Packages
Zero-vault
Getting started with @railman/zero-vault — create, daily unlock, and recovery reset.
Getting started — Zero-vault
@railman/zero-vault is a browser product controller. It never talks HTTP itself — your app persists wraps via zero-access endpoints. It does not open on elevate success.
Install
pnpm add @railman/zero-vault @railman/auth-zero-access @railman/auth-zero-access-passkeySetup
import { defineZeroAccessPasskeyCryptoConfig } from "@railman/auth-zero-access-passkey/client";
import { createVaultClient } from "@railman/zero-vault";
const cryptoConfig = defineZeroAccessPasskeyCryptoConfig({
salt: process.env.NEXT_PUBLIC_PRF_SALT!,
});
const vault = createVaultClient({
userId,
passkeyOptions: cryptoConfig,
});
// create → force recovery export → unlockDaily → seal app dataTypical surface:
| Method | Role |
|---|---|
createVault | Init MEK + recovery (+ optional PRF/password wraps) |
unlockDaily | PRF and/or vault password |
resetWithRecoveryPhrase | Break-glass reset |
reenrollDailyMethods | After recovery |
Requirements
- Server:
zeroAccess()+ passkey stack in the same Better Auth instance (zero-access) - PRF salt only in browser crypto config
- Recovery phrase for reset, not everyday unlock