ultimo 0.9.1

Ultimo is a modern Rust web framework built on Hyper + Tokio: secure-by-default, fast, and type-safe end to end — with automatic TypeScript client generation from your Rust API. REST and JSON-RPC live in one app, and the framework is 100% safe Rust (#![forbid(unsafe_code)]).

Why Ultimo

• 🚀 Automatic TypeScript clients — define your API in Rust, get a fully typed TS client generated for you.
• 🔄 REST + JSON-RPC 2.0 in one app — plain HTTP routes and RPC procedures side by side, with batch requests and notifications.
• 🔌 WebSockets — RFC 6455 with a built-in pub/sub system (zero extra deps).
• 🌊 Streaming responses — chunked/streaming bodies via ctx.stream(...).
• 📡 Server-Sent Events — typed server→client push via ctx.sse(...) + EventSource.
• 🔐 Auth, built in — JWT and API-key middleware plus scope-based authorization guards.
• 🛡️ Secure by default — 100% safe Rust, secure sessions/cookies, CSRF, security-headers middleware, request body-size limits, and supply-chain CI.
• ⚡ Fast — native Rust on the Hyper + Tokio core, O(1) constant-time routing, benchmarks regression-guarded in CI (details).
• 🗄️ Databases — first-class SQLx and Diesel integration (PostgreSQL / MySQL / SQLite).
• 🧪 Testing utilities — in-process TestClient, response assertions, and fixtures.
• 🤖 Built for coding agents — typed Rust→TS codegen, scaffolds that build, llms.txt docs, and Context7. See Using Ultimo with AI coding agents.

Quick start

[dependencies]
ultimo = "0.9"
tokio = { version = "1", features = ["full"] }
serde = { version = "1", features = ["derive"] }

use ultimo::prelude::*;

#[derive(Serialize, Deserialize)]
struct User {
    id: u32,
    name: String,
}

#[tokio::main]
async fn main() -> ultimo::Result<()> {
    let mut app = Ultimo::new();

    app.get("/users/:id", |ctx: Context| async move {
        let id: u32 = ctx
            .req
            .param("id")?
            .parse()
            .map_err(|_| UltimoError::BadRequest("invalid id".into()))?;
        ctx.json(User { id, name: format!("User {id}") }).await
    });

    println!("→ http://127.0.0.1:3000");
    app.listen("127.0.0.1:3000").await
}

MSRV: Rust 1.86. Everything beyond the core is opt-in via Cargo features (see below).

Type-safe clients

Ultimo's headline feature: define an API once in Rust and generate a typed TypeScript client — no hand-written types, no drift.

# Generate a TypeScript client from your RPC definitions
cargo run -p ultimo-cli -- generate --project ./backend --output ./client

// Generated, fully typed — autocomplete + compile-time checks
const user = await client.getUser({ id: 1 });
console.log(user.name);

See TypeScript Clients for the full workflow.

Feature flags

Everything is opt-in (default = []):

ultimo = { version = "0.9", features = ["websocket", "jwt", "sqlx-postgres"] }

CLI

cargo install ultimo-cli   # installs the `ultimo` binary

ultimo new my-app --template fullstack                 # scaffold a new project
ultimo generate --project ./backend --output ./client  # generate the TypeScript client

ultimo dev --port 3000   # hot-reload dev server (watches src/, restarts on change)

ultimo build is not implemented yet — use cargo build --release for now. See the roadmap.

Documentation

Full guides at docs.ultimo.dev — getting started, routing, middleware, RPC + TypeScript clients, OpenAPI, sessions, authentication, WebSockets, database integration, testing, and performance.

Examples

Runnable examples live in examples/. Run one locally with:

cargo run -p jwt-auth-example

Live demos

Try them without cloning (hosted on Render free tier — first request may take ~30s):

Contributing

Issues and PRs welcome. See CONTRIBUTING.md and the roadmap. Security policy: SECURITY.md.

License

MIT © Ultimo Contributors. See LICENSE.