Drizzle v3: adopt the Supabase-style transparent, auto-detecting column interface

[coderdan]

Motivation

Flagged during review of #630 (adapter package split), on packages/stack-drizzle/README.md.

The two v3 adapters expose encrypted columns very differently:

• Supabase (encryptedSupabaseV3) is transparent and auto-detecting: it introspects the database at connect time (packages/stack-supabase/src/introspect.ts — reads information_schema.columns.domain_name, matched against DOMAIN_REGISTRY) and discovers which columns are public.eql_v3_* domains. The caller does not re-declare column types.

• Drizzle (@cipherstash/stack-drizzle/v3) requires the developer to hand-declare each encrypted column's type in the Drizzle schema, e.g. encryptedTypes.TextSearch('email'), encryptedTypes.IntegerOrd('age'). This duplicates information the database already knows (the column's concrete domain fixes its capabilities), and it can drift from the actual DB schema.

Ask

Investigate whether the Drizzle v3 integration can adopt the same fully-transparent, auto-detecting approach as Supabase — discover encrypted columns and their capabilities by introspecting the installed public.eql_v3_* domains, rather than requiring explicit types.* declarations in the Drizzle schema.

Notes / open questions

• Drizzle's schema is normally the source of truth and is defined statically in TS (for drizzle-kit generate etc.), so a Drizzle equivalent likely can't be purely runtime introspection the way Supabase is — the tension is between a statically-typed Drizzle table and DB-driven detection. Worth scoping what "transparent" can mean here: e.g. a codegen/introspection step that emits the typed columns, or a runtime schema derivation for the query/encrypt path while keeping a plain column for migrations.
• Should preserve the concrete per-column types that Type-safe extractEncryptionSchemaV3: preserve per-column concrete types for Drizzle-extracted schemas #589 (type-safe extractEncryptionSchemaV3) is about — auto-detection must not erase them.
• The shared introspection logic (information_schema.columns.domain_name → DOMAIN_REGISTRY) already exists in packages/stack-supabase/src/introspect.ts and the CLI's packages/cli/src/commands/init/lib/introspect.ts; a Drizzle version would be a third consumer, so consider promoting it to a shared helper.

Follow-up to #627.