Raw Postgres SQL Against Encrypted Columns (EQL v3)

An EQL v3 encrypted column is a Postgres domain over jsonb (public.eql_v3_text_search, public.eql_v3_bigint_ord, …). Reading and writing it from raw SQL is two rules:

1. Writing — bind the Encrypted payload your client produced as a JSON object parameter. How you do that differs per driver, and getting it wrong trips a domain CHECK with an unhelpful message.
2. Querying — never send a plaintext. Mint a query term with encryptQuery and cast it to the column's matching eql_v3.query_* domain. That cast is what selects the right operator overload: leave the operand as bare jsonb and you get a different overload, one that expects a full storage envelope.

This covers the pg and postgres-js drivers with no ORM — plain Node services, Hono, edge functions. If you use Drizzle, Prisma Next, or the Supabase client, those integrations emit correct operands for you: see stash-drizzle, stash-prisma, stash-supabase instead.