Getting started with @railman/zero-e2e — X3DH + Double Ratchet for 1:1 sealed chat.

Getting started — Zero-e2e

@railman/zero-e2e is a client crypto library: X3DH-style session init + Double Ratchet. Not a Better Auth plugin. Not a messaging app. Relay persistence lives on zeroAccess E2E endpoints.

Guide: E2E chat · Demo: /chat · HTTP relay: API — E2E

Where passkey and PRF fit

The Zero Access Chat product path is passkey-centered:

Hardened passkey → PRF-backed Vault unlock → identity seed → zero-e2e session

zero-e2e does not run WebAuthn or request PRF output itself. It accepts the identity seed supplied by the unlocked Vault so the protocol primitives stay separate from browser authentication ceremonies. This is an API boundary, not an independent product architecture.

Use case E therefore requires the passkey composition and Vault path. Elevate is the path that can run independently with password or TOTP proof.

Install

pnpm add @railman/zero-e2e

Quick use

import {
  generateIdentityKeyPair,
  generateSignedPreKey,
  bundleForPublish,
  computeIdentityFingerprint,
  initiateSessionPinned,
  acceptSession,
  sealMessage,
  openMessage,
} from "@railman/zero-e2e";

const bob = generateIdentityKeyPair();
const spk = generateSignedPreKey(bob.signing.secretKey);
const bundle = bundleForPublish(bob, spk);
const fp = computeIdentityFingerprint(bundle.signingKey, bundle.identityKey);
// publish bundle via PUT /zero-access/e2e/prekey …

Non-goals (current)

Groups / sender keys
Multi-device fan-out
Post-quantum
Server crypto (relay only stores sealed bytes)

In the suite, identity seeds come from the passkey-centered Vault unlock path. Keep step-up approval and encryption separate.

Status

@experimental — 1:1 only.

Zero-e2e