AES-GCM encrypted target key bytes (GCM tag included).
12-byte IV.
Initiator's ephemeral X25519 public key (from X3DH).
Initiator's Ed25519 identity public key — needed by the recipient to complete X3DH.
Base64 of the consumed OTK public key — recipient uses it to select their matching OTK private key.
Envelope version.
A key wrapped for a specific recipient via X3DH-based envelope.
Design note (differs from some implementations): the envelope INCLUDES the initiator's Ed25519 identity public key — without it the recipient cannot complete X3DH. Some legacy envelopes omit this field assuming out-of-band knowledge; here it is explicit so envelopes are self-contained.