# Documentation

- [CipherStash Documentation](/stack): Data Level Access Control for Postgres. Searchable field-level encryption, identity-bound keys, cryptographic audit trails.
- [Quickstart](/stack/quickstart): Encrypt, store, query, and decrypt your first fields in any Postgres using the stash CLI and @cipherstash/stack, with field-level keys and ZeroKMS.
- [CipherStash](/stack/cipherstash): Data Level Access Control for Postgres. Searchable field-level encryption, identity-bound keys, cryptographic audit trails.
- [PostgreSQL](/stack/cipherstash/postgres): CipherStash integration options for PostgreSQL databases. Choose the right path based on your ORM, deployment, and how much application control you need.
- [Supabase](/stack/cipherstash/supabase): Field-level encryption for your Supabase project. Works with any Postgres client, the Supabase JS SDK, or Drizzle ORM.
- [Deploying to AWS ECS](/stack/deploy/aws-ecs): Deploy CipherStash Proxy to AWS ECS on Fargate, covering ECR images, Secrets Manager credentials, IAM roles, task definitions, and an RDS connection.
- [Bundling](/stack/deploy/bundling): Configure webpack, esbuild, Next.js, and SST to exclude the native @cipherstash/stack module from bundling, plus fixes for Linux deployment failures.
- [Going to production](/stack/deploy/going-to-production): Transition from local device-based auth to production environment variables for CI/CD and hosting platforms
- [Deploy](/stack/deploy): Go from local dev to production. Environment variables, team setup, bundling, and deployment guides.
- [SST](/stack/deploy/sst): Configure SST serverless functions for @cipherstash/stack by excluding it from esbuild bundling and installing it into the Lambda deployment artifact.
- [Team onboarding](/stack/deploy/team-onboarding): Invite team members and set up per-developer device-based access to CipherStash, with traceable client keys you can grant and revoke individually.
- [Testing](/stack/deploy/testing): Test applications using @cipherstash/stack encryption with a dedicated workspace or mocked client, plus PostgreSQL integration tests and CI setup.
- [Troubleshooting](/stack/deploy/troubleshooting): Diagnose @cipherstash/stack issues including client init failures, decryption and keyset errors, empty search results, native addon loading, and performance.
- [Agent Skills](/stack/reference/agent-skills): Install CipherStash agent skills to give your AI coding assistant accurate knowledge of encryption setup, schema building, and integrations
- [Billing](/stack/reference/billing): Understand CipherStash per-workspace billing, compare Free, Pro, Business, and Enterprise plan limits, and learn how upgrades, downgrades, and Stripe work.
- [The CipherCell](/stack/reference/cipher-cell): Understand the CipherCell, the CipherStash JSON format that stores ciphertext, searchable encrypted metadata, and fields for querying encrypted data via EQL.
- [Compliance](/stack/reference/compliance): See how CipherStash supports SOC 2, HIPAA, GDPR, PCI-DSS, and more through field-level encryption, data residency, audit logging, and crypto-shredding.
- [Supabase dashboard integration](/stack/reference/dashboard-supabase-integration): Connect Supabase from the CipherStash dashboard, verify EQL readiness, configure OIDC, and install from the Supabase Marketplace.
- [Discovery session](/stack/reference/discovery-session): What to prepare before your first conversation with the CipherStash team, and what to expect during the call.
- [Drizzle adapter reference](/stack/reference/drizzle): Encrypted query operators, schema extraction, EQL migration generation, and API surface for @cipherstash/stack/drizzle.
- [Encryption SDK reference](/stack/reference/encryption-sdk): Public entry points, supported data types, and configuration highlights for @cipherstash/stack field-level encryption.
- [Encrypt Query Language (EQL)](/stack/reference/eql-guide): Learn how EQL adds PostgreSQL types, operators, and functions for querying encrypted data, covering the eql_v2_encrypted type and searchable index types.
- [Error handling](/stack/reference/error-handling): Handle errors in the @cipherstash/stack SDK with the Result pattern, covering error types, initialization failures, bulk operations, and identity issues.
- [Glossary](/stack/reference/glossary): Definitions of key CipherStash concepts and terms, from ZeroKMS, keysets, and client keys to EQL, HMAC, and searchable encryption.
- [API Reference](/stack/reference): Browse the CipherStash API reference, including the @cipherstash/stack SDK with Encryption, plus types, operators, and functions.
- [Members](/stack/reference/members): Manage CipherStash organization members and workspace memberships in the Dashboard, and onboard developer devices with stash init for local development.
- [Migration guide](/stack/reference/migration): Migrate from @cipherstash/protect to @cipherstash/stack with mapped imports, renamed functions, and updated schema definitions in a few simple steps.
- [Planning guide](/stack/reference/planning-guide): Plan a CipherStash encryption-in-use integration by comparing encryption types, integration paths, ZeroKMS architecture, and the path from dev to production.
- [Error reference](/stack/reference/proxy-errors): A complete reference for errors returned by CipherStash Proxy, grouped by category, with likely causes and steps to diagnose and resolve each one.
- [Reference](/stack/reference/proxy-reference): Complete configuration reference for CipherStash Proxy, covering TOML and environment variable options, CLI flags, Prometheus metrics, and log levels.
- [Security architecture](/stack/reference/security-architecture): Understand the CipherStash security architecture, covering cryptographic primitives, the ZeroKMS key hierarchy, zero-knowledge trust model, and data flow.
- [Supported solutions](/stack/reference/supported-solutions): Integration options, supported databases, and performance characteristics for CipherStash encryption
- [What is CipherStash?](/stack/reference/what-is-cipherstash): Data Level Access Control. Searchable field-level encryption, identity-bound keys, and cryptographic audit trails for Postgres.
- [Programmatic API](/stack/cipherstash/cli/api): Import the stash package programmatically to install EQL, load and validate stash.config.ts, and build custom CipherStash tooling or CI scripts.
- [Execute an encryption plan](/stack/cipherstash/cli/impl): Run stash impl to execute your CipherStash encryption plan by handing off to a coding agent such as Claude Code, Codex, or AGENTS.md.
- [CipherStash CLI](/stack/cipherstash/cli): The stash dev-time CLI installs EQL in PostgreSQL, scaffolds an encryption client, and manages schemas with init, plan, and impl commands.
- [Interactive setup](/stack/cipherstash/cli/init): Run stash init to authenticate, resolve your database, scaffold an encryption client, install dependencies, and add the EQL extension to CipherStash.
- [Install and upgrade EQL](/stack/cipherstash/cli/install): Install or upgrade EQL extensions in Postgres with the stash CLI, covering Supabase and Drizzle migrations, auto-detection, and permission fallbacks.
- [Draft an encryption plan](/stack/cipherstash/cli/plan): Run stash plan to hand off to a coding agent that drafts a reviewable encryption plan.md, with column paths, before any code changes are made.
- [Push and status](/stack/cipherstash/cli/push): Push your CipherStash encryption schema to PostgreSQL and use db status and test-connection to check EQL installation and database connectivity.
- [Project status](/stack/cipherstash/cli/status): Run stash status for a fast, read-only view of your CipherStash setup lifecycle, reading disk state only with no network, database, or auth.
- [Troubleshooting](/stack/cipherstash/cli/troubleshooting): Fix common CipherStash CLI errors covering config files, database permissions, EQL installs, Supabase resets, and Drizzle migration issues.
- [Schema validation](/stack/cipherstash/cli/validate): Use stash db validate to check your CipherStash encryption schema for misconfigurations, with rules for search types, indexes, and operator families.
- [Bulk operations](/stack/cipherstash/encryption/bulk-operations): Encrypt and decrypt arrays of raw values in a single ZeroKMS round-trip using bulkEncrypt and bulkDecrypt
- [Configuration](/stack/cipherstash/encryption/configuration): Configure the @cipherstash/stack encryption SDK with environment variables or programmatic config, covering credentials, keysets, logging, and bundlers.
- [Drizzle ORM](/stack/cipherstash/encryption/drizzle): Define encrypted columns and run type-safe queries with Drizzle ORM and @cipherstash/stack, covering equality, range, text search, and JSONB operators.
- [DynamoDB](/stack/cipherstash/encryption/dynamodb): Encrypt and decrypt DynamoDB items with the encryptedDynamoDB helper from @cipherstash/stack, including bulk operations and HMAC equality queries.
- [Encrypt and decrypt](/stack/cipherstash/encryption/encrypt-decrypt): Encrypt and decrypt single values, models, and bulk records with the CipherStash Encryption SDK, plus identity-aware lock contexts and audit logging.
- [Identity-aware encryption](/stack/cipherstash/encryption/identity): Use LockContext in @cipherstash/stack to tie encryption to a user JWT so only that identity can decrypt their data, including Clerk and Next.js setup.
- [/ENCRYPTION](/stack/cipherstash/encryption): Searchable field-level encryption. Range queries, exact match, and free-text search over ciphertext with sub-millisecond overhead.
- [Setting up indexes](/stack/cipherstash/encryption/indexes): Create PostgreSQL indexes for encrypted columns. Index syntax differs between self-hosted PostgreSQL and managed databases like Supabase.
- [Model operations](/stack/cipherstash/encryption/models): Encrypt and decrypt entire records with schema-driven field selection using encryptModel, decryptModel, bulkEncryptModels, and bulkDecryptModels
- [Prisma Next](/stack/cipherstash/encryption/prisma-next): Searchable field-level encryption for Postgres with Prisma Next, the next-gen ORM with a built-in migration framework
- [Searchable encryption queries](/stack/cipherstash/encryption/queries): Equality, match, and range query patterns for encrypted PostgreSQL columns, with SDK predicates and raw SQL forms.
- [Schema definition](/stack/cipherstash/encryption/schema): Define a @cipherstash/stack schema with encryptedTable and encryptedColumn to choose columns to encrypt, index types, data types, and nested fields.
- [Searchable encryption](/stack/cipherstash/encryption/searchable-encryption): Query encrypted data without decryption. Equality, free-text search, range, ordering, and JSON queries over ciphertext in PostgreSQL.
- [Storing encrypted data](/stack/cipherstash/encryption/storing-data): Store and retrieve encrypted data in PostgreSQL with the @cipherstash/stack Encryption SDK using raw SQL, jsonb or eql_v2_encrypted columns, and bulk ops.
- [Supabase](/stack/cipherstash/encryption/supabase): Encrypt, search, and decrypt data with the encryptedSupabase wrapper from @cipherstash/stack, using familiar Supabase queries, filters, and inserts.
- [Access keys](/stack/cipherstash/kms/access-keys): Create and manage CipherStash access keys for programmatic access to CipherStash Services like ZeroKMS, with member, control, and admin roles and their available scopes.
- [Client keys](/stack/cipherstash/kms/clients): Create and manage CipherStash client keys for SDKs and Proxy, covering device-backed keys for local development and application keys for production and CI.
- [Configuration](/stack/cipherstash/kms/configuration): Configure ZeroKMS for local development and production, including workspace CRN, client and access keys, and keysets for multi-tenant key isolation.
- [CipherStash Token Service (CTS)](/stack/cipherstash/kms/cts): Learn how the CipherStash Token Service (CTS) issues temporary tokens for ZeroKMS access via IDP federation with Auth0, Okta, Clerk, or access keys.
- [Disaster recovery](/stack/cipherstash/kms/disaster-recovery): How ZeroKMS keeps encrypted data recoverable through disaster recovery, separating keys from data so regional outages cause no data loss.
- [ZeroKMS](/stack/cipherstash/kms): 100x faster key management. Unique key per value, derived on demand, never stored. Backed by AWS KMS.
- [Keysets](/stack/cipherstash/kms/keysets): Use CipherStash keysets with ZeroKMS to derive unique data keys and cryptographically isolate tenants, environments, and custom boundaries in your app.
- [OIDC Providers](/stack/cipherstash/kms/oidc): Register an identity provider so end users can authenticate cryptographic operations with their own identity tokens
- [Regions](/stack/cipherstash/kms/regions): Review the AWS regions where ZeroKMS is deployed for CipherStash workspaces, spanning the US, Europe, and Asia Pacific, plus how to request a new region.
- [Audit features](/stack/cipherstash/proxy/audit): Statement fingerprinting, SQL redaction, primary key injection, and record reconciliation in CipherStash Proxy
- [Configuration](/stack/cipherstash/proxy/configuration): Installing and configuring CipherStash Proxy for Docker, environment variables, and database schema setup
- [Encrypt tool](/stack/cipherstash/proxy/encrypt-tool): Use the encrypt CLI tool to encrypt existing data or apply index changes after updating CipherStash Proxy encryption configuration.
- [Getting started with Proxy](/stack/cipherstash/proxy/getting-started): Run CipherStash Proxy locally with Docker and set up credentials, then insert, query, and search transparently encrypted PostgreSQL data in minutes.
- [/PROXY](/stack/cipherstash/proxy): CipherStash Proxy adds transparent, searchable encryption to existing PostgreSQL databases with zero application code changes, powered by EQL and ZeroKMS.
- [Message flow](/stack/cipherstash/proxy/message-flow): How CipherStash Proxy handles PostgreSQL Parse and Bind messages to transparently encrypt and decrypt query parameters.
- [Multitenant operation](/stack/cipherstash/proxy/multitenant): Scope CipherStash Proxy connections to tenant-specific keysets and manage encrypted mapping at runtime.
- [Searchable JSON functions and operators](/stack/cipherstash/proxy/searchable-json): Query encrypted JSONB through CipherStash Proxy using supported operators, path functions, and the ste_vec index, with setup and known limitations.
- [Troubleshooting](/stack/cipherstash/proxy/troubleshooting): Diagnose and resolve issues with CipherStash Proxy, including ZeroKMS connection problems and slow statement performance.
- [CipherStash vs AWS KMS](/stack/reference/comparisons/aws-kms): Compare CipherStash Encryption and AWS KMS for application-level encryption, covering searchable encryption, bulk operations, and developer experience.
- [CipherStash vs Homomorphic Encryption](/stack/reference/comparisons/fhe): Searchable encryption is not FHE. See how CipherStash queries encrypted data and why it's far faster than fully homomorphic encryption for real workloads.
- [Overview](/stack/reference/comparisons): How CipherStash compares to alternative approaches — homomorphic encryption, KMS-only architectures, data vaults.
- [EQL API Reference](/stack/reference/eql): Complete API reference for the Encrypt Query Language (EQL) PostgreSQL extension.
- [Securing AI and RAG pipelines](/stack/reference/use-cases/ai-rag): Protect sensitive data in AI retrieval-augmented generation pipelines with encrypted vector storage and searchable encryption
- [Regulatory compliance](/stack/reference/use-cases/compliance): Meet GDPR, HIPAA, and PCI-DSS requirements with encrypted uniqueness constraints, data minimization, and audit trails
- [Data residency](/stack/reference/use-cases/data-residency): Meet data residency rules with CipherStash using regional ZeroKMS deployment, a dual-party key split, and multi-region patterns for cross-border access.
- [Overview](/stack/reference/use-cases): Real-world use cases for CipherStash encryption, including data vault comparisons, data sovereignty, and identifying sensitive data
- [Provable access control](/stack/reference/use-cases/provable-access): Cryptographic proof-based access control with Lock Contexts for identity-aware encryption and audit logging
- [@cipherstash/stack](/stack/reference/stack/latest): API reference for @cipherstash/stack: every exported type, function, and class, with signatures, parameters, and usage.
- [packages/stack/src/client](/stack/reference/stack/latest/packages/stack/src/client): packages/stack/src/client is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [packages/stack/src/drizzle](/stack/reference/stack/latest/packages/stack/src/drizzle): packages/stack/src/drizzle is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [packages/stack/src/dynamodb](/stack/reference/stack/latest/packages/stack/src/dynamodb): packages/stack/src/dynamodb is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [packages/stack/src/encryption](/stack/reference/stack/latest/packages/stack/src/encryption): packages/stack/src/encryption is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [packages/stack/src/errors](/stack/reference/stack/latest/packages/stack/src/errors): packages/stack/src/errors is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [packages/stack/src/identity](/stack/reference/stack/latest/packages/stack/src/identity): packages/stack/src/identity is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [packages/stack/src/schema](/stack/reference/stack/latest/packages/stack/src/schema): packages/stack/src/schema is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [packages/stack/src/supabase](/stack/reference/stack/latest/packages/stack/src/supabase): packages/stack/src/supabase is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [packages/stack/src/types-public](/stack/reference/stack/latest/packages/stack/src/types-public): packages/stack/src/types-public is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [createEncryptionOperators](/stack/reference/stack/latest/packages/stack/src/drizzle/functions/createEncryptionOperators): Create Drizzle query operators (`eq`, `lt`, `gt`, etc.) that work with
encrypted columns. The returned operators encrypt query values before
passing them to ...
- [encryptedType](/stack/reference/stack/latest/packages/stack/src/drizzle/functions/encryptedType): encryptedType is a function in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [extractEncryptionSchema](/stack/reference/stack/latest/packages/stack/src/drizzle/functions/extractEncryptionSchema): Extract a CipherStash encryption schema from a Drizzle table definition.

Inspects columns created with encryptedType and builds the equivalent
`encryptedTab...
- [EncryptionConfigError](/stack/reference/stack/latest/packages/stack/src/drizzle/classes/EncryptionConfigError): Create Drizzle query operators (`eq`, `lt`, `gt`, etc.) that work with
encrypted columns. The returned operators encrypt query values before
passing them to ...
- [EncryptionOperatorError](/stack/reference/stack/latest/packages/stack/src/drizzle/classes/EncryptionOperatorError): Custom error types for better debugging EncryptionOperatorError in the @cipherstash/stack TypeScript API reference.
- [EncryptedColumnConfig](/stack/reference/stack/latest/packages/stack/src/drizzle/type-aliases/EncryptedColumnConfig): Configuration for encrypted column indexes and data types EncryptedColumnConfig in the @cipherstash/stack TypeScript API reference.
- [BulkDecryptModelsOperation](/stack/reference/stack/latest/packages/stack/src/dynamodb/classes/BulkDecryptModelsOperation): BulkDecryptModelsOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [BulkEncryptModelsOperation](/stack/reference/stack/latest/packages/stack/src/dynamodb/classes/BulkEncryptModelsOperation): BulkEncryptModelsOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [DecryptModelOperation](/stack/reference/stack/latest/packages/stack/src/dynamodb/classes/DecryptModelOperation): DecryptModelOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptModelOperation](/stack/reference/stack/latest/packages/stack/src/dynamodb/classes/EncryptModelOperation): EncryptModelOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [encryptedDynamoDB](/stack/reference/stack/latest/packages/stack/src/dynamodb/functions/encryptedDynamoDB): encryptedDynamoDB is a function in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptedDynamoDBConfig](/stack/reference/stack/latest/packages/stack/src/dynamodb/interfaces/EncryptedDynamoDBConfig): EncryptedDynamoDBConfig is a interface in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptedDynamoDBError](/stack/reference/stack/latest/packages/stack/src/dynamodb/interfaces/EncryptedDynamoDBError): EncryptedDynamoDBError is a interface in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptedDynamoDBInstance](/stack/reference/stack/latest/packages/stack/src/dynamodb/interfaces/EncryptedDynamoDBInstance): EncryptedDynamoDBInstance is a interface in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [BatchEncryptQueryOperation](/stack/reference/stack/latest/packages/stack/src/encryption/classes/BatchEncryptQueryOperation): BatchEncryptQueryOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [BulkDecryptModelsOperation](/stack/reference/stack/latest/packages/stack/src/encryption/classes/BulkDecryptModelsOperation): BulkDecryptModelsOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [BulkDecryptOperation](/stack/reference/stack/latest/packages/stack/src/encryption/classes/BulkDecryptOperation): BulkDecryptOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [BulkEncryptModelsOperation](/stack/reference/stack/latest/packages/stack/src/encryption/classes/BulkEncryptModelsOperation): BulkEncryptModelsOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [BulkEncryptOperation](/stack/reference/stack/latest/packages/stack/src/encryption/classes/BulkEncryptOperation): BulkEncryptOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [DecryptModelOperation](/stack/reference/stack/latest/packages/stack/src/encryption/classes/DecryptModelOperation): DecryptModelOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [DecryptOperation](/stack/reference/stack/latest/packages/stack/src/encryption/classes/DecryptOperation): Decrypts an encrypted payload using the provided client.
This is the type returned by the decrypt method of the EncryptionClient.
- [EncryptModelOperation](/stack/reference/stack/latest/packages/stack/src/encryption/classes/EncryptModelOperation): EncryptModelOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptOperation](/stack/reference/stack/latest/packages/stack/src/encryption/classes/EncryptOperation): EncryptOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptQueryOperation](/stack/reference/stack/latest/packages/stack/src/encryption/classes/EncryptQueryOperation): EncryptQueryOperation is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptionClient](/stack/reference/stack/latest/packages/stack/src/encryption/classes/EncryptionClient): The EncryptionClient is the main entry point for interacting with the CipherStash Encryption library.
It provides methods for encrypting and decrypting indiv...
- [Encryption](/stack/reference/stack/latest/packages/stack/src/encryption/functions/Encryption): Encryption is a function in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [noClientError](/stack/reference/stack/latest/packages/stack/src/encryption/functions/noClientError): noClientError is a function in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [getErrorMessage](/stack/reference/stack/latest/packages/stack/src/errors/functions/getErrorMessage): getErrorMessage is a function in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [ClientInitError](/stack/reference/stack/latest/packages/stack/src/errors/interfaces/ClientInitError): ClientInitError is a interface in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [CtsTokenError](/stack/reference/stack/latest/packages/stack/src/errors/interfaces/CtsTokenError): CtsTokenError is a interface in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [DecryptionOperationError](/stack/reference/stack/latest/packages/stack/src/errors/interfaces/DecryptionOperationError): DecryptionOperationError is a interface in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptionError](/stack/reference/stack/latest/packages/stack/src/errors/interfaces/EncryptionError): Base error interface returned by all encryption operations.

Every operation that can fail returns `Result<T, EncryptionError>`.
Use the `type` field to narr...
- [EncryptionOperationError](/stack/reference/stack/latest/packages/stack/src/errors/interfaces/EncryptionOperationError): EncryptionOperationError is a interface in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [LockContextError](/stack/reference/stack/latest/packages/stack/src/errors/interfaces/LockContextError): LockContextError is a interface in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [StackError](/stack/reference/stack/latest/packages/stack/src/errors/type-aliases/StackError): Discriminated union of all specific error types.

Use `StackError` when you need exhaustive error handling via `switch` on the `type` field.
- [LockContext](/stack/reference/stack/latest/packages/stack/src/identity/classes/LockContext): Manages CipherStash lock contexts for row-level access control.

A `LockContext` ties encryption/decryption operations to an authenticated
user identity via ...
- [EncryptionErrorTypes](/stack/reference/stack/latest/packages/stack/src/errors/variables/EncryptionErrorTypes): EncryptionErrorTypes is a variable in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [Context](/stack/reference/stack/latest/packages/stack/src/identity/type-aliases/Context): Context is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [CtsRegions](/stack/reference/stack/latest/packages/stack/src/identity/type-aliases/CtsRegions): CtsRegions is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [CtsToken](/stack/reference/stack/latest/packages/stack/src/identity/type-aliases/CtsToken): CtsToken is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [GetLockContextResponse](/stack/reference/stack/latest/packages/stack/src/identity/type-aliases/GetLockContextResponse): GetLockContextResponse is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [IdentifyOptions](/stack/reference/stack/latest/packages/stack/src/identity/type-aliases/IdentifyOptions): IdentifyOptions is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [LockContextOptions](/stack/reference/stack/latest/packages/stack/src/identity/type-aliases/LockContextOptions): LockContextOptions is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptedColumn](/stack/reference/stack/latest/packages/stack/src/schema/classes/EncryptedColumn): EncryptedColumn is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptedField](/stack/reference/stack/latest/packages/stack/src/schema/classes/EncryptedField): Builder for a nested encrypted field (encrypted but not searchable).
Create with encryptedField. Use inside nested objects in encryptedTable;
supports `.data...
- [EncryptedTable](/stack/reference/stack/latest/packages/stack/src/schema/classes/EncryptedTable): EncryptedTable is a class in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [buildEncryptConfig](/stack/reference/stack/latest/packages/stack/src/schema/functions/buildEncryptConfig): buildEncryptConfig is a function in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [encryptedColumn](/stack/reference/stack/latest/packages/stack/src/schema/functions/encryptedColumn): encryptedColumn is a function in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [encryptedField](/stack/reference/stack/latest/packages/stack/src/schema/functions/encryptedField): encryptedField is a function in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [encryptedTable](/stack/reference/stack/latest/packages/stack/src/schema/functions/encryptedTable): encryptedTable is a function in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [toEqlCastAs](/stack/reference/stack/latest/packages/stack/src/schema/functions/toEqlCastAs): toEqlCastAs is a function in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [CastAs](/stack/reference/stack/latest/packages/stack/src/schema/type-aliases/CastAs): Type-safe alias for castAsEnum used to specify the *unencrypted* data type of a column or value.
This is important because once encrypted, all data is stored...
- [ColumnSchema](/stack/reference/stack/latest/packages/stack/src/schema/type-aliases/ColumnSchema): ColumnSchema is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptConfig](/stack/reference/stack/latest/packages/stack/src/schema/type-aliases/EncryptConfig): EncryptConfig is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptedTableColumn](/stack/reference/stack/latest/packages/stack/src/schema/type-aliases/EncryptedTableColumn): Shape of table columns: either top-level EncryptedColumn or nested
objects whose leaves are EncryptedField. Used with encryptedTable.
- [EqlCastAs](/stack/reference/stack/latest/packages/stack/src/schema/type-aliases/EqlCastAs): EqlCastAs is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [InferEncrypted](/stack/reference/stack/latest/packages/stack/src/schema/type-aliases/InferEncrypted): Infer the encrypted type from a EncryptedTable schema. InferEncrypted in the @cipherstash/stack TypeScript API reference.
- [InferPlaintext](/stack/reference/stack/latest/packages/stack/src/schema/type-aliases/InferPlaintext): Infer the plaintext (decrypted) type from a EncryptedTable schema. InferPlaintext in the @cipherstash/stack TypeScript API reference.
- [MatchIndexOpts](/stack/reference/stack/latest/packages/stack/src/schema/type-aliases/MatchIndexOpts): MatchIndexOpts is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [OreIndexOpts](/stack/reference/stack/latest/packages/stack/src/schema/type-aliases/OreIndexOpts): OreIndexOpts is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [SteVecIndexOpts](/stack/reference/stack/latest/packages/stack/src/schema/type-aliases/SteVecIndexOpts): SteVecIndexOpts is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [TokenFilter](/stack/reference/stack/latest/packages/stack/src/schema/type-aliases/TokenFilter): TokenFilter is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [UniqueIndexOpts](/stack/reference/stack/latest/packages/stack/src/schema/type-aliases/UniqueIndexOpts): UniqueIndexOpts is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [castAsEnum](/stack/reference/stack/latest/packages/stack/src/schema/variables/castAsEnum): SDK-facing data types — developer-friendly aliases accepted by `dataType()`.
- [eqlCastAsEnum](/stack/reference/stack/latest/packages/stack/src/schema/variables/eqlCastAsEnum): EQL cast types — the PostgreSQL-aligned types that EQL actually accepts.
These are stored in the `cast_as` field of the EncryptConfig.
- [encryptedSupabase](/stack/reference/stack/latest/packages/stack/src/supabase/functions/encryptedSupabase): encryptedSupabase is a function in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptedQueryBuilder](/stack/reference/stack/latest/packages/stack/src/supabase/interfaces/EncryptedQueryBuilder): EncryptedQueryBuilder is a interface in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptedSupabaseInstance](/stack/reference/stack/latest/packages/stack/src/supabase/interfaces/EncryptedSupabaseInstance): EncryptedSupabaseInstance is a interface in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [SupabaseClientLike](/stack/reference/stack/latest/packages/stack/src/supabase/interfaces/SupabaseClientLike): SupabaseClientLike is a interface in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptedSupabaseConfig](/stack/reference/stack/latest/packages/stack/src/supabase/type-aliases/EncryptedSupabaseConfig): EncryptedSupabaseConfig is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptedSupabaseError](/stack/reference/stack/latest/packages/stack/src/supabase/type-aliases/EncryptedSupabaseError): EncryptedSupabaseError is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptedSupabaseResponse](/stack/reference/stack/latest/packages/stack/src/supabase/type-aliases/EncryptedSupabaseResponse): EncryptedSupabaseResponse is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [PendingOrCondition](/stack/reference/stack/latest/packages/stack/src/supabase/type-aliases/PendingOrCondition): PendingOrCondition is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [queryTypes](/stack/reference/stack/latest/packages/stack/src/types-public/variables/queryTypes): queryTypes is a variable in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [BulkDecryptPayload](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/BulkDecryptPayload): BulkDecryptPayload is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [BulkDecryptedData](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/BulkDecryptedData): BulkDecryptedData is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [BulkEncryptPayload](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/BulkEncryptPayload): BulkEncryptPayload is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [BulkEncryptedData](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/BulkEncryptedData): BulkEncryptedData is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [Client](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/Client): Public type re-exports for `@cipherstash/stack/types`.

This module exposes only the public types from the internal types module.
Internal helpers (`queryTyp...
- [ClientConfig](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/ClientConfig): ClientConfig is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [Decrypted](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/Decrypted): Model with encrypted fields replaced by plaintext (decrypted) values Decrypted in the @cipherstash/stack TypeScript API reference.
- [DecryptedFields](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/DecryptedFields): DecryptedFields is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [DecryptionResult](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/DecryptionResult): Result type for individual items in bulk decrypt operations.
Uses `error`/`data` fields (not `failure`/`data`) since bulk operations
can have per-item failures.
- [EncryptOptions](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/EncryptOptions): Options for single-value encrypt operations.
Use a column from your table schema (from encryptedColumn) or a nested
field (from encryptedField) as the target...
- [EncryptQueryOptions](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/EncryptQueryOptions): EncryptQueryOptions is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [Encrypted](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/Encrypted): Structural type representing encrypted data stored in the database. Always
carries a ciphertext. See also `EncryptedValue` for branded nominal typing,
and En...
- [EncryptedFields](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/EncryptedFields): EncryptedFields is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [EncryptedFromSchema](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/EncryptedFromSchema): Maps a plaintext model type to its encrypted form using the table schema.

Fields whose keys match columns defined in `S` become `Encrypted`;
all other field...
- [EncryptedQuery](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/EncryptedQuery): Structural type representing an encrypted query term (search needle)
returned by `encryptQuery` / `encryptQueryBulk` for scalar
(`unique` / `match` / `ore`) ...
- [EncryptedQueryResult](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/EncryptedQueryResult): Result of encryptQuery (single or batch). `eql` return type yields either a
storage payload (`Encrypted`) or a query-only term (`EncryptedQuery`); the
`compo...
- [EncryptedReturnType](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/EncryptedReturnType): Format for encrypted query/search term return values EncryptedReturnType in the @cipherstash/stack TypeScript API reference.
- [EncryptedSearchTerm](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/EncryptedSearchTerm): Encrypted search term result. `eql` return type yields either a storage
payload (`Encrypted`, for `ste_vec_term`) or a query-only term
(`EncryptedQuery`, for...
- [EncryptedValue](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/EncryptedValue): A branded type representing encrypted data. Cannot be accidentally used as plaintext.
- [EncryptionClientConfig](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/EncryptionClientConfig): EncryptionClientConfig is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [KeysetIdentifier](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/KeysetIdentifier): KeysetIdentifier is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [OtherFields](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/OtherFields): OtherFields is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [QueryTypeName](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/QueryTypeName): User-facing query type names for encrypting query values.

- `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/stack/cipherstash/encryp...
- [ScalarQueryTerm](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/ScalarQueryTerm): ScalarQueryTerm is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [SearchTerm](/stack/reference/stack/latest/packages/stack/src/types-public/type-aliases/SearchTerm): SearchTerm is a type in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.