uniweb 1.15.4 → 1.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "1.15.4",
+  "version": "1.16.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,15 +41,15 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/schemas": "~1.6.3",
     "@uniweb/core": "~1.4.0",
+    "@uniweb/schemas": "~1.6.5",
     "@uniweb/semantic-parser": "~1.12.2",
     "@uniweb/content-writer": "~1.3.0"
   },
   "peerDependencies": {
+    "@uniweb/build": "~1.7.4",
     "@uniweb/semantic-parser": "~1.12.2",
-    "@uniweb/content-reader": "~1.5.4",
-    "@uniweb/build": "~1.7.3"
+    "@uniweb/content-reader": "~1.5.4"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/partials/agents.md

@@ -2631,6 +2631,18 @@ read that way comes back with `via: 'rbac'`. It is one step, and a backend refus
 to a field entries already fill. `grantable: false` keeps entries from being shared with a
 person or a team; omitted, they can be.
 
+A reference can also carry a purchase. `sold_with: true` — a boolean, and only on a reference
+or a list of them — means a buyer of the entry reads what the field names, through it, and onward
+along those entries' own `sold_with` fields, up to three steps:
+
+```yaml
+# foundation/schemas/course.yml
+fields:
+  lessons: { ref: '@/lesson', many: true, sold_with: true }   # a buyer of the course reads its lessons
+```
+
+An unmarked reference carries nothing, and `false` is the same as leaving it out.
+
 ### Acting as an administrator
 
 On a site, an administrator's session reads what their role reaches — the operator reads
@@ -2839,11 +2851,12 @@ Foundations have their own free path too: `uniweb add ci --target foundation` pu
 **Content authors work visually in the Uniweb App.** They compose the same extended markdown and set the same component params you defined, through a visual editor — never touching code, git, or the CLI. They see exactly the section types your foundation offers and exactly the knobs each one exposes, because **every `meta.js` is registered as the foundation's schema** when you publish. Your `meta.js` is the app's UI (see *meta.js* in Part 4).
 
 > ⚠️ **Every push, pull and publish works in ONE workspace — the one chosen at `uniweb login`.**
-> A workspace is your personal one or an organization's. A site a push or publish **creates** is
+> A workspace is your personal one, an organization's, or a sub-organization's or project's in one
+> (`@studio:acme`). A site a push or publish **creates** is
 > created — owned, and its storage billed — there, and there is no CLI command to move it
 > afterwards. A site the backend keeps in **another** workspace stops the command, which says how
-> to switch. With no organization, the login works in your personal workspace; with
-> organizations, the login asks, or you name it:
+> to switch. With no organization or project, the login works in your personal workspace;
+> otherwise the login asks, or you name it:
 >
 > ```bash
 > uniweb login --org @acme      # work in an organization
@@ -2853,7 +2866,7 @@ Foundations have their own free path too: `uniweb add ci --target foundation` pu
 >
 > Already logged in, `uniweb login --org @other` (or `--personal`) switches the workspace on the
 > backend you are logged in to, without logging in again. **Without a
-> terminal — you, an agent — a login with organizations and no workspace named signs you in but
+> terminal — you, an agent — a login with organizations or projects and no workspace named signs you in but
 > exits 2**: `uniweb login --org @acme` (or `--personal`) finishes it without signing in again.
 > Until then every command that works on a site refuses, and so does registering a foundation whose
 > name has no scope. A process logged in with `UNIWEB_TOKEN` names its workspace with

package/src/backend/client.js

@@ -165,6 +165,11 @@ export function workspaceHandle(value) {
 
 const UNIT_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 
+/** Whether `value` is shaped like a unit's uuid — how the header names a unit with no handle. */
+export function isUnitUuid(value) {
+  return typeof value === 'string' && UNIT_UUID.test(value.trim())
+}
+
 /**
  * A workspace as a sentence names it: `@acme`, `the unit <uuid>`, or `your personal
  * workspace` — for null, and for a login's stored `personal`.
@@ -180,8 +185,8 @@ export function describeWorkspace(workspace) {
  *
  * ⚠️ A bare value is taken for a uuid only when it is shaped like one, and our own
  * handle grammar admits uuid-shaped handles (3–39 lowercase letters, digits, hyphens).
- * So a HANDLE reaches this already dressed — `--org` through `workspaceHandle`, a
- * login's choice as stored — and a bare uuid here is a unit.
+ * So a HANDLE reaches this already dressed — `--org` through `namedWorkspace`
+ * (`workspace.js`), a login's choice as stored — and a bare uuid here is a unit.
  *
  * @param {unknown} value
  * @returns {string|null}
@@ -214,20 +219,16 @@ export class WorkspaceMismatchError extends Error {
   constructor({ named, answer, nowhere = false, source = 'login', origin = null, message = null }) {
     const where = (w) =>
       !w ? 'your personal workspace' : w.startsWith('@') ? w : `the unit ${w}`
-    // How to work in the site's workspace, said for the way this one was chosen.
+    // How to work in the site's workspace, said for the way this one was chosen. A unit with
+    // no handle is named by its uuid, as the header names it. ⛔ *Until 2026-10-22 this said
+    // "It has no handle, so the CLI cannot work in it": a login could choose only what the
+    // orgs read listed, and that list left handle-less units out (`workspace.js`).*
     const switchTo = !answer
       ? { flag: 'pass --personal', env: 'set UNIWEB_WORKSPACE=personal' }
-      : answer.startsWith('@')
-        ? { flag: `pass --org ${answer}`, env: `set UNIWEB_WORKSPACE=${answer}` }
-        : null
-    const login = !answer
-      ? `${loginCommand(origin)} --personal`
-      : answer.startsWith('@')
-        ? `${loginCommand(origin)} --org ${answer}`
-        : null
-    const fix = !switchTo
-      ? 'It has no handle, so the CLI cannot work in it.'
-      : source === 'flag'
+      : { flag: `pass --org ${answer}`, env: `set UNIWEB_WORKSPACE=${answer}` }
+    const login = !answer ? `${loginCommand(origin)} --personal` : `${loginCommand(origin)} --org ${answer}`
+    const fix =
+      source === 'flag'
         ? `To work on it, ${switchTo.flag}.`
         : source === 'env'
           ? `To work on it, ${switchTo.env}.`

package/src/backend/workspace.js

@@ -23,13 +23,19 @@
  *
  * ⛔ **The personal workspace is named by naming NONE.** `@<your handle>` is your personal
  * SCOPE — a registry namespace for foundations and data schemas — not a workspace.
+ *
+ * ⭐ **A workspace is any unit the backend lets a request name** (backend, 2026-10-22): an
+ * organization, and the units below one — a sub-org, a project — each under its child handle,
+ * `@top:part` (`@studio:acme`); a unit with no handle by its uuid. The login checks and offers
+ * them from the orgs read's `workspaces`, never its `orgs`, which are the SCOPES and leave every
+ * child unit out (`registry-orgs.js`). A child handle names a workspace and no scope.
  */
 
 import { readOrgFlag } from '../utils/args.js'
 import { loginCommand } from '../utils/config.js'
 import { fetchOrgs, bareHandle, validateHandle } from '../utils/registry-orgs.js'
 import { readRegistryAuth } from '../utils/registry-auth.js'
-import { workspaceHandle, describeWorkspace } from './client.js'
+import { workspaceHandle, describeWorkspace, isUnitUuid } from './client.js'
 
 export { describeWorkspace }
 
@@ -40,18 +46,58 @@ export const PERSONAL = 'personal'
 export const WORKSPACE_ENV = 'UNIWEB_WORKSPACE'
 
 /**
- * A workspace choice as it may be written — `@acme`, `acme`, `personal` — or null when
- * the value names none.
+ * A workspace as `--org` names it, in the header's form: a unit's uuid when the value is
+ * written bare and shaped like one — the header's own rule, where the `@` tells the two
+ * apart — else a handle, `@acme` or `@studio:acme`. Null when the value names none.
+ *
+ * @param {unknown} value
+ * @returns {string|null}
+ */
+export function namedWorkspace(value) {
+  if (typeof value !== 'string' || !value.trim()) return null
+  const v = value.trim()
+  return isUnitUuid(v) ? v.toLowerCase() : workspaceHandle(v)
+}
+
+/**
+ * A workspace choice as it may be written — `@acme`, `acme`, `@studio:acme`, a unit's uuid,
+ * `personal` — or null when the value names none.
  *
  * @param {unknown} value
- * @returns {string|null} `@acme`, `PERSONAL`, or null
+ * @returns {string|null} `@acme`, a uuid, `PERSONAL`, or null
  */
 export function parseWorkspaceChoice(value) {
   if (typeof value !== 'string' || !value.trim()) return null
   const v = value.trim()
-  return v === PERSONAL ? PERSONAL : workspaceHandle(v)
+  return v === PERSONAL ? PERSONAL : namedWorkspace(v)
 }
 
+/**
+ * The workspaces the orgs read lists — what the header admits — each by the name a request
+ * gives it: `@handle`, or the unit's uuid when it has none. Null when the answer carries no
+ * list, which a workspace reader refuses (`noWorkspaceList`).
+ *
+ * @param {{ workspaces?: Array<{ unit_uuid?: string, handle?: string|null, kind?: string, is_primary?: boolean }>|null }|null} envelope
+ * @returns {Array<{ name: string, kind: string|null, primary: boolean }>|null}
+ */
+export function listedWorkspaces(envelope) {
+  if (!Array.isArray(envelope?.workspaces)) return null
+  return envelope.workspaces
+    .map((w) => ({
+      name: w?.handle ? workspaceHandle(w.handle) : isUnitUuid(w?.unit_uuid) ? w.unit_uuid.trim().toLowerCase() : null,
+      kind: typeof w?.kind === 'string' ? w.kind : null,
+      primary: w?.is_primary === true
+    }))
+    .filter((w) => w.name)
+}
+
+/**
+ * What a backend whose orgs read lists no workspaces is told. ⛔ The CLI does not check
+ * against `orgs` in its place: that list leaves out every unit below an org.
+ */
+export const noWorkspaceList = (origin) =>
+  `${origin} lists no workspaces, so the CLI cannot check or offer one — that backend is older than this CLI.`
+
 /** A choice in the header's form: `@acme`, or null for the personal workspace. */
 export function headerOf(choice) {
   return choice === PERSONAL ? null : choice
@@ -62,7 +108,7 @@ export const SOURCE_LABEL = {
   flag: 'named on this command',
   env: WORKSPACE_ENV,
   login: 'your login',
-  personal: 'you belong to no organization',
+  personal: 'you belong to no organization or project',
   offline: 'not resolved in a preview'
 }
 
@@ -88,7 +134,7 @@ const choose = (origin) =>
  */
 export async function resolveWorkspace({ client, args = [], offline = false }) {
   const flag = readOrgFlag(args)
-  if (flag) return { workspace: workspaceHandle(flag), source: 'flag' }
+  if (flag) return { workspace: namedWorkspace(flag), source: 'flag' }
   if (args.includes('--personal')) return { workspace: null, source: 'flag' }
 
   const raw = process.env[WORKSPACE_ENV]
@@ -118,11 +164,14 @@ export async function resolveWorkspace({ client, args = [], offline = false }) {
   const now = await fromSession()
   if (now) return { workspace: headerOf(now), source: 'login' }
 
-  const { orgs } = await client.fetchOrgs()
-  if (!orgs.length) return { workspace: null, source: 'personal' }
+  // Personal only when it is the one workspace there is — a project counts as much as an
+  // organization (`listedWorkspaces`).
+  const listed = listedWorkspaces(await client.fetchOrgs())
+  if (!listed) return { refused: true, reason: noWorkspaceList(client.origin) }
+  if (!listed.length) return { workspace: null, source: 'personal' }
   return {
     refused: true,
-    reason: `You belong to organizations, so no workspace is assumed.\n  ${choose(client.origin)}`
+    reason: `You belong to organizations or projects, so no workspace is assumed.\n  ${choose(client.origin)}`
   }
 }
 
@@ -138,8 +187,9 @@ export async function resolveWorkspace({ client, args = [], offline = false }) {
  *
  * Null when the workspace names no scope, and the caller derives one as before
  * (`deriveScope`): none is chosen (you belong to organizations and none is named), the
- * command is a preview, the workspace is a unit without a handle, or the account has no
- * handle (a service account).
+ * command is a preview, the workspace is a unit without a handle, the workspace is a unit
+ * below an organization — a sub-org or a project, whose child handle (`@studio:acme`) names
+ * no scope (backend, 2026-10-22) — or the account has no handle (a service account).
  *
  * @param {{ workspace?: string|null, source?: string, refused?: boolean }} ws -
  *   `resolveWorkspace`'s answer
@@ -149,7 +199,9 @@ export async function resolveWorkspace({ client, args = [], offline = false }) {
  */
 export function scopeOfWorkspace(ws, accountHandle) {
   if (!ws || ws.refused || ws.source === 'offline') return null
-  if (typeof ws.workspace === 'string') return ws.workspace.startsWith('@') ? ws.workspace : null
+  if (typeof ws.workspace === 'string') {
+    return ws.workspace.startsWith('@') && !ws.workspace.includes(':') ? ws.workspace : null
+  }
   const h = bareHandle(accountHandle || '')
   return h && !validateHandle(h) ? `@${h}` : null
 }
@@ -158,42 +210,46 @@ export function scopeOfWorkspace(ws, accountHandle) {
  * The workspace a login works in — asked once, at `uniweb login`, and stored with the
  * session.
  *
- *   `--org @acme`            must be an organization you belong to
+ *   `--org @acme`            must be a workspace the orgs read lists — an organization, or
+ *                            a sub-org or a project under its child handle (`@studio:acme`),
+ *                            or a unit with no handle by its uuid
  *   `--personal`             your personal workspace
- *   neither, no organization your personal workspace — said, not asked
- *   neither, organizations   a pick at a terminal; refused without one
+ *   neither, none listed     your personal workspace — said, not asked
+ *   neither, some listed     a pick at a terminal; refused without one
  *
  * @param {object} p
  * @param {string} p.apiBase
  * @param {string} p.token
  * @param {string[]} [p.args]
  * @returns {Promise<{ choice: string, note?: string } | { refused: true, reason: string }>}
- *   `choice` is `@acme` or `PERSONAL`
+ *   `choice` is `@acme`, a unit's uuid, or `PERSONAL`
  */
 export async function chooseWorkspace({ apiBase, token, args = [] }) {
   const flag = readOrgFlag(args)
   if (!flag && args.includes('--personal')) return { choice: PERSONAL }
 
-  const { orgs } = await fetchOrgs({ apiBase, token })
-  const mine = orgs.map((o) => `@${o.handle}`)
+  const listed = listedWorkspaces(await fetchOrgs({ apiBase, token }))
+  if (!listed) return { refused: true, reason: noWorkspaceList(apiBase) }
+  const mine = listed.map((w) => w.name)
   if (flag) {
-    const h = workspaceHandle(flag)
-    if (!mine.includes(h)) {
+    const named = namedWorkspace(flag)
+    if (!named) return { refused: true, reason: `--org ${flag} names no workspace — give @org, or --personal.` }
+    if (!mine.includes(named)) {
       return {
         refused: true,
         reason:
-          `You are not a member of ${h} on ${apiBase}. ` +
+          `${describeWorkspace(named)} is not a workspace you can open on ${apiBase}. ` +
           (mine.length
             ? `Your workspaces: ${[...mine, `--personal`].join(', ')}.`
-            : 'You belong to no organization — use --personal.')
+            : 'You belong to no organization or project — use --personal.')
       }
     }
-    return { choice: h }
+    return { choice: named }
   }
-  if (!orgs.length) {
+  if (!listed.length) {
     return {
       choice: PERSONAL,
-      note: 'You belong to no organization, so you work in your personal workspace.'
+      note: 'You belong to no organization or project, so you work in your personal workspace.'
     }
   }
 
@@ -207,7 +263,7 @@ export async function chooseWorkspace({ apiBase, token, args = [] }) {
   if (isNonInteractive(args)) {
     return {
       refused: true,
-      reason: `You belong to organizations, so no workspace is assumed. ${howToChoose}`
+      reason: `You belong to organizations or projects, so no workspace is assumed. ${howToChoose}`
     }
   }
   const prompts = (await import('prompts')).default
@@ -218,9 +274,9 @@ export async function chooseWorkspace({ apiBase, token, args = [] }) {
       message: 'Which workspace do you work in?',
       choices: [
         { title: 'Personal — your own sites', value: PERSONAL },
-        ...orgs.map((o) => ({
-          title: `@${o.handle}${o.is_primary ? ' (primary)' : ''}`,
-          value: `@${o.handle}`
+        ...listed.map((w) => ({
+          title: `${describeWorkspace(w.name)}${w.kind === 'project' ? ' — a project' : ''}${w.primary ? ' (primary)' : ''}`,
+          value: w.name
         }))
       ],
       initial: 0

package/src/commands/publish.js

@@ -573,9 +573,14 @@ export async function publish(args = []) {
     say.dim(`This publish creates the site in ${describeWorkspace(ws.workspace)} (${SOURCE_LABEL[ws.source]}).`)
   }
 
-  // 2. Build the site data (link mode): dist/site-content.json (+ per-locale),
-  //    dist/data/*, dist/assets/*. Spawn the SAME CLI binary so the inner
-  //    build can't resolve to a different installed version.
+  // 2. Build the site data (link mode): dist/site-content.json (+ per-locale)
+  //    and dist/data/*. No media is processed: 4b uploads it from the site's
+  //    own files. Spawn the SAME CLI binary so the inner build can't resolve to
+  //    a different installed version.
+  //
+  //    ⛔ *This listed `dist/assets/*` until 2026-10-22; the link build has made
+  //    no media copies since 2026-10-19 (`site/build-site-data.js`, "Does NOT
+  //    emit").*
   //
   //    ⛔ NO SEARCH INDEX. This listed `dist/_search/*` until 2026-08-26; the
   //    link lane stopped emitting one on 2026-08-01 (`@uniweb/build`
@@ -619,8 +624,9 @@ export async function publish(args = []) {
     if (!guard.ok) return { exitCode: 1 }
   }
 
-  // 3. Partition collections by schema presence (a first emit reads `schemaless`
-  //    — collections with no data schema, delivered statically via the ball).
+  // 3. Partition the queries by schema presence (a first emit reads `schemaless`
+  //    — the queries with no data schema, whose compiled files 4c uploads; no
+  //    ball carries them since 2026-08-18).
   let probe
   try {
     probe = await emitSyncPackages(siteDir, {
@@ -846,13 +852,14 @@ export async function publish(args = []) {
     siteDir,
     note: (m) => say.dim(m)
   })
-  // Stamp deploy-derived info on the site-content entity: the data-bundle URL,
-  // and the PINNED foundation ref (`@scope/name@version`) from the bring-along.
-  // Delivery is version-pinned end-to-end (the gateway serves a foundation only
-  // by a concrete version — collab framework↔backend), so pinning the
-  // released version on the wire is required when site.yml uses an unversioned
-  // local ref; injectInfo overrides info.foundation. A registry/URL ref → fnd.ref
-  // is null → the site.yml ref is forwarded verbatim (already pinned).
+  // Stamp the PINNED foundation ref (`@scope/name@version`) from the bring-along
+  // on the site-content entity — the one key `injectInfo` carries since the
+  // data-bundle URL went (2026-08-18). Delivery is version-pinned end-to-end (a
+  // foundation is delivered only by a concrete version, agreed with backend and
+  // measured end to end on 2026-06-25), so pinning the released version on the
+  // wire is required when site.yml uses an unversioned local ref; injectInfo
+  // overrides info.foundation. A registry/URL ref → fnd.ref is null → the
+  // site.yml ref is forwarded verbatim (already pinned).
   // ⛔ DO NOT STAMP A FILE MAP INTO `info` HERE. `injectInfo` WINS the merge
   // (`sync-package.js`: `{...siteDoc.info, ...injectInfo}`), so any name stamped
   // here silently replaces what the author's document carries under it, and the
@@ -861,8 +868,8 @@ export async function publish(args = []) {
   // that moved to `settings.fetch`, and the warning holds for any name.
   //
   // A file map needs a name nothing else claims (`static_data` / `data_files`
-  // were proposed) AND a consumer that reads it — neither settled. See
-  // one object per file, no bundle.
+  // were proposed) AND a consumer that reads it — neither settled. Until then
+  // the schema-less data goes as 4c sends it: one object per file, no bundle.
   const injectInfo = {
     ...(fnd.ref ? { foundation: fnd.ref } : {})
   }

package/src/commands/register.js

@@ -407,6 +407,13 @@ async function deriveScopeFromLogin(client, args) {
     )
     return fromWorkspace
   }
+  // A unit below an organization — a sub-org, a project — is a workspace and no scope (backend,
+  // 2026-10-22), so a bare name is asked for one as when no workspace names any.
+  if (typeof ws.workspace === 'string' && ws.workspace.includes(':')) {
+    console.error(
+      `${colors.dim}${ws.workspace}, the workspace you work in, is a unit below an organization, and names no scope.${colors.reset}`
+    )
+  }
   const sess = await readRegistryAuth(client.origin)
   const derived = await deriveScope({
     apiBase: client.origin,

package/src/framework-index.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-10-21T04:14:08.358Z",
+  "generatedAt": "2026-10-22T17:15:55.292Z",
   "packages": {
     "@uniweb/api": {
-      "version": "1.6.2"
+      "version": "1.6.4"
     },
     "@uniweb/build": {
-      "version": "1.7.3"
+      "version": "1.7.4"
     },
     "@uniweb/content-reader": {
       "version": "1.5.4"
@@ -42,7 +42,7 @@
       "version": "1.0.1"
     },
     "@uniweb/schemas": {
-      "version": "1.6.3"
+      "version": "1.6.5"
     },
     "@uniweb/scholar": {
       "version": "1.1.0"

package/src/index.js

@@ -1815,16 +1815,17 @@ Without --server: https://uniweb.app (or \$UNIWEB_SERVER). No command talks
 to a backend you are not logged in to — run one before logging in and it asks first.
 
 ${colors.bright}The workspace you work in.${colors.reset} A login works in ONE workspace — your
-personal one, or an organization's — and every push, pull and publish works in it:
-a site it creates is created there, and a site kept in another workspace is refused.
-With no organization it is your personal workspace; with organizations you are asked,
-or name it. Already logged in, \`uniweb login --org @other\` (or \`--personal\`) switches
+personal one, an organization's, or a sub-organization's or project's in one
+(@studio:acme) — and every push, pull and publish works in it: a site it creates is
+created there, and a site kept in another workspace is refused. With no organization
+or project it is your personal workspace; with some you are asked, or name it. Already logged in, \`uniweb login --org @other\` (or \`--personal\`) switches
 the workspace on the backend you are logged in to, without logging in again.
 
 ${colors.bright}Options:${colors.reset}
   --server <url>    The backend to log in to (without it: the default backend — or, for
                      --org / --personal alone, the one you are logged in to)
-  --org @org         Work in @org (an organization you belong to)
+  --org @org         Work in @org — an organization, sub-organization or project you
+                     belong to (@studio:acme); a unit with no handle, by its uuid
   --personal         Work in your personal workspace
   --token <bearer>   Seed + verify a session from a bearer token (non-interactive)
   --browser          Force the browser method
@@ -1833,7 +1834,7 @@ ${colors.bright}Options:${colors.reset}
 
 In non-interactive mode (no TTY — an agent, a script), pass \`--token <bearer>\` with
 \`--org @org\` or \`--personal\`, or set \`UNIWEB_USERNAME\` + \`UNIWEB_PASSWORD\`.
-A login with organizations that names no workspace signs you in but exits 2;
+A login with organizations or projects that names no workspace signs you in but exits 2;
 \`uniweb login --org @org\` (or \`--personal\`) finishes it without signing in again.
 \`uniweb logout\` logs you out.
 

package/src/utils/registry-auth.js

@@ -950,8 +950,9 @@ async function reportTokenProcess({ named, token }) {
   )
 
   // Their workspace is UNIWEB_WORKSPACE's — never the stored session's — and, with none
-  // named, personal for an account in no organization (resolveWorkspace, workspace.js).
-  const { WORKSPACE_ENV, PERSONAL, parseWorkspaceChoice, headerOf, describeWorkspace } =
+  // named, personal for an account in no organization or project (resolveWorkspace,
+  // workspace.js). Checked, as a login's `--org` is, against the workspaces the orgs read lists.
+  const { WORKSPACE_ENV, PERSONAL, parseWorkspaceChoice, headerOf, describeWorkspace, listedWorkspaces, noWorkspaceList } =
     await import('../backend/workspace.js')
   const unsettled = (reason, { commandsRefuse }) => {
     console.error(`\x1b[31m✗\x1b[0m ${reason}`)
@@ -967,28 +968,32 @@ async function reportTokenProcess({ named, token }) {
       commandsRefuse: true
     })
   }
-  let orgs
+  let listed
   try {
-    orgs = (await (await import('./registry-orgs.js')).fetchOrgs({ apiBase: origin, token })).orgs
+    listed = listedWorkspaces(await (await import('./registry-orgs.js')).fetchOrgs({ apiBase: origin, token }))
   } catch (err) {
     console.error(`\x1b[33m⚠\x1b[0m ${err.message} — the workspace is not checked.`)
     return
   }
-  const mine = orgs.map((o) => `@${o.handle}`)
+  if (!listed) {
+    console.error(`\x1b[33m⚠\x1b[0m ${noWorkspaceList(origin)}`)
+    return
+  }
+  const mine = listed.map((w) => w.name)
   if (choice && choice !== PERSONAL && !mine.includes(choice)) {
     // As a login refuses `--org` for one (chooseWorkspace).
-    unsettled(`${WORKSPACE_ENV}=${raw} is not one of this account's organizations on ${origin}.`, {
+    unsettled(`${WORKSPACE_ENV}=${raw} is not one of this account's workspaces on ${origin}.`, {
       commandsRefuse: false
     })
   }
   if (!choice && mine.length) {
     unsettled(
-      `The account belongs to organizations, so no workspace is assumed: set ${WORKSPACE_ENV}=${mine[0]} (or another, or personal).`,
+      `The account belongs to organizations or projects, so no workspace is assumed: set ${WORKSPACE_ENV}=${mine[0]} (or another, or personal).`,
       { commandsRefuse: true }
     )
   }
   const where = describeWorkspace(headerOf(choice || PERSONAL))
   console.error(
-    `  They work in \x1b[1m${where}\x1b[0m${choice ? ` (${WORKSPACE_ENV})` : ' — the account belongs to no organization'}.`
+    `  They work in \x1b[1m${where}\x1b[0m${choice ? ` (${WORKSPACE_ENV})` : ' — the account belongs to no organization or project'}.`
   )
 }

package/src/utils/registry-orgs.js

@@ -26,8 +26,20 @@
  *
  *   GET  /dev/orgs → {
  *     account_handle: string|null,     // the caller's account handle
- *     orgs: [{ handle, is_primary }]   // memberships, primary first;
- *   }                                  // handle-less units filtered server-side
+ *     orgs: [{ handle, is_primary }],  // the SCOPES: top-level orgs, primary first;
+ *                                      // handle-less units filtered server-side
+ *     workspaces: [{ unit_uuid, handle, kind, is_primary }]
+ *   }                                  // what `x-uniweb-workspace` admits
+ *
+ * ⭐ TWO LISTS, BECAUSE A WORKSPACE IS NOT A SCOPE (backend, 2026-10-22). `orgs` are the
+ * scopes a foundation registers under — the login's scope picker (`deriveScope`) and the
+ * membership read (`belongsToScope`) stay on it. `workspaces` are where a command may work:
+ * the organizations AND the units below them — a sub-org, a project (`kind: "project"`) —
+ * each under its child handle, `top:part` (`studio:acme`), and a unit with no handle by its
+ * `unit_uuid`. They differ exactly where a workspace is no scope: a child handle names none.
+ * The login's `--org` and its pick read `workspaces` (`backend/workspace.js`). ⛔ *Until
+ * 2026-10-22 both read `orgs`, which listed sub-orgs then; since that day it lists none, so a
+ * login refused a project or a sub-org even when a `409` had just named it.*
  *
  *   POST /dev/orgs { handle } → { handle, uuid, is_primary }
  *
@@ -114,9 +126,13 @@ export function validateHandle(handle) {
 }
 
 /**
- * The picker read: memberships + the caller's account handle + whether the
- * personal org already exists.
- * @returns {Promise<{account_handle: string|null, orgs: Array<{handle: string, is_primary: boolean}>}>}
+ * The orgs read: the caller's account handle, the scopes (`orgs`) and the workspaces.
+ *
+ * `workspaces` is null when the answer carries no list — a backend older than the list
+ * (2026-10-22). The workspace readers refuse then, saying so (`backend/workspace.js`);
+ * they never stand `orgs` in for it, which leaves the units below an org out.
+ *
+ * @returns {Promise<{account_handle: string|null, orgs: Array<{handle: string, is_primary: boolean}>, workspaces: Array<{unit_uuid?: string, handle?: string|null, kind?: string, is_primary?: boolean}>|null}>}
  */
 export async function fetchOrgs({ apiBase, token, fetchImpl = globalThis.fetch }) {
   const res = await fetchImpl(`${apiBase.replace(/\/$/, '')}${ORGS_PATH}`, {
@@ -129,7 +145,8 @@ export async function fetchOrgs({ apiBase, token, fetchImpl = globalThis.fetch }
   const data = await res.json().catch(() => null)
   return {
     account_handle: data?.account_handle ?? null,
-    orgs: Array.isArray(data?.orgs) ? data.orgs : []
+    orgs: Array.isArray(data?.orgs) ? data.orgs : [],
+    workspaces: Array.isArray(data?.workspaces) ? data.workspaces : null
   }
 }