Event tracking for Lacspace platforms — a spec-style track/identify/page/group/alias client with batching, an offline retry queue, consent + Do-Not-Track gating, and pluggable middleware. Every transport, clock and timer is injectable, so it never touches the network by default.

Privacy-first, cookieless web analytics — page views and custom events sent to your own endpoint. No cookies, no localStorage IDs, no cross-site tracking, no consent banner. Respects Do-Not-Track, auto-tracks SPA navigation, uses sendBeacon. Now with a batching LiteClient, a sendBeacon-first transport, UTM parsing, DNT/consent helpers and a CSPRNG id. Zero-dependency, isomorphic.

Lightweight, zero-dependency, isomorphic TypeScript HTTP client for Lacspace APIs — retries with backoff, interceptors, timeouts/abort, page- & cursor-pagination, plus dependency-free query-string, URL/path, header-merge, form-body and typed-error helpers.

Authentication flows (login, register, token, refresh) for Lacspace APIs — now with PKCE/OIDC helpers, JWT expiry math, scope/role checks and proactive token refresh.

Next.js App Router integration for the Lacspace SDK — authenticated server client from cookies, Route Handler/Server Action wrappers, CSRF + middleware auth guard, plus edge-safe pure helpers for cookies, Cache-Control, route matching, open-redirect-safe redirects and bearer tokens.

React hooks and provider for the Lacspace SDK — useAuth, useQuery, useMutation, useAuthStatus and useLacspace, all sharing one authenticated client, over a pure DOM-free core (async state machine, retry/backoff, polling) you can unit-test anywhere.

High-level TypeScript SDK for Lacspace — api, auth, analytics and e-commerce sharing one connection and token. Now with named environment presets, a config merger, correlation/idempotency ids, health probes, typed error normalization and transport-agnostic pagination.

Issue & verify API keys the right way — prefixed high-entropy keys, store only the SHA-256 hash, constant-time verify, plus a storage-agnostic record toolkit: public fingerprints, hierarchical scopes, expiry, key rotation with a grace window, and revocation. Isomorphic over Web Crypto.

Safe, boring cryptography over Web Crypto — authenticated AES-256-GCM, PBKDF2/HKDF key derivation, SHA-256/384/512, HMAC, timing-safe compare and unbiased secure random (tokens, UUIDs, integers). Isomorphic (Node, edge, browser, RN).

Secure HTTP headers & a typed Content-Security-Policy builder — HSTS, CSP nonces & hashes, a typed Permissions-Policy, COOP/COEP/CORP cross-origin isolation, Reporting-Endpoints and report-only, plus ready-made strict and API presets. Framework-agnostic + Next.js. Zero-dependency, isomorphic.

JSON Web Tokens over Web Crypto — HS/RS/ES/EdDSA signing, JWK/JWKS with kid-based key rotation, and strict expiry/issuer/audience/subject/jti checks. Plus refresh-token rotation and CSRF tokens. Isomorphic — Node, edge, browser.

Account lockout & brute-force protection (server lock) — N-strikes with exponential or progressive/tiered backoff, per-account + per-IP composite locking, allow/deny lists, and a CAPTCHA step-up threshold before hard lockout. Pluggable store, zero-dependency, isomorphic.

Orchestrate multi-factor auth — combine password + TOTP + passkeys into 2FA/3FA step-up flows with NIST assurance levels (AAL), now with factor enrollment flows, failed-attempt lockout, trusted-device tokens and recovery codes. Isomorphic (bar @lacspace/otp).

OAuth 2.1 / OpenID Connect client for social login — Google, GitHub, Microsoft, Apple, GitLab, Discord, Slack, LinkedIn, Facebook, X, Spotify, Twitch, Notion, and any OIDC issuer via discovery (Auth0, Okta, Keycloak, Cognito). PKCE, state, nonce, ID-token verification over JWKS, refresh, revoke, normalised profiles. Every preset is cross-checked against the provider's live discovery document. Web Crypto, injectable fetch, isomorphic.

TOTP & HOTP two-factor auth, Google Authenticator compatible — generate secrets, compute/verify codes, parse and build otpauth:// QR URIs, and issue single-use recovery codes. Built on Web Crypto: Node, edge and browser. Zero-dependency, isomorphic.

Password hashing & verification — PBKDF2-HMAC-SHA256 (OWASP iterations, portable PHC string) plus a zxcvbn-style strength estimator, k-anonymity breach check, a configurable policy evaluator, and CSPRNG passphrase/password generators. Isomorphic over Web Crypto.

Framework-agnostic rate limiting — five algorithms (fixed, sliding-window log & weighted counter, token bucket, leaky bucket) over a pluggable store, with cost-weighted requests, composite and per-route limiters, and standard IETF RateLimit-* + legacy X-RateLimit-* headers. For API routes, middleware and edge. Zero-dependency, isomorphic.

Redact secrets & PII from logs — masks by sensitive key and by pattern (Luhn-checked cards, SSNs, JWTs, IBANs, IPs, AWS/GitHub/Slack/Stripe keys, private keys). Cycle-safe deep object redaction with partial masking, custom patterns and a never-throw guarantee. Zero-dependency, isomorphic.

Encrypted, signed cookie sessions for any runtime — AES-256-GCM over Web Crypto with HKDF-stretched keys, secret rotation, rolling and absolute expiry, __Host- cookie rules enforced, a 10-minute OAuth state store and double-submit CSRF tokens. Works with Web Request/Response, Node http, Next.js, Hono, Express. Zero-dependency, isomorphic.

Passkeys / biometric (FaceID, fingerprint, security keys) — browser ceremony helpers + server-side ES256/RS256/Ed25519 verification over Web Crypto, with passkey-sync backup flags, AAGUID, UV/resident-key policy and transports. Zero-dependency, isomorphic.

Generate, parse, and validate llms.txt / llms-full.txt (the llmstxt.org standard) — build both from your sitemap, routes, or a page list, with ## Optional blocks. A Markdown map of your site for LLMs. Zero-dependency, isomorphic.

Dynamic Open Graph images — a share-card design system you configure once and call per page. Produces a next/og element tree AND a zero-dependency SVG from the same options, with 7 templates (article, product, quote, event, split, minimal), named gradient & surface presets, image/avatar embedding and auto-fitting multi-line titles. Zero-dependency, isomorphic.

Build and parse robots.txt — typed per-user-agent rules, crawl-delay & clean-param, sitemap refs, a parser + longest-match isAllowed(), and one-liners to block/allow AI crawlers per-agent from a 21-bot catalog (GPTBot, ClaudeBot, CCBot, Google-Extended, PerplexityBot…). Next.js robots.ts output. Zero-dependency, isomorphic.

Generate RSS 2.0, Atom 1.0 and JSON Feed 1.1 from one item set — with podcast (iTunes) tags, enclosures, media, rich channel metadata and a one-call feeds() builder. Zero-dependency, isomorphic.

Typed metadata + JSON-LD for modern web apps — schema.org builders (Organization, Article, Product, FAQ, Breadcrumb, Event, Dataset, Book, Podcast), robots directives, richer Open Graph & Twitter cards, canonical + hreflang alternates, a Next.js App Router Metadata helper, the defineSite() SEO Autopilot engine, and an on-page SEO auditor with a CI sitemap crawler (`npx @lacspace/seo audit <url>` / `crawl <site> --min-grade A`). Zero-dependency, isomorphic.

Search-engine site verification — meta tags, DNS TXT records, upload files, Next.js verification metadata, batch emit, and tag parsing for Google Search Console, Bing, Yandex, Baidu, Pinterest, Ahrefs, Facebook & more. Zero-dependency, isomorphic.

Generate sitemap.xml, sitemap indexes and Next.js sitemaps — image/video/news extensions, hreflang alternates, auto-split at 50k URLs, plus priority/changefreq/lastmod validators and a URL-count guard. Zero-dependency, isomorphic.

Turn any text into a clean, SEO-friendly URL slug — transliterates diacritics/Cyrillic/Greek, expands symbols, truncates on word boundaries, and guarantees uniqueness with a stateful slugger(). Validate with isSlug, plus strict/locale options. Zero-dependency, isomorphic.

Essential, SSR-safe React hooks — useLocalStorage, useDebounce, useMediaQuery, useOnClickOutside plus new usePagination, useStep, useHistory (undo/redo), useList and useBreakpoint. 35+ hooks built on pure, DOM-free helpers. Zero-dependency, fully typed, isomorphic.

Ergonomic keyboard shortcuts for React — mod+k combos, g-then-d sequences, named scopes and ⌘K formatting, built on a pure, React-free matching core you can reuse anywhere. SSR-safe, respects form fields, zero-dependency, fully typed.

Tiny data fetching for React — useQuery + useMutation in ~2KB over a shared, deduped, stale-while-revalidate cache. Now with a pure, framework-agnostic core: query invalidation with structural key matching, cache inspection/subscriptions, retry/backoff and GC. Zero-dependency, SSR-safe, fully typed.

Minimal global state for React in ~1KB — create a store, select slices, no provider. A React-free vanilla core adds persist/logger middleware, memoized computed values, subscribe-with-selector and slice composition. Zero-dependency, SSR-safe, fully typed.

SSR-safe dark / light / system theming for React — a tiny ThemeProvider, useTheme hook and no-flash inline script. Now ships a pure, framework-agnostic core: theme resolution, CSS-variable & stylesheet generation from design tokens, WCAG contrast helpers and an injectable-storage theme controller. Zero-dependency, fully typed.

A tiny, dependency-free React kit that makes a page feel alive — scroll reveals, animated counters, gradient text, tilt cards, marquees, a typewriter and a ⌘K command palette — plus framework-agnostic helpers (easings, a variant class builder, tilt/gradient math, command filter & scorer). No animation library, no CSS import. Respects prefers-reduced-motion; Tailwind-friendly.

Headless list virtualization for React — render only the rows in view, with fixed or dynamically-measured sizes, overscan, sticky/pinned headers, horizontal lists and scroll-to-index. Ships a pure, React-free math core you can run anywhere. Zero-dependency, SSR-safe, fully typed.

A tiny in-memory cache — LRU/LFU eviction, per-entry TTL, stale-while-revalidate, tag invalidation and hit/miss stats, plus wrap()/getOrSet()/memoize() to cache any async function with single-flight de-duplication. Zero-dependency, isomorphic.

Convert strings between cases — camelCase, PascalCase, snake_case, kebab-case, CONSTANT_CASE, Title/Sentence/Header/Capital Case and more, with a unicode-aware word splitter, an opt-in acronym registry, and is<Case> detectors. Zero-dependency, isomorphic.

Parse, convert, manipulate and check colours — hex/rgb/hsl/hsv/oklch plus 148 CSS names, lighten/darken/mix/invert/complement, tints/shades & colour-wheel harmonies, and WCAG contrast for accessible UIs. Zero-dependency, isomorphic.

Typed, validated environment variables — declare a schema, validate at boot, get a typed frozen object or one clear aggregated error. Coercers for ports, URLs, durations, byte sizes, lists & enums, ${VAR} expansion, secret-redacted errors and non-throwing safe-parse. A zero-dependency t3-env / envalid alternative.

Feature flags & A/B experiments with no SaaS and no infrastructure — deterministic percentage rollouts, targeting segments, weighted variants, kill switches and per-user QA overrides, with an explain() that tells you why each flag resolved. Synchronous, zero-dependency, isomorphic.

End-to-end form handling — turn FormData into typed, validated, spam-guarded data on the server (Next.js Server Actions), and manage interactive form state on the client (values/errors/touched/dirty, sync+async validation, nested paths, field arrays). One framework-free, zero-dependency package.

Turn machine values into human-readable text — bytes, durations, relative time, ordinals, plurals, compact numbers, grammatical lists, number-to-words, Roman numerals and SI units. Zero-dependency, isomorphic — one typed package instead of a pile of tiny formatting libs.

Every ID kind you need — UUID v4/v7, ULID, cuid2, Snowflake, Nano-ID, base62/base58 and Stripe-style prefixed ids. Custom alphabets with unbiased sampling, time-sortable ids with decodeTime. Cryptographically random (Web Crypto), zero-dependency, isomorphic.

A small, safe Markdown → HTML renderer — headings with anchor ids, nested & task lists, fenced code, GFM tables, strikethrough and autolinks. HTML in the source is escaped by default. Plus YAML frontmatter parsing, a nested table of contents, plain-text excerpts and an HTML sanitizer. Zero-dependency, isomorphic.

Money done right — integer minor units (no floating-point cent bugs), currency-safe arithmetic, remainder-preserving allocation/split, explicit rounding modes (incl. banker's), Intl and Intl-free formatting, string parsing, and injected-rate conversion. Zero-dependency, isomorphic.

Resilience for flaky calls — retry with exponential backoff & jitter, per-call timeouts, and a circuit breaker. Zero-dependency, isomorphic.

A tiny, typed schema validator with Zod-style ergonomics — parse/safeParse, objects/arrays/tuples, unions & discriminated unions, records/maps/sets, recursive (lazy) schemas, coercion, refinements/transforms/pipes, and nested form-error formatting, all fully type-inferred. Zero-dependency, isomorphic.

Make any operation exactly-once with an idempotency key — fingerprint the request (reject key-reuse with a different body), replay the stored response on retries, lock in-flight duplicates, and sweep expired records. Framework-agnostic, pluggable store, zero-dependency, isomorphic.

Generate real PDFs — invoices, receipts & documents — with zero dependencies and no headless browser. Accurate text layout, auto page-breaks and batteries-included invoice() & receipt() generators, now with tables, JPEG/raw images, page sizes & landscape, Times/Courier fonts, page numbers, bookmarks and Info metadata. Isomorphic (Node, edge, browser).

HMAC-signed, expiring URLs & tokens over Web Crypto — secure download links, magic-login links, unsubscribe and one-time-action tokens — now with key rotation, method/IP/path binding, single-use nonces, signed claims and clock tolerance. Tamper-proof, timing-safe. Isomorphic (Node, edge, browser).

The webhook toolkit for both directions — sign & deliver outgoing webhooks with retries/backoff, verify incoming ones (timing-safe, replay-protected) with Stripe / GitHub / Shopify presets, plus typed event envelopes, exactly-once idempotency and pure endpoint routing. One internal dependency (@lacspace/crypto), isomorphic.

Meeting slot finder and calendar invites: free slots from busy intervals with working hours, IANA time zones via Intl (DST-correct, half/quarter-hour offsets like Asia/Kathmandu +05:45), buffers around busy times, minimum notice, holidays, custom work weeks (e.g. Nepal Sun-Fri); human-readable slot proposals in English or Nepali; and RFC 5545/5546 iTIP REQUEST invites (VEVENT with CRLF, 75-octet UTF-8-safe folding, escaping, DTSTAMP, UID). Zero dependencies, isomorphic.

Bounce, complaint and auto-reply classifier for email campaigns and webmail: parses RFC 3464 delivery status notifications (Reporting-MTA, Final-Recipient, Action, Status, Diagnostic-Code, Remote-MTA), RFC 5965 ARF spam complaints and RFC 3834 auto-replies (Auto-Submitted, X-Autoreply, Precedence, out-of-office subjects). Also reads plain-text vendor bounces with no DSN part (Gmail, Outlook/Microsoft 365, Zoho, Hostinger/Titan, Postfix, Exim, qmail). Maps RFC 3463 enhanced codes, SMTP reply codes and diagnostic text to hard/soft plus a category (mailbox_unknown, mailbox_full, domain_unknown, blocked_spam, blocked_policy, auth_failed, message_too_large, rate_limited, temporary, challenge) with a confidence score and a plain-English reason. Includes a small built-in MIME splitter for raw messages. Zero dependencies, isomorphic.

DKIM signing and verification for email: RFC 6376 (rsa-sha256, simple/relaxed canonicalization, l=, x=, t=, oversigned From), RFC 8463 Ed25519 (ed25519-sha256) and RFC 8301 (rsa-sha1 and keys under 1024 bits rejected). signMessage(), verifyMessage() with multiple signatures, From alignment, revoked/missing keys and injectable DNS. Key generation and ready-to-paste DNS TXT records split into 255-character strings. Pure WebCrypto, zero dependencies, isomorphic.

Block-based email template builder: a JSON document of blocks (header, text, image, button, divider, spacer, columns, social, footer, html, quote, list, table) renders to bulletproof table-based responsive email HTML for Outlook desktop, Gmail, Apple Mail and mobile. Inline styles, MSO conditional wrapper, VML buttons, ghost-table columns that stack on mobile, hidden preheader, optional dark mode, brand theming, safe rich-text sanitizer, {{mail-merge}} variables passed through untouched, plain-text alternative, WCAG contrast and Gmail-clipping warnings, a validator, a block schema for editor forms and 9 starter templates. Zero dependencies, isomorphic.

Pre-send email linter for webmail and campaign tools: tells you in plain English what will hurt deliverability or render badly before you hit send. 41 stable rules covering Gmail clipping (~102KB), risky and oversized attachments, image-only mail, missing alt text, link-text/href domain mismatch, URL shorteners, IP and javascript: links, spammy subjects and phrases (English + Nepali), ALL CAPS, hidden text, scripts, external stylesheets, Outlook-unsupported CSS, forms, embeds, inline SVG, base64 images, malformed HTML, and Gmail/Yahoo bulk-sender rules (List-Unsubscribe, RFC 8058 one-click). Returns a 0-100 score, good/fair/poor grade, issues with fixes, and stats. Nepali messages for the key rules. Heuristic; does not render. Zero dependencies, isomorphic, tolerant HTML tokenizer built in.

Compose bulletproof, responsive, dark-mode HTML emails from simple blocks, plus 13 ready-made transactional templates (OTP, verify, password-reset, magic-link, receipt, order, shipping, invitation, digest, announcement). Ships plaintext generation, preheaders and {{var}} i18n interpolation. Zero-dependency, isomorphic.

Smart, network-free email validation — RFC-5322 syntax (incl. quoted local parts & IP-literal domains), disposable/temp-mail & role-account detection, free-provider flags, Gmail normalization and 'did you mean?' typo suggestions. Zero-dependency, isomorphic.

Best-effort email deliverability for Node — syntax + disposable/role, MX lookup with priority ranking, an optional SMTP RCPT probe (no mail sent), catch-all detection, a 0-100 confidence score, and de-duped batch verification. All DNS/SMTP injectable; zero npm dependencies.

Small, correct iCalendar (RFC 5545) + iTIP (RFC 5546) parser and builder for webmail meeting invites. parseIcs() reads Google Calendar, Outlook/Exchange and Apple invites: line unfolding (byte-level, so folds that split UTF-8 characters survive), quoted parameters, text escaping, DATE vs DATE-TIME, UTC/floating/TZID times converted to UTC via Intl (IANA names, 60+ Windows zone names like "Nepal Standard Time", custom VTIMEZONE rules), DST gaps/overlaps per RFC 5545, DURATION, attendees, organizer, VALARM, RRULE/EXDATE/RDATE passthrough, RECURRENCE-ID overrides, Google Meet/Teams links. buildIcs() writes CRLF calendars folded at 75 octets (never splitting a multibyte character) with optional TZID + VTIMEZONE. buildReplyIcs() / replyEmail() produce RFC 5546 METHOD:REPLY RSVPs (Accept/Decline/Tentative); buildCancelIcs() cancels. Never throws on malformed input. Zero dependencies; Node 18+, edge runtimes and browsers.

Zero-dependency IMAP4rev1 client for Node (RFC 3501 + IDLE, MOVE, UIDPLUS, CONDSTORE, SPECIAL-USE, LIST-EXTENDED, LITERAL+, SASL-IR, QUOTA, ID). Implicit TLS and STARTTLS with verification on, LOGIN / PLAIN / XOAUTH2 / OAUTHBEARER, streaming byte-accurate parser, async-iterable FETCH, envelopes with RFC 2047 decoding, BODYSTRUCTURE trees shared with @lacspace/mime, modified UTF-7 mailbox names, special-use detection (incl. Gmail XLIST and localised names), IDLE with NOOP fallback. Works with Hostinger (Dovecot), Gmail, Outlook/Exchange, GoDaddy.

Email authentication-result parsing and phishing/impersonation heuristics for webmail warning banners. RFC 8601 Authentication-Results parser (SPF, DKIM, DMARC, ARC, Received-SPF fallback, trusted authserv-id selection so forged lower headers are ignored) plus assessRisk(): DMARC/SPF/DKIM failures, reply-to mismatch, display-name address tricks, known-contact impersonation, lookalike domains (edit distance, homoglyph skeletons, punycode, mixed scripts, subdomain/hyphen/TLD tricks), free-mail brand claims, payment-change and credential-lure wording in English and Nepali, deceptive links. Plain-English reasons, 0-100 score, none/low/high level. Zero dependencies, isomorphic.

Fast, explainable email categoriser for webmail inboxes: tags a message with one of 10 categories (team, clients, personal, finance, calendar, newsletters, notifications, recruiting, social, promotions) and a high/normal/low priority from sender, recipients, subject, preview and optional List-*/Auto-Submitted/Precedence/Content-Type headers. No body fetch, no AI call, returns the reasons that fired. Every pattern and the category labels/colours are exported and overridable. Zero dependencies, isomorphic.

Generate and verify a domain's email DNS records: MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI. generateRecords() gives the exact records to add; checkDomain() looks them up, scores the domain 0-100 and explains every failure in plain English. Recursive SPF lookup counting (10-lookup limit, void lookups, cycles), SPF evaluation for an IP, DKIM key size, DMARC report authorization, MTA-STS policy fetch and MX coverage, provider presets (Hostinger, Google Workspace, Microsoft 365, Zoho, GoDaddy, Amazon SES, SendGrid, Mailgun, Brevo). Injectable resolver, DNS-over-HTTPS for edge runtimes, zero dependencies.

Extract structured data from email bodies: schema.org JSON-LD and basic microdata (Order, Invoice, FlightReservation, LodgingReservation, FoodEstablishmentReservation, EventReservation, ParcelDelivery, Event) normalised to order numbers, totals with currency, merchants, items, flights, tracking numbers; plus heuristics for OTP codes (English and Nepali, with expiry), order/invoice numbers and totals (NPR/Rs./रु., INR ₹, $, €, £), parcel tracking numbers with carrier patterns and flight codes, ignoring quoted reply sections. Zero dependencies, isomorphic.

Mail merge for webmail and email campaigns: turn a CSV or spreadsheet of recipients plus a subject/HTML/text template into one personalised message per recipient, with a validation report before anything is sent. Own RFC 4180 CSV parser (quotes, embedded newlines, BOM, comma/semicolon/tab auto-detect for Excel), built-in column aliases (First Name, e-mail, surname...), {{var|fallback}}, filters (upper, lower, title, capitalize, trim, first), {{#if}}/{{else}}/{{#unless}} blocks with no code execution, HTML escaping, email validation, case-insensitive dedupe, suppression by address or @domain, missing-variable counts, role-address warnings and a max cap. Zero dependencies, isomorphic.

IMAP/SMTP server presets and MX-based provider detection for connecting mailboxes: Hostinger, Titan, GoDaddy, Google Workspace/Gmail, Microsoft 365/Outlook, Zoho, Yahoo and iCloud. providerFromMx() maps MX hosts to a provider, serverCandidates() returns ordered IMAP/SMTP settings to try (with imap./smtp./mail.<domain> fallbacks). Send limits are 'unknown' on purpose - apps set their own. No DNS calls, bring your own MX lookup. Zero dependencies, isomorphic.

Isomorphic email-HTML sanitizer for webmail. Allowlist-based tags and attributes, URL scheme filtering (entity/tab/case tricks decoded), remote images blocked behind placeholders with data-lac-src for a "Load images" button, tracking pixels removed and listed, cid: images mapped to your attachment URLs, optional image proxy, <style> rules scoped under your container, class/id prefixing against DOM clobbering, linear-time hand-rolled tokenizer. Plus htmlToText, textToHtml (linkify + quote blocks) and snippet. Zero dependencies, no DOM; Node 18+, edge and browser.

Gmail-style mail search parser that returns a neutral AST instead of a database query: from:, to:, cc:, subject:, has:attachment, is:unread/read/starred/replied/suspicious/verified/list/important, in:, label:, category:, filename:, before:/after: (YYYY-MM-DD or YYYY/MM/DD), newer_than:/older_than: (d/w/m/y), larger:/smaller: (K/M/G), quoted phrases, - negation and OR groups. Unknown operators fall back to free text. Includes toQueryString() for round-trips and matchesAst() for in-memory filtering. Zero dependencies, isomorphic.

A tiny zero-dependency SMTP client for Node — send email over raw net/tls with STARTTLS & AUTH, plus a fluent MIME builder (inline images, attachments, alternatives), RFC 5322 address + RFC 2047 helpers, batch send with retry, and no-network test transports. Provider presets (Hostinger, Gmail, Outlook, Zoho…) make setup one line.

Safe, generic condition evaluator for rules, filters and automations: evaluate a list of { field, op, value } conditions against any object with all/any matching, dotted paths, array fields (any element matches), case-insensitive strings, numbers and dates. 18 ops: equals, notEquals, is, isNot, contains, notContains, startsWith, endsWith, gt, gte, lt, lte, between, in, notIn, exists, notExists and a ReDoS-guarded regex (pattern length cap, nested quantifiers and backreferences rejected, input length cap). explain() gives per-condition pass/fail and validateConditions() reports errors. Zero dependencies, isomorphic.

Isomorphic RFC 5322 / RFC 2045-2049 MIME parser and builder for webmail. parseMime() turns raw mail (string or bytes) into from/to/cc/subject/date/text/html/attachments/inline cid images/priority/List-Unsubscribe one-click and the part tree; handles nested multipart (mixed, alternative, related, report, signed), message/rfc822 forwards, base64 and quoted-printable (tolerant), RFC 2047 encoded words (split multibyte, adjacent whitespace), RFC 2231 parameters, 30+ charsets and malformed input without ever throwing. parseBodyStructure() parses IMAP BODYSTRUCTURE (literals, extension data) into the same tree with IMAP partIds, plus findTextParts / listAttachments / decodePart for lazy fetching. buildMime() writes CRLF messages with encoded-word headers, QP/base64 bodies, mixed/alternative/related nesting, Message-ID generation and header-injection guards; replyHeaders() / forwardSubject() for threading. Pairs with @lacspace/imap and @lacspace/mailer. Zero dependencies; Node 18+, edge runtimes and browsers.

Multi-step follow-up email sequences as a pure state machine: no I/O, no timers, no storage. Given a sequence, a plain-JSON enrollment and `now`, nextAction() says send / wait (with the exact next time) / skip / stop / paused. Delays in days, hours, minutes and business days; send windows (days of week, HH:MM or fractional hours, holidays) in the recipient's IANA timezone, DST-correct via Intl (Asia/Kathmandu +05:45 included); stop on reply, bounce, unsubscribe, complaint, click, meeting booked or manual stop; step conditions (no_reply, opened, no_open, clicked, no_click); pause/resume; 3-strike failure stop with retry delay; reply threading; seeded deterministic jitter; due() scheduler tick with per-hour and per-day send budgets; previewTimeline() and validateSequence(). Zero dependencies, isomorphic.

Privacy-respecting open and click tracking for email campaigns: compact HMAC-SHA256 signed base64url tokens (WebCrypto) carrying campaign, message, a hashed recipient and issue time with TTL expiry; signed click redirects with the destination URL inside the token so there is no open redirect; constant-time verification; HTML injection of a 1x1 pixel and link rewriting that skips mailto/tel/anchors/unsubscribe/data-no-track/template links; plus open and click classification heuristics for Apple Mail Privacy Protection, Gmail image proxy and security-scanner bots. Zero dependencies, isomorphic.

Mailing-list unsubscribe for webmail: RFC 2369 List-* header parsing (List-Unsubscribe, List-Help, List-Subscribe, List-Post, List-Owner, List-Archive), RFC 2919 List-Id, and RFC 8058 one-click unsubscribe POST with an SSRF guard (private/loopback/link-local/CGNAT/ULA IPs, localhost, .local/.internal/.lan, userinfo), no cookies, https-only redirects. Picks the best method for an Unsubscribe button: one-click > mailto > https > none. Zero dependencies, isomorphic (global fetch).

30+ streaming technical indicators (RSI, MACD, EMA, Bollinger, ATR, Supertrend, ADX, VWAP, Ichimoku, Parabolic SAR, StochRSI, CCI, MFI, Keltner, Donchian, OBV, CMF and more) with O(1) incremental next() updates for live price feeds, plus batch helpers. Zero-dependency.

Stock-market money math — P&L, returns, CAGR, XIRR, tick/lot rounding, circuit limits, position sizing and an Indian brokerage & charges calculator (STT, GST, SEBI, stamp), plus OHLCV candle resampling & gap detection, VWAP, corporate-action adjusted-close and beta/log-returns. Zero-dependency.

Holiday-aware, timezone-correct trading clock — is NEPSE/NSE/BSE/NYSE/LSE open now, current session segment, next open/close, half-days, next N sessions. Built-in exchange presets + bring your own spec. Zero-dependency.

Deterministic, no-AI stock-market wrap writer in English and Nepali (Devanagari). From the index close/change, breadth, turnover, sector moves and top gainers/losers it writes a factual daily wrap such as "NEPSE fell 11.90 points (−0.45%) to 2,587.25. Decliners led 238 to 95. Turnover Rs 4.29 arba." / "नेप्से ११.९० अंक (−०.४५%) घटेर २,५८७.२५ मा बन्द भयो।", with seeded phrasing variants so it doesn't read the same every day, South-Asian number formatting (lakh/crore/arba), a headline, and the computed facts. Every number comes from your input; no advice language. Zero-dependency.

Pure parsers for Nepal (NEPSE) IPO data, with no fetching inside. Turns the nepalipaisa.com GetIpos JSON into clean Issue objects: ordinary/local/migrant-worker tranches mapped to general/locals/foreign_employment eligibility, mutual-fund detection by sector or name (Fund, Yojana, Scheme), one issue per symbol and opening date (ordinary tranche preferred), and open/close/extended-close times converted from Nepal Time (UTC+05:45) to UTC by hand. Also reads the latest row of the SEBON IPO pipeline page (title, date, absolute English PDF link) with a small tolerant HTML table reader, and has archive helpers (lastRelevant, isArchivable). Zero dependencies, Hermes/React Native safe (no Intl time zones, no DOM, no node: imports, no lookbehind regex).

Headless paper-trading engine — a virtual wallet with market, limit, stop, stop-limit and trailing-stop orders (plus DAY/GTC/IOC/FOK time-in-force) that fill against live price ticks, average-cost positions with realized & unrealized P&L, pluggable commission + slippage models, and equity-curve/drawdown analytics. The simulator core behind StockYatra. Zero-dependency.

Rule-based chart-pattern detection on OHLCV bars: ATR-sized swings (zigzag), harmonic XABCD patterns (Gartley, Bat, Butterfly, Crab, Cypher, AB=CD) with potential-reversal zones, an Elliott impulse count that obeys the three hard rules, classic chart patterns (double tops/bottoms, head & shoulders, triangles, wedges, channels, ranges) with necklines and measured moves, per-session TPO market profiles and volume profiles, and Kagi / Point & Figure transforms. Drawing-ready paths and zones plus plain data. Descriptive geometry, never a forecast. Zero-dependency.

Portfolio analytics from holdings {symbol, qty, wacc} and daily closes: unrealised P/L vs WACC per holding and in total, market-value weights, HHI concentration (0–10,000) and effective number of holdings, sector weights, annualised volatility (daily log returns × √periods, default 240 for NEPSE), beta and correlation against an index on shared dates, max drawdown with peak/trough dates, Sharpe and Sortino with a risk-free rate. Duplicate lots merged, missing closes forward-filled. Deterministic, zero-dependency.

Trading rules as data: a small, safe JSON rule language for "buy when …, sell when …" (price, SMA/EMA, RSI, MACD, ATR, Bollinger, Supertrend direction, N-candle high/low, average volume, % change; above / below / crosses above / crosses below; all/any groups; ATR stop and target), evaluated per candle on OHLCV arrays. Includes a validator that coerces AI-written JSON (no code execution), plain-English descriptions, a next-open backtester (stop-first, costs both sides) and a last-candle screener with sector/price/turnover filters and ranking — all on the same engine. Zero-dependency.

Correct, RFC 4180 CSV parsing & stringifying — quoted fields, escaped quotes, newlines in cells, CRLF, custom dialects (delimiter/quote/escape/comment), TSV & BOM, plus opt-in type coercion, column mapping and a chunked/streaming parser. Zero-dependency, isomorphic.

Read & write real Excel (.xlsx) with zero dependencies and no headless browser — objects or arrays to a workbook, typed cells (string/number/boolean/Date), per-column number formats, bold headers, column widths, multiple sheets, live Excel formula cells (=B2*C2 with cached values), and built-in CSV↔XLSX conversion. Isomorphic (Node, edge, browser).

Nepal's official public holidays by Bikram Sambat year, transcribed from the Ministry of Home Affairs notice in Nepal Rajpatra (BS 2083: Khanda 75, Sankhya 67, Bhag 5). BS + AD dates, English/Nepali names, kind (public holiday / observance with offices open), scope (national, regional with districts, community, women, education, disability), multi-day Dashain and Tihar ranges, lunar holidays the notice leaves undated kept as null. holidays(), holidaysOn(), isHoliday(), upcoming(), bsToAD()/adToBS(). Every date checked against the weekday printed in the notice. Pure JS, zero dependencies, React Native safe.

Bikram Sambat (BS) ↔ Gregorian (AD) date conversion — zero-dependency, isomorphic, with token formatting (Nepali digits & names), BS date arithmetic, parsing, calendar-month and fiscal-year helpers.

Nepali and English matching for names and keywords in running text: normaliseNe() folds spelling variants (chandrabindu → anusvara, half nasal + consonant → anusvara, long/short vowels, nukta/ZWJ/ZWNJ, NFC, Devanagari digits); whole-word matching that lets Nepali postpositions follow a word (झापाको → Jhapa, जिल्लाहरूमा, काठमाडौंबाटै) but no other letters (पर्वतारोही ≠ Parbat); English whole words with short all-caps acronyms kept exact-case ("Come and see" ≠ SEE); near() for two terms within N characters in the same sentence (। . ? ! newline), dotted abbreviations kept together; offsets into the original text; splitSuffix(); and districtTerms() for all 77 districts with real-world spellings. Pure JS, zero dependencies, React Native safe.

Romanised Nepali → Devanagari typing with per-word candidates, like a phonetic input method: "namaste" → नमस्ते, "mero desh" → मेरो देश, "kathmandu" → काठमाडौं, "netaharulai" → नेताहरूलाई. A frequency lexicon matched by a loose key that forgives romanisation variance (aa/a, sh/s, w/v/b, ch/chh, dropped schwas, nasals), typed case endings, English loanwords (facebook → फेसबुक), a phonetic engine with ITRANS capitals (T D N Sh → ट ड ण ष), buildLexicon() from your own Nepali text and learn() to remember picks. Pure JS, zero dependencies, React Native safe.

Everyday Nepal helpers — NPR currency formatting, Devanagari numerals, amount-in-words, validators, provinces. Zero-dependency.

Preeti ⇄ Unicode for Nepali: convert legacy Preeti-font ASCII text ("g]kfn") to Unicode Devanagari (नेपाल) and back. Handles short-i and reph reordering, half letters, ra-kaar (| and «), conjunct keys (क्ष ज्ञ त्र श्र …), Preeti numerals, and looksLikePreeti() to detect pasted legacy text. Pure JS, zero dependencies, React Native safe.

Nepali ⇄ English name transliteration and cross-script fuzzy name matching — romanize Devanagari (schwa-deleted), generate spelling variants (Poudel/Paudel), strip honorifics, and match "Ram Chandra Poudel" to "रामचन्द्र पौडेल", with a per-token safety guard so different people who share a surname never collapse. Plus looksLikeName / isCommonWord so a search box doesn't transliterate ordinary words, and Devanagari-aware script-ratio analysis that ignores proper nouns and quotes. Zero-dependency, isomorphic, deterministic.

Structured audit-trail toolkit — who did what, when, with before/after diffs, actor attribution and field-level redaction; seal events into a tamper-evident SHA-256 hash chain (with retention pruning + verifiable checkpoints); and query, filter and export the trail to NDJSON/JSON. Zero-dependency, isomorphic.

Headless, framework-agnostic shopping-cart engine — pure, immutable & serializable. Line-item options/add-ons, line & cart discounts (%/fixed), injectable tax hooks (inclusive/exclusive), a full totals breakdown, plus serialize/hydrate/merge — all in integer minor units. Isomorphic (Node, edge, browser).

Commission & payout engine — flat/percent/marginal-tier/progressive-slab rules with caps & floors, composite and per-category rates, tax-on-commission (inclusive/exclusive), explicit rounding modes, and a marketplace split (platform + seller + affiliate) whose lines conserve the gross exactly. Integer minor units, zero floats. Isomorphic.

Discount & coupon engine — percent, fixed, free-shipping, BOGO and tiered codes, with validity windows, total/per-user limits, first-order and product/category scope, a currency guard, safe coupon stacking and CSPRNG code generation. Integer minor units, no float drift. Zero-dependency, isomorphic.

Courier / last-mile delivery toolkit — a canonical delivery state machine, tracking-number validation with carrier detection (UPS/FedEx/USPS/DHL + regional, check digits), tracking-event timelines, business-day ETA/SLA, tracking-URL building, a Pathao (Nepal) adapter, and inbound webhook verification + status normalization. Zero-dependency, isomorphic.

Headless stock engine that prevents overselling — reserve/commit/restock over plain { onHand, reserved } state, plus multi-location transfers, reorder points, lot/expiry FIFO-FEFO allocation, and an append-only movements ledger with low-stock & expiring-soon reports. Immutable, bring-your-own-store, isomorphic.

Invoice model, numbering and tax-rollup engine — per-line and total calculation, tax grouped by rate, sequential invoice numbers, a status lifecycle, partial payments, credit notes and a render-ready row structure for PDF/XLSX. Integer minor units, zero-dependency, isomorphic.

A tiny double-entry ledger & wallet in integer minor units — balanced journal entries, a chart of accounts with correct normal balances, trial balance, Balance Sheet & Income Statement, period close and idempotent posting. Immutable, zero-dep, isomorphic.

Headless order-lifecycle engine — an immutable order model with a state machine, order-number generation, partial fulfillment tracking, refund tracking, on-demand totals recompute and a typed audit-trail timeline. Integer minor units, zero-dependency, isomorphic.

Returns / RMA workflow and refund engine — line-level partial refunds with proportional tax & shipping, restocking fees, a reason-code policy check (injectable clock), multi-tender split refunds, restock lists and a return state machine. Remainder-safe integer minor units, zero-dependency, isomorphic.

Settlement, netting & reconciliation for marketplace payouts — batch-settle transactions per payee, deduct commission/fees/tax, hold rolling reserves, schedule payout dates (skipping weekends & holidays) and build statements. Integer minor units, pure functions. Isomorphic.

Checkout-time shipping-rate calculator — zone rate tables, weight-break brackets, dimensional/volumetric weight, flat/price/item strategies, free & discounted thresholds, surcharges + handling breakdowns, and sorted multi-method quotes with ETA. Integer minor units, zero-dependency, isomorphic.

VAT & sales-tax done right — exact integer minor-unit arithmetic (no float cents bugs), add/extract tax (inclusive & exclusive), multiple & compound taxes with a labelled breakdown, category rate tables, reverse charge, and line-level vs invoice-level rounding. Isomorphic.

Connect IPS (Nepal) merchant integration over Web Crypto — RSA-SHA256-sign the redirect token, build or send the validate-txn request, verify signatures, and validate/inspect the canonical message fields offline. Zero-dep, isomorphic.

eSewa ePay v2 (Nepal) payment toolkit over Web Crypto — HMAC-SHA256 signing, checkout-form building, response verify/decode, amount validation, CSPRNG transaction ids, and transaction-status request/parse. Zero-dependency, isomorphic.

Fonepay (Nepal) Request-To-Pay over Web Crypto — HMAC-SHA512 sign the request DV and verify the response DV, now with request validation, a CSPRNG PRN generator, auto-submit form + dynamic-QR builders and sandbox/live presets. Zero-dep, isomorphic.

Khalti KPG-2 (ePayment API v2, Nepal) client — initiate payments and look up status over injectable fetch, plus pure helpers: request builders, paisa amount validation, callback verification, sandbox/production presets and a CSPRNG order-id generator. Zero-dependency, isomorphic.

A tiny, zero-dependency, provider-agnostic LLM chat client over fetch — one chat()/stream() API for OpenAI, Anthropic, Google Gemini and any OpenAI-compatible endpoint (Groq, Together, OpenRouter, Ollama), plus typed message builders, retry/backoff + timeout, usage/cost accounting and JSON-output parsing. Bring your own key, no SDK, isomorphic.

Define LLM function-calling / tool-use tools once and use them with any provider — generate the OpenAI, Anthropic or Google tool spec, parse tool calls out of any response, validate/coerce the model's arguments (with an opt-in strict validator), dispatch to your handler and format results back into messages. Zero-dependency, keyless.

A tiny text splitter for RAG and long-context prompts — recursive character, Markdown, code, sentence and paragraph chunking with overlap and a pluggable token-aware lengthFn. Now batch-chunks whole corpora (per-chunk docId + metadata), merges tiny fragments and ships a dependency-free approximate token counter. Zero-dependency, isomorphic.

Extract and repair JSON from messy LLM output — strip code fences and prose, pull out every embedded JSON value, repair with typed diagnostics, and fix trailing commas, single quotes, unquoted keys, Python literals and truncated objects. Zero-dependency, isomorphic, typed.

A tiny, typed prompt-engineering toolkit — build, compose and render LLM prompts and chat messages with real type safety (variable names inferred from the template). Now with a versioned prompt registry, prompt-injection guards, JSON/enum output-format instructions and pure token-budget trimming. Zero-dependency, isomorphic.

A zero-dependency, isomorphic parser for Server-Sent Events, NDJSON and streaming LLM responses — a unified async iterator of text and tool-call deltas across OpenAI and Anthropic, plus map/filter/tee transforms, ReadableStream adapters and AbortSignal cancellation. No SDK, keyless.

A fast token estimator, LLM cost calculator and context-budget manager — good-enough GPT/Claude/Gemini token counts without the 3 MB tiktoken/wasm. Now with context-window usage checks, batch estimation and cross-model cost comparison across an expanded model table. Zero-dependency, isomorphic and fully typed.

A tiny, keyless tool-calling / ReAct agent loop — inject any chat model and any tools as duck-typed interfaces and it drives the reason→act→observe loop with a full trace, maxSteps guard and error recovery.

A tiny, provider-agnostic, keyless embeddings client plus pure vector math (cosine, dot, euclidean, mean-pool, top-k) — the entry point of the RAG stack. Calls OpenAI-compatible, Ollama, Google and Cohere endpoints through an injectable fetch.

Keyless, zero-dependency toolkit for evaluating LLM outputs — deterministic scorers (contains, regex, JSON-schema, Levenshtein, cosine, keyword coverage, JSONPath) plus an optional LLM-as-judge whose model you inject, with batch runs and pass-rate reports.

Keyless, zero-dependency conversation memory for LLM chat apps — track history, keep it inside a token/message budget with a sliding window, and optionally summarize old turns via an injected summarizer.

Keyless content-safety guardrails for AI apps — detect & redact PII, flag toxic content, catch prompt-injection, and validate LLM output before you show or store it. Zero-dependency and isomorphic.

A keyless registry of connection presets for LLM & embedding endpoints — point @lacspace/ai or @lacspace/embeddings at a free or local model (Ollama, Groq, OpenRouter, Google AI Studio…) in one line.

The glue of a RAG pipeline — index documents and retrieve + assemble prompt context by composing an injected embedder, vector store and splitter, with zero hard dependencies.

Rerank retrieved RAG documents for precision — BM25, TF-IDF, Reciprocal Rank Fusion, hybrid vector+lexical blending and MMR diversity, plus an injectable cross-encoder/LLM scorer. Zero-dependency, keyless, isomorphic.

A tiny in-memory vector store for RAG and semantic search — upsert embeddings, run brute-force k-NN queries with cosine/dot/euclidean metrics, metadata filtering and JSON persistence. Zero dependencies.

Zero-AI bilingual (English / Nepali) news stories from structured data: gold & silver prices, Nepal Rastra Bank forex rates, NEPSE market close, DHM weather forecasts and fuel prices. render(kind, data, { lang }) returns headline, deck, summary, 3-5 body paragraphs, 3 bullets, tags, category and the key numbers. Every number comes from your input, missing fields drop their sentence (never "N/A"), phrasing rotates by date, Nepali uses Devanagari numerals with lakh/crore grouping. Zero-dependency.

Tell how old an article really is — so an undated 2019 story is never republished as today's news. Extract the published/modified date from HTML (JSON-LD incl. @graph, meta tags, <time>, URL patterns, bylines), including Nepali Bikram Sambat dates (Devanagari digits, every month spelling, BS→AD on a verified table), detect body-text staleness, and return a fresh | stale | unknown verdict. Fail-closed: no date + no signal = unknown, never silently fresh. AI only via an optional injected hook. Zero third-party deps, deterministic, isomorphic.

Deterministic fact-consistency checks for generated articles — extract every number, amount, percentage, date and named entity (Devanagari digits, लाख/करोड scaling, रु/NPR, %/प्रतिशत, AD + Bikram Sambat dates) and verify each appears in, or is derivable from, the sources. Catches fabricated or drifted figures without an LLM rewrite round; cross-script entity matching via @lacspace/translit. Isomorphic, deterministic.

Read the feeds you follow — the read-side complement to @lacspace/rss. Parse a fetched RSS 2.0, RSS 1.0 (RDF), Atom 1.0 or JSON Feed 1.1 body into one normalized shape, autodiscover the feeds a web page advertises, and score each source's health (staleness vs its own cadence, duplicate/poisoned items, volume spikes, missing fields, fetch error rate) so a large source list prunes itself. Robots.txt respect via @lacspace/robots. Deterministic, isomorphic, zero third-party deps, bring-your-own-fetch.

Targeted repair of failed AI-written story packs, instead of whole-pack rewrites. From your validator's failures it clears name false positives (descriptive Title Case phrases, names found in other-script sources via transliteration), swaps near-misspellings for the source spelling, ranks the sentences behind an 8-gram plagiarism overlap and picks the smallest set to rewrite, and neutralises judgement words (explosive, massive, shocking…) with context guards. Whatever it can't fix comes back with sentence ids, so you re-ask the model for 1–2 sentences, not the whole pack.

Zero-AI first pass for a newsroom's sensitive-story gate, in Nepali and English. classify({ title, text, lang }) returns categories (election, court, death, communal, named_individual, minor, health_emergency), a confidence (certain → skip the model, unsure → ask it) and the matched terms. Bilingual lexicons with suffix-aware Devanagari matching, false-friend exclusions (death overs, climate justice, मुद्दा as 'issue', 'N वर्षका लागि'), headline/lead weighting that ignores scraped sidebar noise, harm context for minors, a person check for allegations, and policy-ruling detection for courts. On 200 real newsroom stories it settled 76% without the model. Zero-dependency.

Burst / trending-topic detection over your own stream of items — score entities and terms by how far their recent frequency departs from a rolling baseline (z-score + growth), per category, English + Nepali, with stopword filtering. Rank a writer queue by what's actually rising. No platform scraping, deterministic, isomorphic.

Pre-write news triage: decide which story candidates to write before spending AI tokens. Ranks by freshness decay, independent source domains (registrable-domain dedupe), trend, novelty and trust; fills per-language publish slots with category quotas; a breaking fast lane (breaking flag, or ≥3 independent sources within an hour plus trend) that jumps full slots with an hourly cap; sensitive stories need two independent sources or an official one; routine notices (bonus/right share, court notice boards) are down-ranked and grouped into roundups; stale, duplicate and would-expire-before-next-slot items are dropped. write_now / queue / drop with reasons. Deterministic, no AI, zero-dependency.

Mix a newsroom voiceover with a music bed: sidechain-duck the music under the voice, place SFX stings, and normalize to -14 LUFS — an ffmpeg command builder plus a licensed-music library loader (local tracks with a licence sidecar) AND a free Creative-Commons music finder over the Jamendo API (bring-your-own client_id, orderable by popularity/'trending', licence + attribution per track), plus a deterministic tempo/beat detector for beat-synced cuts. Safe to bake into API uploads — unlike platform 'trending sounds', which are Content-ID-claimed. Bring your own ffmpeg; zero third-party dependencies.

Compile a list of clips and stills into a platform-ready social video: an ffmpeg timeline builder with per-platform presets and safe areas (Reels/TikTok/Shorts 9:16, FB 4:5 and 1:1, YouTube 16:9), Ken Burns on stills, xfade transitions (crossfade/slide/zoom-punch/whip), Devanagari-shaped kinetic captions, lower-thirds, logo bug and progress bar. Pure deterministic command builder plus an optional low-CPU runner (nice + thread cap + ulimit -c 0). Bring your own ffmpeg; zero third-party dependencies, isomorphic. 1.1 adds plan() — a render-time estimator with a cost breakdown and cheaper alternatives — a fast quality mode (ultrafast, 24 fps, lighter Ken Burns), 720p renditions reused across cuts, libass ASS captions (correct Devanagari shaping via @lacspace/captionsync), and one-process multi-cut: en/ne/square/reels outputs from a single decode.

Generate branded news image posts — headline, quote, stat, breaking-banner, data-table and carousel cards (IG portrait 1080×1350, square, OG 1200×630, story), bilingual en/ne with correct Devanagari shaping (Pango/HarfBuzz via sharp — conjuncts and matras render right), to PNG/WebP. Pure deterministic layout engine + sharp renderer. Includes a safety-gated AI image-prompt helper that always labels 'AI illustration' and refuses photoreal depictions of real people or events.

Choose a post format (video / single image / carousel / text) per story and platform, so a feed like Facebook gets a natural mix instead of all videos. Rule-based and deterministic — platform fit, what the story can produce, a breaking-news nudge, and a don't-repeat-the-last-few mix penalty — with an optional cheap AI tie-break (injected llm) only when two formats are nearly tied. Zero deps, isomorphic.

Search and download free-licence stock video clips and photos from the official Pexels and Pixabay APIs, normalized to one asset shape with licence + a one-line attribution each. Pooled bring-your-own keys, orientation/resolution/duration/safe-search filters, a heuristic news-safe flag, per-query cache. Never scrapes news/social/image-search. Zero third-party deps, bring-your-own-fetch.

Platform-safe burn-in captions from word or sentence timings — Devanagari-safe line breaking (never inside a word, so conjuncts and matras stay intact), max 2 lines, per-platform safe areas (Reels/TikTok/Shorts/Facebook/YouTube), auto font-size fit, punctuation-aware breaks, orphan avoidance, cue duration bounds and gap merging, karaoke word highlight — emitted as ASS (libass shapes Devanagari with HarfBuzz, unlike drawtext), SRT, VTT, the ffmpeg subtitles filter string, and an @lacspace/montage drawtext fallback. Pairs with @lacspace/speakable word timings. Zero deps, deterministic.

Comment moderation for English, romanized Nepali and Devanagari — scores spam, abuse, hate, doxxing and link-spam and returns an allow / review / flag / hide action, with PII detection (Nepali phone, email, URLs/shorteners) and FAQ auto-reply suggestions. Deterministic rules + small, extendable lexicons; a borderline flag marks gray-zone comments for an optional AI second opinion. Exposes a describe() command schema. Zero dependencies.

Drive every describe()-capable @lacspace package through one interface — merge descriptors into a single command catalogue, render it token-light for an LLM prompt, validate an AI-written plan against the command schemas (unknown commands, required inputs, types/enums, forward references, duplicate ids), and execute it step by step with $steps.<id>.output references, parallel groups, per-step timeouts, a whole-plan budget, optional steps, when-conditions and a dry run. The AI decides; the packages do the work. Zero deps.

Automatic data posts from official Nepal sources — Nepal Rastra Bank forex (with day-over-day deltas), FENEGOSIDA gold/silver, Nepal Oil Corporation fuel, DHM city weather forecasts + special-bulletin alerts, Department of Environment air quality (AQI from PM2.5), and injected NEPSE — each turned into a bilingual (English/Nepali, Bikram Sambat + AD dated) @lacspace/newscard table or alert card with caption, alt text, hashtags, an optional sparkline, a worth-posting gate, and a 10–15 s montage video plan. Deterministic, bring-your-own-fetch, no AI tokens.

Article → explainer without an LLM (en/ne): title / what happened / why it matters / key numbers (as written, with currency) / who / background / what's next / CTA slides, a ready newscard carousel, a 30–60 s video script with scenes (voiceover ≤30 words, on-screen line, duration, stock-footage queries, overlay hints), FAQ pairs, category + hashtags. TextRank + keyphrase + Nepali name finder; optional LLM polish with a facts lock.

Turn a full article into a compact brief for an AI writer — extractive TextRank summary, key-facts (numbers, money, percentages, dates, named entities), headline candidates and key phrases/hashtags, for English and Nepali (sentence splitting on the danda '।', decimal-safe). Deterministic, no LLM; reuses @lacspace/keyphrase and @lacspace/factcheck-lite. Exposes a describe() command schema so an AI 'conductor' can drive it.

Parse Nepali government and university notice boards into clean, dated, tagged items for exam and results feeds. Site adapters for PSC (Lok Sewa), NEB, SEE (OCE Sanothimi), TSC, MEC, CTEVT, Nepal Engineering Council and DoTM, plus a generic notice-list finder for any other board. Each notice has a title, Devanagari-aware language flag, AD + Bikram Sambat dates (parses २०८२/०६/१८, 2082-06-18, २०८३ असोज १८, Asoj 18 2082, Sep 15 2026), absolute URL, typed PDF/image/doc attachments and auto tags (result, exam, schedule, admit-card, vacancy, syllabus). parseNotices(), fetchNotices() with conditional GET (ETag / Last-Modified), dedupe(), newSince() for 'results out' alerts, parseBsDate()/parseDate(). Polite: one request per call. Zero runtime dependencies, isomorphic, no AI, no keys.

Deterministic platform copy from facts — hooks, titles, captions, CTAs and descriptions in many styles (question, number-led, what-it-means, contrast, breaking, how-to, quote…), English and Nepali, trimmed to each platform's character limit (YouTube/IG/TikTok/FB/X/Threads/LinkedIn/Telegram). Fills ONLY the facts you pass (never invents claims) and drops sensational phrasing; AI optional, only to fill slots. Exposes a describe() command schema for an AI 'conductor'. Zero dependencies.

Animated news motion graphics as pure ffmpeg filters — lower-thirds (slide/wipe/pop) coloured by category and urgency, breaking stingers (bar/flash/corner), scrolling ticker, brand sting clip, and auto-shorts (16:9 → 9:16 with blurred fill) — eased time expressions, safe-area aware per preset, Devanagari via your font. Plugs into montage chains and multi-cut.

A tiny Thompson-sampling multi-armed bandit to learn the best option per platform — posting time, format, thumbnail or title variant — from engagement rewards. Beta posteriors per arm, deterministic when seeded, JSON-persistable; plugs into postplan. Zero deps.

Quiz and poll items from a news article without an LLM — English or Nepali: fill-in-the-blank on figures (distractors by scaling the number exactly as written, keeping Devanagari digits, लाख/करोड scale words, decimals), fill-in-the-blank on names (distractors from the article itself), true/false (incl. a statement with a perturbed figure), opinion polls from safe templates, did-you-know cards; deterministic seeded shuffle with answer index; per-platform fit (Instagram poll 2 / quiz 4, YouTube 5, X 4, Facebook). Deterministic, no AI tokens.

Re-verify that official source pages still back the facts you published: fetch a URL (HTML, plain text or PDF), extract its visible text, normalise it (NFC, Devanagari digits to ASCII, zero-width and soft-hyphen removal, unified spaces and dashes) and check expected strings, whole numbers ("1145" never matches inside "11450") or RegExps. Pure-JS PDF text extraction (object streams, FlateDecode/LZW/ASCII85/ASCIIHex with PNG predictors, ToUnicode CMaps, Differences encodings, TJ kerning, page-tree order). Detects placeholder pages ("this is test", default server pages, coming soon, suspended accounts), classifies failures (timeout, tls with chain/expired/self_signed/hostname kind, dns, network, http_4xx, http_5xx, not_found_text, placeholder_page, too_large, unparseable), streams bodies with a byte cap, retries transient errors, hashes the normalised text for change detection, and runs batches with a concurrency limit and one-request-per-host politeness. check(), checkAll(), summarize(), pdfText(), extractText(), normalise(), isPlaceholder(). Injectable fetch, zero dependencies, isomorphic (Node 18+, browsers, edge).

Engine-agnostic spoken-form normaliser for Nepali and English text-to-speech. Rewrites what TTS engines mangle before any engine sees it: numbers (unique Nepali 0–99 words, लाख/करोड scales, डेढ/अढाई/साढे idioms, decimals), Bikram Sambat and AD dates (२०८३ असोज १६ → दुई हजार त्रियासी साल असोज सोह्र गते), times (१३:३८ → दिउँसो एक बजेर अठतिस मिनेट), currency (रु. १ लाख ५० हजार / NPR 1,20,000 / $120M), percent, phone numbers and plates digit-by-digit, units, ordinals, acronyms (NEPSE → नेप्से, NRB → एन आर बी, extendable), abbreviations (डा./वि.सं./Dr.), cross-script names via @lacspace/translit with a pronunciation override dictionary. Then sentence segmentation with pauses and slower rate on numbers, SSML for edge-tts/Azure, estimated word timings, and alignment of engine WordBoundary events back to the ORIGINAL text so captions never drift. Deterministic, no AI tokens.

Thumbnail variants for YouTube/OG/square/story from a headline + licensed photo — split, fullbleed with scrim, typographic band, number badge for data stories, quote; breaking banner + category accents; headline auto-fit to 3–4 whole-word lines with correct Devanagari shaping (sharp/Pango via newscard); credit, logo; rationale per variant for A/B via postbandit. No AI tokens.

Trending topics and hashtags for a region from official/public sources only — Google Trends daily RSS (geo), YouTube Data API mostPopular (optional key), and Wikipedia pageviews — merged across scripts and scored (multi-source terms rank up), with story-relevance gating so you never trend-jack unrelated topics, and per-platform hashtag sets with limits + a banned/shadow-ban filter. Bring-your-own-fetch, deterministic given inputs. Reuses @lacspace/keyphrase and @lacspace/translit.

Engine-agnostic text-to-speech pipeline for Nepali/English newsrooms — speakable normalisation → edge-tts (Python WordBoundary stream, CLI fallback), Piper offline, or a custom engine → audio + word timings aligned back to the ORIGINAL text (engine events or estimates scaled to the real duration read from WAV/MP3 bytes, zero deps) → captionsync-ready segments. Retry with backoff + voice fallback ladder, voice registry, content-hash cache. BYO engine binary; no keys.

Extractive multi-source condenser — turn several articles on one story into a short, deduplicated, token-budgeted digest that keeps the numbers, quotes and named entities, so an LLM only rewrites a fraction of the text. BM25 sentence ranking, near-duplicate removal, per-source attribution with char offsets, Devanagari-aware (।/॥, ०-९, रु). Deterministic, isomorphic.

Extractive keyphrases, tags, hashtags, named entities and category votes — a zero-dependency RAKE + TF-IDF engine with built-in English and Nepali stopwords, Devanagari-aware, so you can stop asking an LLM to generate tags/hashtags/entities. Deterministic, isomorphic.

AI key pooling two ways. createAiChain: route-ordered multi-provider failover (Gemini, Groq, Cerebras, OpenAI, Anthropic, DeepSeek, OpenRouter, any OpenAI-compatible) that rests key+model pairs on 429 (Gemini daily quota until Pacific midnight), quarantines rejected keys (incl. Gemini's 400 'API key not valid'), cools down after N failures, shrinks Groq max_tokens to fit TPM, regrows empty reasoning replies, JSON mode with repair, per-purpose routes and caps, a call ledger hook, and a shared store (memory or Redis). createKeypool: RPM/RPD/TPM/TPD rotation and accounting. Built on @lacspace/ai.

A content-hash cache for LLM calls — key by (model family, prompt version, normalized input) so identical requests, retries after a 429 and repeated rewrites never pay twice. Pluggable async store (in-memory LRU built in, Mongo/Redis/KV via an adapter), TTL, stale-if-error and a wrap() memoizer. Zero-dependency, isomorphic.

A cheap lexical content screener and LLM admission gate — score text against your own weighted, multi-language term lexicons (with negation, proximity windows and a named-entity gazetteer) and get a clear / review / block decision, so obviously-clean and obviously-flagged text never reaches an expensive model. Deterministic, auditable, isomorphic.

A fluent assertion library that runs anywhere — deep-equal, async resolves/rejects, toThrow, asymmetric matchers (any/objectContaining/…), expect.extend custom matchers, and 15 more built-ins (toBeOneOf/toBeWithin/toBeSorted/toIncludeSameMembers/type guards). Plugs into any runner or the browser. Zero-dependency, isomorphic.

Typed, deterministic test-data factories — define a factory once, then build realistic objects with sequences, traits, associations and transient params. Now with a seeded fake-data generator (names/emails/dates), async builds and cleanup hooks. Seed it and the same data comes out every run. Zero-dependency, isomorphic.

Snapshot testing without a framework — a stable, deterministic value serializer (sorted keys, circular-safe, pluggable) plus inline and file (.snap) matchers, now with property matchers, volatile-value redaction and obsolete-snapshot detection. Isomorphic core, with a node subpath for filesystem snapshots. Zero-dependency.

Spies, stubs, mocks and deterministic fake timers for any test runner or the browser — record calls, program returns/throws/resolves with once-queues, spyOn with call-through, and now argument matchers (any/objectContaining/…), richer call-inspection and resetAll. Zero-dependency, isomorphic.

ISO 3166-1 countries with alpha-2/alpha-3/numeric codes, names, calling codes, currencies, top-level domains, regions and flag emoji — lookup by any code, name or alias, search, and typed data. Every code and ICU's name for it are cross-checked in the tests. Zero-dependency, isomorphic.

ISO 4217 currencies — codes, numeric codes, minor units asserted against the ISO list (0 for JPY, 3 for BHD, 4 for CLF), names, symbols, fund/special classification and Intl-free formatting for en/de/fr/ch/in locales. Zero-dependency, isomorphic.

Validate, parse and format IBANs (ISO 13616 registry for 90 countries, MOD 97-10) with bank/branch/account extraction, SEPA flag and generation, plus BIC/SWIFT (ISO 9362) and ISIN (ISO 6166) checks. Every registry example is verified by its own check digits. Zero-dependency, isomorphic.

Parse, validate and format international phone numbers — E.164, national and international formats, country detection from the calling code (shared +1/+44/+7 codes resolved by leading digits), trunk prefixes, extensions, per-country length rules and mobile detection for 80+ countries. Isomorphic.

Validate and normalise postal codes for 130 countries — ZIP, postcode, PIN, CEP — with the national spacing and casing (SW1A 1AA, K1A 0B1, 01310-100), and knows which countries have no postal codes. Zero-dependency, isomorphic.

Validate tax and business identifiers with their real checksums — EU VAT (all 27 + UK/XI), Indian GSTIN and PAN, Australian ABN/ACN/TFN, NZ IRD, Canadian BN, US EIN, Brazilian CPF/CNPJ, Argentine CUIT, Chilean RUT, Mexican RFC, Nepali PAN, Singapore UEN, Korean BRN, Japanese corporate number and more — reporting checksum vs format strength. Zero-dependency, isomorphic.

An immutable date-time toolkit — arithmetic, start/end of unit, diff & breakdown, comparison, token format/parse and ISO, now with relative-time ("3 hours ago"), business-day math with injectable holidays and a month calendar-grid builder — a tiny date-fns/dayjs with no dependencies. Zero-dependency, isomorphic.

A Duration type — parse, build, normalize and do arithmetic on ISO-8601 time spans, calendar-honest about months & years (never silently assumes a 30-day month). Now with an optional humanizer, HH:MM:SS clock format/parse and clamp/sum/rebalance helpers. Zero-dependency, isomorphic.

Time ranges, date iteration and business-day math — overlaps, merge, free/busy invert, eachDay/Week/Month and business-day add/subtract, now with coverage/utilization, gaps, total covered duration, peak concurrency and interval algebra (contains/shift/expand). Zero-dependency, isomorphic.

An IANA timezone toolkit built on Intl — DST-correct offsets, wall-clock parts, zoned↔UTC conversion and DST detection, now with zoned string/abbreviation formatting, zone-vs-zone comparison and forward/backward/range transition scanning. No bundled tz database, so it stays tiny and always current. Zero-dependency, isomorphic.

A keyless, privacy-friendly proof-of-work CAPTCHA with zero dependencies — no Google, no Cloudflare, no account, no tracking. Stateless HMAC-signed challenges (ALTCHA-style) verified with one server secret. Isomorphic core + a drop-in browser widget.

GDPR-friendly cookie consent with zero dependencies — a framework-agnostic store (analytics/marketing/preferences), a drop-in vanilla banner, and a React binding (<ConsentBanner/> + useConsent). Cookie-persisted so your server can gate too, plus whenConsent() script-gating.

Beautiful in-app toast notifications with zero dependencies — a framework-agnostic store, a drop-in vanilla DOM renderer, and a React binding (<Toaster/> + useToast). Promise toasts, actions, positions and accessible live regions. React optional. Zero-dependency, isomorphic.

Turn any site into an installable, offline-capable, push-ready PWA — generate a production service worker (offline caching + web-push handlers) and a web app manifest, plus browser helpers to register it and drive the install prompt. Framework-agnostic. Zero-dependency, isomorphic.

Real-time updates over Server-Sent Events with zero dependencies — a channel/room hub that fans messages to many clients, a Web-standard stream (Next.js/Deno/Bun/edge) AND a Node/Express handler, plus a typed browser client and a React useSSE hook. No WebSocket server, no vendor.

Send browser push notifications with zero dependencies and no vendor — pure Web Crypto (VAPID + RFC 8291 aes128gcm). No Firebase/FCM. Ships an `npx @lacspace/web-push` VAPID keygen CLI. Isomorphic: Node, Deno, Bun, Cloudflare Workers and Vercel Edge.

The official Lacspace mark, colours and animations — for everyone to use. Render the self-contained SVG logo and the signature self-crafting reveal anywhere (zero-dep, isomorphic), make Lacspace installable as a favicon / PWA app-icon in one call, and reach the pixel-exact master artwork + Lottie motion bundled inside. Free to reference Lacspace under the Brand Usage Licence — don't alter the mark. Includes React bindings.

Generate images without AI — draw gradients, patterns and placeholders, resize and crop, then export to PNG, JPEG, WebP or SVG with an exact file-size budget (KB/MB). Zero-dependency and isomorphic: native Canvas in the browser, pure-JS PNG (zlib) and baseline JPEG encoders in Node, plus a fit() that binary-searches quality to hit a size ceiling.

Generate real logos and brand marks without AI. A name + a few keywords becomes an on-brand SVG logo — monogram, icon lockup, geometric mark or emblem — chosen deterministically from a curated JSON brain of palettes, fonts, icons and shapes. Seeded variations, five engines, and generateLogoSet for 12 reproducible concepts. Rasterize via @lacspace/image.

A fully type-safe event emitter / tiny pub-sub for Node and the browser. Declare an events map (name → payload type) and get compile-time-checked on/emit. A throwing listener never blocks the others (errors are isolated), adding or removing listeners mid-emit is safe, and once/waitFor/onAny round it out. Comparable to mitt or nanoevents but strongly typed. Zero-dependency, isomorphic.

A tiny structured logger for Node and the browser — leveled JSON logging, child loggers, field redaction and pluggable transports (JSON, pretty, in-memory). A log below the active level costs almost nothing: the record is never even built. Errors serialise automatically; secrets get redacted before they leave the logger. Zero-dependency, isomorphic.

A tiny, fully type-safe finite state machine — declare states, events, guarded transitions, entry/exit/transition actions and a typed context. A pure transition() function plus an interpret() actor with send/subscribe/matches. Context updates are immutable via assign(). A lightweight xstate alternative for the 90% case. Zero-dependency, isomorphic.

An in-memory async task queue with a concurrency limit — run up to N async tasks at once and await individual results or the whole drain. Priority ordering, pause/start, clear, onIdle/onEmpty draining, and per-task abort via AbortSignal. A rejected task never stalls the queue. Comparable to p-queue/p-limit but tiny and dependency-free. Isomorphic.

Typed, functional error handling — Result<T,E> (Ok/Err) and Option<T> (Some/None) so functions return errors as values instead of throwing. Constructors, guards, map/andThen/match, unwrap variants, trySync/tryAsync to wrap throwing code, and an all() combinator that short-circuits on the first error. Tree-shakeable, zero-dependency, isomorphic.

An in-process job scheduler that actually runs your callbacks — on a recurring interval, a standard 5-field cron schedule, or at a specific time. A self-rescheduling, drift-corrected timer (never setInterval), overlap protection so an async job never runs over itself, jitter, maxRuns and error isolation. Clock and timers are injectable, so it's fully testable without real time. Zero-dependency, isomorphic.

The data conversion hub — JSON ⇄ XLSX ⇄ CSV ⇄ TSV ⇄ NDJSON ⇄ YAML ⇄ TOML ⇄ Markdown ⇄ HTML ⇄ SQL in one call. Auto-detects the input, turns nested JSON into flat columns and back (lossless), infers numbers/booleans/dates conservatively, picks sheets, selects/renames/reorders columns, writes injection-safe CSV and SQL with DDL, and streams big files. Built on @lacspace/xlsx and @lacspace/csv — zero external dependencies, isomorphic.

A safe spreadsheet formula engine — parse and evaluate Excel-style formulas over rows and columns with no eval, no new Function and no dependencies. 110+ functions: SUM/AVERAGE/SUMIFS/COUNTIFS, IF/IFS/SWITCH, text, dates (EDATE, EOMONTH, DATEDIF, NETWORKDAYS), VLOOKUP-style LOOKUP/XLOOKUP/MATCH/INDEX, wildcard criteria, TEXT formats. Every function ships reference metadata for docs and autocomplete; validate as the user types with check(). The engine behind LUMIFORM in Lacspace's ERPs.

19 chart components drawn as plain SVG — line, area, bar (vertical, horizontal, stacked), pie, donut, sparkline, spark bars, gauge, heatmap (matrix and calendar), radar, funnel and candlestick, plus the frame, grid, axis, legend, tooltip and data-table primitives to compose your own. No canvas, no D3, no runtime dependencies. The scale maths (linearScale, niceTicks, bandScale, stackSeries, linePath, smoothPath, arcPath, pieSlices, nearestPoint) is exported separately, so you can place marks yourself with no React at all. Shares the --lac-* tokens, so charts match the rest of your UI.

96 React components with no runtime dependencies — buttons, fields, inputs, selects, switches, sliders, pin/colour/file inputs, combobox and multi-select, modal, drawer, popover, tooltip and a toast queue, tabs, accordion, menus, pagination, stepper, avatars, stats, timelines, trees, tags, ratings, skeletons and progress, plus layout and typography primitives. One plain stylesheet — no Tailwind, no CSS-in-JS: every colour, radius, control height and typeface is a --lac-* variable, so the whole library restyles from one block. Variants live in data-* attributes (so your CSS can target any state without !important), everything stateful works controlled or uncontrolled, and nothing touches the DOM during render, so it server-renders as-is.

Calendar and date pickers that handle the awkward cases — single date, range with presets and minimum nights, month, year, week, time, date-time, a schedule/availability grid and a hydration-safe RelativeTime. Locale, week start, disabled days, min/max and keyboard navigation are all real, not decorative. Formatting goes through Intl, so no locale data ships. The date engine (monthGrid, addDays/addMonths with end-of-month clamping, range helpers, isDateDisabled, relative bucketing) is exported on its own and tested across DST boundaries.

A data table that does the boring parts: multi-column sort, per-column filters, global search, pagination, row selection, column resize, reorder and pinning, sticky headers, footer aggregates and CSV/TSV export — with spreadsheet-formula neutralising so an exported cell can never execute in Excel. Use the finished <DataTable /> or the headless useTable() hook and render the markup yourself. Column helpers (text, number, currency, date, badge, boolean, link, actions) type the row for you, and every engine function (sortRows, filterRows, pageSlice, toCsv) is exported for use without React.