:sig
DValue crypto_operation(DValue request)

:params
request : structured operation, algorithm, and operation-specific fields
return value : map with ok, bounded error code, and operation-specific output

:content
Runs one explicitly supported structured asymmetric cryptographic operation. The initial allowlist is `key_generate` with `ES256` and `jwt_sign` with `ES256`. Unknown operations and algorithms fail closed.

ES256 signing validates that `x`, `y`, and `d` form one P-256 key, forces the protected `alg` to `ES256`, and emits a compact JWT with a 64-byte JOSE signature. Requests are capped at 32 KiB; `cbor_decode` accepts at most 16 KiB decoded CBOR (21,846 canonical base64url characters), 256 nodes, and depth 16. CBOR is definite-length only, validates UTF-8 text, preserves typed map keys, rejects structurally duplicate keys and trailing bytes, and reports malformed CBOR as `invalid_cbor`. Header and claims roots must be JSON objects containing valid UTF-8 without raw control bytes.

This function does not replace typed digest, HMAC, password, randomness, or constant-time comparison APIs. It exposes no raw signing, arbitrary curve/digest selection, encryption, or generic OpenSSL access. Keep returned private JWKs secret.

:example
DValue key_request;
key_request["operation"] = "key_generate";
key_request["algorithm"] = "ES256";
DValue key = crypto_operation(key_request);

DValue sign_request;
sign_request["operation"] = "jwt_sign";
sign_request["algorithm"] = "ES256";
sign_request["private_jwk"] = key["private_jwk"];
sign_request["protected_header"]["typ"] = "JWT";
sign_request["claims"]["iss"] = "https://client.example";
DValue signed_jwt = crypto_operation(sign_request);
print(signed_jwt["ok"].to_bool() ? "signed" : "failed", "\n");