Features

Base documentation review: Nov 10, 2026. Expanded behavior, security and backend review: Nov 11, 2026. Each cell names its API boundary and source. Support can differ from the versions used in benchmark captures.

Overview bars show supported capabilities, grouped by built-in, official package and third-party package. Each capability uses the same width; unfilled space is excluded from the count. Category and tool filters apply to both views. Qualified, planned, not documented and outside-scope findings remain in the matrix and each tool’s profile. No weights or quality score are assigned.

“Not documented” means the linked API or guide was reviewed without establishing the defined behavior; it does not prove absence. “Outside scope” means the reviewed core delegates that responsibility. Built-in establishes ownership, not API quality: read the evidence for limitations and composition or override behavior.

SSR

Generate page HTML on the server from application data.

HTML streaming

Send HTML incrementally in the original response. Data streaming and separately fetched fragments are identified in notes.

Suspense / async UI

A declarative boundary with pending UI while asynchronous content resolves. It need not be named Suspense.

Client activation

Make server HTML interactive through hydration, resumability, adoption, or islands. Notes name the mechanism.

Static generation

A workflow that exports deployable HTML before requests arrive. Returning a string alone does not qualify.

Client rendering

Create and update application UI in the browser without requiring initial server HTML.

Server-only components

Keep component implementation and dependencies off the client. Notes distinguish RSC, islands, and server templates.

Static + dynamic UI

Combine a prebuilt shell with request-time content. Notes distinguish original-response streaming from separate island requests.

URL routing

Map application URLs to pages or handlers. A navigation stack alone is distinguished from HTTP routing.

Nested layouts

Compose shared layout UI around nested pages; notes explain whether layout selection is automatic or explicit.

Route parameters

Match variable URL segments, with a documented API for retrieving route parameters.

Parallel routes

Display independently navigable routed regions in one layout. Rendering two ordinary components does not qualify.

Route interception

Render a destination inside the current UI context, such as a routed modal, while preserving direct-link behavior.

Link prefetching

Fetch a likely destination before navigation; notes identify triggers and what is actually fetched.

SPA-like navigation

Navigate between same-site pages without reloading the whole document, updating the URL/history and page content. Includes client routers and Turbo-style HTML swaps. Prefetching or hydration alone does not qualify.

Page transitions

Coordinate visual animations across page navigation through a documented router or View Transitions integration. Navigating without a reload is separate; ordinary component animations alone do not qualify. Browser support and reduced-motion behavior are noted where relevant.

Redirects & rewrites

Documented URL redirection or internal rewriting APIs; notes distinguish which is supported.

Server data loading

Load asynchronous data for server-rendered UI with a documented application pattern.

Client queries

A query API for browser fetch lifecycle, cache state, or server-to-client data handoff; fetch() alone is not a query cache.

Request deduplication

Reuse equivalent reads within one render/request, distinct from caching between requests.

Cross-request cache

Retain data or rendered output across requests. Notes identify storage, lifetime, and deployment dependencies.

Cache invalidation

Explicitly expire or refresh cached data by key, tag, path, or dependencies.

Page revalidation

Refresh previously generated or cached pages after deployment. Notes distinguish origin regeneration from CDN cache headers.

HTTP endpoints

Define application endpoints for JSON, webhooks, or other HTTP responses.

Server functions

Call server-only application functions from browser code through a framework transport; hand-written HTTP endpoints are identified separately.

Forms & validation

A documented form submission and validation workflow. Notes distinguish transport, input validation, and error feedback.

Request middleware

Run application logic around page/API request handling, including request context or response modification.

Cookies & sessions

Read/write request cookies or use a session API; cookie access alone is not session management.

CSS Modules

Build-time local CSS class names imported as a module.

Scoped styles

Component-local styles whose selectors are scoped by a compiler or framework.

Tailwind integration

A documented setup for the external Tailwind CSS compiler; Tailwind is not counted as framework-owned.

CSS-in-JS

A documented CSS-in-JS integration, including server rendering constraints and any required registry.

Image optimization

Automatic resizing, format conversion, or responsive variant generation. Hand-authored srcset is called out separately.

Font optimization

Self-hosting, preload, subsetting, or fallback-metric tooling; notes identify the actual optimizations.

Script loading

Control when third-party scripts load, including deferred or interaction-driven strategies.

Static asset serving

A supported way to publish files with the deployed application, with paths and caching described.

Metadata API

A structured API for titles, descriptions, canonical URLs, and social metadata. Authoring raw head tags is identified separately.

Data-driven metadata

Compute metadata from request parameters or asynchronous data without duplicating the page data pipeline.

Layout inheritance

Inherit metadata defaults through nested layouts. Notes explain field merge or replacement semantics.

Child overrides

A child page/layout can replace or clear inherited metadata. Nested object replacement and inherited arrays must be explained.

Title composition

Apply ancestor title templates while allowing explicit absolute titles or template reset.

Generated OG images

Generate social preview image bytes through a documented integration; setting an og:image URL alone does not qualify.

Sitemaps

Generate XML sitemaps, including any documented splitting, index, or localization support.

robots.txt

A documented file convention or structured generator for crawler directives.

Markdown / MDX

Render authored Markdown content with a supported build/runtime integration; notes distinguish MDX and Markdown output APIs.

Content collections

Load, validate, and query sets of structured content; a database driver alone is not a content collection API.

Editorial previews

Bypass published/cached content for an authenticated editorial preview workflow.

Translations

Locale-specific message lookup, with documented fallback or interpolation.

Locale routing

Locale-specific URLs, detection, or redirects; translation dictionaries alone do not qualify.

Locale formatting

Locale-sensitive date, number, or plural formatting. Fixed-format helpers are identified separately.

Authentication

Documented identity/authentication integration; route guards and cookies alone are not a complete login system.

Content Security Policy

Configure Content Security Policy directives and enforcement. Notes distinguish HTTP headers, meta policies and hash-based policies; nonce coordination is compared separately.

Nonce-based CSP

Coordinate a per-response unpredictable nonce between the Content-Security-Policy and framework-generated scripts/styles, without requiring unsafe-inline. Notes distinguish automatic generation from a supplied nonce and identify streaming, caching and prerendering restrictions. Setting an arbitrary header or allowing a nonce attribute alone does not qualify.

CSRF defenses

Documented protection for unsafe browser requests. Notes specify origin checks, tokens, scope, and gaps.

Environment & secrets

A documented server/client configuration boundary; application secrets must not be exposed to client bundles.

Type checking

Compile-time types for application code or templates. Notes identify toolchain and scope.

Dev updates

A documented live-reload or hot-update workflow. State-preserving HMR is distinguished from full-page reload.

Project CLI

Commands for scaffolding, developing, or building an application.

Bundle analysis

Inspect production browser/server dependency output and its size, distinct from performance benchmarking.

Unit / component tests

A documented unit/component test workflow; notes identify external runners and unsupported component modes.

Browser tests

A documented browser automation integration or workflow; the test runner is identified separately.

Instrumentation

Hooks or integrations for traces, metrics, or production logging; dashboards/exporters may be separate.

Error boundaries

Render a defined fallback/recovery UI for failed page or component work. HTTP status responses alone are distinguished.

Self-hosting

Run the production application on infrastructure you operate, with a documented server runtime or adapter.

Static hosting

Export files deployable without an application server; notes describe features lost in this mode.

Containers

A documented container deployment workflow or image output.

Edge runtimes

A documented edge/worker deployment adapter or runtime, with limitations identified.

ORM / query builder

A documented model or query API above raw SQL or a database driver.

Schema migrations

Versioned database schema changes with an execution and history mechanism.

Transactions

A documented API for atomic database operations, including commit and rollback.

Background jobs

A persistent queue with workers and job lifecycle handling. In-process tasks are qualified separately.

Email

An integrated mail delivery API; templates, transports and queue support are distinguished in notes.

File uploads & storage

Parse uploaded files and manage storage. Request parsing alone is qualified separately.

Real-time delivery

A documented WebSocket, channel, broadcasting or server-sent event API. Notes distinguish transport from a complete pub/sub service.

Output escaping

An owned HTML output-encoding policy for dynamic values. State default/opt-in behavior, protected contexts, URL handling and raw-output bypasses. Escaping text does not establish safe JavaScript/CSS interpolation or HTML sanitization.

HTML sanitization

A maintained allowlist-based API/integration for accepting untrusted rich HTML while removing dangerous markup. Escaping to text, trusting a raw-HTML wrapper or validating a string is not sanitization.

Authorization policies

A documented permission/policy API for deciding whether a principal may perform an operation on a resource. Authentication, hiding a button or a generic middleware hook alone does not qualify.

Rate limiting

A documented limiter for requests/actions with keys, time windows and rejection behavior. State storage, single-process versus distributed enforcement, and any separately installed package. Arbitrary middleware capability alone does not qualify.

Progressive forms

Documented form submission that reaches the server and produces useful results before JavaScript loads or when it is disabled, with optional client enhancement. SSR HTML alone and browser-only submit handlers do not qualify.

Optimistic updates

A documented mutation workflow that displays an unconfirmed result immediately and reconciles it with success/failure. Pending flags alone do not qualify. State automatic versus application-owned rollback and concurrency limitations.

Stale request handling

A documented data/router mechanism that suppresses stale results or cancels superseded requests. Identify which behavior is guaranteed; aborting browser work does not undo a server mutation or guarantee backend cancellation.

Typed links & parameters

A route-aware API that checks destination names/paths and required route parameters before navigation. Generic language types, a string URL or runtime route matching alone do not qualify.

Validated URL state

A router-owned or documented schema integration that parses and validates query/search parameters into typed application state, including malformed-input behavior. Raw URLSearchParams access alone does not qualify.

Navigation state retention

A documented mechanism for retaining/restoring local UI or form state across navigation/back-forward. Identify persistent layouts, retained pages, DOM snapshots or serialization, and what resets. Browser caching alone is not a framework API.

Scroll restoration

A router/navigation integration that restores scroll positions during history traversal. Identify window versus nested scrollports, opt-in configuration and reset controls. An imperative scrollTo helper alone does not qualify.

Unsaved-change guards

An integrated navigation interception API that can pause/cancel an attempted route change and let the app resolve an unsaved-change prompt. Distinguish SPA navigation from browser beforeunload and its limitations.

Accessible navigation

A documented soft-navigation integration for focus management or announcing route changes to assistive technology. Name which behavior is automatic and which remains application-owned. ARIA attributes alone do not qualify; native full-document navigation is distinguished.

Accessibility checks

A documented compiler/linter/test integration that detects inaccessible authored UI. State static-analysis limits; no check establishes WCAG conformance, and emitting ARIA attributes alone does not qualify.

Deferred activation

Activate an interactive SSR component/island through a documented visibility, idle, interaction or media trigger. Distinguish delaying activation from delaying the JavaScript download and describe any event replay. Lazy imports alone are not a hydration scheduler.

Route / island splitting

An integrated build divides browser code by routes or independently activated islands so unused UI is not required in the initial bundle. Identify the splitting boundary and shared runtime; generic dynamic import syntax alone does not qualify.

Offline integration

A documented service-worker/offline integration with build assets or cache lifecycle support. Applications must still define offline data/failure behavior; serving static files or a manifest alone is insufficient.

Scheduled tasks

A documented recurring-task scheduler, distinct from merely dispatching or delaying one job. Describe the external runner, overlapping tasks and multi-server coordination rather than implying exactly-once execution.

Multi-channel notifications

An application notification API that selects and formats multiple delivery channels. Email alone or low-level WebSocket messages do not qualify; provider credentials, queues and external channels are named separately.

Search indexing

A documented application/model search integration with indexing and synchronization lifecycle, distinct from issuing a SQL LIKE query. Name engines/services and any application-owned synchronization.

Encrypted model fields

A model/storage integration that transparently encrypts/decrypts configured attributes, with documented key management. A generic encryption function, password hashing or database disk encryption alone does not qualify.

HTTP integration tests

A documented test harness for application handlers/routes with request construction and response assertions, including session/auth context where available. Unit renderer tests and browser automation are separate; state whether a network server is required.