The problem this solves

Every service in an ecosystem gets called with fetch. It works, so it spreads — and then each call site grows its own timeout, its own retry, its own idea of what an error looks like. One of them logs the Authorization header while debugging and nobody notices for a year.

The dangerous version of that drift is quieter. Server credentials get read in a file that a client component imports three levels down, the bundler follows the graph, and a service token ships to the browser. Nothing fails. The build is green. The token is just there, in a JavaScript file anyone can open.

This package draws that line and then checks it with a test — a static walk of the import graph from the root entry. If a server module ever becomes reachable from it, the suite fails before anything is published.

Install

npm install @zero.sc/sdk

Zero runtime dependencies. react 19 is a peer, and only for the widgets — the server side needs nothing but Node.

Sixty seconds

Server side. Credentials come from the environment; nothing is hardcoded.

import { drive, news, notify } from '@zero.sc/sdk/server';

const session = await drive.createUploadSession({
  name: 'report.pdf',
  size: 4_096,
  mime: 'application/pdf',
});

await notify({ to: 'sub_123', template: 'upload-ready', channels: ['inapp', 'email'] });

const today = await news.digest('today', { country: 'kr' });

Client side. The widgets are ordinary React components.

'use client';
import { useState } from 'react';
import { DrivePicker } from '@zero.sc/sdk';

export function Attach() {
  const [open, setOpen] = useState(false);
  return (
    <DrivePicker
      open={open}
      onOpenChange={setOpen}
      onSelect={([file]) => console.log(file.name)}
    />
  );
}

onSelect receives a one-element tuple by default and an array when multiple is set — so single selection needs no nodes[0] and no check for an element the type says is there.

What's inside

| Namespace | Calls | Credential | |-----------|-------|------------| | drive | Upload sessions, presigned parts, completion | Service token | | pay | Subscription lookup, with a bounded cache | Service token | | talk | Notifications, with a best-effort variant | Service token | | news | Status, daily digest, story, search, trending | Optional key — anonymous works | | util | Tool and list catalogue | None |

And three widgets on the client entry: DrivePicker, CheckoutButton, AssistantPanel.

Failure is one shape

Everything throws ZeroApiError. Network drops, timeouts, malformed JSON and application errors all arrive with a code, a status and details — so a caller writes one catch rather than four.

import { isZeroApiError, retryAfterSeconds } from '@zero.sc/sdk';

try {
  await news.search({ q: 'zero' });
} catch (error) {
  if (isZeroApiError(error) && error.code === 'rate_limited') {
    const wait = retryAfterSeconds(error); // what the service asked for, in seconds
    if (wait !== undefined) await sleep(wait * 1000);
  }
}

Retry-After is read in both forms the HTTP spec allows — a delay in seconds and an absolute date. Implementations that only parse the number turn a date into NaN, and a NaN backoff is an immediate retry, which is precisely what the limit existed to prevent.

When a service returns 429, 503 or 408 without a machine-readable body, the status is promoted to rate_limited, unavailable or timeout so a switch still works. Statuses whose meaning belongs to the application are left as unknown_error — guessing a name there would collide with the real code the service adds later.

The contract it keeps

• Secrets never reach a log. If a service echoes the token it received back inside an error message, it is removed before that error leaves the SDK.
• Credentials never reach a URL. Keys go in headers, because query strings survive in access logs and referrer headers.
• No retries, on purpose. Idempotency is the caller's knowledge, not ours. Retrying a charge because it timed out is not a helpful default.
• Every call has a deadline. A request without a timeout does not fail; it hangs, which is worse.
• Field names are the service's. Responses are not renamed to look tidier. A rename that drifts produces a silently empty value; an unchanged name produces a type error.

Honest limits

• Five services, not the whole ecosystem. More exist than are wrapped here.
• news and util are read-only. No key issuance, no writes.
• No caching beyond one bounded subscription cache. Response lifetime is a policy decision, and it belongs to the app.
• Widgets are unstyled beyond the shell tokens. They inherit; they do not theme.
• This is 0.0.x. The error shape and the entry boundary are the stable parts. Individual service signatures follow their services.

Around it

| | | |---|---| | Docs | kit.zero.sc | | Sign-in | @zero.sc/auth-client | | Events between services | @zero.sc/events | | Components | @zero.sc/ui | | Everything | @zero.sc |

License

MIT OR Zero License v1.0 — take whichever you prefer. Choosing MIT is enough; nothing further is required of you.

The Zero name, marks and logos are not covered — build anything you like with this code, just don't present it as a Zero product.

Copyright (c) 2026 Zero. Source Code begins at Zero.