Every app re-implements the same plumbing: signing a token, hashing a password, generating a sitemap, formatting money, debouncing an input. Lacspace packaged those, once, properly — and gave them away. The result is 63 published npm packages (plus two CLIs), each doing one job well.
Thirteen kits, grouped by the job
- Core SDK — talk to the Lacspace platform from any JS runtime (api, auth, analytics).
- SEO Kit — every file and tag crawlers and AI read: metadata, JSON-LD, sitemap, robots, RSS, llms.txt.
- Security Kit — vetted primitives on Web Crypto: crypto, password, jwt, apikey, otp, webauthn, mfa, lock, headers, redact.
- React Kit — hooks, tiny state, data fetching and UX.
- MailKit — send, compose and validate email.
- App / Web / Utils / Data / DX / Backend Kits — validation, forms, OG images, config, rate-limiting, IDs, retries, xlsx/csv, humanize, colour, signed URLs, PDFs.
What they have in common
- Zero third-party dependencies — tiny installs, no transitive bloat.
- Isomorphic — Node, edge and browser from the same import.
- Dual ESM + CJS —
importorrequire, your call. - TypeScript-first — types in the box.
- Actively versioned — regularly upgraded (the scaffolder alone is on v1.13).
Start here
Browse everything at lacspace.com/packages, read per-package docs at lacspace.com/docs (there’s a downloadable handbook PDF), or scaffold a whole app in one command with create-lacspace-app.
Frequently asked questions
What is the @lacspace package ecosystem?
A suite of 63 published npm packages (plus the create-lacspace-app and create-lacspace-seo CLIs) that cover the things every app re-implements — SDK, SEO, security, React, email, data, dev-experience and more. They are zero-dependency, isomorphic TypeScript, shipped as dual ESM + CJS, and grouped into 13 kits.
Are the packages really zero-dependency?
Yes — no third-party dependencies. Most packages have an empty dependency tree; a few compose from sibling @lacspace packages (for example @lacspace/jwt uses @lacspace/crypto), but nothing pulls in outside code. That means tiny installs and no transitive supply-chain risk.
Which runtimes do they support?
They are isomorphic: the same import runs on Node, on the edge (Vercel/Cloudflare workers) and in the browser, built on Web-standard APIs. Crypto uses the Web Crypto API — never hand-rolled.
How are the packages organised?
Into 13 kits by job: Core SDK, SEO Kit, Security Kit, React Kit, MailKit, StockKit, WebKit, App Kit, Utils Kit, Data Kit, DX Kit, Backend Kit and a Nepal toolkit. Browse them at lacspace.com/packages with per-package docs at lacspace.com/docs.
What licence are they under?
The Lacspace Free Licence (MIT-equivalent) for the free tier — free for personal and commercial use. Some packages are commercial/client/private; each package page states its tier.
