v0.4.1 · Node ≥ 24 · MIT

Full-stack TypeScript.
Secure by default.

File routing, streaming SSR, server actions, and one contract for Node, static, and edge — with a Rust/V8 runtime on the road.

Start in 30 seconds How it works

pnpm create ramonyx-app my-app

~/my-app

$ pnpm create ramonyx-app my-app

scaffold → my-app

$ cd my-app && pnpm dev

vite http://localhost:5173

ssr http://127.0.0.1:3000

ready

Default limits1 MiB body10 s timeout100 concurrent

v0.4.1

published on npm

npm packages

documentation pages

289 · 116

Node · Rust tests

Rendering

Render on the server. Hydrate with the data.

Loaders run next to the page module, the server embeds the payload, and the client hydrates without a second data request. Streaming is opt-in when you want the shell sooner.

One module, both sides

A page exports a loader and a React component. The loader output is the hydration payload — no schema glue, no double fetch.

Streaming SSR via app.streaming: true
Soft navigation + prefetch on the client
Error boundaries per folder, with stable RMX-* codes

src/routes/page.tsxtsx

export async function loader() {
  return { message: "Hello from the server" };
}

export default function Home({
  data,
}: PageProps<{ message: string }>) {
  return <h1>{data.message}</h1>;
}

Security

Limits before your code runs.

Body limits, timeouts, concurrency shedding, CSP nonces, CSRF, rate limiting, and an SSRF-guarded fetch ship with the framework. Defaults are safe; every limit is configurable.

Secure by construction

The server enforces a 1 MiB body limit, a 10 s timeout, and 100 concurrent requests before dispatch. The build rejects node:* in client modules and stubs *.server.ts imports.

Per-request CSP nonce in the hydration payload
Double-submit CSRF with Web Crypto
SSRF guard with DNS pinning (no rebinding window)
Security overview →

src/routes/middleware.tsts

export default [
  securityHeaders(),
  cspNonce(),
  rateLimit({ limit: 120, windowSeconds: 60 }),
];

Principle

“The safe path should be the default path.”

Every limit is configurable; none of them is opt-in.

Deployment

One contract. Three targets.

The same src/app.ts runs as a Node server, a static export, or an edge fetch handler. The asset map is inlined for edge builds; CI exercises the artifact in workerd.

Terminalnode

$ ramonyx build && ramonyx start
✓ client bundle → dist/client
Ramonyx running at http://127.0.0.1:3000 · production

SSR on Node ≥ 24. Hashed client assets, streaming responses, process-local cache.

Agents

Facts an agent can cite.

The machine layer publishes feature status with evidence and limitations, plus an MCP server over stdio. Everything is generated from public documentation only.

MCP tools, no hosting

npx -y @ramonyx/mcp-docs-server serves search, page reads, feature status, rules, and the public ADR index to any MCP client.

llms.txt + llms-full.txt from public docs
features.json with evidence and honest limitations
For agents →

Claude Codebash

claude mcp add ramonyx-docs \
  -- npx -y @ramonyx/mcp-docs-server

Built onReact 19VitepnpmPlaywrightNode ≥ 24TypeScript strictRust + V8 (experimental)

Full-stack TypeScript.Secure by default.