The Hub

The Hub is the Accent CMS ecosystem registry: one signed index serving three kinds of artifact – plugins, themes, and starter templates. The accent CLI resolves all three against the same registry, through the same verification: every registry document is Ed25519-signed and checked before it is read, every archive’s SHA-256 is checked before it is unpacked, and extraction is hardened and bounded.

The registry lives at AccentCMS/hub-registry. It is an index, not a content store: artifacts are hosted in their authors’ own repositories, and the registry holds pointers, checksums, and trust assertions.

Three kinds, two verbs

Plugins and themes are dependencies: they install into your project, stay managed, and can be removed. Templates are seeds: a template is scaffolded once by accent init and then the result is your own project – there is nothing to update against and nothing to uninstall, which is why no accent template install exists.

Kind	Discover	Use	Keep current
Plugin	accent plugin search <query>	accent plugin install <name>	accent plugin update <name>
Theme	accent theme search <query>, list --remote	accent theme install <name>	accent theme update <name>
Template	accent init --list	accent init --template <name>	– (the project is yours)

Searching the registry

accent plugin search <query> and accent theme search <query> match the query against names, descriptions, and tags in the signed index, case-insensitively:

accent plugin search forms
accent theme search dark

Each result shows the latest version, the trust tier, and a (commercial) marker where a vendor licence would be required. A search only ever offers an artifact’s latest version – retracted (yanked) versions are never suggested.

Updating

# See what is behind, without changing anything
accent plugin outdated
accent theme outdated

# Move to the latest version (or pin one with name@version)
accent plugin update accent-contact
accent theme update agentic

outdated compares each installed artifact’s pinned version against the signed index and reports – nothing is downloaded. update stages and verifies the new version completely – signatures, checksum, hardened extraction – before the installed one is touched, so a failed update always leaves the previous version in place and working.

Two rules worth knowing:

• An unpinned update never downgrades. If you installed a newer version than the registry currently lists, update says so and does nothing. Pinning name@version moves to exactly that version, in either direction.
• A theme update refuses to overwrite your edits. Themes unpack into your project precisely so you can modify them, so accent theme update compares every installed file against what install wrote and refuses if anything was modified, added, or removed – naming each file. Copy your changes somewhere safe, or re-run with --force to discard them. Plugins are opaque artifacts and update without this gate.

Retracted versions

A publisher can retract (yank) a released version – typically for a serious defect or a security problem. Retraction never deletes anything; it changes what the registry recommends:

• A retracted version is never chosen automatically and never appears in search.
• Installing or updating to one by exact name@version pin still works, with a plain warning that the version was retracted.
• If the version you have installed is retracted, accent plugin update / accent theme update moves you to the newest version the publisher still stands behind – even when that is technically a downgrade, which the command says out loud.

Installing a theme

# See what the registry publishes
accent theme list --remote

# Install the latest version (or pin one with name@version)
accent theme install agentic

The theme lands in your project’s themes directory (theme.directory, default ./themes). Installing does not activate it – the active theme is whatever theme.name in config.yaml says, and the install prints a note naming that setting when it differs:

theme:
  name: agentic

accent theme list shows what is installed, which theme is active, and whether each theme came from the hub or was created locally. accent theme info <name> adds the verified identity a hub install pinned: version, author, registry, and whether the archive’s checksum was verified.

For a theme that is not installed, info shows the hub’s listing instead, clearly labelled as such – the same works for plugins.

Removing is symmetric – accent theme remove <name> – with a warning when the theme being removed is the active one.

Scaffolding a template

# Embedded templates and the registry's, in one list
accent init --list

# An embedded name scaffolds offline, exactly as before
accent init my-site --template starter

# A registry name is resolved, verified, and scaffolded
accent init my-site --template starter-site

Embedded templates always win: accent init with no --template, or with any embedded name, never touches the network, and the registry refuses template names that collide with embedded ones. Existing files in the target directory are skipped with a warning, never overwritten – the same rule the embedded templates follow.

Installing a plugin

Covered in Managing Plugins. The command shape is the same as for themes, including name@version pins and out-of-band installs with --from.

Commercial artifacts

Some artifacts are sold. A commercial artifact still downloads freely – the registry never gates bytes – and instead requires a vendor-signed licence key to work: a commercial plugin will not load, a commercial theme will not serve or build, and a commercial template will not scaffold, until a valid key is present. Every refusal names the artifact, the exact reason, and where to buy.

Supply a key through any of four sources (the most specific wins):

1. --license <key> on accent init (for templates – the one moment a project does not exist yet);

2. the artifact’s environment variable, e.g. ACCENTCMS_ARTIFACT_LICENSE_PLUGIN_ACME_FORMS;

3. hub.licenses in the project’s config.yaml:

   hub:
     licenses:
       "plugin:acme-forms": "eyJhbGciOiJFZERTQSJ9..."
   

4. the user-level store at ~/.config/accent/hub.yaml (the platform config directory elsewhere), same licenses: map – the right home for a per-seat key that covers every project on a machine.

accent plugin info / accent theme info report the live licence status of an installed commercial artifact – valid (and from which source), missing, or exactly why a key was rejected – so the enforcement points never surprise you. A licence with no expiry is perpetual; one with a version ceiling covers every artifact version up to that MAJOR.MINOR.

Stated plainly, as the contract does: this is not DRM. The check is an unambiguous, machine-checkable statement of entitlement with a clear failure mode – bypassing it is a licence violation, not a technical feat, which is the same standard Accent’s own product licence accepts.

Trust tiers

Every listing carries a trust tier, shown at install time and worth reading:

• official – authored and published by the AccentCMS organisation.
• verified – third-party, reviewed by maintainers before listing.
• community – listed after automated checks only. The CLI says so plainly: nobody has reviewed the code. The tier is a claim about provenance and review, never a safety guarantee.

Out-of-band artifacts

Some vendors deliver their artifact themselves instead of publishing a download URL. Install the file you received with:

accent theme install <name> --from <path>

A listed artifact is still verified against the registry’s checksum even when the bytes came from disk. Only an artifact the registry does not list (or one whose vendor publishes no checksum) needs --allow-unverified, which skips the integrity check and says so.

Self-hosting and publishing

hub.registry_url in config.yaml points the CLI at your own registry; a non-default registry must also set hub.registry_public_key, because signature verification is never optional – only the key varies. See the configuration reference for the hub block.

To turn a plugin, theme, or starter template of your own into something installable, see Publishing Artifacts: accent package produces the archive, checksum, and manifest a registry submission needs, for all three kinds.