Documentation

Add the repository

Register the repository in the project’s composer.json:

composer config repositories.meteorgpl composer https://composer.meteorgpl.com

The repository serves Composer 2 metadata only. Every package it carries is listed on the Packages page.

Authenticate

The repository answers only to a token. Create one on your account page (Account → Tokens) and store it in Composer’s global auth.json:

composer config --global http-basic.composer.meteorgpl.com token <your-token>

The user name is the literal word token (your account e-mail address works as well); the password is the token. Composer writes the pair to ~/.composer/auth.json (or $COMPOSER_HOME/auth.json), never into the project. If you run Composer without a stored token it prompts for the credentials and offers to save them.

In CI, pass the credentials through the environment instead of a file:

COMPOSER_AUTH='{"http-basic":{"composer.meteorgpl.com":{"username":"token","password":"<your-token>"}}}'

Tokens can carry an expiry date and can be revoked at any time from the account page. Repository access is tied to the account: a token of an account without access answers 403 with a pointer to the account page; an unknown, expired or revoked token answers 401.

Package naming

The slug is the plugin’s or theme’s own folder name under wp-content/plugins or wp-content/themes, lower-cased. composer/installers places the package in a folder of that name, so WordPress sees the directory the vendor ships.

Example composer.json

Traditional WordPress

{
    "repositories": [
        { "type": "composer", "url": "https://composer.meteorgpl.com" }
    ],
    "require": {
        "composer/installers": "^2.0",
        "meteorgpl-plugin/elementor-pro": "^3.0",
        "meteorgpl-theme/rehub-theme": "^19.0"
    },
    "extra": {
        "installer-paths": {
            "wp-content/plugins/{$name}/": ["type:wordpress-plugin"],
            "wp-content/themes/{$name}/": ["type:wordpress-theme"]
        }
    },
    "config": {
        "allow-plugins": { "composer/installers": true }
    }
}

The installer-paths map tells composer/installers where wordpress-plugin and wordpress-theme packages go.

Bedrock

Bedrock already requires composer/installers and maps both package types to web/app/plugins and web/app/themes. Add the repository and require the packages; nothing else changes.

Versions

Every version is a semver tag (v3.21.0) in the package’s git history, built into a dist zip whose SHA-256 is shown on the package page and in the API. composer.lock pins the exact version and the dist checksum, so every environment installs the same bytes.

Every published version stays available. composer update moves forward within your constraint; composer require meteorgpl-plugin/elementor-pro:3.20.0 moves back.

License keys

Nothing in a package is modified. The vendor’s license, activation and update code is shipped as-is. Activate the plugin or theme in WordPress with the key you bought from the vendor; the vendor’s own update channel and support remain available to you as the license holder. The licensing page explains the license profiles shown on each package page and what is stripped from the archives.

API

A public, read-only JSON API. Responses are cacheable for five minutes (Cache-Control: public, max-age=300), limited to 60 requests per minute per IP address; unknown packages answer 404.

GET https://meteorgpl.com/api/packages

The listed packages, 50 per page, newest release first. Parameters: q (search), type (plugin or theme), page. Each entry: composer_name, type, title, description, latest_version, latest_released_at, versions_count, license_spdx, license_profile, homepage, url.

GET https://meteorgpl.com/api/packages/{vendor}/{slug}

One package with its published versions: version, released_at, dist_size, dist_sha256, requires_php, requires_wp, tested_wp.

GET https://meteorgpl.com/api/stats

total_packages, active_plugins, active_themes, total_versions, installs_30d, downloads_30d. Installs are Composer’s notify-batch reports; downloads are dist zip downloads.

GET https://meteorgpl.com/api/status

The promoted repository build: build_id, created_at, package_count, version_count (nulls while no build exists).

Every package page is also available as Markdown at /packages/{vendor}/{slug}.md or with Accept: text/markdown, as is this page at /docs.md.