Roadmap

Where Ultimo is headed. The throughline is type-safe end to end — define your API in Rust, get a fully-typed TypeScript client with no drift — sequenced toward a stable 1.0.

Coming Soon 🚧

Type-safe everything (the differentiator)

• 🧩 Finish the codegen story — scaffold generate-client into ultimo new templates; TypeScript docs/workflow rewrite; ultimo generate --watch. ✅ Shipped in 0.5.1
• 🦀 Rust client generation — ultimo generate --target rust produces a typed Rust crate (with reqwest) from your RPC definitions, enabling compile-time-safe service-to-service communication. Publish to a private registry (CodeArtifact, Artifactory, Cloudsmith) for internal microservice contracts — if Service A changes an RPC signature, Service B won't compile until updated.
• 📡 Typed RPC subscriptions / SSE — server-push with event types derived from your Rust types (tRPC-style subscriptions, in Rust).
• ❗ End-to-end typed errors — RPC errors surfaced as typed results in the generated client.
• ✅ Validation from types — derive request validation from the type (Pydantic-style), wired into the extractor and RPC boundary. (Shipped with typed extractors — see the Valid<T> extractor.)
• 🪄 #[derive(UltimoType)] — a thin wrapper so client types derive without adding ts-rs to your own Cargo.toml.

Real-time & streaming

• 🗜️ WebSocket compression — per-message deflate (RFC 7692).

Auth & sessions

• 🔐 OAuth2 — provider integration on top of the existing JWT/API-key auth.
• 🎫 Redis sessions — distributed session storage.

Production-readiness

• 📦 Deployment guides — Docker, Fly.io/Railway, AWS, DigitalOcean, Azure, Google Cloud Run, Kubernetes — each with ready-to-use config. ✅ Shipped in 0.5.1
• 🛡️ Advanced rate limiting — per-user, per-endpoint limits. ✅ Shipped in 0.5.1
• ⏱️ Request timeouts + HTTP graceful shutdown. ✅ Shipped in 0.9.3
• 🔄 Hot reload — ultimo dev with file-watching auto-restart. ✅ Shipped in 0.5.1

Developer experience

• 📖 Turnkey interactive API docs — one call (app.serve_docs("/docs")) to serve Swagger UI / Scalar / ReDoc wired to the generated OpenAPI spec (FastAPI's signature /docs). The Swagger UI helper exists today; this makes it one line. ✅ Shipped in 0.5.1
• 🧩 Built-in middleware pack — small, expected pieces: request-id ✅ shipped, cache-control / ETag helpers, server-timing, basic-auth, trailing-slash normalization (Hono-style breadth).

Integrations

One principle throughout: a generic capability in core, plus thin presets / adapters and cookbook guides — never bundled vendor SDKs (which bloat dependencies and rot as each vendor's API changes).

• 📈 Observability — OpenTelemetry traces + metrics, and a Prometheus endpoint (built on the tracing already used internally).
• 🧰 Redis — one integration backing sessions, the rate-limit store, and response/data caching.
• 🗄️ S3-compatible object storage — pairs with the existing multipart upload support (demand-driven).
• ⚙️ Background tasks — in-process Tokio job spawning (demand-driven).

Cookbook guides only (app-layer, not framework code): email (SMTP/Resend/Postmark), payments (Stripe webhooks), and vendor message queues.

Toward 1.0

• 🧱 API stabilization — public-API audit, documentation completeness, SemVer freeze.

Maybe / demand-driven (post-1.0)

• 🌍 Python client generation — extend the codegen engine beyond TypeScript.

Removed from the roadmap: HTTP/2 Push (deprecated in browsers), Long Polling (covered by SSE + WebSockets), the AI dev-UI cluster (Development Dashboard / Schema Introspection / Smart Suggestions), Go/Dart/Swift client generation (focus stays TypeScript-first), and a standalone Mock Server (testing utilities already ship).

Considered and declined: edge / multi-runtime deployment (Hono's Workers/WASM model) — an architectural mismatch with Ultimo's native Hyper + Tokio core; and server-side rendering / JSX templating — counter to the "Rust API + typed TypeScript frontend" model (a cookbook at most).

Feature Status

For ✅ Available rows, the right column is the real crate version it shipped in. For 📋 Planned rows, it's the roadmap phase it's targeted for — not a crate version, since planned work doesn't have a version number yet.

Roadmap Phases

These are thematic groupings of related work, in roughly the order we're tackling them — not release version numbers. The published crate's version (currently 0.9.2) bumps automatically per PR (any breaking change → minor, any additive/fix → patch) and moves independently of which phase a feature belongs to, so a phase name never goes stale the way a "v0.7.0" label would once the crate passes 0.7 numerically without that phase being done.

Phase 1: Foundations

• Core framework features
• RPC system with TypeScript generation
• OpenAPI support
• CLI tools
• Database integration (SQLx & Diesel)

Phase 2: WebSocket Support

• ✅ WebSocket Support (Complete) - Production-ready RFC 6455 implementation
• ✅ Configuration System - WebSocketConfig with size limits, timeouts, and buffer sizes
• ✅ Message Fragmentation - Automatic chunking and reassembly for large payloads
• ✅ Automatic Ping/Pong - Heartbeat with configurable intervals and timeout detection
• ✅ Graceful Shutdown - Server-wide notifications with broadcast_all()
• ✅ Backpressure Handling - Bounded channels, on_drain callback, capacity tracking
• ✅ Built-in Pub/Sub System - Topic-based messaging with backpressure support
• ✅ Type-safe WebSocketHandler - Typed context data and lifecycle callbacks
• ✅ Router Optimization - Radix Tree for O(L) lookups
• ✅ 279 Comprehensive Tests - Production-ready with extensive test coverage
• ✅ Two Working Examples - Simple chat + React chat

Phase 3: Sessions, Cookies & Testing

• ✅ Session management — cookie-based sessions, SessionStore + in-memory store, secure middleware
• ✅ Cookie helper — parsing + Set-Cookie with security guards
• ✅ Testing utilities — in-process TestClient, assertions, middleware/DB/fixture helpers
• ✅ Router precedence fix, Ultimo::oneshot, Request::raw_body()
• ✅ MSRV 1.86, hardened dependency floors, automated releases + CI guardrails

Phase 4: Security & Performance

Ultimo's two headline pillars: secure-by-default and proven performance.

Security (secure-by-default · defense-in-depth · provable)

• ✅ Security headers middleware (HSTS, CSP, X-Frame-Options, …)
• ✅ CSRF protection (integrates with sessions)
• ✅ Auth: JWT + API-key middleware + authorization guards (scopes)
• ✅ Request body-size limits + real client IP (trusted-proxy aware)
• ✅ #![forbid(unsafe_code)] (100% safe Rust), SECURITY.md disclosure policy, cargo-deny + cargo-audit in CI

Performance (proven · regression-guarded)

• ✅ Framework-overhead benchmark suite (criterion) + methodology (BENCHMARKS.md) + advisory CI regression check
• ✅ /performance page with reproducible methodology + self-serve recipe

Phase 5: Static Files & Compression

• ✅ Static file serving + SPA fallback — serve_static, serve_spa, ETag caching, path-traversal protection (static-files feature)
• ✅ Response compression — automatic brotli/gzip middleware, pure Rust, builder API (compression feature)

Phase 6: Type-Safe Clients, For Real

• ✅ TypeScript type derivation (client-gen feature) — RPC client types are derived from your Rust types via ts-rs; the generated client emits real type X = {...} declarations instead of hand-written strings. ts_rs::TS re-exported as ultimo::rpc::TS.
• ✅ Derived query/mutation (breaking) — infer input/output types from #[derive(TS)] structs; string-typed query_with_types/mutation_with_types remain as escape hatches.
• ✅ ultimo generate runs for real — executes the project's generate-client binary (no more artifact-hunting); assert_cmd CLI tests.

Phase 7: Hot Reload & IP Filtering

• ✅ Hot reload — ultimo dev with file-watching auto-restart
• ✅ IP allow/deny middleware — CIDR-aware IpFilter (allow-list / deny-list)

Phase 8: Finish the Codegen Story + Ship-Readiness

• Codegen: scaffold generate-client into ultimo new templates; TypeScript docs rewrite; ultimo generate --watch ✅ Shipped
• Rust client generation — ultimo generate --target rust for typed service-to-service RPC (microservice contracts via private crate registry)
• Turnkey interactive API docs — serve_docs (Swagger UI / Scalar / ReDoc) ✅ Shipped
• Deployment guides (Docker, Fly.io/Railway, AWS, DigitalOcean, Azure, GCR, K8s) ✅ Shipped
• Advanced rate limiting (per-user, per-endpoint) ✅ Shipped

Phase 9: Real-Time, Auth & Production Gaps

• ✅ Typed handler extractors + validation-from-types (type-safe input; Path/Query/Json/Valid, 400/422)
• Typed RPC subscriptions / SSE (derived event types)
• OAuth2 provider integration
• ✅ Auth providers (OIDC/JWKS) — RS256/ES256 + remote JWKS (fetch/cache/ rotation), OIDC discovery, cookbook for Clerk / Cognito / Auth0 / Supabase (oidc feature)
• Observability — OpenTelemetry traces + metrics, Prometheus endpoint (in progress: request_id() middleware + request-scoped tracing span shipped; Prometheus metrics next)
• ✅ Streaming responses
• ✅ Request timeouts + HTTP graceful shutdown — request_timeout, listen_with_shutdown, shutdown_signal; WebSocket clients get a 1001 close frame

Phase 10: Distribution & Dev Experience

• Redis integration — sessions, cache, and rate-limit store (one dependency)
• WebSocket compression (per-message deflate)
• #[derive(UltimoType)] (drop the ts-rs dependency papercut)
• Built-in middleware pack (✅ request-id; cache-control/ETag, server-timing, basic-auth remaining)

Phase 11: Stabilization (toward 1.0)

• End-to-end typed errors
• Public-API audit + SemVer freeze
• Documentation completeness
• Production battle-testing
• (Demand-driven: S3-compatible storage, background tasks, MCP server, Python client generation)

Contributing

Want to help? Check out:

• GitHub Issues
• Contributing Guide
• Discord Community

Feature Requests

Have an idea? Open an issue with the "feature request" label.

Stay Updated

• Follow on Twitter
• Join Discord
• Watch on GitHub