# Roadmap

> The first-party packages planned after Tinka's foundation, and what Tinka leaves out on purpose.

Tinka grows one package at a time, and each one ships with its tests and its docs page, or it does not ship. The foundation is done: [the Introduction](introduction.md#status-and-stability) lists what an App can use today, and [Releases](releases.md) records what each version holds. This page lists what comes next.

The roadmap has no dates. A package is ready when it is complete, tested and documented, and its API settles before `v1.0.0`.

## Planned packages

### Validation

Typed validation of request bodies, query strings and route params, with every failing field reported together in one problem details response. The [body parser](guides/basics/body-parser.md) already decodes bodies into typed values and accepts a validator, so validation builds on what handlers do today.

### Sessions and authentication

Sessions that keep state between requests, logging users in and out, guards that protect routes, and authorization checks that decide what a signed-in user may do. Passwords already hash with [Argon2id](guides/security/hashing.md), and cookies are [signed and encrypted](guides/basics/response.md#set-cookies) with the App's key.

### Data layer

Access to SQL databases, migrations that evolve the schema with the App, and models for reading and writing rows. Until it ships, open a database with `database/sql` and register the pool in a [service provider](guides/concepts/service-providers.md), as the [FAQs](faqs.md#how-do-i-use-a-database-today) show.

### HTTP security

A static file server with caching headers, CORS for APIs that browsers call from other origins, CSRF protection for forms, and rate limiting. Today `app.Handle` serves files with the standard library's `http.FileServerFS`, as [Routing](guides/basics/routing.md#serve-other-handlers) shows, and `net/http` middleware already runs in Tinka's chain through `tinka.Std`, so you can add a package you trust in the meantime: see [Middleware](guides/basics/middleware.md#use-nethttp-middleware).

## Left out on purpose

Some things Tinka does not plan to add, because the language or the principles already answer them:

- **Controllers.** A handler is a function, and handlers that share a dependency are methods on a struct. There is no controller type to learn.
- **A configuration loader.** Configuration is typed Go code that reads the environment, as [Configuration & Environment](configuration.md) shows, so the compiler checks it.
- **A REPL.** Write a [Command](guides/command-line/commands.md) for a task you run by hand, and it ships with the App.

See also: [Releases](releases.md), [Philosophy](philosophy.md), [Contributing](contributing.md)