uniweb 0.64.1 → 0.65.0

package/src/backend/workspace.js

@@ -0,0 +1,199 @@
+/**
+ * THE WORKSPACE A COMMAND WORKS IN — one at a time, chosen with the login.
+ *
+ * ⭐ **[Diego, 2026-09-23]** — *"when a user has workspace in the backend, I expected them
+ * to explicitly login into one"*, and a site the backend keeps in ANOTHER workspace is
+ * refused rather than worked on anyway: *"that's the intent of the workspace concept."*
+ * The app keeps one workspace per tab; the CLI keeps one per login, and every site
+ * request names it (`x-uniweb-workspace`, `client.js`). A site outside it answers `409
+ * wrong_workspace`, and the command stops, saying how to switch — nothing is adopted.
+ *
+ * Where a command's workspace comes from — the first answer wins:
+ *
+ *   1. `--org @acme` / `--personal`     this command only
+ *   2. `UNIWEB_WORKSPACE=@acme|personal` a process logged in with `UNIWEB_TOKEN`, which has
+ *                                        no `uniweb login` to choose one (a template
+ *                                        installer, an agent driving several backends)
+ *   3. the one chosen at `uniweb login`  the session's
+ *   4. none chosen                       your personal workspace when you belong to no
+ *                                        organization; otherwise refused, naming 1–3
+ *
+ * New sites are created in it: a create names the workspace, and the workspace is the
+ * site's owner.
+ *
+ * ⛔ **The personal workspace is named by naming NONE.** `@<your handle>` is your personal
+ * SCOPE — a registry namespace for foundations and data schemas — not a workspace.
+ */
+
+import { readOrgFlag } from '../utils/args.js'
+import { fetchOrgs } from '../utils/registry-orgs.js'
+import { readRegistryAuth } from '../utils/registry-auth.js'
+import { workspaceHandle, describeWorkspace } from './client.js'
+
+export { describeWorkspace }
+
+/** The personal workspace, as a login stores the choice (a handle is stored with its `@`). */
+export const PERSONAL = 'personal'
+
+/** Names a process's workspace when it is logged in with `UNIWEB_TOKEN`. */
+export const WORKSPACE_ENV = 'UNIWEB_WORKSPACE'
+
+/**
+ * A workspace choice as it may be written — `@acme`, `acme`, `personal` — or null when
+ * the value names none.
+ *
+ * @param {unknown} value
+ * @returns {string|null} `@acme`, `PERSONAL`, or null
+ */
+export function parseWorkspaceChoice(value) {
+  if (typeof value !== 'string' || !value.trim()) return null
+  const v = value.trim()
+  return v === PERSONAL ? PERSONAL : workspaceHandle(v)
+}
+
+/** A choice in the header's form: `@acme`, or null for the personal workspace. */
+export function headerOf(choice) {
+  return choice === PERSONAL ? null : choice
+}
+
+/** What a source is called in a sentence — "(… )" after the workspace. */
+export const SOURCE_LABEL = {
+  flag: 'named on this command',
+  env: WORKSPACE_ENV,
+  login: 'your login',
+  personal: 'you belong to no organization',
+  offline: 'not resolved in a preview'
+}
+
+const CHOOSE = [
+  'Choose the workspace you work in:',
+  '    uniweb login --org @acme      (or --personal) — for every command after',
+  '    --org @acme / --personal      — for this command only',
+  `    ${WORKSPACE_ENV}=@acme        — for a process logged in with UNIWEB_TOKEN`
+].join('\n')
+
+/**
+ * The workspace this command works in.
+ *
+ * @param {object} p
+ * @param {import('./client.js').BackendClient} p.client - its origin and token
+ * @param {string[]} [p.args]
+ * @param {boolean} [p.offline=false] - a preview (`--dry-run`, `-o`): never authenticates,
+ *   so step 4 answers "not resolved" instead of asking the backend
+ * @returns {Promise<{ workspace: string|null, source: string } | { refused: true, reason: string }>}
+ *   `workspace` in the header's form — `@acme`, or null for the personal workspace
+ */
+export async function resolveWorkspace({ client, args = [], offline = false }) {
+  const flag = readOrgFlag(args)
+  if (flag) return { workspace: workspaceHandle(flag), source: 'flag' }
+  if (args.includes('--personal')) return { workspace: null, source: 'flag' }
+
+  const raw = process.env[WORKSPACE_ENV]
+  if (raw !== undefined && raw !== '') {
+    const env = parseWorkspaceChoice(raw)
+    if (!env) {
+      return {
+        refused: true,
+        reason: `${WORKSPACE_ENV}=${JSON.stringify(raw)} names no workspace — give @org, or ${PERSONAL}.`
+      }
+    }
+    return { workspace: headerOf(env), source: 'env' }
+  }
+
+  // ⛔ A process logged in with UNIWEB_TOKEN is not the session's login: the token may be
+  // another account's, so the session's workspace is not its to use.
+  const useSession = !process.env.UNIWEB_TOKEN
+  const fromSession = async () =>
+    useSession ? parseWorkspaceChoice((await readRegistryAuth(client.origin))?.workspace) : null
+
+  const chosen = await fromSession()
+  if (chosen) return { workspace: headerOf(chosen), source: 'login' }
+  if (offline) return { workspace: null, source: 'offline' }
+
+  // Authenticate — a login this triggers chooses a workspace, so ask the session again.
+  await client.token()
+  const now = await fromSession()
+  if (now) return { workspace: headerOf(now), source: 'login' }
+
+  const { orgs } = await client.fetchOrgs()
+  if (!orgs.length) return { workspace: null, source: 'personal' }
+  return {
+    refused: true,
+    reason: `You belong to organizations, so no workspace is assumed.\n  ${CHOOSE}`
+  }
+}
+
+/**
+ * The workspace a login works in — asked once, at `uniweb login`, and stored with the
+ * session.
+ *
+ *   `--org @acme`            must be an organization you belong to
+ *   `--personal`             your personal workspace
+ *   neither, no organization your personal workspace — said, not asked
+ *   neither, organizations   a pick at a terminal; refused without one
+ *
+ * @param {object} p
+ * @param {string} p.apiBase
+ * @param {string} p.token
+ * @param {string[]} [p.args]
+ * @returns {Promise<{ choice: string, note?: string } | { refused: true, reason: string }>}
+ *   `choice` is `@acme` or `PERSONAL`
+ */
+export async function chooseWorkspace({ apiBase, token, args = [] }) {
+  const flag = readOrgFlag(args)
+  if (!flag && args.includes('--personal')) return { choice: PERSONAL }
+
+  const { orgs } = await fetchOrgs({ apiBase, token })
+  const mine = orgs.map((o) => `@${o.handle}`)
+  if (flag) {
+    const h = workspaceHandle(flag)
+    if (!mine.includes(h)) {
+      return {
+        refused: true,
+        reason:
+          `You are not a member of ${h} on ${apiBase}. ` +
+          (mine.length
+            ? `Your workspaces: ${[...mine, `--personal`].join(', ')}.`
+            : 'You belong to no organization — use --personal.')
+      }
+    }
+    return { choice: h }
+  }
+  if (!orgs.length) {
+    return {
+      choice: PERSONAL,
+      note: 'You belong to no organization, so you work in your personal workspace.'
+    }
+  }
+
+  const { isNonInteractive } = await import('../utils/interactive.js')
+  if (isNonInteractive(args)) {
+    return {
+      refused: true,
+      reason: `You belong to organizations — name the workspace you work in: ${[...mine, '--personal'].map((w) => (w.startsWith('@') ? `--org ${w}` : w)).join(' | ')}.`
+    }
+  }
+  const prompts = (await import('prompts')).default
+  const { choice } = await prompts(
+    {
+      type: 'select',
+      name: 'choice',
+      message: 'Which workspace do you work in?',
+      choices: [
+        { title: 'Personal — your own sites', value: PERSONAL },
+        ...orgs.map((o) => ({
+          title: `@${o.handle}${o.is_primary ? ' (primary)' : ''}`,
+          value: `@${o.handle}`
+        }))
+      ],
+      initial: 0
+    },
+    {
+      onCancel: () => {
+        console.error('\nCancelled.')
+        process.exit(0)
+      }
+    }
+  )
+  return choice ? { choice } : { refused: true, reason: 'No workspace chosen.' }
+}

package/src/commands/clone.js

@@ -39,10 +39,9 @@
  *   uniweb clone <uuid> --path sites     Place under sites/ (segregated layout)
  *   uniweb clone <uuid> --project docs   Co-located docs/site
  *   uniweb clone <uuid> --no-records Pull pages only; skip records
- *   uniweb clone <uuid> --org @org       Read it as @org — stops if the backend works on
- *                                        the site from another workspace. Without it,
- *                                        the one the backend names is recorded in
- *                                        sync.json for every command after.
+ *   uniweb clone <uuid> --org @org       Work in @org for this clone, instead of the
+ *                                        workspace chosen at `uniweb login`. A site in
+ *                                        another workspace stops it.
  *
  * Backend: via BackendClient (the site-content pull lane). Origin from
  *   UNIWEB_REGISTER_URL  >  the local default (internal dev overrides;
@@ -59,13 +58,8 @@ import { resolvePlacement, SITE_KIND } from '../utils/placement.js'
 import { findWorkspaceRoot } from '../utils/workspace.js'
 import { addWorkspaceGlob } from '../utils/config.js'
 import { detectWorkspacePm, installCmd } from '../utils/pm.js'
-import {
-  BackendClient,
-  describeRequestError,
-  refusalDetail,
-  workspaceHandle
-} from '../backend/client.js'
-import { readOrgFlag } from '../utils/args.js'
+import { BackendClient, describeRequestError, refusalDetail } from '../backend/client.js'
+import { resolveWorkspace } from '../backend/workspace.js'
 import { isNonInteractive, getCliPrefix } from '../utils/interactive.js'
 import { extractFoundationRef } from '../utils/site-content-refs.js'
 import { readUwxDocuments } from '../utils/uwx-read.js'
@@ -153,7 +147,7 @@ export function extractCloneSeeds(document) {
 // `site.yml`'s equivalent needed a hand-rolled dependency-free WRITER for exactly
 // this. The store stays the one writer everywhere else; this seeds a fresh file.
 // `test/clone.test.js` covers it end to end with `skipInstall: true`.
-function seedSyncJson(siteDir, origin, uuid, workspace = null) {
+function seedSyncJson(siteDir, origin, uuid) {
   const file = join(siteDir, 'sync.json')
   let doc = { version: 1, backends: {} }
   if (existsSync(file)) {
@@ -165,19 +159,11 @@ function seedSyncJson(siteDir, origin, uuid, workspace = null) {
     }
   }
   const key = new URL(origin).origin
-  // The workspace the read named — `--org`, or the one the backend answered with — so
-  // the delegated pull, and every command after it, names it from the first request.
-  // As the create records it: a handle bare in `org`, a handle-less unit's uuid in
-  // `unit` (site-sync.js::readSiteWorkspace).
-  const w = typeof workspace === 'string' && workspace ? workspace : null
-  const named = w
-    ? w.startsWith('@')
-      ? { org: w.slice(1) }
-      : { unit: w }
-    : {}
+  // ⛔ No workspace: a command works in the one chosen with the login, and the clone
+  // does not know which workspace OWNS the site — it may read it from a parent.
   doc.backends[key] = {
     ...(doc.backends[key] || {}),
-    site: { ...(doc.backends[key]?.site || {}), uuid, ...named }
+    site: { ...(doc.backends[key]?.site || {}), uuid }
   }
   mkdirSync(dirname(file), { recursive: true })
   writeFileSync(file, JSON.stringify(doc, null, 2) + '\n')
@@ -229,11 +215,15 @@ export async function clone(args = [], deps = {}) {
     args,
     command: 'Cloning'
   })
-  // The workspace the reads name: `--org` explicitly — a mismatch then stops the clone —
-  // else none, and the client adopts the one the backend works on the site from. There
-  // is no project yet to record it in; `seedSyncJson` does, below.
-  const orgFlag = readOrgFlag(args)
-  client.setWorkspace(orgFlag ? workspaceHandle(orgFlag) : null, { explicit: Boolean(orgFlag) })
+  // The workspace this clone works in — the login's, unless this command names another
+  // (`workspace.js`). A site the backend keeps elsewhere stops it, naming how to switch.
+  const ws = await resolveWorkspace({ client, args })
+  if (ws.refused) {
+    error('This clone works in one workspace, and none is chosen.')
+    note(ws.reason)
+    return { exitCode: 2 }
+  }
+  client.setWorkspace(ws.workspace, { source: ws.source })
 
   // 1. GET the site-content document.
   //
@@ -385,7 +375,7 @@ export async function clone(args = [], deps = {}) {
   // the old `$backend`: the uuid came from whoever we read and nothing on disk said
   // so, and a teammate who pulled while logged in elsewhere sent it to the wrong
   // backend. Stored under the origin, that cannot be expressed.
-  seedSyncJson(siteDir, client.origin, siteUuid, client.workspace)
+  seedSyncJson(siteDir, client.origin, siteUuid)
   success(
     `Scaffolded the site harness${foundationRef ? ` (foundation: ${foundationRef})` : ''}.`
   )

package/src/commands/publish.js

@@ -29,15 +29,11 @@
  *   uniweb publish --dry-run       Resolve everything; POST nothing
  *   uniweb publish --yes           Skip confirmations (CI); never block on a prompt
  *   uniweb publish --force         Overwrite upstream app-side edits (drop the push gate)
- *   uniweb publish --org @org      Publish under @org. On the FIRST publish of a
- *                                  site it decides which org owns the site and whose
- *                                  storage its assets are charged to; recorded in
- *                                  `sync.json`, and every request after names it, so
- *                                  it never has to be re-typed. Later, it must match
- *                                  the workspace the backend works on the site from,
- *                                  or publish stops.
- *   uniweb publish --personal      Own the new site personally, deliberately: its
- *                                  requests name no workspace.
+ *   uniweb publish --org @org      Work in @org for this publish, instead of the
+ *   uniweb publish --personal      workspace chosen at `uniweb login` (or your
+ *                                  personal workspace). A site it creates is created
+ *                                  — owned — there; a site in another workspace stops
+ *                                  it.
  *   uniweb publish --no-save       Do not record this publish in deploy.yml
  */
 
@@ -73,7 +69,7 @@ import {
 import { DEFAULT_BACKEND_ORIGIN } from '../utils/config.js'
 import { resolveSiteDir } from './deploy.js'
 import { warnIfContentDoesNotConform } from '../utils/conformance.js'
-import { readFlagValue, readOrgFlag } from '../utils/args.js'
+import { readFlagValue } from '../utils/args.js'
 import { checkFlags } from '../utils/flag-guard.js'
 import {
   syncedElsewhere,
@@ -93,11 +89,9 @@ import {
   ensureSiteExists,
   clearRemoteSyncStateIfUnbound,
   dropSiteBoundValues,
-  pushSyncPackages,
-  resolveSiteOrgForCreate,
-  nameSiteWorkspace,
-  EXPLICIT_OWNER
+  pushSyncPackages
 } from '../backend/site-sync.js'
+import { resolveWorkspace, describeWorkspace, SOURCE_LABEL } from '../backend/workspace.js'
 import { uploadSiteMedia, describeAssetRefusal } from '../backend/site-media.js'
 import {
   updateBackendMap,
@@ -309,21 +303,13 @@ export async function publish(args = []) {
     }
   }
 
-  // WHO will own this site, if this publish is the one that creates it. Resolved
-  // up front: `ensureSiteExists` below is the create, and it must not be reached
-  // with the question still open. An already-created site resolves to null without
-  // asking — its ownership was settled once and cannot be changed from here.
-  const org = await resolveSiteOrgForCreate({
-    client,
-    siteDir,
-    args,
-    flag: readOrgFlag(args),
-    personal: args.includes('--personal'),
-    offline: dryRun
-  })
-  if (org.refused) {
-    say.err('Refusing to create this site without naming an owner.')
-    say.dim(org.reason)
+  // ⭐ THE WORKSPACE THIS PUBLISH WORKS IN — the one chosen with the login, unless this
+  // command names another (`workspace.js`). Resolved up front: `ensureSiteExists` below
+  // creates the site in it, and a site the backend keeps elsewhere is refused.
+  const ws = await resolveWorkspace({ client, args, offline: dryRun })
+  if (ws.refused) {
+    say.err('This publish works in one workspace, and none is chosen.')
+    say.dim(ws.reason)
     return { exitCode: 2 }
   }
 
@@ -513,16 +499,13 @@ export async function publish(args = []) {
   // be the silent-wrong-success this whole branch exists to prevent.
   if (!fnd.proceed) return { exitCode: fnd.refused ? 1 : 0 }
 
-  // ⭐ Name the workspace every site request works in — the create, the push, the
-  // publish and the data lane. The user's own choice is explicit, so a `409
-  // wrong_workspace` stops the publish; a recorded one is adopted afresh when stale
-  // (`nameSiteWorkspace`).
-  nameSiteWorkspace(client, {
-    siteDir,
-    workspace: org.workspace,
-    explicit: EXPLICIT_OWNER.has(org.source),
-    note: (m) => say.dim(m)
-  })
+  // ⭐ Every site request names the workspace — the create, the push, the publish and
+  // the data lane — and a site outside it stops the publish (`WorkspaceMismatchError`).
+  // A site this publish creates is created in it — said first.
+  client.setWorkspace(ws.workspace, { source: ws.source })
+  if (ws.source !== 'offline' && !readBackendState(siteDir, client.origin).site?.uuid) {
+    say.dim(`This publish creates the site in ${describeWorkspace(ws.workspace)} (${SOURCE_LABEL[ws.source]}).`)
+  }
 
   // 2. Build the site data (link mode): dist/site-content.json (+ per-locale),
   //    dist/data/*, dist/assets/*. Spawn the SAME CLI binary so the inner

package/src/commands/pull.js

@@ -90,11 +90,9 @@ import {
   mergeBaseVersions,
   mergeItemBaseVersions,
   writeUnitBases,
-  writeItemUuids,
-  nameSiteWorkspace,
-  readSiteWorkspace
+  writeItemUuids
 } from '../backend/site-sync.js'
-import { readOrgFlag } from '../utils/args.js'
+import { resolveWorkspace } from '../backend/workspace.js'
 import {
   uncommittedUnder,
   siteContentRoots,
@@ -106,7 +104,6 @@ import {
   BackendClient,
   describeRequestError,
   refusalDetail,
-  workspaceHandle,
   WorkspaceMismatchError
 } from '../backend/client.js'
 import { resolveSiteDir as defaultResolveSiteDir } from './deploy.js'
@@ -601,15 +598,6 @@ export async function pull(args = [], deps = {}) {
     args,
     command: 'Pulling'
   })
-  // The workspace these requests name: `--org` explicitly, else the one this project
-  // recorded for this backend — adopted afresh from the backend's answer when stale.
-  const orgFlag = readOrgFlag(args)
-  nameSiteWorkspace(client, {
-    siteDir,
-    workspace: orgFlag ? workspaceHandle(orgFlag) : readSiteWorkspace(siteDir, client.origin),
-    explicit: Boolean(orgFlag),
-    note
-  })
 
   // ⭐ No scope check any more — and none is needed. This project's identity on
   // `client.origin` is read from that origin's own section of sync.json, so a
@@ -664,6 +652,17 @@ export async function pull(args = [], deps = {}) {
     return { exitCode: 0 }
   }
 
+  // The workspace this pull works in — the one chosen with the login, unless this
+  // command names another (`workspace.js`). Resolved at the first request, not before:
+  // a pull with nothing to pull never needs one. A site kept elsewhere stops it.
+  const ws = await resolveWorkspace({ client, args })
+  if (ws.refused) {
+    error('This pull works in one workspace, and none is chosen.')
+    note(ws.reason)
+    return { exitCode: 2 }
+  }
+  client.setWorkspace(ws.workspace, { source: ws.source })
+
   // GET a pull lane via the client and return `{ docs, etag }` from its `.uwx` (ZIP)
   // body — `readPullDocuments` reads the entity files out of it (JSON fallback). A
   // conditional request whose ETag matches returns `{ notModified: true }` (304, empty

package/src/commands/push.js

@@ -27,15 +27,11 @@
  *
  * Usage:
  *   uniweb push                          Build, push both lanes, back-fill $uuid
- *   uniweb push --org @org               Own the new site under @org. On the FIRST
- *                                        push it decides which org owns the site, and
- *                                        whose storage its assets are charged to;
- *                                        recorded in `sync.json`, and every request
- *                                        after names it. Without it, you are asked
- *                                        once. Later, it must match the workspace the
- *                                        backend works on the site from, or push stops.
- *   uniweb push --personal               Own the new site personally, deliberately:
- *                                        its requests name no workspace.
+ *   uniweb push --org @org               Work in @org for this push, instead of the
+ *   uniweb push --personal               workspace chosen at `uniweb login` (or your
+ *                                        personal workspace). A site this push creates
+ *                                        is created — owned — there; a site the backend
+ *                                        keeps in another workspace stops the push.
  *   uniweb push --dry-run                Report what would be pushed; submit nothing
  *   uniweb push -o out.uwx               Write the .uwx file(s) per lane; submit nothing
  *   uniweb push --foundation <dir>       Use this local foundation for the Model schema
@@ -62,7 +58,7 @@
 import { readFileSync, writeFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import yaml from 'js-yaml'
-import { emitSyncPackages } from '@uniweb/build/uwx'
+import { emitSyncPackages, readBackendState } from '@uniweb/build/uwx'
 import { findSiteCopies, describeSiteCopies } from '../utils/site-copies.js'
 import { uploadSiteMedia, describeAssetRefusal } from '../backend/site-media.js'
 import { updateBackendMap, carryServed, SYNC_STORE_FILE } from '@uniweb/build/uwx'
@@ -70,7 +66,6 @@ import { BackendClient } from '../backend/client.js'
 import { resolveSiteDir } from './deploy.js'
 import { warnIfContentDoesNotConform } from '../utils/conformance.js'
 import { reportSchemalessQueries } from '../utils/schemaless-report.js'
-import { readOrgFlag } from '../utils/args.js'
 import { checkFlags } from '../utils/flag-guard.js'
 import {
   syncedElsewhere,
@@ -91,11 +86,9 @@ import {
   ensureSiteExists,
   clearRemoteSyncStateIfUnbound,
   dropSiteBoundValues,
-  pushSyncPackages,
-  resolveSiteOrgForCreate,
-  nameSiteWorkspace,
-  EXPLICIT_OWNER
+  pushSyncPackages
 } from '../backend/site-sync.js'
+import { resolveWorkspace, describeWorkspace, SOURCE_LABEL } from '../backend/workspace.js'
 
 // Re-exported for downstream importers (pull.js, push.test.js) that read these
 // helpers from this module — their canonical home is now ../backend/site-sync.js.
@@ -216,21 +209,13 @@ export async function push(args = [], deps = {}) {
     }
   }
 
-  // WHO will own this site, if this push is the one that creates it. Resolved
-  // before any lane runs, because both create paths below consume it and neither
-  // should be reached with the question still open. A site that already exists
-  // resolves to null without asking — ownership was settled at its create.
-  const org = await resolveSiteOrgForCreate({
-    client,
-    siteDir,
-    args,
-    flag: readOrgFlag(args),
-    personal: args.includes('--personal'),
-    offline: !!output || dryRun
-  })
-  if (org.refused) {
-    error('Refusing to create this site without naming an owner.')
-    note(org.reason)
+  // ⭐ THE WORKSPACE THIS PUSH WORKS IN — the one chosen with the login, unless this
+  // command names another (`workspace.js`). Resolved before any lane runs: a site this
+  // push creates is created in it, and a site the backend keeps elsewhere is refused.
+  const ws = await resolveWorkspace({ client, args, offline: !!output || dryRun })
+  if (ws.refused) {
+    error('This push works in one workspace, and none is chosen.')
+    note(ws.reason)
     return { exitCode: 2 }
   }
 
@@ -289,16 +274,12 @@ export async function push(args = [], deps = {}) {
   }
   if (!fnd.proceed) return { exitCode: 1 }
 
-  // ⭐ Name the workspace every site request works in. The user's own choice (`--org`,
-  // `--personal`, the picker) is explicit, so a `409 wrong_workspace` stops the push; a
-  // recorded one is adopted afresh from the backend's answer when stale
-  // (`nameSiteWorkspace`).
-  nameSiteWorkspace(client, {
-    siteDir,
-    workspace: org.workspace,
-    explicit: EXPLICIT_OWNER.has(org.source),
-    note
-  })
+  // ⭐ Every site request names the workspace; a site outside it stops the push
+  // (`WorkspaceMismatchError`). A site this push creates is created in it — said first.
+  client.setWorkspace(ws.workspace, { source: ws.source })
+  if (ws.source !== 'offline' && !readBackendState(siteDir, client.origin).site?.uuid) {
+    note(`This push creates the site in ${describeWorkspace(ws.workspace)} (${SOURCE_LABEL[ws.source]}).`)
+  }
 
   // Build BOTH directional packages (the producer side). Each carries its own
   // `index` — the per-entity source-file map for back-fill, correlated by submission

package/src/commands/status.js

@@ -25,12 +25,11 @@ import { join } from 'node:path'
 import yaml from 'js-yaml'
 
 import { resolveSiteDir } from './deploy.js'
-import { probeUnpushed, nameSiteWorkspace, readSiteWorkspace } from '../backend/site-sync.js'
-import { readOrgFlag } from '../utils/args.js'
+import { probeUnpushed } from '../backend/site-sync.js'
+import { resolveWorkspace } from '../backend/workspace.js'
 import {
   BackendClient,
   resolveBackendOrigin,
-  workspaceHandle,
   WorkspaceMismatchError
 } from '../backend/client.js'
 import { readBackendState } from '@uniweb/build/uwx'
@@ -128,15 +127,11 @@ export async function status(args = []) {
         args,
         command: 'Status'
       })
-      // The workspace the site's requests name — as pull names it. A stale record is
-      // re-adopted from the backend's answer; `--json` keeps stdout to the document.
-      const orgFlag = readOrgFlag(args)
-      nameSiteWorkspace(client, {
-        siteDir,
-        workspace: orgFlag ? workspaceHandle(orgFlag) : readSiteWorkspace(siteDir, client.origin),
-        explicit: Boolean(orgFlag),
-        note: jsonMode ? undefined : say.dim
-      })
+      // The workspace this status works in — the login's, unless this command names
+      // another (`workspace.js`). None chosen is reported, like a site outside it.
+      const ws = await resolveWorkspace({ client, args })
+      if (ws.refused) throw Object.assign(new Error(ws.reason), { status: 409 })
+      client.setWorkspace(ws.workspace, { source: ws.source })
       if (uuid) site = await client.siteStatus(uuid)
       // Foundation freshness: prefer the LOCAL foundation's scoped name (so a
       // local-foundation site can be checked too); fall back to a scoped

package/src/index.js

@@ -1456,15 +1456,10 @@ ${colors.bright}Options:${colors.reset}
                      bind to, and the app cannot open such a site.
   --no-save          Do not record this deploy in deploy.yml
   --no-validate      Skip the content-conformance check (it only warns)
-  --org @org         Publish under @org (membership-gated). On a site's FIRST
-                     publish it decides which org owns the site, and whose storage
-                     its assets are charged to. Recorded in sync.json and named on
-                     every request after, so it is never re-typed. Without it, you
-                     are asked once. Later, it must match the workspace the backend
-                     works on the site from, or publish stops.
-  --personal         Create the site under your personal account, deliberately.
-                     Only needed on a first publish, and only to answer the owner
-                     question without a prompt (CI, agents, scripts).
+  --org @org         Work in @org for this publish, instead of the workspace
+  --personal         chosen at \`uniweb login\` (or your personal workspace). A
+                     site this publish creates is created — owned — there, and a
+                     site the backend keeps in another workspace stops it.
 `,
     create: `
 ${colors.cyan}${colors.bright}uniweb create${colors.reset} ${colors.dim}— Create a new project${colors.reset}
@@ -1793,16 +1788,26 @@ does nothing; add --password, --browser, --token-paste or --token to log in agai
 Without --backend: https://uniweb.app (or \$UNIWEB_REGISTER_URL). No command talks
 to a backend you are not logged in to — run one before logging in and it asks first.
 
+${colors.bright}The workspace you work in.${colors.reset} A login works in ONE workspace — your
+personal one, or an organization's — and every push, pull and publish works in it:
+a site it creates is created there, and a site kept in another workspace is refused.
+With no organization it is your personal workspace; with organizations you are asked,
+or name it. Already logged in, \`uniweb login --org @other\` switches without logging
+in again.
+
 ${colors.bright}Options:${colors.reset}
   --backend <url>    The backend to log in to
+  --org @org         Work in @org (an organization you belong to)
+  --personal         Work in your personal workspace
   --token <bearer>   Seed + verify a session from a bearer token (non-interactive)
   --browser          Force the browser method
   --password         Force the username/password method
   --token-paste      Force the paste-a-token prompt
 
-In non-interactive mode (CI / no TTY), pass \`--token <bearer>\`, or set
-\`UNIWEB_USERNAME\` + \`UNIWEB_PASSWORD\`, or set \`UNIWEB_TOKEN\` (used per-command,
-not stored). \`uniweb logout\` logs you out.
+In non-interactive mode (no TTY — an agent, a script), pass \`--token <bearer>\` with
+\`--org @org\` or \`--personal\`, or set \`UNIWEB_USERNAME\` + \`UNIWEB_PASSWORD\`, or set
+\`UNIWEB_TOKEN\` (per process, not stored) with \`UNIWEB_WORKSPACE=@org\` or \`personal\`.
+\`uniweb logout\` logs you out.
 `,
     refresh: `
 ${colors.cyan}${colors.bright}uniweb refresh${colors.reset} ${colors.dim}— Catch up with teammates AND app authors${colors.reset}
@@ -2082,8 +2087,8 @@ ${colors.bright}Publish Options:${colors.reset}
   --dry-run          Resolve everything; release/sync/POST nothing
   --yes              Skip confirmations (CI); never block on a prompt
   --no-release       Ship content against the already-released code; release nothing
-  --org @org         Publish under @org (first publish only; then remembered)
-  --personal         Own the new site personally, deliberately (first publish only)
+  --org @org         Work in @org for this publish, not your login's workspace
+  --personal         Work in your personal workspace for this publish
   --no-save          Do not record this deploy in deploy.yml
   --no-validate      Skip the content-conformance check (it only warns)