Stored shape for an encrypted string. A structured object (not a concatenated blob) so the field stays greppable in Mongo and the version tag supports a future re-key/algorithm migration.
Base64-encoded ciphertext.
Base64-encoded 12-byte GCM nonce, fresh per toStored call.
toStored
Base64-encoded 16-byte GCM authentication tag.
Format version (for future re-key / algorithm migration).
Stored shape for an encrypted string. A structured object (not a concatenated blob) so the field stays greppable in Mongo and the version tag supports a future re-key/algorithm migration.