Docs V2: new information architecture (CIP-3307)

.gitignore

@@ -39,3 +39,8 @@ content/stack/reference/drizzle/latest/
 content/stack/reference/drizzle/v*/
 .tmp-*
 .env.local
+
+# serena (local MCP tooling state)
+.serena/
+# EQL release manifest extracted by generate-eql-docs.ts (see generate-eql-api-docs.ts)
+.eql-manifest.release.json

biome.json

@@ -1,13 +1,21 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.2.0/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.3.15/schema.json",
   "vcs": {
     "enabled": true,
     "clientKind": "git",
     "useIgnoreFile": true
   },
   "files": {
     "ignoreUnknown": true,
-    "includes": ["**", "!node_modules", "!.next", "!dist", "!build", "!.source"]
+    "includes": [
+      "**",
+      "!node_modules",
+      "!.next",
+      "!dist",
+      "!build",
+      "!.source",
+      "!src/app/global.css"
+    ]
   },
   "formatter": {
     "enabled": true,

content/docs/concepts/compare/index.mdx

@@ -0,0 +1,9 @@
+---
+title: Comparisons
+description: "How CipherStash compares to other approaches to protecting data."
+type: concept
+---
+
+This section is being built as part of the docs V2 overhaul ([CIP-3307](https://linear.app/cipherstash/issue/CIP-3307)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
+
+Until it lands, current documentation lives in the [existing docs](/stack).

content/docs/concepts/compare/meta.json

@@ -0,0 +1,5 @@
+{
+  "title": "Comparisons",
+  "icon": "Scale",
+  "pages": ["..."]
+}

content/docs/concepts/index.mdx

@@ -0,0 +1,9 @@
+---
+title: Concepts
+description: "How CipherStash works and how to think about searchable encryption, keys, and identity."
+type: concept
+---
+
+This section is being built as part of the docs V2 overhaul ([CIP-3307](https://linear.app/cipherstash/issue/CIP-3307)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
+
+Until it lands, current documentation lives in the [existing docs](/stack).

content/docs/concepts/meta.json

@@ -0,0 +1,5 @@
+{
+  "title": "Concepts",
+  "icon": "Lightbulb",
+  "pages": ["...", "compare"]
+}

content/docs/concepts/searchable-encryption.mdx

@@ -0,0 +1,9 @@
+---
+title: Searchable encryption
+description: "How querying encrypted data works, and exactly what each index term reveals."
+type: concept
+---
+
+This page is being rewritten as part of the docs V2 overhaul ([CIP-3333](https://linear.app/cipherstash/issue/CIP-3333)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
+
+Until it lands, the current version lives in the [existing docs](/stack/cipherstash/encryption/searchable-encryption).

content/docs/get-started/index.mdx

@@ -0,0 +1,9 @@
+---
+title: Get started
+description: "What CipherStash is, a 10-minute quickstart, and how to choose your integration path."
+type: tutorial
+---
+
+This section is being built as part of the docs V2 overhaul ([CIP-3307](https://linear.app/cipherstash/issue/CIP-3307)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
+
+Until it lands, current documentation lives in the [existing docs](/stack).

content/docs/get-started/meta.json

@@ -0,0 +1,5 @@
+{
+  "title": "Get started",
+  "icon": "Rocket",
+  "pages": ["..."]
+}

content/docs/guides/deployment/index.mdx

@@ -0,0 +1,8 @@
+---
+title: Deployment
+description: "Deployment documentation — being built as part of the docs V2 overhaul."
+---
+
+This section is being built as part of the docs V2 overhaul ([CIP-3307](https://linear.app/cipherstash/issue/CIP-3307)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
+
+Until it lands, current documentation lives in the [existing docs](/stack).

content/docs/guides/deployment/meta.json

@@ -0,0 +1,4 @@
+{
+  "title": "Deployment",
+  "pages": ["..."]
+}

content/docs/guides/development/index.mdx

@@ -0,0 +1,8 @@
+---
+title: Development
+description: "Development documentation — being built as part of the docs V2 overhaul."
+---
+
+This section is being built as part of the docs V2 overhaul ([CIP-3307](https://linear.app/cipherstash/issue/CIP-3307)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
+
+Until it lands, current documentation lives in the [existing docs](/stack).

content/docs/guides/development/meta.json

@@ -0,0 +1,4 @@
+{
+  "title": "Development",
+  "pages": ["..."]
+}

content/docs/guides/index.mdx

@@ -0,0 +1,9 @@
+---
+title: Guides
+description: "Task-oriented guides: development workflow, data migration, deployment, and troubleshooting."
+type: guide
+---
+
+This section is being built as part of the docs V2 overhaul ([CIP-3307](https://linear.app/cipherstash/issue/CIP-3307)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
+
+Until it lands, current documentation lives in the [existing docs](/stack).

content/docs/guides/meta.json

@@ -0,0 +1,5 @@
+{
+  "title": "Guides",
+  "icon": "Wrench",
+  "pages": ["..."]
+}

content/docs/guides/migration/index.mdx

@@ -0,0 +1,8 @@
+---
+title: Data migration
+description: "Data migration documentation — being built as part of the docs V2 overhaul."
+---
+
+This section is being built as part of the docs V2 overhaul ([CIP-3307](https://linear.app/cipherstash/issue/CIP-3307)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
+
+Until it lands, current documentation lives in the [existing docs](/stack).

content/docs/guides/migration/meta.json

@@ -0,0 +1,4 @@
+{
+  "title": "Data migration",
+  "pages": ["..."]
+}

content/docs/guides/troubleshooting/index.mdx

@@ -0,0 +1,8 @@
+---
+title: Troubleshooting
+description: "Troubleshooting documentation — being built as part of the docs V2 overhaul."
+---
+
+This section is being built as part of the docs V2 overhaul ([CIP-3307](https://linear.app/cipherstash/issue/CIP-3307)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
+
+Until it lands, current documentation lives in the [existing docs](/stack).

content/docs/guides/troubleshooting/meta.json

@@ -0,0 +1,4 @@
+{
+  "title": "Troubleshooting",
+  "pages": ["..."]
+}

content/docs/guides/troubleshooting/query-performance.mdx

@@ -0,0 +1,9 @@
+---
+title: Query performance
+description: "Diagnosing and fixing slow queries on encrypted columns."
+type: guide
+---
+
+This page is being built as part of the docs V2 overhaul ([CIP-3351](https://linear.app/cipherstash/issue/CIP-3351)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
+
+Until it lands, the EQL reference covers the essentials: [Indexes](/reference/eql/indexes) walks through `EXPLAIN` verification and large-table index builds, and [Sorting](/reference/eql/sorting) covers extractor-form sort keys.

content/docs/index.mdx

@@ -0,0 +1,38 @@
+---
+title: CipherStash Docs
+seoTitle: CipherStash Docs — Searchable encryption for Postgres
+description: "Searchable field-level encryption, identity-bound keys, and cryptographic audit trails — built into your existing Postgres stack."
+type: concept
+audience: [developer, cto, ciso]
+---
+
+CipherStash encrypts your data at the field level. Every value gets its own
+key, bound to an identity — and the ciphertext stays queryable in Postgres.
+A breach, a compromised agent, a curious insider: they all see ciphertext
+with no key.
+
+## Start here
+
+<Cards>
+  <Card title="Get started" href="/get-started" description="What CipherStash is and your first encrypted fields in 10 minutes." />
+  <Card title="Quickstart" href="/stack/quickstart" description="Encrypt, store, query, and decrypt your first fields in any Postgres." />
+  <Card title="Supabase" href="/integrations/supabase" description="Searchable, application-level encryption for your Supabase project." />
+  <Card title="Agent skills" href="/stack/reference/agent-skills" description="CipherStash knowledge for Cursor, Copilot, and Claude Code." />
+</Cards>
+
+## Browse the docs
+
+<Cards>
+  <Card title="Integrations" href="/integrations" description="Platforms, ORMs, frameworks, auth providers, and runtimes." />
+  <Card title="Concepts" href="/concepts" description="How searchable encryption, key management, and identity-aware encryption work." />
+  <Card title="Guides" href="/guides" description="Development workflow, data migration, deployment, and troubleshooting." />
+  <Card title="Architecture & security" href="/security" description="Trust model, components, availability, audit, and compliance — for security review." />
+  <Card title="Solutions" href="/solutions" description="PII protection, HIPAA, AI/RAG, data residency, and provable access." />
+  <Card title="Reference" href="/reference" description="EQL, the Stack SDK, Auth, the CLI, and Proxy — precise API documentation." />
+</Cards>
+
+## AI-ready documentation
+
+Every page is available as clean markdown: append `.mdx` to any page URL, or
+fetch the whole corpus via [llms.txt](/llms.txt) and
+[llms-full.txt](/llms-full.txt).

content/docs/integrations/index.mdx

@@ -0,0 +1,9 @@
+---
+title: Integrations
+description: "Set up CipherStash with your platform, ORM, framework, auth provider, and runtime."
+type: tutorial
+---
+
+This section is being built as part of the docs V2 overhaul ([CIP-3307](https://linear.app/cipherstash/issue/CIP-3307)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
+
+Until it lands, current documentation lives in the [existing docs](/stack).

content/docs/integrations/meta.json

@@ -0,0 +1,5 @@
+{
+  "title": "Integrations",
+  "icon": "Blocks",
+  "pages": ["..."]
+}

content/docs/integrations/supabase/index.mdx

@@ -0,0 +1,20 @@
+---
+title: Supabase
+description: "Searchable, application-level encryption for your Supabase project — encrypt in your app, query in Postgres."
+type: tutorial
+components: [encryption, eql, platform]
+audience: [developer]
+integration:
+  category: platform
+  setup: dashboard-required
+  pairsWith: [drizzle, prisma-next, clerk, nextjs]
+---
+
+CipherStash adds application-level encryption to your Supabase project:
+sensitive fields are encrypted in your application before they reach Postgres,
+and stay queryable with the same Supabase.js calls you already use.
+
+This page is being rebuilt as part of the docs V2 overhaul
+([CIP-3328](https://linear.app/cipherstash/issue/CIP-3328)). Until it lands,
+the current Supabase integration guide lives at
+[CipherStash + Supabase](/stack/cipherstash/supabase).

content/docs/integrations/supabase/meta.json

@@ -0,0 +1,5 @@
+{
+  "title": "Supabase",
+  "icon": "Supabase",
+  "pages": ["..."]
+}

content/docs/meta.json

@@ -0,0 +1,12 @@
+{
+  "pages": [
+    "index",
+    "get-started",
+    "integrations",
+    "concepts",
+    "guides",
+    "security",
+    "solutions",
+    "reference"
+  ]
+}

content/docs/reference/auth/index.mdx

@@ -0,0 +1,8 @@
+---
+title: Auth
+description: "Auth documentation — being built as part of the docs V2 overhaul."
+---
+
+This section is being built as part of the docs V2 overhaul ([CIP-3307](https://linear.app/cipherstash/issue/CIP-3307)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
+
+Until it lands, current documentation lives in the [existing docs](/stack).

content/docs/reference/auth/meta.json

@@ -0,0 +1,4 @@
+{
+  "title": "Auth",
+  "pages": ["..."]
+}

content/docs/reference/cli/auth.mdx

@@ -0,0 +1,88 @@
+---
+title: stash auth
+description: "Reference for the `stash auth` commands."
+type: reference
+components: [cli]
+verifiedAgainst:
+  cli: "0.17.0"
+---
+
+{/* GENERATED — do not edit. Produced by scripts/generate-cli-docs.ts from `stash manifest --json` (v0.17.0). Re-run `bun run generate-docs:cli` to refresh from the latest published CLI. */}
+
+<Callout type="info">
+Generated from **`stash` v0.17.0** via `npx stash@0.17.0 manifest --json`. Run `npx stash@0.17.0 --help` to see the live command surface.
+</Callout>
+
+The `stash auth` command group.
+
+### `auth login`
+
+Authenticate with CipherStash
+
+```bash
+npx stash auth login [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--region <slug>` | Region to authenticate against (e.g. us-east-1). Skips the interactive region picker. (env: `STASH_REGION`) |
+| `--json` | Emit newline-delimited JSON events instead of prose. The first event (authorization_required) carries the device verification URL for a human to open. Implies no prompt and no browser auto-open. |
+| `--no-open` | Don't auto-open the verification URL in a browser (already implied by --json). |
+| `--supabase` | Track Supabase as the referrer. |
+| `--drizzle` | Track Drizzle as the referrer. |
+
+
+#### Examples
+
+```bash
+npx stash auth login
+npx stash auth login --region us-east-1
+npx stash auth login --supabase
+npx stash auth login --region us-east-1 --json
+```
+
+### `auth regions`
+
+List the regions you can authenticate against
+
+```bash
+npx stash auth regions [flags]
+```
+
+#### Flags
+
+| Flag | Description |
+| --- | --- |
+| `--json` | Emit machine-readable [\{ slug, label \}] instead of a text list. |
+
+
+#### Examples
+
+```bash
+npx stash auth regions
+npx stash auth regions --json
+```
+
+## How authentication works
+
+`stash auth login` runs the OAuth 2.0 **device authorization flow**:
+
+1. You pick a **region** for your CipherStash workspace.
+2. The CLI opens your browser to a verification URL (and prints it, so it also
+   works over SSH or in a headless/agent environment) where you approve the
+   request.
+3. Meanwhile the CLI polls CipherStash until you approve, then receives a
+   short-lived access token (it reports the token's expiry).
+4. Your device is **bound to the workspace's default keyset**, so later commands
+   (`stash eql install`, `stash db push`, …) authenticate without a fresh login.
+
+<Callout title="Good to know">
+Login is device- and workspace-scoped. Authenticating from a new machine, or for a different workspace, re-runs the device flow.
+</Callout>
+
+{/* TODO(verify with product): profiles, multiple workspaces, and switching
+between them (where they're stored and how they're selected) belong here, or
+in a linked CLI concept page. The CLI currently exposes only `auth login`;
+confirm the profile / workspace-switching surface before documenting it. */}