Build an encrypted messaging app

The DID document holds the X25519 public key used for envelope encryption.

const doc = await tz.call("resolve_did_document", {
  did: "did:tenzro:human:..."
});

Derive a shared secret via X25519, then encrypt with AES-256-GCM.

const sealed = await tz.call("envelope_encrypt", {
  recipient_pubkey: doc.keyAgreement[0].publicKeyBase58,
  plaintext: utf8("hello")
});

The A2A protocol relays the ciphertext envelope addressed to the recipient DID.

await tz.call("send_agent_message", {
  to: recipientDid,
  payload_b64: base64(sealed),
  encoding: "x25519+aes-gcm"
});

The recipient unwraps with their MPC-held private key — the server never sees plaintext.

const plaintext = await tz.call("envelope_decrypt", { sealed });