SveltyCMS Documentation
Complete technical and editorial map for SveltyCMS — the fastest, most secure headless CMS with compiled zero-overhead performance.
Welcome. This site serves two audiences:
- Content Creators & Admins — Manage collections, media, and users without code.
- Engineers & Developers — Extend the core, build widgets, integrate via REST/GraphQL.
🎯 Choose Your Path
👥 For Administrators & Editors
| Guide | What You’ll Learn |
|---|---|
| 🚀 Getting Started | Install, run the Setup Wizard, create your first collection |
| 🛡️ Security Overview | RBAC, 2FA, audit logs, account lockout |
| 🖼️ Media Hub | Upload images, video transcoding, cloud storage |
| 👥 User Management | Roles, permissions, 2FA enforcement |
🛠️ For Developers & Engineers
| Guide | What You’ll Learn |
|---|---|
| 🏗️ Architecture Overview | Svelte 5 Runes, DB adapters, boot pipeline |
| 📡 API Reference | REST, GraphQL, Local SDK, SCIM 2.0 |
| 🧩 Widget Development | Build custom field types with the 3-pillar system |
| 📊 Dashboard Widgets | Build marketplace-portable dashboard widgets |
| ⚡ Performance Benchmarks | 60 tests across 4 databases, trend analysis |
| 🤖 AI Agent Guide | llms.txt — structured context for LLM tooling |
🚀 Key Features
| Feature | Detail |
|---|---|
| Performance | Sub-millisecond API responses, Svelte 5 zero-runtime reactivity, Local SDK at 41K RPS |
| Security | 4-layer defense-in-depth, Argon2id, AES-256-GCM, 0 CVEs, crypto-chained audit logs |
| Database Agnostic | MongoDB, PostgreSQL, MariaDB, SQLite — all production-ready with Drizzle ORM |
| i18n | Paraglide JS — compiled, type-safe, zero-runtime translations |
| Multi-Tenant | Native tenantId isolation at the database adapter level |
| AI Integration | Local Ollama + hosted MCP knowledge core, AI translation, smart CMS migration |
| Accessibility | WCAG 2.2 AA + ATAG 2.0, Svelte 5 native components, keyboard shortcuts |
| Editorial Tools | Scheduled publishing, per-field localization, version history with diff, collection templates |
🏆 Competitive Context
SveltyCMS is designed for teams that prioritize performance, security, and developer experience. For a detailed, EU-compliant comparison against Payload, Strapi, Directus, and WordPress:
All comparisons based on publicly available documentation as of June 2026.
🏗️ Technical Stack
| Layer | Technology |
|---|---|
| Frontend | SvelteKit 2 + Svelte 5 (Runes) + Tailwind CSS v4 |
| Runtime | Node.js ≥24 or Bun (3-4x faster) |
| Toolchain | VoidZero (Rust): oxlint in 47ms, oxfmt in ~2s |
| Databases | MongoDB, PostgreSQL, MariaDB, SQLite |
| ORM | Drizzle ORM — parameterized, type-safe queries |
| API | REST + GraphQL Yoga + Local SDK + SCIM 2.0 |
🔐 Security at a Glance
| Score | 0 CVEs | Full Report → |
|---|
- 4 Defense Layers: Middleware → Dispatcher → Handler → Page Action
- Auth: Argon2id (64MB), CSPRNG tokens,
__Host-cookies, 2FA TOTP, 5-attempt lockout - Encryption: AES-256-GCM, SHA-256 crypto-chained audit logs
- Headers: CSP
script-src 'self', COOP/COEP/CORP, HSTS, X-Frame-Options DENY - Reporting: security@sveltycms.com · GitHub Advisories · security.txt
🤝 Community & Support
- Bugs: GitHub Issues
- Discussions: GitHub Discussions
- Contribute: Documentation Standards
- Security: Reporting a Vulnerability
Related
Was this page helpful?