@lacspace/env

Typed, validated environment variables — declare a schema, validate process.env at boot, get a typed frozen object or a clear fail-fast error. A zero-dependency t3-env / envalid alternative.


Keywords
env, environment-variables, dotenv, env-validation, t3-env, envalid, config, type-safe, typescript, environment, config-validation, zod-env, process-env, typed-env, env-schema, env-example, dotenv-expand, variable-expansion, duration, bytes, secret-redaction, safe-parse, coercion, ai, brand-kit, cli, commonjs, developer-tools, esm, fintech, image-generation, isomorphic, keyless, logo-generator, monorepo, no-ai, nodejs, npm-packages, open-source, react, web-crypto, zero-dependency
License
ICU
Install
npm install @lacspace/env@1.1.0

Documentation

The Lacspace mark, crafting itself

Lacspace Packages

Small, sharp, open-source TypeScript packages & CLIs — zero-dependency, isomorphic, keyless.

Think · Innovate · Execute

packages types zero deps ESM + CJS licence

Catalog · Handbook · Live tools · Contribute · Brand kit

One monorepo, 130+ published packages and CLIs. Most are zero-dependency, isomorphic (the same code runs on Node, edge runtimes and browsers), ship dual ESM + CJS builds with TypeScript types included, and — wherever money is involved — use integer minor units (paisa/cents) so you never lose a penny to floating point. Nothing here needs an API key or phones home.

  • 🧩 Tiny & focused — one job per package, no framework lock-in
  • 🔒 Correct by default — real crypto over the Web Crypto API (never hand-rolled), injection-safe outputs, exhaustive tests
  • 🌍 Isomorphic — Node 18+ (20+ for the Web-Crypto packages), edge, browsers, React Native
  • 📦 Dual buildimport and require both work, types bundled
  • 🆓 Free — every package here ships under the Lacspace Free Licence (permissive; use in personal & commercial work)

🌐 The Developer Platform

🚀 30-second example

npm install @lacspace/sdk
import { createClient } from "@lacspace/sdk";

const lac = createClient({ baseUrl: "https://api.lacspace.com" });

// auth + api + analytics + e-commerce, one typed client
await lac.auth.login({ email, password });
const products = await lac.ecommerce.getProducts();
lac.analytics.track("viewed_products", { count: products.length });

More, in a few lines each

Build a checkout — cart → shipping → tax → order, all in integer paisa:

import { createCart, addItem, cartTotals } from "@lacspace/cart";
import { cheapestQuote } from "@lacspace/shipping";
import { createOrder } from "@lacspace/order";

let cart = addItem(createCart("NPR"), { sku: "NP-1", name: "Dhaka Topi", unitPrice: 120000, qty: 2 });
const totals = cartTotals(cart);                 // exact, integer minor units
const order = createOrder({ currency: "NPR", lines: cart.items, shipping: 10000 });

Ship SEO for a page — metadata + JSON-LD in one call:

import { defineSite } from "@lacspace/seo";

const site = defineSite({ name: "Acme", url: "https://acme.com" });
export const metadata = site.page({ title: "Pricing", path: "/pricing" }).metadata;

Lock down an endpoint — hashed API keys + rate limiting:

import { verifyKey } from "@lacspace/apikey";
import { rateLimit } from "@lacspace/rate-limit";

const ok = await rateLimit(req, { limit: 60, window: "1m" });
const key = await verifyKey(req.headers.get("x-api-key"), store);

📦 Packages

Every package links to its own README with a full, explained example. Version badges are live from npm.

Core & Platform SDK

Package Version What it does
@lacspace/sdk v High-level TypeScript SDK for Lacspace
@lacspace/api v Lightweight, zero-dependency, isomorphic TypeScript HTTP client for Lacspace APIs
@lacspace/auth v Authentication flows (login, register, token, refresh) for Lacspace APIs
@lacspace/analytics v Event tracking for Lacspace platforms

React Kit

Package Version What it does
@lacspace/react v React hooks and provider for the Lacspace SDK
@lacspace/hooks v Essential, SSR-safe React hooks
@lacspace/store v Minimal global state for React in ~1KB
@lacspace/query v Tiny data fetching for React with a shared cache & request de-duplication
@lacspace/theme v SSR-safe dark / light / system theme for React
@lacspace/hotkeys v Ergonomic keyboard shortcuts for React
@lacspace/virtual v Headless list virtualization for React
@lacspace/ui v A tiny, dependency-free React kit that makes a page feel alive

Web Kit

Package Version What it does
@lacspace/env v Typed, validated environment variables
@lacspace/next v Next.js App Router integration for the Lacspace SDK
@lacspace/headers v Secure HTTP headers & a typed Content-Security-Policy builder
@lacspace/rate-limit v Framework-agnostic rate limiting
@lacspace/flags v Feature flags & A/B experiments with no SaaS and no infrastructure
@lacspace/idempotency v Make any operation exactly-once with an idempotency key
@lacspace/signed-url v HMAC-signed, expiring URLs & tokens over Web Crypto
@lacspace/webhooks v The webhook toolkit for both directions (sign & verify)

SEO Kit

Package Version What it does
@lacspace/seo v Typed metadata + JSON-LD for modern web apps
@lacspace/sitemap v Generate sitemap.xml, sitemap indexes and Next.js sitemaps
@lacspace/robots v Build and parse robots.txt
@lacspace/llms-txt v Generate and parse llms.txt / llms-full.txt (the llmstxt.org standard)
@lacspace/site-verify v Search-engine site verification
@lacspace/rss v Generate RSS 2.0, Atom 1.0 and JSON Feed 1.1 from one set of items
@lacspace/slugify v Turn any text into a clean, SEO-friendly URL slug
@lacspace/og v Dynamic Open Graph images

Security Kit

Package Version What it does
@lacspace/crypto v Safe, boring cryptography over Web Crypto (AES-256-GCM, KDF, hashing)
@lacspace/password v Password hashing & verification
@lacspace/jwt v JSON Web Tokens (HS256/384/512) with strict expiry/issuer/audience checks
@lacspace/apikey v Issue & verify API keys the right way
@lacspace/otp v TOTP & HOTP two-factor auth, Google Authenticator compatible
@lacspace/webauthn v Passkeys / biometric (FaceID, fingerprint, security keys)
@lacspace/mfa v Orchestrate multi-factor auth
@lacspace/lock v Account lockout & brute-force protection
@lacspace/redact v Redact secrets & PII from strings and objects before logging

Commerce & Ledger

Package Version What it does
@lacspace/cart v Headless, framework-agnostic shopping-cart engine
@lacspace/inventory v Stock-tracking engine that prevents overselling
@lacspace/order v Headless order-lifecycle engine (state machine + price snapshots)
@lacspace/refund v Returns / RMA workflow and refund-calculation engine
@lacspace/shipping v Checkout-time shipping-rate calculator
@lacspace/invoice v Invoice model, numbering and tax-rollup engine
@lacspace/commission v Commission & payout calculation engine
@lacspace/settlement v Settlement, netting & reconciliation for multi-party payouts
@lacspace/coupon v Discount & coupon engine
@lacspace/tax v VAT & sales-tax done right (inclusive/exclusive, integer minor units)
@lacspace/ledger v A tiny double-entry ledger & wallet
@lacspace/audit-log v Structured audit trail + tamper-evident SHA-256 hash chain
@lacspace/courier v Courier / last-mile delivery toolkit (Pathao adapter + webhooks)

Nepal Payments

Package Version What it does
@lacspace/esewa v eSewa ePay v2 (Nepal) payment gateway toolkit over Web Crypto
@lacspace/khalti v Khalti KPG-2 (ePayment API v2, Nepal) client
@lacspace/connectips v Connect IPS (Nepal) merchant integration over Web Crypto
@lacspace/fonepay v Fonepay (Nepal) merchant redirect / Request-To-Pay over Web Crypto

Mail Kit

Package Version What it does
@lacspace/mailer v A tiny zero-dependency SMTP client for Node backends
@lacspace/email-templates v Compose bulletproof, responsive, dark-mode-aware HTML emails
@lacspace/email-validate v Smart email validation
@lacspace/email-verify v Best-effort email deliverability checks for Node

Stock Kit

Package Version What it does
@lacspace/indicators v Streaming technical indicators (RSI, MACD, EMA, Bollinger, ATR, ADX, VWAP…)
@lacspace/market v Stock-market money math
@lacspace/market-clock v Holiday-aware, timezone-correct trading clock
@lacspace/paper-trade v Headless paper-trading engine

Data Kit

Package Version What it does
@lacspace/csv v Correct, RFC 4180 CSV parsing & stringifying
@lacspace/xlsx v Read & write real Excel (.xlsx) with zero deps, no headless browser
@lacspace/money v Money done right (integer minor units, allocation, Intl formatting)
@lacspace/markdown v A small, safe Markdown → HTML renderer
@lacspace/cache v A tiny in-memory cache (LRU + TTL + stale-while-revalidate)

Forms & PDF

Package Version What it does
@lacspace/validate v A tiny, typed schema validator
@lacspace/form v End-to-end form handling for the server
@lacspace/pdf v Generate real PDFs with zero dependencies

DX & Utilities

Package Version What it does
@lacspace/humanize v Turn machine values into human-readable text (bytes, durations, relative time…)
@lacspace/color v Parse, convert, manipulate and check colours
@lacspace/id v Unique IDs done right (UUID, nanoid-style, sortable)
@lacspace/retry v Resilience for flaky calls (backoff, timeout, circuit breaker)
@lacspace/case v Convert strings between cases
@lacspace/analytics-lite v Privacy-first, cookieless web analytics

Nepal toolkit

Package Version What it does
@lacspace/nepali-date v Bikram Sambat (BS) ↔ Gregorian (AD) date conversion
@lacspace/nepali-utils v Everyday Nepal helpers (NPR words, phone, PAN/VAT, provinces…)

AI Kit

Zero-dependency, provider-agnostic, keyless building blocks for LLM apps — bring your own key.

Package Version What it does
@lacspace/ai v One chat()/stream() API over OpenAI, Anthropic, Gemini & any OpenAI-compatible endpoint
@lacspace/prompt v Typed prompt templates — variable names inferred from the string, so .render() is type-checked
@lacspace/tokenizer v Token estimator, LLM cost calculator & context-budget manager (no 3 MB wasm)
@lacspace/json-repair v Extract & repair JSON from messy LLM output (fences, trailing commas, truncation)
@lacspace/chunk v RAG text splitter — recursive/markdown/code/sentence with a token-aware lengthFn
@lacspace/stream v SSE + streaming-LLM parser → async iterator, normalized across OpenAI & Anthropic
@lacspace/ai-tools v Define function-calling tools once → any provider spec + validated runtime dispatch

Testing Kit

Zero-dependency, isomorphic, runner-agnostic testing primitives — work in vitest/jest/node:test or standalone.

Package Version What it does
@lacspace/expect v Fluent assertions — deep-equal, async, asymmetric & expect.extend custom matchers
@lacspace/spy v Spies, stubs, spyOn & deterministic fake timers
@lacspace/fixtures v Typed, seeded test-data factories — sequences, traits, associations
@lacspace/snapshot v Stable serializer + inline & file (.snap) snapshot matchers

Dates & Time Kit

Date math, durations, timezones and time ranges — a tiny date toolkit that complements @lacspace/humanize (display) and @lacspace/nepali-date (BS↔AD).

Package Version What it does
@lacspace/datetime v Immutable date math, token format/parse, diff & comparisons — a tiny date-fns
@lacspace/duration v ISO-8601 duration type — parse, normalize & arithmetic, calendar-honest
@lacspace/timezone v IANA offsets & zoned↔UTC conversion via Intl, DST-aware, no bundled tz data
@lacspace/interval v Time ranges, merge/free-busy, date iteration & business-day math

🎨 Media Kit

Generate real logos and images without AI — and use the official Lacspace brand. Curated JSON "brains" + deterministic geometry, not a diffusion model. Try the Studio · Brand Center.

Package Version What it does
@lacspace/logo v No-AI logo generator — name + keywords → on-brand SVG (5 engines, brand-kit, animate)
@lacspace/image v No-AI image engine — gradients/patterns/mesh, PNG/JPEG/WebP with an exact size budget
@lacspace/brand v The official Lacspace mark, colours & animations — installable favicon/PWA icon, React
@lacspace/og v Open Graph / social card generator for next/og and the edge

CLIs & tools

24 standalone lacspace-* CLIs ship here too — scraper, leads, monitor, enrich, extract, sql, cron, qr, icon, http, fake, and more. Browse the live tools →

Package Version What it does
create-lacspace-app v Scaffold a beautiful, production-ready Next.js app — also a library
create-lacspace-seo v Scaffold a complete SEO setup into a Next.js App Router app in seconds
lacspace-leads v Free, open-source local-business lead finder (Google Maps → JSON/CSV/Excel)

✨ Conventions

Every @lacspace/* package follows the same rules, so once you've learned one you've learned them all:

  • Zero runtime dependencies (the two CLIs create-lacspace-app and lacspace-leads are the deliberate exceptions).
  • Isomorphic — Node, edge and browsers. Crypto is always the Web Crypto API, never hand-rolled. Web-Crypto packages require Node 20+; the rest support Node 18+.
  • Dual builddist/index.js (ESM) + dist/index.cjs (CJS) + dist/index.d.ts types, from tsup.
  • Money is integer minor units — paisa, cents, satoshi — never a float.
  • Immutable & serializable where it makes sense — pure functions return new objects you can JSON.stringify and persist.

🛠️ Local development

git clone https://github.com/lacspace/npm-packages.git
cd npm-packages
npm install            # links the workspace packages
npm test               # vitest across every package
npm run typecheck      # tsc over the whole monorepo

Each package lives in its own folder with a package.json, src/, tsup.config.ts and tsconfig.json extending tsconfig.base.json. Build one with npm run build -w <name>.

Note: lacspace-leads lives in this repo but is not a zero-dep workspace member (it needs Playwright), so it is excluded from the root workspaces, tests and typecheck, and builds/tests independently from its own folder.

❓ Frequently asked questions

More answers — and rich, searchable versions — at developer.lacspace.com/faq.

Getting started

What is the Lacspace developer platform? A free ecosystem for JavaScript and TypeScript developers: a library of 85+ zero-dependency @lacspace packages, a set of standalone command-line tools, and create-lacspace-app — a CLI that scaffolds a finished Next.js app. Everything is documented at developer.lacspace.com and published openly to npm.

Are the Lacspace packages and tools really free? Yes. Every open package and tool is published under the permissive Lacspace Free Licence v1.0 — free to use, ship, modify and use commercially, with no fees, seats or usage metering.

Do I need an API key, account or sign-up? No. There are no API keys, tokens, accounts or dashboards. Install a package or run a tool with npx and it works offline.

What's the difference between the packages, the tools and create-lacspace-app? The @lacspace/* packages are libraries you import into your code. The tools are standalone programs you run from your terminal. create-lacspace-app scaffolds a complete Next.js project pre-wired with the best of both.

Which runtimes are supported? The @lacspace libraries are isomorphic — Node.js, the browser, edge runtimes and serverless. The command-line tools and CLIs need Node.js 20+.

Are the packages written in TypeScript and fully typed? Yes — strict TypeScript with hand-checked type declarations, so you get autocomplete and type safety whether you write TS or JS.

Do the packages add dependencies or bloat my bundle? The @lacspace libraries are zero-dependency and tree-shakeable. The tools keep dependencies minimal too — most are zero-dependency; a few build on the shared scraper engine, and only lacspace-leads drives a real browser.

ESM or CommonJS? Both — every library ships a dual ESM + CommonJS build with correct exports maps.

The @lacspace packages

How many packages are there and what do they cover? 93+ packages, grouped into kits: Core, Security, SEO, React, App & Utils, Backend, Data, Commerce & Ledger, Stock, Mail, Web, the AI Kit, the Testing Kit, the Dates & Time Kit and regional payments — covering auth, JWTs, crypto, validation, forms, SEO, sitemaps, OG images, money, dates, CSV/Excel, caching, rate-limiting, LLM chat & streaming, prompt engineering, token counting, RAG chunking and more.

How do I install a package? npm i @lacspace/seo (or pnpm add / yarn add). Each package page on the site shows the exact command, API and examples.

Which package should I use for a given job? The handbook and per-package reference at developer.lacspace.com/docs include a "which package for what" guide.

Are the packages production-ready? Yes — semver-versioned, tested, and already powering Lacspace's own products and this platform (which dogfoods the SEO, OG, sitemap, robots and RSS packages).

Do they work with Next.js, React and other frameworks? Yes — framework-agnostic and isomorphic, so they work with Next.js, Remix, Astro, SvelteKit, Express, plain Node and the browser. The React Kit adds React hooks/components; a dedicated Next.js helper exists too.

Is there documentation for each package? Yes — a reference page per package, a full handbook with runnable recipes, a downloadable PDF handbook, and a live in-browser playground, all at developer.lacspace.com/docs.

How do they compare to popular alternatives? Many are focused, zero-dependency takes on well-known libraries (a Zod-style validator, a Dinero-style money package, an SWR-style data hook, a jsonwebtoken-style JWT package). The /compare page lines them up side by side.

The developer tools

What developer tools does Lacspace offer? Twelve free, keyless tools: lacspace-leads, lacspace-scraper, lacspace-monitor, lacspace-enrich, lacspace-extract, lacspace-sql, lacspace-inspect, lacspace-cron, lacspace-dotenv, lacspace-webhook, lacspace-har and lacspace-icon.

How do I run a tool without installing it? Use npx, e.g. npx lacspace-inspect example.com. Each tool's page lists its commands; you can also npm i -g <tool>.

Are the tools a CLI or a library? Both — a command-line program and a fully-typed library sharing the same engine.

Which formats can they export? JSON, NDJSON, CSV and Excel, with a built-in converter between all four. Several also emit Markdown, HTML reports, .ics calendars or images.

Can I try a tool without installing anything? Yes — the scraper has a hosted live tester at developer.lacspace.com/tools/scraper/try that runs in your browser exactly as it would locally.

Do the tools send my data anywhere? No — they run on your machine, use only the open web and open data, and have no telemetry or accounts.

Why is lacspace-leads local-only? It drives a real browser over Google Maps, so it runs on your own machine — hosting it publicly would breach Google's Terms and can't run in a serverless function.

Is scraping and lead-finding done responsibly? The tools are robots.txt-aware where it matters and support polite delays, jitter, rate-limits, retries and a custom User-Agent. You're responsible for using them within each site's terms and applicable law.

Can I use the tools in CI/CD? Yes — lacspace-inspect has --min-grade/--budget, lacspace-har has budgets, lacspace-monitor has --fail-on-change, and lacspace-dotenv has a check gate and pre-commit hook, all exiting non-zero on failure.

create-lacspace-app

What is create-lacspace-app? A scaffolding CLI that writes a complete, production-ready Next.js 15 + Tailwind app in seconds — pre-wired with Lacspace SEO, security headers, robots.txt, a sitemap, a contact form, a ⌘K palette, dynamic OG images and a CI workflow.

How do I scaffold a new app? npx create-lacspace-app, or pass a name and template: npx create-lacspace-app my-site --template saas.

What templates are included? Personal, business, ecommerce, SaaS, blog (a real Markdown blog), docs (a real Markdown docs site) and marketplace — each a complete, deployable Next.js app.

What comes pre-wired? SEO metadata + JSON-LD (@lacspace/seo), a dynamic OG endpoint (@lacspace/og), security headers, robots.txt and sitemap, a typed contact form with honeypot, a ⌘K palette, and a GitHub Actions workflow that gates on an SEO crawl grade.

Do I need to know the Lacspace packages to use it? No — the app works out of the box; the packages are wired in where they help and you can lean on them as much or as little as you like.

Licensing & usage

What licence are the packages and tools under? The Lacspace Free Licence v1.0 — short, permissive and own-branded. Full text: developer.lacspace.com/licenses/lacspace-free-1.0.

Can I use them in commercial and closed-source projects? Yes — commercial, private, closed-source, modification and redistribution are all permitted, royalty-free. Just keep the licence notice.

How does it compare to MIT? Permissive in the same spirit as MIT and BSD — use, modify and ship freely, including commercially — but it's Lacspace's own branded licence. In practice it imposes no more restrictions than a typical permissive open-source licence.

Will Lacspace start charging later? No — the open packages and tools are free, and a published version stays under the licence it shipped with.

Support & staying updated

Where are the docs and source code? Docs at developer.lacspace.com/docs (plus a PDF handbook); source at github.com/lacspace/npm-packages.

How do I report a bug or request a feature? Open an issue at github.com/lacspace/npm-packages/issues with the package/tool name, version and a minimal reproduction.

How do I keep up with new packages and versions? Watch the GitHub repo, follow the @lacspace org on npm, and check the developer platform.

Can I contribute or suggest a new package or tool? Yes — ideas and contributions are welcome via GitHub issues and pull requests.

🤝 Contributing

New contributors are genuinely welcome — and some of the highest-impact contributions are also the easiest.

  • Grow the Media Kit's JSON "brain". The @lacspace/logo generator gets smarter the more curated data it has. Adding a palette, an icon (a 24-grid line SVG with keyword tags) or a font pairing is a small, self-contained PR — no engine changes needed. See CONTRIBUTING.md.
  • Fix a bug or sharpen the docs. Every package has tests; a failing-test-first PR is the fastest path to a merge.
  • Propose a package. Open an issue describing the one job it does. Tiny, focused, zero-dependency wins.
git clone https://github.com/lacspace/npm-packages && cd npm-packages
npm install            # workspaces link automatically
npm test               # vitest across the monorepo

Every package is zero-dependency by default, isomorphic, dual ESM + CJS, fully typed, and ships under the Lacspace Free Licence — keep new work in that spirit and it'll feel right at home. Read CONTRIBUTING.md for conventions.

🌐 Links

Licence

The packages in this repository are free, published under the Lacspace Free Licence v1.0 — permissive freedoms for personal and commercial use. See each package's LICENSE file.

Lacspace also ships Client-specific and Private (proprietary) packages under separate terms — those are not in this repository.


If these save you time, a ⭐ helps other developers find them.

zero-dependency · isomorphic · TypeScript · ESM + CJS · keyless · no-AI logo & image generation · Web Crypto · Node · edge · browser · React · payments · auth · SEO · AI · developer tools

Built by Lacspace · developer.lacspace.com