code: func (t *envelopeTransformer) TransformFromStorage(data []byte, context value.Context) ([]byte, bool, error) {
  	// Read the 16 bit length-of-DEK encoded at the start of the encrypted DEK. 16 bits can
  	// represent a maximum key length of 65536 bytes. We are using a 256 bit key, whose
  	// length cannot fit in 8 bits (1 byte). Thus, we use 16 bits (2 bytes) to store the length.
  	var encKey cryptobyte.String
  	s := cryptobyte.String(data)
  	if ok := s.ReadUint16LengthPrefixed(&encKey); !ok {
  		return nil, false, fmt.Errorf("invalid data encountered by envelope transformer: failed to read uint16 length prefixed data")
  	}
  
  	encData := []byte(s)
  
  	// Look up the decrypted DEK from cache or Envelope.
  	transformer := t.getTransformer(encKey)
  	if transformer == nil {
  		value.RecordCacheMiss()
  		key, err := t.envelopeService.Decrypt(encKey)
  		if err != nil {
  			return nil, false, fmt.Errorf("error while decrypting key: %q", err)
  		}
  		transformer, err = t.addTransformer(encKey, key)
  		if err != nil {
  			return nil, false, err
  		}
  	}
  	return transformer.TransformFromStorage(encData, context)
  }
docs: // TransformFromStorage decrypts data encrypted by this transformer using envelope encryption.