Modules, themes and kits, checked before they are listed
Sandboxed extensions, themes and kits go live after automated checks. Trusted modules, which run in the server process, wait for a human review. Every download is verified against a signed index.
No results
No packages match. Try another word or a different kind.
This page is rendered by the registry blocks. On an instance that does not host the registry (REGISTRY_HOST is not set) they show a placeholder; on spillwaycms.com they list the published packages, and /registry/<name> shows a package with its README, versions, install command, capability sheet, badges and advisories.
Publish
spillway publish in a module, theme or kit folder with an API token, or upload a tarball here. Versions are semver and immutable.
Checks and review
Manifest validation, secret scanning, a sandbox smoke test, a kit dry run. Trusted modules are reviewed by a person before they appear in search.
Verified installs
The index is signed with the project key; every Spillway ships the public key, so a swapped tarball is refused.