SveltyCMS - Headless CMS with Sveltekit Power

SveltyCMS.com

(Still in Development — your support is appreciated!)

A powerful Enterprise Headless CMS with Sveltekit Power

It's lightning fast, flexible and an easy to use modern content management system to provide a headless backend

This SveltyCMS headless CMS provides a powerful backend based on a modern SvelteKit 3 / Svelte 5 framework (on the SvelteKit 3 release-candidate — see svelte.dev/blog/sveltekit-3-release-candidate). Being designed to be database agnostic, we fully support MongoDB, PostgreSQL, SQLite, and MariaDB/MySQL (via Drizzle ORM).

You can define Content Collections in two ways: in code or via the GUI-based collection builder. Full TypeScript support and a rich widget library make it straightforward to build custom data structures.

All widget fields support localization, validation using Valibot, and access control.

System localization uses Inlang Paraglide JS, a lightweight, type-safe i18n library. English is the default; additional languages are bundled and can be extended.

We use the latest tailwindcss v4, so the CMS can be quickly optimized to your personal needs.

Backend data is available via REST API or GraphQL Yoga for fast, flexible frontends.

⭐ Key Features

Feature	Status	Notes
Collection Builder	✅	GUI and code-based definitions
Typed Widget System	✅	Localization, validation, access control
Multi-language (Paraglide)	✅	Compile-time i18n (type-safe)
REST API	✅	CRUD and configuration endpoints
GraphQL API (Yoga)	✅	GraphQL API; Yoga upgrade path tracked on roadmap
Database agnostic	✅	MongoDB, PostgreSQL, SQLite, MariaDB/MySQL (Drizzle)
List / count product layer	✅	findPage (hasMore/keyset), count modes, L1 count cache (all engines)
Database Resilience	✅	Retries, self-healing reconnection, diagnostics
Email Templating	✅	Svelte Email + SMTP
Roles & Permissions	✅	Database-backed RBAC
Persistent DoS Protection	✅	Hardware-aware rate limiting; state across restarts

🚀 Quick Start

Get up and running fast:

1. Clone and install

git clone https://github.com/SveltyCMS/SveltyCMS.git
cd SveltyCMS
bun install  # or npm/pnpm

2. Start dev server (guided installer auto-launches)

bun run dev  # or npm run dev / pnpm run dev

3. Open the app

• SvelyCMS: http://localhost:5173/
• GraphQL: http://localhost:5173/api/graphql

Prefer a full walkthrough? See: ./docs/getting-started.mdx

🛠️ Developer Experience (DXP)

• CLI installer auto-launches for smooth first-run setup
• Typed widgets and schema-driven collection builder
• Fast feedback loop with hot reloads and strong typing

🚀 Setup

Clone the repository

To clone our repository you need to be able to use Git.

git clone https://github.com/SveltyCMS/SveltyCMS.git
cd SveltyCMS

Install all dependencies

Tip

Bun is preferred for best results. While SveltyCMS is fully compatible with Node.js (>=24), running the application under the Bun runtime unlocks native Zig-based cryptographic performance (like native Argon2id hashing) and optimized OS-level file watching with zero binding overhead.

Install LATEST STABLE Node.js (>=24) to get started. We recommend using Bun for the best experience (3-4x faster than npm/pnpm). Then choose your preferred package manager:

bun

# Install bun if you haven't already
curl -fsSL https://bun.sh/install | bash

# Install all dependencies
bun install

# Development (CLI installer launches automatically if needed)
bun run dev

# Build for production
bun run build

# Preview production build
bun run preview

⚠️ Windows users: If bun install fails with ParserError or corrupted packages (null bytes in package.json files), use npm install instead. bun run dev and other commands work normally after npm install. This is an upstream bun bug affecting Windows only.

npm

# Install all dependencies
npm install

# Development (CLI installer launches automatically if needed)
npm run dev

# Build for production
npm run build

# Preview production build
npm run preview

pnpm

# Install pnpm if you haven't already
npm install -g pnpm

# Install all dependencies
pnpm install

# Development (CLI installer launches automatically if needed)
pnpm run dev

# Build for production
pnpm run build

# Preview production build
pnpm run preview

Setup Wizard (auto)

When starting the dev server without configuration, the guided installer launches automatically:

• Smart detection via vite.config.ts
• Database configuration: MongoDB, PostgreSQL, SQLite, or MariaDB/MySQL
• Admin account setup, secrets/keys generation
• Optional SMTP and Google OAuth configuration

Start with:

bun run dev  # or npm run dev / pnpm run dev

Development and Production

We use the unified Vite+ Alpha (VoidZero) toolchain for an ultra-fast development experience.

• Development: bun run dev (runs on localhost:5173)
• Production Build: bun run build (Rust-based Rolldown bundler)
• Preview: bun run preview (runs on localhost:4173)
• Linting: bun run lint (oxlint — project-wide checks in <50ms)
• Formatting: bun run format (oxfmt — blazing fast Rust-based formatter)

See our package.json for all available commands.

🔒 Authentication & Security

SveltyCMS implements A++ enterprise-grade security with 4-layer defense-in-depth architecture.

Multi-Layer Protection:

• AI Bot Defense Shield — Proactive detection blocks 28 AI crawler patterns (GPTBot, Claude, Perplexity) and reconnaissance tools (Nmap, SQLMap, Burp Suite). A 45-route honeypot grid with progressive tarpit delays and response poisoning wastes attacker resources.
• 4-Layer Defense-in-Depth — Middleware → Dispatcher → Handler → Page Action; every layer re-validates permissions independently with fail-closed defaults.
• Enterprise SSO — Native SAML 2.0 and SCIM 2.0 support for automated user provisioning (Okta, Azure AD).
• Zero-Bias Cryptography — CSPRNG token generation with rejection sampling, Argon2id password hashing (64MB memory-hard), AES-256-GCM encryption, SHA-256 crypto-chained audit logs.
• Cross-Origin Isolation — COOP, COEP, and CORP headers on all API responses prevent Spectre/Meltdown side-channel attacks.
• Multi-Tenancy — Native tenantId isolation at the database adapter level with TBAC role scoping.
• Granular RBAC — Role-based and field-level access control; OAuth HMAC state integrity; timing-safe cryptographic comparisons; __Host- cookie prefix enforcement (RFC 6265bis).

You can log in with email/password, Google OAuth, or GitHub OAuth. Role- and field-based access control lets you define precisely who can view, edit, or delete content.

📖 Full Security Documentation

🎨 Modern Theming & Design System

SveltyCMS features a native Svelte 5 component library (42+ primitives) built on Tailwind 4 CSS variables with zero third-party UI dependencies.

• Swappable Admin Themes — Centralized app.css using Tailwind 4 @theme blocks. Replace the default color palette to give your CMS a corporate brand identity — from startup purple to enterprise blue in minutes.
• Dark Mode — Native support via media and class selectors.
• Accessibility-First — All components verified for WCAG 2.2 AA compliance in the Kitchen Sink validation lab.
• Zero Runtime Overhead — Components use Svelte 5 Runes ($state, $props) with Svelte use:action patterns instead of heavy state machines.

📖 UI Style Guide

🌍 Great System Localization i18n infrastructure

We use Paraglide JS, the best i18n library together with inlang ecosystem for first class System Translations with full typescript support. Our System Translations are available at: inlang and can easily be extended. If a language has not yet been defined, reach out to us, so that you can help extend the System Localization.

♿ Accessibility & Inclusivity

SveltyCMS is designed with inclusivity at its core, strictly following WCAG 2.2 AA and ATAG 2.0 standards, and proactively moving towards WCAG 3.0 (Functional Performance).

• Screen Reader Ready: Semantic HTML landmarks, ARIA live regions for status updates, and descriptive labels.
• Keyboard Navigation: Full support for keyboard-only users, including complex widgets like tree views and drag-and-drop interfaces.
• Cognitive Accessibility: Clear input validation, consistent navigation, and focus management.
• For Developers: We provide a comprehensive Accessibility Guide to help you maintain these standards in your custom widgets.

📋 Easily create Data Collections

Great Experience to designing user-friendly and intuitive interfaces for managing content. Full Typescript support to display all available widgets, options to create fully custom data structures.

📧 Flexible Email Templating System

Build and send emails using Svelty Email and TypeScript.

📦 Optimized Bundle Size SveltyCMS is built with modern optimization techniques resulting in a compact bundle compared to traditional CMS platforms:

CMS Platform	Total Asset Size	Bundle Size (Brotli)	Technology Stack
SveltyCMS	3.01 MB	842 KB ⚡	Svelte 5 + Vite+
WordPress Admin	~12.5 MB	~950 KB	jQuery + PHP
Drupal Admin	~15.0 MB	~1.2 MB	jQuery + Drupal
Payload CMS	~8.5 MB	~1.1 MB	React + Next.js
Directus	~6.5 MB	~1.0 MB	Vue.js

Note

Secure-by-Design Architecture: The 842 KB figure represents the total Brotli-compressed assets for the standard admin dashboard. By leveraging Svelte 5's zero-runtime reactivity and the Vite+ tree-shaking compiler, we achieve a highly optimized delivery where the client only receives exactly what it needs to render.

⚡ Performance Benchmarks

Self-measured suites under tests/benchmarks/ with per-DB MDX reports. Not a global “fastest CMS” ranking — numbers depend on hardware, DB, and whether you measure adapter vs full HTTP stack.

What we measure

Area	Notes
4 database adapters	SQLite (embedded), PostgreSQL / MariaDB / MongoDB (Docker local)
Optional Redis L2	Cache variants in the matrix runner
List / count product layer	findPage vs legacy list+count; count estimate vs exact; L1 count cache hits (~0.024 ms for count only, not full list bodies)
Reports	docs/project/benchmarks/benchmark_<db>.mdx

Order-of-magnitude results (self-measured; re-run to refresh)

Layer	Typical self-measured class
SQLite adapter FIND ONE	~0.05–0.08 ms
Networked adapter FIND/INSERT (local Docker)	~0.5–2+ ms (RTT-bound)
findPage vs dual findMany+count	~1.6–5.7× on that path (2026-08-04 matrix)
L1 count cache hit	~0.024–0.029 ms (all four engines)

Methodology and EU-safe competitive framing: benchmarks · performance architecture · technical evaluation.

How to run

# Console only (safe for normal dev)
bun test tests/benchmarks/database-performance.test.ts

# Record to report
BENCHMARK_RECORD=1 bun test tests/benchmarks/database-performance.test.ts

# Full matrix (long)
bun run scripts/benchmark-matrix/index.ts --sql

📚 Documentation

• 📖 Documentation — Guides, API reference, and architecture
• 🎯 Getting Started — Quick start guide
• 🗺️ Roadmap 2026 — In-progress vs planned work
• 🧪 Test status — What to run; CI is source of truth for pass/fail
• 🔒 Security — Architecture (self-assessment, not a third-party audit)
• 🔄 Upgrading SveltyCMS — Safe update guide
• 🏗️ Architecture: Database Resilience — ./docs/architecture/database-resilience.mdx
• 🤝 Contributing Guide — How to contribute

🔌 Quick API Examples

REST (fetch 5 posts):

curl -H "Authorization: Bearer <token>" \
  "http://localhost:5173/api/collections/posts?limit=5"

GraphQL (posts with author):

query {
  posts(limit: 5) {
    id
    title
    slug
    author {
      name
    }
  }
}

📜 License: Fair Source (BSL 1.1)

SveltyCMS is licensed under the Business Source License 1.1 (BSL 1.1) — Fair Source software that balances openness with sustainability.

What this means:

• ✅ Free for individuals & small businesses — Use, modify, and deploy in production if your organization's total finances are under $1,000,000 USD
• 💼 Paid license for larger organizations — Commercial license required if total finances exceed $1M USD
• 🔓 Future open source — Automatically converts to MIT License on the "Change Date" specified in the license file
• 🤝 Open collaboration — Source code is publicly available; contributions welcome

Who needs a paid license?

If your organization's Total Finances (revenue, funding, assets) exceed $1,000,000 USD, you must purchase a commercial license to use SveltyCMS in production.

Commercial licensing inquiries:

📧 Email: info@sveltycms.com

For more details, see the full LICENSE file.

❓ Need help?

Contact us if you're struggling with installation or other issues:

• 💬 GitHub Discussions
• 💬 Discord Server
• 🔧 Report Issues
• 📖 Documentation
• 📧 Email: support@sveltycms.com

🚀 Versioning & Release Process

For detailed information on our Git workflow, branching strategy, and commit conventions, see our Git Workflow & Automated Releases guide.

How Releases Work

SveltyCMS uses tag-driven releases — the maintainer controls the version number.

next:  feat: add media gallery    ─┐
       fix: toolbar spacing        ├─ accumulate over days/weeks
       feat: image derivatives     ─┘
                                         │
                               merge next → main (when stable)
                               git tag v0.0.7
                               git push --tags
                                         │
                                         ▼
                              Tag push triggers auto-release:
                              ├─ npm publish → npmjs.com
                              ├─ GitHub Release with auto-generated notes
                              └─ package.json version set from tag

• next branch: Active development — all features and fixes land here. No releases.
• main branch: Production — merged from next when stable. Releases triggered by pushing a version tag.
• Version source: Git tags are the source of truth — NOT package.json.

Commit Convention

Every commit must follow Conventional Commits:

• feat: — new feature
• fix: — bug fix
• perf: — performance improvement
• docs:, chore:, refactor:, test:, ci:, security: — maintenance

Commit prefixes inform the auto-generated release notes but do not drive version bumps — the maintainer chooses the version.

Verified CI Parity

Before submitting Pull Requests, ensure your changes pass all checks by running:

bun run lint && bun run check && bun run test:unit

This runs the linter (oxlint), type checker (svelte-check), and the full unit test suite (vitest) exactly as the CI pipeline does.

Thank you for helping us maintain a consistent and predictable release process!

🤝 Contributing

We welcome all kinds of contributions! Please see our CONTRIBUTING.md for details on how to get started.

� Sponsoring

If you find our project useful and would like to support its development, you can become a sponsor! Your sponsorship will help us cover the costs of maintaining the project and allow us to dedicate more time to its development.

There are several ways you can sponsor us:

• Become a GitHub sponsor
• Donate via PayPal

Thank you for your support! 🙏

👏 Thanks

To all our contributors — without you, SveltyCMS would never have been possible.

⭐ Give us a star

If you like what we're doing, give us a star and share our SveltyCMS project with others!

---