Roadmap

Where Ultimo is headed. The throughline is type-safe end to end — define your API in Rust, get a fully-typed TypeScript client with no drift — sequenced toward a stable 1.0.

Coming Soon 🚧

Type-safe everything (the differentiator)

• 🧩 Finish the codegen story — scaffold generate-client into ultimo new templates; TypeScript docs/workflow rewrite; ultimo generate --watch. ✅ Shipped in 0.5.1
• 🦀 Rust client generation — ultimo generate --target rust produces a typed Rust crate (with reqwest) from your RPC definitions, enabling compile-time-safe service-to-service communication. Publish to a private registry (CodeArtifact, Artifactory, Cloudsmith) for internal microservice contracts — if Service A changes an RPC signature, Service B won't compile until updated.
• 📡 Typed RPC subscriptions / SSE — server-push with event types derived from your Rust types (tRPC-style subscriptions, in Rust).
• ❗ End-to-end typed errors — RPC errors surfaced as typed results in the generated client.
• 🎯 Typed handler extractors — declare typed path / query / body / header params on a handler; they're parsed and validated automatically, with a structured 422 on bad input. Ultimo already gives type-safe output (the TS client); this gives type-safe input — the handler signature becomes the contract. Inspired by FastAPI / axum.
• ✅ Validation from types — derive request validation from the type (Pydantic-style), wired into the extractor and RPC boundary.
• 🪄 #[derive(UltimoType)] — a thin wrapper so client types derive without adding ts-rs to your own Cargo.toml.

Real-time & streaming

• 🌊 Streaming responses — large-body / chunked streaming.
• 🗜️ WebSocket compression — per-message deflate (RFC 7692).

Auth & sessions

• 🔐 OAuth2 — provider integration on top of the existing JWT/API-key auth.
• 🎫 Redis sessions — distributed session storage.

Production-readiness

• 📦 Deployment guides — Docker, Fly.io/Railway, AWS, DigitalOcean, Azure, Google Cloud Run, Kubernetes — each with ready-to-use config. ✅ Shipped in 0.5.1
• 🛡️ Advanced rate limiting — per-user, per-endpoint limits. ✅ Shipped in 0.5.1
• ⏱️ Request timeouts + HTTP graceful shutdown (WebSocket graceful shutdown already ships).
• 🔄 Hot reload — ultimo dev with file-watching auto-restart. ✅ Shipped in 0.5.1

Developer experience

• 📖 Turnkey interactive API docs — one call (app.serve_docs("/docs")) to serve Swagger UI / Scalar / ReDoc wired to the generated OpenAPI spec (FastAPI's signature /docs). The Swagger UI helper exists today; this makes it one line. ✅ Shipped in 0.5.1
• 🧩 Built-in middleware pack — small, expected pieces: request-id, cache-control / ETag helpers, server-timing, basic-auth, trailing-slash normalization (Hono-style breadth).

Integrations

One principle throughout: a generic capability in core, plus thin presets / adapters and cookbook guides — never bundled vendor SDKs (which bloat dependencies and rot as each vendor's API changes).

• 🔑 Auth providers (OIDC/JWKS) — verify RS256/ES256 JWTs against a provider's JWKS endpoint (caching + key rotation, iss/aud validation), with presets/guides for Clerk, Cognito, Auth0, Supabase, WorkOS, Keycloak. Extends the jwt feature.
• 📈 Observability — OpenTelemetry traces + metrics, and a Prometheus endpoint (built on the tracing already used internally).
• 🧰 Redis — one integration backing sessions, the rate-limit store, and response/data caching.
• 🗄️ S3-compatible object storage — pairs with the existing multipart upload support (demand-driven).
• ⚙️ Background tasks — in-process Tokio job spawning (demand-driven).

Cookbook guides only (app-layer, not framework code): email (SMTP/Resend/Postmark), payments (Stripe webhooks), and vendor message queues.

Toward 1.0

• 🧱 API stabilization — public-API audit, documentation completeness, SemVer freeze.

Maybe / demand-driven (post-1.0)

• 🤖 MCP server — Model Context Protocol server for AI-assisted development.
• 🌍 Python client generation — extend the codegen engine beyond TypeScript.

Removed from the roadmap: HTTP/2 Push (deprecated in browsers), Long Polling (covered by SSE + WebSockets), the AI dev-UI cluster (Development Dashboard / Schema Introspection / Smart Suggestions), Go/Dart/Swift client generation (focus stays TypeScript-first), and a standalone Mock Server (testing utilities already ship).

Considered and declined: edge / multi-runtime deployment (Hono's Workers/WASM model) — an architectural mismatch with Ultimo's native Hyper + Tokio core; and server-side rendering / JSX templating — counter to the "Rust API + typed TypeScript frontend" model (a cookbook at most).

Feature Status

Version Timeline

v0.1.0

• Core framework features
• RPC system with TypeScript generation
• OpenAPI support
• CLI tools
• Database integration (SQLx & Diesel)

v0.2.1

• ✅ WebSocket Support (Complete) - Production-ready RFC 6455 implementation
• ✅ Configuration System - WebSocketConfig with size limits, timeouts, and buffer sizes
• ✅ Message Fragmentation - Automatic chunking and reassembly for large payloads
• ✅ Automatic Ping/Pong - Heartbeat with configurable intervals and timeout detection
• ✅ Graceful Shutdown - Server-wide notifications with broadcast_all()
• ✅ Backpressure Handling - Bounded channels, on_drain callback, capacity tracking
• ✅ Built-in Pub/Sub System - Topic-based messaging with backpressure support
• ✅ Type-safe WebSocketHandler - Typed context data and lifecycle callbacks
• ✅ Router Optimization - Radix Tree for O(L) lookups
• ✅ 279 Comprehensive Tests - Production-ready with extensive test coverage
• ✅ Two Working Examples - Simple chat + React chat

v0.3.0

• ✅ Session management — cookie-based sessions, SessionStore + in-memory store, secure middleware
• ✅ Cookie helper — parsing + Set-Cookie with security guards
• ✅ Testing utilities — in-process TestClient, assertions, middleware/DB/fixture helpers
• ✅ Router precedence fix, Ultimo::oneshot, Request::raw_body()
• ✅ MSRV 1.86, hardened dependency floors, automated releases + CI guardrails

v0.4.0 — Security & Performance

Ultimo's two headline pillars: secure-by-default and proven performance.

Security (secure-by-default · defense-in-depth · provable)

• ✅ Security headers middleware (HSTS, CSP, X-Frame-Options, …)
• ✅ CSRF protection (integrates with sessions)
• ✅ Auth: JWT + API-key middleware + authorization guards (scopes)
• ✅ Request body-size limits + real client IP (trusted-proxy aware)
• ✅ #![forbid(unsafe_code)] (100% safe Rust), SECURITY.md disclosure policy, cargo-deny + cargo-audit in CI

Performance (proven · regression-guarded)

• ✅ Framework-overhead benchmark suite (criterion) + methodology (BENCHMARKS.md) + advisory CI regression check
• ✅ /performance page with reproducible methodology + self-serve recipe

v0.4.1

• ✅ Static file serving + SPA fallback — serve_static, serve_spa, ETag caching, path-traversal protection (static-files feature)
• ✅ Response compression — automatic brotli/gzip middleware, pure Rust, builder API (compression feature)

v0.5.0 — Type-safe clients, for real

• ✅ TypeScript type derivation (client-gen feature) — RPC client types are derived from your Rust types via ts-rs; the generated client emits real type X = {...} declarations instead of hand-written strings. ts_rs::TS re-exported as ultimo::rpc::TS.
• ✅ Derived query/mutation (breaking) — infer input/output types from #[derive(TS)] structs; string-typed query_with_types/mutation_with_types remain as escape hatches.
• ✅ ultimo generate runs for real — executes the project's generate-client binary (no more artifact-hunting); assert_cmd CLI tests.

v0.5.1

• ✅ Hot reload — ultimo dev with file-watching auto-restart
• ✅ IP allow/deny middleware — CIDR-aware IpFilter (allow-list / deny-list)

v0.6.0 (Current) — Finish the codegen story + ship-readiness

• Codegen: scaffold generate-client into ultimo new templates; TypeScript docs rewrite; ultimo generate --watch ✅ Shipped
• Rust client generation — ultimo generate --target rust for typed service-to-service RPC (microservice contracts via private crate registry)
• Turnkey interactive API docs — serve_docs (Swagger UI / Scalar / ReDoc) ✅ Shipped
• Deployment guides (Docker, Fly.io/Railway, AWS, DigitalOcean, Azure, GCR, K8s) ✅ Shipped
• Advanced rate limiting (per-user, per-endpoint) ✅ Shipped

v0.7.0 — Real-time, auth, & production gaps

• Typed handler extractors + validation-from-types (type-safe input)
• Typed RPC subscriptions / SSE (derived event types)
• OAuth2 provider integration
• Auth providers (OIDC/JWKS) — RS256/ES256 + remote JWKS, presets for Clerk / Cognito / Auth0 / Supabase
• Observability — OpenTelemetry traces + metrics, Prometheus endpoint
• Streaming responses
• Request timeouts + HTTP graceful shutdown

v0.8.0 — Distribution & dev experience

• Redis integration — sessions, cache, and rate-limit store (one dependency)
• WebSocket compression (per-message deflate)
• #[derive(UltimoType)] (drop the ts-rs dependency papercut)
• Built-in middleware pack (request-id, cache-control/ETag, server-timing, basic-auth)

v0.9.0 → v1.0.0 — Stabilize

• End-to-end typed errors
• Public-API audit + SemVer freeze
• Documentation completeness
• Production battle-testing
• (Demand-driven: S3-compatible storage, background tasks, MCP server, Python client generation)

Contributing

Want to help? Check out:

• GitHub Issues
• Contributing Guide
• Discord Community

Feature Requests

Have an idea? Open an issue with the "feature request" label.

Stay Updated

• Follow on Twitter
• Join Discord
• Watch on GitHub