# What's Included

A map of implemented capabilities to their documentation. Status: ✅ implemented, ◐ partial,
⚗️ experimental (runtime). Everything below is exercised by the test suite.

## Core & routing

| Capability | Docs |
| --- | --- |
| File routing (pages, nested layouts, route groups) | [Routing](docs/routing) |
| Dynamic params `[id]` and catch-all `[...slug]` | [Routing](docs/routing) |
| API routes with method exports + 404/405 | [Routing](docs/routing) |
| Global + per-folder middleware | [Routing](docs/routing) |
| Error boundaries (`error.tsx`) + stable `RMX-*` codes | [Troubleshooting](docs/troubleshooting) |
| Request limits (body 1 MiB, 10 s timeout, 100 concurrent) | [Routing](docs/routing) |
| Config pass-through (`ramonyx.config.ts`) | [CLI](docs/cli) |

## Rendering & data

| Capability | Docs |
| --- | --- |
| SSR React (sync + streaming opt-in) | [SSR & Hydration](docs/ssr-hydration) |
| Hydration payload + soft navigation + prefetch | [SSR & Hydration](docs/ssr-hydration) |
| Loaders (`params`, `query`, `env`, `assets`, `locale`) | [SSR & Hydration](docs/ssr-hydration) |
| Server actions + schema validation + 303 PRG | [SSR & Hydration](docs/ssr-hydration) |
| Loader cache with TTL + stale-while-revalidate + tags | [Data & Caching](docs/data-and-caching) |
| On-demand invalidation (`revalidate`) | [Data & Caching](docs/data-and-caching) |
| Metadata/SEO (sitemap, robots, canonical) | [SSR & Hydration](docs/ssr-hydration) |
| i18n routing + translation helpers | [Internationalization](docs/i18n) |
| Typed routes (`routeHref`) | [Typed Routes](docs/typed-routes) |
| Streaming SSR | [SSR & Hydration](docs/ssr-hydration) |

## Security

| Capability | Docs |
| --- | --- |
| Security headers + CSP nonce | [Security overview](docs/security/overview) |
| CSRF double-submit | [Sessions & Auth](docs/sessions-and-auth) |
| Rate limiting per client | [Security overview](docs/security/overview) |
| SSRF guard with DNS pinning (`guardedFetch`) | [Security overview](docs/security/overview) |
| Safe cookies + HMAC-signed sessions | [Sessions & Auth](docs/sessions-and-auth) |
| Server/client boundary enforcement | [Architecture](docs/architecture) |
| Body/timeout/concurrency/output limits | [Routing](docs/routing) |

## Assets & media

| Capability | Docs |
| --- | --- |
| `src/assets/**` hashing + manifest + resolver | [Assets & Images](docs/assets-and-images) |
| `Image` (anti-CLS, lazy, `<picture>`) | [Assets & Images](docs/assets-and-images) |
| Build-time image variants (WebP; AVIF opt-in) | [Assets & Images](docs/assets-and-images) |
| Font preload helper | [Assets & Images](docs/assets-and-images) |

## Tooling & deployment

| Capability | Docs |
| --- | --- |
| CLI (`dev`, `build`, `start`, `doctor`, `watch`) | [CLI](docs/cli) |
| Dev server + HMR | [CLI](docs/cli) |
| Devtools panel (dev-only) | [Devtools Panel](docs/devtools) |
| Scaffolder (`create-ramonyx-app`) | [Getting Started](docs/getting-started) |
| Typed routes codegen | [Typed Routes](docs/typed-routes) |
| Observability (trace id, logs, metrics) | [Observability](docs/observability) |
| Static export / SSG | [Deployment](docs/deployment) |
| Edge/serverless target | [Deployment](docs/deployment) |
| Compression + ETag + immutable assets | [Deployment](docs/deployment) |
| Source maps (client + packages) | [Troubleshooting](docs/troubleshooting) |
| Benchmark protocol | [Benchmarks](docs/benchmarks) |
| Test utilities | [Testing](docs/testing) |

## Extensibility

| Capability | Docs |
| --- | --- |
| Plugins (Vite, middleware, hooks, assets) | [Plugins](docs/plugins) |
| Plugin publishing conventions | [Plugins](docs/plugins) |
| Image plugin (`sharp` optional peer) | [Assets & Images](docs/assets-and-images) |
| MCP docs server + `llms.txt` | [For Agents](docs/for-agents) |

## Experimental runtime (Rust + V8)

Permission deny-all model, HTTP server with streaming/cancellation, worker and process isolation,
CPU/RSS quotas, plugin sandbox (Landlock), TLS `fetch`, CommonJS interop. Shipped as a separate
binary; **not part of the production promise** yet — see the repository for its assessments.