Chat composition

Use this when you want sealed 1:1 messaging on top of an unlocked vault. Chat does not run a second WebAuthn ceremony: the Vault path unlocks, derives an identity seed, and hands that seed to @railman/zero-e2e.

Hardened passkey → PRF-backed Vault unlock → identity seed → zero-e2e

Live: Chat lab · Chooser: Use cases · Protocol guide: E2E chat

What you install

Everything from Vault composition, plus:

Relay persistence uses the same zeroAccess plugin (E2E endpoints). No extra server plugin.

Identity from Vault

import { deriveE2eIdentitySeed } from "@railman/zero-vault";
import { identityKeyPairFromSeed, zeroize } from "@railman/zero-e2e";

const identity = await vault.withGrantUnlock(
  { slots, prfSecret, password },
  async (grant) => {
    const seed = await deriveE2eIdentitySeed(grant);
    try {
      return identityKeyPairFromSeed(seed);
    } finally {
      zeroize(seed);
    }
  }
);

Typechecked with the Quick start client sketch: docs-site/verified-examples/start-client-vault-chat.ts.

Session crypto (library sketch)

import {
  generateIdentityKeyPair,
  generateSignedPreKey,
  bundleForPublish,
  computeIdentityFingerprint,
} from "@railman/zero-e2e";

const bob = generateIdentityKeyPair();
const spk = generateSignedPreKey(bob.signing.secretKey);
const bundle = bundleForPublish(bob, spk);
const fp = computeIdentityFingerprint(bundle.signingKey, bundle.identityKey);
// publish bundle via PUT /zero-access/e2e/prekey …

Getting started: Zero-e2e. Full seal/open flow: package README and E2E chat.

HTTP relay

Session-gated; bodies M6-checked: API — E2E relay.

Enable e2eRequireRecipientContact: true on zeroAccess when contacts must gate delivery (see Quick start).

Hard rules

• zero-e2e never talks to WebAuthn or requests PRF output
• Elevate ≠ vault unlock ≠ chat identity mint — keep layers separate
• Never send raw identity seeds or private keys to the server

Next

• Topic guide: E2E chat
• Packages: Zero-e2e · Zero-vault
• Blind store HTTP: API — Zero-access
• Production checklist: Checklist