SveltyCMS - Headless CMS with Sveltekit Power

SveltyCMS.com

(Still in Development — your support is appreciated!)

This SveltyCMS headless CMS provides a powerful backend based on a modern SvelteKit 3 / Svelte 5 framework (on the SvelteKit 3 release-candidate — see svelte.dev/blog/sveltekit-3-release-candidate). Being designed to be database agnostic, we fully support MongoDB, PostgreSQL, SQLite, and MariaDB/MySQL (via Drizzle ORM).

You can define Content Collections in two ways: in code or via the GUI-based collection builder. Full TypeScript support and a rich widget library make it straightforward to build custom data structures.

All widget fields support localization, validation using Valibot, and access control.

System localization uses Inlang Paraglide JS, a lightweight, type-safe i18n library. English and German ship by default. Additional admin UI languages can be added in Setup (writes project.inlang/settings.json and runs machine translate) or by hand — see System Languages.

We use the latest tailwindcss v4, so the CMS can be quickly optimized to your personal needs.

Backend data is available via REST API or GraphQL Yoga for fast, flexible frontends.

Get up and running fast:

1. Clone and install

git clone https://github.com/SveltyCMS/SveltyCMS.git
cd SveltyCMS
bun install  # or npm install --legacy-peer-deps / pnpm install

2. Start dev server (guided installer auto-launches)

bun run dev  # or npm run dev / pnpm run dev

3. Open the app

• SvelyCMS: http://localhost:5173/
• GraphQL: http://localhost:5173/api/graphql

Prefer a full walkthrough? See: ./docs/getting-started.mdx

• CLI installer auto-launches for smooth first-run setup
• Typed widgets and schema-driven collection builder
• Fast feedback loop with hot reloads and strong typing

To clone our repository you need to be able to use Git.

git clone https://github.com/SveltyCMS/SveltyCMS.git
cd SveltyCMS

Install LATEST STABLE Node.js (>=24) or Bun to get started. Then choose your preferred package manager:

# Install bun if you haven't already
curl -fsSL https://bun.sh/install | bash

# Install all dependencies
bun install

# Development (guided setup launches automatically on first run)
bun run dev

# Production Build (Node.js runtime — highest sustained throughput)
bun run build:node
node build/index.js

# Production Build (Native Bun.serve — sub-10ms startup)
bun run build:bun
bun build/index.js

# Install all dependencies (use --legacy-peer-deps for SvelteKit 3 RC peer resolution)
npm install --legacy-peer-deps

# Development (CLI installer launches automatically if needed)
npm run dev

# Build for production
npm run build

# Preview production build
npm run preview

# Install pnpm if you haven't already
npm install -g pnpm

# Install all dependencies
pnpm install

# Development (CLI installer launches automatically if needed)
pnpm run dev

# Build for production
pnpm run build

# Preview production build
pnpm run preview

When starting the dev server without configuration, the guided installer launches automatically:

• Smart detection via vite.config.ts
• Database configuration: MongoDB, PostgreSQL, SQLite, or MariaDB/MySQL
• Admin account setup, secrets/keys generation
• Optional SMTP and Google OAuth configuration

Start with:

bun run dev  # or npm run dev / pnpm run dev

We use the unified Vite+ (VoidZero) toolchain and support dual-target execution for both Node.js (>=24) and Bun (>=1.3):

• Development: bun run dev (or npm run dev / pnpm run dev on localhost:5173)
• Production Build: bun run build (or npm run build)
• Production Server (Node.js): npm run start:node or node index.cjs (standard production server powered by Node 24 V8 engine)
• Production Server (Bun): bun run start:bun or bun index.bun.ts (native high-throughput Bun.serve runtime)
• Preview: bun run preview (runs on localhost:4173)
• Linting: bun run check (oxfmt + oxlint — project-wide checks in <50ms)

See our package.json for all available commands.

SveltyCMS implements A++ enterprise-grade security with 4-layer defense-in-depth architecture.

Multi-Layer Protection:

• AI Bot Defense Shield — Proactive detection blocks 28 AI crawler patterns (GPTBot, Claude, Perplexity) and reconnaissance tools (Nmap, SQLMap, Burp Suite). A 45-route honeypot grid with progressive tarpit delays and response poisoning wastes attacker resources.
• 4-Layer Defense-in-Depth — Middleware → Dispatcher → Handler → Page Action; every layer re-validates permissions independently with fail-closed defaults.
• Enterprise SSO — Native SAML 2.0 and SCIM 2.0 support for automated user provisioning (Okta, Azure AD).
• Zero-Bias Cryptography — CSPRNG token generation with rejection sampling, Argon2id password hashing (64MB memory-hard), AES-256-GCM encryption, SHA-256 crypto-chained audit logs.
• Cross-Origin Isolation — COOP, COEP, and CORP headers on all API responses prevent Spectre/Meltdown side-channel attacks.
• Multi-Tenancy — Native tenantId isolation at the database adapter level with TBAC role scoping.
• Granular RBAC — Role-based and field-level access control; OAuth HMAC state integrity; timing-safe cryptographic comparisons; __Host- cookie prefix enforcement (RFC 6265bis).

You can log in with email/password, Google OAuth, or GitHub OAuth. Role- and field-based access control lets you define precisely who can view, edit, or delete content.

📖 Full Security Documentation

SveltyCMS features a native Svelte 5 component library (42+ primitives) built on Tailwind 4 CSS variables with zero third-party UI dependencies.

• Swappable Admin Themes — Centralized app.css using Tailwind 4 @theme blocks. Replace the default color palette to give your CMS a corporate brand identity — from startup purple to enterprise blue in minutes.
• Dark Mode — Native support via media and class selectors.
• Accessibility-First — All components verified for WCAG 2.2 AA compliance in the Kitchen Sink validation lab.
• Zero Runtime Overhead — Components use Svelte 5 Runes ($state, $props) with Svelte use:action patterns instead of heavy state machines.

📖 UI Style Guide

bun translate          # machine-fill src/messages/{locale}.json
bun run paraglide      # compile catalogs

SveltyCMS is designed with inclusivity at its core, strictly following WCAG 2.2 AA and ATAG 2.0 standards, and proactively moving towards WCAG 3.0 (Functional Performance).

• Screen Reader Ready: Semantic HTML landmarks, ARIA live regions for status updates, and descriptive labels.
• Keyboard Navigation: Full support for keyboard-only users, including complex widgets like tree views and drag-and-drop interfaces.
• Cognitive Accessibility: Clear input validation, consistent navigation, and focus management.
• For Developers: We provide a comprehensive Accessibility Guide to help you maintain these standards in your custom widgets.

Great Experience to designing user-friendly and intuitive interfaces for managing content. Full Typescript support to display all available widgets, options to create fully custom data structures.

Build and send emails using Svelty Email and TypeScript.

📦 Optimized Bundle Size SveltyCMS is built with modern optimization techniques resulting in a compact bundle compared to traditional CMS platforms:

Self-measured suites under tests/benchmarks/ with per-DB MDX reports. Not a global “fastest CMS” ranking — numbers depend on hardware, DB, and whether you measure adapter vs full HTTP stack.

Methodology and EU-safe competitive framing: benchmarks · performance architecture · achievements log.

# Console only (safe for normal dev)
bun test tests/benchmarks/database-performance.test.ts

# Record to report
BENCHMARK_RECORD=1 bun test tests/benchmarks/database-performance.test.ts

# Full matrix (long)
bun run scripts/benchmark-matrix/index.ts --sql

• 📖 Documentation — Guides, API reference, and architecture
• 🎯 Getting Started — Quick start guide
• 🗺️ Roadmap 2026 — In-progress vs planned work
• 🧪 Test status — What to run; CI is source of truth for pass/fail
• 🔒 Security — Architecture (self-assessment, not a third-party audit)
• 🔄 Upgrading SveltyCMS — Safe update guide
• 🏗️ Architecture: Database Resilience — ./docs/architecture/database-resilience.mdx
• 🤝 Contributing Guide — How to contribute

REST (fetch 5 posts):

curl -H "Authorization: Bearer <token>" \
  "http://localhost:5173/api/collections/posts?limit=5"

GraphQL (posts with author):

query {
  posts(limit: 5) {
    id
    title
    slug
    author {
      name
    }
  }
}

SveltyCMS is licensed under the Business Source License 1.1 (BSL 1.1) — Fair Source software that balances openness with sustainability.

• ✅ Free for individuals & small businesses — Use, modify, and deploy in production if your organization's total finances are under $1,000,000 USD
• 💼 Paid license for larger organizations — Commercial license required if total finances exceed $1M USD
• 🔓 Future open source — Automatically converts to MIT License on the "Change Date" specified in the license file
• 🤝 Open collaboration — Source code is publicly available; contributions welcome

If your organization's Total Finances (revenue, funding, assets) exceed $1,000,000 USD, you must purchase a commercial license to use SveltyCMS in production.

📧 Email: info@sveltycms.com

For more details, see the full LICENSE file.

Contact us if you're struggling with installation or other issues:

• 💬 GitHub Discussions
• 💬 Discord Server
• 🔧 Report Issues
• 📖 Documentation
• 📧 Email: support@sveltycms.com

For detailed information on our Git workflow, branching strategy, and commit conventions, see our Git Workflow & Automated Releases guide.

SveltyCMS uses tag-driven releases — the maintainer controls the version number.

next:  feat: add media gallery    ─┐
       fix: toolbar spacing        ├─ accumulate over days/weeks
       feat: image derivatives     ─┘
                                         │
                               merge next → main (when stable)
                               git tag v0.0.7
                               git push --tags
                                         │
                                         ▼
                              Tag push triggers auto-release:
                              ├─ npm publish → npmjs.com
                              ├─ GitHub Release with auto-generated notes
                              └─ package.json version set from tag

• next branch: Active development — all features and fixes land here. No releases.
• main branch: Production — merged from next when stable. Releases triggered by pushing a version tag.
• Version source: Git tags are the source of truth — NOT package.json.

Every commit must follow Conventional Commits:

• feat: — new feature
• fix: — bug fix
• perf: — performance improvement
• docs:, chore:, refactor:, test:, ci:, security: — maintenance

Commit prefixes inform the auto-generated release notes but do not drive version bumps — the maintainer chooses the version.

Before submitting Pull Requests, ensure your changes pass all checks by running:

bun run lint && bun run check && bun run test:unit

This runs the linter (oxlint), type checker (svelte-check), and the full unit test suite (vitest) exactly as the CI pipeline does.

Thank you for helping us maintain a consistent and predictable release process!

We welcome all kinds of contributions! Please see our CONTRIBUTING.md for details on how to get started.

If you find our project useful and would like to support its development, you can become a sponsor! Your sponsorship will help us cover the costs of maintaining the project and allow us to dedicate more time to its development.

There are several ways you can sponsor us:

• Become a GitHub sponsor
• Donate via PayPal

Thank you for your support! 🙏

To all our contributors — without you, SveltyCMS would never have been possible.

If you like what we're doing, give us a star and share our SveltyCMS project with others!