Skip to content

Welcome to USL - Unified Specification Language

  • Get started in 5 minutes


    Install USL and create your first policy-driven application

    Quick Start

  • Learn by doing


    Follow our comprehensive tutorial series from basics to advanced patterns

    Tutorials

  • Build with confidence


    Formally verified security and correctness guarantees

    Policy-Driven Design

  • Deploy anywhere


    Generate production-ready code for multiple platforms

    Deployment Guide

What is USL?

USL (Unified Specification Language) is a revolutionary policy-driven development framework that brings formal verification, layered architecture, and multi-target code generation into a unified workflow. Write your application specification once, and USL automatically generates secure, correct, and production-ready code.

Core Principles

graph LR
    A[Domain<br/>Modeling] --> B[Policy<br/>Enforcement]
    B --> C[Behavior<br/>Definition]
    C --> D[Service<br/>Implementation]
    D --> E[Code<br/>Generation]
    style A fill:#e3f2fd
    style B fill:#fff3e0
    style C fill:#f3e5f5
    style D fill:#e8f5e9
    style E fill:#fce4ec

Policy-First: Authorization is not an afterthoughtβ€”it's built into every layer of your application.

Formally Verified: Mathematical proofs ensure your invariants always hold, eliminating entire classes of bugs.

Layered Architecture: Clear separation between domain logic, policies, behavior, and services prevents architectural erosion.

Multi-Target: Generate TypeScript, Rust, Python, and more from a single specification.

Quick Example

Here's a complete USL application that defines a blog with secure access control:

domain Blog {
  entity Post {
    id: PostId @primary
    title: String
    content: String @secret
    author: UserId
    published: Boolean

    invariant published_has_content {
      this.published -> len(this.content) > 0
    }
  }

  entity User {
    id: UserId @primary
    role: Role
  }

  enum Role { Admin, Author, Reader }
}

policy BlogPolicy {
  actor user: User

  rule create_post {
    user.role == Role.Author || user.role == Role.Admin
  }

  rule edit_post(post: Post) {
    user.id == post.author || user.role == Role.Admin
  }

  rule read_post(post: Post) {
    post.published || user.id == post.author || user.role == Role.Admin
  }
}

behavior PostLifecycle for Post {
  initial state Draft

  state Draft {
    on publish -> Published
      requires len(this.content) > 0
      effects { this.published = true }
  }

  state Published {
    on unpublish -> Draft
      effects { this.published = false }
  }
}

service BlogService {
  action createPost(title: String, content: String) -> Post
    enforces BlogPolicy.create_post
    effects { Write(Post) }

  action editPost(postId: PostId, newContent: String) -> Post
    enforces BlogPolicy.edit_post(post)
    effects { Write(Post) }

  action readPost(postId: PostId) -> Post
    enforces BlogPolicy.read_post(post)
    effects { Read(Post) }
}

This specification:

  • βœ… Defines domain entities with type-safe fields
  • βœ… Enforces invariants (published posts must have content)
  • βœ… Implements role-based access control
  • βœ… Models state transitions with guards
  • βœ… Exposes a service API with effect tracking
  • βœ… Generates production code with all checks built-in

Key Features

πŸ” Built-in Security

  • Policy enforcement at compile-time and runtime
  • Secret tracking prevents accidental data leaks
  • Effect system tracks side effects and data flow
  • Escape hatches with capability-based security

🎯 Correctness Guarantees

  • Formal verification of invariants
  • State machine validation ensures valid transitions
  • Type safety catches errors before deployment
  • Totality checking ensures all cases are covered

πŸ—οΈ Clean Architecture

  • Layered design enforces separation of concerns
  • Domain layer for business logic and entities
  • Policy layer for authorization rules
  • Behavior layer for state machines and workflows
  • Service layer for external-facing APIs
  • Escape layer for external integrations

πŸš€ Production Ready

  • Multi-target code generation (TypeScript, Rust, Python)
  • OpenAPI specification generation
  • Docker deployment templates
  • Kubernetes manifests included
  • CI/CD integration examples

Installation

curl -fsSL https://raw.githubusercontent.com/shaifulshabuj/USL/main/scripts/install.sh | sh
irm https://raw.githubusercontent.com/shaifulshabuj/USL/main/scripts/install.ps1 | iex
git clone https://github.com/shaifulshabuj/USL.git
cd USL/compiler
cargo install --path .

Verify the installation:

usl --version

Next Steps

  • New to USL?

    Start with the Getting Started tutorial to build your first application in 30 minutes.

  • Coming from other frameworks?

    Check out the FAQ for comparisons with Django, Rails, and NestJS.

  • Want to understand the concepts?

    Read about Policy-Driven Design and why layered architecture matters.

  • Ready to deploy?

    Jump to the Deployment Guide for production best practices.

Community & Support

License

USL is open source software licensed under the MIT License.