Drizzle adapter reference

@cipherstash/stack/drizzle integrates CipherStash field-level encryption with Drizzle ORM. It provides a custom column type for encrypted fields and drop-in query operators that encrypt search values before they reach PostgreSQL. This page covers the operators, batching patterns, and migration generation. The step-by-step integration guide is at Drizzle integration guide. Full type signatures live in the auto-generated API reference.

Public entry points

Encrypted query operators

createEncryptionOperators returns a set of operators that mirror the standard Drizzle operator names. Each operator encrypts the search value before constructing the SQL fragment.

Key pattern: Most operators are async. await the operator call in the .where() clause, or pass un-awaited operators to encryptionOps.and() / encryptionOps.or() for batching.

Non-encrypted columns fall back to the standard Drizzle operator automatically.

import { drizzle } from "drizzle-orm/postgres-js"
import { Encryption } from "@cipherstash/stack"
import { extractEncryptionSchema, createEncryptionOperators } from "@cipherstash/stack/drizzle"
import { usersTable } from "./schema"
import postgres from "postgres"

const usersSchema = extractEncryptionSchema(usersTable)
const client = await Encryption({ schemas: [usersSchema] })
const ops = createEncryptionOperators(client)
const db = drizzle({ client: postgres(process.env.DATABASE_URL!) })

// Equality lookup
const exact = await db
  .select()
  .from(usersTable)
  .where(await ops.eq(usersTable.email, "[email protected]"))

// Range query on an encrypted number column
const adults = await db
  .select()
  .from(usersTable)
  .where(await ops.gte(usersTable.age, 18))

Batching conditions with and and or

Passing multiple operators to encryptionOps.and() or encryptionOps.or() batches all encryption into a single ZeroKMS call. This is more efficient than awaiting each operator separately.

Pass each operator without await as an argument to and() or or(), then await the outer call.

// All three encryptions happen in one ZeroKMS call
const results = await db
  .select()
  .from(usersTable)
  .where(
    await ops.and(
      ops.gte(usersTable.age, 18),
      ops.lte(usersTable.age, 65),
      ops.ilike(usersTable.email, "%@example.com"),
    ),
  )

Both and() and or() filter out undefined conditions, which makes conditional query building safe:

const results = await db
  .select()
  .from(usersTable)
  .where(
    await ops.and(
      searchEmail ? ops.ilike(usersTable.email, `%${searchEmail}%`) : undefined,
      ops.gte(usersTable.age, minAge),
    ),
  )

EQL migration generation

extractEncryptionSchema produces a CipherStash schema object from your Drizzle table. The @cipherstash/cli uses this schema to generate the EQL database migration that installs the required PostgreSQL indexes.

Run the migration generator after defining your table:

npx @cipherstash/cli db install

The CLI reads your Drizzle config and calls extractEncryptionSchema internally to determine which columns need EQL indexes. It then produces a timestamped SQL migration file in your Drizzle migrations directory.

See the CipherStash CLI reference for all db install options.

Cross-links

• Integration guide: Drizzle integration guide
• Index types: Encrypted indexes
• Query patterns: Encrypted queries
• PostgreSQL setup: Postgres setup

Full API surface

Everything else is in the auto-generated TypeDoc reference:

• Drizzle module — all exports
• encryptedType — column builder
• extractEncryptionSchema — schema conversion
• createEncryptionOperators — operator factory
• EncryptedColumnConfig — column config type