Encrypted column values with versioned key rotation and optional blind indexes for equality lookups. Framework-agnostic core (AES-256-GCM envelope + HMAC-SHA256 blind index) with opt-in adapters for Sequel, ROM, and Active Record. Ruby companion to the Crystal avram_encrypted shard.