The Backend Kit: The Missing npm Primitives, Built Zero-Dependency

Open-source is most useful when it removes real, repeated pain. So instead of guessing, we asked a concrete question: what do backend developers rebuild on every project, that npm still has no clean, zero-dependency answer for? We searched the registry, looked at what the incumbents actually are, and found five genuine gaps. Then we built them.

The result is the Lacspace Backend Kit — small, sharp, dependency-free primitives for the server side. Here is the whole set.

1. Expiring signed links — @lacspace/signed-url

Magic-login links, secure download URLs, unsubscribe links, one-time actions. Tamper-proof, timing-safe, optionally expiring — and, remarkably, npm had no dependency-free package for it.

import { magicLink, readMagicLink, signUrl, verifyUrl } from "@lacspace/signed-url";

// passwordless login link (expires in 15 min)
const link = await magicLink("https://app.me/auth/callback", { email }, { secret, expiresIn: 900 });
const r = await readMagicLink(request.url, { secret });
if (r.valid) signIn(r.data.email);

// a download link that stops working in 5 minutes
const url = await signUrl("https://cdn.me/report.pdf?uid=42", { secret, expiresIn: 300 });
await verifyUrl(request.url, { secret }); // { valid, reason?, expiresAt? }

2. PDFs without a browser — @lacspace/pdf

Every other option is heavy: pdfkit drags in a pile of dependencies, puppeteer launches Chromium. This builds the raw PDF bytes directly — no dependencies — with real font metrics so text wraps and aligns correctly, and batteries-included generators for invoices and receipts.

import { invoice } from "@lacspace/pdf";

const bytes = invoice({
  brand: "Lacspace", number: "INV-1024", date: "2026-08-23",
  from: { name: "Lacspace Corporation", email: "billing@lacspace.com" },
  to:   { name: "Acme Pvt. Ltd.", lines: ["Kathmandu, Nepal"] },
  items: [{ description: "Custom software", quantity: 1, rate: 4500 }],
  currency: "$", taxRate: 13,
});
return new Response(bytes, { headers: { "content-type": "application/pdf" } });

Totals are computed for you, long item lists auto-paginate, and it runs on the edge and even in the browser.

3. Webhooks, both directions — @lacspace/webhooks

Webhooks are simple until you do them right: HMAC signatures, replay windows, timing-safe comparison, retries with backoff, and never processing an event twice. The hosted alternative (svix) is a paid SaaS; this is the library — for sending and receiving, with presets for Stripe, GitHub and Shopify.

import { verify, deliver } from "@lacspace/webhooks";

// receiving: verify an incoming webhook (timing-safe + replay-protected)
const r = await verify(rawBody, request.headers.get("webhook-signature"), { secret });
if (!r.valid) return new Response(r.reason, { status: 400 });

// sending: deliver with retries + exponential backoff
await deliver("https://client.app/webhooks", event, { secret, retries: 4 });

4. Exactly-once — @lacspace/idempotency

The "don't double-charge the card, don't send the email twice" primitive. A client retries, a webhook fires again, a user double-clicks — and your operation runs once, replaying the stored result. Every existing library is welded to a framework; this one is not.

import { idempotent } from "@lacspace/idempotency";

const key = request.headers.get("idempotency-key");
const { value, replayed } = await idempotent(key, () => chargeCard(order));
// first request runs it; every retry with the same key replays the result — no second charge

It is concurrency-safe: simultaneous requests with the same key run the operation exactly once, and shared stores get atomic create-if-absent with a conflict/wait policy.

Plus: feature flags without a vendor — @lacspace/flags

Feature flagging is dominated by hosted vendors. But you do not always want a SaaS, a network call, or a monthly bill. You own the config; this evaluates it — with deterministic bucketing, so the same user always gets the same result.

import { Flags } from "@lacspace/flags";

const flags = new Flags({
  "new-dashboard": { rollout: 25 },                              // 25% of users
  "checkout-exp": { type: "variant", variants: [{ key: "control" }, { key: "one-click" }] },
});
flags.isEnabled("new-dashboard", { key: user.id });  // stable per user, synchronous
flags.variant("checkout-exp", { key: user.id });     // "control" | "one-click"

And a shortcut: npm create lacspace-seo

One command scaffolds a complete SEO setup into a Next.js app — a single site config plus ready-made robots.txt, sitemap.xml, feed.xml, llms.txt and a dynamic Open Graph image route.

Why zero-dependency, why isomorphic

The same principle runs through all of them. No third-party runtime dependencies means a tiny install and a clean supply chain. Being isomorphic — written against standard web APIs like fetch and Web Crypto — means the exact same code runs on a server, on the edge, in the browser and in React Native. And every package is fully typed, shipped as both ESM and CommonJS.

All of it is free under the Lacspace Free Licence and lives in one open monorepo. Browse the full set on the packages page, read the source on GitHub, or install straight from npm.

Frequently asked questions

What is the Lacspace Backend Kit?

A new family of zero-dependency, isomorphic npm packages for the server-side things every backend re-implements: @lacspace/signed-url (HMAC-signed expiring URLs & tokens), @lacspace/pdf (invoices, receipts & documents without a headless browser), @lacspace/webhooks (sign, verify and deliver webhooks) and @lacspace/idempotency (exactly-once operations). It ships alongside @lacspace/flags (feature flags without a SaaS) and the create-lacspace-seo scaffolder.

Why build these when libraries already exist?

We researched npm first. For signed expiring URLs there was no incumbent at all. For PDFs, the options are heavy (pdfkit) or spin up Chromium (puppeteer). Webhooks are dominated by svix, a paid SaaS. Feature flags are all hosted vendors. Idempotency libraries are locked to a single framework (Hono, AWS Lambda). Each Lacspace package fills a real gap with a small, dependency-free, isomorphic alternative.

Are they really zero-dependency?

Yes. They pull in no third-party runtime dependencies. The ones that need cryptography build on @lacspace/crypto, a thin correct layer over the Web Crypto API — we never hand-roll cryptography. That keeps installs tiny and your supply chain clean.

Where do they run?

Everywhere JavaScript runs — Node 18+, edge runtimes and workers, the browser, and React Native — because they are written against standard web APIs. @lacspace/pdf even generates PDF bytes in the browser with no server.

What licence are they under?

The Lacspace Free Licence — a free, permissive licence with MIT-equivalent freedoms. Use them in personal and commercial projects at no cost; just keep the notice. Read it at lacspace.com/licenses.