# dove documentation

> dove is an open-source CLI for sending or requesting encrypted, expiring files through infrastructure the operator controls. In full mode, the server that serves or receives ciphertext does not receive its decryption secret.

Use these sources in this order:

1. Current source and tests define shipped behavior.
2. Current CLI help defines shipped command syntax.
3. Approved design documents define intended behavior and may be ahead of implementation.
4. Marketing copy is explanatory, not an API contract.

Do not present designed or future features as released. Known non-existent contracts include CLI JSON output, a runtime theme manifest, an external-backend wire protocol, unattended provisioning, automatic teardown, batch sharing, and a multi-file request inbox.

## Documentation

- [Start here](https://dove.sh/docs/): status labels, quickstart, and canonical sources
- [How it works](https://dove.sh/docs/how-it-works/): data path, fragment key, container, PIN, browser handoff
- [File requests](https://dove.sh/docs/file-requests/): create, browser upload, local collection, routes, limits, and key custody
- [Provisioning](https://dove.sh/docs/provisioning/): every AWS resource, permission, secret, and re-run behavior
- [CLI reference](https://dove.sh/docs/cli/): current commands, flags, defaults, and omissions
- [Rust core API](https://dove.sh/docs/core-api/): current public method signatures
- [Automation](https://dove.sh/docs/automation/): safe scripting boundaries and gaps
- [Custom share pages](https://dove.sh/docs/custom-pages/): routes, states, branding, and security invariants
- [Security model](https://dove.sh/docs/security/): guarantees, observations, and non-guarantees
- [For coding agents](https://dove.sh/docs/agents/): task checklist and acceptance evidence
- [Full agent context](https://dove.sh/llms-full.txt): condensed reference suitable for a context window

## Canonical repositories

- CLI: https://github.com/boomctl/dove
- Core, encryption, provisioning, and gate: https://github.com/boomctl/dove-core

## Share and request page invariants

- Never transmit or log `location.hash`, a fragment secret, content key, plaintext, decrypted metadata, or PIN.
- Never call the decrementing `/dl/<id>` endpoint or authorize `/up/<id>` on page load. Require explicit human action.
- `/meta/<id>` and PIN pre-check `/verify/<id>` are non-decrementing.
- Decrypt locally. Outgoing shares under 2 GB may use WebCrypto; files 2 GB and larger hand off to `dove get <url>`. Request pages encrypt one browser-buffered file up to 512 MiB before upload.
- Shipped request CLI: `dove request`, `dove requests`, and `dove requests get`. Request PIN gates access; the fragment secret encrypts the upload.
- The install link always points to https://dove.sh/#install; operator-hosted pages must not publish inline install commands.