Packages overview
What each package does, when to install it, and where to start.
Packages overview
@railman/* packages for Better Auth Zero Access (railmanio/auth-zero-access). Still private: true — install from git / workspace until public npm. Use only what your use case needs.
| Package | Kind | Primary entry | Start here |
|---|---|---|---|
@railman/auth-zero-access-kit | Composition | createZeroAccessKit() · gates() | Start here — one-import wiring of the whole suite |
@railman/auth-elevate | BA plugin | elevate() · requireElevate() | Step-up / sudo |
@railman/auth-login-factor | BA plugin | loginFactors() · requireAccess() | L0 stamps + gates |
@railman/auth-zero-access-passkey | BA plugins + client | enhancePasskey(passkey, …) | Hardened WebAuthn + PRF |
@railman/auth-zero-access | BA plugin + client | zeroAccess() | Blind MEK store |
@railman/zero-vault | Product (not BA) | createVaultClient() | Local MEK; persist via zeroAccessClient |
@railman/zero-e2e | Product (not BA) | X3DH + Double Ratchet | Identity from vault; relay via zeroAccessClient |
Layer rule
Elevate can run independently and never opens a vault. Vault and chat are
extra products on zeroAccessClient. Chat requires Vault for identity.
Client boundaries.
Dependency sketch
Independent:
auth-login-factor + auth-elevate
└─ password / TOTP / optional passkey step-up
Passkey-centered:
auth-zero-access-passkey (enhancePasskey → stock + guard)
└─ auth-zero-access (installed guard auto-bound)
└─ zero-vault (PRF-backed browser unlock)
└─ zero-e2e (Vault-derived identity seed)Pick by goal
| Goal | Packages |
|---|---|
| Sudo only | elevate + login-factor (+ optional twoFactor) |
| Passkey login | zero-access-passkey (enhancePasskey) |
| Passkey + sudo | passkey stack + elevate |
| Vault | passkey stack + zero-access + zero-vault (+ optional elevate policy) |
| E2E chat | vault path + zero-e2e |
Composing more than one of the above? Start with the kit — createZeroAccessKit() wires the plugins in install order and returns request-scoped gates. See the kit package page.
Getting started
Zero-access kit
One-import composition + gates
Elevate
Step-up plugin
Login factor
Session stamps + requireAccess
Passkey
enhancePasskey + PRF
Zero-access
Blind MEK store
Zero-vault
Product vault client
Zero-e2e
Sealed messaging crypto
Specs
HTTP paths, bodies, and M6 rules: API & specs. BA helpers vs vault/chat: Client boundaries.