uniweb 0.64.0 → 0.65.0

package/src/index.js

@@ -1456,15 +1456,10 @@ ${colors.bright}Options:${colors.reset}
                      bind to, and the app cannot open such a site.
   --no-save          Do not record this deploy in deploy.yml
   --no-validate      Skip the content-conformance check (it only warns)
-  --org @org         Publish under @org (membership-gated). On a site's FIRST
-                     publish it decides which org owns the site, and whose storage
-                     its assets are charged to. Recorded in sync.json and named on
-                     every request after, so it is never re-typed. Without it, you
-                     are asked once. Later, it must match the workspace the backend
-                     works on the site from, or publish stops.
-  --personal         Create the site under your personal account, deliberately.
-                     Only needed on a first publish, and only to answer the owner
-                     question without a prompt (CI, agents, scripts).
+  --org @org         Work in @org for this publish, instead of the workspace
+  --personal         chosen at \`uniweb login\` (or your personal workspace). A
+                     site this publish creates is created — owned — there, and a
+                     site the backend keeps in another workspace stops it.
 `,
     create: `
 ${colors.cyan}${colors.bright}uniweb create${colors.reset} ${colors.dim}— Create a new project${colors.reset}
@@ -1793,16 +1788,26 @@ does nothing; add --password, --browser, --token-paste or --token to log in agai
 Without --backend: https://uniweb.app (or \$UNIWEB_REGISTER_URL). No command talks
 to a backend you are not logged in to — run one before logging in and it asks first.
 
+${colors.bright}The workspace you work in.${colors.reset} A login works in ONE workspace — your
+personal one, or an organization's — and every push, pull and publish works in it:
+a site it creates is created there, and a site kept in another workspace is refused.
+With no organization it is your personal workspace; with organizations you are asked,
+or name it. Already logged in, \`uniweb login --org @other\` switches without logging
+in again.
+
 ${colors.bright}Options:${colors.reset}
   --backend <url>    The backend to log in to
+  --org @org         Work in @org (an organization you belong to)
+  --personal         Work in your personal workspace
   --token <bearer>   Seed + verify a session from a bearer token (non-interactive)
   --browser          Force the browser method
   --password         Force the username/password method
   --token-paste      Force the paste-a-token prompt
 
-In non-interactive mode (CI / no TTY), pass \`--token <bearer>\`, or set
-\`UNIWEB_USERNAME\` + \`UNIWEB_PASSWORD\`, or set \`UNIWEB_TOKEN\` (used per-command,
-not stored). \`uniweb logout\` logs you out.
+In non-interactive mode (no TTY — an agent, a script), pass \`--token <bearer>\` with
+\`--org @org\` or \`--personal\`, or set \`UNIWEB_USERNAME\` + \`UNIWEB_PASSWORD\`, or set
+\`UNIWEB_TOKEN\` (per process, not stored) with \`UNIWEB_WORKSPACE=@org\` or \`personal\`.
+\`uniweb logout\` logs you out.
 `,
     refresh: `
 ${colors.cyan}${colors.bright}uniweb refresh${colors.reset} ${colors.dim}— Catch up with teammates AND app authors${colors.reset}
@@ -2082,8 +2087,8 @@ ${colors.bright}Publish Options:${colors.reset}
   --dry-run          Resolve everything; release/sync/POST nothing
   --yes              Skip confirmations (CI); never block on a prompt
   --no-release       Ship content against the already-released code; release nothing
-  --org @org         Publish under @org (first publish only; then remembered)
-  --personal         Own the new site personally, deliberately (first publish only)
+  --org @org         Work in @org for this publish, not your login's workspace
+  --personal         Work in your personal workspace for this publish
   --no-save          Do not record this deploy in deploy.yml
   --no-validate      Skip the content-conformance check (it only warns)
 

package/src/utils/flag-guard.js

@@ -79,15 +79,17 @@ const VERBS = {
     '--no-assets',
     '--no-records', '--no-delete', '--no-prune',
     // via backend/site-sync.js (the owner resolver) and utils/conformance.js
-    '--yes', '--org', '--no-validate', ...VIA_DEPLOY
+    '--yes', '--org', '--personal', '--no-validate', ...VIA_DEPLOY
   ],
   clone: [
     '--content-only', '--no-assets', '--no-records', '--path',
-    '--project', '--org'
+    '--project', '--org', '--personal'
   ],
   register: [
     '--dry-run', '--json', '--output', '-o',
-    '--schema-only', '--scope', '--org'
+    '--schema-only', '--scope', '--org',
+    // reach the login a register may trigger, which chooses the workspace it works in
+    '--personal'
   ],
   /**
    * `forget` = remove one backend's records (`--backend <url>`), or everything a
@@ -98,7 +100,7 @@ const VERBS = {
   forget: ['--backend', '--all'],
   status: [
     '--json', '--remote', '--dry-run',
-    '--force', '--no-verify', '--no-validate', '--yes', '--org',
+    '--force', '--no-verify', '--no-validate', '--yes', '--org', '--personal',
     // inert here, reachable through the bring-along module status imports for
     // `resolveLocalFoundation` — listed per the over-approximation note above
     '--no-release', ...VIA_DEPLOY
@@ -118,7 +120,7 @@ const VERBS = {
    */
   refresh: [
     '--no-backend', '--no-git',
-    '--org', '--dry-run', '--no-validate', '--yes', ...VIA_DEPLOY
+    '--org', '--personal', '--dry-run', '--no-validate', '--yes', ...VIA_DEPLOY
   ]
 }
 

package/src/utils/registry-auth.js

@@ -49,6 +49,7 @@ import { createServer } from 'node:http'
 import { randomBytes } from 'node:crypto'
 
 import { DEFAULT_BACKEND_ORIGIN } from './config.js'
+import { readOrgFlag } from './args.js'
 import { normalizeSessionFile, sessionFilePath, loggedInOriginOf } from './session-file.js'
 
 const LOGIN_PATH = '/dev/auth/login'
@@ -641,6 +642,36 @@ async function loginViaBrowser({ apiBase }) {
   return record
 }
 
+/**
+ * Choose the WORKSPACE this login works in, and store it with the session.
+ *
+ * ⭐ A login works in one workspace *[Diego, 2026-09-23: "at login, it can be mandatory to
+ * specify which workspace"]* — `--org @acme` / `--personal`, else your personal workspace
+ * when you belong to no organization, else a pick at a terminal. Without one (no
+ * terminal, organizations, no flag) the login stays and this says how to choose; every
+ * command refuses until one is chosen (`backend/workspace.js`).
+ *
+ * @param {object} record - the session just stored (`token`, `origin`, …)
+ * @param {string[]} args
+ * @returns {Promise<{ record: object, refused?: string }>}
+ */
+async function settleWorkspace(record, args) {
+  const { chooseWorkspace } = await import('../backend/workspace.js')
+  const pick = await chooseWorkspace({ apiBase: record.origin, token: record.token, args })
+  if (pick.refused) return { record, refused: pick.reason }
+  if (pick.note) console.error(`\x1b[2m${pick.note}\x1b[0m`)
+  const next = { ...record, workspace: pick.choice }
+  await writeRegistryAuth(next)
+  return { record: next }
+}
+
+/** ` · working in @acme` — the tail of a login line. */
+async function workspaceTail(record) {
+  if (!record?.workspace) return ''
+  const { describeWorkspace } = await import('../backend/workspace.js')
+  return `, working in \x1b[1m${describeWorkspace(record.workspace)}\x1b[0m`
+}
+
 /**
  * `uniweb login` against the new backend — a multi-method picker:
  *   browser/social (default, once available) · username+password · paste a token.
@@ -675,19 +706,37 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
       existing.handle ||
       (existing.uuid ? `account ${existing.uuid}` : '')
     if (!forced) {
-      // Already logged in to this backend: nothing to do — logging in again is behind a
-      // method flag. (Also where a file from before sessions were single, holding this
-      // backend among others, becomes single: the rewrite keeps only this session.)
+      // Already logged in to this backend: nothing to re-authenticate — logging in again is
+      // behind a method flag. (Also where a file from before sessions were single, holding
+      // this backend among others, becomes single: the rewrite keeps only this session.)
+      let session = { ...existing, origin: key }
       if (current !== key || Object.keys(file.sessions).length > 1) {
-        await writeRegistryAuth({ ...existing, origin: key })
+        await writeRegistryAuth(session)
+      }
+      // ⭐ SWITCHING WORKSPACE NEEDS NO NEW LOGIN: `--org @x` / `--personal` on a valid
+      // session just changes the workspace it works in. One with none chosen yet (a
+      // session from before workspaces) is asked now.
+      const wants = readOrgFlag(args) || args.includes('--personal')
+      if (wants || !session.workspace) {
+        const settled = await settleWorkspace(session, args)
+        if (settled.refused) {
+          console.error(`\x1b[32m✓\x1b[0m Logged in to ${key}${who ? ` as \x1b[1m${who}\x1b[0m` : ''}.`)
+          console.error(`\x1b[31m✗\x1b[0m ${settled.refused}`)
+          process.exit(2)
+        }
+        session = settled.record
+        if (wants) {
+          console.error(`\x1b[32m✓\x1b[0m Now working in ${(await workspaceTail(session)).replace(/^, working in /, '')} (${key}).`)
+          return session
+        }
       }
       console.error(
-        `\x1b[32m✓\x1b[0m Already logged in to ${key}${who ? ` as \x1b[1m${who}\x1b[0m` : ''}.`
+        `\x1b[32m✓\x1b[0m Already logged in to ${key}${who ? ` as \x1b[1m${who}\x1b[0m` : ''}${await workspaceTail(session)}.`
       )
       console.error(
-        '\x1b[2mTo log in again, name a method: --password, --browser, --token-paste or --token <bearer>.\x1b[0m'
+        '\x1b[2mSwitch workspace: --org @acme or --personal. To log in again, name a method: --password, --browser, --token-paste or --token <bearer>.\x1b[0m'
       )
-      return { ...existing, origin: key }
+      return session
     }
     console.error(
       `Already logged in${who ? ` as \x1b[1m${who}\x1b[0m` : ''} (${key}) — logging in again replaces that session.\n`
@@ -720,10 +769,7 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
     if (account?.username) record.username = account.username
     if (account?.handle) record.handle = account.handle
     await writeRegistryAuth(record)
-    console.error(
-      `\x1b[32m✓\x1b[0m Logged in${account?.username ? ` as \x1b[1m${account.username}\x1b[0m` : ''}${apiBase ? ` (${apiBase})` : ''}`
-    )
-    return record
+    return finishLogin(record, apiBase, args)
   }
 
   let method = args.includes('--browser')
@@ -787,10 +833,23 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
     process.exit(1)
   }
 
-  if (record?.token) {
-    console.error(
-      `\x1b[32m✓\x1b[0m Logged in${record.username ? ` as \x1b[1m${record.username}\x1b[0m` : ''}${apiBase ? ` (${apiBase})` : ''}`
-    )
+  if (!record?.token) return record
+  return finishLogin({ ...record, origin: record.origin || normOrigin(apiBase) }, apiBase, args)
+}
+
+/**
+ * A login succeeded and its session is stored: choose its workspace, and say where the
+ * login works. Without a workspace (no terminal, organizations, no flag) the session
+ * stays, the reason is printed, and the login exits 2 — every command would refuse.
+ */
+async function finishLogin(record, apiBase, args) {
+  const settled = await settleWorkspace(record, args)
+  const who = settled.record.username ? ` as \x1b[1m${settled.record.username}\x1b[0m` : ''
+  if (settled.refused) {
+    console.error(`\x1b[32m✓\x1b[0m Logged in${who} (${apiBase}).`)
+    console.error(`\x1b[31m✗\x1b[0m ${settled.refused}`)
+    process.exit(2)
   }
-  return record
+  console.error(`\x1b[32m✓\x1b[0m Logged in${who} (${apiBase})${await workspaceTail(settled.record)}.`)
+  return settled.record
 }

package/src/utils/registry-orgs.js

@@ -99,8 +99,8 @@ export function validateHandle(handle) {
  * personal org already exists.
  * @returns {Promise<{account_handle: string|null, orgs: Array<{handle: string, is_primary: boolean}>}>}
  */
-export async function fetchOrgs({ apiBase, token }) {
-  const res = await fetch(`${apiBase.replace(/\/$/, '')}${ORGS_PATH}`, {
+export async function fetchOrgs({ apiBase, token, fetchImpl = globalThis.fetch }) {
+  const res = await fetchImpl(`${apiBase.replace(/\/$/, '')}${ORGS_PATH}`, {
     headers: { Authorization: `Bearer ${token}` }
   })
   if (!res.ok)