This document is the living roadmap — in-progress and planned work. Completed achievements: Technical Evaluation.

---

📊 CMS Tables & List Platform (Smart Table)

Shipped foundation (July 2026): headless controller, schema-aware server filters, QueryBuilder IR, SWR/cache hash, shared UX primitives — plus the July 2026 2FA hardening set (AES-256-GCM TOTP secrets at rest, resumable enrollment, trusted-devices cookie, configurable TOTP window, afterAuthenticate plugin hook). Both are documented in the Technical Evaluation. Collections stay server-secure.

Next (high leverage — foundations ready)

Enhancement	Status	Notes
Saved views	🟡 Partial	Entry-list + website-tokens wired; users/media still to mirror
Column resize + layout prefs	🟡 Partial	Entry-list + tokens layoutKey; extend media/users
Status / domain facets	🟡 Partial	Collection facets use cached crud.count; expand chips UI
List metrics	🟡 Partial	list-query-metrics + SSR badge on collections; extend users/tokens
Filter engine reuse	Planned	Port IR to users/tokens allowlisted fields

Planned product UX

• Bulk field-edit UI, sticky columns, multi-column sort, advanced filter operators UI
• Export filtered selection, keyboard grid nav (ATAG), responsive card mode
• Team / cloud saved views (enterprise)

Performance & observability

• Virtualization tuning; predictive preload “warm next page”
• List p50/p95 from list-query-metrics into benchmark trend notes
• Negative cache / empty-page policy documentation

Explicitly deferred

Item	Why
TanStack as collection core	SSR + multi-tenant security
GraphQL.js 17 + Yoga	Blocked on graphql-yoga#4545 — do not schedule until Yoga merges
Mini matrices on Smart Table	Stay purpose-built

---

🏗️ In Progress

• 🏗️ Marketplace Phase 2 (in-app catalog) — August 2026 progress: Extensions page Marketplace tab + marketplace-view.svelte + GET /api/marketplace offline-first merge (local listings + marketplace-client remote). Dashboard widgets refactored into marketplace-portable package folders (widgets/<folder>/<component>.svelte + required widget.json + .mdx) with installDashboardWidget() and local catalog listings (type filter incl. dashboard, license/price badges). Licensing aligned with widgets/plugins/site starter: Free / Freemium (14-day key-less trial) / Paid via checkExtensionLicense("dashboard", id) — client-side upgrade prompts and server-side 403 LICENSE_REQUIRED gates on premium dashboard endpoints (see license-endpoint-inventory). Still open: one-click install pipeline for remote packages, richer package cards, in-app license UX.
• 🏗️ Plugin Admin Pages (page part) — plugins contribute full admin pages under /plugin/<path> with server load, RBAC gating (403), declarative sidebar nav, and the <AdminZone> renderer for adminTool + AdminAreaExtension zones. See Plugin Architecture.
• 🏗️ Published DB Adapters: sveltycms-sqlite|mongodb|mariadb|postgresql npm packages — extraction + CI publish pending.

---

🚀 Planned

• OIDC login flow — August 2026 progress: Discovery (auth/token/jwks/logout), JWKS verify for back-channel logout + id_token, GET /api/auth/oidc-login + oidc-callback (authorization code → local session for existing users). Still open: auto-provision policy, PKCE, IdP UI on login page, full ES256 test matrix.
• Admin Session Console (UI) — API shipped (GET/DELETE /api/user/sessions?admin=1&userId=X); Access Management UI for browsing/revoking sessions per user is planned.
• Cross-Source Merge Execution (v3.1 → stable)
• Visual Studio Query Builder
• GraphQL Supergraph / Federation
• GraphQL.js 17 + Yoga — blocked upstream (see deferred)
• Svelty Managed Cloud, Docker/Terraform enterprise pack
• AI-Verified Zero-Downtime Deployments
• Autonomous Import Optimization, per-content-type collection split
• Content branching, Dynamic admin theme system
• SvelteKit 3.0, TypeScript 7 (transformers test blocked on TS7 API)
• Field-level write guards — read-side response filtering shipped (FIELD_PERMISSIONS in handle-token-resolution) and filter/search FLAC shipped (canAccessField in the collection filter engine); still open: wiring the enforceFieldAccess write-rejection utility (403 + audit log) into the mutation pipeline
• Third-party pentest — engage a pentest lab before enterprise GA (0 CVEs on record today, self-checked via NVD / GitHub Advisory DB)

---

🧩 Gap Register & Non-Goals (August 2026)

Honest assessment against reference platforms, based on publicly available documentation as of 2026-08-04. Closure paths link to the roadmap items above; shipped items are tracked in the Technical Evaluation.

Capability	Reference platforms (public docs)	Our current state	Gap & closure path
Distributed SSO realm sessions	Keycloak documents realm-wide session clustering and cross-application SSO propagation	Single-instance session store (L1/L2 + DB); OIDC login flow in progress; SAML and all three OIDC logout mechanisms shipped	No cross-application session propagation yet. Closure: OIDC login page + PKCE (roadmap P1); distributed session clustering with the managed-cloud / Docker enterprise pack (P2)
Adaptive / risk-based authentication	Keycloak documents conditional authentication flows (step-up, risk-based)	Static lockout, TTL/idle controls, step-up re-auth for session management	No policy engine for adaptive challenges. Closure: roadmap candidate; the shipped log-only anomaly detection feeds future alerting
Module ecosystem depth	Drupal’s public module directory lists tens of thousands of modules	Plugin page part, widgets, and dashboard widget packages provide first-class admin extension points	Catalog is young. Closure: marketplace in-app catalog + one-click install (P1); ecosystem launch items on the roadmap
Field-level write guards	Directus documents per-field read/write policy per role	Read-side response filtering shipped (FIELD_PERMISSIONS); filter/search FLAC shipped (canAccessField); enforceFieldAccess write-rejection utility exists but is not yet wired	Write-guard wiring into the mutation pipeline is a roadmap candidate (P1)
Passkey UI polish	WebAuthn/passkeys widely deployed in consumer-grade UX	WebAuthn/passkey support exists; UI polish pending	Small, contained; tracked in the security scorecard
Independent verification	Enterprise platforms publish third-party pentest / audit reports	0 CVEs on record (NVD / GitHub Advisory DB, self-checked); internal scanners enforced in CI	No third-party pentest yet. Closure: engage a pentest lab before enterprise GA

Strategic non-goals (explicit): matching WordPress/PHP’s install base or module count is not a design target — the extension surface is deliberately typed and tree-shaken (plugins, widgets, dashboard packages) rather than a generic runtime hook bus.

---

🏢 Enterprise Workspaces & Governance

• Whole-team studio workflow, editorial state visibility, translation cockpit
• Adaptive workspaces theme, OAuth 2.1 for MCP, deep JSON path filtering
• AI command bar guardrails, TSV formatter evaluation, onboarding/deploy buttons

---

📣 Future Improvements to Get Noticed

🔴 High

1. Marketplace static OG sync on live docroot
2. Docs “Was this page helpful?” widget wiring
3. Framework quickstart tabs / role segmentation
4. SEO comparison blogs (dated, EU-compliant)
5. FUNDING.yml / sponsors
6. Ecosystem launch (PH, HN, awesome lists)

🟡 Medium

7. Versioned docs
8. Per-page OG images
9. Telemetry SSR of first-paint stats
10. Canonical Discord invite
11. Stripe renewal webhook fix
12. Enterprise governance feature page

GEO / KPIs

13. Agent-prompt onboarding snippets
14. FAQ JSON-LD
15. Verifiable dated technical claims (ongoing — evaluation docs truth-pass Aug 2026)
16. Analytics / Search Console

---

Priority for implementers (current)

Priority	Work
P0	Finish list surfaces on findPage/metrics; saved views on users/media
P1	Marketplace install path; OIDC login page + PKCE; published adapters
P2	Docker/Terraform, managed cloud — not GraphQL 17 until Yoga unblocks

Last roadmap sync: 2026-08-10