Crate dove_core 

dove-core — the shared library behind dove.

Client-side encryption, the S3 + gate transfer, provisioning, and the backend registry — with no terminal I/O of its own. It takes resolved inputs and reports progress through a callback, so the dove CLI and the Dove desktop app drive the exact same logic, and a future cloud backend plugs in behind the same Transfer seam.

Being extracted from the CLI per docs/DESIGN.md.

Re-exports

pub use factory::resolve;

Modules

backend

Backend implementations of the crate::transfer::Transfer seam.

config

The named-backend registry: where dove looks up which cloud a share goes to. Today there’s one kind of backend (self-hosted — your own S3 bucket, the fields dove provision writes), but the registry format supports many, named and switchable (dove backend use <name>, a later CLI feature).

crypto

The full tier’s encryption engine: chunked AES-256-GCM, streaming, with a random key destined for the URL fragment. Same bytes on both ends (Rust and WebCrypto both speak AES-GCM), so dove get and the browser page decrypt the same container.

duration

Compact share durations like 3d, 12h, 30m, 90s — how long a share’s link stays valid.

error

factory

The backend factory: the plugin seam. resolve turns the registry’s active backend into a live Transfer — self-hosted is built straight into this crate; any other kind is expected to be served by a signed plugin binary (dove-<kind>) discovered in the plugins dir and dispatched as a subprocess.

ledger

A local record of the full-tier shares this machine created. The server holds only ciphertext under name-free keys — it can’t tell you what you shared. But you named the file at upload time, so dove keeps a private map here (~/.config/dove/shares.json) and dove ls reads it. Server stays blind; you keep your own view.

progress

How dove-core reports progress without doing I/O: callers pass a &dyn Progress.

provision

Stand up the self-hosted backend from your own AWS account, using the aws CLI so it rides your existing credentials/SSO. The simple tier creates a private bucket (all public access blocked) with a lifecycle rule that auto-deletes objects after a ceiling of days, and mints a least-privilege IAM user scoped to just this bucket, whose key share signs with — never your full account credentials, and with a long-term key so presigned links get their full requested lifetime. The full tier additionally provisions the gate: DynamoDB (share policies) + a Lambda (role, function) + API Gateway + CloudFront + the cost circuit-breaker + the SSM-held MAC secret.

request

Status types for a dove request — the PIN-gated ask for someone else to upload a file to you. share run backwards: the link’s creator is the eventual receiver. dove-core reports these; the CLI and the desktop app render them without needing to know how the gate encodes state on the wire. See docs/REQUEST.md for the full design.

request_ledger

A local record of the requests this machine created — the sibling of ledger.rs, but for dove request instead of dove share. The gate only ever sees the request id and ciphertext; it can’t tell you what you asked for or how to decrypt it. So dove keeps a private map here (~/.config/dove/requests.json) holding the description and the fragment — the decryption key — so dove requests and dove requests get can list and later collect what comes in. Because this file holds a secret (the share ledger doesn’t), it’s locked to 0600 after every write, mirroring secrets.rs.

s3

The S3 layer: upload a share, sign a presigned download URL, delete, list. Built on rusty-s3 + ureq, matching git-ark. Credentials come from the operator’s own AWS profile (via the AWS CLI) — the simple tier signs with your credentials directly, so there’s no separate IAM user and no host.

secrets

dove’s scoped S3 credentials — the access key of the least-privilege IAM user dove provision mints. share / ls / revoke sign and act with this key, not your full account credentials. Lives at ~/.config/dove/secrets.toml, mode 0600, and is never committed.

transfer

The transfer seam: the operations every backend (self-hosted S3 today, a future hosted cloud backend later) must implement. The CLI and the Dove desktop app drive shares through this trait instead of talking to S3 directly, so a new backend plugs in without either caller changing.