Introduces a C++ `NativeCryptoKey` class that holds the real CryptoKey
slots (`handle_data_`, `algorithm_`, `usages_`, `extractable_`) and
provides structured-clone and worker-transfer support through a dedicated
`CryptoKeyTransferData`. New bindings `createCryptoKeyClass`,
`getCryptoKeyHandle`, and `getCryptoKeySlots` expose the class and
accessors to JS; a brand-tag class-ID pointer rejects spoofed receivers
on the accessors.

Signed-off-by: Filip Skokan <[email protected]>

JS-side `CryptoKey` now extends the native `NativeCryptoKey` created via
`createCryptoKeyClass`. `InternalCryptoKey` caches the
`[type, extractable, algorithm, usages, handle]` slot tuple in a
`#slots` private field on first access; the public getters and
`isCryptoKey` route through dedicated `getCryptoKey{Type,Extractable,
Algorithm,Usages,Handle}` helpers re-exported from this module. Symbol
property storage (`kKeyObject`, `kAlgorithm`, `kExtractable`,
`kKeyUsages`, `kCachedAlgorithm`, `kCachedKeyUsages`) is gone;
`kKeyObject` is dropped from `internal/crypto/util` exports.

`deepStrictEqual` on CryptoKey switches to the new accessors plus
`handle.equals()` (instead of structural compare on wrapper objects).
An ESLint rule forbids destructuring `getCryptoKeyHandle` from
`internalBinding('crypto')`; it must come from `internal/crypto/keys`
so the brand-check path is used.

Signed-off-by: Filip Skokan <[email protected]>

Every Web Crypto algorithm module drops `key[kKeyObject][kHandle]`
symbol access in favor of `getCryptoKey*` accessors and stores the raw
`KeyObjectHandle` directly (no more `SecretKeyObject`/`PublicKeyObject`/
`PrivateKeyObject` wrappers on the CryptoKey slot). Key generation
moves off the promisified `generateKey`/`generateKeyPair` paths onto
ones that return `KeyObjectHandle` (i.e. not wrapped in KeyObject):

  - `SecretKeyGenJob` for AES, ChaCha20-Poly1305, HMAC/CMAC (aes.js,
    chacha20_poly1305.js, mac.js).
  - `EcKeyPairGenJob` for ECDSA, ECDH (ec.js).
  - `NidKeyPairGenJob` for Ed25519/Ed448/X25519/X448, ML-DSA-{44,65,87},
    ML-KEM-{512,768,1024} (cfrg.js, ml_dsa.js, ml_kem.js).
  - `RsaKeyPairGenJob` for RSASSA-PKCS1-v1_5, RSA-PSS, RSA-OAEP (rsa.js).

`webcrypto_util.js` switches its import helpers (`importDerKey`,
`importJwkKey`, `importRawKey`) to return raw `KeyObjectHandle`s and
adds `importSecretKey` / `importJwkSecretKey` helpers for symmetric
imports. `webcrypto.js` follows the same pattern; its `getPublicKey`
builds a temporary wrapper and carries a TODO for future refactor.
`hkdf.js` switches from `promisify(hkdf)` to
`jobPromise(() => new HKDFJob(...))` directly. `diffiehellman.js`,
`argon2.js`, and `pbkdf2.js` are accessor-only migrations (the
`TODO(panva)` notes on argon2/pbkdf2 are orthogonal and left for a later
cleanup).

Signed-off-by: Filip Skokan <[email protected]>

Loosens two `AdditionalConfig` precondition checks so the new Web Crypto
keygen jobs added earlier (RsaKeyPairGenJob, EcKeyPairGenJob) can reuse
the shared traits without threading unused encoding args through the job
constructor.

  - `RsaKeyGenTraits::AdditionalConfig` now CHECKs RSA key
     type-dependant argument count accounting for being able to skip
     unused parameters.
  - `EcKeyGenTraits::AdditionalConfig` now defaults `param_encoding` to
    `OPENSSL_EC_NAMED_CURVE`, this is not observable in existing
    crypto.generateKeyPair(Sync) as its dispatch already applies the
    same default. This is just so that a stray OPENSSL_EC_NAMED_CURVE
    isn't needed in ec.js

Pure precondition relaxation — no new code paths. Existing
`generateKeyPair` callers still pass the same args and hit the same
branches.

Signed-off-by: Filip Skokan <[email protected]>

Enforces a 1024-byte maximum on `HkdfParams.info` at the WebIDL layer
using refactored `validateMaxBufferLength`. Its error message is also
fixed.

Oversized `info` was already rejected via a different code path. It just
relocates the rejection earlier into the WebIDL conversion step so the
failure reproduces the OpenSSL's limitation early.

Signed-off-by: Filip Skokan <[email protected]>

Tightens `validateJwk` to require the per-`kty` string members up front
(before switching to C++), short-circuiting with the same
`Invalid keyData` message and `DataError` when the JWK is missing
required fields or passes a non-string value for one. In theory non-strings
are already rejected by WebIDL's JWK converter but this doesn't hurt.

  - RSA: requires `n`, `e`; if `d` is present, also requires `p`, `q`,
    `dp`, `dq`, and `qi`.
  - EC:  requires `crv`, `x`, `y`; optional `d`.
  - OKP: requires `crv`, `x`; optional `d`.
  - oct: requires `k`.
  - AKP: requires `alg`, `pub`; optional `priv`.

Four export/import negative tests update their expected error text from
the later "Invalid JWK … Parameter and algorithm name mismatch" to the
new short-circuit "Invalid keyData" (for the case where `crv`/`alg` is
missing entirely). A new `{ kty: 'oct' }` missing-`k` negative is added
for ChaCha20-Poly1305. The tests check error messages but the error
class (DataError/DOMException) is the same everywhere.

Signed-off-by: Filip Skokan <[email protected]>

Adds four focused tests that check guarantees either introduced by the
native `CryptoKey` refactor or carried over from the existing state.

  - `test-webcrypto-cryptokey-brand-check.js` - each of the four
    prototype getters (`type`, `extractable`, `algorithm`, `usages`)
    throws `ERR_INVALID_THIS` for foreign receivers (plain objects,
    null-proto, primitives, null/undefined, functions, a subverted
    `Symbol.hasInstance`, and a real `BaseObject` of a different kind).
    `util.types.isCryptoKey()` remains accurate after a prototype
    swap, confirming it cannot be spoofed.
  - `test-webcrypto-cryptokey-clone-transfer.js` - exhaustive
    structured-clone, `MessagePort.postMessage`, and
    `Worker.postMessage` round-trips.
    Verifies slot preservation, inspect-output equivalence, and that
    crypto operations interoperate across clones including repeated
    round-trips.
  - `test-webcrypto-cryptokey-hidden-slots.js` - replaces all four
    prototype getters with forged versions and confirms internal
    consumers (export, inspect) still read the real native slots.
  - `test-webcrypto-cryptokey-no-own-symbols.js`, asserts CryptoKey
    instances expose no own symbol-keyed properties even after every
    public getter has been touched (proof the `#slots` private field
    plus native storage leaves the instance shape pristine).

Signed-off-by: Filip Skokan <[email protected]>

Adds two benchmarks exercising `subtle.sign` / `subtle.verify` across
the main algorithm families:

  - ECDSA P-256
  - RSASSA-PKCS1-v1_5
  - RSA-PSS
  - Ed25519
  - ML-DSA-44 (gated on OpenSSL >= 3.5)

Each benchmark runs two modes (serial / parallel) × two key-reuse
patterns (shared / unique per call) so regressions in slot-access
hot paths (getCryptoKey* accessors) and in per-call key wrapping
surface on both dimensions.

Signed-off-by: Filip Skokan <[email protected]>

Signed-off-by: Filip Skokan <[email protected]>

Signed-off-by: Filip Skokan <[email protected]>

Signed-off-by: Filip Skokan <[email protected]>