TSON – A JSON superset with immutable, hash-pinned schemas

Posted by andrewjneumann 1 day ago

Counter59Comment60OpenOriginal

Comments

Comment by kbolino 1 day ago

Using the query string to carry the sha256 hash but then saying the "hash parameter is verification metadata, not identity" doesn't make much sense. The ?query part of a URL is supposed to be sent to the server. If you want to add client-side (meta)data, you should use the #fragment part of a URL. See RFC 3986, sections 3.4 and 3.5: https://datatracker.ietf.org/doc/html/rfc3986#section-3.4

Comment by sakjur 17 hours ago

I'm not sure why string level manipulations would be necessary in a structured data format to begin with. You'll update the URL using tooling regardless, so why not utilize the language for it at the expense of a little bit of verbosity?

  !!schema: { url: "https://example.com/people.tn" sha256: "c4d5e6f7…a2b3c4d5" }

Comment by geoah 1 day ago

Was thinking the same. ?v=4#sha111 for defining the version and using fragment for hash verification seemed like a more interesting approach.

Comment by thyristan 1 day ago

Fragments are useless outside a browser and lead to problems. A lot of command line and library HTTP agents ignore the fragment part of an URL, so you often might encounter everything after # stripped. Thus forcing you to invent yet another HTTP client/agent/URL library in a ton of languages.

Comment by kbolino 1 day ago

Yes, this is just how fragments work; they're supposed to be stripped before sending the request to the server. This is exactly why, in the context of the thread, the fragment is the correct place to put the TSON hash parameter.

Comment by thyristan 1 day ago

It is fine to have the fragment stripped before sending it to the server. What I meant was that client-side parsing of TSON in many languages will be hindered by the client-side libraries stripping the fragment far too early. Because you will need that fragment part for validation, but if your parse_url-function dismisses the fragment because nobody ever needs it...

Comment by kbolino 17 hours ago

I did a cursory look through a number of major languages and libraries*, and as far as I can tell, they all retain and provide access to the fragment by default. Maybe some of them didn't in the past, or the APIs that I found superseded older ones that didn't, but at least in the present day, this doesn't seem to be an issue.

* = Including urllib.parse (Python), url_parse (PHP), java.net.URI (Java), System.Uri (.NET), net/url.URL (Go), curl_url_get (libcurl), URL (JavaScript, which calls it the "hash"), url::Url (Rust), Boost.URL (C++)

Comment by thyristan 1 day ago

Dislike.

No comments means that one cannot use it for configuration. Properties repeat the XML mistake of the attribute/content dichotomy.

And trailing commas as a syntax error prevents easy sorting/appending/editing of arrays.

And it doesn't fix a ton of JSON problems like strings containing newlines, quotes and the like, while introducing a ton of new problems, like the dependency on obscure Unicode features to elide quotes. This will lead to TSON homoglyph attacks.

Comment by Retr0id 1 day ago

What's the justification for being a superset of JSON? Being incompatible with most existing JSON tooling and interfaces is a big disadvantage, so there better be a tangible upside.

Also, I see mention of hashing, but no mention of canonicalization. Does fiddling with a schema's whitespace change its hash?

Comment by ramses0 1 day ago

"superset" is just marketing mumbo jumbo that says: "I promise to embed an x86 virtual machine inside my spec that'll still parse whatever weird JSON you're currently handling and give it back to you as an object in your programming language"

    $ echo '{ "Hello": "World" }' | tson --parse
    ERROR: ...refusing to interoperate w/ JSON b/c we want to be different
...that's a non-starter. If they're trying to replace or supplement JSON (same way `uv` has been replacing / supplementing `pip`, and `deno` is doing the same with `node`), you've got to do the work of supporting the extant real-world use cases that are floating around but with a healthy layer of $BETTER sprinkled on top.

    $ echo '{ "Hello": !number 3.14 }' | jq '.'
    jq: parse error: Invalid numeric literal at line 1, column 19
...THAT's the difference/extension.

I've been explicitly trying to support `--json5` on some of my internal work tooling. Being very explicit that I'm not parsing `--json`, but instead using a slower (but more forgiving) `--json5` which would allow comments, trailing commas, whatever JSON5 claims to support.

This `--tson` feels like it's solving two problems in disguise:

1) It wants to be `--json6` (eg: `pi: !number 3.14`)

2) It wants to use it's own `--json6` (aka: `--tson`) to write "json-ish schemas" (eg: `foo: [text; 1..10]` for presumably a list of maximum of 10 elements?)

...JSON was a blessing because it existed naturally as an unambiguous "lists, dicts, values" representation that most programming languages treat as first-class citizens. Missing "sets" and things like "date" or "boolean" are certainly under-specified, but that's the real-world impact of JSON as lowest common denominator.

SCHEMA's don't have nearly as much natural, unambiguous representations across many programming languages. The closest thing I can think of is straight up Java + Constructors (ie: a full programming language for object initialization but w/o allowing interaction or behavior).

   CalendarEvent x = new CalendarEvent( Date start, Date end, Boolean all_day, List<Invitee<...>>, ...etc... )
...where my mind has gone lately is doubling down on TypeScript's `*.d.ts` as a "naturally occurring, expressive schema language". It's hella-more-complicated to parse/validate than JSON, but there's tons of tooling around it, and it's relatively unambiguous that it can solve and express Real World(tm) engineering problems.

Comment by deepsun 1 day ago

> unambiguous

But it's pretty ambiguous when parsing. Like a long number -- is it a floating point, BigInt or i128? Every language is different

JSON was a blessing because it was literally Javascript. It was unambiguous in Javascript only.

A true unambiguous would be "everything is a string", like TCL.

Comment by Retr0id 1 day ago

That's not what superset means. Taking it at face value, all JSON is valid TSON, and some TSON happens to be valid JSON but not in the general case.

Comment by gwbas1c 1 day ago

What problem is this trying to solve?

> Data with an immutable schema.

> TSON (Typed Schema Object Notation) is a schema system with immutable, hash-pinned schemas whose definitions are themselves data. A document names its schema, the schema names its meta-schema; one hash verifies the whole chain. The finishing touch, TSON's data format is a Unicode-first superset of JSON you'll actually enjoy writing.

I'm not sure what problem this is solving?

I rarely have issues with JSON schema validation; and when I do, the failure patterns aren't something that I want to offload to a 3rd party library.

Basically, how my application fails with poorly formed JSON is part of how I define my application, which means that unexpected JSON needs to be handled on a case-by-case basis.

---

Anyway, the system smells like xsd, which when I used it, wasn't worth the effort.

Comment by hmokiguess 1 day ago

I think I'm gonna go back to XSLT

Comment by yourapostasy 1 day ago

I sometimes wonder if we as an industry should revisit XML for those use cases where painful JSON contortions are being used, now that LLM's can plausibly support writing the syntax for XML-adjacent languages like XSLT without as steep a learning and sustainment curve. My natural inclination is to design to accommodate as complex a space as the business requirements project for, because representation data structures and languages are so incredibly painful to change late in a product's maturity cycle.

So I've never rejected XML out of hand, but I've always been "show me" skeptical of calls for it and pushed for explanations on why the business requirements feel the justification to adopt XML. Sometimes I've seen it totally makes sense, but with the conceptual rigor it requires in those use cases, the skillset and expertise of the development team has to reach a higher than average bar. I'm cautiously hopeful LLM's might help with lowering that bar, but time will tell.

Comment by conartist6 1 day ago

I think the industry has an XML-shaped hole for sure, but XML itself was still designed before about 30 years of hard-won knowledge about smart design of data languages.

If you want to know how I would approach designinga language to fill XML's market niche, check out https://docs.bablr.org/guides/cstml

Comment by pyuser583 1 day ago

Always tempted, but never enough.

Comment by minraws 1 day ago

you can just add schema to json why add new syntax now, especially for json I dont think it makes sense I honestly believe the war is over there won't be a xml to json moment unless we move to a new platform other than browsers which seem rather unlikely, json honestly is fine for something that's somewhat human readable...

Comment by kelseydh 1 day ago

A change in the direction of protobufs to reduce serialization and transfer costs of data exchange seems most likely the next trend.

Comment by al_be_back 1 day ago

>> Ordering, consensus, and mutability policy are application concerns outside this series. [1]

Of course, immutable means as-is, but since you're not dealing with ordering etc (that's pretty big), I might as well use existing tech (JSON with a schema) and a policy (simple/naive: hash and compare lowercased data).

[1] From their spec: 2.2.1 Identity and Content Addressing - https://tson.io/2026/32/tson-part1-data/#

Comment by lokar 1 day ago

Seem to different from JSON to be an easy drop in, while still having the problems of json. I’d rather use something further away like cue.

Comment by pratyahava 1 day ago

cue? what is that? i remember only cue which holds audio tracks metadata.

Comment by lokar 1 day ago

https://cuelang.org/docs/reference/spec/

I’ve used it once for something small. It was ok, but the docs and some of the libraries were a bit lacking.

But it demonstrates the kind of things you could have if you don’t care about text/parser compatibility with json

Comment by azatom 1 day ago

when will be xson invented, with support of xpathson and xsdson but strictly leaving out other xml features.. for future improvement?

Comment by robto 1 day ago

Seems like it draws a lot of inspiration from EDN. Tagged literals, commas-as-whitespace (and optional), and anything-can-be-a-key are features I sorely miss when I have to go back to JSON.

Don't know how I feel about optional quotes around strings, that seems like a mistake. And having an immutable set literal would be nice as well.

Comment by waweic 1 day ago

Because I may not be the only one who was confused initially: I think EDN in this instance refers to the data serialization format (Extensible Data Notation) from the Clojure people, not to CBOR-EDN (Extended Diagnostic Notation), which also offers tagged literals and anything-can-be-a-key, IIRC.

Really unfortunate naming

Comment by eventualcomp 1 day ago

I just use Amazon Ion as my JSON superset of choice for my own sanity, and downconvert to JSON when (if) it matters, it's not even bad and it supports comments. Hell there's a freaking Lisp for it now, too (Fusion). https://ion-fusion.dev/

Given also that it's a big tech technology I am going to wager that it's not going away anytime soon.

Comment by jensneuse 1 day ago

What problem does it solve? The hero of the website doesn't answer.

Comment by Yannik_Sc 1 day ago

I wonder where this should fit in? It introduces itself as

> Data with an immutable schema.

But for what? I don't see a fit for APIs here, maybe config but there are already other languages that are perfectly suited for this job.

Also this feels more like some proposal than a serious attempt to build a new format. Java is widely used but I would at least expect such a new format to at least release with Java-/TypeScript, Go and Python libraries (personal perference: Rust too). But just a Java launch is at best a PoC.

Comment by tomnipotent 1 day ago

> I don't see a fit for APIs here

Baically protobuf, Cap’n Proto, msgpack, Avro, or every other serialization approach that versions schemas?

Comment by corbindavenport 1 day ago

The website smells vibe-coded.

Comment by aggregator-ios 1 day ago

My thoughts exactly. I don't mind AI coding, but I'm not really sure on the viability of anyone using or even hearing of TSON. This is just not something you do without an RFC and adoption.

Comment by polymer8563 19 hours ago

vibe-ideated too

Comment by aljarry 1 day ago

Schemas, etc. look a lot like JSON-LD. You would need to pin the schema only if you're worried someone might modify one. But it gives you a lot of options out of the box, while still being valid JSON.

Comment by polymer8563 19 hours ago

My friend you have discovered Nickel but with less types

Comment by myshapeprotocol 1 day ago

Hash-pinned schemas are definitely the right direction for ensuring verifiable provenance across distributed systems. Great concept!

Comment by andrewjneumann 1 day ago

Agree. It’s early stages, but I love the approach!

Comment by hdjrudni 1 day ago

> Version 2 just added a new required email field to the person record. In mutable schema systems, adding a new required field is universally forbidden. The API guidelines for Google, Microsoft and Zalando all ban the practice. Protobuf even marks the required keyword a hazard developers must avoid. These rules exist because a single definition is forced to serve every document ever written against it. TSON removes this burden because schemas are immutable. A version is simply a new document with a new hash. Two contracts coexist at full strength, and employee composing person inherits the new requirement in the same declaration.

I don't understand how this helps. That just means I have dozens of schemas for the same data set. How is that better? I'd rather have one lowest common denominator schema for the entire data set and be forced to validate.

I mean I guess because the data blob specifies its own schema I can use that schema to ensure the blob is valid but then what. What is my code that processes this data supposed to do? `if(schema1) { ... } else if(schema2) { ... }`. How is that better?

Comment by sandeepkd 1 day ago

Not sure if I am the only one feeling this way, but what problem is being solved with this?

Comment by tonyg 1 day ago

Absolute slop. Interesting that the end result, the place where Claude ended up, is similar to a (human-authored, windmill-tilting) project of mine, https://preserves.dev/ . Though with a much prettier website and far, far, far more words.

Comment by eska 1 day ago

I unfortunately agree, this reads heavily AI generated. I was not able to follow the reasoning, e.g. management of backward and forward compatibility seems broken.

Comment by flanked-evergl 1 day ago

why can't you use hash pinned schemas with existing json? Why do you need a new format for it?

Comment by IncreasePosts 1 day ago

Here's some json: []

How do you add schema info to that?

Comment by crote 1 day ago

Like this:

    {
        'schema': 'c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f2',
        'data': []
    }

Comment by phailhaus 1 day ago

And there you go, just `[]` is no longer valid, so you need a new format.

Comment by ltbarcly3 1 day ago

If you need a schema for [] you have lost the plot.

Comment by hyperhello 1 day ago

Well, you could be annotating type that the array is for.

Comment by inigyou 1 day ago

It's the schema's root type, obviously.

Comment by IncreasePosts 1 day ago

What record types are valid to add to that array?

Comment by inigyou 1 day ago

Don't ask me, ask the schema.

Comment by phailhaus 13 hours ago

Are you serious? Do you honestly think that I am talking about a schema for passing empty lists around?

If you are passing around lists of structured objects, I need you to send me what those objects are supposed to look like even if the list is empty sometimes. If you say "ok so sometimes I'll give you an object with a schema key and a list of data, other times I will just give you an empty list because I don't feel like it", everyone will hate you.

Comment by ltbarcly3 1 hour ago

I assumed you meant empty list because that made sense. What you said here does not make sense.

Comment by 13 hours ago

Comment by tanepiper 1 day ago

Getting flashback to coffeescript

Comment by esafak 1 day ago

If the author is here, the Github repo in https://litterat.io/ should be https://github.com/litterat

Comment by tantalor 1 day ago

Just use protos?

Comment by hdjrudni 1 day ago

Author doesn't like protos.

> Protobuf even marks the required keyword a hazard developers must avoid. These rules exist because a single definition is forced to serve every document ever written against it. TSON removes this burden because schemas are immutable.

I personally don't have a problem with them. They've grown on me. Thought they looked icky before I actually had to use them. Now I see their merit.

Comment by kkukshtel 1 day ago

This looks like AI slop, and also a worse version of CUE.

https://cuelang.org/

Comment by dizlexic 1 day ago

Why?

Comment by biggestlou 1 day ago

Sorry, but this tool is just never going to succeed being written in Java.

Comment by ltbarcly3 1 day ago

great another shitty JSON variant. now I'll have 9 different json-like libraries in every project that I can't get rid of.

Comment by thomasnowhere 1 day ago

[dead]