uniweb 1.16.0 → 1.16.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "1.16.0",
+  "version": "1.16.1",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,15 +41,15 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/core": "~1.4.0",
     "@uniweb/schemas": "~1.6.5",
+    "@uniweb/core": "~1.4.0",
     "@uniweb/semantic-parser": "~1.12.2",
     "@uniweb/content-writer": "~1.3.0"
   },
   "peerDependencies": {
-    "@uniweb/build": "~1.7.4",
     "@uniweb/semantic-parser": "~1.12.2",
-    "@uniweb/content-reader": "~1.5.4"
+    "@uniweb/content-reader": "~1.5.4",
+    "@uniweb/build": "~1.7.4"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/src/backend/workspace.js

@@ -91,6 +91,33 @@ export function listedWorkspaces(envelope) {
     .filter((w) => w.name)
 }
 
+/**
+ * The top-level organization of a unit named by its child handle — `@studio` for `@studio:acme`,
+ * the part before the colon (backend, 2026-10-22).
+ *
+ * @param {string} handle - `@top:part`
+ * @returns {string} `@top`
+ */
+export function topOfChildHandle(handle) {
+  return `@${String(handle).replace(/^@/, '').split(':')[0]}`
+}
+
+/**
+ * The account's own handle, as the header would name it (`@jane`), from the orgs read — or null.
+ *
+ * ⛔ **An account's handle names no workspace** (backend, 2026-10-22, pinned by its tests). A
+ * handle names a person or an org, and only an org is a workspace: the header answers
+ * `@<account handle>` with `400`, never as the personal workspace, which a request names by
+ * naming none. So `--org @<your handle>` is refused, saying what names your own.
+ */
+export function ownHandle(envelope) {
+  return envelope?.account_handle ? workspaceHandle(envelope.account_handle) : null
+}
+
+/** What naming your own handle as a workspace is told — `--personal`, or `UNIWEB_WORKSPACE=personal`. */
+export const ownHandleNamesNone = (named, personal) =>
+  `${named} is your own handle, which names no workspace — your personal workspace is ${personal}.`
+
 /**
  * What a backend whose orgs read lists no workspaces is told. ⛔ The CLI does not check
  * against `orgs` in its place: that list leaves out every unit below an org.
@@ -185,22 +212,36 @@ export async function resolveWorkspace({ client, args = [], offline = false }) {
  * decides which SITE a command works on; here it only answers the question a bare name
  * asks the first time it registers.
  *
+ * ⭐ **A unit below an organization — a sub-org, a project — takes its organization's scope**
+ * *[Diego, 2026-10-22]*: its child handle (`@studio:acme`) names no scope (backend, the same day),
+ * and a bare name registered from it defaults to the top-level org's handle, `@studio`, when that
+ * org is among the account's organizations — the orgs read's `orgs`, the scopes. Not otherwise: a
+ * project's guest belongs to the project alone and has only their own scope, and so do the people
+ * of a sub-org whose belonging stops there — which the orgs read cannot tell apart, so membership is
+ * read from `orgs` and nothing else.
+ *
  * Null when the workspace names no scope, and the caller derives one as before
  * (`deriveScope`): none is chosen (you belong to organizations and none is named), the
  * command is a preview, the workspace is a unit without a handle, the workspace is a unit
- * below an organization — a sub-org or a project, whose child handle (`@studio:acme`) names
- * no scope (backend, 2026-10-22) — or the account has no handle (a service account).
+ * below an organization the account is not a member of, or the account has no handle (a
+ * service account).
  *
  * @param {{ workspace?: string|null, source?: string, refused?: boolean }} ws -
  *   `resolveWorkspace`'s answer
  * @param {string|null} accountHandle - the account's own handle (`GET /dev/orgs`), read
  *   only for the personal workspace
+ * @param {Array<{ handle?: string }>} [orgs] - the orgs read's `orgs`, read only for a unit
+ *   below an organization
  * @returns {string|null} `@handle`
  */
-export function scopeOfWorkspace(ws, accountHandle) {
+export function scopeOfWorkspace(ws, accountHandle, orgs = []) {
   if (!ws || ws.refused || ws.source === 'offline') return null
   if (typeof ws.workspace === 'string') {
-    return ws.workspace.startsWith('@') && !ws.workspace.includes(':') ? ws.workspace : null
+    if (!ws.workspace.startsWith('@')) return null
+    if (!ws.workspace.includes(':')) return ws.workspace
+    const top = topOfChildHandle(ws.workspace)
+    const member = (Array.isArray(orgs) ? orgs : []).some((o) => `@${bareHandle(o?.handle)}` === top)
+    return member ? top : null
   }
   const h = bareHandle(accountHandle || '')
   return h && !validateHandle(h) ? `@${h}` : null
@@ -228,12 +269,14 @@ export async function chooseWorkspace({ apiBase, token, args = [] }) {
   const flag = readOrgFlag(args)
   if (!flag && args.includes('--personal')) return { choice: PERSONAL }
 
-  const listed = listedWorkspaces(await fetchOrgs({ apiBase, token }))
+  const envelope = await fetchOrgs({ apiBase, token })
+  const listed = listedWorkspaces(envelope)
   if (!listed) return { refused: true, reason: noWorkspaceList(apiBase) }
   const mine = listed.map((w) => w.name)
   if (flag) {
     const named = namedWorkspace(flag)
     if (!named) return { refused: true, reason: `--org ${flag} names no workspace — give @org, or --personal.` }
+    if (named === ownHandle(envelope)) return { refused: true, reason: ownHandleNamesNone(named, '--personal') }
     if (!mine.includes(named)) {
       return {
         refused: true,

package/src/commands/register.js

@@ -90,7 +90,7 @@ import {
 } from '../utils/code-upload.js'
 import { deriveScope, publishScope, belongsToScope } from '../utils/registry-orgs.js'
 import { BackendClient } from '../backend/client.js'
-import { resolveWorkspace, scopeOfWorkspace, SOURCE_LABEL } from '../backend/workspace.js'
+import { resolveWorkspace, scopeOfWorkspace, topOfChildHandle, SOURCE_LABEL } from '../backend/workspace.js'
 import { writeJsonPreservingStyleAsync } from '../utils/json-file.js'
 import {
   findWorkspaceRoot,
@@ -395,23 +395,29 @@ export async function settleFoundationScope(targetDir, { args, isPreview, flagSc
 async function deriveScopeFromLogin(client, args) {
   const token = await client.token()
   const ws = await resolveWorkspace({ client, args })
-  const personal = !ws.refused && ws.source !== 'offline' && ws.workspace === null
-  const accountHandle = personal ? (await client.fetchOrgs()).account_handle : null
-  const fromWorkspace = scopeOfWorkspace(ws, accountHandle)
+  const live = !ws.refused && ws.source !== 'offline'
+  const personal = live && ws.workspace === null
+  // A unit below an organization — a sub-org, a project — names no scope; its organization's is
+  // the default for the organization's members (`scopeOfWorkspace`), read from the same answer.
+  const child = live && typeof ws.workspace === 'string' && ws.workspace.includes(':')
+  const envelope = personal || child ? await client.fetchOrgs() : null
+  const fromWorkspace = scopeOfWorkspace(ws, envelope?.account_handle ?? null, envelope?.orgs)
   if (fromWorkspace) {
     const named = `${colors.bright}${fromWorkspace}${colors.reset}`
     console.error(
       personal
         ? `Registering under your personal scope ${named} — you work in your personal workspace (${SOURCE_LABEL[ws.source]}). For an org: --scope @org.`
-        : `Registering under ${named} — the workspace you work in (${SOURCE_LABEL[ws.source]}). For another scope: --scope @org.`
+        : child
+          ? `Registering under ${named} — the organization of ${ws.workspace}, the workspace you work in (${SOURCE_LABEL[ws.source]}). For another scope: --scope @org.`
+          : `Registering under ${named} — the workspace you work in (${SOURCE_LABEL[ws.source]}). For another scope: --scope @org.`
     )
     return fromWorkspace
   }
-  // A unit below an organization — a sub-org, a project — is a workspace and no scope (backend,
-  // 2026-10-22), so a bare name is asked for one as when no workspace names any.
-  if (typeof ws.workspace === 'string' && ws.workspace.includes(':')) {
+  // Not a member of the unit's organization — a project's guest — so it gives no scope, and a bare
+  // name is asked for one as when no workspace names any.
+  if (child) {
     console.error(
-      `${colors.dim}${ws.workspace}, the workspace you work in, is a unit below an organization, and names no scope.${colors.reset}`
+      `${colors.dim}${ws.workspace}, the workspace you work in, names no scope, and ${topOfChildHandle(ws.workspace)} is not among your organizations.${colors.reset}`
     )
   }
   const sess = await readRegistryAuth(client.origin)

package/src/index.js

@@ -1759,7 +1759,9 @@ ${colors.bright}Options:${colors.reset}
                      org's — and write it into the name (refused when the name has another
                      scope). A schemas-only package: publish under @scope; default:
                      package.json uniweb.scope
-  --org @org         Work in @org for this command: a bare name registers under it
+  --org @org         Work in @org for this command: a bare name registers under it —
+                     a sub-org's or project's (@studio:acme): under its organization's,
+                     when you are a member of it
   --personal         Work in your personal workspace: a bare name registers under your
                      personal scope
   --dry-run          Print the .uwx; submit nothing

package/src/utils/registry-auth.js

@@ -952,8 +952,16 @@ async function reportTokenProcess({ named, token }) {
   // Their workspace is UNIWEB_WORKSPACE's — never the stored session's — and, with none
   // named, personal for an account in no organization or project (resolveWorkspace,
   // workspace.js). Checked, as a login's `--org` is, against the workspaces the orgs read lists.
-  const { WORKSPACE_ENV, PERSONAL, parseWorkspaceChoice, headerOf, describeWorkspace, listedWorkspaces, noWorkspaceList } =
-    await import('../backend/workspace.js')
+  const {
+    WORKSPACE_ENV,
+    PERSONAL,
+    parseWorkspaceChoice,
+    headerOf,
+    describeWorkspace,
+    listedWorkspaces,
+    noWorkspaceList,
+    ownHandle
+  } = await import('../backend/workspace.js')
   const unsettled = (reason, { commandsRefuse }) => {
     console.error(`\x1b[31m✗\x1b[0m ${reason}`)
     if (commandsRefuse) {
@@ -968,18 +976,27 @@ async function reportTokenProcess({ named, token }) {
       commandsRefuse: true
     })
   }
-  let listed
+  let envelope
   try {
-    listed = listedWorkspaces(await (await import('./registry-orgs.js')).fetchOrgs({ apiBase: origin, token }))
+    envelope = await (await import('./registry-orgs.js')).fetchOrgs({ apiBase: origin, token })
   } catch (err) {
     console.error(`\x1b[33m⚠\x1b[0m ${err.message} — the workspace is not checked.`)
     return
   }
+  const listed = listedWorkspaces(envelope)
   if (!listed) {
     console.error(`\x1b[33m⚠\x1b[0m ${noWorkspaceList(origin)}`)
     return
   }
   const mine = listed.map((w) => w.name)
+  if (choice && choice === ownHandle(envelope)) {
+    // As a login refuses `--org @<own handle>` (chooseWorkspace): a handle names a person or an org,
+    // and only an org is a workspace.
+    unsettled(
+      `${WORKSPACE_ENV}=${raw} names the account's own handle, which names no workspace — its personal workspace is ${WORKSPACE_ENV}=personal.`,
+      { commandsRefuse: false }
+    )
+  }
   if (choice && choice !== PERSONAL && !mine.includes(choice)) {
     // As a login refuses `--org` for one (chooseWorkspace).
     unsettled(`${WORKSPACE_ENV}=${raw} is not one of this account's workspaces on ${origin}.`, {