JOSE JWE (experimental, ML-KEM)

JSON Web Encryption (RFC 7516) with ML-KEM-1024 key encapsulation and XChaCha20-Poly1305 AEAD content encryption. Lives under b.jose.jwe.experimental because the JOSE PQC IANA codepoint registration (draft-ietf-jose-pqc-kem-05) hasn't finalized — the namespace name is the contract: codepoints may change between minors without the framework's stable surface being affected.

When the JOSE WG closes the draft and IANA registers final codepoints, the same primitives graduate to b.jose.jwe (or a stable equivalent) with explicit deprecation of the experimental namespace and a one-minor migration window per the framework's stable-upgrade-policy rule.

Compact serialization only — no JSON serialization variant (saves wire-format complexity at this experimental tier; operators that need JWE-JSON wait for the stable surface).

b.jose.jwe.experimental.encrypt(plaintext, recipientPublicKeyPem, opts?) #

{
  typ:           string,        // optional JWE "typ" header
  contentType:   string,        // optional JWE "cty" header
  audit:         boolean,        // default true; emit audit event on encrypt
}

Encrypt a payload under the recipient's ML-KEM-1024 public key. Returns the JWE compact serialization

var pair = b.crypto.generateEncryptionKeyPair();
var jwe = b.jose.jwe.experimental.encrypt("hello", pair.mlkem.publicKey);
typeof jwe; // → "string" (compact form)

{
  audit:         boolean,        // default true
}

var plaintext = b.jose.jwe.experimental.decrypt(jwe, pair.mlkem.privateKey);
plaintext.toString("utf8"); // → "hello"