bzync-nextsql 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c3ea6924ca4732695f486e9def584fd7d8eb6dfb90e646c54819c047ee4ff61a
-  data.tar.gz: e70bf019af638b3ba62255994dfe881a033c340ccc1f6f20732a625e3a0dd19e
+  metadata.gz: 0146d77d1a64f774c074a7675c2c10be3cb9c00b65e1e60fead33c7baf5d4b48
+  data.tar.gz: 6490a676adbdc20b430a45eebd356d155d5f882ab76aab8b94af4a6302cbe5cf
 SHA512:
-  metadata.gz: 8115ef2bd516eefc60bc59c5a237e71f668571cc95cdaf97cd37928eb73582552fdbd912ff6ec16c2b46256218dc89f0c853049cad0e7038aae895aa3b6dc573
-  data.tar.gz: 27caa6edbcf6b55c10e9af5f2fb59159a32d3d4f9cbfbb5bdd96f1ba744b7435ccf9a1430585219ed8a6fb5fdaaed2efdd2063de75752f5186cb2b55486962b2
+  metadata.gz: 6d7e2921ed7f87454c6d65893d06178a9f776dc451b04e0258005f8a7d210f870f4fc9fc94e6cf9ad69a650b43a58b0bc22814844772ab96c7e968b31181bf06
+  data.tar.gz: 7cc3a24342dbaacb69cb828c6fc7214b618dce91eb6ca4c832019d681e5f7915da4c5f8456039805189fe4eaeb80f9ce5cbec231a912014ff5d18cb78b9d6042

data/README.md

@@ -31,7 +31,23 @@ end
 Plaintext connections are allowed only on loopback. For an HA cluster with
 follower-read routing, use `NextSQL.connect_cluster`.
 
+### Connection Pooling & Statement Caching
+
+```ruby
+pool = NextSQL.create_pool(cfg, min_size: 2, max_size: 10, statement_cache_size: 50)
+begin
+  pool.with do |conn|
+    res = conn.exec("SELECT * FROM users WHERE status = $1", ["active"])
+  end
+ensure
+  pool.close
+end
+```
+
+Parameterized queries automatically reuse cached server-side prepared statements via LRU eviction policy.
+
 - Full driver docs: <https://nextsql.bzync.com/docs/drivers>
 - Wire protocol: <https://github.com/bzync/nextsql/blob/master/docs/protocol.md>
+- Client-side field encryption: <https://nextsql.bzync.com/docs/client-encryption>
 
 MIT licensed.

data/lib/nextsql/client.rb

@@ -10,6 +10,7 @@ require "ipaddr"
 
 require_relative "protocol"
 require_relative "errors"
+require_relative "field_encryption"
 
 module NextSQL
   # TLS options for a remote connection. +ca+ is PEM text/bytes; omit both
@@ -24,12 +25,14 @@ module NextSQL
   end
 
   Config = Struct.new(:address, :nodes, :database, :realm, :user, :password, :key, :key_version, :tls,
-                       :insecure_no_tls, :read_consistency, :max_staleness_ms, :timeout, keyword_init: true) do
+                       :insecure_no_tls, :read_consistency, :max_staleness_ms, :timeout, :field_keys,
+                       :statement_cache_size, keyword_init: true) do
     def initialize(**kwargs)
       defaults = {
         address: "", nodes: [], database: "", realm: "", user: "", password: "",
         key: nil, key_version: 1, tls: nil, insecure_no_tls: false,
-        read_consistency: Protocol::READ_STRONG, max_staleness_ms: 0, timeout: 60.0
+        read_consistency: Protocol::READ_STRONG, max_staleness_ms: 0, timeout: 60.0,
+        field_keys: nil, statement_cache_size: 50
       }
       super(defaults.merge(kwargs))
     end
@@ -95,6 +98,7 @@ module NextSQL
           raise Error.new("invalid_argument", "plaintext is only allowed on loopback")
         end
         raise Error.new("invalid_argument", "user is required") if cfg.user.to_s.empty?
+        raise Error.new("invalid_argument", "statement_cache_size must be >= 0") if cfg.statement_cache_size && cfg.statement_cache_size < 0
       end
 
       LEADING_WS_RE = /\A[ \t\r\n(]+/.freeze
@@ -175,6 +179,8 @@ module NextSQL
       @sock = self.class.dial(cfg)
       @secret = "".b
       @busy = false
+      @statement_cache_size = cfg.statement_cache_size || 0
+      @stmt_cache = {}
       begin
         handshake
         set_read_consistency(cfg.read_consistency, cfg.max_staleness_ms) if cfg.read_consistency != Protocol::READ_STRONG
@@ -203,6 +209,30 @@ module NextSQL
       st
     end
 
+    def encrypt_field(table, column, field_type, value)
+      raise Error.new("invalid_argument", "field_keys is required for client encryption") unless @cfg.field_keys
+
+      FieldEncryption.encrypt(@cfg.field_keys, @cfg.database.to_s.empty? ? "default" : @cfg.database, table, column, field_type, value)
+    end
+
+    def decrypt_field(table, column, expected_type, ciphertext)
+      raise Error.new("invalid_argument", "field_keys is required for client encryption") unless @cfg.field_keys
+
+      FieldEncryption.decrypt(@cfg.field_keys, @cfg.database.to_s.empty? ? "default" : @cfg.database, table, column, expected_type, ciphertext)
+    end
+
+    def encrypt_field_deterministic(table, column, field_type, value)
+      raise Error.new("invalid_argument", "field_keys is required for client encryption") unless @cfg.field_keys
+
+      FieldEncryption.encrypt_deterministic(@cfg.field_keys, @cfg.database.to_s.empty? ? "default" : @cfg.database, table, column, field_type, value)
+    end
+
+    def decrypt_field_deterministic(table, column, expected_type, ciphertext)
+      raise Error.new("invalid_argument", "field_keys is required for client encryption") unless @cfg.field_keys
+
+      FieldEncryption.decrypt_deterministic(@cfg.field_keys, @cfg.database.to_s.empty? ? "default" : @cfg.database, table, column, expected_type, ciphertext)
+    end
+
     def exec(sql, params = [])
       query(sql, params).collect
     end
@@ -211,6 +241,29 @@ module NextSQL
       raise Error.new("unavailable", "connection closed") if @sock.nil?
       raise Error.new("conflict", "connection is busy") if @busy
 
+      if !params.empty? && @statement_cache_size > 0
+        stmt_id = @stmt_cache.delete(sql)
+        if stmt_id.nil?
+          stmt_id = prepare_id(sql)
+          if @stmt_cache.size >= @statement_cache_size
+            _evicted_sql, evicted_id = @stmt_cache.shift
+            begin
+              close_statement(evicted_id)
+            rescue StandardError
+              nil
+            end
+          end
+        end
+        @stmt_cache[sql] = stmt_id
+
+        begin
+          return execute_prepared(stmt_id, params)
+        rescue StandardError
+          @stmt_cache.delete(sql)
+          raise
+        end
+      end
+
       @busy = true
       begin
         write_frame(Protocol::TYPE_QUERY, Protocol.encode_query(sql, params))
@@ -241,7 +294,7 @@ module NextSQL
       end
     end
 
-    def prepare(sql)
+    def prepare_id(sql)
       raise Error.new("conflict", "connection is busy") if @busy
 
       write_frame(Protocol::TYPE_PREPARE, Protocol.u32bytes(sql.b, Protocol::MAX_SQL))
@@ -251,7 +304,11 @@ module NextSQL
 
       stmt_id = Protocol.u32(payload, 0)
       expect_ready
-      Statement.new(self, stmt_id)
+      stmt_id
+    end
+
+    def prepare(sql)
+      Statement.new(self, prepare_id(sql))
     end
 
     def execute_prepared(stmt_id, params)
@@ -300,6 +357,17 @@ module NextSQL
     def close
       return if @sock.nil?
 
+      if @stmt_cache
+        @stmt_cache.each_value do |stmt_id|
+          begin
+            close_statement(stmt_id)
+          rescue StandardError
+            nil
+          end
+        end
+        @stmt_cache.clear
+      end
+
       begin
         write_frame(Protocol::TYPE_TERMINATE, "")
       rescue Error

data/lib/nextsql/field_encryption.rb

@@ -0,0 +1,823 @@
+# frozen_string_literal: true
+
+require "base64"
+require "openssl"
+require "securerandom"
+require "bigdecimal"
+require "json"
+
+require_relative "protocol"
+require_relative "errors"
+
+module NextSQL
+  FieldType = Struct.new(:kind, :precision, :scale, :vec_elem, keyword_init: true) do
+    def self.decimal(precision, scale)
+      if precision < 1 || precision > 38 || scale.negative? || scale > precision
+        raise Error.new("invalid_argument", "unsupported client-encrypted type")
+      end
+
+      new(kind: Protocol::KIND_DECIMAL, precision: precision, scale: scale, vec_elem: 0)
+    end
+  end
+
+  FieldType::UUID = FieldType.new(kind: Protocol::KIND_UUID, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::STRING = FieldType.new(kind: Protocol::KIND_STRING, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::TEXT = FieldType.new(kind: Protocol::KIND_TEXT, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::BLOB = FieldType.new(kind: Protocol::KIND_BLOB, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::TIMESTAMPTZ = FieldType.new(kind: Protocol::KIND_TIMESTAMPTZ, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::JSON = FieldType.new(kind: Protocol::KIND_JSON, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::BOOL = FieldType.new(kind: Protocol::KIND_BOOL, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::INT8 = FieldType.new(kind: Protocol::KIND_INT8, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::INT16 = FieldType.new(kind: Protocol::KIND_INT16, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::INT32 = FieldType.new(kind: Protocol::KIND_INT32, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::INT64 = FieldType.new(kind: Protocol::KIND_INT64, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::UINT8 = FieldType.new(kind: Protocol::KIND_UINT8, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::UINT16 = FieldType.new(kind: Protocol::KIND_UINT16, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::UINT32 = FieldType.new(kind: Protocol::KIND_UINT32, precision: 0, scale: 0, vec_elem: 0).freeze
+  FieldType::UINT64 = FieldType.new(kind: Protocol::KIND_UINT64, precision: 0, scale: 0, vec_elem: 0).freeze
+
+  FieldKey = Struct.new(:id, :material, keyword_init: true) do
+    def initialize(id:, material:)
+      FieldEncryption.validate_key_id!(id)
+      material_bytes = material.b
+      if material_bytes.bytesize != FieldEncryption::KEY_SIZE || material_bytes == ("\x00".b * FieldEncryption::KEY_SIZE)
+        raise Error.new("invalid_argument", "invalid field key")
+      end
+
+      super(id: id, material: material_bytes)
+    end
+  end
+
+  FieldKeyInfo = Struct.new(:id, :created, :current, :revoked, keyword_init: true)
+
+  class MemoryFieldKeyring
+    def initialize(current, overlap = [])
+      @keys = {}
+      @revoked = {}
+      all_keys = [current] + (overlap || [])
+      if all_keys.length > FieldEncryption::MAX_KEYS
+        raise Error.new("invalid_argument", "too many field keys")
+      end
+
+      seen = {}
+      all_keys.each do |k|
+        raise Error.new("invalid_argument", "invalid field key") unless k.is_a?(FieldKey)
+        raise Error.new("invalid_argument", "duplicate field key id") if seen[k.id]
+
+        seen[k.id] = true
+        @keys[k.id] = k
+      end
+      @current_id = current.id
+    end
+
+    def current_field_key(_database, _table, _column)
+      k = @keys[@current_id]
+      raise Error.new("crypto", "current field key unavailable") unless k
+
+      k
+    end
+
+    def field_key(_database, _table, _column, key_id)
+      if @revoked[key_id] || !@keys.key?(key_id)
+        raise Error.new("crypto", "field key unavailable or revoked")
+      end
+
+      @keys[key_id]
+    end
+
+    def rotate(key)
+      raise Error.new("invalid_argument", "invalid field key") unless key.is_a?(FieldKey)
+      raise Error.new("conflict", "cannot reuse a revoked field key id") if @revoked[key.id]
+
+      if !@keys.key?(key.id) && @keys.length >= FieldEncryption::MAX_KEYS
+        raise Error.new("exhausted", "field key limit reached")
+      end
+
+      @keys[key.id] = key
+      @current_id = key.id
+    end
+
+    def revoke(key_id)
+      if !@keys.key?(key_id) && !@revoked.key?(key_id)
+        raise Error.new("not_found", "unknown field key id")
+      end
+      if key_id == @current_id
+        raise Error.new("conflict", "cannot revoke the current field key")
+      end
+      return if @revoked[key_id]
+
+      @revoked[key_id] = true
+      @keys.delete(key_id)
+    end
+  end
+
+  class FileFieldKeyring
+    FileRecord = Struct.new(:id, :created, :current, :revoked, :material, keyword_init: true)
+
+    attr_reader :path
+
+    def initialize(path, records)
+      @path = path
+      @records = records
+    end
+
+    class << self
+      def create(path, current)
+        raise Error.new("already_exists", "keyring file exists") if File.exist?(path)
+        raise Error.new("invalid_argument", "invalid field key") unless current.is_a?(FieldKey)
+
+        rec = FileRecord.new(
+          id: current.id,
+          created: Time.now.utc,
+          current: true,
+          revoked: false,
+          material: current.material
+        )
+        kr = new(path, [rec])
+        kr.send(:persist!)
+        kr
+      end
+
+      def open(path)
+        raise Error.new("not_found", "keyring file not found") unless File.exist?(path)
+
+        raw = File.binread(path)
+        records = decode_keyring(raw)
+        new(path, records)
+      rescue Error
+        raise
+      rescue StandardError => e
+        raise Error.new("io", "failed to read keyring: #{e.message}")
+      end
+
+      def decode_keyring(raw)
+        raise Error.new("invalid_format", "truncated keyring") if raw.bytesize < 8
+        raise Error.new("invalid_format", "bad keyring magic") if raw[0, 4] != FieldEncryption::KEYRING_MAGIC
+
+        ver = raw[4, 2].unpack1("v")
+        count = raw[6, 2].unpack1("v")
+        raise Error.new("invalid_format", "unsupported keyring version") if ver != FieldEncryption::KEYRING_VERSION
+        raise Error.new("invalid_format", "keyring key count exceeds limit") if count > FieldEncryption::MAX_KEYS
+
+        off = 8
+        records = []
+        seen = {}
+        current_count = 0
+
+        count.times do
+          raise Error.new("invalid_format", "truncated keyring record") if off >= raw.bytesize
+
+          id_len = raw.getbyte(off)
+          off += 1
+          if id_len < 1 || id_len > FieldEncryption::MAX_KEY_ID || off + id_len + 8 + 1 + FieldEncryption::KEY_SIZE > raw.bytesize
+            raise Error.new("invalid_format", "invalid field key id length or truncated record")
+          end
+
+          id_str = raw[off, id_len].force_encoding("utf-8")
+          off += id_len
+          unless FieldEncryption.valid_key_id?(id_str) && !seen[id_str]
+            raise Error.new("invalid_format", "invalid or duplicate field key id")
+          end
+
+          seen[id_str] = true
+
+          created_sec = raw[off, 8].unpack1("Q<")
+          flags = raw.getbyte(off + 8)
+          off += 9
+          material = raw[off, FieldEncryption::KEY_SIZE]
+          off += FieldEncryption::KEY_SIZE
+
+          is_current = (flags & FieldEncryption::FLAG_CURRENT) != 0
+          is_revoked = (flags & FieldEncryption::FLAG_REVOKED) != 0
+
+          raise Error.new("invalid_format", "current key cannot be revoked") if is_current && is_revoked
+
+          if is_revoked && material != ("\x00".b * FieldEncryption::KEY_SIZE)
+            raise Error.new("invalid_format", "revoked key has non-zero material")
+          end
+          if !is_revoked && material == ("\x00".b * FieldEncryption::KEY_SIZE)
+            raise Error.new("invalid_format", "unrevoked key has all-zero material")
+          end
+
+          current_count += 1 if is_current
+
+          records << FileRecord.new(
+            id: id_str,
+            created: Time.at(created_sec).utc,
+            current: is_current,
+            revoked: is_revoked,
+            material: material
+          )
+        end
+
+        if count.positive? && current_count != 1
+          raise Error.new("invalid_format", "keyring must contain exactly one current key")
+        end
+        if off != raw.bytesize
+          raise Error.new("invalid_format", "trailing bytes after keyring records")
+        end
+
+        records
+      end
+    end
+
+    def current_field_key(_database, _table, _column)
+      rec = @records.find { |r| r.current && !r.revoked }
+      raise Error.new("crypto", "current field key unavailable") unless rec
+
+      FieldKey.new(id: rec.id, material: rec.material)
+    end
+
+    def field_key(_database, _table, _column, key_id)
+      rec = @records.find { |r| r.id == key_id }
+      if !rec || rec.revoked
+        raise Error.new("crypto", "field key unavailable or revoked")
+      end
+
+      FieldKey.new(id: rec.id, material: rec.material)
+    end
+
+    def rotate(key)
+      raise Error.new("invalid_argument", "invalid field key") unless key.is_a?(FieldKey)
+
+      idx = @records.find_index { |r| r.id == key.id }
+      if idx
+        raise Error.new("conflict", "cannot reuse a revoked field key id") if @records[idx].revoked
+      else
+        if @records.length >= FieldEncryption::MAX_KEYS
+          raise Error.new("exhausted", "field key limit reached")
+        end
+
+        @records << FileRecord.new(
+          id: key.id,
+          created: Time.now.utc,
+          current: false,
+          revoked: false,
+          material: key.material
+        )
+        idx = @records.length - 1
+      end
+
+      @records.each { |r| r.current = false }
+      @records[idx].current = true
+      @records[idx].material = key.material
+      persist!
+    end
+
+    def revoke(key_id)
+      idx = @records.find_index { |r| r.id == key_id }
+      raise Error.new("not_found", "unknown field key id") unless idx
+      if @records[idx].current
+        raise Error.new("conflict", "cannot revoke the current field key")
+      end
+      return if @records[idx].revoked
+
+      @records[idx].revoked = true
+      @records[idx].material = "\x00".b * FieldEncryption::KEY_SIZE
+      persist!
+    end
+
+    def reload
+      raw = File.binread(@path)
+      @records = self.class.decode_keyring(raw)
+    rescue Error
+      raise
+    rescue StandardError => e
+      raise Error.new("io", "failed to reload keyring: #{e.message}")
+    end
+
+    def list
+      @records.map do |r|
+        FieldKeyInfo.new(id: r.id, created: r.created, current: r.current, revoked: r.revoked)
+      end
+    end
+
+    private
+
+    def persist!
+      raw = encode_keyring
+      tmp = "#{@path}.tmp.#{Process.pid}.#{SecureRandom.hex(4)}"
+      File.open(tmp, File::WRONLY | File::CREAT | File::EXCL, 0o600) do |f|
+        f.binmode
+        f.write(raw)
+        f.flush
+        f.fsync
+      end
+      File.rename(tmp, @path)
+    rescue StandardError => e
+      File.unlink(tmp) if File.exist?(tmp)
+      raise Error.new("io", "failed to persist keyring: #{e.message}")
+    end
+
+    def encode_keyring
+      buf = +"".b
+      buf << FieldEncryption::KEYRING_MAGIC
+      buf << [FieldEncryption::KEYRING_VERSION].pack("v")
+      buf << [@records.length].pack("v")
+
+      @records.each do |r|
+        id_b = r.id.encode("utf-8").b
+        buf << [id_b.bytesize].pack("C")
+        buf << id_b
+        buf << [r.created.to_i].pack("Q<")
+        flags = 0
+        flags |= FieldEncryption::FLAG_CURRENT if r.current
+        flags |= FieldEncryption::FLAG_REVOKED if r.revoked
+        buf << [flags].pack("C")
+        buf << r.material
+      end
+
+      buf
+    end
+  end
+
+  module FieldEncryption
+    PREFIX = "NSCE1."
+    DETERMINISTIC_PREFIX = "NSCE2."
+    VERSION = 1
+    DETERMINISTIC_VERSION = 2
+    SUITE_AES_256_GCM = 1
+    SUITE_AES_SIV = 2
+    KEY_SIZE = 32
+    MAX_KEY_ID = 64
+    MAX_KEYS = 64
+    MAX_PLAINTEXT = 1 << 20
+    NONCE_SIZE = 12
+    TAG_SIZE = 16
+
+    KEYRING_MAGIC = "NSFK".b
+    KEYRING_VERSION = 1
+    FLAG_CURRENT = 1 << 0
+    FLAG_REVOKED = 1 << 1
+
+    KEY_ID_RE = /\A[A-Za-z0-9._-]+\z/
+
+    class << self
+      def generate_field_key(id)
+        validate_key_id!(id)
+        FieldKey.new(id: id, material: SecureRandom.random_bytes(KEY_SIZE))
+      end
+
+      def valid_key_id?(id)
+        id.is_a?(String) && id.length >= 1 && id.length <= MAX_KEY_ID && KEY_ID_RE.match?(id)
+      end
+
+      def validate_key_id!(id)
+        raise Error.new("invalid_argument", "invalid field key id") unless valid_key_id?(id)
+      end
+
+      def encrypt(provider, database, table, column, field_type, value)
+        return nil if value.nil?
+
+        validate_field_type!(field_type)
+        plain = encode_scalar(field_type, value)
+        if plain.bytesize > MAX_PLAINTEXT
+          raise Error.new("exhausted", "plaintext exceeds field limit")
+        end
+
+        key = provider.current_field_key(database, table, column)
+        public_header = build_public_header(VERSION, SUITE_AES_256_GCM, key.id, field_type)
+        nonce = SecureRandom.random_bytes(NONCE_SIZE)
+        aad = build_aad(PREFIX, database, table, column, public_header)
+
+        cipher = OpenSSL::Cipher.new("aes-256-gcm")
+        cipher.encrypt
+        cipher.key = key.material
+        cipher.iv = nonce
+        cipher.auth_data = aad
+        ct = cipher.update(plain) + cipher.final
+        tag = cipher.auth_tag
+
+        body = public_header + nonce + ct + tag
+        PREFIX + Base64.urlsafe_encode64(body, padding: false)
+      end
+
+      def decrypt(provider, database, table, column, expected_type, ciphertext)
+        return nil if ciphertext.nil?
+
+        validate_field_type!(expected_type)
+        parsed = inspect_field(ciphertext)
+        if parsed[:mode] != "randomized"
+          raise Error.new("invalid_format", "deterministic ciphertext requires decrypt_field_deterministic")
+        end
+        if parsed[:type] != expected_type
+          raise Error.new("invalid_format", "encrypted logical type mismatch")
+        end
+
+        key = provider.field_key(database, table, column, parsed[:key_id])
+        body = parsed[:body]
+        header_len = parsed[:header_length]
+        public_header = body[0...(header_len - NONCE_SIZE)]
+        nonce = body[(header_len - NONCE_SIZE)...header_len]
+        ct_and_tag = body[header_len..]
+        tag = ct_and_tag[-TAG_SIZE..]
+        ct = ct_and_tag[0...-TAG_SIZE]
+        aad = build_aad(PREFIX, database, table, column, public_header)
+
+        cipher = OpenSSL::Cipher.new("aes-256-gcm")
+        cipher.decrypt
+        cipher.key = key.material
+        cipher.iv = nonce
+        cipher.auth_tag = tag
+        cipher.auth_data = aad
+        begin
+          plain = cipher.update(ct) + cipher.final
+        rescue OpenSSL::Cipher::CipherError
+          raise Error.new("crypto", "ciphertext authentication failed")
+        end
+
+        if plain.bytesize > MAX_PLAINTEXT
+          raise Error.new("invalid_format", "plaintext exceeds field limit")
+        end
+
+        decode_scalar(expected_type, plain)
+      end
+
+      def encrypt_deterministic(provider, database, table, column, field_type, value)
+        return nil if value.nil?
+
+        validate_field_type!(field_type)
+        plain = encode_scalar(field_type, value)
+        if plain.bytesize > MAX_PLAINTEXT
+          raise Error.new("exhausted", "plaintext exceeds field limit")
+        end
+
+        key = provider.current_field_key(database, table, column)
+        public_header = build_public_header(DETERMINISTIC_VERSION, SUITE_AES_SIV, key.id, field_type)
+        aad = build_aad(DETERMINISTIC_PREFIX, database, table, column, public_header)
+
+        derived = hkdf_sha256(key.material, "NextSQL NSCE2 AES-SIV v2".b, 32)
+        k1 = derived[0, 16]
+        k2 = derived[16, 16]
+
+        tag = s2v(k1, aad, plain)
+        cipher_bytes = ctr_crypt(k2, tag, plain)
+
+        body = public_header + tag + cipher_bytes
+        DETERMINISTIC_PREFIX + Base64.urlsafe_encode64(body, padding: false)
+      end
+
+      def decrypt_deterministic(provider, database, table, column, expected_type, ciphertext)
+        return nil if ciphertext.nil?
+
+        validate_field_type!(expected_type)
+        parsed = inspect_field(ciphertext)
+        if parsed[:mode] != "deterministic"
+          raise Error.new("invalid_format", "randomized ciphertext requires decrypt_field")
+        end
+        if parsed[:type] != expected_type
+          raise Error.new("invalid_format", "encrypted logical type mismatch")
+        end
+
+        key = provider.field_key(database, table, column, parsed[:key_id])
+        body = parsed[:body]
+        header_len = parsed[:header_length]
+        public_header = body[0...header_len]
+        tag = body[header_len, 16]
+        ct = body[(header_len + 16)..]
+
+        aad = build_aad(DETERMINISTIC_PREFIX, database, table, column, public_header)
+        derived = hkdf_sha256(key.material, "NextSQL NSCE2 AES-SIV v2".b, 32)
+        k1 = derived[0, 16]
+        k2 = derived[16, 16]
+
+        plain = ctr_crypt(k2, tag, ct)
+        expected_tag = s2v(k1, aad, plain)
+        unless OpenSSL.fixed_length_secure_compare(tag, expected_tag)
+          raise Error.new("crypto", "ciphertext authentication failed")
+        end
+
+        if plain.bytesize > MAX_PLAINTEXT
+          raise Error.new("invalid_format", "plaintext exceeds field limit")
+        end
+
+        decode_scalar(expected_type, plain)
+      end
+
+      def inspect_field(ciphertext)
+        raise Error.new("invalid_format", "invalid client ciphertext") unless ciphertext.is_a?(String)
+
+        if ciphertext.start_with?(PREFIX)
+          prefix = PREFIX
+          version = VERSION
+          suite = SUITE_AES_256_GCM
+          nonce_size = NONCE_SIZE
+          mode = "randomized"
+        elsif ciphertext.start_with?(DETERMINISTIC_PREFIX)
+          prefix = DETERMINISTIC_PREFIX
+          version = DETERMINISTIC_VERSION
+          suite = SUITE_AES_SIV
+          nonce_size = 0
+          mode = "deterministic"
+        else
+          raise Error.new("invalid_format", "invalid client ciphertext prefix")
+        end
+
+        encoded = ciphertext[prefix.length..]
+        max_encoded = ((MAX_PLAINTEXT + 101) * 4 / 3) + 4
+        if encoded.nil? || encoded.empty? || encoded.length > max_encoded || encoded.length % 4 == 1 || !encoded.match?(/\A[A-Za-z0-9_-]+\z/)
+          raise Error.new("invalid_format", "client ciphertext length out of range")
+        end
+
+        padded = encoded + ("=" * ((4 - (encoded.length % 4)) % 4))
+        begin
+          body = Base64.urlsafe_decode64(padded)
+        rescue StandardError
+          raise Error.new("invalid_format", "invalid client ciphertext encoding")
+        end
+
+        min_len = 3 + 1 + 6 + nonce_size + TAG_SIZE
+        if body.bytesize < min_len || body.getbyte(0) != version || body.getbyte(1) != suite
+          raise Error.new("invalid_format", "unsupported or truncated client ciphertext")
+        end
+
+        key_id_len = body.getbyte(2)
+        if key_id_len < 1 || key_id_len > MAX_KEY_ID || body.bytesize < 3 + key_id_len + 6 + nonce_size + TAG_SIZE
+          raise Error.new("invalid_format", "invalid field key id length")
+        end
+
+        key_id = body[3, key_id_len].force_encoding("utf-8")
+        raise Error.new("invalid_format", "invalid field key id") unless valid_key_id?(key_id)
+
+        off = 3 + key_id_len
+        kind = body.getbyte(off)
+        precision = body[off + 1, 2].unpack1("v")
+        scale = body[off + 3, 2].unpack1("v")
+        vec_elem = body.getbyte(off + 5)
+        ft = FieldType.new(kind: kind, precision: precision, scale: scale, vec_elem: vec_elem)
+        validate_field_type!(ft)
+
+        header_len = off + 6 + nonce_size
+        {
+          key_id: key_id,
+          type: ft,
+          body: body,
+          header_length: header_len,
+          mode: mode,
+        }
+      end
+
+      # --- internal helpers ---
+
+      def validate_field_type!(ft)
+        if ft.kind == Protocol::KIND_DECIMAL
+          if ft.precision < 1 || ft.precision > 38 || ft.scale.negative? || ft.scale > ft.precision
+            raise Error.new("invalid_argument", "unsupported client-encrypted type")
+          end
+          return
+        end
+
+        valid = [
+          Protocol::KIND_UUID, Protocol::KIND_STRING, Protocol::KIND_TEXT, Protocol::KIND_BLOB,
+          Protocol::KIND_TIMESTAMPTZ, Protocol::KIND_JSON, Protocol::KIND_BOOL,
+          Protocol::KIND_INT8, Protocol::KIND_INT16, Protocol::KIND_INT32, Protocol::KIND_INT64,
+          Protocol::KIND_UINT8, Protocol::KIND_UINT16, Protocol::KIND_UINT32, Protocol::KIND_UINT64,
+        ]
+        if !valid.include?(ft.kind) || ft.precision != 0 || ft.scale != 0 || ft.vec_elem != 0
+          raise Error.new("invalid_argument", "unsupported client-encrypted type")
+        end
+      end
+
+      def build_public_header(version, suite, key_id, field_type)
+        key_id_b = key_id.encode("utf-8").b
+        [version, suite, key_id_b.bytesize].pack("CCC") +
+          key_id_b +
+          [field_type.kind, field_type.precision, field_type.scale, field_type.vec_elem].pack("CvvC")
+      end
+
+      def build_aad(prefix, database, table, column, public_header)
+        db_b = validate_name!(database, "database")
+        tbl_b = validate_name!(table, "table")
+        col_b = validate_name!(column, "column")
+
+        out = prefix.encode("utf-8").b
+        out << [db_b.bytesize].pack("v") << db_b
+        out << [tbl_b.bytesize].pack("v") << tbl_b
+        out << [col_b.bytesize].pack("v") << col_b
+        out << public_header
+        out
+      end
+
+      def validate_name!(val, what)
+        raise Error.new("invalid_argument", "#{what} must not be empty") unless val.is_a?(String) && !val.empty?
+        b = val.encode("utf-8").b
+        raise Error.new("invalid_argument", "#{what} exceeds maximum length") if b.bytesize > 0xFFFF
+        b
+      end
+
+      def encode_scalar(ft, value)
+        case ft.kind
+        when Protocol::KIND_UUID
+          if value.is_a?(String)
+            clean = value.delete("-")
+            raise Error.new("invalid_argument", "invalid UUID") unless clean.match?(/\A[0-9a-fA-F]{32}\z/)
+            [clean].pack("H*")
+          elsif value.is_a?(String) && value.bytesize == 16
+            value.b
+          else
+            raise Error.new("invalid_argument", "invalid UUID for encrypted field")
+          end
+        when Protocol::KIND_STRING, Protocol::KIND_TEXT
+          raise Error.new("invalid_argument", "encrypted string value must be a string") unless value.is_a?(String)
+          b = value.encode("utf-8").b
+          [b.bytesize].pack("V") + b
+        when Protocol::KIND_BLOB
+          raise Error.new("invalid_argument", "encrypted BLOB value must be bytes") unless value.is_a?(String)
+          b = value.b
+          [b.bytesize].pack("V") + b
+        when Protocol::KIND_BOOL
+          raise Error.new("invalid_argument", "encrypted BOOL value must be boolean") unless value == true || value == false
+          value ? "\x01".b : "\x00".b
+        when Protocol::KIND_INT8
+          raise Error.new("invalid_argument", "encrypted int value out of range") if value < -0x80 || value > 0x7F
+          [value].pack("c")
+        when Protocol::KIND_INT16
+          raise Error.new("invalid_argument", "encrypted int value out of range") if value < -0x8000 || value > 0x7FFF
+          [value].pack("s<")
+        when Protocol::KIND_INT32
+          raise Error.new("invalid_argument", "encrypted int value out of range") if value < -0x80000000 || value > 0x7FFFFFFF
+          [value].pack("l<")
+        when Protocol::KIND_INT64
+          raise Error.new("invalid_argument", "encrypted int value out of range") if value < -0x8000000000000000 || value > 0x7FFFFFFFFFFFFFFF
+          [value].pack("q<")
+        when Protocol::KIND_UINT8
+          raise Error.new("invalid_argument", "encrypted uint value out of range") if value.negative? || value > 0xFF
+          [value].pack("C")
+        when Protocol::KIND_UINT16
+          raise Error.new("invalid_argument", "encrypted uint value out of range") if value.negative? || value > 0xFFFF
+          [value].pack("S<")
+        when Protocol::KIND_UINT32
+          raise Error.new("invalid_argument", "encrypted uint value out of range") if value.negative? || value > 0xFFFFFFFF
+          [value].pack("L<")
+        when Protocol::KIND_UINT64
+          raise Error.new("invalid_argument", "encrypted uint value out of range") if value.negative? || value > 0xFFFFFFFFFFFFFFFF
+          [value].pack("Q<")
+        when Protocol::KIND_TIMESTAMPTZ
+          if value.is_a?(Time)
+            ns = (value.to_r * 1_000_000_000).to_i
+            [ns].pack("q<")
+          elsif value.is_a?(Integer)
+            [value].pack("q<")
+          else
+            raise Error.new("invalid_argument", "encrypted TIMESTAMPTZ value must be Time or unix nanoseconds")
+          end
+        when Protocol::KIND_DECIMAL
+          dec_str = value.is_a?(BigDecimal) ? value.to_s("F") : value.to_s
+          Protocol.encode_decimal(dec_str)
+        when Protocol::KIND_JSON
+          json_str = value.is_a?(String) ? value : JSON.generate(value)
+          b = json_str.encode("utf-8").b
+          [b.bytesize].pack("V") + b
+        else
+          raise Error.new("invalid_argument", "unsupported client-encrypted type")
+        end
+      end
+
+      def decode_scalar(ft, raw)
+        case ft.kind
+        when Protocol::KIND_UUID
+          raise Error.new("invalid_format", "invalid encrypted UUID payload") if raw.bytesize != 16
+          Protocol.format_uuid(raw)
+        when Protocol::KIND_STRING, Protocol::KIND_TEXT
+          raise Error.new("invalid_format", "truncated string payload") if raw.bytesize < 4
+          len = raw[0, 4].unpack1("V")
+          raise Error.new("invalid_format", "string payload length mismatch") if raw.bytesize != 4 + len
+          raw[4..].force_encoding("utf-8")
+        when Protocol::KIND_BLOB
+          raise Error.new("invalid_format", "truncated blob payload") if raw.bytesize < 4
+          len = raw[0, 4].unpack1("V")
+          raise Error.new("invalid_format", "blob payload length mismatch") if raw.bytesize != 4 + len
+          raw[4..]
+        when Protocol::KIND_BOOL
+          raise Error.new("invalid_format", "invalid encrypted bool payload") if raw.bytesize != 1
+          raw.getbyte(0) != 0
+        when Protocol::KIND_INT8
+          raise Error.new("invalid_format", "invalid encrypted int payload") if raw.bytesize != 1
+          raw.unpack1("c")
+        when Protocol::KIND_INT16
+          raise Error.new("invalid_format", "invalid encrypted int payload") if raw.bytesize != 2
+          raw.unpack1("s<")
+        when Protocol::KIND_INT32
+          raise Error.new("invalid_format", "invalid encrypted int payload") if raw.bytesize != 4
+          raw.unpack1("l<")
+        when Protocol::KIND_INT64
+          raise Error.new("invalid_format", "invalid encrypted int payload") if raw.bytesize != 8
+          raw.unpack1("q<")
+        when Protocol::KIND_UINT8
+          raise Error.new("invalid_format", "invalid encrypted uint payload") if raw.bytesize != 1
+          raw.unpack1("C")
+        when Protocol::KIND_UINT16
+          raise Error.new("invalid_format", "invalid encrypted uint payload") if raw.bytesize != 2
+          raw.unpack1("S<")
+        when Protocol::KIND_UINT32
+          raise Error.new("invalid_format", "invalid encrypted uint payload") if raw.bytesize != 4
+          raw.unpack1("L<")
+        when Protocol::KIND_UINT64
+          raise Error.new("invalid_format", "invalid encrypted uint payload") if raw.bytesize != 8
+          raw.unpack1("Q<")
+        when Protocol::KIND_TIMESTAMPTZ
+          raise Error.new("invalid_format", "invalid encrypted timestamptz payload") if raw.bytesize != 8
+          ns = raw.unpack1("q<")
+          Time.at(Rational(ns, 1_000_000_000)).utc
+        when Protocol::KIND_DECIMAL
+          raise Error.new("invalid_format", "truncated decimal payload") if raw.bytesize < 4
+          len = raw[0, 4].unpack1("V")
+          raise Error.new("invalid_format", "decimal payload length mismatch") if raw.bytesize != 4 + len
+          Protocol.decode_decimal(raw[4..])
+        when Protocol::KIND_JSON
+          raise Error.new("invalid_format", "truncated json payload") if raw.bytesize < 4
+          len = raw[0, 4].unpack1("V")
+          raise Error.new("invalid_format", "json payload length mismatch") if raw.bytesize != 4 + len
+          JSON.parse(raw[4..].force_encoding("utf-8"))
+        else
+          raise Error.new("invalid_format", "unsupported client-encrypted type")
+        end
+      end
+
+      # --- RFC 5297 AES-SIV implementation ---
+
+      def hkdf_sha256(ikm, info, length = 32)
+        prk = OpenSSL::HMAC.digest("SHA256", "".b, ikm)
+        t = "".b
+        okm = +"".b
+        i = 1
+        while okm.bytesize < length
+          t = OpenSSL::HMAC.digest("SHA256", prk, t + info + [i].pack("C"))
+          okm << t
+          i += 1
+        end
+        okm[0, length]
+      end
+
+      def aes_block(key, block)
+        c = OpenSSL::Cipher.new("aes-128-ecb")
+        c.encrypt
+        c.key = key
+        c.padding = 0
+        c.update(block) + c.final
+      end
+
+      def dbl(block)
+        out = +"\x00".b * 16
+        carry = 0
+        15.downto(0) do |i|
+          b = block.getbyte(i)
+          out.setbyte(i, ((b << 1) & 0xFF) | carry)
+          carry = (b >> 7) & 1
+        end
+        out.setbyte(15, out.getbyte(15) ^ 0x87) if carry != 0
+        out
+      end
+
+      def xor_16(a, b)
+        res = +"\x00".b * 16
+        16.times { |i| res.setbyte(i, a.getbyte(i) ^ b.getbyte(i)) }
+        res
+      end
+
+      def cmac(key, message)
+        k1 = dbl(aes_block(key, "\x00".b * 16))
+        k2 = dbl(k1)
+        n = message.bytesize
+        blocks = [1, (n + 15) / 16].max
+        last = if n.positive? && (n % 16).zero?
+                 xor_16(message[(n - 16)..], k1)
+               else
+                 rem = n % 16
+                 pad = message[(n - rem)..] + "\x80".b + ("\x00".b * (15 - rem))
+                 xor_16(pad, k2)
+               end
+        y = "\x00".b * 16
+        (blocks - 1).times do |i|
+          blk = message[(i * 16), 16]
+          y = aes_block(key, xor_16(y, blk))
+        end
+        aes_block(key, xor_16(y, last))
+      end
+
+      def s2v(key, ad, plain)
+        d = dbl(cmac(key, "\x00".b * 16))
+        d = xor_16(d, cmac(key, ad))
+        t = if plain.bytesize >= 16
+              off = plain.bytesize - 16
+              plain[0...off] + xor_16(plain[off..], d)
+            else
+              pad = plain + "\x80".b + ("\x00".b * (15 - plain.bytesize))
+              xor_16(dbl(d), pad)
+            end
+        cmac(key, t)
+      end
+
+      def ctr_crypt(key, tag, input)
+        q = tag.dup
+        q.setbyte(8, q.getbyte(8) & 0x7F)
+        q.setbyte(12, q.getbyte(12) & 0x7F)
+        c = OpenSSL::Cipher.new("aes-128-ctr")
+        c.encrypt
+        c.key = key
+        c.iv = q
+        c.update(input) + c.final
+      end
+    end
+  end
+end

data/lib/nextsql/pool.rb

@@ -0,0 +1,215 @@
+# frozen_string_literal: true
+
+require "monitor"
+
+module NextSQL
+  # Thread-safe connection pool for NextSQL Ruby driver.
+  #
+  #   pool = NextSQL.create_pool(cfg, min_size: 2, max_size: 10)
+  #   pool.with do |conn|
+  #     res = conn.exec("SELECT * FROM users")
+  #   end
+  #
+  #   # Or directly on the pool:
+  #   pool.exec("INSERT INTO logs VALUES ($1)", ["event"])
+  #   pool.close
+  class ConnectionPool
+    class PooledItem
+      attr_reader :conn
+      attr_accessor :last_used
+
+      def initialize(conn)
+        @conn = conn
+        @last_used = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+    end
+
+    def initialize(config, min_size: 1, max_size: 10, timeout: 30.0, max_idle: 300.0, statement_cache_size: 50)
+      raise Error.new("invalid_argument", "min_size must be >= 0") if min_size < 0
+      raise Error.new("invalid_argument", "max_size must be >= 1") if max_size < 1
+      raise Error.new("invalid_argument", "max_size must be >= min_size") if max_size < min_size
+      raise Error.new("invalid_argument", "statement_cache_size must be >= 0") if statement_cache_size < 0
+
+      @config = config.dup
+      @config.statement_cache_size = statement_cache_size if @config.respond_to?(:statement_cache_size=)
+      @min_size = min_size
+      @max_size = max_size
+      @timeout = timeout
+      @max_idle = max_idle
+
+      @monitor = Monitor.new
+      @cond = @monitor.new_cond
+      @idle = []
+      @in_use = {}.compare_by_identity
+      @closed = false
+
+      if min_size > 0
+        min_size.times do
+          begin
+            conn = Connection.connect(@config)
+            @idle << PooledItem.new(conn)
+          rescue StandardError
+            close
+            raise
+          end
+        end
+      end
+    end
+
+    def size
+      @monitor.synchronize { @idle.size + @in_use.size }
+    end
+
+    def idle_count
+      @monitor.synchronize { @idle.size }
+    end
+
+    def in_use_count
+      @monitor.synchronize { @in_use.size }
+    end
+
+    def closed?
+      @monitor.synchronize { @closed }
+    end
+
+    # Acquires a connection from the pool, waiting up to +timeout+ seconds if
+    # all connections are currently in use.
+    def acquire(timeout: nil)
+      wait_time = timeout || @timeout
+      deadline = wait_time > 0 ? Process.clock_gettime(Process::CLOCK_MONOTONIC) + wait_time : Float::INFINITY
+
+      @monitor.synchronize do
+        loop do
+          raise Error.new("unavailable", "connection pool is closed") if @closed
+
+          now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          while (item = @idle.pop)
+            if @max_idle > 0 && (now - item.last_used) > @max_idle
+              safe_close(item.conn)
+              next
+            end
+            if !alive?(item.conn)
+              safe_close(item.conn)
+              next
+            end
+            @in_use[item.conn] = item
+            return item.conn
+          end
+
+          if (@idle.size + @in_use.size) < @max_size
+            conn = Connection.connect(@config)
+            item = PooledItem.new(conn)
+            @in_use[conn] = item
+            return conn
+          end
+
+          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          if remaining <= 0
+            raise Error.new("resource_exhausted", "connection pool exhausted, wait timeout exceeded")
+          end
+
+          @cond.wait([remaining, 0.5].min)
+        end
+      end
+    end
+
+    # Returns a connection to the pool.
+    def release(conn)
+      @monitor.synchronize do
+        item = @in_use.delete(conn)
+        return if item.nil?
+
+        if @closed
+          safe_close(conn)
+          @cond.signal
+          return
+        end
+
+        unless clean_connection(item)
+          safe_close(conn)
+          @cond.signal
+          return
+        end
+
+        item.last_used = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        @idle << item
+        @cond.signal
+      end
+    end
+
+    # Checks out a connection for the duration of the block and guarantees its
+    # release even if the block raises.
+    def with(timeout: nil)
+      conn = acquire(timeout: timeout)
+      begin
+        yield conn
+      ensure
+        release(conn)
+      end
+    end
+
+    # Executes a statement on a pooled connection and returns the result.
+    def exec(sql, params = nil)
+      with { |conn| conn.exec(sql, params) }
+    end
+
+    # Queries a statement on a pooled connection, buffering all rows into
+    # a Result before releasing the connection.
+    def query(sql, params = nil)
+      with do |conn|
+        rows = conn.query(sql, params)
+        rows.collect
+      end
+    end
+
+    # Closes all idle and active connections in the pool.
+    def close
+      @monitor.synchronize do
+        return if @closed
+
+        @closed = true
+        @idle.each { |item| safe_close(item.conn) }
+        @idle.clear
+
+        @in_use.each_key { |conn| safe_close(conn) }
+        @in_use.clear
+
+        @cond.broadcast
+      end
+    end
+
+    private
+
+    def safe_close(conn)
+      conn.close
+    rescue StandardError
+      nil
+    end
+
+    def alive?(conn)
+      if conn.instance_variable_defined?(:@sock) && conn.instance_variable_get(:@sock).nil?
+        return false
+      end
+      true
+    rescue StandardError
+      true
+    end
+
+    def clean_connection(item)
+      item.conn.exec("ROLLBACK")
+      true
+    rescue StandardError
+      false
+    end
+  end
+
+  def self.create_pool(config, min_size: 1, max_size: 10, timeout: 30.0, max_idle: 300.0)
+    ConnectionPool.new(
+      config,
+      min_size: min_size,
+      max_size: max_size,
+      timeout: timeout,
+      max_idle: max_idle,
+    )
+  end
+end

data/lib/nextsql/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module NextSQL
-  VERSION = "0.1.1"
+  VERSION = "0.2.0"
 end

data/lib/nextsql.rb

@@ -25,8 +25,10 @@
 require_relative "nextsql/version"
 require_relative "nextsql/errors"
 require_relative "nextsql/protocol"
+require_relative "nextsql/field_encryption"
 require_relative "nextsql/client"
 require_relative "nextsql/cluster"
+require_relative "nextsql/pool"
 
 module NextSQL
   READ_STRONG = Protocol::READ_STRONG
@@ -65,4 +67,9 @@ module NextSQL
   def self.connect_cluster(cfg)
     Cluster.connect(cfg)
   end
+
+  # Creates a connection pool managing a set of connections to a NextSQL server.
+  def self.create_pool(cfg, **kwargs)
+    ConnectionPool.new(cfg, **kwargs)
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bzync-nextsql
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Rayan Reynaldo
@@ -10,8 +10,8 @@ cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies: []
 description: 'Native-protocol client for NextSQL: TLS 1.3, prepared statements, follower-read
-  routing, and NSCE1 client-side field encryption. Keys and passwords are never accepted
-  in a URL.'
+  routing, and NSCE1/NSCE2 client-side field encryption. Keys and passwords are never
+  accepted in a URL.'
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -22,6 +22,8 @@ files:
 - lib/nextsql/client.rb
 - lib/nextsql/cluster.rb
 - lib/nextsql/errors.rb
+- lib/nextsql/field_encryption.rb
+- lib/nextsql/pool.rb
 - lib/nextsql/protocol.rb
 - lib/nextsql/version.rb
 homepage: https://nextsql.bzync.com/docs/drivers
@@ -47,7 +49,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.20
+rubygems_version: 4.0.23
 specification_version: 4
 summary: Official NextSQL Ruby driver. Speaks the native NSQL v1 protocol.
 test_files: []