defmodule Towerops.Encrypted.Map do
  @moduledoc """
  Encrypted map field using Cloak vault.

  Used for storing sensitive configuration like API credentials as encrypted JSON.
  Data is encrypted at rest using AES-256-GCM.

  ## Usage

      field :credentials, Towerops.Encrypted.Map

  ## Database Schema

  The database column must be `:binary`:

      add :credentials, :binary

  Note: Atom keys become string keys after decryption.
  """
  use Cloak.Ecto.Map, vault: Towerops.Vault
end
