devendra-skill-package 1.0.2

package/.github/skills/encryption-decryption-utility/assets/encryption-config-template.json

@@ -0,0 +1,13 @@
+{
+  "encryptionEnabled": false,
+  "approach": null,
+  "publicKeyPem": null,
+  "privateKeyPem": null,
+  "sharedKey": null,
+  "excludeUrls": [],
+  "hmac": {
+    "enabled": false,
+    "secret": null
+  },
+  "debug": false
+}

package/.github/skills/encryption-decryption-utility/assets/platform-matrix.json

@@ -0,0 +1,180 @@
+{
+  "platforms": {
+    "angular": {
+      "approaches": [1, 2, 3],
+      "dependencies": {
+        "1": [],
+        "2": ["jsencrypt", "crypto-js", "@types/crypto-js"],
+        "3": ["crypto-js", "@types/crypto-js"]
+      },
+      "allowedCommonJsDependencies": ["crypto-js", "jsencrypt"],
+      "buildCommand": "ng build",
+      "filePaths": {
+        "config": "src/environments/environment.ts",
+        "service": "src/app/core/encryption/encryption.service.ts",
+        "interceptor": "src/app/core/encryption/encryption.interceptor.ts",
+        "moduleWiring": "src/app/app.module.ts"
+      },
+      "standaloneWiringFile": "src/app/app.config.ts",
+      "fileNamingConvention": "kebab-case",
+      "packageManager": "npm"
+    },
+    "web": {
+      "approaches": [1, 2, 3],
+      "dependencies": {
+        "1": [],
+        "2": ["jsencrypt", "crypto-js"],
+        "3": ["crypto-js"]
+      },
+      "buildCommand": "npm run build",
+      "filePaths": {
+        "config": "src/encryption/encryption.config.js",
+        "service": "src/encryption/encryption.service.js",
+        "interceptor": "src/encryption/encryption.interceptor.js",
+        "moduleWiring": "src/main.js"
+      },
+      "fileNamingConvention": "kebab-case",
+      "packageManager": "npm"
+    },
+    "node": {
+      "approaches": [2, 3],
+      "dependencies": {
+        "2": ["jsencrypt", "crypto-js", "@types/crypto-js"],
+        "3": ["crypto-js", "@types/crypto-js"]
+      },
+      "buildCommand": "npm run build",
+      "filePaths": {
+        "config": "src/encryption/encryption.config.ts",
+        "service": "src/encryption/encryption.service.ts",
+        "interceptor": "src/encryption/encryption.middleware.ts",
+        "moduleWiring": "src/app.ts"
+      },
+      "fileNamingConvention": "kebab-case",
+      "packageManager": "npm"
+    },
+    "android": {
+      "approaches": [2, 3],
+      "dependencies": {
+        "2": [],
+        "3": []
+      },
+      "buildCommand": "./gradlew assembleDebug",
+      "filePaths": {
+        "config": "app/src/main/java/com/example/encryption/EncryptionConfig.kt",
+        "service": "app/src/main/java/com/example/encryption/EncryptionService.kt",
+        "interceptor": "app/src/main/java/com/example/encryption/EncryptionInterceptor.kt",
+        "moduleWiring": "app/src/main/java/com/example/MyApplication.kt"
+      },
+      "fileNamingConvention": "PascalCase",
+      "packageManager": "gradle"
+    },
+    "ios": {
+      "approaches": [1, 2, 3],
+      "dependencies": {
+        "1": [],
+        "2": [],
+        "3": []
+      },
+      "buildCommand": "xcodebuild -scheme App -configuration Debug build",
+      "filePaths": {
+        "config": "Sources/App/Encryption/EncryptionConfig.swift",
+        "service": "Sources/App/Encryption/EncryptionService.swift",
+        "interceptor": "Sources/App/Encryption/EncryptionInterceptor.swift",
+        "moduleWiring": "Sources/App/AppDelegate.swift"
+      },
+      "fileNamingConvention": "PascalCase",
+      "packageManager": "swift-pm"
+    },
+    "react": {
+      "approaches": [1, 2, 3, 7],
+      "dependencies": {
+        "1": ["axios"],
+        "2": ["axios", "jsencrypt", "crypto-js", "@types/crypto-js"],
+        "3": ["axios", "crypto-js", "@types/crypto-js"],
+        "7": ["axios"]
+      },
+      "buildCommand": "npm run build",
+      "filePaths": {
+        "config": "src/encryption/encryption.config.ts",
+        "service": "src/encryption/encryption.service.ts",
+        "interceptor": "src/encryption/encryption.interceptor.ts",
+        "moduleWiring": "src/api/axiosInstance.ts"
+      },
+      "productionFilePaths": {
+        "cryptoUtils": "src/services/security/crypto-utils.ts",
+        "aesService": "src/services/security/aes.service.ts",
+        "rsaService": "src/services/security/rsa.service.ts",
+        "rsaKeyService": "src/services/security/rsa-key.service.ts",
+        "hmacService": "src/services/security/hmac.service.ts",
+        "storageService": "src/services/security/storage.service.ts",
+        "interceptor": "src/services/security/encryption.interceptor.ts",
+        "encryptionConfig": "src/services/security/encryption-config.ts",
+        "types": "src/services/security/types.ts",
+        "moduleWiring": "src/api/axiosInstance.ts"
+      },
+      "ecdhSessionFilePaths": {
+        "base64url": "src/core/security/ecdh-session/base64url.ts",
+        "aad": "src/core/security/ecdh-session/aad.ts",
+        "ecdhSession": "src/core/security/ecdh-session/ecdhSession.ts",
+        "aesGcm": "src/core/security/ecdh-session/aesGcm.ts",
+        "ecdhSessionService": "src/core/security/ecdh-session/ecdhSessionService.ts"
+      },
+      "fileNamingConvention": "kebab-case",
+      "packageManager": "npm"
+    },
+    "react-native": {
+      "approaches": [2, 3, 4, 5, 6],
+      "dependencies": {
+        "2": ["axios", "jsencrypt", "crypto-js", "@types/crypto-js", "react-native-get-random-values"],
+        "3": ["axios", "crypto-js", "@types/crypto-js", "react-native-get-random-values"],
+        "4": ["axios", "react-native-quick-crypto", "@craftzdog/react-native-buffer", "react-native-keychain", "react-native-get-random-values"],
+        "5": ["axios", "react-native-quick-crypto", "@craftzdog/react-native-buffer", "react-native-keychain", "react-native-get-random-values"],
+        "6": ["axios", "react-native-quick-crypto", "buffer", "react-native-keychain", "react-native-get-random-values"]
+      },
+      "entryPolyfillFile": "index.js",
+      "buildCommand": "npx react-native run-android",
+      "filePaths": {
+        "config": "src/encryption/encryption.config.ts",
+        "service": "src/encryption/encryption.service.ts",
+        "interceptor": "src/encryption/encryption.interceptor.ts",
+        "moduleWiring": "src/api/axiosInstance.ts"
+      },
+      "productionFilePaths": {
+        "types": "src/services/security/types.ts",
+        "encryptionService": "src/services/security/encryption.service.ts",
+        "decryptionService": "src/services/security/decryption.service.ts",
+        "rsaKeyService": "src/services/security/rsa-key.service.ts",
+        "keychainService": "src/services/security/keychain.service.ts",
+        "hmacService": "src/services/security/hmac.service.ts",
+        "encryptionConfig": "src/services/security/encryption-config.ts",
+        "interceptor": "src/services/security/encryption.interceptor.ts",
+        "moduleWiring": "src/api/axiosInstance.ts"
+      },
+      "nativeFilePaths": {
+        "androidModule": "android/app/src/main/java/com/example/security/NativeCryptoModule.kt",
+        "androidPackage": "android/app/src/main/java/com/example/security/NativeCryptoPackage.kt",
+        "iosModule": "ios/NativeCryptoModule.swift",
+        "iosBridge": "ios/NativeCryptoModule.m",
+        "jsBridge": "src/services/security/native-crypto.module.ts"
+      },
+      "fileNamingConvention": "kebab-case",
+      "packageManager": "npm"
+    },
+    "flutter": {
+      "approaches": [2, 3],
+      "dependencies": {
+        "2": ["encrypt: ^5.0.3", "pointycastle: ^3.7.3"],
+        "3": ["encrypt: ^5.0.3", "pointycastle: ^3.7.3"]
+      },
+      "buildCommand": "flutter build apk --debug",
+      "filePaths": {
+        "config": "lib/core/encryption/encryption_config.dart",
+        "service": "lib/core/encryption/encryption_service.dart",
+        "interceptor": "lib/core/encryption/encryption_interceptor.dart",
+        "moduleWiring": "lib/main.dart"
+      },
+      "fileNamingConvention": "snake_case",
+      "packageManager": "pub"
+    }
+  }
+}

package/.github/skills/encryption-decryption-utility/metadata.yaml

@@ -0,0 +1,51 @@
+name: encryption-decryption-utility
+version: 1.1.0
+status: active
+category: security
+platforms:
+  - angular
+  - react
+  # - react-native
+  - web
+  - android
+  - ios
+  # - flutter
+  # - node
+tags:
+  - encryption
+  - decryption
+  - rsa
+  - aes
+  - ecdh
+  - hmac
+  - interceptor
+  - security
+  - crypto
+  - web-crypto
+  - keychain
+  - token-storage
+  - react-web
+  - browser-crypto
+owner: mohit-pwa-skill-development-team
+changelog:
+  - version: 1.1.0
+    date: 2026-06-24
+    changes:
+      - Added approach 7 — React JS web production mode (AES-256-GCM + RSA-OAEP or ECDH-Session via built-in Web Crypto API)
+      - New reference file references/react-web-crypto.md — full approach 7 implementation reference
+      - platform-matrix.json — approach 7 added to react platform with productionFilePaths and ecdhSessionFilePaths
+      - SKILL.md — approach 7 minimum completion scope, Step 6c, rules 28-40, Inputs/Outputs/Dependencies table rows
+      - config-questionnaire.md — Question 0a, Q7-1 through Q7-6, approach 7 validation status section
+      - implementation-plan.md — React JS approach 7 dependency plan, file tables, runtime behaviour, feature flags, testing plan
+      - delivery-checklist.md — approach 7 RSA-OAEP and ECDH-Session implementation checklists, security and CORS items
+      - No changes to approaches 1-6 or any other platform — fully additive
+  - version: 1.0.0
+    date: 2026-05-05
+    changes:
+      - Initial release of encryption-decryption-utility skill metadata
+      - Support for Angular, React, React Native (JS + Native), Web, Node.js, Android, iOS, Flutter
+      - Six cryptographic approaches including RSA-OAEP+AES-256-GCM, RSA+AES-256-CBC, AES-256-CBC shared key, EC ECDH+AES-256-GCM
+      - Zero-dependency Node.js scripts for detection, install, and setup
+      - HMAC signing support and per-URL exclusion lists
+      - Single-run execution contract with config-questionnaire-driven flow
+      - backend-alignment.md spec for server-side contract sharing

package/.github/skills/encryption-decryption-utility/references/android-crypto.md

@@ -0,0 +1,157 @@
+# Platform: Android (Kotlin)
+
+## Overview
+
+Android uses an **OkHttp Interceptor** (`EncryptionInterceptor`) registered on the OkHttp client.  
+Crypto operations use the built-in `javax.crypto` package.  
+Supports Approaches 1, 2, 3, and 6 using native Android security providers.
+
+> File locations are determined at runtime by `assets/platform-matrix.json` for this platform.
+> Do not hardcode file paths in skill instructions or generated code.
+
+---
+
+## File Naming Convention
+
+| Role           | Path                                                                          |
+|----------------|------------------------------------------------------------------------------|
+| Config         | `app/src/main/java/com/example/encryption/EncryptionConfig.kt`               |
+| Service        | `app/src/main/java/com/example/encryption/EncryptionService.kt`              |
+| Interceptor    | `app/src/main/java/com/example/encryption/EncryptionInterceptor.kt`          |
+| Module wiring  | `app/src/main/java/com/example/network/NetworkModule.kt`                     |
+
+---
+
+## MANDATORY INTERACTIVE PROMPT SEQUENCE (Fresh Implementation)
+
+> **This section applies whenever no existing centralized `EncryptionService` is found in the project.**
+> **It is not optional. It is not skippable. It runs before Step 3 of the skill and before any file is generated.**
+> The agent MUST ask each question below, wait for the user's answer, and record the response before proceeding.
+> Do NOT infer, assume, or pre-fill any answer. Do NOT proceed to implementation until every question is answered.
+
+---
+
+### Prompt 1 — Encryption approach
+
+Ask the user exactly this question and wait for their answer:
+
+```
+Which encryption approach should be used for this Android project?
+
+  1 — RSA-OAEP + AES-256-GCM   (asymmetric hybrid; modern authenticated encryption)
+  2 — RSA + AES-256-CBC       (asymmetric hybrid; legacy compatibility)
+  3 — AES-256-CBC shared key  (symmetric; requires a shared secret string)
+  6 — ECDH + AES-256-GCM      (Elliptic Curve; highest security with Forward Secrecy)
+
+Enter 1, 2, 3, or 6:
+```
+
+- Do not proceed until the user answers with 1, 2, 3, or 6.
+- Do not default to any option if the user does not answer immediately.
+- If the user answers outside the valid range, re-ask.
+
+---
+
+### Prompt 2 — Key material
+
+After Prompt 1 is answered, ask the appropriate follow-up:
+
+**If approach 1 or 2:**
+```
+Provide the RSA public key PEM that will be used to encrypt the AES session key.
+The server must hold the corresponding private key to decrypt it.
+
+Paste the PEM (begins with -----BEGIN PUBLIC KEY-----):
+```
+
+**If approach 3:**
+```
+Provide the shared secret string (minimum 32 characters).
+This exact same secret must also be configured on the server.
+
+Enter shared secret:
+```
+
+**If approach 6:**
+```
+Provide the Server's Public EC Key (Uncompressed HEX or PEM).
+The app will use this to perform the ECDH key agreement.
+
+Enter Server EC Public Key:
+```
+
+**If the user says they want to reuse an existing Keystore entry:**
+```
+Provide the Android Keystore alias that holds the key material:
+```
+
+- Do not proceed until the user provides actual key material.
+- Do not accept placeholder strings.
+- Validate inputs based on approach requirements.
+
+---
+
+### Prompt 3 — Backend decryption scope
+
+```
+Will a backend server decrypt the data encrypted by this service?
+
+  yes — server decryption is in scope; I confirm the server uses the same algorithm and key
+  no  — local/demo only; encryption and decryption happen within this app only
+
+Enter yes or no:
+```
+
+---
+
+### Prompt 4 — HMAC signing
+
+```
+Should requests include an HMAC signature for integrity verification?
+
+  yes — HMAC-SHA256 signing enabled (requires ENCRYPTION_HMAC_SECRET environment variable at runtime)
+  no  — no HMAC signing
+
+Enter yes or no:
+```
+
+---
+
+### Prompt 5 — URL exclusions
+
+```
+Are there any URL prefixes that should NOT be encrypted?
+(e.g. /api/health, /api/upload for multipart endpoints)
+
+Enter comma-separated prefixes, or press Enter to skip:
+```
+
+---
+
+## MANDATORY Pre-Implementation Rules
+
+---
+
+### Rule 1 — Algorithm and approach must be explicitly confirmed before any code is written
+
+The approach (1, 2, 3, or 6) **must be stated explicitly** by the user before a single line of cryptographic code is generated.
+
+---
+
+### Rule 2 — Key material source must be explicitly confirmed; random keys are forbidden for AES
+
+**Never generate a random symmetric key** as the primary root key. The root material must be user-confirmed.
+
+---
+
+### Rule 3 — Scan for existing encryption and Keystore implementations before creating anything new
+
+Always run `detect.js` or equivalent scan to avoid duplication.
+
+---
+
+## Build Command
+
+```bash
+gradlew.bat assembleDebug
+```

package/.github/skills/encryption-decryption-utility/references/angular-crypto.md

@@ -0,0 +1,130 @@
+# Platform: Angular
+
+## Overview
+
+Angular uses an **HttpInterceptor** to transparently encrypt outgoing request bodies.  
+All encryption logic lives in `EncryptionService`; the interceptor calls the service and clones the request.  
+Supports Approaches 1, 2, 3.
+
+---
+
+## File Naming Convention
+
+| Role           | Path                                                        |
+|----------------|-------------------------------------------------------------|
+| Config         | `src/environments/environment.ts`                           |
+| Service        | `src/app/core/encryption/encryption.service.ts`             |
+| Interceptor    | `src/app/core/encryption/encryption.interceptor.ts`         |
+| Module wiring  | `src/app/app.module.ts` (NgModule) OR `src/app/app.config.ts` (standalone) |
+
+---
+
+## Module Wiring
+
+### NgModule projects
+
+Add to `providers` in `AppModule`:
+
+```ts
+import { HTTP_INTERCEPTORS } from '@angular/common/http';
+import { EncryptionInterceptor } from './core/encryption/encryption.interceptor';
+
+providers: [
+  {
+    provide:  HTTP_INTERCEPTORS,
+    useClass: EncryptionInterceptor,
+    multi:    true,
+  },
+  // ENCRYPTION_INTERCEPTOR_PLACEHOLDER
+]
+```
+
+### Standalone projects (NgModule-free, no AppModule)
+
+`app.module.ts` does not exist. Patch `src/app/app.config.ts` instead:
+
+```ts
+import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http';
+import { HTTP_INTERCEPTORS } from '@angular/common/http';
+import { EncryptionInterceptor } from './core/encryption/encryption.interceptor';
+// ENCRYPTION_INTERCEPTOR_PLACEHOLDER
+
+export const appConfig: ApplicationConfig = {
+  providers: [
+    provideRouter(routes),
+    provideHttpClient(withInterceptorsFromDi()),
+    {
+      provide:  HTTP_INTERCEPTORS,
+      useClass: EncryptionInterceptor,
+      multi:    true,
+    },
+  ]
+};
+```
+
+The `standaloneWiringFile` field in `platform-matrix.json` controls which file is patched when `app.module.ts` is absent.
+
+---
+
+## Interceptor Pattern
+
+```ts
+@Injectable()
+export class EncryptionInterceptor implements HttpInterceptor {
+  constructor(private encryptionService: EncryptionService) {}
+
+  intercept(req: HttpRequest<unknown>, next: HttpHandler): Observable<HttpEvent<unknown>> {
+    if (!environment.encryption.enabled) return next.handle(req);
+    if (req.body instanceof FormData)    return next.handle(req);
+
+    return from(this.encryptionService.encrypt(req.body as object)).pipe(
+      switchMap(encrypted => next.handle(req.clone({ body: encrypted }))),
+      catchError(()       => next.handle(req))
+    );
+  }
+}
+```
+
+---
+
+## URL Exclusion Pattern
+
+```ts
+const excludeUrls: string[] = environment.encryption.excludeUrls;
+if (excludeUrls.some(prefix => req.url.startsWith(prefix))) {
+  return next.handle(req);
+}
+```
+
+---
+
+## Dependencies (Approach 2 or 3)
+
+```bash
+npm install jsencrypt crypto-js
+npm install --save-dev @types/crypto-js
+```
+
+Approach 1 uses the browser-native `crypto.subtle` — no extra packages.
+
+### Suppress CommonJS build warnings
+
+`crypto-js` and `jsencrypt` are CommonJS packages. Add to `angular.json` under
+`projects.<name>.architect.build.options`:
+
+```json
+"allowedCommonJsDependencies": [
+  "crypto-js",
+  "jsencrypt"
+]
+```
+
+`install.js` reads `allowedCommonJsDependencies` from `platform-matrix.json` to know which packages to list.
+
+---
+
+## Build Command
+
+```bash
+ng build --configuration production
+```

package/.github/skills/encryption-decryption-utility/references/approach-1-webcrypto.md

@@ -0,0 +1,95 @@
+# Approach 1 — RSA-OAEP + AES-256-GCM (Web Crypto)
+
+## Overview
+
+Uses the browser/runtime native **Web Crypto API** (`crypto.subtle`).  
+No third-party library dependencies.  
+Platforms: `angular`, `web`, `ios` (via CryptoKit).  
+**NOT supported on**: `node`, `android`, `flutter` (use Approach 2 or 3).
+
+---
+
+## Payload Shape
+
+```json
+{
+  "encryptedKey":  "<base64 RSA-OAEP wrapped AES key>",
+  "iv":            "<base64 12-byte IV>",
+  "encryptedData": "<base64 AES-GCM ciphertext + auth tag>"
+}
+```
+
+---
+
+## Encryption Flow (client side)
+
+1. Generate a one-time AES-256-GCM key: `crypto.subtle.generateKey({name:"AES-GCM",length:256}, true, ["encrypt"])`
+2. Generate a 12-byte random IV: `crypto.getRandomValues(new Uint8Array(12))`
+3. Encrypt the JSON body: `crypto.subtle.encrypt({name:"AES-GCM",iv}, aesKey, bodyBytes)`
+4. Export the raw AES key: `crypto.subtle.exportKey("raw", aesKey)`
+5. Import the server RSA public key (SPKI, SHA-256): `crypto.subtle.importKey("spki", ...)`
+6. Wrap the AES key with RSA-OAEP: `crypto.subtle.encrypt({name:"RSA-OAEP"}, pubKey, rawAesKey)`
+7. Base64-encode all three results and return the payload object
+
+---
+
+## Decryption Flow (backend — Node.js example)
+
+```js
+const crypto = require('crypto');
+
+async function decryptPayload(payload, privateKeyPem) {
+  const privateKey = crypto.createPrivateKey(privateKeyPem);
+
+  const encryptedKey  = Buffer.from(payload.encryptedKey,  'base64');
+  const iv            = Buffer.from(payload.iv,            'base64');
+  const encryptedData = Buffer.from(payload.encryptedData, 'base64');
+
+  const aesKeyBuffer = crypto.privateDecrypt(
+    { key: privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: 'sha256' },
+    encryptedKey
+  );
+
+  const aesKey = await crypto.subtle.importKey('raw', aesKeyBuffer, { name: 'AES-GCM' }, false, ['decrypt']);
+  const decrypted = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, aesKey, encryptedData);
+  return JSON.parse(Buffer.from(decrypted).toString('utf8'));
+}
+```
+
+---
+
+## iOS Mapping (CryptoKit)
+
+- AES-256-GCM → `AES.GCM.seal(data, using: symmetricKey)`
+- RSA-OAEP     → `SecKeyCreateEncryptedData(pubKey, .rsaEncryptionOAEPSHA256, keyData, &error)`
+- IV embedded in `AES.GCM.SealedBox.combined`
+
+---
+
+## Key Generation (OpenSSL)
+
+```bash
+# RSA-2048 key pair
+openssl genrsa -out private.pem 2048
+openssl rsa -in private.pem -pubout -out public.pem
+```
+
+---
+
+## Required Config Fields
+
+| Field         | Required | Notes                          |
+|---------------|----------|-------------------------------|
+| approach      | Yes      | Must be `1`                   |
+| publicKeyPem  | Yes      | SPKI PEM, whitespace removed  |
+| privateKeyPem | No       | Only if response is encrypted |
+
+---
+
+## Platform Dependencies (install.js uses platform-matrix.json)
+
+| Platform | Package                | Notes                          |
+|----------|------------------------|-------------------------------|
+| angular  | none                   | Uses browser `crypto.subtle`   |
+| web      | none                   | Uses browser `crypto.subtle`   |
+| ios      | CryptoKit (built-in)   | Swift >= 5.4                   |