SveltyCMS connects to the hosted marketplace at marketplace.sveltycms.com for plugin discovery, license verification, and package distribution. Combined with the AI Widget Scaffolder, this provides two complementary paths for extending the CMS.

Phase 2 (August 2026): An in-app catalog lives under Config → Extensions → Marketplace. It merges local listings with the remote catalog offline-first — the CMS stays usable when marketplace.sveltycms.com is unreachable.

Architecture

Marketplace API (marketplace.sveltycms.com)

Security & license enforcement

The marketplace surface is protected at multiple layers:

1. License manager — checkExtensionLicense(type, id) verifies keys against the marketplace (POST /api/v1/license/verify), falls back to the local 14-day key-less trial, and is fail-open only when a license key is configured (marketplace-outage resilience). See License Gate Inventory.
2. Client-side gates — premium widgets/plugins resolve /api/system/license-status and render an upgrade prompt instead of content when the trial expired without a key.
3. Server-side gates (defense-in-depth) — premium dashboard endpoints (dashboard-license.ts) call checkExtensionLicense("dashboard", widgetId) and return 403 LICENSE_REQUIRED; plugin lifecycle hooks gate premium paths identically. Premium data is never served without entitlement.
4. Admin-gated catalog & install — GET /api/marketplace and POST /api/marketplace/install are admin-only; the install handler validates locals.isAdmin / role admin before any write.
5. Fail-closed dispatcher — the marketplace namespace is mapped in ENDPOINT_PERMISSIONS; unmapped namespaces return 403 by default.
6. Plugin route security — definePlugin requires requiredCapabilities on every route part (compile-time error when omitted): [] = auth-only, "public" = explicit unauthenticated opt-out.
7. No secrets in code — marketplace license keys live in system settings (LICENSE_KEY, LICENSE_KEY_{TYPE}_{ID}), never in source.

In-App Catalog (Phase 2)

Offline-first merge

1. Always include local built-in themes (adminThemeService.listThemes), dashboard widget packages (getInstalledDashboardWidgets()), and known plugin stubs (e.g. Unified Data Hub listing).
2. Best-effort call marketplace.list() against marketplace.sveltycms.com.
3. Deduplicate by id / slug; set source to local | remote | mixed and remoteAvailable accordingly.
4. Apply optional type / search filters on the merged list.

Response shape (via successResponse):

{
  "success": true,
  "data": {
    "source": "mixed",
    "remoteAvailable": true,
    "items": [
      {
        "id": "1",
        "name": "Default",
        "type": "theme",
        "source": "local",
        "installed": true,
        "version": "1.0.0"
      }
    ]
  }
}

The Marketplace tab’s type filter includes dashboard — local dashboard widget packages (from widgets/<folder>/widget.json) appear with their license model (Free / Freemium / Paid) and price, sourced from the offline-first merge.

Two Paths to Extend

Dashboard widget packages install into src/routes/(app)/dashboard/widgets/<folder>/ and appear in the dashboard picker after restart — no registration step. The marketplace hosts community-built plugins, widgets, and dashboard widgets; the scaffolder generates custom code on demand.

Marketplace Client API

List plugins

import { marketplace } from "@src/services/intelligence/marketplace-client";

// Browse all plugins
const { plugins, total } = await marketplace.list({
  type: "widget",
  limit: 10,
});

// Search
const results = await marketplace.search("seo");

// Filter by license tier
const freePlugins = await marketplace.list({ license: "free" });

Install a plugin

import { installPlugin } from "@src/services/intelligence/marketplace-client";

const plugin = await installPlugin("svelty-stripe");
// → Downloads files, creates src/plugins/stripe/, writes all files

Install a dashboard widget

import { installDashboardWidget } from "@src/services/intelligence/marketplace-client";

const widget = await installDashboardWidget("request-rate");
// → Downloads files, creates src/routes/(app)/dashboard/widgets/request-rate/,
//   writes component + widget.json + docs; visible in the picker after restart

License management

import { setLicenseKey } from "@src/services/intelligence/marketplace-client";

// Set your pro/enterprise license
setLicenseKey("svl_xxxxxxxxxxxxxxxxxxxxxxxx");

// Check if license allows a specific plugin
const { valid, tier } = await marketplace.checkLicense("enterprise-audit");

Check for updates

// Pass your installed plugins
const updates = await marketplace.checkUpdates([
  { id: "redirect-manager", version: "1.0.0" },
  { id: "sitemap", version: "1.0.0" },
]);

// → [{ id: "sitemap", version: "1.1.0", ... }]

Extension Types

License Tiers

Extension Pricing Overview

Performance

The marketplace client is offline-resilient: if marketplace.sveltycms.com is unreachable, it serves cached listings and degrades gracefully.

Local dashboard widget packages (core bundled) and built-in themes always appear in GET /api/marketplace (type dashboard) so the in-app catalog works offline; the remote catalog adds marketplace-published widgets when reachable.

Telemetry & Ecosystem Health

SveltyCMS measures extension adoption anonymously through the Security Updates & Telemetry heartbeat, which now reports the marketplace ecosystem:

This powers the BSL 1.1 economy (small business free, enterprise licensed), update/security alerts, and adoption prioritization — without tracking content, credentials, or raw IPs. See Telemetry Server Implementation for the receiver contract.

Phased Migration & Documentation Federation

As extensions migrate from the monorepo to marketplace.sveltycms.com, their co-located .mdx documentation leaves the local source tree. This creates a challenge for docs.sveltycms.com, which generates llms-full.txt and subset variants (llms-api.txt, llms-dev.txt, llms-guides.txt) by scanning local {name}/{name}.mdx files.

Migration Phases

Doc Stub Pattern

During migration, each removed extension leaves a lightweight .mdx stub in its original path that redirects readers to the marketplace:

---
title: "Remote Video Widget"
redirect: "https://marketplace.sveltycms.com/packages/remote-video"
---

# Remote Video Widget

This widget has moved to the [SveltyCMS Marketplace](https://marketplace.sveltycms.com/packages/remote-video).

The docs pipeline detects redirect frontmatter and fetches the full documentation from the marketplace API.

Federation Architecture

Marketplace API — Documentation Endpoint

The marketplace package schema includes a documentation field for serving the full .mdx content:

This field is exposed via GET /api/packages/{slug} and is ingested at build time by the docs pipeline. Cached with a 30-minute TTL, matching the marketplace client cache duration.

llms-full.txt Coverage Guarantee

The federation layer ensures 0% documentation loss during migration — every extension, whether local or marketplace-hosted, appears in llms-full.txt for AI agents and RAG pipelines.

Related

• Utility API — Marketplace — GET /api/marketplace contract
• AI Integration & Hosted Knowledge — AI widget scaffolder and behavioral learning
• Behavioral Learning Engine — Learns from usage patterns
• Plugin Architecture — Building plugins for SveltyCMS
• Widget Development — Building custom widgets
• Project Roadmap — Migration timeline and milestones