docs(v2): PROTOTYPE — generate the CLI reference from the stash CLI

content/docs/reference/cli/auth.mdx

@@ -0,0 +1,50 @@
+---
+title: stash auth
+description: "Authenticate with CipherStash"
+type: reference
+components: [cli]
+verifiedAgainst:
+  cli: "0.16.0"
+---
+
+{/* GENERATED — do not edit. Produced by scripts/generate-cli-docs.ts from `stash --help` (v0.16.0). Re-run `bun run generate-docs:cli` to refresh from the latest published CLI. */}
+
+<Callout type="info">
+Generated from **`stash` v0.16.0**. Run `npx stash@0.16.0 --help` to see the live command surface.
+</Callout>
+
+Authenticate with CipherStash
+
+```bash
+npx stash auth
+```
+
+## Examples
+
+```bash
+npx stash auth login
+```
+
+## How authentication works
+
+`stash auth login` runs the OAuth 2.0 **device authorization flow**:
+
+1. You pick a **region** for your CipherStash workspace.
+2. The CLI opens your browser to a verification URL — and prints it, so it also
+   works over SSH or in a headless/agent environment — where you approve the
+   request.
+3. Meanwhile the CLI polls CipherStash until you approve, then receives a
+   short-lived access token (it reports the token's expiry).
+4. Your device is **bound to the workspace's default keyset**, so later commands
+   (`stash eql install`, `stash db push`, …) authenticate without a fresh login.
+
+The `--supabase` / `--drizzle` flags only tag the referrer for onboarding
+analytics; they don't change the flow.
+
+> **Good to know**: login is device- and workspace-scoped. Authenticating from a
+> new machine — or for a different workspace — re-runs the device flow.
+
+{/* TODO(verify with product): profiles, multiple workspaces, and switching
+between them — where they're stored and how they're selected — belong here (or
+in a linked CLI concept page). The CLI currently exposes only `auth login`;
+confirm the profile / workspace-switching surface before documenting it. */}

content/docs/reference/cli/db.mdx

@@ -0,0 +1,163 @@
+---
+title: stash db
+description: "Reference for the `stash db` commands."
+type: reference
+components: [cli, eql]
+verifiedAgainst:
+  cli: "0.16.0"
+---
+
+{/* GENERATED — do not edit. Produced by scripts/generate-cli-docs.ts from `stash --help` (v0.16.0). Re-run `bun run generate-docs:cli` to refresh from the latest published CLI. */}
+
+<Callout type="info">
+Generated from **`stash` v0.16.0**. Run `npx stash@0.16.0 --help` to see the live command surface.
+</Callout>
+
+The `stash db` command group.
+
+### `db install`
+
+Scaffold stash.config.ts (if missing) and install EQL extensions
+
+```bash
+npx stash db install [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--force` | Reinstall / overwrite even if already installed |
+| `--dry-run` | Show what would happen without making changes |
+| `--supabase` | Use Supabase-compatible mode (auto-detected from DATABASE_URL) |
+| `--drizzle` | Generate a Drizzle migration instead of direct install (auto-detected from project) |
+| `--migration` | (requires --supabase) Write a Supabase migration file instead of running SQL directly |
+| `--direct` | (requires --supabase) Run the SQL directly against the database (mutually exclusive with --migration) |
+| `--migrations-dir <path>` | (requires --supabase) Override the Supabase migrations directory (default: supabase/migrations) |
+| `--exclude-operator-family` | Skip operator family creation |
+| `--latest` | Fetch the latest EQL from GitHub |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk |
+
+
+#### Examples
+
+```bash
+npx stash db install
+```
+
+### `db upgrade`
+
+Upgrade EQL extensions to the latest version
+
+```bash
+npx stash db upgrade [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--dry-run` | Show what would happen without making changes |
+| `--supabase` | Use Supabase-compatible mode (auto-detected from DATABASE_URL) |
+| `--exclude-operator-family` | Skip operator family creation |
+| `--latest` | Fetch the latest EQL from GitHub |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk |
+
+
+### `db push`
+
+Push encryption schema (writes pending if active config already exists)
+
+```bash
+npx stash db push [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--dry-run` | Show what would happen without making changes |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk |
+
+
+#### Examples
+
+```bash
+npx stash db push
+```
+
+### `db activate`
+
+Promote pending → active without renames (use after additive db push)
+
+```bash
+npx stash db activate [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk |
+
+
+### `db validate`
+
+Validate encryption schema
+
+```bash
+npx stash db validate [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--supabase` | Use Supabase-compatible mode (auto-detected from DATABASE_URL) |
+| `--exclude-operator-family` | Skip operator family creation |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk |
+
+
+### `db migrate`
+
+Run pending encrypt config migrations
+
+```bash
+npx stash db migrate [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk |
+
+
+### `db status`
+
+Show EQL installation status
+
+```bash
+npx stash db status [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk |
+
+
+### `db test-connection`
+
+Test database connectivity
+
+```bash
+npx stash db test-connection [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--database-url <url>` | Override DATABASE_URL for this run only — never written to disk |

content/docs/reference/cli/encrypt.mdx

@@ -0,0 +1,56 @@
+---
+title: stash encrypt
+description: "Reference for the `stash encrypt` commands."
+type: reference
+components: [cli, eql]
+verifiedAgainst:
+  cli: "0.16.0"
+---
+
+{/* GENERATED — do not edit. Produced by scripts/generate-cli-docs.ts from `stash --help` (v0.16.0). Re-run `bun run generate-docs:cli` to refresh from the latest published CLI. */}
+
+<Callout type="info">
+Generated from **`stash` v0.16.0**. Run `npx stash@0.16.0 --help` to see the live command surface.
+</Callout>
+
+The `stash encrypt` command group.
+
+### `encrypt status`
+
+Show per-column migration status (phase, progress, drift)
+
+```bash
+npx stash encrypt status
+```
+
+### `encrypt plan`
+
+Diff intent (.cipherstash/migrations.json) vs observed state
+
+```bash
+npx stash encrypt plan
+```
+
+### `encrypt backfill`
+
+Resumably encrypt plaintext into the encrypted column
+
+```bash
+npx stash encrypt backfill
+```
+
+### `encrypt cutover`
+
+Rename swap encrypted → primary column
+
+```bash
+npx stash encrypt cutover
+```
+
+### `encrypt drop`
+
+Generate a migration to drop the plaintext column
+
+```bash
+npx stash encrypt drop
+```

content/docs/reference/cli/env.mdx

@@ -0,0 +1,20 @@
+---
+title: stash env
+description: "(experimental) Print production env vars for deployment"
+type: reference
+components: [cli]
+verifiedAgainst:
+  cli: "0.16.0"
+---
+
+{/* GENERATED — do not edit. Produced by scripts/generate-cli-docs.ts from `stash --help` (v0.16.0). Re-run `bun run generate-docs:cli` to refresh from the latest published CLI. */}
+
+<Callout type="info">
+Generated from **`stash` v0.16.0**. Run `npx stash@0.16.0 --help` to see the live command surface.
+</Callout>
+
+(experimental) Print production env vars for deployment
+
+```bash
+npx stash env
+```

content/docs/reference/cli/impl.mdx

@@ -0,0 +1,36 @@
+---
+title: stash impl
+description: "Execute the plan with a local agent"
+type: reference
+components: [cli]
+verifiedAgainst:
+  cli: "0.16.0"
+---
+
+{/* GENERATED — do not edit. Produced by scripts/generate-cli-docs.ts from `stash --help` (v0.16.0). Re-run `bun run generate-docs:cli` to refresh from the latest published CLI. */}
+
+<Callout type="info">
+Generated from **`stash` v0.16.0**. Run `npx stash@0.16.0 --help` to see the live command surface.
+</Callout>
+
+Execute the plan with a local agent
+
+```bash
+npx stash impl [flags]
+```
+
+### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--continue-without-plan` | Skip planning and go straight to implementation (interactively confirms before proceeding) |
+| `--target <name>` | Skip the agent-target picker and hand off directly to one of claude-code \| codex \| agents-md \| wizard. Safe to call from non-TTY contexts (CI, pipes). Without --target in non-TTY, the command prints a hint and exits cleanly instead of hanging. |
+
+
+## Examples
+
+```bash
+npx stash impl
+npx stash impl --continue-without-plan
+npx stash impl --target claude-code
+```