Marketplace
This page covers the CLI side of the marketplace. For the full concepts (the web catalog, the UVL configurator, publishing as a third party and the index architecture) see the Marketplace section.
The SPLENT marketplace is built on one rule. The index is a regenerable
cache, never a second source of truth. Everything the marketplace knows
about a feature derives from the feature’s own pyproject.toml (the
auto-generated [tool.splent.contract]), read at its latest released tag,
plus every SPL model the workspace knows for variability.
The model
- Publishing a feature is releasing it.
splent feature:releasebumps the version, regenerates the contract, tags the repo and uploads to GitHub and PyPI. The tag IS the publication. There is no upload to the marketplace, no account, and no publish API for features. - Publishing an SPL model is the one thing that does go through the
marketplace.
spl:publishsends the.uvlto the marketplace, which relays it to UVLHub on its own key and reports back the DOI. That is whatlogin,whoamiandlogoutexist for, and it is the only thing they are needed for. You never hold a UVLHub key. - The index is derived.
splent marketplace:indexscans the configured GitHub organisations (and any explicitly registered third-party repos), reads each feature’s contract at its latest tag, and emits a singleindex.json. If the index is ever stale, wrong or lost, rebuild it. Nothing is edited in place. - Third parties are curated, not uploaded. External authors release
their feature on their own GitHub org, then get listed by adding their
org/repo to the registry file consumed by
marketplace:index --registry(a reviewed pull request, the Homebrew-tap model). The indexer validates contracts at build time; authors never push data into the marketplace. - CLI and web share the same index.
feature:searchandfeature:inforead the sameindex.jsonthe marketplace web app serves. SetSPLENT_INDEX_URLto consume a published index; without it, commands use the locally built copy in.splent_cache/marketplace/index.json.
What the index contains
Per feature, the full contract (provides / requires / extensible / docker),
the derived archetype, presentation metadata (description, category,
tags), distribution state (latest Git tag, PyPI presence), reverse
dependencies (used_by) and the source repo. Per SPL, the DOI pointer and
the parsed UVL structure (mandatory/optional features, alternative groups,
and constraints). Plus computed collisions, features that provide the
same route/service/model and therefore can only coexist behind an
alternative group.
Commands
| Command | Purpose |
|---|---|
marketplace:index |
Build index.json from GitHub orgs, a registry file, or the workspace (--local). |
login |
Authenticate against a marketplace and store the token per registry. |
whoami |
Identity, scopes, expiry, and which credential is in use. |
logout |
Revoke the token on the server and remove it locally. |
feature:search |
Search the index (query + filters by category/archetype/tag/provides/requires). |
feature:info |
Full contract card of a feature without cloning it. |
check:contracts |
Verify contracts and SPL UVL constraints tell the same dependency story. |
login, whoami and logout are bare command names on purpose, the same
ergonomics as docker login. The CLI help lists them next to the
namespaced marketplace: commands they belong with.
Which marketplace
| Variable | Effect |
|---|---|
SPLENT_MARKETPLACE_URL |
The registry to talk to. Defaults to https://marketplace.splent.io. Every command also takes --registry URL. |
SPLENT_MARKETPLACE_TOKEN |
A token from the environment. Wins over the stored one, which is what CI expects. |
SPLENT_CREDENTIALS |
Path of the credential store. Defaults to <WORKING_DIR>/.splent/credentials.json. |
Credentials are stored per registry, so a production marketplace and a
local one coexist. From inside splent_cli_container a local one answers
at http://splent_marketplace_app_web:5000, from the host at
http://localhost:5818.