@moloodev/cli 0.6.0 → 0.8.0

package/README.md

@@ -1,9 +1,13 @@
 `moloo editor dev` does not support the local app host because the parent app origin is fixed to production (`https://app.moloo.dev`).
 
-The view server defaults to `http://127.0.0.1:4310` and opens `https://app.moloo.dev/w/<slug>/dev-editor`. Use `moloo editor dev --view-port 4451` to select another port. Click **로컬 뷰 연결** in the app and allow Chrome local network access when prompted. If a connection fails, the app displays the browser error or manifest HTTP status; check the CLI and the app's browser site permissions.
+The view server defaults to `http://127.0.0.1:4310` and opens `https://app.moloo.dev/w/<slug>/dev-editor`. Use `moloo editor dev --view-port 4451` to select another port. The first time, click **로컬 뷰 연결** in the app and allow Chrome local network access; once granted, the app connects automatically. If a connection fails, the app displays the browser error or manifest HTTP status; check the CLI and the app's browser site permissions.
 
-`moloo editor publish` always targets a workspace you administer. For `moloo.*` manifests it defaults to workspace `moloo`; `--workspace` overrides that default. Other publishers use the explicit flag, saved workspace or membership selection. Publisher ownership is verified on the server. Builtin means publisher `moloo`, managed by the admin-only `moloo` workspace; these submissions publish immediately after checks pass (422 with finding details on failure). Other publishers are claimed by the submitting workspace on first submission and receive 202 pending review in `https://admin.moloo.dev`. Run `moloo editor status` to inspect revision status, check findings, and rejection reasons.
+`moloo editor publish` always targets a workspace you administer. For `moloo.*` manifests it defaults to workspace `moloo`; `--workspace` overrides that default. Other publishers use the explicit flag, saved workspace or membership selection. Publisher ownership is verified on the server. Builtin means publisher `moloo`, managed by the admin-only `moloo` workspace; these submissions publish immediately after checks pass (422 with finding details on failure). Other publishers are claimed by the submitting workspace on first submission and receive 202 pending review in `https://admin.moloo.dev`. Run `moloo editor status` to inspect revision status, which tracks point at each revision, check findings, and rejection reasons.
+
+Editors have two release tracks, `stable` (the default) and `beta`. Each track points at one revision. `moloo editor publish --track beta` releases to beta as soon as checks pass, with no platform review; workspaces that opt into beta in their editor settings get it, and all others stay on stable. `moloo editor promote beta stable` moves stable to the current beta revision: immediately for `moloo.*` editors and for revisions already reviewed, otherwise after platform review. A stable release also moves beta when beta is older, so beta never trails stable.
 
 Create a standalone editor with `moloo editor create <publisher>.<name>` (for example, `moloo editor create acme.notes`), or use `moloo editor create acme.notes --here` in an empty directory. The CLI downloads template tag `v1` from `moloodev/editor-template`, then rewrites its package, manifest, and README title. It never overwrites an existing destination. In the generated directory, run `pnpm install`, `moloo login`, `moloo workspace use <slug>`, then `moloo editor dev`. When ready, run `moloo editor build`, `moloo editor publish`, and `moloo editor status`.
 
 The `moloo` bin delegates to a project's installed `@moloodev/cli`, searching from the current directory upward. This keeps global invocations on the project's CLI version.
+
+`moloo upgrade` upgrades the globally installed CLI to the npm `latest` version and is never delegated to a project's CLI. It detects npm, pnpm, yarn or bun from the install path and runs that manager's global install; if the version is already latest it only says so. When the running CLI is a project dependency, it prints how to upgrade it with the project's package manager and changes nothing.

package/bin/local-cli.mjs

@@ -1,4 +1,4 @@
-import { readFileSync, realpathSync } from "node:fs";
+import { lstatSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 
 export const LOCAL_CLI_ENV = "MOLOO_LOCAL_CLI";
@@ -8,17 +8,16 @@ export function findLocalCli(cwd, currentBin, env = process.env) {
   if (env[LOCAL_CLI_ENV]) return null;
   for (let directory = resolve(cwd); ; directory = dirname(directory)) {
     const packageRoot = join(directory, "node_modules/@moloodev/cli");
-    let pkg;
     try {
-      pkg = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-    if (pkg) {
-      const bin = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.moloo;
-      if (typeof bin !== "string") throw new Error("Local @moloodev/cli has no moloo bin");
+      const pkg = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
+      const bin = typeof pkg?.bin === "string" ? pkg.bin : pkg?.bin?.moloo;
+      if (typeof bin !== "string" || !bin) throw new Error("Local @moloodev/cli has no moloo bin");
       const local = realpathSync(resolve(packageRoot, bin));
       return local === realpathSync(currentBin) ? null : local;
+    } catch (error) {
+      if (error.code !== "ENOENT" || lstatSync(packageRoot, { throwIfNoEntry: false })) {
+        throw new Error(`Broken local @moloodev/cli at ${packageRoot}: ${error.message}. ${LOCAL_CLI_ENV}=1 skips the handoff.`, { cause: error });
+      }
     }
     if (dirname(directory) === directory) return null;
   }

package/bin/moloo.mjs

@@ -3,7 +3,8 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { findLocalCli, LOCAL_CLI_ENV } from "./local-cli.mjs";
 
-const local = findLocalCli(process.cwd(), fileURLToPath(import.meta.url));
+// `upgrade` targets the globally installed CLI itself, so it never hands off.
+const local = process.argv[2] === "upgrade" ? null : findLocalCli(process.cwd(), fileURLToPath(import.meta.url));
 if (local) {
   const child = spawnSync(process.execPath, [local, ...process.argv.slice(2)], {
     stdio: "inherit",
@@ -20,7 +21,7 @@ const { runCli } = await import("../src/cli.ts");
 runCli(process.argv.slice(2)).then(
   (code) => process.exit(code),
   (err) => {
-    console.error(err);
+    console.error(err instanceof Error && process.env.MOLOO_DEBUG !== "1" ? `Error: ${err.message}` : err);
     process.exit(1);
   },
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moloodev/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "type": "module",
   "bin": {
     "moloo": "./bin/moloo.mjs"
@@ -24,15 +24,15 @@
     "tw-animate-css": "^1.4.0",
     "vite": "^8.2.2",
     "zod": "^4.5.4",
-    "@moloodev/editor-sdk": "0.6.0",
-    "@moloodev/editor-store": "0.6.0",
-    "@moloodev/platform": "0.6.0",
-    "@moloodev/ui": "0.6.0"
+    "@moloodev/editor-sdk": "0.8.0",
+    "@moloodev/editor-store": "0.8.0",
+    "@moloodev/platform": "0.8.0",
+    "@moloodev/ui": "0.8.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
     "typescript": "^7.0.2",
-    "@moloodev/typescript-config": "0.6.0"
+    "@moloodev/typescript-config": "0.8.0"
   },
   "publishConfig": {
     "access": "public"

package/src/api-result.ts

@@ -4,7 +4,7 @@ import { z } from "zod";
 const ErrorBodySchema = z.object({
   error: z.string(),
   message: z.string().optional(),
-  details: z.array(z.object({ code: z.string().optional(), detail: z.string() })).optional(),
+  details: z.array(z.object({ code: z.string().optional(), detail: z.string() })).catch([]),
 });
 
 export function readApiBody(body: string): Record<string, unknown> | undefined {
@@ -18,6 +18,6 @@ export function apiErrorMessage(status: number, body: string): string {
   const result = ErrorBodySchema.safeParse(readApiBody(body)).data;
   const code = result?.error ?? body;
   const message = result?.message ?? publishErrorBody(code).message ?? `Request failed (${status}): ${code}`;
-  const details = result?.details?.map((finding) => `  ${finding.code ? finding.code + ": " : ""}${finding.detail}`) ?? [];
+  const details = result?.details.map((finding) => `  ${finding.code ? finding.code + ": " : ""}${finding.detail}`) ?? [];
   return [message, ...details].join("\n");
 }

package/src/cli.ts

@@ -2,16 +2,18 @@ import { login, logout, whoami } from "./auth";
 import { resolve } from "node:path";
 import { runEditorDev } from "./editor-dev";
 import { buildEditorPackage } from "./editor-views";
-import { publishEditorPackage } from "./publish";
+import { isEditorTrack, type EditorTrack } from "@moloodev/platform";
+import { promoteEditorPackage, publishEditorPackage } from "./publish";
 import { printEditorStatus } from "./editor-status";
 import { createEditor, EDITOR_CREATE_USAGE } from "./editor-create";
 import { apiErrorMessage, readApiBody } from "./api-result";
+import { upgradeCli, UPGRADE_USAGE } from "./upgrade";
 import { listWorkspaces, useWorkspace, type WorkspaceOptions } from "./workspace";
 
 const EDITOR_USAGE =
-  `${EDITOR_CREATE_USAGE}\nUsage: moloo editor <dev|build|publish|status> [--dir <path>] [--out-dir <path>] [--view-port <port>] [--workspace <slug>]\nDev view port: 4310 (default)`;
+  `${EDITOR_CREATE_USAGE}\nUsage: moloo editor <dev|build|publish|status> [--dir <path>] [--out-dir <path>] [--view-port <port>] [--workspace <slug>]\nUsage: moloo editor publish [--track stable|beta] [--dir <path>] [--workspace <slug>]\nUsage: moloo editor promote beta stable [--dir <path>] [--workspace <slug>]\nDev view port: 4310 (default)`;
 const WORKSPACE_USAGE = "Usage: moloo workspace list | use <slug>";
-const USAGE = `Usage: moloo <command>\n\nCommands:\n  login   [--device]\n  logout\n  whoami\n  workspace  list | use <slug>\n  editor  create | dev | build | publish | status\n\n${WORKSPACE_USAGE}\n${EDITOR_USAGE}`;
+const USAGE = `Usage: moloo <command>\n\nCommands:\n  login   [--device]\n  logout\n  whoami\n  upgrade\n  workspace  list | use <slug>\n  editor  create | dev | build | publish | promote | status\n\n${WORKSPACE_USAGE}\n${EDITOR_USAGE}`;
 
 type Command = (args: readonly string[], options: WorkspaceOptions) => Promise<number>;
 
@@ -52,23 +54,42 @@ const editorCommands: Record<string, Command> = {
     return 0;
   },
   async publish(args, options) {
-    validateWorkspaceFlags(args);
+    validateWorkspaceFlags(args, ["--track"]);
+    const track = readTrackFlag(args);
     const result = await publishEditorPackage(packageRootFlag(args), {
-      ...options, workspace: readFlag(args, "--workspace"),
+      ...options, workspace: readFlag(args, "--workspace"), track,
     });
     if (result.status === 202) {
       const receipt = readApiBody(result.body)?.data as { id?: string } | undefined;
       if (typeof receipt?.id !== "string") throw new Error("Invalid submission receipt");
-      console.log(`${result.id} submitted — pending platform review. Revision: ${receipt.id}`);
+      const next = track === "stable" ? "pending platform review" : "beta after checks pass";
+      console.log(`${result.id} submitted — ${next}. Revision: ${receipt.id}`);
       return 0;
     }
     if (result.status !== 200 && result.status !== 201) {
-      console.error(apiErrorMessage(result.status, result.body));
-      return 1;
+      throw new Error(apiErrorMessage(result.status, result.body));
     }
     console.log(`${result.id} ${String(result.status)} ${result.body}`);
     return 0;
   },
+  async promote(args, options) {
+    const [from, to, ...flags] = args;
+    if (from !== "beta" || to !== "stable") throw new Error(EDITOR_USAGE);
+    validateWorkspaceFlags(flags);
+    const result = await promoteEditorPackage(packageRootFlag(flags), {
+      ...options, workspace: readFlag(flags, "--workspace"),
+    });
+    if (![200, 201, 202].includes(result.status)) {
+      throw new Error(apiErrorMessage(result.status, result.body));
+    }
+    const data = readApiBody(result.body)?.data as { id?: string; revision?: number } | undefined;
+    if (typeof data?.id !== "string" || typeof data.revision !== "number") throw new Error("Invalid promotion receipt");
+    const outcome = result.status === 201
+      ? "promoted to stable"
+      : result.status === 200 ? "stable already points at beta" : "submitted for stable — pending platform review";
+    console.log(`${result.id} #${String(data.revision)} ${outcome}. Revision: ${data.id}`);
+    return 0;
+  },
   async status(args, options) {
     validateWorkspaceFlags(args);
     return printEditorStatus(packageRootFlag(args), { ...options, workspace: readFlag(args, "--workspace") });
@@ -103,6 +124,13 @@ const commands: Record<string, {
       return 0;
     },
   },
+  upgrade: {
+    usage: UPGRADE_USAGE,
+    async run(args) {
+      if (args.length) throw new Error(UPGRADE_USAGE);
+      return upgradeCli();
+    },
+  },
   workspace: {
     usage: WORKSPACE_USAGE,
     async run([name, ...args], options) {
@@ -123,8 +151,7 @@ const commands: Record<string, {
             ? editorCommands[name]
             : undefined;
       if (!command) {
-        console.error(EDITOR_USAGE);
-        return 1;
+        throw new Error(EDITOR_USAGE);
       }
       return command(args, options);
     },
@@ -141,8 +168,7 @@ export async function runCli(argv: readonly string[], options: WorkspaceOptions
     return 0;
   }
   if (!command) {
-    console.error(USAGE);
-    return 1;
+    throw new Error(USAGE);
   }
   return command.run(args, options);
 }
@@ -151,9 +177,9 @@ function packageRootFlag(args: readonly string[]): string {
   return resolve(readFlag(args, "--dir") ?? process.cwd());
 }
 
-function validateWorkspaceFlags(args: readonly string[]): void {
+function validateWorkspaceFlags(args: readonly string[], extra: readonly string[] = []): void {
   for (let index = 0; index < args.length; index += 2) {
-    if (!["--dir", "--workspace"].includes(args[index] ?? "") ||
+    if (!["--dir", "--workspace", ...extra].includes(args[index] ?? "") ||
         !args[index + 1] || args[index + 1]?.startsWith("--")) throw new Error(EDITOR_USAGE);
   }
 }
@@ -164,6 +190,12 @@ function readFlag(args: readonly string[], flag: string): string | undefined {
   return args[index + 1];
 }
 
+function readTrackFlag(args: readonly string[]): EditorTrack {
+  const raw = readFlag(args, "--track") ?? "stable";
+  if (!isEditorTrack(raw)) throw new Error(`Invalid --track: use stable or beta`);
+  return raw;
+}
+
 function readPortFlag(args: readonly string[], flag: string): number | undefined {
   const raw = readFlag(args, flag);
   if (raw === undefined) return undefined;

package/src/editor-create.ts

@@ -1,9 +1,8 @@
 import { constants } from "node:fs";
-import { cp, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { copyFile, cp, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { extract, list } from "tar";
-import { parseQualifiedName } from "@moloodev/platform";
 import { parseEditorId } from "@moloodev/editor-sdk/protocol";
 
 export const EDITOR_TEMPLATE_TAG = "v1";
@@ -18,12 +17,11 @@ export async function createEditor(
     fetch?: typeof fetch;
   } = {},
 ): Promise<string> {
-  const qualified = parseQualifiedName(id);
-  if (!qualified || `${qualified.publisher}.${qualified.name}` !== id || !parseEditorId(id, true)) {
-    throw new Error("Invalid editor id: use publisher.name with a valid publisher handle and lowercase editor DNS label (1–63 characters). Reserved publishers other than moloo are unavailable.");
+  const editor = parseEditorId(id);
+  if (!editor) {
+    throw new Error("Invalid editor id: use publisher.name with a valid publisher handle and lowercase editor DNS label (1–63 characters).");
   }
-  const { publisher, name } = qualified;
-  const destination = here ? resolve(cwd) : resolve(cwd, `${name}-editor`);
+  const destination = here ? resolve(cwd) : resolve(cwd, `${editor.editor}-editor`);
   async function checkDestination() {
     if (here) {
       if ((await readdir(destination)).length) throw new Error("--here requires an empty current directory (including hidden files).");
@@ -61,16 +59,16 @@ export async function createEditor(
     const packageFile = join(source, "package.json");
     const pkg = JSON.parse(await readFile(packageFile, "utf8"));
     if (pkg.name !== "@moloodev/example-editor") throw new Error("Invalid editor template package placeholder");
-    pkg.name = `@${publisher}/${name}-editor`;
+    pkg.name = `@${editor.publisher}/${editor.editor}-editor`;
     await writeFile(packageFile, JSON.stringify(pkg, null, 2) + "\n");
     const manifestFile = join(source, "src/manifest.ts");
     let manifest = await readFile(manifestFile, "utf8");
     for (const [token, value] of [
       ["example.editor", id],
-      ["/editor/example", `/editor/${name}`],
-      [".example.json", `.${name}.json`],
-      ["https://example.com/schemas/example/v1.json", `https://example.com/schemas/${name}/v1.json`],
-      ["Example editor", `${name} editor`],
+      ["/editor/example", `/editor/${editor.editor}`],
+      [".example.json", `.${editor.editor}.json`],
+      ["https://example.com/schemas/example/v1.json", `https://example.com/schemas/${editor.editor}/v1.json`],
+      ["Example editor", `${editor.editor} editor`],
     ] as const) {
       if (!manifest.includes(token)) throw new Error(`Missing editor template placeholder: ${token}`);
       manifest = manifest.replaceAll(token, value);
@@ -79,22 +77,36 @@ export async function createEditor(
     const readmeFile = join(source, "README.md");
     const readme = await readFile(readmeFile, "utf8");
     if (!readme.startsWith("# Example editor\n")) throw new Error("Missing editor template README title");
-    await writeFile(readmeFile, readme.replace("# Example editor\n", `# ${name} editor\n`));
+    await writeFile(readmeFile, readme.replace("# Example editor\n", `# ${editor.editor} editor\n`));
 
     // Recheck after download; mkdir and exclusive copies also protect against races.
     await checkDestination();
     if (!here) await mkdir(destination);
+    const created: string[] = [];
     try {
-      for (const entry of await readdir(source)) {
-        await cp(join(source, entry), join(destination, entry), {
-          recursive: true, force: false, errorOnExist: true, mode: constants.COPYFILE_EXCL,
-        });
+      for (const entry of await readdir(source, { withFileTypes: true })) {
+        const target = join(destination, entry.name);
+        if (entry.isDirectory()) {
+          // Claim the directory before copying so partial copies can be removed.
+          await mkdir(target);
+          created.push(target);
+          for (const child of await readdir(join(source, entry.name))) {
+            await cp(join(source, entry.name, child), join(target, child), {
+              recursive: true, force: false, errorOnExist: true, mode: constants.COPYFILE_EXCL,
+            });
+          }
+        } else {
+          await copyFile(join(source, entry.name), target, constants.COPYFILE_EXCL);
+          created.push(target);
+        }
       }
     } catch (error) {
-      if (!here) await rm(destination, { recursive: true, force: true });
+      if (here) {
+        for (const target of created) await rm(target, { recursive: true, force: true });
+      } else await rm(destination, { recursive: true, force: true });
       throw error;
     }
-    console.log(`Created ${id} in ${destination}\n\nNext steps:\n${here ? "" : `  cd ${name}-editor\n`}  pnpm install\n  pnpm exec moloo login\n  pnpm dev\n\nPublish: pnpm publish:editor --workspace <slug>`);
+    console.log(`Created ${id} in ${destination}\n\nNext steps:\n${here ? "" : `  cd ${editor.editor}-editor\n`}  pnpm install\n  pnpm exec moloo login\n  pnpm dev\n\nPublish: pnpm publish:editor --workspace <slug>`);
     return destination;
   } finally {
     await rm(staging, { recursive: true, force: true });

package/src/editor-dev.ts

@@ -28,6 +28,7 @@ export async function runEditorDev(
   try {
     const destination = new URL(`/w/${encodeURIComponent(slug)}/dev-editor`, getWorkspaceHostUrl("production"));
     destination.searchParams.set("view", server.viewOrigin);
+    console.log(`${server.editorId} browser -> ${destination.href}`);
     console.log(`${server.editorId} view origin -> ${server.viewOrigin}`);
     await deps.open(destination.href);
     await deps.stopped();

package/src/editor-status.ts

@@ -1,17 +1,10 @@
-import { getApiOrigin } from "@moloodev/platform";
-import { z } from "zod";
+import { editorStatusResponseSchema, getApiOrigin } from "@moloodev/platform";
 import { publishToken } from "./auth";
 import { apiErrorMessage, readApiBody } from "./api-result";
 import { readPackageEditorView } from "./editor-views";
 import { resolveEditorTarget } from "./publish";
 import type { WorkspaceOptions } from "./workspace";
 
-const StatusBodySchema = z.object({ data: z.array(z.object({
-  id: z.string(), revision: z.number().int(), status: z.string(),
-  submittedAt: z.string(), reviewedAt: z.string().nullable(), rejectionReason: z.string().nullable(),
-  checkFindings: z.array(z.object({ code: z.string(), detail: z.string() })),
-})) });
-
 export async function printEditorStatus(packageRoot: string, options: WorkspaceOptions & { workspace?: string }): Promise<number> {
   const { id } = readPackageEditorView(packageRoot);
   const target = await resolveEditorTarget(id, options);
@@ -22,16 +15,16 @@ export async function printEditorStatus(packageRoot: string, options: WorkspaceO
   });
   const body = await response.text();
   if (response.status !== 200) {
-    console.error(apiErrorMessage(response.status, body));
-    return 1;
+    throw new Error(apiErrorMessage(response.status, body));
   }
-  const parsed = StatusBodySchema.safeParse(readApiBody(body));
+  const parsed = editorStatusResponseSchema.safeParse(readApiBody(body));
   if (!parsed.success) throw new Error("Invalid editor status response");
   const { data } = parsed.data;
   console.log(`${id} — latest ${data.length} revisions (${target.workspaceSlug})`);
   if (!data.length) console.log("No revisions submitted.");
   for (const row of data) {
-    console.log(`#${row.revision} ${row.status} (${row.id})\n  Submitted: ${row.submittedAt}\n  Reviewed: ${row.reviewedAt ?? "pending"}`);
+    const tracks = row.tracks.length ? ` [${row.tracks.join(", ")}]` : "";
+    console.log(`#${row.revision} ${row.status}${tracks} (${row.id})\n  Submitted: ${row.submittedAt}\n  Reviewed: ${row.reviewedAt ?? "pending"}`);
     if (row.rejectionReason) console.log(`  Rejected: ${row.rejectionReason}`);
     for (const finding of row.checkFindings) console.log(`  ${finding.code}: ${finding.detail}`);
   }

package/src/editor-views.ts

@@ -6,9 +6,8 @@ import { fileURLToPath } from "node:url";
 import esbuild from "esbuild";
 import { build, type Rollup } from "vite";
 import tailwind from "@tailwindcss/vite";
-import { parseEditorId } from "@moloodev/editor-sdk/protocol";
 import { validateEditorManifest } from "@moloodev/editor-sdk/commands/editor-document";
-import { isPublisherHandle, isReservedPublisherHandle, PUBLISH_ERROR_MESSAGES } from "@moloodev/platform";
+import { parsePublishName, PUBLISH_ERROR_MESSAGES } from "@moloodev/platform";
 import { parseNetwork } from "@moloodev/platform/network";
 import { publishBundlePlugin } from "./publish-bundle";
 import { readEditorManifest } from "./read-editor-manifest";
@@ -25,19 +24,14 @@ export function readPackageEditorView(packageRoot: string): EditorView & { manif
     throw new Error(`Missing editor manifest at ${manifestPath}`);
   }
   const manifest = readEditorManifest(manifestPath);
-  if (typeof manifest.id === "string" && manifest.id.includes(".")) {
-    const publisher = manifest.id.split(".")[0]!;
-    if (!isPublisherHandle(publisher)) throw new Error(PUBLISH_ERROR_MESSAGES.invalid_publisher_handle);
-    if (publisher !== "moloo" && isReservedPublisherHandle(publisher)) throw new Error(PUBLISH_ERROR_MESSAGES.publisher_reserved);
-  }
-  validateEditorManifest(manifest);
   if (typeof manifest.id !== "string") {
     throw new Error(`Invalid editor manifest id in ${manifestPath}`);
   }
-  const parsed = parseEditorId(manifest.id, true);
-  if (parsed === undefined) {
-    throw new Error(`Invalid editor id ${manifest.id}`);
+  const parsed = parsePublishName(manifest.id);
+  if (!parsed.ok) {
+    throw new Error(PUBLISH_ERROR_MESSAGES[parsed.error]);
   }
+  validateEditorManifest(manifest);
   const network = parseNetwork("network" in manifest ? manifest.network : undefined);
   return { id: manifest.id, packageRoot, network, manifest };
 }

package/src/publish.ts

@@ -1,7 +1,7 @@
 import { publishToken } from "./auth";
 import { createHash } from "node:crypto";
 import { putScriptUpload } from "@moloodev/editor-store/upload";
-import { getApiOrigin, parseQualifiedName, type PublishTarget } from "@moloodev/platform";
+import { getApiOrigin, parseQualifiedName, type EditorTrack, type PublishTarget } from "@moloodev/platform";
 import { buildEditorPackage, readPackageEditorView } from "./editor-views";
 import { resolveWorkspace, type WorkspaceOptions } from "./workspace";
 
@@ -9,6 +9,10 @@ export function publishEndpoint(): string {
   return `${getApiOrigin("production")}/v1/revisions/publish`;
 }
 
+export function promoteEndpoint(): string {
+  return `${getApiOrigin("production")}/v1/revisions/promote`;
+}
+
 export function uploadEndpoint(): string {
   return `${getApiOrigin("production")}/v1/revisions/uploads`;
 }
@@ -18,6 +22,7 @@ export async function publishEditor(input: {
   script: string;
   token: string;
   target: PublishTarget;
+  track: EditorTrack;
 }): Promise<{ status: number; body: string }> {
   const uploadUrl = uploadEndpoint();
   const publishUrl = publishEndpoint();
@@ -48,6 +53,7 @@ export async function publishEditor(input: {
     },
     body: JSON.stringify({
       target: input.target,
+      track: input.track,
       manifest: input.manifest,
       upload: {
         pathname: upload.pathname,
@@ -60,7 +66,7 @@ export async function publishEditor(input: {
 
 export async function publishEditorPackage(
   packageRoot: string,
-  options: Omit<WorkspaceOptions, "apiOrigin"> & { workspace?: string } = {},
+  options: Omit<WorkspaceOptions, "apiOrigin"> & { workspace?: string; track?: EditorTrack } = {},
 ): Promise<{ id: string; status: number; body: string }> {
   const view = readPackageEditorView(packageRoot);
   const target = await resolveEditorTarget(view.id, options);
@@ -71,10 +77,28 @@ export async function publishEditorPackage(
     script: built.script,
     token,
     target,
+    track: options.track ?? "stable",
   });
   return { id: built.id, ...result };
 }
 
+/** Move the editor's `stable` track to its current `beta` revision. */
+export async function promoteEditorPackage(
+  packageRoot: string,
+  options: Omit<WorkspaceOptions, "apiOrigin"> & { workspace?: string } = {},
+): Promise<{ id: string; status: number; body: string }> {
+  const { id } = readPackageEditorView(packageRoot);
+  const target = await resolveEditorTarget(id, options);
+  const token = await publishToken(options.store);
+  const response = await fetch(promoteEndpoint(), {
+    method: "POST",
+    redirect: "error",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({ target, editor: id, from: "beta", to: "stable" }),
+  });
+  return { id, status: response.status, body: await response.text() };
+}
+
 export async function resolveEditorTarget(
   id: string,
   options: WorkspaceOptions & { workspace?: string },

package/src/upgrade.ts

@@ -0,0 +1,104 @@
+import { spawnSync } from "node:child_process";
+import { readFileSync, realpathSync } from "node:fs";
+import { dirname, join, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const UPGRADE_USAGE = "Usage: moloo upgrade";
+
+const PACKAGE = "@moloodev/cli";
+const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE.replace("/", "%2F")}/latest`;
+
+export type GlobalManager = "npm" | "pnpm" | "yarn" | "bun";
+export type Install = { kind: "global"; manager: GlobalManager } | { kind: "local" };
+
+const INSTALL_COMMANDS: Record<GlobalManager, readonly [string, ...string[]]> = {
+  npm: ["npm", "install", "--global", `${PACKAGE}@latest`],
+  pnpm: ["pnpm", "add", "--global", `${PACKAGE}@latest`],
+  yarn: ["yarn", "global", "add", `${PACKAGE}@latest`],
+  bun: ["bun", "add", "--global", `${PACKAGE}@latest`],
+};
+
+/** Classify the installed package directory (realpath) by each manager's global store layout. */
+export function detectInstall(packageRoot: string): Install {
+  const path = packageRoot.split(sep).join("/");
+  if (/\/pnpm\/global\/|\/\.pnpm-global\//.test(path)) return { kind: "global", manager: "pnpm" };
+  if (/\/\.bun\/install\/global\//.test(path)) return { kind: "global", manager: "bun" };
+  if (/\/yarn\/global\/|\/\.yarn-global\//.test(path)) return { kind: "global", manager: "yarn" };
+  if (/\/lib\/node_modules\/@moloodev\/cli$|\/npm\/node_modules\/@moloodev\/cli$/.test(path)) {
+    return { kind: "global", manager: "npm" };
+  }
+  return { kind: "local" };
+}
+
+export type Runner = (command: string, args: readonly string[]) => number;
+
+export interface UpgradeDeps {
+  packageRoot?: string;
+  currentVersion?: string;
+  fetchLatest?: () => Promise<string>;
+  run?: Runner;
+  log?: (line: string) => void;
+}
+
+export async function upgradeCli(deps: UpgradeDeps = {}): Promise<number> {
+  const packageRoot = deps.packageRoot ?? realpathSync(join(dirname(fileURLToPath(import.meta.url)), ".."));
+  const current = deps.currentVersion ?? readVersion(packageRoot);
+  const log = deps.log ?? console.log;
+  const install = detectInstall(packageRoot);
+  if (install.kind === "local") {
+    log(`${PACKAGE} ${current} is a project dependency (${packageRoot}).`);
+    log(`Upgrade it with the project's package manager, e.g. pnpm add -D ${PACKAGE}@latest`);
+    return 1;
+  }
+  const latest = await (deps.fetchLatest ?? fetchLatestVersion)();
+  if (latest === current) {
+    log(`${PACKAGE} ${current} is already the latest.`);
+    return 0;
+  }
+  if (compareVersions(current, latest) > 0) {
+    log(`${PACKAGE} ${current} is newer than latest ${latest}; not downgrading.`);
+    return 0;
+  }
+  const [command, ...args] = INSTALL_COMMANDS[install.manager];
+  log(`Upgrading ${PACKAGE} ${current} -> ${latest}: ${[command, ...args].join(" ")}`);
+  const status = (deps.run ?? spawnRunner)(command, args);
+  if (status !== 0) throw new Error(`${command} exited with ${String(status)}`);
+  log(`${PACKAGE} upgraded to ${latest}.`);
+  return 0;
+}
+
+/** Minimal semver order: numeric core, then a release outranks its prereleases. */
+export function compareVersions(a: string, b: string): number {
+  const [coreA = "", preA] = a.split("-", 2);
+  const [coreB = "", preB] = b.split("-", 2);
+  const numsA = coreA.split(".").map(Number);
+  const numsB = coreB.split(".").map(Number);
+  for (let index = 0; index < 3; index += 1) {
+    const diff = (numsA[index] ?? 0) - (numsB[index] ?? 0);
+    if (diff) return Math.sign(diff);
+  }
+  if (preA === preB) return 0;
+  if (preA === undefined) return 1;
+  if (preB === undefined) return -1;
+  return preA.localeCompare(preB, "en", { numeric: true });
+}
+
+function readVersion(packageRoot: string): string {
+  const pkg = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8")) as { version?: unknown };
+  if (typeof pkg.version !== "string") throw new Error(`No version in ${packageRoot}/package.json`);
+  return pkg.version;
+}
+
+async function fetchLatestVersion(): Promise<string> {
+  const response = await fetch(REGISTRY_URL);
+  if (!response.ok) throw new Error(`npm registry returned ${String(response.status)} for ${PACKAGE}`);
+  const body = (await response.json()) as { version?: unknown };
+  if (typeof body.version !== "string") throw new Error(`npm registry has no latest version for ${PACKAGE}`);
+  return body.version;
+}
+
+const spawnRunner: Runner = (command, args) => {
+  const child = spawnSync(command, args, { stdio: "inherit", shell: process.platform === "win32" });
+  if (child.error) throw child.error;
+  return child.status ?? 1;
+};