Jazz – Apps with Distributed State

Original Article ↗ Hacker News Discussion ↗

A new open source framework called Jazz aims to make it easy to build local‑first, real‑time collaborative apps by treating encrypted CRDT-based state as a shared, distributed database that syncs via a mesh of peers or a hosted backend. Commenters are intrigued by its promise as an alternative to tools like Firebase, InstantDB, and Meteor, highlighting strengths such as offline support, end‑to‑end encryption, and self‑hosting, but they also flag concerns about unfinished features, pricing for the hosted mesh, browser quirks, and the hard problems of schema evolution, validation, and independent security audits. The creator responds that Jazz is already powering real products, is TypeScript-first with more platform bindings planned, and will prioritize features and performance based on real-world usage while keeping the core protocol open and auditable.

Overview & Concept

  • Jazz is presented as a local-first, distributed state framework built on CRDT-backed “collaborative values” with end-to-end encrypted sync.
  • Acts like a distributed database: clients mutate local state, sync via a mesh of servers or self-hosted nodes, and achieve eventual consistency.
  • Aims to make offline-first, real-time collaborative apps easy, with React bindings as a thin wrapper over core TypeScript APIs.

Reliability, Demos & UX Issues

  • The public chat demo briefly broke under usage; initially blamed on a large message, later on another bug. It was quickly patched, but raised concerns about robustness.
  • The homepage’s embedded chat/iframe caused browser history to “hijack” the back button in Firefox/Safari; this was acknowledged and fixed.
  • Some users see such issues as normal for an early-stage launch; others view them as undermining confidence.

Architecture, Features & Comparisons

  • Sync is peer-to-peer at the protocol level but typically goes through a central mesh for persistence and offline device syncing.
  • Compared with Firebase/Convex: similar “no-backend” goal, but local-first, CRDT-based, and cryptography-driven permissions.
  • Compared with InstantDB/Meteor/PartyKit: positioned more as encrypted document/collaborative data sync than as a traditional queryable DB or room-based websocket layer.
  • Some key features (cursors, DB interop, migrations, richer media/presence) are marked “coming soon,” which worries some as they are central for serious apps.

Security, Privacy & Data Location

  • Data is end-to-end encrypted; the mesh sees only encrypted edits plus metadata.
  • A simple sync server and parts of the mesh are open source; self-hosting is supported.
  • European data routing is discussed (London cache, Prague main server), with plans to keep regions separable; metadata may still be sensitive.
  • Third‑party security audits are planned but not yet completed; some see “open source” as insufficient without independent review.

Pricing & Self‑Hosting

  • Hosted “Mesh Pro” charges primarily by “sync‑minutes,” which several find too expensive or misaligned with how they price apps.
  • Running your own sync node is described as straightforward (npx jazz-run sync), with thread participants debating whether DIY costs would actually be low.

Languages, Ecosystem & Use Cases

  • Core is TypeScript; React, Node, and experimental React Native support exist.
  • Svelte and Rust bindings are planned; Dart/Flutter, Vue, Python, Go, etc. are requested but not prioritized yet.
  • Real-world apps (e.g., a Notion-like product and others) already use Jazz; this reassures some that it’s not just a toy.

Modeling, Validation & Migrations

  • CoValues are intended to be small, linked units to support granular sync and pagination.
  • Permissions rely on group roles and composition of CoValues with different access rules.
  • Complex validation and schema evolution are acknowledged as hard and currently underdeveloped; guidance and guardrails are “coming soon,” which some find concerning.
  • Deletion is typically tombstoned; full erasure for GDPR-like requirements is planned but not fully implemented.