
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
@iadev93/zuno
Advanced tools
The core state engine for Zuno.
Zuno is a universal, event-driven state system designed to keep client, server, and multiple runtimes in sync with strong consistency guarantees.
This package provides the foundation:
ZunoReadable contract for UI bindings.npm install @iadev93/zuno
import { createZuno } from "@iadev93/zuno";
const zuno = createZuno({
// Optional: Enable batching for high-frequency updates
batchSync: true,
});
const counter = zuno.store(
"counter",
() => 0,
undefined,
// Optional: Custom equality check
(a, b) => a === b
);
await counter.set((v) => v + 1);
console.log(counter.get());
A Universe is a container for many stores. It is responsible for:
A Store is keyed state.
get() returns current snapshotset(next) updates state (supports functional updates)subscribe(cb) notifies on changesZuno sync is driven by versioned state events. Each event includes:
storeKeystateorigin (who produced it)baseVersion (what it was based on)version (monotonic)eventId (optional)This enables deterministic ordering and protects against stale overwrites.
Zuno supports multi-tab / multi-client synchronization.
import { startBroadcastChannel } from "@iadev93/zuno";
startBroadcastChannel({
channelName: "zuno-demo"
});
BroadcastChannel works only across the same origin.
import { startSSE } from "@iadev93/zuno";
startSSE({
url: "/zuno/events",
// optional: pass shared Maps for version bookkeeping
// versions,
});
SSE is ideal for:
Zuno exposes a minimal adapter contract that can be consumed by any UI/runtime:
type ZunoReadable<T> = {
getSnapshot(): T;
subscribe(onChange: () => void): () => void;
getServerSnapshot?: () => T;
};
Helper:
import { toReadable } from "@iadev93/zuno";
const readable = toReadable(store);
This contract is used by official adapters:
@iadev93/zuno-react@iadev93/zuno-angular (New!)If you want to host Zuno sync endpoints yourself (without @iadev93/zuno-express), the core package provides server-side utilities via the @iadev93/zuno/server entry point.
The snapshot handler returns the current universe/store snapshot for new clients.
import { /* snapshot handler export */ } from "@iadev93/zuno/server";
Zuno’s SSE utilities typically do two jobs:
import { createSSEConnection, setUniverseState } from "@iadev93/zuno/server";
Incoming events should be validated and applied using the core apply routine.
import { /* apply-state-event export */ } from "@iadev93/zuno/server";
npm install @iadev93/zuno-reactnpm install @iadev93/zuno-angular (New!)npm install @iadev93/zuno-expressFor Express usage:
npm install @iadev93/zuno-express
It wires SSE + snapshot routes cleanly and keeps your core imports tidy.
Core exports are intentionally minimal:
createZuno, CreateZunoOptionsstartSSE, startBroadcastChannelZunoReadable, ZunoSubscribableStore, toReadableIf you export server helpers from core, consider server-only subpath exports to prevent accidental client bundling.
If you’re using Zuno in a real project, please open an issue and tell us your use case.
MIT
FAQs
The core state engine for Zuno.
We found that @iadev93/zuno demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.