# The vault format and how to serve it — sgit.ai

> Everything on this site about what a vault IS and how to host, read and embed one — the storage layout, static hosting with no backend, and reading a single file out of a vault from a web page. Generated at build time (v0.2.75).
> The whole-site map is /llms.txt; every page here also exists as `.md`.

## Pages (8)
- [SG/Vault & the vault platform](/docs/vault/index.md): The official working documentation for the SGraph vault platform: the SG/Vault browser app, the SG/Send zero-knowledge API, and vault apps.
- [Building vault apps](/docs/vault/vault-apps.md): How to build apps that live inside encrypted vaults: the project shape, app.json, the authoring contract, and shipping with sgit push.
- [The window.sg bridge](/docs/vault/sg-bridge.md): The vault app runtime: sg.* namespaces, the deny-by-default permission model, and the capabilities the host chrome provides for free.
- [Content authoring](/docs/vault/content-authoring.md): Publish documents, galleries and hub pages from a vault with no code: markdown with print-aware extras, and _page.json layouts with eleven component types.
- [Sub-vaults](/docs/vault/sub-vaults.md): Vaults inside vaults: link files, owner records, read-only team access, click-to-load external embeds, and the extract-and-embed workflow.
- [Git repos inside vaults](/docs/vault/git-and-vaults.md): Run git and sgit side by side: the encrypted store in a git remote, the leak-audit boundary, the GitHub round trip — plus a pure-Python git reader preview.
- [Reading one file out of a vault](/docs/vault/reading-a-vault-file.md): The primitive under every live embed on this site: derive the address from a published read key, fetch ciphertext over CORS, decrypt in the browser — and the sandbox rules for rendering what comes back, including why a PDF is a download and not an embed.
- [Static hosting on GitHub Pages](/docs/vault/static-hosting.md): Serve an encrypted vault and its app from GitHub Pages or S3 with zero backend: deterministic GET paths, client-side decryption, clean read-only degradation.