End-to-end: scaffold a React app, wire the in-page Chia wallet (window.chia + WalletConnect fallback) with the dig-sdk, build and sign a spend via the chip35 wasm, then deploy on-chain and add a custom domain — one thread through every DIG primitive.
The canonical CHIP-0035 wasm builder constructs every store-coin spend; admin / writer / oracle delegation is the on-chain primitive behind Teams and revocable CI deploy tokens — never hand-rolled.
Full walkthrough of the dig-store CLI: initialize a store, commit files, and read content back. The parallel track to the web-first quickstart.
One-page index of the core DIG Network entities — capsule, store, generation, URN, retrieval key, the dig RPC, the chia:// protocol, and on-chain anchoring — each defined once and linked to its deep doc.
Blind serving model, decoy streams, CORS, caching, rate limiting, and conformance checklist for dig RPC endpoints.
Already have a built site or SPA? How DIG serves it — the store as your file set, index.html + assets + routes, the anchored-root serve model — and a worked example: upload a real dist/ folder through DIGHUb's web upload and reach it.
Auto-publish your built site or dapp to your existing DIG store on every push with the dig-network/deploy-action — git-push-to-deploy, free PR previews, and a PR comment + GitHub deployment status. Keyless CI auth, no long-lived hub secret.
Overview of the DIG Network primitives: dig-store for content-addressable publishing, dig RPC for blind hosting and retrieval, and the DIG Browser for content access.
Example DIG dapps you can clone and open in a template — a static site, a wallet-wired React app, and an NFT drop page. Start from working code instead of a blank folder.
Frequently asked questions about DIG — what it costs, whether you can iterate for free, how the host can't read your app, custom domains, and updates.
Ship a website or app you truly own — minted on-chain as your own asset, not rented. Build and preview for free; pay a small uniform $DIG price only when you publish, with files encrypted in your browser so no host can read them.
Open chia:// content that your own browser verifies against the blockchain — no host can alter or fake it, private content stays private from the host, and it's permanent and re-hostable anywhere, so nobody can take it down or lock you in.
Mint a whole CHIP-0007 collection whose art lives permanently in a tamper-evident DIG capsule — wallet-signed on-chain mints auto-batched for large collections, real royalties, and honest drop mechanics that never fake what they can't yet prove on-chain.
Every store gets a public, shareable tip page, and a one-line script embeds a Tip button on any site. Visitors tip you directly in $DIG, wallet to wallet — no account, no backend, no middleman.
The shortest path through DIGHUb: create a store, publish a capsule, give it a web address, and get tipped — all from the browser, wallet connected only when you publish or spend.
The shortest path through the dig-store CLI: install it, scaffold and preview for free, publish a capsule on-chain, share it over a remote, and read it back — each task linked to the page that walks it.
Layer 0 of the DIG Protocol: store vs capsule vs generation. store_id is the CHIP-0035 singleton launcher id. A store is an ordered sequence of capsules.
The normative urn:dig:chia URN grammar, the rootless retrieval_key = SHA-256(canonical) invariant, resourceKey normalization, the three-way scheme split (chia:// vs §21 dig:// vs dig://* browser), and the salt addressing extension.
Chia AugScheme (G1 48B / G2 96B), the five mutually-distinct role DSTs (PUSH/NODE/TOMB/REQ/ATTEST) with their exact signing-message preimages, rogue-key rejection, and the host↔guest parity fixtures.
Layer 1 read-crypto: HKDF-SHA256 key derivation (salt-mixed secret), AES-256-GCM-SIV fixed-nonce seal, the byte-exact constants table, and the one-crypto-implementation invariant (producer = host = verifier = dig-client-wasm).
The D5 per-resource UNTAGGED leaf = SHA-256(ciphertext), the NODE_TAG fold, odd-node carry-up, the proof-length ≤ ceil(log2 n) binding contract (D8), and the base64 X-Dig-Inclusion-Proof wire layout.
BINDING contract D1: the DIGS blob byte layout (big-endian, self-describing), all 13 SectionIds and their body formats (KeyTable D3, ChunkPool D4, MerkleNodes D5, ChainState, PublicManifest, Filler), and the big-endian rationale.
Fixed-size obfuscation (128 MiB uniform blob, deterministic ChaCha20 filler), WASM injection memory layout (BINDING D2: 2 MiB offset, 384 MiB ceiling), the self-serving guest pipeline, oblivious gather, decoy generation, and the disabled host-attestation gate.
The DIG CAT TAIL asset id, the treasury inner puzzle hash, 3-decimal units, the dynamic USD-pegged per-capsule amount (no protocol constant), the atomic commit-bundle convention, and its non-enforcement caveat.
store = a CHIP-0035 singleton; capsule = a singleton update + root-advance. Free mint vs DIG-paid commit, the owner-discovery memo hint, and admin/writer/oracle delegation as the Teams / deploy-token primitive.
The provider-blindness invariant, serve_blind (framing-only decode), the root-pinned immutable response cache, the *.on.dig.net + custom-domain resolver, the /v1 control plane (CHIP-0002 login, JWT sessions, refresh reuse-detection, action re-auth, GitHub-OIDC CI), and the accept-on-signature push trust model.
The dig RPC is THE machine interface of the protocol: JSON-RPC 2.0 over HTTP POST, the full method catalogue, the chunk wire object (chunk_lens first-window-only, NO decoy field), range/window math, error codes incl. -32004, and the node profile vs the network profile.
The four ordered integrity gates (merkle inclusion → authenticated decryption → anchored-root pinning → risc0 execution), anchored-root pinning against the CHIP-0035 singleton via coinset.org, the authenticated head, tombstones, the MOCK-by-default risc0 caveat, the freshness contract, and provenance UX surfacing.
Complete dig RPC method set: dig.getContent, dig.getProof, dig.getCapsule, dig.getManifest, dig.listCapsules, dig.listCollectionItems, dig.getCollection, and service discovery methods.
Wallet seed setup, on-chain costs, funding, anchor status, and chain-verified downloads for digs projects.
The committable dig.toml manifest and how to inject PUBLIC build-time config (RPC endpoint, asset/CAT ids, feature flags) into a dapp — plus the one hard rule: a blind static capsule holds no server secrets.
The DIG Protocol as seven bottom-up layers, normative and implementation-defined. The capsule (storeId:rootHash) is the fundamental unit; the host is blind and the reader verifies against the chain. This is the authoritative protocol reference.
Ship your first site on DIG — free to build and preview, you only pay the uniform capsule price when you publish. Web-first path (no wallet to start) plus a parallel CLI track.
What a dig-node is, why you'd run one, and how to install it — the apt repository for Ubuntu/Debian or the cross-platform DIG Installer.
npm create dig-app — scaffold a wallet-wired, deployable DIG app in one command. Five templates (static, vite-react, next-static, nft-drop, dapp-window-chia), all free to build and preview; you pay the uniform capsule price only when you publish.
Store identity via on-chain singleton launcher id, generations as capsules, content root, on-disk layout, and compiled module structure.
Streaming chunk model for byte methods: chunk object structure, 64 KiB alignment, reassembly, proof verification, and reference client loop.
A content-addressed protocol for opening stores and resources directly from the DIG Network, with URN and shorthand forms.
Architecture of the content-addressable, encrypted WebAssembly store format: identity, generations, URNs, and compiled modules.
Every failure gives you a stable code and a request-id that ties straight to the server log, on-chain spends are race-guarded so you never double-pay, and clear pre-flight guards stop wasted capsules before you spend $DIG.
Workflow for initializing projects, managing staging areas, running multiple stores in one workspace, and typical release loops.
Public RPC endpoint usage, portability across nodes, operating your own node, and rate limiting policies.
Register an HTTPS endpoint to be notified when a deployment changes state — queued, building, ready, or error. Each event is signed so you can verify it came from DIGHUb. The event contract — payload shape and signature — is stable; delivery is rolling out.
Git-shaped, content-addressable project format with built-in encryption and URN-based addressing; compiles to a single self-defending WebAssembly module.
Network-wide read interface for dig-store capsules via JSON-RPC 2.0; blind by construction, verifiable without trust, and streamable at any size.