@moloodev/cli 0.5.0 → 0.7.0

package/README.md

@@ -1,3 +1,11 @@
 `moloo editor dev` does not support the local app host because the parent app origin is fixed to production (`https://app.moloo.dev`).
 
-The view server defaults to `http://127.0.0.1:4310`. Use `moloo editor dev --view-port 4451` to select another port. Click **로컬 뷰 연결** in the app and allow browser local network access when prompted. If a connection fails, the app displays the browser error or manifest HTTP status; check the CLI and the app's browser site permissions.
+The view server defaults to `http://127.0.0.1:4310` and opens `https://app.moloo.dev/w/<slug>/dev-editor`. Use `moloo editor dev --view-port 4451` to select another port. Click **로컬 뷰 연결** in the app and allow Chrome local network access when prompted. If a connection fails, the app displays the browser error or manifest HTTP status; check the CLI and the app's browser site permissions.
+
+`moloo editor publish` always targets a workspace you administer. For `moloo.*` manifests it defaults to workspace `moloo`; `--workspace` overrides that default. Other publishers use the explicit flag, saved workspace or membership selection. Publisher ownership is verified on the server. Builtin means publisher `moloo`, managed by the admin-only `moloo` workspace; these submissions publish immediately after checks pass (422 with finding details on failure). Other publishers are claimed by the submitting workspace on first submission and receive 202 pending review in `https://admin.moloo.dev`. Run `moloo editor status` to inspect revision status, which tracks point at each revision, check findings, and rejection reasons.
+
+Editors have two release tracks, `stable` (the default) and `beta`. Each track points at one revision. `moloo editor publish --track beta` releases to beta as soon as checks pass, with no platform review; workspaces that opt into beta in their editor settings get it, and all others stay on stable. `moloo editor promote beta stable` moves stable to the current beta revision: immediately for `moloo.*` editors and for revisions already reviewed, otherwise after platform review. A stable release also moves beta when beta is older, so beta never trails stable.
+
+Create a standalone editor with `moloo editor create <publisher>.<name>` (for example, `moloo editor create acme.notes`), or use `moloo editor create acme.notes --here` in an empty directory. The CLI downloads template tag `v1` from `moloodev/editor-template`, then rewrites its package, manifest, and README title. It never overwrites an existing destination. In the generated directory, run `pnpm install`, `moloo login`, `moloo workspace use <slug>`, then `moloo editor dev`. When ready, run `moloo editor build`, `moloo editor publish`, and `moloo editor status`.
+
+The `moloo` bin delegates to a project's installed `@moloodev/cli`, searching from the current directory upward. This keeps global invocations on the project's CLI version.

package/bin/local-cli.mjs

@@ -0,0 +1,24 @@
+import { lstatSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+
+export const LOCAL_CLI_ENV = "MOLOO_LOCAL_CLI";
+
+/** Resolve from the invoking directory, including pnpm's symlinked packages. */
+export function findLocalCli(cwd, currentBin, env = process.env) {
+  if (env[LOCAL_CLI_ENV]) return null;
+  for (let directory = resolve(cwd); ; directory = dirname(directory)) {
+    const packageRoot = join(directory, "node_modules/@moloodev/cli");
+    try {
+      const pkg = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
+      const bin = typeof pkg?.bin === "string" ? pkg.bin : pkg?.bin?.moloo;
+      if (typeof bin !== "string" || !bin) throw new Error("Local @moloodev/cli has no moloo bin");
+      const local = realpathSync(resolve(packageRoot, bin));
+      return local === realpathSync(currentBin) ? null : local;
+    } catch (error) {
+      if (error.code !== "ENOENT" || lstatSync(packageRoot, { throwIfNoEntry: false })) {
+        throw new Error(`Broken local @moloodev/cli at ${packageRoot}: ${error.message}. ${LOCAL_CLI_ENV}=1 skips the handoff.`, { cause: error });
+      }
+    }
+    if (dirname(directory) === directory) return null;
+  }
+}

package/bin/moloo.mjs

@@ -1,11 +1,26 @@
 #!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { findLocalCli, LOCAL_CLI_ENV } from "./local-cli.mjs";
+
+const local = findLocalCli(process.cwd(), fileURLToPath(import.meta.url));
+if (local) {
+  const child = spawnSync(process.execPath, [local, ...process.argv.slice(2)], {
+    stdio: "inherit",
+    env: { ...process.env, [LOCAL_CLI_ENV]: "1" },
+  });
+  if (child.error) throw child.error;
+  if (child.signal) process.kill(process.pid, child.signal);
+  else process.exit(child.status ?? 1);
+}
+
 await import("tsx/esm");
 const { runCli } = await import("../src/cli.ts");
 
 runCli(process.argv.slice(2)).then(
   (code) => process.exit(code),
   (err) => {
-    console.error(err);
+    console.error(err instanceof Error && process.env.MOLOO_DEBUG !== "1" ? `Error: ${err.message}` : err);
     process.exit(1);
   },
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moloodev/cli",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "type": "module",
   "bin": {
     "moloo": "./bin/moloo.mjs"
@@ -19,18 +19,20 @@
     "open": "11.0.2",
     "shadcn": "^4.21.0",
     "tailwindcss": "^4.3.3",
-    "tw-animate-css": "^1.4.0",
+    "tar": "7.5.22",
     "tsx": "^4.23.13",
+    "tw-animate-css": "^1.4.0",
     "vite": "^8.2.2",
-    "@moloodev/editor-sdk": "0.5.0",
-    "@moloodev/editor-store": "0.5.0",
-    "@moloodev/platform": "0.5.0",
-    "@moloodev/ui": "0.5.0"
+    "zod": "^4.5.4",
+    "@moloodev/editor-sdk": "0.7.0",
+    "@moloodev/platform": "0.7.0",
+    "@moloodev/editor-store": "0.7.0",
+    "@moloodev/ui": "0.7.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
     "typescript": "^7.0.2",
-    "@moloodev/typescript-config": "0.5.0"
+    "@moloodev/typescript-config": "0.7.0"
   },
   "publishConfig": {
     "access": "public"
@@ -38,13 +40,15 @@
   "files": [
     "bin",
     "src",
-    "!src/**/*.test.ts"
+    "!src/**/*.test.ts",
+    "!src/fixtures",
+    "!bin/**/*.test.mjs"
   ],
   "engines": {
     "node": ">=24"
   },
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "test": "node --import tsx --test 'src/**/*.test.ts'"
+    "test": "node --import tsx --test 'src/**/*.test.ts' 'bin/**/*.test.mjs'"
   }
 }

package/src/api-result.ts

@@ -0,0 +1,23 @@
+import { publishErrorBody } from "@moloodev/platform";
+import { z } from "zod";
+
+const ErrorBodySchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+  details: z.array(z.object({ code: z.string().optional(), detail: z.string() })).catch([]),
+});
+
+export function readApiBody(body: string): Record<string, unknown> | undefined {
+  try {
+    return z.record(z.string(), z.unknown()).safeParse(JSON.parse(body)).data;
+  } catch { /* Non-JSON errors still get an HTTP status below. */ }
+  return undefined;
+}
+
+export function apiErrorMessage(status: number, body: string): string {
+  const result = ErrorBodySchema.safeParse(readApiBody(body)).data;
+  const code = result?.error ?? body;
+  const message = result?.message ?? publishErrorBody(code).message ?? `Request failed (${status}): ${code}`;
+  const details = result?.details.map((finding) => `  ${finding.code ? finding.code + ": " : ""}${finding.detail}`) ?? [];
+  return [message, ...details].join("\n");
+}

package/src/cli.ts

@@ -2,17 +2,29 @@ import { login, logout, whoami } from "./auth";
 import { resolve } from "node:path";
 import { runEditorDev } from "./editor-dev";
 import { buildEditorPackage } from "./editor-views";
-import { publishEditorPackage } from "./publish";
+import { isEditorTrack, type EditorTrack } from "@moloodev/platform";
+import { promoteEditorPackage, publishEditorPackage } from "./publish";
+import { printEditorStatus } from "./editor-status";
+import { createEditor, EDITOR_CREATE_USAGE } from "./editor-create";
+import { apiErrorMessage, readApiBody } from "./api-result";
 import { listWorkspaces, useWorkspace, type WorkspaceOptions } from "./workspace";
 
 const EDITOR_USAGE =
-  "Usage: moloo editor <dev|build|publish> [--dir <path>] [--out-dir <path>] [--view-port <port>] [--workspace <slug>]\nDev view port: 4310 (default)";
+  `${EDITOR_CREATE_USAGE}\nUsage: moloo editor <dev|build|publish|status> [--dir <path>] [--out-dir <path>] [--view-port <port>] [--workspace <slug>]\nUsage: moloo editor publish [--track stable|beta] [--dir <path>] [--workspace <slug>]\nUsage: moloo editor promote beta stable [--dir <path>] [--workspace <slug>]\nDev view port: 4310 (default)`;
 const WORKSPACE_USAGE = "Usage: moloo workspace list | use <slug>";
-const USAGE = `Usage: moloo <command>\n\nCommands:\n  login   [--device]\n  logout\n  whoami\n  workspace  list | use <slug>\n  editor  dev | build | publish\n\n${WORKSPACE_USAGE}\n${EDITOR_USAGE}`;
+const USAGE = `Usage: moloo <command>\n\nCommands:\n  login   [--device]\n  logout\n  whoami\n  workspace  list | use <slug>\n  editor  create | dev | build | publish | promote | status\n\n${WORKSPACE_USAGE}\n${EDITOR_USAGE}`;
 
 type Command = (args: readonly string[], options: WorkspaceOptions) => Promise<number>;
 
 const editorCommands: Record<string, Command> = {
+  async create(args) {
+    const ids = args.filter((arg) => arg !== "--here");
+    if (ids.length !== 1 || !ids[0] || ids[0].startsWith("-") || args.length > 2) {
+      throw new Error(EDITOR_CREATE_USAGE);
+    }
+    await createEditor(ids[0], { here: args.includes("--here") });
+    return 0;
+  },
   async dev(args, options) {
     for (let index = 0; index < args.length; index += 2) {
       if (
@@ -41,22 +53,45 @@ const editorCommands: Record<string, Command> = {
     return 0;
   },
   async publish(args, options) {
-    for (let index = 0; index < args.length; index += 2) {
-      if (!["--dir", "--workspace"].includes(args[index] ?? "") ||
-          !args[index + 1] || args[index + 1]?.startsWith("--")) {
-        throw new Error(EDITOR_USAGE);
-      }
-    }
+    validateWorkspaceFlags(args, ["--track"]);
+    const track = readTrackFlag(args);
     const result = await publishEditorPackage(packageRootFlag(args), {
-      ...options, workspace: readFlag(args, "--workspace"),
+      ...options, workspace: readFlag(args, "--workspace"), track,
     });
     if (result.status === 202) {
-      const receipt = JSON.parse(result.body) as { data: { id: string } };
-      console.log(`${result.id} 제출됨·심사 필요 ${receipt.data.id}`);
+      const receipt = readApiBody(result.body)?.data as { id?: string } | undefined;
+      if (typeof receipt?.id !== "string") throw new Error("Invalid submission receipt");
+      const next = track === "stable" ? "pending platform review" : "beta after checks pass";
+      console.log(`${result.id} submitted — ${next}. Revision: ${receipt.id}`);
       return 0;
     }
+    if (result.status !== 200 && result.status !== 201) {
+      throw new Error(apiErrorMessage(result.status, result.body));
+    }
     console.log(`${result.id} ${String(result.status)} ${result.body}`);
-    return result.status === 200 || result.status === 201 ? 0 : 1;
+    return 0;
+  },
+  async promote(args, options) {
+    const [from, to, ...flags] = args;
+    if (from !== "beta" || to !== "stable") throw new Error(EDITOR_USAGE);
+    validateWorkspaceFlags(flags);
+    const result = await promoteEditorPackage(packageRootFlag(flags), {
+      ...options, workspace: readFlag(flags, "--workspace"),
+    });
+    if (![200, 201, 202].includes(result.status)) {
+      throw new Error(apiErrorMessage(result.status, result.body));
+    }
+    const data = readApiBody(result.body)?.data as { id?: string; revision?: number } | undefined;
+    if (typeof data?.id !== "string" || typeof data.revision !== "number") throw new Error("Invalid promotion receipt");
+    const outcome = result.status === 201
+      ? "promoted to stable"
+      : result.status === 200 ? "stable already points at beta" : "submitted for stable — pending platform review";
+    console.log(`${result.id} #${String(data.revision)} ${outcome}. Revision: ${data.id}`);
+    return 0;
+  },
+  async status(args, options) {
+    validateWorkspaceFlags(args);
+    return printEditorStatus(packageRootFlag(args), { ...options, workspace: readFlag(args, "--workspace") });
   },
 };
 
@@ -108,8 +143,7 @@ const commands: Record<string, {
             ? editorCommands[name]
             : undefined;
       if (!command) {
-        console.error(EDITOR_USAGE);
-        return 1;
+        throw new Error(EDITOR_USAGE);
       }
       return command(args, options);
     },
@@ -126,8 +160,7 @@ export async function runCli(argv: readonly string[], options: WorkspaceOptions
     return 0;
   }
   if (!command) {
-    console.error(USAGE);
-    return 1;
+    throw new Error(USAGE);
   }
   return command.run(args, options);
 }
@@ -136,12 +169,25 @@ function packageRootFlag(args: readonly string[]): string {
   return resolve(readFlag(args, "--dir") ?? process.cwd());
 }
 
+function validateWorkspaceFlags(args: readonly string[], extra: readonly string[] = []): void {
+  for (let index = 0; index < args.length; index += 2) {
+    if (!["--dir", "--workspace", ...extra].includes(args[index] ?? "") ||
+        !args[index + 1] || args[index + 1]?.startsWith("--")) throw new Error(EDITOR_USAGE);
+  }
+}
+
 function readFlag(args: readonly string[], flag: string): string | undefined {
   const index = args.indexOf(flag);
   if (index === -1) return undefined;
   return args[index + 1];
 }
 
+function readTrackFlag(args: readonly string[]): EditorTrack {
+  const raw = readFlag(args, "--track") ?? "stable";
+  if (!isEditorTrack(raw)) throw new Error(`Invalid --track: use stable or beta`);
+  return raw;
+}
+
 function readPortFlag(args: readonly string[], flag: string): number | undefined {
   const raw = readFlag(args, flag);
   if (raw === undefined) return undefined;

package/src/editor-create.ts

@@ -0,0 +1,114 @@
+import { constants } from "node:fs";
+import { copyFile, cp, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { extract, list } from "tar";
+import { parseEditorId } from "@moloodev/editor-sdk/protocol";
+
+export const EDITOR_TEMPLATE_TAG = "v1";
+export const EDITOR_TEMPLATE_URL = `https://codeload.github.com/moloodev/editor-template/tar.gz/refs/tags/${EDITOR_TEMPLATE_TAG}`;
+export const EDITOR_CREATE_USAGE = "Usage: moloo editor create <publisher>.<name> [--here]";
+
+export async function createEditor(
+  id: string,
+  { cwd = process.cwd(), here = false, fetch: download = globalThis.fetch }: {
+    cwd?: string;
+    here?: boolean;
+    fetch?: typeof fetch;
+  } = {},
+): Promise<string> {
+  const editor = parseEditorId(id);
+  if (!editor) {
+    throw new Error("Invalid editor id: use publisher.name with a valid publisher handle and lowercase editor DNS label (1–63 characters).");
+  }
+  const destination = here ? resolve(cwd) : resolve(cwd, `${editor.editor}-editor`);
+  async function checkDestination() {
+    if (here) {
+      if ((await readdir(destination)).length) throw new Error("--here requires an empty current directory (including hidden files).");
+    } else {
+      const existing = await lstat(destination).catch((error: NodeJS.ErrnoException) => {
+        if (error.code !== "ENOENT") throw error;
+        return null;
+      });
+      if (existing) throw new Error(`Destination already exists: ${destination}`);
+    }
+  }
+  await checkDestination();
+  const staging = await mkdtemp(join(tmpdir(), "moloo-create-"));
+  try {
+    const response = await download(EDITOR_TEMPLATE_URL, { signal: AbortSignal.timeout(30_000) });
+    if (!response.ok) throw new Error(`Template download failed (${response.status}): ${EDITOR_TEMPLATE_URL}`);
+    const archive = join(staging, "template.tar.gz");
+    await writeFile(archive, new Uint8Array(await response.arrayBuffer()));
+    const source = join(staging, "source");
+    await mkdir(source);
+    let archiveRoot: string | undefined;
+    list({
+      file: archive, sync: true, strict: true,
+      onReadEntry(entry) {
+        const path = entry.path;
+        const parts = path.replace(/\/$/, "").split("/");
+        archiveRoot ??= parts[0];
+        if (parts[0] !== archiveRoot || parts.some((part) => !part || part === "." || part === ".." || part === ".git") ||
+            path.includes("\\") || !["File", "Directory"].includes(entry.type)) {
+          throw new Error(`Unsupported template archive entry: ${path}`);
+        }
+      },
+    });
+    await extract({ file: archive, cwd: source, strip: 1, strict: true });
+    const packageFile = join(source, "package.json");
+    const pkg = JSON.parse(await readFile(packageFile, "utf8"));
+    if (pkg.name !== "@moloodev/example-editor") throw new Error("Invalid editor template package placeholder");
+    pkg.name = `@${editor.publisher}/${editor.editor}-editor`;
+    await writeFile(packageFile, JSON.stringify(pkg, null, 2) + "\n");
+    const manifestFile = join(source, "src/manifest.ts");
+    let manifest = await readFile(manifestFile, "utf8");
+    for (const [token, value] of [
+      ["example.editor", id],
+      ["/editor/example", `/editor/${editor.editor}`],
+      [".example.json", `.${editor.editor}.json`],
+      ["https://example.com/schemas/example/v1.json", `https://example.com/schemas/${editor.editor}/v1.json`],
+      ["Example editor", `${editor.editor} editor`],
+    ] as const) {
+      if (!manifest.includes(token)) throw new Error(`Missing editor template placeholder: ${token}`);
+      manifest = manifest.replaceAll(token, value);
+    }
+    await writeFile(manifestFile, manifest);
+    const readmeFile = join(source, "README.md");
+    const readme = await readFile(readmeFile, "utf8");
+    if (!readme.startsWith("# Example editor\n")) throw new Error("Missing editor template README title");
+    await writeFile(readmeFile, readme.replace("# Example editor\n", `# ${editor.editor} editor\n`));
+
+    // Recheck after download; mkdir and exclusive copies also protect against races.
+    await checkDestination();
+    if (!here) await mkdir(destination);
+    const created: string[] = [];
+    try {
+      for (const entry of await readdir(source, { withFileTypes: true })) {
+        const target = join(destination, entry.name);
+        if (entry.isDirectory()) {
+          // Claim the directory before copying so partial copies can be removed.
+          await mkdir(target);
+          created.push(target);
+          for (const child of await readdir(join(source, entry.name))) {
+            await cp(join(source, entry.name, child), join(target, child), {
+              recursive: true, force: false, errorOnExist: true, mode: constants.COPYFILE_EXCL,
+            });
+          }
+        } else {
+          await copyFile(join(source, entry.name), target, constants.COPYFILE_EXCL);
+          created.push(target);
+        }
+      }
+    } catch (error) {
+      if (here) {
+        for (const target of created) await rm(target, { recursive: true, force: true });
+      } else await rm(destination, { recursive: true, force: true });
+      throw error;
+    }
+    console.log(`Created ${id} in ${destination}\n\nNext steps:\n${here ? "" : `  cd ${editor.editor}-editor\n`}  pnpm install\n  pnpm exec moloo login\n  pnpm dev\n\nPublish: pnpm publish:editor --workspace <slug>`);
+    return destination;
+  } finally {
+    await rm(staging, { recursive: true, force: true });
+  }
+}

package/src/editor-status.ts

@@ -0,0 +1,32 @@
+import { editorStatusResponseSchema, getApiOrigin } from "@moloodev/platform";
+import { publishToken } from "./auth";
+import { apiErrorMessage, readApiBody } from "./api-result";
+import { readPackageEditorView } from "./editor-views";
+import { resolveEditorTarget } from "./publish";
+import type { WorkspaceOptions } from "./workspace";
+
+export async function printEditorStatus(packageRoot: string, options: WorkspaceOptions & { workspace?: string }): Promise<number> {
+  const { id } = readPackageEditorView(packageRoot);
+  const target = await resolveEditorTarget(id, options);
+  const token = await publishToken(options.store);
+  const query = new URLSearchParams({ workspace: target.workspaceSlug, editor: id });
+  const response = await fetch(`${getApiOrigin("production")}/v1/revisions/status?${query}`, {
+    redirect: "error", headers: { authorization: `Bearer ${token}` },
+  });
+  const body = await response.text();
+  if (response.status !== 200) {
+    throw new Error(apiErrorMessage(response.status, body));
+  }
+  const parsed = editorStatusResponseSchema.safeParse(readApiBody(body));
+  if (!parsed.success) throw new Error("Invalid editor status response");
+  const { data } = parsed.data;
+  console.log(`${id} — latest ${data.length} revisions (${target.workspaceSlug})`);
+  if (!data.length) console.log("No revisions submitted.");
+  for (const row of data) {
+    const tracks = row.tracks.length ? ` [${row.tracks.join(", ")}]` : "";
+    console.log(`#${row.revision} ${row.status}${tracks} (${row.id})\n  Submitted: ${row.submittedAt}\n  Reviewed: ${row.reviewedAt ?? "pending"}`);
+    if (row.rejectionReason) console.log(`  Rejected: ${row.rejectionReason}`);
+    for (const finding of row.checkFindings) console.log(`  ${finding.code}: ${finding.detail}`);
+  }
+  return 0;
+}

package/src/editor-views.ts

@@ -6,8 +6,8 @@ import { fileURLToPath } from "node:url";
 import esbuild from "esbuild";
 import { build, type Rollup } from "vite";
 import tailwind from "@tailwindcss/vite";
-import { parseEditorId } from "@moloodev/editor-sdk/protocol";
 import { validateEditorManifest } from "@moloodev/editor-sdk/commands/editor-document";
+import { parsePublishName, PUBLISH_ERROR_MESSAGES } from "@moloodev/platform";
 import { parseNetwork } from "@moloodev/platform/network";
 import { publishBundlePlugin } from "./publish-bundle";
 import { readEditorManifest } from "./read-editor-manifest";
@@ -24,14 +24,14 @@ export function readPackageEditorView(packageRoot: string): EditorView & { manif
     throw new Error(`Missing editor manifest at ${manifestPath}`);
   }
   const manifest = readEditorManifest(manifestPath);
-  validateEditorManifest(manifest);
   if (typeof manifest.id !== "string") {
     throw new Error(`Invalid editor manifest id in ${manifestPath}`);
   }
-  const parsed = parseEditorId(manifest.id, true);
-  if (parsed === undefined) {
-    throw new Error(`Invalid editor id ${manifest.id}`);
+  const parsed = parsePublishName(manifest.id);
+  if (!parsed.ok) {
+    throw new Error(PUBLISH_ERROR_MESSAGES[parsed.error]);
   }
+  validateEditorManifest(manifest);
   const network = parseNetwork("network" in manifest ? manifest.network : undefined);
   return { id: manifest.id, packageRoot, network, manifest };
 }

package/src/publish.ts

@@ -1,7 +1,7 @@
 import { publishToken } from "./auth";
 import { createHash } from "node:crypto";
 import { putScriptUpload } from "@moloodev/editor-store/upload";
-import { getApiOrigin, parseQualifiedName, type PublishTarget } from "@moloodev/platform";
+import { getApiOrigin, parseQualifiedName, type EditorTrack, type PublishTarget } from "@moloodev/platform";
 import { buildEditorPackage, readPackageEditorView } from "./editor-views";
 import { resolveWorkspace, type WorkspaceOptions } from "./workspace";
 
@@ -9,6 +9,10 @@ export function publishEndpoint(): string {
   return `${getApiOrigin("production")}/v1/revisions/publish`;
 }
 
+export function promoteEndpoint(): string {
+  return `${getApiOrigin("production")}/v1/revisions/promote`;
+}
+
 export function uploadEndpoint(): string {
   return `${getApiOrigin("production")}/v1/revisions/uploads`;
 }
@@ -18,6 +22,7 @@ export async function publishEditor(input: {
   script: string;
   token: string;
   target: PublishTarget;
+  track: EditorTrack;
 }): Promise<{ status: number; body: string }> {
   const uploadUrl = uploadEndpoint();
   const publishUrl = publishEndpoint();
@@ -48,6 +53,7 @@ export async function publishEditor(input: {
     },
     body: JSON.stringify({
       target: input.target,
+      track: input.track,
       manifest: input.manifest,
       upload: {
         pathname: upload.pathname,
@@ -60,20 +66,10 @@ export async function publishEditor(input: {
 
 export async function publishEditorPackage(
   packageRoot: string,
-  options: Omit<WorkspaceOptions, "apiOrigin"> & { workspace?: string } = {},
+  options: Omit<WorkspaceOptions, "apiOrigin"> & { workspace?: string; track?: EditorTrack } = {},
 ): Promise<{ id: string; status: number; body: string }> {
   const view = readPackageEditorView(packageRoot);
-  const name = parseQualifiedName(view.id);
-  if (!name) throw new Error("Invalid editor manifest id");
-  let target: PublishTarget;
-  if (name.publisher === "moloo") {
-    if (options.workspace !== undefined) throw new Error("Built-in editors do not accept --workspace.");
-    target = { kind: "builtin" };
-  } else {
-    target = { kind: "workspace", workspaceSlug: await resolveWorkspace({
-      flag: options.workspace, store: options.store, configPath: options.configPath,
-    }) };
-  }
+  const target = await resolveEditorTarget(view.id, options);
   const token = await publishToken(options.store);
   const built = await buildEditorPackage(packageRoot);
   const result = await publishEditor({
@@ -81,10 +77,40 @@ export async function publishEditorPackage(
     script: built.script,
     token,
     target,
+    track: options.track ?? "stable",
   });
   return { id: built.id, ...result };
 }
 
+/** Move the editor's `stable` track to its current `beta` revision. */
+export async function promoteEditorPackage(
+  packageRoot: string,
+  options: Omit<WorkspaceOptions, "apiOrigin"> & { workspace?: string } = {},
+): Promise<{ id: string; status: number; body: string }> {
+  const { id } = readPackageEditorView(packageRoot);
+  const target = await resolveEditorTarget(id, options);
+  const token = await publishToken(options.store);
+  const response = await fetch(promoteEndpoint(), {
+    method: "POST",
+    redirect: "error",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({ target, editor: id, from: "beta", to: "stable" }),
+  });
+  return { id, status: response.status, body: await response.text() };
+}
+
+export async function resolveEditorTarget(
+  id: string,
+  options: WorkspaceOptions & { workspace?: string },
+): Promise<PublishTarget> {
+  const name = parseQualifiedName(id);
+  if (!name) throw new Error("Invalid editor manifest id");
+  return { kind: "workspace", workspaceSlug: await resolveWorkspace({
+    flag: options.workspace ?? (name.publisher === "moloo" ? "moloo" : undefined),
+    store: options.store, configPath: options.configPath, apiOrigin: options.apiOrigin,
+  }) };
+}
+
 function readUpload(text: string): { pathname: string; token: string } | undefined {
   let value: unknown;
   try {