fix(ci): validate links across both content trees, and check anchors

.github/workflows/docs.yml

@@ -0,0 +1,53 @@
+# Blocking documentation checks for pull requests.
+#
+# `validate-links` also runs inside `prebuild`, so a broken link already fails
+# the Vercel build. This job exists to make that a fast, named status check
+# that branch protection can require, rather than a failure buried in a
+# deploy log.
+name: Docs
+
+on:
+  pull_request:
+    # v2 is the live documentation line. `main` is deliberately excluded: it
+    # trails v2 by ~100 commits and its bun.lock is out of sync with its
+    # package.json, so `--frozen-lockfile` fails there for reasons that have
+    # nothing to do with links. Add `main` here once #37 lands and makes it
+    # current.
+    branches: [v2]
+  push:
+    branches: [v2]
+  workflow_dispatch:
+
+# A PR that gets pushed to twice shouldn't queue behind its own stale run.
+concurrency:
+  group: docs-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  links:
+    name: Internal links
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          # Pinned rather than `latest` so a bun release can't turn a
+          # required check red on its own.
+          bun-version: 1.3.13
+
+      - run: bun install --frozen-lockfile
+
+      # The TypeDoc reference under content/stack/reference/stack/latest/ is
+      # gitignored and built from a clone of cipherstash/stack. Roughly 18
+      # links point into it, so without this step they all report as missing.
+      # `prebuild` generates before validating for the same reason.
+      - name: Generate the SDK reference
+        run: bun run generate-docs
+
+      - name: Validate internal links and anchors
+        run: bun run validate-links

content/docs/reference/eql/v2/index.mdx

@@ -76,19 +76,19 @@ EQL supports multiple searchable encryption index types. Each index type enables
 
 Enables exact equality queries and unique constraints using HMAC-SHA256.
 
-[Learn more about exact indexes](/stack/cipherstash/encryption/searchable-encryption#exact-match)
+[Learn more about exact indexes](/stack/cipherstash/encryption/searchable-encryption#exact-matching)
 
 ### `ore`: Range queries
 
 Enables range comparisons (`<`, `>`, `BETWEEN`) and ordering (`ORDER BY`) using Order Revealing Encryption.
 
-[Learn more about range indexes](/stack/cipherstash/encryption/searchable-encryption#range--order)
+[Learn more about range indexes](/stack/cipherstash/encryption/searchable-encryption#sorting-and-range-queries)
 
 ### `match`: Pattern matching
 
 Enables substring and full-text search (`LIKE`, `ILIKE`) using encrypted Bloom filters with trigrams.
 
-[Learn more about match indexes](/stack/cipherstash/encryption/searchable-encryption#match-pattern)
+[Learn more about match indexes](/stack/cipherstash/encryption/searchable-encryption#free-text-search)
 
 ### `ste_vec`: Structured data
 

content/docs/reference/eql/v2/payload.mdx

@@ -157,7 +157,7 @@ Enables exact match queries using HMAC-SHA256.
 
 **Type**: Hex-encoded string (64 characters)
 
-**Index Type**: [Exact](/stack/cipherstash/encryption/searchable-encryption#exact-match)
+**Index Type**: [Exact](/stack/cipherstash/encryption/searchable-encryption#exact-matching)
 
 ```json
 {
@@ -171,7 +171,7 @@ Enables range queries and ordering using Order Revealing Encryption.
 
 **Type**: Array of strings
 
-**Index Type**: [Order / Range](/stack/cipherstash/encryption/searchable-encryption#range--order)
+**Index Type**: [Order / Range](/stack/cipherstash/encryption/searchable-encryption#sorting-and-range-queries)
 
 ```json
 {
@@ -188,7 +188,7 @@ Enables substring and pattern matching queries using encrypted Bloom filters wit
 
 **Type**: Array of integers
 
-**Index Type**: [Match](/stack/cipherstash/encryption/searchable-encryption#match-pattern)
+**Index Type**: [Match](/stack/cipherstash/encryption/searchable-encryption#free-text-search)
 
 ```json
 {

content/stack/reference/cipher-cell.mdx

@@ -149,7 +149,7 @@ Enables exact match queries using HMAC-SHA256.
 
 **Type**: Hex-encoded string (64 characters)
 
-**Index Type**: [Exact](/stack/cipherstash/encryption/searchable-encryption#exact-match)
+**Index Type**: [Exact](/stack/cipherstash/encryption/searchable-encryption#exact-matching)
 
 ```json
 {
@@ -163,7 +163,7 @@ Enables range queries and ordering using Order Revealing Encryption.
 
 **Type**: Array of strings
 
-**Index Type**: [Order / Range](/stack/cipherstash/encryption/searchable-encryption#range--order)
+**Index Type**: [Order / Range](/stack/cipherstash/encryption/searchable-encryption#sorting-and-range-queries)
 
 ```json
 {
@@ -180,7 +180,7 @@ Enables substring and pattern matching queries using encrypted Bloom filters wit
 
 **Type**: Array of integers
 
-**Index Type**: [Match](/stack/cipherstash/encryption/searchable-encryption#match-pattern)
+**Index Type**: [Match](/stack/cipherstash/encryption/searchable-encryption#free-text-search)
 
 ```json
 {

content/stack/reference/drizzle.mdx

@@ -131,7 +131,7 @@ See the [CipherStash CLI reference](/stack/cipherstash/cli) for all `db install`
 
 ## Full API surface
 
-The Drizzle adapter now ships as its own package, `@cipherstash/stack-drizzle`. The EQL v3 dialect is on `@cipherstash/stack-drizzle/v3`. See the [Drizzle integration](/integrations/drizzle) for the current, EQL v3 surface:
+The Drizzle adapter now ships as its own package, `@cipherstash/stack-drizzle`. The EQL v3 dialect is on `@cipherstash/stack-drizzle/v3`. Its surface:
 
 - `encryptedType` — column builder
 - `extractEncryptionSchema` — schema conversion

content/stack/reference/eql-guide.mdx

@@ -87,19 +87,19 @@ EQL supports multiple searchable encryption index types. Each index type enables
 
 Enables exact equality queries and unique constraints using HMAC-SHA256.
 
-[Learn more about exact indexes](/stack/cipherstash/encryption/searchable-encryption#exact-match)
+[Learn more about exact indexes](/stack/cipherstash/encryption/searchable-encryption#exact-matching)
 
 ### `ore`: Range queries
 
 Enables range comparisons (`<`, `>`, `BETWEEN`) and ordering (`ORDER BY`) using Order Revealing Encryption.
 
-[Learn more about range indexes](/stack/cipherstash/encryption/searchable-encryption#range--order)
+[Learn more about range indexes](/stack/cipherstash/encryption/searchable-encryption#sorting-and-range-queries)
 
 ### `match`: Pattern matching
 
 Enables substring and full-text search (`LIKE`, `ILIKE`) using encrypted Bloom filters with trigrams.
 
-[Learn more about match indexes](/stack/cipherstash/encryption/searchable-encryption#match-pattern)
+[Learn more about match indexes](/stack/cipherstash/encryption/searchable-encryption#free-text-search)
 
 ### `ste_vec`: Structured data
 

content/stack/reference/glossary.mdx

@@ -131,7 +131,7 @@ It facilitates secure single sign-on (SSO) and simplifies the authentication pro
 ### ORE (Order Revealing Encryption)
 
 A searchable encryption technique allowing for search, comparison, and sorting of encrypted data without decryption.
-See [Range queries](/stack/cipherstash/encryption/searchable-encryption#range--order) for details.
+See [Range queries](/stack/cipherstash/encryption/searchable-encryption#sorting-and-range-queries) for details.
 
 ## P