code: func (t *envelopeTransformer) TransformToStorage(data []byte, context value.Context) ([]byte, error) {
  	newKey, err := generateKey(32)
  	if err != nil {
  		return nil, err
  	}
  
  	encKey, err := t.envelopeService.Encrypt(newKey)
  	if err != nil {
  		return nil, err
  	}
  
  	transformer, err := t.addTransformer(encKey, newKey)
  	if err != nil {
  		return nil, err
  	}
  
  	result, err := transformer.TransformToStorage(data, context)
  	if err != nil {
  		return nil, err
  	}
  	// Append the length of the encrypted DEK as the first 2 bytes.
  	b := cryptobyte.NewBuilder(nil)
  	b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  		b.AddBytes([]byte(encKey))
  	})
  	b.AddBytes(result)
  
  	return b.Bytes()
  }
docs: // TransformToStorage encrypts data to be written to disk using envelope encryption.