docs(v2): generate the CLI reference from stash manifest --json

content/docs/reference/cli/auth.mdx

@@ -0,0 +1,88 @@
+---
+title: stash auth
+description: "Reference for the `stash auth` commands."
+type: reference
+components: [cli]
+verifiedAgainst:
+  cli: "0.17.0"
+---
+
+{/* GENERATED — do not edit. Produced by scripts/generate-cli-docs.ts from `stash manifest --json` (v0.17.0). Re-run `bun run generate-docs:cli` to refresh from the latest published CLI. */}
+
+<Callout type="info">
+Generated from **`stash` v0.17.0** via `npx stash@0.17.0 manifest --json`. Run `npx stash@0.17.0 --help` to see the live command surface.
+</Callout>
+
+The `stash auth` command group.
+
+### `auth login`
+
+Authenticate with CipherStash
+
+```bash
+npx stash auth login [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--region <slug>` | Region to authenticate against (e.g. us-east-1). Skips the interactive region picker. (env: `STASH_REGION`) |
+| `--json` | Emit newline-delimited JSON events instead of prose. The first event (authorization_required) carries the device verification URL for a human to open. Implies no prompt and no browser auto-open. |
+| `--no-open` | Don't auto-open the verification URL in a browser (already implied by --json). |
+| `--supabase` | Track Supabase as the referrer. |
+| `--drizzle` | Track Drizzle as the referrer. |
+
+
+#### Examples
+
+```bash
+npx stash auth login
+npx stash auth login --region us-east-1
+npx stash auth login --supabase
+npx stash auth login --region us-east-1 --json
+```
+
+### `auth regions`
+
+List the regions you can authenticate against
+
+```bash
+npx stash auth regions [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--json` | Emit machine-readable [\{ slug, label \}] instead of a text list. |
+
+
+#### Examples
+
+```bash
+npx stash auth regions
+npx stash auth regions --json
+```
+
+## How authentication works
+
+`stash auth login` runs the OAuth 2.0 **device authorization flow**:
+
+1. You pick a **region** for your CipherStash workspace.
+2. The CLI opens your browser to a verification URL (and prints it, so it also
+   works over SSH or in a headless/agent environment) where you approve the
+   request.
+3. Meanwhile the CLI polls CipherStash until you approve, then receives a
+   short-lived access token (it reports the token's expiry).
+4. Your device is **bound to the workspace's default keyset**, so later commands
+   (`stash eql install`, `stash db push`, …) authenticate without a fresh login.
+
+<Callout title="Good to know">
+Login is device- and workspace-scoped. Authenticating from a new machine, or for a different workspace, re-runs the device flow.
+</Callout>
+
+{/* TODO(verify with product): profiles, multiple workspaces, and switching
+between them (where they're stored and how they're selected) belong here, or
+in a linked CLI concept page. The CLI currently exposes only `auth login`;
+confirm the profile / workspace-switching surface before documenting it. */}

content/docs/reference/cli/db.mdx

@@ -0,0 +1,86 @@
+---
+title: stash db
+description: "Reference for the `stash db` commands."
+type: reference
+components: [cli, eql]
+verifiedAgainst:
+  cli: "0.17.0"
+---
+
+{/* GENERATED — do not edit. Produced by scripts/generate-cli-docs.ts from `stash manifest --json` (v0.17.0). Re-run `bun run generate-docs:cli` to refresh from the latest published CLI. */}
+
+<Callout type="info">
+Generated from **`stash` v0.17.0** via `npx stash@0.17.0 manifest --json`. Run `npx stash@0.17.0 --help` to see the live command surface.
+</Callout>
+
+The `stash db` command group.
+
+### `db push`
+
+Push encryption schema (writes pending if active config already exists)
+
+```bash
+npx stash db push [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--dry-run` | Show what would happen without making changes. |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk. (env: `DATABASE_URL`) |
+
+
+### `db activate`
+
+Promote pending → active without renames (use after additive db push)
+
+```bash
+npx stash db activate [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk. (env: `DATABASE_URL`) |
+
+
+### `db validate`
+
+Validate encryption schema
+
+```bash
+npx stash db validate [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--supabase` | Use Supabase-compatible mode. |
+| `--exclude-operator-family` | Skip operator family creation. |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk. (env: `DATABASE_URL`) |
+
+
+### `db migrate`
+
+Run pending encrypt config migrations (not yet implemented)
+
+```bash
+npx stash db migrate
+```
+
+### `db test-connection`
+
+Test database connectivity
+
+```bash
+npx stash db test-connection [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk. (env: `DATABASE_URL`) |

content/docs/reference/cli/doctor.mdx

@@ -0,0 +1,20 @@
+---
+title: stash doctor
+description: "Diagnose install problems (native binaries, runtime)"
+type: reference
+components: [cli]
+verifiedAgainst:
+  cli: "0.17.0"
+---
+
+{/* GENERATED — do not edit. Produced by scripts/generate-cli-docs.ts from `stash manifest --json` (v0.17.0). Re-run `bun run generate-docs:cli` to refresh from the latest published CLI. */}
+
+<Callout type="info">
+Generated from **`stash` v0.17.0** via `npx stash@0.17.0 manifest --json`. Run `npx stash@0.17.0 --help` to see the live command surface.
+</Callout>
+
+Diagnose install problems (native binaries, runtime)
+
+```bash
+npx stash doctor
+```

content/docs/reference/cli/encrypt.mdx

@@ -0,0 +1,88 @@
+---
+title: stash encrypt
+description: "Reference for the `stash encrypt` commands."
+type: reference
+components: [cli, eql]
+verifiedAgainst:
+  cli: "0.17.0"
+---
+
+{/* GENERATED — do not edit. Produced by scripts/generate-cli-docs.ts from `stash manifest --json` (v0.17.0). Re-run `bun run generate-docs:cli` to refresh from the latest published CLI. */}
+
+<Callout type="info">
+Generated from **`stash` v0.17.0** via `npx stash@0.17.0 manifest --json`. Run `npx stash@0.17.0 --help` to see the live command surface.
+</Callout>
+
+The `stash encrypt` command group.
+
+### `encrypt status`
+
+Show per-column migration status (phase, progress, drift)
+
+```bash
+npx stash encrypt status
+```
+
+### `encrypt plan`
+
+Diff intent (.cipherstash/migrations.json) vs observed state
+
+```bash
+npx stash encrypt plan
+```
+
+### `encrypt backfill`
+
+Resumably encrypt plaintext into the encrypted column
+
+```bash
+npx stash encrypt backfill [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--table <name>` | Target table. |
+| `--column <name>` | Target column. |
+| `--pk-column <name>` | Primary-key column used to page through rows. |
+| `--chunk-size <n>` | Rows encrypted per batch. |
+| `--encrypted-column <name>` | Destination encrypted column. |
+| `--schema-column-key <key>` | Schema key identifying the column config. |
+| `--confirm-dual-writes-deployed` | Assert the app is dual-writing before backfilling (safety gate). |
+| `--force` | Proceed past non-fatal safety checks. |
+
+
+### `encrypt cutover`
+
+Rename swap encrypted → primary column
+
+```bash
+npx stash encrypt cutover [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--table <name>` | Target table. |
+| `--column <name>` | Target column. |
+| `--proxy-url <url>` | Proxy URL to verify against. |
+| `--migrations-dir <path>` | Directory to write the rename migration into. |
+
+
+### `encrypt drop`
+
+Generate a migration to drop the plaintext column
+
+```bash
+npx stash encrypt drop [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--table <name>` | Target table. |
+| `--column <name>` | Target column. |
+| `--migrations-dir <path>` | Directory to write the drop migration into. |

content/docs/reference/cli/env.mdx

@@ -0,0 +1,26 @@
+---
+title: stash env
+description: "(experimental) Print production env vars for deployment"
+type: reference
+components: [cli]
+verifiedAgainst:
+  cli: "0.17.0"
+---
+
+{/* GENERATED — do not edit. Produced by scripts/generate-cli-docs.ts from `stash manifest --json` (v0.17.0). Re-run `bun run generate-docs:cli` to refresh from the latest published CLI. */}
+
+<Callout type="info">
+Generated from **`stash` v0.17.0** via `npx stash@0.17.0 manifest --json`. Run `npx stash@0.17.0 --help` to see the live command surface.
+</Callout>
+
+(experimental) Print production env vars for deployment
+
+```bash
+npx stash env [flags]
+```
+
+### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--write` | Write the vars to a file instead of printing them. |

content/docs/reference/cli/eql.mdx

@@ -0,0 +1,77 @@
+---
+title: stash eql
+description: "Reference for the `stash eql` commands."
+type: reference
+components: [cli, eql]
+verifiedAgainst:
+  cli: "0.17.0"
+---
+
+{/* GENERATED — do not edit. Produced by scripts/generate-cli-docs.ts from `stash manifest --json` (v0.17.0). Re-run `bun run generate-docs:cli` to refresh from the latest published CLI. */}
+
+<Callout type="info">
+Generated from **`stash` v0.17.0** via `npx stash@0.17.0 manifest --json`. Run `npx stash@0.17.0 --help` to see the live command surface.
+</Callout>
+
+The `stash eql` command group.
+
+### `eql install`
+
+Scaffold stash.config.ts (if missing) and install EQL extensions
+
+```bash
+npx stash eql install [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--force` | Reinstall / overwrite even if already installed. |
+| `--dry-run` | Show what would happen without making changes. |
+| `--supabase` | Use Supabase-compatible mode (auto-detected from DATABASE_URL). |
+| `--drizzle` | Generate a Drizzle migration instead of direct install (auto-detected from project). |
+| `--migration` | Write a Supabase migration file instead of running SQL directly (requires --supabase). |
+| `--direct` | Run the SQL directly against the database (requires --supabase; mutually exclusive with --migration). |
+| `--migrations-dir <path>` | Override the Supabase migrations directory (requires --supabase). (default: `supabase/migrations`) |
+| `--exclude-operator-family` | Skip operator family creation. |
+| `--eql-version <2\|3>` | EQL generation to target. v3 is the native eql_v3.* domain schema (direct install only for now). (default: `2`) |
+| `--latest` | Fetch the latest EQL from GitHub (v2 only). |
+| `--name <name>` | With --drizzle: name for the generated migration (defaults to a scaffold name). |
+| `--out <path>` | With --drizzle: directory to write the generated migration into. |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk. (env: `DATABASE_URL`) |
+
+
+### `eql upgrade`
+
+Upgrade EQL extensions to the latest version
+
+```bash
+npx stash eql upgrade [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--dry-run` | Show what would happen without making changes. |
+| `--supabase` | Use Supabase-compatible mode. |
+| `--exclude-operator-family` | Skip operator family creation. |
+| `--eql-version <2\|3>` | EQL generation to target. (default: `2`) |
+| `--latest` | Fetch the latest EQL from GitHub (v2 only). |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk. (env: `DATABASE_URL`) |
+
+
+### `eql status`
+
+Show EQL installation status
+
+```bash
+npx stash eql status [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk. (env: `DATABASE_URL`) |