uniweb 0.64.1 → 0.65.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.64.1",
+  "version": "0.65.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,17 +41,17 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/runtime": "^0.27.4",
-    "@uniweb/schemas": "^0.4.0",
+    "@uniweb/content-writer": "^0.3.4",
     "@uniweb/core": "^0.29.8",
     "@uniweb/kit": "^0.19.4",
-    "@uniweb/semantic-parser": "^1.4.1",
-    "@uniweb/content-writer": "^0.3.4"
+    "@uniweb/runtime": "^0.27.4",
+    "@uniweb/schemas": "^0.4.0",
+    "@uniweb/semantic-parser": "^1.4.1"
   },
   "peerDependencies": {
-    "@uniweb/semantic-parser": "^1.4.1",
+    "@uniweb/build": "^0.59.1",
     "@uniweb/content-reader": "^1.2.5",
-    "@uniweb/build": "^0.59.1"
+    "@uniweb/semantic-parser": "^1.4.1"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/partials/agents.md

@@ -2527,9 +2527,9 @@ uniweb add ci --target foundation # Publish a foundation for free at permanent v
 
 uniweb push / pull / clone / status   # Git-style content sync with the Uniweb backend
 uniweb refresh / sync                 # Catch up (git + backend, never pushes) / catch up, then push
-uniweb push --org @acme               # First push/publish of a site: who owns it (see below)
+uniweb login --org @acme              # The workspace you work in — new sites are created there (see below)
 uniweb register [--scope @scope]      # Register a foundation + its data schemas to the registry
-uniweb login / logout                 # One backend at a time: log in (--backend <url>) or out
+uniweb login / logout                 # One backend, one workspace at a time: log in (--backend, --org) or out
 uniweb org list / create <handle>     # Your personal scope, and the orgs you belong to
 uniweb content export [dir]           # Package a site (or a built foundation's schema) as .uwx
 
@@ -2573,24 +2573,24 @@ Foundations have their own free path too: `uniweb add ci --target foundation` pu
 
 **Content authors work visually in the Uniweb App.** They compose the same extended markdown and set the same component params you defined, through a visual editor — never touching code, git, or the CLI. They see exactly the section types your foundation offers and exactly the knobs each one exposes, because **every `meta.js` is registered as the foundation's schema** when you publish. Your `meta.js` is the app's UI (see *meta.js* in Part 4).
 
-> ⚠️ **The FIRST push or publish of a site asks who owns it — and refuses if it cannot ask.**
-> That create decides which organization owns the site (and whose storage its assets are billed
-> to), it is the only moment the choice is made, and there is no CLI command to change it
-> afterwards. At a terminal you get a picker. **Without a terminal — CI, a script, or you, an
-> agent — the command exits non-zero instead of choosing**, and `--yes` refuses too, because
-> guessing an owner is not an answer. Name it and it never asks again:
+> ⚠️ **Every push, pull and publish works in ONE workspace — the one chosen at `uniweb login`.**
+> A workspace is your personal one or an organization's. A site a push or publish **creates** is
+> created — owned, and its storage billed — there, and there is no CLI command to move it
+> afterwards. A site the backend keeps in **another** workspace stops the command, which says how
+> to switch. With no organization, the login works in your personal workspace; with
+> organizations, the login asks, or you name it:
 >
 > ```bash
-> uniweb publish --org @acme     # an organization
-> uniweb publish --personal      # your personal account, deliberately
+> uniweb login --org @acme      # work in an organization
+> uniweb login --personal       # work in your personal workspace
+> uniweb push --org @acme       # this command only
 > ```
 >
-> The answer is recorded in `sync.json` and committed, so it is a one-time choice per site,
-> not per machine. **Ask the human which one to use** rather than picking for them — a site in
-> the wrong org cannot be moved from here. Sites that already exist are unaffected: their
-> ownership is settled, so nothing is asked. After the create, every command names the
-> recorded org for you; an `--org` that disagrees with where the backend keeps the site
-> **stops the command** rather than acting in another org.
+> Already logged in, `uniweb login --org @other` switches without logging in again. **Without a
+> terminal — you, an agent — a login with organizations refuses until one is named**, and so
+> does a command when none was. A process logged in with `UNIWEB_TOKEN` names its workspace with
+> `UNIWEB_WORKSPACE=@acme` (or `personal`). **Ask the human which workspace to use** rather than
+> picking for them — a site created in the wrong one cannot be moved from here.
 >
 > Relatedly: these commands now **reject flags they do not recognize** instead of ignoring them.
 > If you get `Unknown flag`, read the suggestion — it is usually a near miss.

package/src/backend/client.js

@@ -148,6 +148,15 @@ export function workspaceHandle(value) {
 
 const UNIT_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 
+/**
+ * A workspace as a sentence names it: `@acme`, `the unit <uuid>`, or `your personal
+ * workspace` — for null, and for a login's stored `personal`.
+ */
+export function describeWorkspace(workspace) {
+  if (!workspace || workspace === 'personal') return 'your personal workspace'
+  return workspace.startsWith('@') ? workspace : `the unit ${workspace}`
+}
+
 /**
  * A workspace as the header names it — `@handle`, or a unit's bare uuid when the unit
  * has no handle — or null for none.
@@ -155,7 +164,7 @@ const UNIT_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
  * ⚠️ A bare value is taken for a uuid only when it is shaped like one, and our own
  * handle grammar admits uuid-shaped handles (3–39 lowercase letters, digits, hyphens).
  * So a HANDLE reaches this already dressed — `--org` through `workspaceHandle`, a
- * record through `readSiteWorkspace` — and a bare uuid here is a unit.
+ * login's choice as stored — and a bare uuid here is a unit.
  *
  * @param {unknown} value
  * @returns {string|null}
@@ -167,34 +176,45 @@ export function workspaceHeader(value) {
 }
 
 /**
- * The request named its workspace EXPLICITLY — `--org`, `--personal`, a choice made at
- * create — and the backend works on the site from another.
+ * The site is in another workspace than the one this command works in.
  *
- * ⛔ Stopping is the point. It is the mismatch check [Diego, 2026-09-22: "there is no org
- * mismatch when the site is set for an org and the user tries a different one"], and it
- * is the backend's `409` that decides it, never a handle comparison here: a site in
- * `@acme/labs` is legitimately worked on from `@acme`. Adopting the answer would override
- * a choice the user made.
+ * ⛔ **Stopping is the point, and nothing is adopted.** A command works in ONE workspace —
+ * the one chosen with the login (`workspace.js`) — and a site outside it is refused, not
+ * worked on anyway *[Diego, 2026-09-23: "that's the intent of the workspace concept"]*.
+ * It is the backend's `409` that decides it, never a handle comparison here: a site in
+ * `@acme/labs` is legitimately worked on from `@acme`. ⚠️ *Until 2026-09-23 a workspace
+ * nobody had named was adopted from the `409` and the request retried.*
  */
 export class WorkspaceMismatchError extends Error {
   /**
-   * @param {{ named: string|null, answer: string|null }} p - the workspace the request
-   *   named, and the one the backend named (`@handle`, null for personal)
+   * @param {{ named: string|null, answer: string|null, source?: string }} p - the
+   *   workspace the request named and the one the backend named (`@handle`, a unit's
+   *   uuid, null for personal), and where the named one came from (`workspace.js`)
    */
-  constructor({ named, answer }) {
+  constructor({ named, answer, source = 'login' }) {
     const where = (w) =>
       !w ? 'your personal workspace' : w.startsWith('@') ? w : `the unit ${w}`
-    const flag = named ? '--org' : '--personal'
-    super(
-      `The backend works on this site from ${where(answer)}, not ${where(named)} ` +
-        `(${named ? `--org ${named}` : flag}). ` +
-        // `--org` takes a handle; a unit without one is reached by naming nothing.
-        (answer?.startsWith('@') ? `Pass --org ${answer}, or drop ${flag}.` : `Drop ${flag}.`)
-    )
+    // How to work in the site's workspace, said for the way this one was chosen.
+    const switchTo = !answer
+      ? { flag: 'pass --personal', env: 'set UNIWEB_WORKSPACE=personal' }
+      : answer.startsWith('@')
+        ? { flag: `pass --org ${answer}`, env: `set UNIWEB_WORKSPACE=${answer}` }
+        : null
+    const login = !answer ? 'uniweb login --personal' : answer.startsWith('@') ? `uniweb login --org ${answer}` : null
+    const fix = !switchTo
+      ? 'It has no handle, so the CLI cannot work in it.'
+      : source === 'flag'
+        ? `To work on it, ${switchTo.flag}.`
+        : source === 'env'
+          ? `To work on it, ${switchTo.env}.`
+          : `To work on it: ${login}`
+    const why = source === 'flag' ? ' (named on this command)' : source === 'env' ? ' (UNIWEB_WORKSPACE)' : ''
+    super(`This site is in ${where(answer)}, and you are working in ${where(named)}${why}. ${fix}`)
     this.name = 'WorkspaceMismatchError'
     this.status = 409
     this.named = named
     this.answer = answer
+    this.source = source
   }
 }
 
@@ -270,8 +290,7 @@ export class BackendClient {
     this._fetch = fetchImpl || ((url, init) => globalThis.fetch(url, init))
     this._discovery = null
     this._workspace = null
-    this._workspaceExplicit = false
-    this._onWorkspaceAdopted = null
+    this._workspaceSource = 'login'
   }
 
   /** The workspace this client's requests name — `@handle`, or null (none named). */
@@ -280,23 +299,19 @@ export class BackendClient {
   }
 
   /**
-   * Name the workspace every request from here on works in (`x-uniweb-workspace`).
+   * Name the workspace every site request from here on works in (`x-uniweb-workspace`)
+   * — the one `resolveWorkspace` answered for this command.
    *
-   * @param {string|null} value - `@acme` / `acme`, a handle-less unit's uuid, or null to
-   *   name none (`workspaceHeader`)
+   * @param {string|null} value - `@acme` / `acme`, a handle-less unit's uuid, or null for
+   *   the personal workspace (`workspaceHeader`)
    * @param {object} [opts]
-   * @param {boolean} [opts.explicit=false] - the user named it (`--org`, `--personal`,
-   *   the create picker). A `409 wrong_workspace` then STOPS the command
-   *   (`WorkspaceMismatchError`) instead of adopting the backend's answer.
-   * @param {(handle: string|null) => void|Promise<void>} [opts.onAdopted] - called when a
-   *   request that named nothing, or a stale workspace, adopts the one the backend named;
-   *   the caller records it (sync.json) and says so
+   * @param {string} [opts.source='login'] - where it came from (`workspace.js`), so a
+   *   refusal says how to switch
    * @returns {this}
    */
-  setWorkspace(value, { explicit = false, onAdopted = null } = {}) {
+  setWorkspace(value, { source = 'login' } = {}) {
     this._workspace = workspaceHeader(value)
-    this._workspaceExplicit = Boolean(explicit)
-    this._onWorkspaceAdopted = onAdopted || null
+    this._workspaceSource = source
     return this
   }
 
@@ -332,9 +347,8 @@ export class BackendClient {
    * applies query params, and infers a content-type from the body when unset
    * (string → application/json, Buffer/Uint8Array → application/zip). Returns
    * the raw Response so callers branch on status themselves (409 resume,
-   * 404 → null, 401/403 messaging, …) — except a `409 wrong_workspace`, which is
-   * answered here: adopted and retried once when the workspace was not named, and
-   * thrown as `WorkspaceMismatchError` when it was (see the body).
+   * 404 → null, 401/403 messaging, …) — except a `409 wrong_workspace`, thrown as
+   * `WorkspaceMismatchError`: the site is in another workspace than this command's.
    *
    * @param {string} path - leading-slash path, e.g. '/dev/site/content'
    * @param {object} [opts]
@@ -349,13 +363,10 @@ export class BackendClient {
     const res = await this._send(path, opts)
     if (res?.status !== 409) return res
 
-    // ⭐ THE WORKSPACE A REQUEST NAMES IS CHECKED BY THE BACKEND, NOT HERE. A request that
-    // names the wrong one for an existing site is refused with `409 wrong_workspace`,
-    // naming a workspace the caller CAN open that contains the site — its own unit, or a
-    // parent the caller belongs to. Two answers, and which one depends on the user:
-    //   - they named it (`--org`, `--personal`) → stop and say so: the mismatch check;
-    //   - they named nothing, or a stale one → adopt the backend's answer, let the caller
-    //     record it, and retry ONCE.
+    // ⭐ THE WORKSPACE A REQUEST NAMES IS CHECKED BY THE BACKEND, NOT HERE. A request whose
+    // workspace does not contain the site is refused with `409 wrong_workspace`, naming a
+    // workspace the caller CAN open that does — the site's own unit, or a parent. The
+    // command works in one workspace, so this stops it (`WorkspaceMismatchError`).
     // ⛔ No handle comparison anywhere: a site in `@acme/labs` is worked on from `@acme`.
     const problem =
       typeof res.clone === 'function' ? await res.clone().json().catch(() => null) : null
@@ -367,15 +378,14 @@ export class BackendClient {
       : typeof where.unit_uuid === 'string' && where.unit_uuid
         ? where.unit_uuid
         : null
-    // Naming what the backend names and still refused: nothing to adopt, or to report
-    // as a mismatch. The caller reads the 409 like any other.
+    // Refused while naming what the backend names: nothing to switch to; the caller reads
+    // the 409 like any other.
     if (answer === this._workspace) return res
-    if (this._workspaceExplicit) {
-      throw new WorkspaceMismatchError({ named: this._workspace, answer })
-    }
-    this._workspace = answer
-    if (this._onWorkspaceAdopted) await this._onWorkspaceAdopted(answer)
-    return this._send(path, opts)
+    throw new WorkspaceMismatchError({
+      named: this._workspace,
+      answer,
+      source: this._workspaceSource
+    })
   }
 
   /** One request, as `request` documents it — naming the client's workspace on a site route. */
@@ -571,7 +581,7 @@ export class BackendClient {
 
   /** GET /dev/orgs → { account_handle, orgs[] }. */
   async fetchOrgs() {
-    return fetchOrgsImpl({ apiBase: this.origin, token: await this.token() })
+    return fetchOrgsImpl({ apiBase: this.origin, token: await this.token(), fetchImpl: this._fetch })
   }
 
   /** POST /dev/orgs { handle } → { handle, uuid, is_primary }. Throws with the server's detail on 409/422. */

package/src/backend/site-sync.js

@@ -19,6 +19,7 @@ import { humanBytes } from '../utils/bytes.js'
 import { isAuthoredPreview } from '../utils/preview.js'
 import {
   describeRequestError,
+  describeWorkspace,
   WorkspaceMismatchError,
   workspaceHandle,
   workspaceHeader
@@ -652,21 +653,19 @@ export function writeItemUuids(siteDir, backend, map) {
 }
 
 /**
- * The workspace this project's requests name on `backend`, as the header names it —
- * `@handle`, or a unit's bare uuid when that unit has no handle — or null for none.
+ * The workspace this site was created in on `backend` — its owner, as the create
+ * answered it — in the header's form: `@handle`, a unit's bare uuid when that unit has
+ * no handle, or null for the personal workspace (or no record).
  *
- * Read back from `backend`'s section of `sync.json`: `site.org` holds a handle, stored
- * bare and re-dressed with its `@`; `site.unit` holds a unit's uuid, for a workspace
- * that has no handle. At most one is set (`writeSiteWorkspace`). ⛔ They are two keys
- * because the `@` is the only thing telling the two apart — our own handle grammar
- * admits a uuid-shaped handle — and a bare value at rest has lost it.
+ * ⭐ A RECORD, NOT A ROUTE (2026-09-23). A command works in the workspace chosen with the
+ * login (`workspace.js`); this says where the site was made, and routes nothing. (Until
+ * then it was the workspace every request named, adopted from a `409` when stale.)
  *
- * Recorded at create — the site's owner — or adopted later from a backend's `409
- * wrong_workspace`, which may name a PARENT workspace that contains the site rather
- * than the site's own unit. ⇒ It is "the workspace these requests name", never
- * printed as "the site's org".
- *
- * Deliberately NOT a fallback for the flag: an explicit `--org` always wins.
+ * Read from `backend`'s section of `sync.json`: `site.org` holds a handle, stored bare
+ * and re-dressed with its `@`; `site.unit` holds a unit's uuid. At most one is set
+ * (`writeSiteWorkspace`). ⛔ Two keys, because the `@` is the only thing telling the two
+ * apart — our own handle grammar admits a uuid-shaped handle — and a bare value at rest
+ * has lost it.
  *
  * @param {string} siteDir
  * @param {string} backend - the origin whose record to read
@@ -681,10 +680,10 @@ export function readSiteWorkspace(siteDir, backend) {
 }
 
 /**
- * Record the workspace this project's requests name on `backend` — a handle in
- * `site.org` (bare), a handle-less unit in `site.unit`, clearing the other; null
- * clears both (the personal workspace, named by naming none). Returns what was
- * recorded, in the header's form.
+ * Record the workspace this site was created in on `backend` — a handle in `site.org`
+ * (bare), a handle-less unit in `site.unit`, clearing the other; null clears both (the
+ * personal workspace, named by naming none). Returns what was recorded, in the header's
+ * form.
  *
  * @param {string} siteDir
  * @param {string} backend
@@ -702,50 +701,6 @@ function writeSiteWorkspace(siteDir, backend, workspace) {
   return w
 }
 
-/** A workspace as a sentence names it: `@acme`, `the unit <uuid>`, or `your personal workspace`. */
-export function describeWorkspace(workspace) {
-  if (!workspace) return 'your personal workspace'
-  return workspace.startsWith('@') ? workspace : `the unit ${workspace}`
-}
-
-/**
- * Point `client` at the workspace this project's requests name — `x-uniweb-workspace`.
- *
- * ⭐ THE WORKSPACE IS PER PROJECT, per backend — the one `sync.json` recorded — never
- * per login: a login is one session for the whole machine (`utils/session-file.js`).
- * An explicit choice (`--org`, `--personal`, the create picker) is sent as named, and
- * a `409 wrong_workspace` then STOPS the command. Otherwise the client adopts the
- * workspace the backend names, and this records it — as-is, since it may be a parent
- * workspace, or a unit with no handle — and says so. (`client.js::request`; agreed
- * with backend 2026-09-23.)
- *
- * @param {import('./client.js').BackendClient} client
- * @param {object} p
- * @param {string} p.siteDir
- * @param {string|null} p.workspace - in the header's form (`readSiteWorkspace`, or
- *   `workspaceHandle(--org)`), or null to name none
- * @param {boolean} [p.explicit=false]
- * @param {(m: string) => void} [p.note]
- * @returns {import('./client.js').BackendClient}
- */
-export function nameSiteWorkspace(client, { siteDir, workspace, explicit = false, note }) {
-  return client.setWorkspace(workspace, {
-    explicit,
-    onAdopted: (adopted) => {
-      try {
-        writeSiteWorkspace(siteDir, client.origin, adopted)
-      } catch {
-        // Recording is a convenience for the next command; this one still retries.
-      }
-      note?.(
-        adopted
-          ? `Requests for this site now name ${describeWorkspace(adopted)}, the workspace the backend works on it from (recorded in sync.json).`
-          : 'Requests for this site now name no workspace — the backend works on it from your personal one (recorded in sync.json).'
-      )
-    }
-  })
-}
-
 /**
  * Record the workspace a just-minted site was created under.
  *
@@ -768,173 +723,6 @@ function recordSiteWorkspace(siteDir, backend, owner) {
   }
 }
 
-/**
- * The `source`s of `resolveSiteOrgForCreate` that are the user's OWN choice — named on
- * the command line or picked — and so explicit: a `409 wrong_workspace` for one stops
- * the command rather than adopting the backend's answer (`nameSiteWorkspace`).
- */
-export const EXPLICIT_OWNER = new Set(['flag', 'personal', 'picked'])
-
-/**
- * Resolve WHICH ORG will own a site that is about to be created.
- *
- * The create that mints the site's uuid takes its owner from the workspace the request
- * names (`x-uniweb-workspace`), and the backend never moves ownership afterwards. There is also no CLI verb to transfer
- * or delete a site. So this is a **one-shot, unrepealable** decision — and until
- * this function existed the CLI made it silently, by sending nothing and letting
- * the backend fall back to the session's personal context. A developer who belongs
- * to several orgs could put a company site, and the storage it bills, somewhere
- * they never named.
- *
- * `register` resolves a foundation's scope in the same order — recorded (the scope
- * in its name, `@acme/marketing` in main.js), else explicit (`--scope`), else derived
- * (`deriveScope`) — with one difference: non-interactive, it takes your personal
- * scope and says so. This refuses instead, because a site's owner is the one-shot
- * decision above, and a scope is only a namespace (2026-09-23). ⭐ And the two are
- * separate decisions: a foundation may be registered under any org its author
- * belongs to, whoever owns the site (2026-09-22) — a site's `@/x` refs take the
- * FOUNDATION's scope, never this one. ⚠️ Until 2026-09-21 this said
- * `register` "has refused to guess a scope", which is wrong for a non-interactive
- * run by anyone with an org.
- *
- * Order:
- *   1. `--org @org`         — explicit; the create names it as its workspace
- *   2. `--personal`         — explicit "no org, I mean it" → names NO workspace
- *   3. the recorded org     — `sync.json`, written at this site's own create
- *   4. the site already exists on this backend (a recorded uuid) → null; ownership
- *      is settled, ask nothing
- *   5. otherwise ASK (TTY) or REFUSE (non-interactive)
- *
- * ⛔ **`--personal` names no workspace, and is NOT the same as `--org @<handle>`.**
- * The personal *org* `@jane` is an org like any other, lazily created on first use;
- * the session's personal workspace is not an org at all. Whether the backend gives
- * them the same owning unit is **its** business and unverified here, so the
- * deliberate-personal spelling names nothing rather than asserting an equivalence
- * this lane cannot check.
- *
- * @returns {Promise<{ workspace: string|null, source?: string, refused?: true, reason?: string }>}
- *   `workspace: null` with no `refused` means "name no workspace" — either a settled site
- *   or a deliberate personal choice. `source` says which answer it is: `flag`,
- *   `personal` and `picked` are the user's own choice (explicit — a mismatch then
- *   stops the command); `recorded`, `existing` and `offline` are not.
- */
-export async function resolveSiteOrgForCreate({
-  client,
-  siteDir,
-  args = [],
-  flag,
-  personal = false,
-  offline = false
-}) {
-  if (flag) return { workspace: workspaceHandle(flag), source: 'flag' }
-  if (personal) return { workspace: null, source: 'personal' }
-
-  const recorded = readSiteWorkspace(siteDir, client?.origin)
-  if (recorded) return { workspace: recorded, source: 'recorded' }
-
-  // Already created ⇒ nothing to decide: ownership was settled at its create and
-  // re-asking would be theatre. ⭐ "Created" is a question about THIS backend now —
-  // the same project may be brand new on one and long-established on another.
-  if (readBackendState(siteDir, client?.origin).site?.uuid) return { workspace: null, source: 'existing' }
-
-  // An offline preview (`--dry-run` / `-o`) must never authenticate, and it is
-  // creating nothing, so there is no decision to force. Say what is unresolved
-  // instead of prompting for an answer the run will not use.
-  if (offline) return { workspace: null, source: 'offline' }
-
-  // `--yes` promises "never block on a prompt", so it has to answer this one too —
-  // and the only honest non-blocking answer to an unanswerable ownership question
-  // is a refusal. Treating it as consent-to-anything would reinstate the silent
-  // default this whole path exists to remove, behind a flag that reads like
-  // approval.
-  const { isNonInteractive } = await import('../utils/interactive.js')
-  if (isNonInteractive(args) || args.includes('--yes')) {
-    return {
-      workspace: null,
-      refused: true,
-      reason:
-        'This site does not exist on the backend yet, and no org was named.\n' +
-        '  The create decides who OWNS it — and which workspace its storage is billed to —\n' +
-        '  one time, with no CLI way to change it afterwards. Name it explicitly:\n' +
-        '    --org @org        create it under an organization\n' +
-        '    --personal        create it under your personal account, deliberately'
-    }
-  }
-
-  // Interactive: offer the real choice. Deliberately NOT `deriveScope` — that one picks
-  // a NAMESPACE for a foundation, where `@<your handle>` is your personal scope. Here
-  // the answer is an OWNER: your personal workspace (named by naming none) or an org.
-  const { fetchOrgs, createOrg, validateHandle, bareHandle } =
-    await import('../utils/registry-orgs.js')
-  let envelope
-  try {
-    envelope = await fetchOrgs({
-      apiBase: client.origin,
-      token: await client.token()
-    })
-  } catch (err) {
-    return { workspace: null, refused: true, reason: err.message }
-  }
-  const personalHandle = envelope.account_handle || null
-  const prompts = (await import('prompts')).default
-  const choices = [
-    ...envelope.orgs.map((o) => ({
-      title: `@${o.handle}${o.handle === personalHandle ? ' — your personal org' : o.is_primary ? ' (primary)' : ''}`,
-      value: o.handle
-    })),
-    {
-      title: `Personal — no organization${personalHandle ? ` (${personalHandle})` : ''}`,
-      value: ':personal'
-    },
-    { title: 'A new organization…', value: ':new' }
-  ]
-  const { choice } = await prompts(
-    {
-      type: 'select',
-      name: 'choice',
-      message: 'Create this site under which owner?',
-      choices,
-      initial: 0
-    },
-    {
-      onCancel: () => {
-        console.log('\nCancelled.')
-        process.exit(0)
-      }
-    }
-  )
-  if (!choice) return { workspace: null, refused: true, reason: 'No owner chosen.' }
-  if (choice === ':personal') return { workspace: null, source: 'picked' }
-  if (choice !== ':new') return { workspace: `@${choice}`, source: 'picked' }
-
-  const answer = await prompts(
-    {
-      type: 'text',
-      name: 'handle',
-      message: 'Org handle (e.g. acme):',
-      validate: (v) => validateHandle(v) || true
-    },
-    {
-      onCancel: () => {
-        console.log('\nCancelled.')
-        process.exit(0)
-      }
-    }
-  )
-  if (!answer.handle)
-    return { workspace: null, refused: true, reason: 'No org handle given.' }
-  try {
-    const org = await createOrg({
-      apiBase: client.origin,
-      token: await client.token(),
-      handle: bareHandle(answer.handle)
-    })
-    return { workspace: `@${org.handle}`, source: 'picked' }
-  } catch (err) {
-    return { workspace: null, refused: true, reason: err.message }
-  }
-}
-
 /**
  * Turn a typed site-create refusal into a sentence, or null to fall through to the
  * generic HTTP line.
@@ -1048,7 +836,7 @@ export async function ensureSiteExists({
 
   let res
   try {
-    // The owner is the workspace the client names — `nameSiteWorkspace` set it.
+    // The owner is the workspace the client names — the command's (`workspace.js`).
     res = await client.createSite({
       name: siteName,
       foundation: siteFoundation