This document is the living roadmap — in-progress and planned work. Completed achievements: Achievements Log.

---

📊 CMS Tables & List Platform (Smart Table)

Shipped foundation (July 2026): headless controller, schema-aware server filters, QueryBuilder IR, SWR/cache hash, shared UX primitives — plus the July 2026 2FA hardening set (AES-256-GCM TOTP secrets at rest, resumable enrollment, trusted-devices cookie, configurable TOTP window, afterAuthenticate plugin hook). Both are documented in the Achievements Log. Collections stay server-secure.

Next (high leverage — foundations ready)

Enhancement	Status	Notes
Saved views	🟢 Shipped	100% wired across all list surfaces: Entry-list, website-tokens, users, and media
Column resize + layout prefs	🟡 Partial	Entry-list + tokens layoutKey; extend media/users
Status / domain facets	🟢 Shipped	Collection facets + interactive User Management facet chips (All, Admins, Users, Active, Blocked)
List metrics	🟢 Shipped	list-query-metrics + SSR badge on collections, users, and tokens
Filter engine reuse	🟢 Shipped	Allowlisted field filtering (role, blocked, email, username) on users/tokens

Planned product UX

• Bulk field-edit UI, sticky columns, multi-column sort, advanced filter operators UI
• Export filtered selection, keyboard grid nav (ATAG), responsive card mode
• Team / cloud saved views (enterprise)

Performance & observability

• Predictive preload “warm next page” — 🟢 Shipped: sidebar smart-preload of learner-predicted path + dashboard hot-collection chips + heat-aware SWR + Smart Table pagination links with data-preload="viewport" (2026-09-02, see Achievements Log).
• List p50/p95 from list-query-metrics into benchmark trend notes
• Negative cache / empty-page policy documentation

Explicitly deferred

Item	Why
TanStack as collection core	SSR + multi-tenant security
Mini matrices on Smart Table	Stay purpose-built

---

🏗️ In Progress

• 🏗️ AI-Assisted Builder (Phase 0 shipped 2026-08-20) — src/services/ai-builder/ gateway skeleton: gateway.ts (ordered backend failover via the existing Ollama aiService + per-user sliding-window quotas), prompts.ts (<user_data> passive-reference injection shield), validator.ts (Valibot structured-output validation + widget-registry awareness + reserved db_fieldName blocking), diff.ts (proposal-vs-schema diff), collection-designer.ts (design/refine). API namespace ai-builder registered in the existing fail-closed dispatcher (ENDPOINT_PERMISSIONS: system:settings, admin-gated handler): POST /api/ai-builder/design-collection and refine-collection live; approve-collection returns 501 until Phase 1 (schema write via AST path). See AI-Assisted Builder Design.

• 🏗️ CollectionsNamespace consolidation (2026-08) — src/services/sdk/namespaces/collections-namespace.ts split from a ~2,100-line monolith into a thin orchestrator + single-purpose modules (schema-store, read-pipeline, write-pipeline, post-write, request-cache, lazy-services). Write field prep is now ONE schema walk + ONE clone via prepareCollectionFields() in content-utils.ts (previously 3 walks / up to 3 clones); create/update share applySchemaHookPipeline; collectionTableName() centralizes physical table naming (namespace + handlers); dead code removed (emitOutboxEvent, modifyRequest passthrough). Adapter naming reconciled: SQL getTable/createIndexes/registerTableSchema and Mongo normalizeCollectionName/createModel now all derive from normalizeCollectionTableName() — fixes hyphenated-id index/model-registry mismatches (see Performance Architecture). Hot-path follow-on (2026-08-21): field-cached widget transforms, createdAt insert-only on SQL+Mongo, mutation L1 sync / L2 fire-and-forget, validateSession JOIN, zero boot settling delay, globalThis cache/webhook/automation singletons. Security invariants preserved: publication clamping, tenant injection, sanitization, assertWriteAllowed, best-effort side effects. See Local SDK vs HTTP/GraphQL API. Pending: re-run local-cms-crud / local-sdk-vs-direct benchmarks to refresh trend labels.

• 🏗️ Marketplace Phase 2 (in-app catalog) — August 2026 progress: Extensions page Marketplace tab + marketplace-view.svelte + GET /api/marketplace offline-first merge (local listings + marketplace-client remote). Dashboard widgets refactored into marketplace-portable package folders (widgets/<folder>/<component>.svelte + required widget.json + .mdx) with installDashboardWidget() and local catalog listings (type filter incl. dashboard, license/price badges). Licensing aligned with widgets/plugins/site starter: Free / Freemium (14-day key-less trial) / Paid via checkExtensionLicense("dashboard", id) — client-side upgrade prompts and server-side 403 LICENSE_REQUIRED gates on premium dashboard endpoints (see license-endpoint-inventory). Still open: one-click install pipeline for remote packages, richer package cards, in-app license UX.

• 🏗️ Plugin Admin Pages (page part) — plugins contribute full admin pages under /plugin/<path> with server load, RBAC gating (403), declarative sidebar nav, and the <AdminZone> renderer for adminTool + AdminAreaExtension zones. See Plugin Architecture.

• 🏗️ Published DB Adapters: sveltycms-sqlite|mongodb|mariadb|postgresql npm packages — extraction + CI publish pending.

• 🏗️ Native commerce pipeline — optional Commerce plugin (disabled by default): tenant-scoped guest cart, merge on login, quotes, inventory, checkout, /api/commerce/*, Stripe grandTotal intent, /shop /cart /checkout /account, transactional mail. Smart Importer Woo/Shopify. Dashboard Orders / Inventory widgets. Dedicated /api/commerce rate-limit lane. Paid add-ons (not core): Live Shipping (plugin:shipping-live, UPS/FedEx/DHL) and TaxJar (plugin:taxjar) — table rates stay free. Open (same list as the overview “Still open” table): ConditionPlugin / AND-OR promotion groups; BOGO / tiered promotions, multi-warehouse, FX resolver; Stripe Billing (Pro endpoint is 501); computeTotals < 5 ms benchmark; HTTP cart→order→refund two-tenant integration; Schema.org Product/Offer/Review on /shop. Product map: E-Commerce Overview.

---

🚀 Planned

• OIDC login flow — August 2026 progress: Discovery (auth/token/jwks/logout), JWKS verify for back-channel logout + id_token, GET /api/auth/oidc-login + oidc-callback (authorization code → local session for existing users). Still open: auto-provision policy, PKCE, IdP UI on login page, full ES256 test matrix.
• Admin Session Console (UI) — 🟢 Shipped (September 2026): interactive modal for inspecting active user sessions, device/browser categorization, IP addresses, and one-click revocation.
• Cross-Source Merge Execution (v3.1 → stable)
• Visual Studio Query Builder
• GraphQL Supergraph / Federation
• Svelty Managed Cloud, Docker/Terraform enterprise pack
• AI-Verified Zero-Downtime Deployments
• SvelteKit 3.0, TypeScript 7 — running @sveltejs/kit@3.0.0-next.25 + typescript@6.0.3; TS7 adoption pending SvelteKit upstream write_tsconfig modernisation (language-tools#3063)
• Rust Tooling Watch (fuzdev/tsv) — Track development of fuzdev/tsv (native Rust Svelte parser + formatter); evaluate for Svelte AST compilation & CI linting once its planned linter ships to complement/benchmark against Oxc (oxlint + oxfmt).
• Third-party pentest — engage a pentest lab before enterprise GA (0 CVEs on record today, self-checked via NVD / GitHub Advisory DB)

---

🧩 Gap Register & Non-Goals (August 2026)

Honest assessment against reference platforms, based on publicly available documentation as of 2026-08-04. Closure paths link to the roadmap items above; shipped items are tracked in the Achievements Log.

Capability	Reference platforms (public docs)	Our current state	Gap & closure path
Distributed SSO realm sessions	Keycloak documents realm-wide session clustering and cross-application SSO propagation	Single-instance session store (L1/L2 + DB); OIDC login flow in progress; SAML and all three OIDC logout mechanisms shipped	No cross-application session propagation yet. Closure: OIDC login page + PKCE (roadmap P1); distributed session clustering with the managed-cloud / Docker enterprise pack (P2)
Adaptive / risk-based authentication	Keycloak documents conditional authentication flows (step-up, risk-based)	Static lockout, TTL/idle controls, step-up re-auth for session management	No policy engine for adaptive challenges. Closure: roadmap candidate; the shipped log-only anomaly detection feeds future alerting
Module ecosystem depth	Drupal’s public module directory lists tens of thousands of modules	Plugin page part, widgets, and dashboard widget packages provide first-class admin extension points	Catalog is young. Closure: marketplace in-app catalog + one-click install (P1); ecosystem launch items on the roadmap
Field-level write guards	Directus documents per-field read/write policy per role	Read-side response filtering shipped (FIELD_PERMISSIONS); filter/search FLAC shipped (canAccessField); mutation enforcement active via assertWriteAllowed	Shipped: Full read + write field permission enforcement active across SDK and API pipelines
Passkey UI polish	WebAuthn/passkeys widely deployed in consumer-grade UX	WebAuthn/passkey support exists; UI polish pending	Small, contained; tracked in the security scorecard
Independent verification	Enterprise platforms publish third-party pentest / audit reports	0 CVEs on record (NVD / GitHub Advisory DB, self-checked); internal scanners enforced in CI	No third-party pentest yet. Closure: engage a pentest lab before enterprise GA

Strategic non-goals (explicit): matching WordPress/PHP’s install base or module count is not a design target — the extension surface is deliberately typed and tree-shaken (plugins, widgets, dashboard packages) rather than a generic runtime hook bus.

---

🏢 Enterprise Workspaces & Governance

• Whole-team studio workflow, editorial state visibility, translation cockpit
• Adaptive workspaces theme, OAuth 2.1 for MCP, deep JSON path filtering
• AI command bar guardrails, Rust tooling evaluation (fuzdev/tsv formatter/parser vs Oxc), onboarding/deploy buttons

---

📣 Future Improvements to Get Noticed

🔴 High

1. Marketplace static OG sync on live docroot
2. Docs “Was this page helpful?” widget wiring
3. Framework quickstart tabs / role segmentation
4. SEO comparison blogs (dated, EU-compliant)
5. FUNDING.yml / sponsors
6. Ecosystem launch (PH, HN, awesome lists)

🟡 Medium

7. Versioned docs
8. Per-page OG images
9. Telemetry SSR of first-paint stats
10. Canonical Discord invite
11. Stripe renewal webhook fix
12. Enterprise governance feature page

GEO / KPIs

13. Agent-prompt onboarding snippets
14. FAQ JSON-LD
15. Verifiable dated technical claims (ongoing — evaluation docs truth-pass Aug 2026)
16. Analytics / Search Console

---

Priority for implementers (current)

Priority	Work
P0	Scale-spectrum ledger recorded (SQLite 1→10k; PG/Maria/Mongo 1→100k) — see achievements
P1	Marketplace install path; OIDC login page + PKCE; published adapters
P2	Docker/Terraform, managed cloud

✅ Shipped (2026-08-23) — moved to the Achievements Log

• Hardware-adaptive profile (@utils/hardware-profile) — one boot-time detection drives sharp/DB-pool/worker/compile/job concurrency with workload-prioritized CPU allocation and HARDWARE_CPU_BUDGET (default 0.75 all-in-one, 1.0 dedicated). Surfaces on the dashboard + setup wizard.
• Honest 4-DB benchmark matrix 199/200 — media preset dedup + deferred variant generation (SDK −45%, HTTP −50%), CacheService pattern invalidation 26→4.5 ms, reporter auto-formats generated MDX (DX check stays green), benchmark seeder provisions index-pressure/migration-scale collections, Mongo stress flakes fixed.

Open follow-ups: run the Redis matrix variant once (USE_REDIS=true). The profile-backed matrix re-run landed 200/200 — see the Achievements Log for the pre-profile vs profile measurement.

Last roadmap sync: 2026-08-23

✅ Shipped (2026-09-02) — moved to the Achievements Log

• Intelligence consumption & predictive navigation — the behavioral learner now renders confidence-gated (predictNextPathAdaptive); data-preload="smart" on sidebar navigation and collection tree nodes in collections.svelte + tree-view.svelte; “Warm next page” viewport preloading on Smart Table pagination controls (data-preload="viewport" on next page link via pagination.svelte); dashboard hot-collection quick chips; heat-aware SWR in collection-service.ts (hot top-20 lists keep the 60 s fresh TTL but serve stale up to 15 min; cold lists unchanged).
• Request-pipeline lean — one canonical L2 cache key shared by hook + dispatcher (duplicate api: namespace retired), single-compression guarantee via a compressed: {} sentinel (one br+gzip+zstd pass re-sets L1 with real variants), admin sidebar payload cached per (tenant, contentVersion) instead of rebuilt + recursively cloned per SSR, and one per-request session-cookie resolution across authn/authz/turbo/dispatcher.
• Smart Table Saved Views — saved views menu (SmartTableSavedViewsMenu) wired into User Management (admin-area.svelte) alongside existing entry-list and website-tokens surfaces.