Packages overview

@railman/* packages for Better Auth Zero Access (railmanio/auth-zero-access). Still private: true — install from git / workspace until public npm. Use only what your use case needs.

Package	Kind	Primary entry	Start here
`@railman/auth-elevate`	BA plugin	`elevate()` · `requireElevate()`	Step-up / sudo
`@railman/auth-login-factor`	BA plugin	`loginFactors()` · `requireAccess()`	L0 stamps + gates
`@railman/auth-zero-access-passkey`	BA plugins + client	`enhancePasskey(passkey, …)`	Hardened WebAuthn + PRF
`@railman/auth-zero-access`	BA plugin + client	`zeroAccess()`	Blind MEK store
`@railman/zero-vault`	Client only	`createVaultClient()`	Create / unlock / reset UX
`@railman/zero-e2e`	Client only	X3DH + Double Ratchet	Chat on a Vault-derived identity

Layer rule

Elevate can run independently and never opens a vault. Vault requires the passkey composition. Chat requires Vault and consumes its identity seed. How it works.

Dependency sketch

Independent:
  auth-login-factor + auth-elevate
    └─ password / TOTP / optional passkey step-up

Passkey-centered:
  auth-zero-access-passkey (enhancePasskey → stock + guard)
    └─ auth-zero-access (installed guard auto-bound)
         └─ zero-vault (PRF-backed browser unlock)
              └─ zero-e2e (Vault-derived identity seed)

Pick by goal

Goal	Packages
Sudo only	elevate + login-factor (+ optional twoFactor)
Passkey login	zero-access-passkey (`enhancePasskey`)
Passkey + sudo	passkey stack + elevate
Vault	passkey stack + zero-access + zero-vault (+ optional elevate policy)
E2E chat	vault path + zero-e2e