# dove documentation

> dove is an open-source CLI for encrypted, expiring file sharing from infrastructure the operator controls. In full mode, the server that serves a file does not receive its decryption secret.

Use these sources in this order:

1. Current source and tests define shipped behavior.
2. Current CLI help defines shipped command syntax.
3. Approved design documents define intended behavior and may be ahead of implementation.
4. Marketing copy is explanatory, not an API contract.

Do not present designed or future features as released. Known non-existent contracts include CLI JSON output, a runtime theme manifest, an external-backend wire protocol, unattended provisioning, automatic teardown, and the file-request CLI.

## Documentation

- [Start here](https://dove.sh/docs/): status labels, quickstart, and canonical sources
- [How it works](https://dove.sh/docs/how-it-works/): data path, fragment key, container, PIN, browser handoff
- [Provisioning](https://dove.sh/docs/provisioning/): every AWS resource, permission, secret, and re-run behavior
- [CLI reference](https://dove.sh/docs/cli/): current commands, flags, defaults, and omissions
- [Rust core API](https://dove.sh/docs/core-api/): current public method signatures
- [Automation](https://dove.sh/docs/automation/): safe scripting boundaries and gaps
- [Custom share pages](https://dove.sh/docs/custom-pages/): routes, states, branding, and security invariants
- [Security model](https://dove.sh/docs/security/): guarantees, observations, and non-guarantees
- [For coding agents](https://dove.sh/docs/agents/): task checklist and acceptance evidence
- [Full agent context](https://dove.sh/llms-full.txt): condensed reference suitable for a context window

## Canonical repositories

- CLI: https://github.com/boomctl/dove
- Core, encryption, provisioning, and gate: https://github.com/boomctl/dove-core

## Share-page invariants

- Never transmit or log `location.hash`, a fragment secret, content key, plaintext, decrypted metadata, or PIN.
- Never call the decrementing `/dl/<id>` endpoint on page load. Require explicit human action.
- `/meta/<id>` and PIN pre-check `/verify/<id>` are non-decrementing.
- Decrypt locally. Files under 2 GB may use WebCrypto; files 2 GB and larger hand off to `dove get <url>`.
- The install link always points to https://dove.sh/#install; operator-hosted pages must not publish inline install commands.