Your vault

Your credit and history live in this browser. A vault is their second home: an encrypted folder on a vault server that only you can open, with no password and no email. The page encrypts everything before it leaves; the server holds ciphertext.

How it works

1. Sign in with a passkey. Your phone or laptop unlocks it, the way it unlocks your apps. The passkey gives this page 32 bytes that derive the address and key of a small door vault; nothing is stored to be found.
2. Create your vault, once. Three vaults are made: the door, a master that holds your keys, and your reader vault that holds your data. You are shown a recovery code once, for a device without your passkey.
3. Update it from each device. This device's reads, top-ups and ratings are written as one file of its own, encrypted, in one commit. Nothing is written until you press Update.
4. Open it on another device with the same passkey (or the recovery code), and bring your other devices' reading into that browser, so the balance is the whole account's.

What creating a vault needs

A vault access key: the token the vault server asks for before it accepts a write (sent as the x-sgraph-access-token header to the endpoint above and nowhere else). Opening and reading a vault needs none; creating one, and updating it, does.

Where it comes from: Not issued yet. Dinis Cruz will add how readers of this site get one; until then the pane asks for it, explains what it is, and creates nothing without it. Once pasted, it is written into the reader's own master vault, so no other device of theirs needs it typed.

The key is never written to this repository, never kept in local storage, and never sent anywhere but the endpoint above.

What is in it

• activity/devices/<device>.json: each device's own reads (with the share read, the rating and any decline), top-ups and personas, rewritten whole by that device only, so two devices never conflict.
• activity/account.json: the one starting credit of the account; totals are worked out from the records, never copied.
• apps/<feature>/...: what other parts of this site save for you through the vault, such as conversations with the newsroom's agent. Each feature writes only under its own folder.

The vault server is https://dev.send.sgraph.ai, the one newsroom.sgit.ai uses; the library is the pinned copy that runs dev.vault.sgraph.ai (sg-vault v0.2.3 (assets/vendor/sg-vault/v0.2.3, unedited) and its one local extension (assets/vendor/sg-vault/local/sg-vault--create-with-id.js)). The keys live in memory and, for the life of this tab, in its session storage; none is written to local storage, and none is sent anywhere but the vault server.

This works like the reading vault on newsroom.sgit.ai, where it is a beta. Nothing about the vault is needed to read this site. Your reading account.