Getting started with @railman/zero-vault — create, daily unlock, and recovery reset.

Getting started — Zero-vault

@railman/zero-vault is an additional browser product. It creates and unlocks MEKs locally. It publishes through authClient.zeroAccess and calls authClient.elevate only before privileged writes. Client boundaries.

Guide: Vault · Demo: /vault

Install

pnpm add @railman/zero-vault @railman/auth-zero-access @railman/auth-zero-access-passkey

Setup

import { createAuthClient } from "better-auth/client";
import { passkeyClient } from "@better-auth/passkey/client";
import { elevateClient } from "@railman/auth-elevate/client";
import { zeroAccessClient } from "@railman/auth-zero-access/client";
import { defineZeroAccessPasskeyCryptoConfig } from "@railman/auth-zero-access-passkey/client";
import { createVaultClient } from "@railman/zero-vault";

const authClient = createAuthClient({
  plugins: [passkeyClient(), elevateClient(), zeroAccessClient()],
});

const cryptoConfig = defineZeroAccessPasskeyCryptoConfig({
  salt: process.env.NEXT_PUBLIC_PRF_SALT!,
});

const vault = createVaultClient({
  userId,
  cryptoConfig,
  authClient,
});

await authClient.elevate.withPasskey();
const created = await vault.createVault({ password });
created.init.exportRecoveryPhrase();
await vault.persistCreatedVault(created, { authClient });
await vault.unlockWithPasskey();

Typical surface:

Method	Role
`createVault`	Local WebCrypto. Returns `mekBody` + slots + phrase. No HTTP.
`persistCreatedVault`	Sugar: POST those bodies via `authClient.zeroAccess` (or `fetch`). Not `authClient.createMek`.
`unlockWithPasskey`	List wraps → local PRF get → `unlockDaily` (not elevate, not login)
`unlockDaily`	Explicit PRF secret and/or vault password
`buildAccountRecoveryEnrollBody`	Possession-proof body for `POST /account-recovery/enroll`
`resetWithRecoveryPhrase`	Break-glass reset
`reenrollDailyMethods`	After recovery

Requirements

Server: zeroAccess() + passkey stack in the same Better Auth instance (zero-access)
PRF salt only in browser crypto config
Recovery phrase for reset, not everyday unlock

Zero-vault

Getting started — Zero-vault

Install

Setup

Requirements

Next

On this page