NextSQL

One engine for SQL, JSON, vectors, and search.

Relational data, native JSON, full-text, vectors, and geo share one WAL, one MVCC, and one optimizer. Install the engine and run it.

Get startedDownloadDocumentation

Not PostgreSQL, MySQL, MongoDB, or a vector-store compatibility layer. Native format, dialect, protocol, and drivers.

hybrid.sql
CREATE TABLE products (
    id          UUID PRIMARY KEY DEFAULT UUID(),
    tenant_id   UUID NOT NULL,
    name        STRING NOT NULL,
    description TEXT,
    price       DECIMAL(12,2),
    metadata    JSON,
    embedding   VECTOR<F32,1536>,
    location    POINT,
    created_at  TIMESTAMPTZ DEFAULT NOW()
);

CREATE INDEX ix_category ON products (metadata.category);
CREATE FULLTEXT INDEX ix_desc ON products (description);
CREATE VECTOR INDEX ix_emb ON products (embedding) USING HNSW;

SELECT id, name, price
FROM products
WHERE metadata.category = 'headphones'
  AND price <= 15000
SEARCH description FOR 'wireless noise cancelling'
NEAREST embedding TO $query
LIMIT 20;

Crypto

AES-256-GCM envelope

Wire

NSQL v1 · TLS 1.3

Page

16 KiB logical

HA

Raft, 3 voters

Search

BM25 + HNSW

Engine

Phases 0–15 built

Platform

Built as one engine. Operated with the safety still on.

  1. 01

    One system of record

    Relational columns, JSON, vectors, full-text, and geo live in the same table and the same transaction.

  2. 02

    Encrypted by default

    Pages, WAL, UNDO, indexes, vectors, full-text trees, backups, and spills. Established AES-256-GCM only.

  3. 03

    Keys stay off the disk

    Root unlock is a --key-file you keep off the data volume. Drivers reject keys and passwords in a URL.

  4. 04

    Durable writes

    Group-commit WAL plus fsync before commit is acknowledged. Stolen files stay ciphertext.

  5. 05

    Hybrid in one plan

    Filters, BM25, and ANN share the cost model. Reciprocal rank fusion, then LIMIT. EXPLAIN shows the path.

  6. 06

    Honest operations

    Official benches keep encryption, WAL, fsync, checksums, MVCC, and auth on. Overload returns unavailable.

multimodel

Five models. One physical plan.

That hybrid SELECT is not a federated query. Filters, BM25, and ANN participate in the same cost model. The write path is the same WAL, MVCC, and encryption as a DECIMAL update.

  • RelationalClustered B+Tree, FK, joins, GROUP BY
  • JSONBinary NSJB, path extract, path indexes
  • Full-textInverted index, BM25, phrases
  • VectorsVECTOR<F32,N>, flat + HNSW
  • GeoWGS84 POINT / BOX / LINESTRING
Hybrid queries

# same table, same transaction

SELECT id, name

FROM products

WHERE metadata.category = 'headphones'

SEARCH description FOR 'noise cancelling'

NEAREST embedding TO $query

LIMIT 20;

EXPLAIN → Candidates, Rerank bm25+vector

Encryption protects files at rest. It does not hide plaintext from a live process.

AttackerGetsDoes not get
Stolen disks, WAL, backups, treesCiphertext, wrapped DEKs, key IDsPlaintext without the root unlock key
Network observer (remote)TLS 1.3 recordsSQL, passwords, unlock material
Live unlocked nextsqldKeys, pages, and rows in RAMNothing. The process decrypts to run SQL.

Envelope: external root → KEK → database master → separate DEKs for pages, WAL, UNDO, backup, vector, full-text, temp, and replication. Security docs

Catalog, HNSW, and inverted postings go through the same WAL.

ArchitectureWire protocolSQL dialect
  1. 01Native wire protocol → TLS 1.3 → authn → authz
  2. 02SQL parser → binder / catalog → planner → cost optimizer
  3. 03Vectorized executor: relational · JSON · vector · full-text · geo
  4. 04MVCC + row/range locks + UNDO
  5. 05REDO WAL (group commit, fsync)
  6. 06Buffer manager → AES-256-GCM sealed pages

Native NSQL. No keys in the URL.

Driver docs

Official drivers speak NSQL v1. TLS 1.3 is required off loopback.--insecureis loopback-only.

RuntimePathOpen
Godrivers/gonextsql.Open(nextsql.Config{…})
Node.js 18+drivers/nodeconnect({ address, user, password, tls })
Bundrivers/bunsame shape as Node
Denodrivers/denoimport { connect } from "./mod.ts"
PHP 8.1+drivers/phpNextSQL\Client::connect([…])

Install, init, serve.

Install the nextsql and nextsqld binaries, then initialize a data directory. Keep the root unlock key off the data volume. Loopback may run without TLS; any other bind needs --tls-cert and --tls-key.

Full walkthrough
sh
go install github.com/bzync/nextsql/cmd/nextsql@latest
go install github.com/bzync/nextsql/cmd/nextsqld@latest

printf 'secret\n' > /tmp/nextsql.pw && chmod 600 /tmp/nextsql.pw

nextsql init --data-dir /var/lib/nextsql \
  --key-file /etc/nextsql/root.key \
  --user app --password-file /tmp/nextsql.pw

nextsqld --data-dir /var/lib/nextsql \
  --key-file /etc/nextsql/root.key \
  --listen 127.0.0.1:7210 \
  --user app --password-file /tmp/nextsql.pw
Engine complete

The database is built. Run it on your machine.

Storage, WAL, MVCC, SQL, optimizer, protocol, JSON, full-text, vectors, hybrid plans, security, backup/PITR/export, and Raft HA ship in nextsql and nextsqld. Install the binaries, initialize a data directory, and start serving NSQL.

Get startedInstallLimits