uniweb 0.82.1 → 0.83.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.82.1",
+  "version": "0.83.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,16 +41,16 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/core": "^0.37.1",
-    "@uniweb/schemas": "^0.12.0",
+    "@uniweb/content-writer": "^0.3.4",
     "@uniweb/runtime": "^0.29.1",
-    "@uniweb/semantic-parser": "^1.5.1",
     "@uniweb/kit": "^0.19.17",
-    "@uniweb/content-writer": "^0.3.4"
+    "@uniweb/schemas": "^0.12.0",
+    "@uniweb/core": "^0.37.1",
+    "@uniweb/semantic-parser": "^1.5.1"
   },
   "peerDependencies": {
-    "@uniweb/content-reader": "^1.2.8",
     "@uniweb/build": "^0.76.1",
+    "@uniweb/content-reader": "^1.2.8",
     "@uniweb/semantic-parser": "^1.5.1"
   },
   "peerDependenciesMeta": {

package/partials/agents.md

@@ -2635,9 +2635,12 @@ Foundations have their own free path too: `uniweb add ci --target foundation` pu
 > uniweb push --org @acme       # this command only
 > ```
 >
-> Already logged in, `uniweb login --org @other` switches without logging in again. **Without a
-> terminal — you, an agent — a login with organizations refuses until one is named**, and so
-> does a command when none was. A process logged in with `UNIWEB_TOKEN` names its workspace with
+> Already logged in, `uniweb login --org @other` (or `--personal`) switches the workspace on the
+> backend you are logged in to, without logging in again. **Without a
+> terminal — you, an agent — a login with organizations and no workspace named signs you in but
+> exits 2**: `uniweb login --org @acme` (or `--personal`) finishes it without signing in again.
+> Until then every command that works on a site refuses, and so does registering a foundation whose
+> name has no scope. A process logged in with `UNIWEB_TOKEN` names its workspace with
 > `UNIWEB_WORKSPACE=@acme` (or `personal`). **Ask the human which workspace to use** rather than
 > picking for them — a site created in the wrong one cannot be moved from here.
 >
@@ -2696,7 +2699,7 @@ Platform-specific configuration that doesn't belong in npm-standard fields. All
 |---|---|---|---|
 | `runtimePolicy` | `dist/runtime-pin.json` | unset | Declares how far past the recorded runtime version a host may move a site. |
 
-**The foundation's name is not here — it is `name` in `main.js`** (else `package.json`'s `name`), **and so is the scope it registers under: the scope is part of the name**, `name: '@acme/marketing'`. A scope is a namespace — your personal one, `@<your handle>`, which needs no org, or an org's. A name with no scope has not been registered yet: the first `uniweb register` takes `--scope`, else your personal scope (asking only if you belong to orgs), and writes it into the name; a `--scope` naming another scope than the name's is refused. The foundation's own data schemas register under the same scope (`@/article` → `@acme/article`). ⛔ `uniweb.id` and `uniweb.scope` are no longer read for a foundation: `uniweb register` refuses them and prints the `main.js` line to write instead. (A schemas-only package has no `main.js`, and still records its scope in `uniweb.scope`.)
+**The foundation's name is not here — it is `name` in `main.js`** (else `package.json`'s `name`), **and so is the scope it registers under: the scope is part of the name**, `name: '@acme/marketing'`. A scope is a namespace — your personal one, `@<your handle>`, which needs no org, or an org's. A name with no scope has not been registered yet: the first `uniweb register` takes `--scope`, else the workspace you work in — an org's scope, or your personal one; when you belong to orgs and chose no workspace, it asks at a terminal and refuses without one — and writes it into the name; a `--scope` naming another scope than the name's is refused. The foundation's own data schemas register under the same scope (`@/article` → `@acme/article`). ⛔ `uniweb.id` and `uniweb.scope` are no longer read for a foundation: `uniweb register` refuses them and prints the `main.js` line to write instead. (A schemas-only package has no `main.js`, and still records its scope in `uniweb.scope`.)
 
 **Runtime updates — handled for you.** Your foundation's code links against the runtime: it externalizes `react`, `react-dom`, `react-dom/server`, both JSX runtimes and `@uniweb/core`, and the runtime supplies all of them at load time. So a build is bound to *that* React and *that* core API.
 

package/src/backend/client.js

@@ -7,9 +7,11 @@
  * `fetch(… Authorization: Bearer …)` against a per-command default origin. It
  * owns the three things that were previously scattered across a dozen files:
  *
- *   1. ORIGIN   — where the backend is. resolveBackendOrigin(): an explicit
- *                 flag (`--backend`) > UNIWEB_REGISTER_URL >
- *                 the local default. Any full URL is reduced to its origin.
+ *   1. ORIGIN   — where the backend is. resolveBackendOrigin(): UNIWEB_REGISTER_URL >
+ *                 the backend you are logged in to > the default backend (below).
+ *                 Each is reduced to its origin, http(s) only. *(This named a
+ *                 `--backend` flag as the first tier until 2026-10-05; the verbs
+ *                 lost that flag on 2026-09-21.)*
  *   2. AUTH     — the opaque session bearer (utils/registry-auth.js). Resolved
  *                 LAZILY on the first authed call, so dry-runs and fully-local
  *                 work never trigger a login.
@@ -27,7 +29,7 @@
  * single home.
  */
 
-import { getRegistryApiBaseUrl } from '../utils/config.js'
+import { getRegistryApiBaseUrl, loginCommand } from '../utils/config.js'
 import {
   ensureRegistryAuth,
   fetchMe,
@@ -189,11 +191,12 @@ export function workspaceHeader(value) {
  */
 export class WorkspaceMismatchError extends Error {
   /**
-   * @param {{ named: string|null, answer: string|null, source?: string }} p - the
-   *   workspace the request named and the one the backend named (`@handle`, a unit's
-   *   uuid, null for personal), and where the named one came from (`workspace.js`)
+   * @param {{ named: string|null, answer: string|null, source?: string, origin?: string|null }} p -
+   *   the workspace the request named and the one the backend named (`@handle`, a unit's
+   *   uuid, null for personal), where the named one came from (`workspace.js`), and the
+   *   backend — a login that switches must name it unless it is the default (`loginCommand`)
    */
-  constructor({ named, answer, source = 'login' }) {
+  constructor({ named, answer, source = 'login', origin = null }) {
     const where = (w) =>
       !w ? 'your personal workspace' : w.startsWith('@') ? w : `the unit ${w}`
     // How to work in the site's workspace, said for the way this one was chosen.
@@ -202,7 +205,11 @@ export class WorkspaceMismatchError extends Error {
       : answer.startsWith('@')
         ? { flag: `pass --org ${answer}`, env: `set UNIWEB_WORKSPACE=${answer}` }
         : null
-    const login = !answer ? 'uniweb login --personal' : answer.startsWith('@') ? `uniweb login --org ${answer}` : null
+    const login = !answer
+      ? `${loginCommand(origin)} --personal`
+      : answer.startsWith('@')
+        ? `${loginCommand(origin)} --org ${answer}`
+        : null
     const fix = !switchTo
       ? 'It has no handle, so the CLI cannot work in it.'
       : source === 'flag'
@@ -330,12 +337,16 @@ export class BackendClient {
       return this._token
     }
     // ⛔ NO ORIGIN-MISMATCH GUARD HERE, AND DO NOT RE-ADD ONE (removed 2026-09-20).
-    // It existed because the session store held ONE record: a session for another
-    // backend was the only session, so it was about to be sent here and rejected, and a
-    // warning was the best available move. Sessions are keyed by origin now
-    // (utils/registry-auth.js), so being logged into another backend is just a fact
-    // about another backend — `ensureRegistryAuth` below finds this origin's session or
-    // asks for one. Warning about the other would be noise about nothing.
+    // It existed because the session store held ONE record, read without an origin: a
+    // session for another backend was about to be sent here and rejected, and a warning
+    // was the best available move. The session is looked up BY ORIGIN now
+    // (`readRegistryAuth(origin)`, utils/registry-auth.js), so another backend's token is
+    // never sent here — `ensureRegistryAuth` below finds this origin's session or asks
+    // for one. ⚠️ There is still ONE session (since 2026-09-21): a login it asks for
+    // replaces the other backend's session, and says so. *(Until 2026-10-05 this read
+    // "sessions are keyed by origin now … being logged into another backend is just a
+    // fact about another backend" — true of the per-backend store of 2026-09-20→21, and
+    // read as "several sessions coexist".)*
     this._token = await ensureRegistryAuth({
       apiBase: this.origin,
       command: this._command,
@@ -386,7 +397,8 @@ export class BackendClient {
     throw new WorkspaceMismatchError({
       named: this._workspace,
       answer,
-      source: this._workspaceSource
+      source: this._workspaceSource,
+      origin: this.origin
     })
   }
 
@@ -807,6 +819,67 @@ export class BackendClient {
    * @param {string} uuid - the site-content uuid
    * @returns {Promise<object|null>}
    */
+  /**
+   * Whether the backend holds the site `uuid` names — `live`, `gone` or `unknown`, kept
+   * apart — for a script that must decide, before any push, whether a binding still
+   * points at a site (`uniweb status --remote --json`, `remote.site_state`).
+   *
+   * ⛔ `gone` ONLY ON THE BACKEND'S OWN WORD ABOUT THIS SITE: a `404` whose problem names
+   * it — `kind: "site"`, `key: <uuid>`. A push from an unbound copy CREATES a site, so a
+   * binding dropped because its site was merely unreadable leaves a second copy beside
+   * the first. Folding `unknown` into `gone` would be worse than no answer.
+   *
+   *   live     the site's status came back, or the site was refused as belonging to
+   *            another workspace (`409 wrong_workspace` names where it is: it exists)
+   *   gone     a `404` naming this site
+   *   unknown  anything else — no answer, a credential or an id refused, a `404` that
+   *            names something else (a backend too old for the route)
+   *
+   * *Measured 2026-10-06 against a local backend — its wire, its to change:* `200` with
+   * the status; `409 wrong_workspace` naming the site's workspace; `404 {kind: "site",
+   * key}`; `400` for a malformed id; `401` for a bad bearer.
+   *
+   * @param {string} uuid
+   * @returns {Promise<{ state: 'live'|'gone'|'unknown', status: number|null, site?: object, workspace?: string|null, detail?: string|null }>}
+   */
+  async siteState(uuid) {
+    let res
+    try {
+      res = await this.request(`/dev/site/status/${encodeURIComponent(uuid)}`)
+    } catch (err) {
+      if (err instanceof WorkspaceMismatchError) {
+        return { state: 'live', status: 409, workspace: err.answer, detail: err.message }
+      }
+      return { state: 'unknown', status: null, detail: err?.message || String(err) }
+    }
+    const body = await res.text().catch(() => '')
+    let parsed = null
+    try {
+      parsed = body ? JSON.parse(body) : null
+    } catch {
+      parsed = null
+    }
+    if (res.ok) return { state: 'live', status: res.status, ...(parsed ? { site: parsed } : {}) }
+    if (res.status === 409 && parsed?.reason === 'wrong_workspace') {
+      const w = parsed.workspace || {}
+      return {
+        state: 'live',
+        status: 409,
+        workspace: w.handle ? workspaceHandle(w.handle) : w.unit_uuid || null,
+        detail: parsed.detail || null
+      }
+    }
+    const names = (v) => String(v ?? '').toLowerCase() === String(uuid).toLowerCase()
+    if (res.status === 404 && parsed?.kind === 'site' && names(parsed.key)) {
+      return { state: 'gone', status: 404, detail: parsed.detail || null }
+    }
+    return {
+      state: 'unknown',
+      status: res.status,
+      detail: parsed?.detail || parsed?.title || (body ? body.slice(0, 200) : null)
+    }
+  }
+
   async siteStatus(uuid) {
     try {
       const res = await this.request(

package/src/backend/foundation-bring-along.js

@@ -63,6 +63,8 @@ import {
 } from '@uniweb/build'
 import { computeFoundationDigest } from '../utils/code-upload.js'
 import { isNonInteractive } from '../utils/interactive.js'
+import { readOrgFlag } from '../utils/args.js'
+import { belongsToScope } from '../utils/registry-orgs.js'
 import { writeJsonPreservingStyle } from '../utils/json-file.js'
 import {
   compareSemverPrecedence,
@@ -191,13 +193,22 @@ function writePkgVersion(dir, version) {
   writeJsonPreservingStyle(path, { ...JSON.parse(src), version }, src)
 }
 
-// What travels to the spawned `uniweb register` / `build` on the command line: only
-// --non-interactive. The BACKEND travels in the child's environment
-// (releaseFoundation), and the SESSION is the shared session file — or UNIWEB_TOKEN,
-// which the child inherits. The backend commands take no `--backend` or `--token`.
-function forwardedFlags(args) {
+// What travels to the spawned `uniweb register` on the command line: --non-interactive,
+// and the WORKSPACE this command names (`--org` / `--personal`). The BACKEND travels in
+// the child's environment (releaseFoundation), and the SESSION is the shared session
+// file — or UNIWEB_TOKEN, which the child inherits. The backend commands take no
+// `--backend` or `--token`.
+//
+// ⭐ The workspace travels because a bare name registers under the workspace the command
+// works in *[Diego, 2026-10-06]*, and a workspace named on this command is this command's
+// alone: the child cannot read it from the session. One chosen at the login, or in
+// UNIWEB_WORKSPACE, reaches the child on its own.
+export function forwardedFlags(args) {
   const out = []
   if (isNonInteractive(args)) out.push('--non-interactive')
+  const org = readOrgFlag(args)
+  if (org) out.push('--org', org)
+  else if (args.includes('--personal')) out.push('--personal')
   return out
 }
 
@@ -280,9 +291,16 @@ async function bringLocalCodeAlong({
 }) {
   const Kind = kind === 'extension' ? 'Extension ' : 'Foundation'
   const scopedName = await foundationScopedName(local.dir)
+  // A name with no scope yet (it has never registered) is still a name: say it. ⛔ Until
+  // 2026-10-06 the label fell back to the KIND, and the line read "Releasing the foundation
+  // foundation@0.1.0".
+  const bareName = scopedName
+    ? null
+    : await readFoundationName(local.dir).then((r) => (r?.name && !checkFoundationName(r.name) ? r.name : null), () => null)
+  const shown = scopedName || bareName
   const label =
-    scopedName || local.version
-      ? `${scopedName || kind}${local.version ? `@${local.version}` : ''}`
+    shown || local.version
+      ? `${shown || kind}${local.version ? `@${local.version}` : ''}`
       : `the local ${kind}`
   const skipPrompts =
     args.includes('--yes') ||
@@ -361,6 +379,16 @@ async function bringLocalCodeAlong({
   // answer / no scoped name to look up) → release.
   const reg = scopedName ? await client.readFoundationLatest(scopedName) : null
 
+  // Every release below goes through here, so a refusal for a scope you are not a member
+  // of is said as that, with the ways on (`explainReleaseFailure`).
+  const release = async () => {
+    try {
+      return releaseFoundation(local, args, cliBin, say, client?.origin)
+    } catch (err) {
+      throw await explainReleaseFailure(err, { client, local, reg, verb })
+    }
+  }
+
   if (!reg) {
     // ⛔ Nothing to bind to. Releasing anyway would be the opposite of what was asked,
     // and shipping anyway would leave a site the app cannot open — so stop and say so.
@@ -376,7 +404,7 @@ async function bringLocalCodeAlong({
     }
     say.info(`Releasing the ${kind} ${label} (not yet registered)…`)
     return {
-      released: releaseFoundation(local, args, cliBin, say, client?.origin),
+      released: await release(),
       proceed: true,
       ref: await pinnedRef()
     }
@@ -406,7 +434,7 @@ async function bringLocalCodeAlong({
     }
     writePkgVersion(local.dir, bumpTo)
     say.info(`Releasing the ${kind} ${scopedName || kind} as ${bumpTo} — ${why}…`)
-    const released = releaseFoundation(local, args, cliBin, say, client?.origin)
+    const released = await release()
     say.dim(`The ${kind}'s package.json now says ${bumpTo} — commit it.`)
     if (optOut) say.dim('To send content without releasing code, pass `--no-release`.')
     return { released, proceed: true, bumped: bumpTo, ref: await pinnedRef() }
@@ -480,7 +508,7 @@ async function bringLocalCodeAlong({
           : `Releasing the ${kind} ${label} (registered latest is ${reg.latest_version})…`
       )
       return {
-        released: releaseFoundation(local, args, cliBin, say, client?.origin),
+        released: await release(),
         proceed: true,
         ref: await pinnedRef()
       }
@@ -514,7 +542,7 @@ async function bringLocalCodeAlong({
     )
     if (reRelease)
       return {
-        released: releaseFoundation(local, args, cliBin, say, client?.origin),
+        released: await release(),
         proceed: true,
         ref: await pinnedRef()
       }
@@ -570,6 +598,48 @@ function releaseFoundation(local, args, cliBin, say, origin) {
   return true
 }
 
+/**
+ * A failed release, explained when the cause is a scope you are not a member of
+ * *[Diego, 2026-10-06]* — or the error as it came.
+ *
+ * The scope is the one in the foundation's name: `register` writes a bare name's scope
+ * before it submits, so a refused release leaves the name scoped. When the orgs read
+ * says the account is neither that scope's owner nor a member of its org, the error
+ * says so (`notMember`) and carries the ways on (`ways`): `--no-release`, where a
+ * released version exists to send the content against, and a member releasing it.
+ * Its message is what the refusal means for the push — nothing was sent — since the
+ * `register` it ran has just printed the refusal itself, membership and the registry's
+ * own sentence included (measured against a local backend, 2026-10-06: HTTP 400, no
+ * typed reason).
+ *
+ * ⛔ The registry decides membership; this only names it after a refusal, and passes
+ * the error through whenever it cannot tell.
+ *
+ * @param {Error} err - the release's failure
+ * @param {object} o
+ * @param {import('./client.js').BackendClient} o.client
+ * @param {{ dir: string }} o.local
+ * @param {{ latest_version?: string }|null} o.reg - the catalog's answer for this name
+ * @param {string} o.verb - `push` or `publish`, for the ways on
+ * @returns {Promise<Error>}
+ */
+export async function explainReleaseFailure(err, { client, local, reg, verb }) {
+  const name = await foundationScopedName(local.dir).catch(() => null)
+  const scope = name ? name.split('/')[0] : null
+  if (!scope || typeof client?.fetchOrgs !== 'function') return err
+  const member = belongsToScope(scope, await client.fetchOrgs().catch(() => null))
+  if (member !== false) return err
+  const explained = new Error(`${name} was not released, so nothing was sent.`)
+  explained.notMember = true
+  explained.ways = reg?.latest_version
+    ? [
+        `Send the content against the released ${reg.latest_version}: \`uniweb ${verb} --no-release\`.`,
+        `Or ask a member of ${scope} to release it.`
+      ]
+    : [`Ask a member of ${scope} to release it.`]
+  return explained
+}
+
 /**
  * Bring the site's LOCAL extensions along — the exact parallel of
  * `bringFoundationAlong`, run for each workspace-local extension.

package/src/backend/site-sync.js

@@ -1109,8 +1109,8 @@ function recordSiteWorkspace(siteDir, backend, owner) {
  * ⚖️ The wording deliberately DIVERGES from the asset lane's on one point. There the
  * allowance belongs to the site's owner, who may not be the person pushing. Here
  * there is no site yet, so the only workspace in play is the one the site would be
- * created in — `--as <org>` included. Saying "the site owner's workspace" would be
- * incoherent for a site that does not exist.
+ * created in — one named with `--org` included. Saying "the site owner's workspace"
+ * would be incoherent for a site that does not exist.
  *
  * @param {string} body - the raw response body
  * @returns {string|null}
@@ -1125,6 +1125,9 @@ function describeCreateRefusal(body) {
   }
   if (!p || typeof p !== 'object' || typeof p.reason !== 'string') return null
 
+  const attach = describeAttachRefusal(p)
+  if (attach) return [attach.headline, ...attach.steps].join('\n  ')
+
   if (p.reason === 'storage_quota_exceeded') {
     const parts = []
     const used = humanBytes(p.used_bytes)
@@ -1144,6 +1147,63 @@ function describeCreateRefusal(body) {
   return `the backend refused the site create (${p.reason})${detail ? ` — ${detail}` : ''}`
 }
 
+/**
+ * The backend's refusals to ATTACH a foundation to a site, as what happened and what to
+ * do next — or null for any other problem document.
+ *
+ * A site takes any version of a foundation it already uses, and a new one only from a
+ * scope its author owns. The create, the first push and a push that changes the site's
+ * foundation can each be refused:
+ *
+ *   `foundation_not_licensed`    not yours to attach. `templates` names the app
+ *                                templates that carry it: start from one in the app,
+ *                                then clone the site you made. With none, register a
+ *                                foundation under a scope you own.
+ *   `foundation_not_registered`  this backend has no such version.
+ *
+ * ⛔ Branch on `reason`, never on the status: a `403` is also a rejected credential, and
+ * "log in again" is the wrong advice for a foundation that is not yours. ⚠️ Until
+ * 2026-10-06 a push printed exactly that for this refusal, and the create printed the
+ * reason's bare name.
+ *
+ * @param {object|null} problem - a parsed problem document
+ * @returns {{ headline: string, steps: string[] } | null}
+ */
+export function describeAttachRefusal(problem) {
+  if (!problem || typeof problem !== 'object') return null
+  const named = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null)
+
+  if (problem.reason === 'foundation_not_licensed') {
+    const pkg = named(problem.package) || 'This foundation'
+    const templates = (Array.isArray(problem.templates) ? problem.templates : [])
+      .map((t) => named(t?.name))
+      .filter(Boolean)
+    const SHOWN = 5
+    const list =
+      templates
+        .slice(0, SHOWN)
+        .map((n) => `“${n}”`)
+        .join(', ') + (templates.length > SHOWN ? ` and ${templates.length - SHOWN} more` : '')
+    const steps = templates.length
+      ? [
+          `Start from ${templates.length === 1 ? list : `one of ${list}`} in the app — ` +
+            `${templates.length === 1 ? 'that template carries' : 'those templates carry'} it — ` +
+            "then `uniweb clone <your site's uuid>`."
+        ]
+      : ['Register a foundation under a scope you own, and name it in site.yml.']
+    return { headline: `${pkg} is not yours to attach.`, steps }
+  }
+
+  if (problem.reason === 'foundation_not_registered') {
+    const f = named(problem.foundation) || 'The foundation this site names'
+    return {
+      headline: `${f} is not registered on this backend.`,
+      steps: ['Register it here first (`uniweb register` in its directory), or name a version this backend has.']
+    }
+  }
+  return null
+}
+
 /**
  * Guarantee the site EXISTS on the backend before anything is uploaded against it.
  *
@@ -1759,13 +1819,22 @@ export async function pushSyncPackages({
       // Two unrelated conflicts share HTTP 409, so branch on the machine-readable
       // `reason` — never on `detail`, which is prose the backend may reword.
       let problem = null
-      if ((res.status === 409 || res.status === 400 || res.status === 422) && body) {
+      if ((res.status === 409 || res.status === 400 || res.status === 403 || res.status === 422) && body) {
         try {
           problem = JSON.parse(body)
         } catch {
           /* not a problem document */
         }
       }
+      // A foundation the site may not take (`foundation_not_licensed`, a 403) or that this
+      // backend does not have (`foundation_not_registered`) — said, with what to do next.
+      // Before the credential branch below, which a 403 would otherwise reach.
+      const attach = describeAttachRefusal(problem)
+      if (attach) {
+        error(`${label} push refused — ${attach.headline}`)
+        for (const step of attach.steps) note(step)
+        return null
+      }
       // The package carried no identity for records the backend already stores, so
       // applying it would replace every one of them. `ensureItemUuids` is supposed
       // to make this unreachable, so reaching it means that recovery failed — say so

package/src/backend/workspace.js

@@ -26,7 +26,8 @@
  */
 
 import { readOrgFlag } from '../utils/args.js'
-import { fetchOrgs } from '../utils/registry-orgs.js'
+import { loginCommand } from '../utils/config.js'
+import { fetchOrgs, bareHandle, validateHandle } from '../utils/registry-orgs.js'
 import { readRegistryAuth } from '../utils/registry-auth.js'
 import { workspaceHandle, describeWorkspace } from './client.js'
 
@@ -65,12 +66,14 @@ export const SOURCE_LABEL = {
   offline: 'not resolved in a preview'
 }
 
-const CHOOSE = [
-  'Choose the workspace you work in:',
-  '    uniweb login --org @acme      (or --personal) — for every command after',
-  '    --org @acme / --personal      — for this command only',
-  `    ${WORKSPACE_ENV}=@acme        — for a process logged in with UNIWEB_TOKEN`
-].join('\n')
+/** How to choose, for a command on `origin` — its login names the backend when it must (`loginCommand`). */
+const choose = (origin) =>
+  [
+    'Choose the workspace you work in:',
+    `    ${loginCommand(origin)} --org @acme   (or --personal) — for every command after`,
+    '    --org @acme / --personal      — for this command only',
+    `    ${WORKSPACE_ENV}=@acme        — for a process logged in with UNIWEB_TOKEN`
+  ].join('\n')
 
 /**
  * The workspace this command works in.
@@ -119,10 +122,38 @@ export async function resolveWorkspace({ client, args = [], offline = false }) {
   if (!orgs.length) return { workspace: null, source: 'personal' }
   return {
     refused: true,
-    reason: `You belong to organizations, so no workspace is assumed.\n  ${CHOOSE}`
+    reason: `You belong to organizations, so no workspace is assumed.\n  ${choose(client.origin)}`
   }
 }
 
+/**
+ * The scope a bare name registers under by default — the workspace the command works in
+ * *[Diego, 2026-10-06]*: an organization's handle, or your own handle for your personal
+ * workspace.
+ *
+ * ⭐ A default, asked once: a name that carries a scope keeps it, and `--scope` names
+ * another. The workspace still never decides anything else about a foundation — it
+ * decides which SITE a command works on; here it only answers the question a bare name
+ * asks the first time it registers.
+ *
+ * Null when the workspace names no scope, and the caller derives one as before
+ * (`deriveScope`): none is chosen (you belong to organizations and none is named), the
+ * command is a preview, the workspace is a unit without a handle, or the account has no
+ * handle (a service account).
+ *
+ * @param {{ workspace?: string|null, source?: string, refused?: boolean }} ws -
+ *   `resolveWorkspace`'s answer
+ * @param {string|null} accountHandle - the account's own handle (`GET /dev/orgs`), read
+ *   only for the personal workspace
+ * @returns {string|null} `@handle`
+ */
+export function scopeOfWorkspace(ws, accountHandle) {
+  if (!ws || ws.refused || ws.source === 'offline') return null
+  if (typeof ws.workspace === 'string') return ws.workspace.startsWith('@') ? ws.workspace : null
+  const h = bareHandle(accountHandle || '')
+  return h && !validateHandle(h) ? `@${h}` : null
+}
+
 /**
  * The workspace a login works in — asked once, at `uniweb login`, and stored with the
  * session.
@@ -166,11 +197,17 @@ export async function chooseWorkspace({ apiBase, token, args = [] }) {
     }
   }
 
-  const { isNonInteractive } = await import('../utils/interactive.js')
+  const { isNonInteractive, getCliPrefix } = await import('../utils/interactive.js')
+  // ⭐ How to choose, said whole: the session is stored already (`registry-auth.js`, the
+  // login methods), so the login that finishes this signs nobody in again.
+  const others = [...mine.slice(1).map((h) => `--org ${h}`), '--personal']
+  const howToChoose =
+    `Choose one: ${loginCommand(apiBase, getCliPrefix())} --org ${mine[0]} (or ${others.join(', ')}) — ` +
+    'it will not ask you to sign in again.'
   if (isNonInteractive(args)) {
     return {
       refused: true,
-      reason: `You belong to organizations — name the workspace you work in: ${[...mine, '--personal'].map((w) => (w.startsWith('@') ? `--org ${w}` : w)).join(' | ')}.`
+      reason: `You belong to organizations, so no workspace is assumed. ${howToChoose}`
     }
   }
   const prompts = (await import('prompts')).default
@@ -188,12 +225,10 @@ export async function chooseWorkspace({ apiBase, token, args = [] }) {
       ],
       initial: 0
     },
-    {
-      onCancel: () => {
-        console.error('\nCancelled.')
-        process.exit(0)
-      }
-    }
+    // ⛔ A cancelled pick is NOT a cancelled login: the session is stored already, so the
+    // login says so and how to finish it (`finishLogin`), and exits 2. Until 2026-10-06 this
+    // printed "Cancelled." and exited 0 — with the new session in place of the old one.
+    { onCancel: () => false }
   )
-  return choice ? { choice } : { refused: true, reason: 'No workspace chosen.' }
+  return choice ? { choice } : { refused: true, reason: `No workspace chosen. ${howToChoose}` }
 }

package/src/commands/publish.js

@@ -492,8 +492,9 @@ export async function publish(args = []) {
       cliBin: process.argv[1]
     })
   } catch (err) {
-    say.err(`Foundation release failed: ${err.message}`)
-    say.dim('Fix the foundation, then re-run `uniweb publish`.')
+    // A scope you are not a member of is said as that, with the ways on (`explainReleaseFailure`).
+    say.err(err.notMember ? err.message : `Foundation release failed: ${err.message}`)
+    for (const line of err.notMember ? err.ways : ['Fix the foundation, then re-run `uniweb publish`.']) say.dim(line)
     return { exitCode: 1 }
   }
 
@@ -512,8 +513,8 @@ export async function publish(args = []) {
       cliBin: process.argv[1]
     })
   } catch (err) {
-    say.err(`Extension release failed: ${err.message}`)
-    say.dim('Fix the extension, then re-run `uniweb publish`.')
+    say.err(err.notMember ? err.message : `Extension release failed: ${err.message}`)
+    for (const line of err.notMember ? err.ways : ['Fix the extension, then re-run `uniweb publish`.']) say.dim(line)
     return { exitCode: 1 }
   }
   if (!ext.proceed) return { exitCode: 1 }

package/src/commands/push.js

@@ -37,6 +37,9 @@
  *   uniweb push --foundation <dir>       Use this local foundation for the Model schema
  *   uniweb push --all                    Send every record (bypass the changed-only cache)
  *   uniweb push --force                  Overwrite upstream changes (drop the staleness gate)
+ *   uniweb push --no-release             Send content against the foundation already
+ *                                        released; release nothing
+ *   uniweb push --bump                   Release above a newer registered version
  *
  * Pushes are GATED by default: each entity carries the backend `version` this clone
  * last saw (a top-level `base_version` on the manifest entry), and the backend refuses the whole package
@@ -274,8 +277,9 @@ export async function push(args = [], deps = {}) {
       verb: 'push'
     })
   } catch (err) {
-    error(`Foundation release failed: ${err.message}`)
-    note('Fix the foundation, then re-run `uniweb push`.')
+    // A scope you are not a member of is said as that, with the ways on (`explainReleaseFailure`).
+    error(err.notMember ? err.message : `Foundation release failed: ${err.message}`)
+    for (const line of err.notMember ? err.ways : ['Fix the foundation, then re-run `uniweb push`.']) note(line)
     return { exitCode: 1 }
   }
   if (!fnd.proceed) return { exitCode: 1 }

package/src/commands/register.js

@@ -88,8 +88,9 @@ import {
   computeFoundationDigest,
   readRuntimePin
 } from '../utils/code-upload.js'
-import { deriveScope, publishScope } from '../utils/registry-orgs.js'
+import { deriveScope, publishScope, belongsToScope } from '../utils/registry-orgs.js'
 import { BackendClient } from '../backend/client.js'
+import { resolveWorkspace, scopeOfWorkspace, SOURCE_LABEL } from '../backend/workspace.js'
 import { writeJsonPreservingStyleAsync } from '../utils/json-file.js'
 import {
   findWorkspaceRoot,
@@ -316,8 +317,10 @@ export async function settleFoundationName(targetDir, { args, isPreview }) {
  * A preview (`--dry-run`, `-o`) writes nothing: a bare name previews under `--scope`,
  * or unscoped.
  *
- * @returns {Promise<{ scope: string|null, source: string|null } | { cancelled: true } | null>}
- *   null when refused (the reason is printed); `cancelled` when no org was chosen
+ * @returns {Promise<{ scope: string|null, source: string|null } | null>}
+ *   null when refused, the reason printed — no scope chosen included, since a name with
+ *   no scope cannot register. ⛔ Until 2026-10-06 "no scope chosen" was `cancelled`, and
+ *   register exited 0 having registered nothing.
  */
 export async function settleFoundationScope(targetDir, { args, isPreview, flagScope, client }) {
   let read
@@ -351,7 +354,7 @@ export async function settleFoundationScope(targetDir, { args, isPreview, flagSc
   let source = flagScope ? '--scope' : null
   if (!scope) {
     scope = await deriveScopeFromLogin(client, args)
-    if (!scope) return { cancelled: true }
+    if (!scope) return null
     source = 'login'
   }
 
@@ -375,11 +378,35 @@ export async function settleFoundationScope(targetDir, { args, isPreview, flagSc
 }
 
 /**
- * A scope derived from the login (`deriveScope`): your personal scope when you belong
- * to no org, else a pick — as `@handle`, or null when none was chosen.
+ * The scope a bare name registers under when `--scope` names none — as `@handle`, or null
+ * when none was chosen.
+ *
+ * ⭐ THE WORKSPACE THIS COMMAND WORKS IN *[Diego, 2026-10-06]* — an organization's handle,
+ * or your own for your personal workspace — said, not asked (`scopeOfWorkspace`). A team
+ * working in `@acme` registers `@acme/…`, which any of its members can release.
+ * ⛔ Until 2026-10-06 the default was your personal scope wherever you worked, so a team's
+ * foundation registered as `@jane/…` — releasable by Jane alone, and fixed only by
+ * renaming it into a new foundation.
+ *
+ * When the workspace names no scope — none is chosen, or it is a unit without a handle —
+ * the scope is derived from your orgs as before (`deriveScope`): your personal scope when
+ * you belong to none, else a pick at a terminal, your personal scope without one.
  */
 async function deriveScopeFromLogin(client, args) {
   const token = await client.token()
+  const ws = await resolveWorkspace({ client, args })
+  const personal = !ws.refused && ws.source !== 'offline' && ws.workspace === null
+  const accountHandle = personal ? (await client.fetchOrgs()).account_handle : null
+  const fromWorkspace = scopeOfWorkspace(ws, accountHandle)
+  if (fromWorkspace) {
+    const named = `${colors.bright}${fromWorkspace}${colors.reset}`
+    console.error(
+      personal
+        ? `Registering under your personal scope ${named} — you work in your personal workspace (${SOURCE_LABEL[ws.source]}). For an org: --scope @org.`
+        : `Registering under ${named} — the workspace you work in (${SOURCE_LABEL[ws.source]}). For another scope: --scope @org.`
+    )
+    return fromWorkspace
+  }
   const sess = await readRegistryAuth(client.origin)
   const derived = await deriveScope({
     apiBase: client.origin,
@@ -585,11 +612,13 @@ async function runRegister(args = []) {
     : await resolveFoundationDir(args)
 
   // Scope. ⭐ A FOUNDATION's is the one in its name (`name: '@acme/marketing'` in
-  // main.js), settled below before the build; a bare name takes --scope, else one
-  // derived from your orgs, and register writes it into the name (2026-09-22).
-  // A SCHEMAS-ONLY package has no name to carry one: --scope, else package.json
-  // `uniweb.scope`, else (real submit only) derived from login membership. Either
-  // spelling, `@acme` or `acme`, and from here on the one form: `@acme` (publishScope).
+  // main.js), settled below before the build; a bare name takes --scope, else the
+  // workspace the command works in (`deriveScopeFromLogin`), and register writes it
+  // into the name (2026-09-22). A SCHEMAS-ONLY package has no name to carry one:
+  // --scope, else package.json `uniweb.scope`, else (real submit only) the workspace
+  // the command works in. Either spelling, `@acme` or `acme`, and from here on the one
+  // form: `@acme` (publishScope). ⛔ This said "derived from your orgs" / "from login
+  // membership" until 2026-10-06, read as the personal-scope default that was replaced.
   const pkgScope = standalone ? readPkgScope(targetDir) : null
   const givenScope = scopeFlag || pkgScope
   let scope = publishScope(givenScope)
@@ -640,7 +669,6 @@ async function runRegister(args = []) {
       client
     })
     if (!settled) return { exitCode: 2 }
-    if (settled.cancelled) return { exitCode: 0 }
     scope = settled.scope
     scopeSource = settled.source
     // Build-if-stale (`foundationNeedsBuild`): a missing or stale dist/ gets
@@ -691,12 +719,12 @@ async function runRegister(args = []) {
     }
   }
 
-  // A schemas-only package with no scope, on a real submit → derive it from the login
-  // (your personal scope, or a pick among it and your orgs) and persist it to package.json.
+  // A schemas-only package with no scope, on a real submit → the workspace you work in,
+  // else derived from your orgs (`deriveScopeFromLogin`), and persisted to package.json.
   // (A foundation's was settled before its build — `settleFoundationScope`.)
   if (standalone && !scope && !isPreview) {
     const derived = await deriveScopeFromLogin(client, args)
-    if (!derived) return { exitCode: 0 }
+    if (!derived) return { exitCode: 2 }
     scope = derived
     scopeSource = 'login'
     try {
@@ -852,10 +880,27 @@ async function runRegister(args = []) {
         `${colors.dim}Schema for this version is already registered — resuming code delivery.${colors.reset}`
       )
     } else {
-      error(
-        `Registry rejected the submission: HTTP ${res.status} ${res.statusText}`
-      )
-      if (res.status === 401 || res.status === 403) {
+      // ⭐ NOT A MEMBER OF THE SCOPE IS SAID AS THAT *[Diego, 2026-10-06]*. The registry
+      // decides who may release into a scope — its account, or an org's members — and
+      // when the orgs read says you are neither, that is the refusal to name. ⛔ Until then
+      // a 403 here printed "log in again", the wrong advice for a scope that is not yours.
+      // Read to explain a refusal, never to gate one; a 401 is the credential itself.
+      const member =
+        res.status === 401 ? null : belongsToScope(scope, await client.fetchOrgs().catch(() => null))
+      if (member === false) {
+        const what = standalone
+          ? `data schemas under ${scope}`
+          : doc.entities.find((e) => e.model === '@uniweb/foundation-schema')?.info?.name || `a foundation under ${scope}`
+        error(`You can't release ${what}: you're not a member of ${scope}.`)
+        log(
+          `  ${colors.dim}A member of ${scope} can release it. (The registry answered HTTP ${res.status}.)${colors.reset}`
+        )
+      } else {
+        error(
+          `Registry rejected the submission: HTTP ${res.status} ${res.statusText}`
+        )
+      }
+      if (member !== false && (res.status === 401 || res.status === 403)) {
         log(
           `  ${colors.dim}The registry didn't accept your credentials — it may use different ones than \`uniweb login\`.${colors.reset}`
         )

package/src/commands/status.js

@@ -14,8 +14,11 @@
  *
  * Usage:
  *   uniweb status            Sync identity + unpushed content + foundation ref (local)
- *   uniweb status --remote   Also: draft-vs-live + a newer-registered-foundation check
- *   uniweb status --json     One JSON line (adds a `remote` object under --remote)
+ *   uniweb status --remote   Also: whether the backend still holds the site, draft-vs-live,
+ *                            and a newer-registered-foundation check
+ *   uniweb status --json     One JSON line (adds a `remote` object under --remote, whose
+ *                            `site_state` is live / gone / unknown — `gone` only on the
+ *                            backend's own word that it holds no such site)
  *
  * Run from a site, or a workspace with one site.
  */
@@ -119,6 +122,9 @@ export async function status(args = []) {
   // Remote signals — opt-in (`--remote`). May prompt for login. Degrades to null
   // on 404 / any failure, so a backend without the endpoints just shows local.
   let site = null
+  // Whether the backend holds the site this binding names — live / gone / unknown, never
+  // folded (`client.siteState`). Null when there is no binding to ask about.
+  let siteState = null
   let fdnLatest = null
   let foundationFresh = null // true/false when both digests are known; else null
   let localFoundationVersion = null
@@ -134,7 +140,14 @@ export async function status(args = []) {
       const ws = await resolveWorkspace({ client, args })
       if (ws.refused) throw Object.assign(new Error(ws.reason), { status: 409 })
       client.setWorkspace(ws.workspace, { source: ws.source })
-      if (uuid) site = await client.siteStatus(uuid)
+      if (uuid) {
+        siteState = await client.siteState(uuid)
+        if (siteState.state === 'live') {
+          site = siteState.site || null
+          // In another workspace: it exists, and the refusal says where — report it.
+          if (siteState.status === 409) remoteError = siteState.detail
+        }
+      }
       // Foundation freshness: prefer the LOCAL foundation's scoped name (so a
       // local-foundation site can be checked too); fall back to a scoped
       // site.yml ref. The digest compare is read-only — it never builds, so it
@@ -153,6 +166,8 @@ export async function status(args = []) {
       // backend does not work on this site from, or the deployment has another. Saying
       // nothing would read as "fine".
       if (err instanceof WorkspaceMismatchError || err?.status === 409) remoteError = err.message
+      // Not asked, or not answered: that is not knowing, never `gone`.
+      if (uuid && !siteState) siteState = { state: 'unknown', status: null, detail: err?.message || null }
     }
   }
 
@@ -168,6 +183,10 @@ export async function status(args = []) {
         ...(remote
           ? {
               remote: {
+                // ⭐ live · gone · unknown — `gone` only on the backend's own word about
+                // this site; null when this directory names no site on this backend.
+                site_state: siteState ? siteState.state : null,
+                site_state_detail: siteState?.detail ?? null,
                 site,
                 foundation_latest: fdnLatest?.latest_version ?? null,
                 foundation_fresh: foundationFresh,
@@ -221,6 +240,16 @@ export async function status(args = []) {
   // Remote signals
   if (remote) {
     if (remoteError) say.warn(remoteError)
+    if (siteState?.state === 'gone') {
+      say.warn(`The backend has no site ${uuid} — it was deleted there, or the backend was rebuilt.`)
+      say.dim(
+        `To push this as a new site: uniweb forget --backend ${probeBackend}, then uniweb push.`
+      )
+    } else if (siteState?.state === 'unknown') {
+      say.dim(
+        `Could not tell whether the backend holds this site${siteState.detail ? ` (${siteState.detail})` : ''}.`
+      )
+    }
     if (site) {
       if (site.draft_dirty) {
         say.info(

package/src/framework-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-10-06T01:57:25.800Z",
+  "generatedAt": "2026-10-06T02:16:00.292Z",
   "packages": {
     "@uniweb/api": {
       "version": "0.6.10",
@@ -43,7 +43,7 @@
       ]
     },
     "@uniweb/frame-bridge": {
-      "version": "0.3.1",
+      "version": "0.3.2",
       "path": "framework/frame-bridge",
       "deps": []
     },

package/src/index.js

@@ -917,10 +917,12 @@ async function main() {
   // Handle login command — the backend (username/password · paste a token ·
   // --token <bearer>). ⭐ `--backend <url>` names it; without the flag it is the DEFAULT
   // backend — UNIWEB_REGISTER_URL, else ~/.uniweb/config.json, else https://uniweb.app —
-  // and never the project's backend or the current session *[Diego, 2026-09-21: "the
-  // default backend for login, if not specified, is uniweb.app"]*. The backend logged in
-  // to becomes CURRENT, and every backend command goes there (only UNIWEB_REGISTER_URL
-  // outranks it) — which is why this is the one place a backend is chosen.
+  // and never the project's backend *[Diego, 2026-09-21: "the default backend for login, if
+  // not specified, is uniweb.app"]*. ⭐ Except a WORKSPACE SWITCH — `--org` / `--personal`
+  // and no way of signing in — which acts on the backend you are logged in to *[Diego,
+  // 2026-10-06]* (`resolveLoginOrigin`). The backend logged in to becomes CURRENT, and
+  // every backend command goes there (only UNIWEB_REGISTER_URL outranks it) — which is why
+  // this is the one place a backend is chosen.
   //
   // ⛔ Until 2026-09-21 a bare login went to the backend of the project in the cwd, and
   // asked when the machine knew several backends. Both are gone: the default is the
@@ -932,7 +934,7 @@ async function main() {
     const { resolveLoginOrigin } = await import('./utils/config.js')
     let apiBase
     try {
-      apiBase = resolveLoginOrigin(readFlagValue(loginArgs, '--backend'))
+      apiBase = resolveLoginOrigin(readFlagValue(loginArgs, '--backend'), loginArgs)
     } catch (err) {
       console.error(
         `\x1b[31m✗\x1b[0m ${err.message} — e.g. uniweb login --backend http://localhost:8080`
@@ -1729,8 +1731,8 @@ Auto-detects what you run it in:
 
 A foundation's scope is part of its name — name: '@scope/<name>' in main.js. A scope
 is a namespace: your personal one (@<your handle>, no org needed) or an org's. A bare
-name takes --scope, else your personal scope (or a pick, if you belong to orgs), and
-register writes it into the name.
+name takes --scope, else the workspace you work in (an org's scope, or your personal
+one), and register writes it into the name.
 
 Schema scopes:
   @/name     your own schema, in the foundation's scope   (@/x -> @org/x)
@@ -1742,6 +1744,9 @@ ${colors.bright}Options:${colors.reset}
                      org's — and write it into the name (refused when the name has another
                      scope). A schemas-only package: publish under @scope; default:
                      package.json uniweb.scope
+  --org @org         Work in @org for this command: a bare name registers under it
+  --personal         Work in your personal workspace: a bare name registers under your
+                     personal scope
   --dry-run          Print the .uwx; submit nothing
   -o, --output <f>   Write the .uwx to a file; submit nothing
   --non-interactive  Fail with usage info instead of prompting
@@ -1798,11 +1803,12 @@ ${colors.bright}The workspace you work in.${colors.reset} A login works in ONE w
 personal one, or an organization's — and every push, pull and publish works in it:
 a site it creates is created there, and a site kept in another workspace is refused.
 With no organization it is your personal workspace; with organizations you are asked,
-or name it. Already logged in, \`uniweb login --org @other\` switches without logging
-in again.
+or name it. Already logged in, \`uniweb login --org @other\` (or \`--personal\`) switches
+the workspace on the backend you are logged in to, without logging in again.
 
 ${colors.bright}Options:${colors.reset}
-  --backend <url>    The backend to log in to
+  --backend <url>    The backend to log in to (without it: the default backend — or, for
+                     --org / --personal alone, the one you are logged in to)
   --org @org         Work in @org (an organization you belong to)
   --personal         Work in your personal workspace
   --token <bearer>   Seed + verify a session from a bearer token (non-interactive)
@@ -1813,6 +1819,8 @@ ${colors.bright}Options:${colors.reset}
 In non-interactive mode (no TTY — an agent, a script), pass \`--token <bearer>\` with
 \`--org @org\` or \`--personal\`, or set \`UNIWEB_USERNAME\` + \`UNIWEB_PASSWORD\`, or set
 \`UNIWEB_TOKEN\` (per process, not stored) with \`UNIWEB_WORKSPACE=@org\` or \`personal\`.
+A login with organizations that names no workspace signs you in but exits 2;
+\`uniweb login --org @org\` (or \`--personal\`) finishes it without signing in again.
 \`uniweb logout\` logs you out.
 `,
     refresh: `
@@ -2089,6 +2097,16 @@ ${colors.bright}Global Options:${colors.reset}
   a script can aim and authenticate one process with UNIWEB_REGISTER_URL and
   UNIWEB_TOKEN instead.
 
+${colors.bright}Push Options:${colors.reset}
+  --dry-run          Report what would be pushed; send nothing (-o <file> writes the .uwx)
+  --no-release       Send content against the already-released code; release nothing
+  --bump             Release above a newer registered foundation version
+  --force            Overwrite upstream changes (drop the staleness gate)
+  --all              Send every record (bypass the changed-only cache)
+  --org @org         Work in @org for this push, not your login's workspace
+  --personal         Work in your personal workspace for this push
+  --no-validate      Skip the content-conformance check (it stops a push)
+
 ${colors.bright}Publish Options:${colors.reset}
   --dry-run          Resolve everything; release/sync/POST nothing
   --yes              Skip confirmations (CI); never block on a prompt

package/src/utils/config.js

@@ -107,32 +107,87 @@ export function getDefaultBackendOrigin() {
 }
 
 /**
- * The backend `uniweb login` logs in to: `--backend`, else the default backend.
+ * The `uniweb login` that SWITCHES the workspace on `origin` — the caller appends `--org @x`
+ * or `--personal` — with `--backend` unless a switch without it reaches `origin`
+ * (`resolveLoginOrigin`): the backend you are logged in to, or, logged in nowhere, the
+ * default backend.
+ *
+ * ⚠️ *Measured 2026-10-06 against a local backend, before switches acted on the session:*
+ * `uniweb login --org @acme` went to https://uniweb.app and began a new login there — the
+ * reason a hint about any other backend names it.
+ *
+ * @param {string} origin - the backend the hint is about
+ * @param {string} [prefix='uniweb'] - how the user runs the CLI (`getCliPrefix`)
+ * @returns {string} e.g. `uniweb login`, or `uniweb login --backend http://localhost:8080`
+ */
+export function loginCommand(origin, prefix = 'uniweb') {
+  const o = originOrNull(origin)
+  const reached = originOrNull(loggedInOrigin()) || getDefaultBackendOrigin()
+  return o && o !== reached ? `${prefix} login --backend ${o}` : `${prefix} login`
+}
+
+/** The flags with which `uniweb login` SIGNS IN — a method, or a credential. */
+const SIGN_IN_FLAGS = ['--token', '--browser', '--password', '--token-paste']
+
+/**
+ * Whether a `uniweb login` is a WORKSPACE SWITCH: `--org` or `--personal`, and nothing that
+ * signs in (`SIGN_IN_FLAGS`).
+ *
+ * @param {string[]} [args]
+ * @returns {boolean}
+ */
+export function isWorkspaceSwitch(args = []) {
+  const names = args.map((a) => String(a).split('=')[0])
+  return (
+    (names.includes('--org') || names.includes('--personal')) &&
+    !SIGN_IN_FLAGS.some((f) => names.includes(f))
+  )
+}
+
+/**
+ * The backend `uniweb login` logs in to: `--backend`; else, for a workspace switch, the
+ * backend you are logged in to; else the default backend.
+ *
+ * ⭐ A SWITCH ACTS ON YOUR SESSION *[Diego, 2026-10-06: "`uniweb login --org @x` or
+ * `--personal`, with no `--backend`, should switch to the workspace on the backend you're
+ * already logged in to so we can fullfil the promise 'switches without logging in again'"]*.
+ * Logged in nowhere, it is a first login, and goes where any first login goes. A login that
+ * signs in — a method or a credential named (`isWorkspaceSwitch`) — still goes to the
+ * default backend *[Diego, 2026-09-21: "the default backend for login, if not specified, is
+ * uniweb.app"]*. ⛔ Until 2026-10-06 a switch went to the default backend too, so on any
+ * other backend it began a new login there, logging you out of the one you were on.
  *
  * ⛔ A mistyped `--backend` is an error, never a fallback — it would log you in, and so
  * point every command, somewhere you did not name.
  *
  * @param {string|null|undefined} flag - `readFlagValue`'s answer: undefined when the
  *   flag is absent, null when it was given with no value
+ * @param {string[]} [args] - the login's argv, to tell a switch from a sign-in
  * @returns {string}
  * @throws {Error} when --backend was given and is not a URL
  */
-export function resolveLoginOrigin(flag) {
-  if (flag === undefined) return getDefaultBackendOrigin()
+export function resolveLoginOrigin(flag, args = []) {
+  if (flag === undefined) {
+    const session = isWorkspaceSwitch(args) ? originOrNull(loggedInOrigin()) : null
+    return session || getDefaultBackendOrigin()
+  }
   const origin = originOrNull(flag)
   if (!origin) throw new Error(flag ? `Not a URL: ${flag}` : '--backend needs a URL')
   return origin
 }
 
 /**
- * **The backend a command talks to** when no `--backend` is given — the base of every
- * `/dev/*` route (`register` POSTs to {origin}/dev/registry/register, and so on).
+ * **The backend a command talks to** — the base of every `/dev/*` route (`register`
+ * POSTs to {origin}/dev/registry/register, and so on).
  *
  * `UNIWEB_REGISTER_URL` > **the backend the user is logged in to** > the default
  * (`getDefaultBackendOrigin`). ⭐ Nothing talks to a backend the user is not logged in
  * to *[Diego, 2026-09-21]*: when this falls through to the default, the command's first
  * request asks for that login — so the default is where the login goes, never a
- * backend reached without one. `resolveBackendOrigin` puts `--backend` on top.
+ * backend reached without one. `resolveBackendOrigin` (backend/client.js) returns this
+ * unchanged: no command takes a `--backend`. ⛔ *Until 2026-10-05 this said "when no
+ * `--backend` is given" and that `resolveBackendOrigin` put `--backend` on top — read as
+ * a per-command flag outranking the login. The verbs lost that flag on 2026-09-21.*
  *
  * @returns {string}
  */

package/src/utils/registry-auth.js

@@ -98,7 +98,8 @@ export function getRegistryAuthPath() {
  * always logs you out of the one backend you may be logged in"]*. A login REPLACES the
  * file — once it succeeds, so a cancelled or failed login leaves you where you were —
  * and a logout deletes it. So "the backend you are logged in to" is exactly one thing
- * or nothing, and logout needs no selector.
+ * or nothing, and logout needs no selector. ⚠️ One exception, and it says so: a login that
+ * signs in but cannot choose a workspace keeps the session and exits 2 (`finishLogin`).
  *
  * ⚖️ The v2 map is kept, holding one entry: the file then has one reader
  * (utils/session-file.js), and it still understands what came before — a v1 flat
@@ -720,7 +721,12 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
       if (wants || !session.workspace) {
         const settled = await settleWorkspace(session, args)
         if (settled.refused) {
-          console.error(`\x1b[32m✓\x1b[0m Logged in to ${key}${who ? ` as \x1b[1m${who}\x1b[0m` : ''}.`)
+          // Say what the session works in now: unchanged, or — one from before workspaces —
+          // nothing yet (`finishLogin`).
+          const where = session.workspace
+            ? `${await workspaceTail(session)} — unchanged`
+            : ' — with no workspace chosen yet'
+          console.error(`\x1b[32m✓\x1b[0m Logged in to ${key}${who ? ` as \x1b[1m${who}\x1b[0m` : ''}${where}.`)
           console.error(`\x1b[31m✗\x1b[0m ${settled.refused}`)
           process.exit(2)
         }
@@ -839,15 +845,22 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
 
 /**
  * A login succeeded and its session is stored: choose its workspace, and say where the
- * login works. Without a workspace (no terminal, organizations, no flag) the session
- * stays, the reason is printed, and the login exits 2 — every command would refuse.
+ * login works.
+ *
+ * ⭐ WITHOUT A WORKSPACE THE SESSION STAYS, AND THE LOGIN SAYS SO *[Diego, 2026-10-06]*. No
+ * terminal, organizations, neither `--org` nor `--personal` — or a pick cancelled at a
+ * terminal: you are logged in, with no workspace, and the login exits 2 naming the one
+ * command that finishes it without signing in again. The credential was good, and a
+ * second sign-in can be a second browser round trip. ⚠️ So this is the one login that
+ * exits non-zero having replaced your session — the reason it says so in as many words.
  */
 async function finishLogin(record, apiBase, args) {
   const settled = await settleWorkspace(record, args)
   const who = settled.record.username ? ` as \x1b[1m${settled.record.username}\x1b[0m` : ''
   if (settled.refused) {
-    console.error(`\x1b[32m✓\x1b[0m Logged in${who} (${apiBase}).`)
+    console.error(`\x1b[32m✓\x1b[0m Logged in to ${normOrigin(apiBase)}${who} — with no workspace chosen yet.`)
     console.error(`\x1b[31m✗\x1b[0m ${settled.refused}`)
+    console.error('\x1b[2m  Until one is chosen, the commands that work on a site refuse.\x1b[0m')
     process.exit(2)
   }
   console.error(`\x1b[32m✓\x1b[0m Logged in${who} (${apiBase})${await workspaceTail(settled.record)}.`)

package/src/utils/registry-orgs.js

@@ -81,6 +81,25 @@ export function publishScope(value) {
   return handle ? `@${handle}` : null
 }
 
+/**
+ * Whether the orgs read (`GET /dev/orgs`) says this account may release into `scope`:
+ * the account's own handle, or an org it belongs to. True or false; null when there is
+ * nothing to say (no scope, no read).
+ *
+ * ⛔ For EXPLAINING a refusal only, never to gate a release: the registry decides who
+ * may publish into a scope, and this knows only the memberships that read lists.
+ *
+ * @param {string|null} scope - `@acme`, `acme` or `@acme/…`
+ * @param {{ account_handle?: string|null, orgs?: Array<{ handle?: string }> }|null} envelope
+ * @returns {boolean|null}
+ */
+export function belongsToScope(scope, envelope) {
+  const h = bareHandle(scope)
+  if (!h || !envelope || typeof envelope !== 'object') return null
+  if (bareHandle(envelope.account_handle || '') === h) return true
+  return (Array.isArray(envelope.orgs) ? envelope.orgs : []).some((o) => bareHandle(o?.handle) === h)
+}
+
 /**
  * Validate a handle's GRAMMAR client-side (reserved names are the server's
  * call — a 409 carries the verdict). Returns an error string, or null.
@@ -157,15 +176,22 @@ export async function createOrg({ apiBase, token, handle }) {
 }
 
 /**
- * The scope to register under, from the login, when none was named — a bare handle,
- * or null when none was chosen. Persists nothing; the caller records it (in the
- * foundation's name, or a schemas-only package's `package.json`).
+ * The scope to register under, from the login's orgs, when none was named and the
+ * workspace the command works in names none either — a bare handle, or null when none
+ * was chosen. Persists nothing; the caller records it (in the foundation's name, or a
+ * schemas-only package's `package.json`).
+ *
+ * ⚠️ The FALLBACK since 2026-10-06: a bare name first takes the workspace the command
+ * works in (`register.js::deriveScopeFromLogin`, `workspace.js::scopeOfWorkspace`). This
+ * answers only when no workspace is chosen — you belong to orgs and named none — or the
+ * one chosen is a unit without a handle.
  *
  * ⭐ A SCOPE IS A NAMESPACE (2026-09-23): your account's own, `@<handle>`, needs no org.
  *
  *   no org              → your personal scope — said, never asked, in CI too
  *   orgs                → pick: your personal scope first, then each org;
- *                         non-interactive, your personal scope, said
+ *                         non-interactive, REFUSED — choose a workspace, or --scope
+ *                         (until 2026-10-06: your personal scope, said)
  *   no account handle   → (a service account) its one org, said; several are asked,
  *                         or refused in CI; none is a pointer to `--scope`
  *
@@ -220,10 +246,20 @@ export async function deriveScope({
       )
       return null
     }
+    // ⛔ NO DEFAULT FOR A MEMBER OF ORGANIZATIONS *[Diego, 2026-10-06: "someone in an org,
+    // with no workspace chosen must choose one. we should not default to personal"]*. Only
+    // reached when the workspace the command works in names no scope — none is chosen — so
+    // the choice is theirs. ⚠️ Until then this answered your personal scope, said: a team's
+    // foundation registered as one member's.
+    const { getCliPrefix } = await import('./interactive.js')
+    const { loginCommand } = await import('./config.js')
+    const first = orgs[0].handle
     console.error(
-      `Registering under your personal scope ${bold(personal)} (non-interactive). Pass --scope @org for an org.`
+      `\x1b[31m✗\x1b[0m You belong to organizations (${orgs.map((o) => `@${o.handle}`).join(', ')}), so no scope is assumed.\n` +
+        `  Choose the workspace you work in — ${loginCommand(apiBase, getCliPrefix())} --org @${first} (or --personal) — and the name takes its scope;\n` +
+        `  or name the scope here: --scope @${first}, or --scope @${personal} for your own.`
     )
-    return personal
+    return null
   }
   const prompts = (await import('prompts')).default
   const { choice } = await prompts(
@@ -249,5 +285,6 @@ export async function deriveScope({
       }
     }
   )
+  if (!choice) console.error('\x1b[31m✗\x1b[0m No scope chosen.')
   return choice || null
 }