Honor requested key usages in RSA generateKey

- msrcryptoRsa.generateKeyPair previously ignored the caller's requested
  usages (the usages: null || ... was a dead no-op) and forced a fixed pair,
  unlike AES/ECDH/ECDSA and RSA importKey which preserve p.usages.

- It now filters the requested usages into the half each applies to:
  verify/sign for RSASSA-PKCS1-v1_5 and RSA-PSS; encrypt/wrapKey (public) and
  decrypt/unwrapKey (private) for RSA-OAEP/RSAES. Defaults to all valid usages
  when none are requested.

- Fixes generating an RSA-OAEP key with ["wrapKey","unwrapKey"] producing a
  key that could not be used with subtle.wrapKey (rejected InvalidAccessError).

Author: ljoy913

CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- `SubtleCrypto.generateKey` for RSA algorithms now honors the requested key
+  usages (routing each usage to the public or private key it applies to)
+  instead of forcing a fixed pair. Generating an `RSA-OAEP` key with
+  `["wrapKey", "unwrapKey"]` now yields keys usable with `wrapKey`/`unwrapKey`.
+
+### Removed
+
+- Dead, unreachable `wrapKey.js` module (legacy JWE-style key wrapping that was
+  never dispatched) and its orphaned JWK byte-serializer helper. The public
+  `wrapKey`/`unwrapKey` continue to work via the standard
+  export-then-encrypt / decrypt-then-import path.
+
 ## [1.7.0] - 2026-06-25
 
 ### Added

src/rsa.js

@@ -463,14 +463,23 @@ if (typeof operations !== "undefined") {
         var algName = p.algorithm.name;
         var rsaKeyType = algName.slice(algName.indexOf("-") + 1).toUpperCase();
 
+        // The usages valid for each half of the key pair for this algorithm.
         var publicUsage, privateUsage;
 
         if (algName === "RSASSA-PKCS1-V1_5" || algName === "RSA-PSS") {
             publicUsage = ["verify"];
             privateUsage = ["sign"];
         } else { // OAEP, RSAES
-            publicUsage = ["encrypt"];
-            privateUsage = ["decrypt"];
+            publicUsage = ["encrypt", "wrapKey"];
+            privateUsage = ["decrypt", "unwrapKey"];
+        }
+
+        // Honor the caller's requested usages (like the other algorithms do),
+        // routing each requested usage to the key half it applies to. When no
+        // usages are requested, default to all usages valid for the algorithm.
+        if (p.usages) {
+            publicUsage = publicUsage.filter(function(usage) { return p.usages.indexOf(usage) >= 0; });
+            privateUsage = privateUsage.filter(function(usage) { return p.usages.indexOf(usage) >= 0; });
         }
 
         return {
@@ -481,7 +490,7 @@ if (typeof operations !== "undefined") {
                     keyHandle: {
                         algorithm: p.algorithm,
                         extractable: p.extractable,
-                        usages: null || publicUsage,
+                        usages: publicUsage,
                         type: "public"
                     }
                 },
@@ -490,7 +499,7 @@ if (typeof operations !== "undefined") {
                     keyHandle: {
                         algorithm: p.algorithm,
                         extractable: p.extractable,
-                        usages: null || privateUsage,
+                        usages: privateUsage,
                         type: "private"
                     }
                 }