devendra-skill-package 1.0.2

package/.github/skills/encryption-decryption-utility/scripts/install.js

@@ -0,0 +1,1713 @@
+#!/usr/bin/env node
+/**
+ * install.js - Encryption-Decryption Generator Skill
+ *
+ * Deterministic file writer. Accepts a fully resolved config JSON and writes
+ * all generated encryption files into the target project.
+ * No interactive prompts. Idempotent: same config always produces same output.
+ *
+ * Usage:
+ *   node install.js --config-json <path> [--dry-run]
+ *   node install.js --help
+ *
+ * Exit codes:
+ *   0  All files written successfully
+ *   1  Config JSON missing or invalid
+ *   2  File write error
+ */
+
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+
+const args = process.argv.slice(2);
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+const SKILL_ROOT  = path.resolve(__dirname, '..');
+const MATRIX_PATH = path.join(SKILL_ROOT, 'assets', 'platform-matrix.json');
+
+function loadJson(filePath, label) {
+  if (!fs.existsSync(filePath)) {
+    console.error('Error: ' + label + ' not found: ' + filePath);
+    process.exit(1);
+  }
+  try {
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  } catch (e) {
+    console.error('Error: ' + label + ' is not valid JSON: ' + e.message);
+    process.exit(1);
+  }
+}
+
+function writeFile(filePath, content, dryRun) {
+  if (dryRun) {
+    console.log('DRY-RUN WRITE  ' + filePath);
+    console.log(content);
+    console.log('---');
+    return;
+  }
+  const dir = path.dirname(filePath);
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(filePath, content, 'utf8');
+    console.log('WROTE  ' + filePath);
+  } catch (e) {
+    console.error('Error: could not write ' + filePath + ': ' + e.message);
+    process.exit(2);
+  }
+}
+
+function patchFile(filePath, marker, insertContent, dryRun) {
+  if (dryRun) {
+    console.log('DRY-RUN PATCH  ' + filePath);
+    return;
+  }
+  if (!fs.existsSync(filePath)) {
+    console.log('SKIP PATCH (file not found): ' + filePath);
+    return;
+  }
+  let content = fs.readFileSync(filePath, 'utf8');
+  if (content.includes(insertContent.trim())) {
+    console.log('ALREADY PATCHED  ' + filePath);
+    return;
+  }
+  try {
+    const updated = content.replace(marker, insertContent + '\n' + marker);
+    fs.writeFileSync(filePath, updated, 'utf8');
+    console.log('PATCHED  ' + filePath);
+  } catch (e) {
+    console.error('Error: could not patch ' + filePath + ': ' + e.message);
+    process.exit(2);
+  }
+}
+
+function scaffoldPath(relPath) {
+  const ext  = path.extname(relPath);
+  const base = relPath.slice(0, relPath.length - ext.length);
+  return base + '.scaffold' + ext;
+}
+
+// ── Content generators ────────────────────────────────────────────────────────
+
+function generateConfig(platform, config) {
+  const enc = config.encryptionEnabled ? 'true' : 'false';
+  const debugVal = (config.debug === true) ? 'true' : 'false';
+
+  if (platform === 'android') {
+    return [
+      'package com.example.encryption',
+      '',
+      'object EncryptionConfig {',
+      '    val encryptionEnabled: Boolean = ' + enc,
+      '    val approach: Int = ' + (config.approach || 0),
+      '    val publicKeyPem: String? = ' + (config.publicKeyPem ? '"' + config.publicKeyPem + '"' : 'null'),
+      '    val sharedKey: String? = ' + (config.sharedKey ? '"' + config.sharedKey + '"' : 'null'),
+      '    val excludeUrls: List<String> = listOf(' + (config.excludeUrls || []).map(u => '"' + u + '"').join(', ') + ')',
+      '    val hmacEnabled: Boolean = ' + (config.hmac && config.hmac.enabled ? 'true' : 'false'),
+      '    val debug: Boolean = ' + debugVal,
+      '}',
+    ].join('\n');
+  }
+
+  if (platform === 'ios') {
+    return [
+      'import Foundation',
+      '',
+      'struct EncryptionConfig {',
+      '    static let encryptionEnabled: Bool = ' + enc,
+      '    static let approach: Int = ' + (config.approach || 0),
+      '    static let publicKeyPem: String? = ' + (config.publicKeyPem ? '"' + config.publicKeyPem + '"' : 'nil'),
+      '    static let sharedKey: String? = ' + (config.sharedKey ? '"' + config.sharedKey + '"' : 'nil'),
+      '    static let excludeUrls: [String] = [' + (config.excludeUrls || []).map(u => '"' + u + '"').join(', ') + ']',
+      '    static let hmacEnabled: Bool = ' + (config.hmac && config.hmac.enabled ? 'true' : 'false'),
+      '    static let debug: Bool = ' + debugVal,
+      '}',
+    ].join('\n');
+  }
+
+  if (platform === 'flutter') {
+    return [
+      'class EncryptionConfig {',
+      '  static const bool encryptionEnabled = ' + enc + ';',
+      '  static const int approach = ' + (config.approach || 0) + ';',
+      '  static const String? publicKeyPem = ' + (config.publicKeyPem ? "'" + config.publicKeyPem + "'" : 'null') + ';',
+      '  static const String? sharedKey = ' + (config.sharedKey ? "'" + config.sharedKey + "'" : 'null') + ';',
+      '  static const List<String> excludeUrls = [' + (config.excludeUrls || []).map(u => "'" + u + "'").join(', ') + '];',
+      '  static const bool hmacEnabled = ' + (config.hmac && config.hmac.enabled ? 'true' : 'false') + ';',
+      '  static const bool debug = ' + debugVal + ';',
+      '}',
+    ].join('\n');
+  }
+
+  // angular / web / node — TypeScript / JS
+  const isBrowser = (platform === 'angular' || platform === 'web');
+  const exportWord = isBrowser ? 'export const environment' : 'export const encryptionConfig';
+  return [
+    exportWord + ' = {',
+    '  encryption: {',
+    '    enabled: ' + enc + ',',
+    '    approach: ' + (config.approach || 0) + ',',
+    '    publicKeyPem: ' + (config.publicKeyPem ? JSON.stringify(config.publicKeyPem) : 'null') + ',',
+    '    privateKeyPem: ' + (config.privateKeyPem ? JSON.stringify(config.privateKeyPem) : 'null') + ',',
+    '    sharedKey: ' + (config.sharedKey ? JSON.stringify(config.sharedKey) : 'null') + ',',
+    '    excludeUrls: ' + JSON.stringify(config.excludeUrls || []) + ',',
+    '    hmac: {',
+    '      enabled: ' + (config.hmac && config.hmac.enabled ? 'true' : 'false') + ',',
+    '    },',
+    '    debug: ' + debugVal + ',',
+    '  },',
+    '};',
+  ].join('\n');
+}
+
+function generateService(platform, config) {
+  const approach = config.approach || 0;
+  const hasHmac  = config.hmac && config.hmac.enabled;
+
+  if (platform === 'android') {
+    const androidApproach = config.approach || 3;
+    const encryptBody = androidApproach === 2
+      ? [
+        '            val aesKey = ByteArray(32).also { SecureRandom().nextBytes(it) }',
+        '            val iv = ByteArray(16).also { SecureRandom().nextBytes(it) }',
+        '            val aesCipher = Cipher.getInstance("AES/CBC/PKCS5Padding")',
+        '            aesCipher.init(Cipher.ENCRYPT_MODE, SecretKeySpec(aesKey, "AES"), IvParameterSpec(iv))',
+        '            val encryptedData = aesCipher.doFinal(plaintext.toByteArray(Charsets.UTF_8))',
+        '            val pubKeyPem = EncryptionConfig.publicKeyPem?.replace(Regex("-----.*?-----"), "")?.replace("\\\\s".toRegex(), "") ?: return null',
+        '            val pubKeyBytes = android.util.Base64.decode(pubKeyPem, android.util.Base64.DEFAULT)',
+        '            val rsaCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding")',
+        '            rsaCipher.init(Cipher.ENCRYPT_MODE, java.security.KeyFactory.getInstance("RSA").generatePublic(java.security.spec.X509EncodedKeySpec(pubKeyBytes)))',
+        '            val encryptedKey = rsaCipher.doFinal(aesKey)',
+        '            "{\\\"encryptedKey\\\":\\\"${Base64.encodeToString(encryptedKey, Base64.NO_WRAP)}\\\",\\\"iv\\\":\\\"${Base64.encodeToString(iv, Base64.NO_WRAP)}\\\",\\\"encryptedData\\\":\\\"${Base64.encodeToString(encryptedData, Base64.NO_WRAP)}\\\"}"',
+      ].join('\n')
+      : [
+        '            val iv = ByteArray(16).also { SecureRandom().nextBytes(it) }',
+        '            val key = deriveKey()',
+        '            val cipher = Cipher.getInstance("AES/CBC/PKCS5Padding")',
+        '            cipher.init(Cipher.ENCRYPT_MODE, SecretKeySpec(key, "AES"), IvParameterSpec(iv))',
+        '            val encrypted = cipher.doFinal(plaintext.toByteArray(Charsets.UTF_8))',
+        '            "{\\\"iv\\\":\\\"${Base64.encodeToString(iv, Base64.NO_WRAP)}\\\",\\\"encryptedData\\\":\\\"${Base64.encodeToString(encrypted, Base64.NO_WRAP)}\\\"}"',
+      ].join('\n');
+    const deriveKeyFn = androidApproach === 3 ? [
+      '    private fun deriveKey(): ByteArray {',
+      '        val secret = EncryptionConfig.sharedKey ?: ""',
+      '        return MessageDigest.getInstance("SHA-256").digest(secret.toByteArray(Charsets.UTF_8))',
+      '    }',
+    ].join('\n') : '';
+    const hmacFn = hasHmac ? [
+      '    fun computeHmac(data: String): String {',
+      '        val secret = System.getenv("ENCRYPTION_HMAC_SECRET") ?: ""',
+      '        val mac = javax.crypto.Mac.getInstance("HmacSHA256")',
+      '        mac.init(javax.crypto.spec.SecretKeySpec(secret.toByteArray(Charsets.UTF_8), "HmacSHA256"))',
+      '        return Base64.encodeToString(mac.doFinal(data.toByteArray(Charsets.UTF_8)), Base64.NO_WRAP)',
+      '    }',
+    ].join('\n') : '';
+    return [
+      'package com.example.encryption',
+      '',
+      'import javax.crypto.Cipher',
+      'import javax.crypto.spec.IvParameterSpec',
+      'import javax.crypto.spec.SecretKeySpec',
+      'import java.security.MessageDigest',
+      'import java.security.SecureRandom',
+      'import android.util.Base64',
+      '',
+      'object EncryptionService {',
+      '',
+      '    fun encrypt(plaintext: String): String? {',
+      '        if (!EncryptionConfig.encryptionEnabled) return plaintext',
+      '        return try {',
+      encryptBody,
+      '        } catch (e: Exception) {',
+      config.debug ? '            if (EncryptionConfig.debug) android.util.Log.d("EncryptionService", "encrypt error", e)' : null,
+      '            null',
+      '        }',
+      '    }',
+      '',
+      deriveKeyFn,
+      hmacFn,
+      '}',
+    ].filter(l => l !== null).join('\n');
+  }
+
+  if (platform === 'ios') {
+    const iosApproach = config.approach || 3;
+    const encryptImpl = iosApproach === 1
+      ? [
+        '        let sealedBox = try AES.GCM.seal(data, using: try deriveSymmetricKey())',
+        '        return sealedBox.combined!.base64EncodedString()',
+      ].join('\n')
+      : [
+        '        let key = try deriveAESKey()',
+        '        var iv = [UInt8](repeating: 0, count: kCCBlockSizeAES128)',
+        '        let _ = SecRandomCopyBytes(kSecRandomDefault, iv.count, &iv)',
+        '        let keyBytes = key.withUnsafeBytes { Array($0) }',
+        '        var outBytes = [UInt8](repeating: 0, count: data.count + kCCBlockSizeAES128)',
+        '        var numBytes = 0',
+        '        CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmAES),',
+        '                CCOptions(kCCOptionPKCS7Padding), keyBytes, kCCKeySizeAES256,',
+        '                iv, (data as NSData).bytes, data.count, &outBytes, outBytes.count, &numBytes)',
+        '        let ivB64 = Data(iv).base64EncodedString()',
+        '        let encB64 = Data(outBytes[..<numBytes]).base64EncodedString()',
+        '        return ["iv": ivB64, "encryptedData": encB64].description',
+      ].join('\n');
+    const deriveImpl = iosApproach === 1
+      ? [
+        '    private static func deriveSymmetricKey() throws -> SymmetricKey {',
+        '        let secret = EncryptionConfig.sharedKey ?? ""',
+        '        return SymmetricKey(data: SHA256.hash(data: Data(secret.utf8)))',
+        '    }',
+      ].join('\n')
+      : [
+        '    private static func deriveAESKey() throws -> Data {',
+        '        let secret = EncryptionConfig.sharedKey ?? ""',
+        '        return Data(SHA256.hash(data: Data(secret.utf8)))',
+        '    }',
+      ].join('\n');
+    const hmacImpl = hasHmac ? [
+      '    static func computeHmac(_ data: String) -> String {',
+      '        let secret = ProcessInfo.processInfo.environment["ENCRYPTION_HMAC_SECRET"] ?? ""',
+      '        let key = SymmetricKey(data: Data(secret.utf8))',
+      '        let mac = HMAC<SHA256>.authenticationCode(for: Data(data.utf8), using: key)',
+      '        return Data(mac).base64EncodedString()',
+      '    }',
+    ].join('\n') : '';
+    const imports = iosApproach === 1
+      ? ['import Foundation', 'import CryptoKit']
+      : ['import Foundation', 'import CryptoKit', 'import CommonCrypto'];
+    return [
+      ...imports,
+      '',
+      'struct EncryptionService {',
+      '',
+      '    static func encrypt(_ plaintext: String) -> String? {',
+      '        guard EncryptionConfig.encryptionEnabled else { return plaintext }',
+      '        guard let data = plaintext.data(using: .utf8) else { return nil }',
+      '        do {',
+      encryptImpl,
+      '        } catch {',
+      config.debug ? '            if EncryptionConfig.debug { print("[EncryptionService] encrypt error: \\(error)") }' : '',
+      '            return nil',
+      '        }',
+      '    }',
+      '',
+      deriveImpl,
+      hmacImpl,
+      '}',
+    ].filter(l => l !== null).join('\n');
+  }
+
+  if (platform === 'flutter') {
+    return [
+      "import 'dart:convert';",
+      "import 'dart:typed_data';",
+      "import 'package:encrypt/encrypt.dart';",
+      "import 'package:pointycastle/digests/sha256.dart';",
+      "import 'encryption_config.dart';",
+      '',
+      'class EncryptionService {',
+      '  static String? encrypt(String plaintext) {',
+      '    if (!EncryptionConfig.encryptionEnabled) return plaintext;',
+      '    try {',
+      '      final key = _deriveKey();',
+      "      final iv = IV.fromSecureRandom(16);",
+      "      final encrypter = Encrypter(AES(key, mode: AESMode.cbc));",
+      '      final encrypted = encrypter.encrypt(plaintext, iv: iv);',
+      "      return jsonEncode({'iv': iv.base64, 'encryptedData': encrypted.base64});",
+      '    } catch (_) { return null; }',
+      '  }',
+      '',
+      '  static String? decrypt(String payload) {',
+      '    if (!EncryptionConfig.encryptionEnabled) return payload;',
+      '    try {',
+      '      final map = jsonDecode(payload) as Map<String, dynamic>;',
+      '      final iv = IV.fromBase64(map[\'iv\'] as String);',
+      '      final encrypted = Encrypted.fromBase64(map[\'encryptedData\'] as String);',
+      '      final key = _deriveKey();',
+      "      final encrypter = Encrypter(AES(key, mode: AESMode.cbc));",
+      '      return encrypter.decrypt(encrypted, iv: iv);',
+      '    } catch (_) { return null; }',
+      '  }',
+      '',
+      '  static Key _deriveKey() {',
+      '    final secret = EncryptionConfig.sharedKey ?? \'\';',
+      '    final digest = SHA256Digest();',
+      '    final bytes = Uint8List.fromList(utf8.encode(secret));',
+      '    final hash = digest.process(bytes);',
+      '    return Key(hash);',
+      '  }',
+      '}',
+    ].join('\n');
+  }
+
+  // TypeScript (angular / web / node)
+  const configImport = platform === 'angular'
+    ? "import { environment } from '../../../environments/environment';"
+    : platform === 'web'
+      ? "import { encryptionConfig } from './encryption.config.js';"
+      : "import { encryptionConfig } from './encryption.config';";
+  const cfgRef = (platform === 'angular') ? 'environment.encryption' : 'encryptionConfig.encryption';
+  const injectable = platform === 'angular' ? "@Injectable({ providedIn: 'root' })\nexport " : 'export ';
+  const importBlock = [
+    platform === 'angular' ? "import { Injectable } from '@angular/core';" : null,
+    configImport,
+    approach === 2 ? "import JSEncrypt from 'jsencrypt';" : null,
+    approach === 2 || approach === 3 ? "import CryptoJS from 'crypto-js';" : null,
+  ].filter(Boolean).join('\n');
+  return [
+    importBlock,
+    '',
+    injectable + 'class EncryptionService {',
+    '',
+    '  async encrypt(payload: object): Promise<object | null> {',
+    '    const cfg = ' + cfgRef + ';',
+    '    if (!cfg.enabled) return payload;',
+    '    try {',
+    approach === 1
+      ? [
+        '      const bodyStr = JSON.stringify(payload);',
+        '      const bodyBytes = new TextEncoder().encode(bodyStr);',
+        '      const aesKey = await crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt"]);',
+        '      const iv = crypto.getRandomValues(new Uint8Array(12));',
+        '      const encryptedData = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, bodyBytes);',
+        '      const rawKey = await crypto.subtle.exportKey("raw", aesKey);',
+        '      const pubKey = await this.importPublicKey(cfg.publicKeyPem ?? "");',
+        '      const encryptedKey = await crypto.subtle.encrypt({ name: "RSA-OAEP" }, pubKey, rawKey);',
+        '      return {',
+        '        encryptedKey: this.toBase64(encryptedKey),',
+        '        iv: this.toBase64(iv),',
+        '        encryptedData: this.toBase64(encryptedData),',
+        '      };',
+      ].join('\n')
+      : approach === 2
+        ? [
+          "      const bodyStr = JSON.stringify(payload);",
+          "      const aesKey = CryptoJS.lib.WordArray.random(32);",
+          "      const iv = CryptoJS.lib.WordArray.random(16);",
+          "      const salt = CryptoJS.lib.WordArray.random(8);",
+          "      const encrypted = CryptoJS.AES.encrypt(bodyStr, aesKey, { iv, mode: CryptoJS.mode.CBC, padding: CryptoJS.pad.Pkcs7 });",
+          "      const jsEncrypt = new JSEncrypt();",
+          "      jsEncrypt.setPublicKey(cfg.publicKeyPem ?? '');",
+          "      const encKey = jsEncrypt.encrypt(CryptoJS.enc.Base64.stringify(aesKey));",
+          "      if (!encKey) throw new Error('RSA encryption failed');",
+          "      return {",
+          "        encryptedKey: encKey,",
+          "        iv: CryptoJS.enc.Base64.stringify(iv),",
+          "        salt: CryptoJS.enc.Base64.stringify(salt),",
+          "        encryptedData: encrypted.toString(),",
+          "      };",
+        ].join('\n')
+        : [
+          "      const key = CryptoJS.SHA256(cfg.sharedKey ?? '');",
+          "      const iv = CryptoJS.lib.WordArray.random(16);",
+          "      const encrypted = CryptoJS.AES.encrypt(JSON.stringify(payload), key, { iv, mode: CryptoJS.mode.CBC, padding: CryptoJS.pad.Pkcs7 });",
+          "      return {",
+          "        iv: CryptoJS.enc.Base64.stringify(iv),",
+          "        encryptedData: encrypted.toString(),",
+          "      };",
+        ].join('\n'),
+    '    } catch (err) {',
+    config.debug ? "      if (cfg.debug) console.debug('[EncryptionService] encrypt error:', err);" : '',
+    '      return payload;',
+    '    }',
+    '  }',
+    '',
+    approach === 1 ? '  private toBase64(buffer: ArrayBuffer | Uint8Array): string {' : null,
+    approach === 1 ? '    return btoa(String.fromCharCode(...new Uint8Array(buffer instanceof ArrayBuffer ? buffer : buffer)));' : null,
+    approach === 1 ? '  }' : null,
+    approach === 1 ? '' : null,
+    approach === 1 ? '  private async importPublicKey(pem: string): Promise<CryptoKey> {' : null,
+    approach === 1 ? '    const binaryDer = atob(pem.replace(/-----.*?-----/g, "").replace(/\\s/g, ""));' : null,
+    approach === 1 ? '    const buffer = Uint8Array.from(binaryDer, c => c.charCodeAt(0));' : null,
+    approach === 1 ? '    return crypto.subtle.importKey("spki", buffer, { name: "RSA-OAEP", hash: "SHA-256" }, false, ["encrypt"]);' : null,
+    approach === 1 ? '  }' : null,
+    '}',
+  ].filter(l => l !== null).join('\n');
+}
+
+function generateInterceptor(platform, config) {
+  const hasHmac     = config.hmac && config.hmac.enabled;
+  const excludeUrls = config.excludeUrls || [];
+
+  if (platform === 'android') {
+    const excludeCheck = excludeUrls.length > 0
+      ? [
+        '        val url = chain.request().url.toString()',
+        '        val excluded = listOf(' + excludeUrls.map(u => '"' + u + '"').join(', ') + ')',
+        '        if (excluded.any { url.startsWith(it) }) return chain.proceed(chain.request())',
+      ].join('\n')
+      : '';
+    return [
+      'package com.example.encryption',
+      '',
+      'import okhttp3.Interceptor',
+      'import okhttp3.Response',
+      'import okhttp3.RequestBody.Companion.toRequestBody',
+      'import okhttp3.MediaType.Companion.toMediaType',
+      '',
+      'class EncryptionInterceptor : Interceptor {',
+      '    override fun intercept(chain: Interceptor.Chain): Response {',
+      excludeCheck,
+      '        val original = chain.request()',
+      '        if (!EncryptionConfig.encryptionEnabled) return chain.proceed(original)',
+      '        return try {',
+      '            val body = original.body ?: return chain.proceed(original)',
+      '            val buffer = okio.Buffer()',
+      '            body.writeTo(buffer)',
+      '            val plaintext = buffer.readUtf8()',
+      '            val encrypted = EncryptionService.encrypt(plaintext) ?: return chain.proceed(original)',
+      '            val newBody = encrypted.toRequestBody("application/json".toMediaType())',
+      hasHmac ? [
+        '            val timestamp = System.currentTimeMillis().toString()',
+        '            val nonce = java.util.UUID.randomUUID().toString()',
+        '            val hmacSig = EncryptionService.computeHmac("$timestamp.$nonce.$encrypted")',
+        '            val newRequest = original.newBuilder()',
+        '                .method(original.method, newBody)',
+        '                .addHeader("X-Timestamp", timestamp)',
+        '                .addHeader("X-Nonce", nonce)',
+        '                .addHeader("X-Signature", hmacSig)',
+        '                .build()',
+      ].join('\n') : '            val newRequest = original.newBuilder().method(original.method, newBody).build()',
+      '            chain.proceed(newRequest)',
+      '        } catch (e: Exception) {',
+      config.debug ? '            if (EncryptionConfig.debug) android.util.Log.d("EncryptionInterceptor", "intercept error", e)' : null,
+      '            chain.proceed(original)',
+      '        }',
+      '    }',
+      '}',
+    ].filter(l => l !== null).join('\n');
+  }
+
+  if (platform === 'ios') {
+    const excludeCheckIos = excludeUrls.length > 0
+      ? [
+        '        let url = request.url?.absoluteString ?? ""',
+        '        let excluded: [String] = [' + excludeUrls.map(u => '"' + u + '"').join(', ') + ']',
+        '        if excluded.contains(where: { url.hasPrefix($0) }) { return request }',
+      ].join('\n')
+      : '';
+    const hmacIos = hasHmac ? [
+      '        let timestamp = String(Int(Date().timeIntervalSince1970 * 1000))',
+      '        let nonce = UUID().uuidString',
+      '        let sig = EncryptionService.computeHmac("\\(timestamp).\\(nonce).\\(encrypted)")',
+      '        modified.addValue(timestamp, forHTTPHeaderField: "X-Timestamp")',
+      '        modified.addValue(nonce, forHTTPHeaderField: "X-Nonce")',
+      '        modified.addValue(sig, forHTTPHeaderField: "X-Signature")',
+    ].join('\n') : '';
+    return [
+      'import Foundation',
+      'import CryptoKit',
+      '',
+      'struct EncryptionInterceptor {',
+      '    static func intercept(request: URLRequest) -> URLRequest {',
+      '        guard EncryptionConfig.encryptionEnabled else { return request }',
+      excludeCheckIos,
+      '        guard let body = request.httpBody,',
+      '              let plaintext = String(data: body, encoding: .utf8) else { return request }',
+      '        guard let encrypted = EncryptionService.encrypt(plaintext) else { return request }',
+      '        guard let encryptedData = encrypted.data(using: .utf8) else { return request }',
+      '        var modified = request',
+      '        modified.httpBody = encryptedData',
+      hmacIos,
+      '        return modified',
+      '    }',
+      '}',
+    ].filter(l => l !== null).join('\n');
+  }
+
+  if (platform === 'flutter') {
+    const excludeCheck = excludeUrls.length > 0
+      ? [
+        "    final excludeUrls = EncryptionConfig.excludeUrls;",
+        "    if (excludeUrls.any((prefix) => options.path.startsWith(prefix))) {",
+        "      return handler.next(options);",
+        "    }",
+      ].join('\n')
+      : '';
+    const hmacFlutter = hasHmac ? [
+      "    final timestamp = DateTime.now().millisecondsSinceEpoch.toString();",
+      "    final nonce = DateTime.now().microsecondsSinceEpoch.toString();",
+      "    final hmacSecret = const String.fromEnvironment('ENCRYPTION_HMAC_SECRET');",
+      "    final sigPayload = '$timestamp.$nonce.${jsonEncode(body)}';",
+      "    final hmacBytes = Hmac(sha256, utf8.encode(hmacSecret)).convert(utf8.encode(sigPayload)).bytes;",
+      "    final signature = base64Encode(hmacBytes);",
+      "    options.headers['X-Timestamp'] = timestamp;",
+      "    options.headers['X-Nonce'] = nonce;",
+      "    options.headers['X-Signature'] = signature;",
+    ].join('\n') : '';
+    return [
+      "import 'dart:convert';",
+      "import 'dart:typed_data';",
+      "import 'package:dio/dio.dart';",
+      "import 'package:crypto/crypto.dart';",
+      "import 'encryption_config.dart';",
+      "import 'encryption_service.dart';",
+      '',
+      'class EncryptionInterceptor extends Interceptor {',
+      '  @override',
+      '  void onRequest(RequestOptions options, RequestInterceptorHandler handler) async {',
+      excludeCheck,
+      '    if (!EncryptionConfig.encryptionEnabled) return handler.next(options);',
+      '    try {',
+      '      final body = options.data;',
+      '      if (body == null || body is FormData) return handler.next(options);',
+      '      final plaintext = body is String ? body : jsonEncode(body);',
+      '      final encrypted = EncryptionService.encrypt(plaintext);',
+      '      if (encrypted != null) {',
+      '        options.data = encrypted;',
+      hmacFlutter,
+      '      }',
+      '    } catch (e) {',
+      config.debug ? "      if (EncryptionConfig.debug) debugPrint('[EncryptionInterceptor] error: $e');" : '',
+      '    }',
+      '    handler.next(options);',
+      '  }',
+      '}',
+    ].filter(l => l !== null).join('\n');
+  }
+
+  if (platform === 'react' || platform === 'react-native') {
+    const rnHmacImport = hasHmac ? "import CryptoJS from 'crypto-js';" : null;
+    const rnExcludeCheck = excludeUrls.length > 0
+      ? "      if (cfg.excludeUrls?.some((u: string) => config.url?.startsWith(u))) return config;"
+      : null;
+    const rnHmacBlock = hasHmac ? [
+      "        const timestamp = Date.now().toString();",
+      "        const nonce = Math.random().toString(36).slice(2);",
+      "        const hmacSecret = process.env['ENCRYPTION_HMAC_SECRET'] ?? '';",
+      "        const sigPayload = timestamp + '.' + nonce + '.' + JSON.stringify(config.data);",
+      "        const signature = CryptoJS.HmacSHA256(sigPayload, hmacSecret).toString(CryptoJS.enc.Base64);",
+      "        config.headers['X-Timestamp'] = timestamp;",
+      "        config.headers['X-Nonce'] = nonce;",
+      "        config.headers['X-Signature'] = signature;",
+    ].join('\n') : null;
+    return [
+      "import { AxiosInstance, InternalAxiosRequestConfig } from 'axios';",
+      "import { EncryptionService } from './encryption.service';",
+      rnHmacImport,
+      "import { encryptionConfig } from './encryption.config';",
+      '',
+      'const encryptionService = new EncryptionService();',
+      '',
+      'export function applyEncryptionInterceptor(instance: AxiosInstance): void {',
+      '  const cfg = encryptionConfig.encryption;',
+      '',
+      '  instance.interceptors.request.use(',
+      '    async (config: InternalAxiosRequestConfig) => {',
+      '      if (!cfg.enabled)                   return config;',
+      '      if (!config.data)                   return config;',
+      '      if (config.data instanceof FormData) return config;',
+      rnExcludeCheck,
+      '      try {',
+      '        config.data = await encryptionService.encrypt(config.data);',
+      "        config.headers['Content-Type'] = 'application/json';",
+      rnHmacBlock,
+      '      } catch {}',
+      '      return config;',
+      '    },',
+      '    (error: unknown) => Promise.reject(error)',
+      '  );',
+      '}',
+    ].filter(l => l !== null).join('\n');
+  }
+
+  // TypeScript (angular / web / node)
+  const excludeBlock = excludeUrls.length > 0
+    ? [
+      '    const excludeUrls: string[] = ' + JSON.stringify(excludeUrls) + ';',
+      "    if (excludeUrls.some(prefix => url.startsWith(prefix))) {",
+      platform === 'angular' ? '      return next(req);' : '      return next(request);',
+      '    }',
+    ].join('\n')
+    : '';
+
+  const hmacBlock = hasHmac
+    ? [
+      '    const timestamp = Date.now().toString();',
+      "    const nonce = (typeof crypto !== 'undefined' && crypto.randomUUID) ? crypto.randomUUID() : Math.random().toString(36).slice(2);",
+      "    const hmacSecret = process.env['ENCRYPTION_HMAC_SECRET'] ?? '';",
+      "    const sigPayload = timestamp + '.' + nonce + '.' + JSON.stringify(encrypted);",
+      platform === 'angular' || platform === 'web'
+        ? [
+          "    const sigKey = await crypto.subtle.importKey('raw', new TextEncoder().encode(hmacSecret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);",
+          "    const sigBuf = await crypto.subtle.sign('HMAC', sigKey, new TextEncoder().encode(sigPayload));",
+          "    const signature = btoa(String.fromCharCode(...new Uint8Array(sigBuf)));",
+        ].join('\n')
+        : [
+          "    const { createHmac } = await import('crypto');",
+          "    const signature = createHmac('sha256', hmacSecret).update(sigPayload).digest('base64');",
+        ].join('\n'),
+    ].join('\n')
+    : '';
+
+  if (platform === 'angular') {
+    const configImport = "import { environment } from '../../../environments/environment';";
+    return [
+      "import { Injectable } from '@angular/core';",
+      "import { HttpInterceptor, HttpRequest, HttpHandler, HttpEvent } from '@angular/common/http';",
+      "import { Observable, from, switchMap, catchError } from 'rxjs';",
+      configImport,
+      "import { EncryptionService } from './encryption.service';",
+      '',
+      "@Injectable()",
+      'export class EncryptionInterceptor implements HttpInterceptor {',
+      '  constructor(private encryptionService: EncryptionService) {}',
+      '',
+      '  intercept(req: HttpRequest<unknown>, next: HttpHandler): Observable<HttpEvent<unknown>> {',
+      '    const cfg = environment.encryption;',
+      '    const url = req.url;',
+      excludeBlock,
+      '    if (!cfg.enabled || req.body == null) return next.handle(req);',
+      '    if (req.body instanceof FormData) return next.handle(req);',
+      '    return from(this.encryptionService.encrypt(req.body as object)).pipe(',
+      hasHmac
+        ? '      switchMap(encrypted => from((async () => {'
+        : '      switchMap(encrypted => next.handle(req.clone({ body: encrypted }))),',
+      hasHmac ? hmacBlock : null,
+      hasHmac ? "        const headers: Record<string, string> = { 'X-Timestamp': timestamp, 'X-Nonce': nonce, 'X-Signature': signature };" : null,
+      hasHmac ? '        return req.clone({ body: encrypted, setHeaders: headers });' : null,
+      hasHmac ? '      })()).pipe(switchMap(cloned => next.handle(cloned)))),': null,
+      '      catchError(err => {',
+      "        if (cfg.debug) console.debug('[EncryptionInterceptor] error:', err);",
+      '        return next.handle(req);',
+      '      }),',
+      '    );',
+      '  }',
+      '}',
+    ].filter(l => l !== null).join('\n');
+  }
+
+  if (platform === 'node') {
+    return [
+      "import { Request, Response, NextFunction } from 'express';",
+      "import { encryptionConfig } from './encryption.config';",
+      "import { EncryptionService } from './encryption.service';",
+      '',
+      'const encryptionService = new EncryptionService();',
+      '',
+      'export async function encryptionMiddleware(req: Request, res: Response, next: NextFunction): Promise<void> {',
+      '  const cfg = encryptionConfig.encryption;',
+      '  const url = req.path;',
+      excludeBlock,
+      '  if (!cfg.enabled || req.body == null) return next();',
+      '  try {',
+      '    req.body = await encryptionService.encrypt(req.body);',
+      hasHmac ? hmacBlock : '',
+      hasHmac ? "    res.setHeader('X-Timestamp', timestamp);\n    res.setHeader('X-Nonce', nonce);\n    res.setHeader('X-Signature', signature);" : '',
+      '  } catch (err) {',
+      "    if (cfg.debug) console.debug('[EncryptionMiddleware] error:', err);",
+      '  }',
+      '  next();',
+      '}',
+    ].join('\n');
+  }
+
+  // web
+  return [
+    "import { encryptionConfig } from './encryption.config.js';",
+    "import { EncryptionService } from './encryption.service.js';",
+    '',
+    'const encryptionService = new EncryptionService();',
+    '',
+    'export async function encryptRequest(url, options = {}) {',
+    '  const cfg = encryptionConfig.encryption;',
+    '  const excludeUrls = ' + JSON.stringify(excludeUrls) + ';',
+    '  if (excludeUrls.some(prefix => url.startsWith(prefix))) return fetch(url, options);',
+    '  if (!cfg.enabled || !options.body) return fetch(url, options);',
+    '  try {',
+    '    const body = typeof options.body === "string" ? JSON.parse(options.body) : options.body;',
+    '    const encrypted = await encryptionService.encrypt(body);',
+    hasHmac
+      ? [
+          "    const timestamp = Date.now().toString();",
+          "    const nonce = (typeof crypto !== 'undefined' && crypto.randomUUID) ? crypto.randomUUID() : Math.random().toString(36).slice(2);",
+          "    const hmacSecret = (typeof process !== 'undefined' && process.env['ENCRYPTION_HMAC_SECRET']) || '';",
+          "    const sigPayload = timestamp + '.' + nonce + '.' + JSON.stringify(encrypted);",
+          "    const sigKey = await crypto.subtle.importKey('raw', new TextEncoder().encode(hmacSecret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);",
+          "    const sigBuf = await crypto.subtle.sign('HMAC', sigKey, new TextEncoder().encode(sigPayload));",
+          "    const signature = btoa(String.fromCharCode(...new Uint8Array(sigBuf)));",
+          "    options = { ...options, body: JSON.stringify(encrypted), headers: { ...options.headers, 'Content-Type': 'application/json', 'X-Timestamp': timestamp, 'X-Nonce': nonce, 'X-Signature': signature } };",
+        ].join('\n')
+      : '    options = { ...options, body: JSON.stringify(encrypted), headers: { ...options.headers, "Content-Type": "application/json" } };',
+    '  } catch (err) {',
+    "    if (cfg.debug) console.debug('[encryptRequest] error:', err);",
+    '  }',
+    '  return fetch(url, options);',
+    '}',
+  ].join('\n');
+}
+
+function generateAxiosInstance() {
+  return [
+    "import axios from 'axios';",
+    "import { applyEncryptionInterceptor } from '../encryption/encryption.interceptor';",
+    '',
+    'const axiosInstance = axios.create({',
+    "  // baseURL: 'https://your-api-base-url.com',",
+    '});',
+    '',
+    'applyEncryptionInterceptor(axiosInstance);',
+    '// ENCRYPTION_INTERCEPTOR_PLACEHOLDER',
+    '',
+    'export default axiosInstance;',
+  ].join('\n');
+}
+
+function patchIndexPolyfill(indexPath, dryRun) {
+  const polyfillLine = "import 'react-native-get-random-values'; // crypto.getRandomValues polyfill \u2014 must be first import";
+  if (dryRun) {
+    console.log('DRY-RUN PATCH  ' + indexPath + ' (react-native-get-random-values polyfill)');
+    return;
+  }
+  if (!fs.existsSync(indexPath)) {
+    console.log('SKIP PATCH (file not found): ' + indexPath);
+    return;
+  }
+  let content;
+  try { content = fs.readFileSync(indexPath, 'utf8'); } catch (e) {
+    console.error('Error: could not read ' + indexPath + ': ' + e.message);
+    return;
+  }
+  if (content.includes('react-native-get-random-values')) {
+    console.log('ALREADY PATCHED  ' + indexPath + ' (polyfill already present)');
+    return;
+  }
+  try {
+    fs.writeFileSync(indexPath, polyfillLine + '\n' + content, 'utf8');
+    console.log('PATCHED  ' + indexPath);
+  } catch (e) {
+    console.error('Error: could not patch ' + indexPath + ': ' + e.message);
+  }
+}
+
+// ── Production React Native generators (approaches 4 & 5) ────────────────────
+
+function generateRnProductionTypes() {
+  return [
+    "// src/services/security/types.ts",
+    "export interface EncryptedEnvelope {",
+    "  data: string;    // base64(ciphertext + 16-byte GCM auth_tag)",
+    "  key: string;     // base64(RSA-OAEP encrypted AES key bytes)",
+    "  iv: string;      // base64(12-byte IV)",
+    "  nonce: string;   // appId^unix_timestamp_ms.random_hex_16",
+    "  key_id: string;  // RSA key version identifier from key endpoint",
+    "}",
+    "",
+    "export interface EncryptedResponse {",
+    "  data: string;    // base64(ciphertext + 16-byte GCM auth_tag)",
+    "  iv: string;      // base64(new server-generated 12-byte IV)",
+    "  nonce?: string;",
+    "}",
+  ].join('\n');
+}
+
+function generateRnProductionEncryptionService() {
+  return [
+    "import { randomBytes, createCipheriv } from 'react-native-quick-crypto';",
+    "",
+    "export const encryptPayload = async (",
+    "  plaintext: string,",
+    "  _rsaPublicKeyPem: string",
+    "): Promise<{ ciphertext: string; aesKey: Buffer; iv: Buffer }> => {",
+    "  const aesKey = randomBytes(32) as Buffer;",
+    "  const iv = randomBytes(12) as Buffer;",
+    "  const cipher = createCipheriv('aes-256-gcm', aesKey, iv) as any;",
+    "  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);",
+    "  const tag = cipher.getAuthTag() as Buffer;",
+    "  const ciphertext = Buffer.concat([encrypted, tag]).toString('base64');",
+    "  return { ciphertext, aesKey, iv };",
+    "};",
+  ].join('\n');
+}
+
+function generateRnProductionDecryptionService() {
+  return [
+    "import { createDecipheriv } from 'react-native-quick-crypto';",
+    "",
+    "export const decryptResponse = (",
+    "  ciphertextBase64: string,",
+    "  ivBase64: string,",
+    "  aesKey: Buffer",
+    "): string => {",
+    "  const combined = Buffer.from(ciphertextBase64, 'base64');",
+    "  const tag = combined.slice(combined.length - 16);",
+    "  const ciphertext = combined.slice(0, combined.length - 16);",
+    "  const iv = Buffer.from(ivBase64, 'base64');",
+    "  const decipher = createDecipheriv('aes-256-gcm', aesKey, iv) as any;",
+    "  decipher.setAuthTag(tag);",
+    "  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');",
+    "};",
+  ].join('\n');
+}
+
+function generateRnProductionRsaKeyService(config) {
+  const endpoint = config.rsaKeyEndpoint || '<API_BASE_URL>/api/security/public-key';
+  const retries  = config.rsaKeyRetries  || 3;
+  return [
+    "import axios from 'axios';",
+    "",
+    "let cachedPublicKey: string | null = null;",
+    "let cachedKeyId: string | null = null;",
+    "const MAX_RETRIES = " + retries + ";",
+    "",
+    "export const getRsaPublicKey = async (",
+    "  endpoint: string = '" + endpoint + "'",
+    "): Promise<{ publicKey: string; keyId: string }> => {",
+    "  if (cachedPublicKey && cachedKeyId) return { publicKey: cachedPublicKey, keyId: cachedKeyId };",
+    "  let lastError: Error | null = null;",
+    "  for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {",
+    "    try {",
+    "      const { data } = await axios.get(endpoint);",
+    "      cachedPublicKey = data.public_key;",
+    "      cachedKeyId = data.key_id;",
+    "      return { publicKey: data.public_key, keyId: data.key_id };",
+    "    } catch (e: any) { lastError = e; }",
+    "  }",
+    "  throw new Error(`RSA key fetch failed after ${MAX_RETRIES} attempts: ${lastError?.message}`);",
+    "};",
+    "",
+    "export const invalidateRsaKey = () => { cachedPublicKey = null; cachedKeyId = null; };",
+  ].join('\n');
+}
+
+function generateRnProductionKeychainService() {
+  return [
+    "import * as Keychain from 'react-native-keychain';",
+    "",
+    "export const storeToken = async (key: string, value: string): Promise<void> => {",
+    "  await Keychain.setGenericPassword(key, value, { service: key });",
+    "};",
+    "",
+    "export const getToken = async (key: string): Promise<string | null> => {",
+    "  const result = await Keychain.getGenericPassword({ service: key });",
+    "  return result ? result.password : null;",
+    "};",
+    "",
+    "export const deleteToken = async (key: string): Promise<void> => {",
+    "  await Keychain.resetGenericPassword({ service: key });",
+    "};",
+  ].join('\n');
+}
+
+function generateRnProductionHmacService() {
+  return [
+    "import { createHmac } from 'react-native-quick-crypto';",
+    "",
+    "export const buildCanonicalString = (",
+    "  method: string, url: string, nonce: string, encryptedData: string",
+    "): string => `${method.toUpperCase()}|${url}|${nonce}|${encryptedData}`;",
+    "",
+    "export const signRequest = (canonical: string, hmacSecret: string): string => {",
+    "  if (!hmacSecret) throw new Error('HMAC_SECRET is not configured');",
+    "  const hmac = createHmac('sha256', hmacSecret) as any;",
+    "  hmac.update(canonical);",
+    "  return hmac.digest('base64');",
+    "};",
+  ].join('\n');
+}
+
+function generateRnProductionEncryptionConfig(config) {
+  const excludeLines = (config.excludeUrls || []).map(u => "  '" + u + "',");
+  const endpoint = config.rsaKeyEndpoint || '<API_BASE_URL>/api/security/public-key';
+  const alwaysOn = config.encryptionToggle === 'always-on';
+  const encryptionEnabledLine = alwaysOn
+    ? "export const ENCRYPTION_ENABLED = true; // always-on mode"
+    : "export const ENCRYPTION_ENABLED = process.env.ENCRYPTION_ENABLED === 'true';";
+  return [
+    "// Paths that bypass encryption (public endpoints, health checks, etc.)",
+    "export const EXCLUDED_PATHS: string[] = [",
+    ...excludeLines,
+    "];",
+    "",
+    encryptionEnabledLine,
+    "export const ENCRYPTION_LAYER   = process.env.ENCRYPTION_LAYER ?? 'rn'; // 'rn' | 'native'",
+    "export const RSA_KEY_ENDPOINT   = process.env.RSA_KEY_ENDPOINT ?? '" + endpoint + "';",
+    "export const HMAC_ENABLED       = process.env.HMAC_ENABLED === 'true';",
+    "export const HMAC_SECRET        = process.env.ENCRYPTION_HMAC_SECRET ?? '';",
+  ].join('\n');
+}
+
+function generateRnProductionInterceptor(approach, config) {
+  const hasHmac = config.hmac && config.hmac.enabled;
+  const isNative = approach === 5;
+  const cryptoImport = isNative
+    ? "import { nativeEncryptAES, nativeEncryptRSA } from './native-crypto.module';"
+    : "import { encryptPayload } from './encryption.service';";
+  const decryptImport = isNative
+    ? "import { nativeDecryptAES } from './native-crypto.module';"
+    : "import { decryptResponse } from './decryption.service';";
+  const hmacImport = hasHmac ? "import { buildCanonicalString, signRequest } from './hmac.service';" : null;
+  const encryptBlock = isNative ? [
+    "        const aesKeyBuf = randomBytes(32) as Buffer;",
+    "        const aesKeyBase64 = aesKeyBuf.toString('base64');",
+    "        const { ciphertext, iv } = await nativeEncryptAES(plaintext, aesKeyBase64);",
+    "        const encryptedKey = await nativeEncryptRSA(publicKey, aesKeyBase64);",
+    "        requestMap.set(requestId, { aesKeyBase64, iv });",
+  ].join('\n') : [
+    "        const { ciphertext, aesKey, iv } = await encryptPayload(plaintext, publicKey);",
+    "        const encryptedKey = publicEncrypt({ key: publicKey, padding: 4 /* RSA_PKCS1_OAEP_PADDING */ }, aesKey).toString('base64');",
+    "        requestMap.set(requestId, { aesKey, iv: iv.toString('base64') });",
+  ].join('\n');
+  const decryptBlock = isNative ? [
+    "        const { aesKeyBase64 } = requestMap.get(requestId)!;",
+    "        requestMap.delete(requestId);",
+    "        if (encResp?.data && encResp?.iv) {",
+    "          response.data = JSON.parse(await nativeDecryptAES(encResp.data, encResp.iv, aesKeyBase64));",
+    "        }",
+  ].join('\n') : [
+    "        const { aesKey, iv: _iv } = requestMap.get(requestId)!;",
+    "        requestMap.delete(requestId);",
+    "        if (encResp?.data && encResp?.iv) {",
+    "          response.data = JSON.parse(decryptResponse(encResp.data, encResp.iv, aesKey));",
+    "        }",
+  ].join('\n');
+  return [
+    "import axios, { AxiosInstance, InternalAxiosRequestConfig, AxiosResponse } from 'axios';",
+    isNative
+      ? "import { randomBytes } from 'react-native-quick-crypto';"
+      : "import { randomBytes, publicEncrypt } from 'react-native-quick-crypto';",
+    cryptoImport,
+    decryptImport,
+    "import { getRsaPublicKey, invalidateRsaKey } from './rsa-key.service';",
+    hmacImport,
+    "import { ENCRYPTION_ENABLED, EXCLUDED_PATHS, RSA_KEY_ENDPOINT, HMAC_ENABLED, HMAC_SECRET } from './encryption-config';",
+    "",
+    "const requestMap = new Map<string, any>();",
+    "",
+    "export function applyProductionEncryptionInterceptor(instance: AxiosInstance): void {",
+    "  instance.interceptors.request.use(",
+    "    async (config: InternalAxiosRequestConfig) => {",
+    "      if (!ENCRYPTION_ENABLED) return config;",
+    "      if (!config.data) return config;",
+    "      if (config.data instanceof FormData) return config;",
+    "      if (EXCLUDED_PATHS.some((p: string) => config.url?.includes(p))) return config;",
+    "      const method = (config.method ?? '').toUpperCase();",
+    "      if (!['POST', 'PUT', 'PATCH'].includes(method)) return config;",
+    "      try {",
+    "        const { publicKey, keyId } = await getRsaPublicKey(RSA_KEY_ENDPOINT);",
+    "        const plaintext = typeof config.data === 'string' ? config.data : JSON.stringify(config.data);",
+    "        const requestId = (randomBytes(16) as Buffer).toString('hex');",
+    "        const nonce = `app^${Date.now()}.${(randomBytes(8) as Buffer).toString('hex')}`;",
+    encryptBlock,
+    "        const envelope = { data: ciphertext, key: encryptedKey, iv: iv.toString ? iv.toString('base64') : iv, nonce, key_id: keyId };",
+    "        config.data = envelope;",
+    "        config.headers['Content-Type'] = 'application/json';",
+    "        config.headers['X-Request-Id'] = requestId;",
+    "        (config as any).__requestId = requestId;",
+    hasHmac ? [
+      "        if (HMAC_ENABLED) {",
+      "          const canonical = buildCanonicalString(method, config.url ?? '', nonce, ciphertext);",
+      "          const signature = signRequest(canonical, HMAC_SECRET);",
+      "          config.headers['X-Request-Signature'] = signature;",
+      "          config.headers['X-Nonce'] = nonce;",
+      "        }",
+    ].join('\n') : null,
+    "      } catch (err: any) {",
+    "        if (__DEV__) console.debug('[EncryptionInterceptor] encrypt error:', err?.message);",
+    "      }",
+    "      return config;",
+    "    },",
+    "    (error: unknown) => Promise.reject(error)",
+    "  );",
+    "",
+    "  instance.interceptors.response.use(",
+    "    (response: AxiosResponse) => {",
+    "      const requestId = (response.config as any).__requestId;",
+    "      if (!requestId || !requestMap.has(requestId)) return response;",
+    "      const encResp = response.data;",
+    "      try {",
+    decryptBlock,
+    "      } catch (err: any) {",
+    "        requestMap.delete(requestId);",
+    "        if (__DEV__) console.debug('[EncryptionInterceptor] decrypt error:', err?.message);",
+    "        throw Object.assign(new Error('DECRYPTION_AUTH_TAG_FAILURE'), { isAuthTagFailure: true });",
+    "      }",
+    "      return response;",
+    "    },",
+    "    async (error: any) => {",
+    "      const requestId = error?.config?.__requestId;",
+    "      if (requestId) requestMap.delete(requestId);",
+    "      if (error?.response?.status === 401 && error?.response?.data?.code === 'KEY_ID_NOT_FOUND') {",
+    "        invalidateRsaKey();",
+    "        return instance.request(error.config);",
+    "      }",
+    "      return Promise.reject(error);",
+    "    }",
+    "  );",
+    "}",
+  ].filter(l => l !== null).join('\n');
+}
+
+function generateNativeAndroidModule(config) {
+  const pkg = config.androidPackage || 'com.example.security';
+  return [
+    'package ' + pkg,
+    '',
+    'import android.util.Base64',
+    'import com.facebook.react.bridge.*',
+    'import javax.crypto.Cipher',
+    'import javax.crypto.spec.GCMParameterSpec',
+    'import javax.crypto.spec.SecretKeySpec',
+    'import java.security.KeyFactory',
+    'import java.security.spec.X509EncodedKeySpec',
+    '',
+    'class NativeCryptoModule(reactContext: ReactApplicationContext) : ReactContextBaseJavaModule(reactContext) {',
+    '  override fun getName() = "NativeCryptoModule"',
+    '',
+    '  @ReactMethod',
+    '  fun encryptAES(plaintext: String, keyBase64: String, promise: Promise) {',
+    '    try {',
+    '      val keyBytes = Base64.decode(keyBase64, Base64.NO_WRAP)',
+    '      require(keyBytes.size == 32) { "AES key must be 32 bytes" }',
+    '      val cipher = Cipher.getInstance("AES/GCM/NoPadding")',
+    '      cipher.init(Cipher.ENCRYPT_MODE, SecretKeySpec(keyBytes, "AES"))',
+    '      val cipherWithTag = cipher.doFinal(plaintext.toByteArray(Charsets.UTF_8))',
+    '      val result = WritableNativeMap().apply {',
+    '        putString("ciphertext", Base64.encodeToString(cipherWithTag, Base64.NO_WRAP))',
+    '        putString("iv", Base64.encodeToString(cipher.iv, Base64.NO_WRAP))',
+    '      }',
+    '      promise.resolve(result)',
+    '    } catch (e: Exception) { promise.reject("ERR_ENCRYPT", e.message, e) }',
+    '  }',
+    '',
+    '  @ReactMethod',
+    '  fun decryptAES(ciphertextBase64: String, ivBase64: String, keyBase64: String, promise: Promise) {',
+    '    try {',
+    '      val keyBytes = Base64.decode(keyBase64, Base64.NO_WRAP)',
+    '      require(keyBytes.size == 32) { "AES key must be 32 bytes" }',
+    '      val cipherWithTag = Base64.decode(ciphertextBase64, Base64.NO_WRAP)',
+    '      val iv = Base64.decode(ivBase64, Base64.NO_WRAP)',
+    '      val cipher = Cipher.getInstance("AES/GCM/NoPadding")',
+    '      cipher.init(Cipher.DECRYPT_MODE, SecretKeySpec(keyBytes, "AES"), GCMParameterSpec(128, iv))',
+    '      promise.resolve(String(cipher.doFinal(cipherWithTag), Charsets.UTF_8))',
+    '    } catch (e: Exception) { promise.reject("ERR_DECRYPT", e.message, e) }',
+    '  }',
+    '',
+    '  @ReactMethod',
+    '  fun encryptRSA(publicKeyPem: String, dataBase64: String, promise: Promise) {',
+    '    try {',
+    '      val pem = publicKeyPem.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", "").replace("\\n", "").trim()',
+    '      val pubKey = KeyFactory.getInstance("RSA").generatePublic(X509EncodedKeySpec(Base64.decode(pem, Base64.NO_WRAP)))',
+    '      val cipher = Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding")',
+    '      cipher.init(Cipher.ENCRYPT_MODE, pubKey)',
+    '      promise.resolve(Base64.encodeToString(cipher.doFinal(Base64.decode(dataBase64, Base64.NO_WRAP)), Base64.NO_WRAP))',
+    '    } catch (e: Exception) { promise.reject("ERR_RSA_ENCRYPT", e.message, e) }',
+    '  }',
+    '}',
+  ].join('\n');
+}
+
+function generateNativeAndroidPackage(config) {
+  const pkg = config.androidPackage || 'com.example.security';
+  return [
+    'package ' + pkg,
+    '',
+    'import com.facebook.react.ReactPackage',
+    'import com.facebook.react.bridge.NativeModule',
+    'import com.facebook.react.bridge.ReactApplicationContext',
+    'import com.facebook.react.uimanager.ViewManager',
+    '',
+    'class NativeCryptoPackage : ReactPackage {',
+    '  override fun createNativeModules(ctx: ReactApplicationContext): List<NativeModule> =',
+    '    listOf(NativeCryptoModule(ctx))',
+    '  override fun createViewManagers(ctx: ReactApplicationContext): List<ViewManager<*, *>> = emptyList()',
+    '}',
+    '// Register NativeCryptoPackage in MainApplication.kt getPackages()',
+  ].join('\n');
+}
+
+function generateNativeIosModule() {
+  return [
+    '// NativeCryptoModule.swift',
+    'import CryptoKit',
+    'import Foundation',
+    '',
+    '@objc(NativeCryptoModule)',
+    'class NativeCryptoModule: NSObject {',
+    '',
+    '  @objc func encryptAES(_ plaintext: String, keyBase64: String,',
+    '    resolve: @escaping RCTPromiseResolveBlock, reject: @escaping RCTPromiseRejectBlock) {',
+    '    do {',
+    '      guard let data = plaintext.data(using: .utf8),',
+    '            let keyData = Data(base64Encoded: keyBase64), keyData.count == 32 else {',
+    '        return reject("ERR_INVALID_INPUT", "Invalid plaintext or key", nil)',
+    '      }',
+    '      let key = SymmetricKey(data: keyData)',
+    '      let nonce = try AES.GCM.Nonce()',
+    '      let sealed = try AES.GCM.seal(data, using: key, nonce: nonce)',
+    '      resolve(["ciphertext": (sealed.ciphertext + sealed.tag).base64EncodedString(),',
+    '               "iv": Data(nonce).base64EncodedString()])',
+    '    } catch { reject("ERR_ENCRYPT", error.localizedDescription, error) }',
+    '  }',
+    '',
+    '  @objc func decryptAES(_ ciphertextBase64: String, ivBase64: String, keyBase64: String,',
+    '    resolve: @escaping RCTPromiseResolveBlock, reject: @escaping RCTPromiseRejectBlock) {',
+    '    do {',
+    '      guard let combined = Data(base64Encoded: ciphertextBase64),',
+    '            let ivData = Data(base64Encoded: ivBase64),',
+    '            let keyData = Data(base64Encoded: keyBase64),',
+    '            keyData.count == 32, combined.count > 16 else {',
+    '        return reject("ERR_INVALID_INPUT", "Invalid inputs", nil)',
+    '      }',
+    '      let key = SymmetricKey(data: keyData)',
+    '      let nonce = try AES.GCM.Nonce(data: ivData)',
+    '      let box = try AES.GCM.SealedBox(nonce: nonce, ciphertext: combined.dropLast(16), tag: combined.suffix(16))',
+    '      guard let plain = String(data: try AES.GCM.open(box, using: key), encoding: .utf8) else {',
+    '        return reject("ERR_DECODE", "UTF-8 decode failed", nil)',
+    '      }',
+    '      resolve(plain)',
+    '    } catch { reject("ERR_DECRYPT", error.localizedDescription, error) }',
+    '  }',
+    '',
+    '  @objc func encryptRSA(_ publicKeyPEM: String, dataBase64: String,',
+    '    resolve: @escaping RCTPromiseResolveBlock, reject: @escaping RCTPromiseRejectBlock) {',
+    '    guard let data = Data(base64Encoded: dataBase64) else {',
+    '      return reject("ERR_INVALID_INPUT", "Invalid data", nil)',
+    '    }',
+    '    let pem = publicKeyPEM',
+    '      .replacingOccurrences(of: "-----BEGIN PUBLIC KEY-----", with: "")',
+    '      .replacingOccurrences(of: "-----END PUBLIC KEY-----", with: "")',
+    '      .replacingOccurrences(of: "\\n", with: "")',
+    '    guard let keyData = Data(base64Encoded: pem),',
+    '          let secKey = SecKeyCreateWithData(keyData as CFData,',
+    '            [kSecAttrKeyType: kSecAttrKeyTypeRSA, kSecAttrKeyClass: kSecAttrKeyClassPublic] as CFDictionary, nil) else {',
+    '      return reject("ERR_KEY_LOAD", "Failed to load RSA key", nil)',
+    '    }',
+    '    var error: Unmanaged<CFError>?',
+    '    guard let encrypted = SecKeyCreateEncryptedData(secKey, .rsaEncryptionOAEPSHA256, data as CFData, &error) else {',
+    '      return reject("ERR_RSA_ENCRYPT", error?.takeRetainedValue().localizedDescription ?? "RSA encrypt failed", nil)',
+    '    }',
+    '    resolve((encrypted as Data).base64EncodedString())',
+    '  }',
+    '}',
+  ].join('\n');
+}
+
+function generateNativeIosBridge() {
+  return [
+    '// NativeCryptoModule.m',
+    '#import <React/RCTBridgeModule.h>',
+    '@interface RCT_EXTERN_MODULE(NativeCryptoModule, NSObject)',
+    'RCT_EXTERN_METHOD(encryptAES:(NSString *)plaintext keyBase64:(NSString *)keyBase64 resolve:(RCTPromiseResolveBlock)resolve reject:(RCTPromiseRejectBlock)reject)',
+    'RCT_EXTERN_METHOD(decryptAES:(NSString *)ciphertextBase64 ivBase64:(NSString *)ivBase64 keyBase64:(NSString *)keyBase64 resolve:(RCTPromiseResolveBlock)resolve reject:(RCTPromiseRejectBlock)reject)',
+    'RCT_EXTERN_METHOD(encryptRSA:(NSString *)publicKeyPEM dataBase64:(NSString *)dataBase64 resolve:(RCTPromiseResolveBlock)resolve reject:(RCTPromiseRejectBlock)reject)',
+    '@end',
+  ].join('\n');
+}
+
+function generateNativeJsBridge() {
+  return [
+    "import { NativeModules } from 'react-native';",
+    "const { NativeCryptoModule } = NativeModules;",
+    "",
+    "if (!NativeCryptoModule) {",
+    "  throw new Error('[NativeCryptoModule] Native module not registered. Verify MainApplication and Xcode wiring.');",
+    "}",
+    "",
+    "export interface NativeEncryptResult { ciphertext: string; iv: string; }",
+    "",
+    "export const nativeEncryptAES = (plaintext: string, keyBase64: string): Promise<NativeEncryptResult> =>",
+    "  NativeCryptoModule.encryptAES(plaintext, keyBase64);",
+    "",
+    "export const nativeDecryptAES = (ciphertextBase64: string, ivBase64: string, keyBase64: string): Promise<string> =>",
+    "  NativeCryptoModule.decryptAES(ciphertextBase64, ivBase64, keyBase64);",
+    "",
+    "export const nativeEncryptRSA = (publicKeyPEM: string, dataBase64: string): Promise<string> =>",
+    "  NativeCryptoModule.encryptRSA(publicKeyPEM, dataBase64);",
+  ].join('\n');
+}
+
+// ── CLI ───────────────────────────────────────────────────────────────────────
+
+if (args.includes('--help') || args.includes('-h')) {
+  console.log([
+    'Usage: node install.js --config-json <path> [--dry-run] [--detection-mode <mode>]',
+    '',
+    'Options:',
+    '  --config-json     Path to the resolved config JSON file (required)',
+    '  --dry-run         Print file paths and content without writing to disk',
+    '  --detection-mode  One of: replace (default), reuse, refactor',
+    '                      replace  Overwrite all generated files (default)',
+    '                      reuse    Skip files that already exist; generate only missing ones',
+    '                      refactor Write scaffold files (*.scaffold.*) alongside existing; do not overwrite',
+    '  --help            Print this help and exit',
+    '',
+    'Exit codes:',
+    '  0  Success',
+    '  1  Config JSON missing or invalid',
+    '  2  File write error',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const configIndex = args.indexOf('--config-json');
+if (configIndex === -1 || !args[configIndex + 1]) {
+  console.error('Error: --config-json is required.');
+  console.error('Run with --help for usage.');
+  process.exit(1);
+}
+
+const dryRun     = args.includes('--dry-run');
+const configPath = path.resolve(args[configIndex + 1]);
+
+const detectionModeIndex = args.indexOf('--detection-mode');
+const detectionMode = (detectionModeIndex !== -1 && args[detectionModeIndex + 1])
+  ? args[detectionModeIndex + 1]
+  : 'replace';
+if (!['replace', 'reuse', 'refactor'].includes(detectionMode)) {
+  console.error('Error: --detection-mode must be one of: replace, reuse, refactor');
+  process.exit(1);
+}
+
+const config     = loadJson(configPath, 'config JSON');
+const matrix     = loadJson(MATRIX_PATH, 'platform-matrix.json');
+
+const platform = config.platform;
+if (!platform || !matrix.platforms[platform]) {
+  console.error('Error: config.platform "' + platform + '" is not a supported platform.');
+  console.error('Supported: ' + Object.keys(matrix.platforms).join(', '));
+  process.exit(1);
+}
+
+const platformDef = matrix.platforms[platform];
+const projectPath = path.resolve(config.projectPath || process.cwd());
+const approach    = config.approach || 1;
+
+// ── Production React Native (approaches 4 & 5) ────────────────────────────────
+if (platform === 'react-native' && (approach === 4 || approach === 5 || approach === 6)) {
+
+  // ── Approach 6 (EC / ECDH+AES-256-GCM) ─────────────────────────────────────
+  if (approach === 6) {
+    const secDir = 'src/services/security';
+    const isSessionInit = config.ecContractType === 'session-init';
+    const isNativeLayer = config.encryptionLayer === 'native';
+
+    const ecTypes = [
+      "// src/services/security/types.ts",
+      "// Per-request cryptographic material (used by both RSA and EC modes)",
+      "export type RequestCryptoMaterial = {",
+      "  aesKey: Uint8Array;",
+      "  requestIv: Uint8Array;",
+      "  keyId?: string;",
+      "};",
+      "",
+      "export type EcPublicKeyResponse = {",
+      "  public_key: string;   // base64(65-byte uncompressed P-256 point)",
+      "  key_id: string;",
+      "  expires_at?: string;",
+      "};",
+      "",
+      "export type EcEncryptedEnvelope = {",
+      "  data: string;",
+      "  ephemeral_public_key: string;",
+      "  iv: string;",
+      "  nonce: string;",
+      "  key_id?: string;",
+      "};",
+    ].join('\n');
+
+    const endpoint = config.ecKeyEndpoint || '<API_BASE_URL>/api/security/ec-public-key';
+    const retries  = config.ecKeyRetries  || 3;
+    const ecKeyService = [
+      "import axios from 'axios';",
+      "import type { EcPublicKeyResponse } from './types';",
+      "",
+      "const DEFAULT_EC_KEY_PATH = '/api/security/ec-public-key';",
+      "const MAX_RETRIES = " + retries + ";",
+      "",
+      "export class EcKeyService {",
+      "  private cachedKey: EcPublicKeyResponse | null = null;",
+      "  constructor(private readonly apiBaseUrl: string) {}",
+      "  getCached(): EcPublicKeyResponse | null { return this.cachedKey; }",
+      "  clearCache(): void { this.cachedKey = null; }",
+      "  async getPublicKey(accessToken?: string): Promise<EcPublicKeyResponse> {",
+      "    if (this.cachedKey) return this.cachedKey;",
+      "    return this.refreshPublicKey(accessToken);",
+      "  }",
+      "  async refreshPublicKey(accessToken?: string): Promise<EcPublicKeyResponse> {",
+      "    const url = '" + endpoint + "'.startsWith('http') ? '" + endpoint + "' : this.apiBaseUrl.replace(/\\/$/, '') + DEFAULT_EC_KEY_PATH;",
+      "    let lastError: unknown;",
+      "    for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {",
+      "      try {",
+      "        const response = await axios.get<EcPublicKeyResponse>(url, {",
+      "          timeout: 10000,",
+      "          headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : undefined,",
+      "        });",
+      "        if (!response.data?.public_key) throw new Error('EC public key response missing public_key');",
+      "        const decoded = Buffer.from(response.data.public_key, 'base64');",
+      "        if (decoded.length !== 65 || decoded[0] !== 0x04) {",
+      "          throw new Error('Invalid EC public key: must be 65-byte uncompressed P-256 point');",
+      "        }",
+      "        this.cachedKey = response.data;",
+      "        return response.data;",
+      "      } catch (error) { lastError = error; }",
+      "    }",
+      "    throw lastError instanceof Error ? lastError : new Error('Failed to fetch EC public key');",
+      "  }",
+      "}",
+    ].join('\n');
+
+    const ecCryptoUtil = isSessionInit ? [
+      "import {",
+      "  createCipheriv, createDecipheriv, createECDH, createHmac,",
+      "  randomBytes, Buffer as QCBuffer,",
+      "} from 'react-native-quick-crypto';",
+      "import { Buffer } from 'buffer';",
+      "import type { EcEncryptedEnvelope, RequestCryptoMaterial } from './types';",
+      "",
+      "declare function btoa(input: string): string;",
+      "",
+      "export function toBase64(buf: Uint8Array): string {",
+      "  const bytes = new Uint8Array(buf);",
+      "  let binary = '';",
+      "  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);",
+      "  return btoa(binary);",
+      "}",
+      "",
+      "function toBuffer(input: unknown): Buffer {",
+      "  if (Buffer.isBuffer(input)) return input;",
+      "  return Buffer.from(input as Uint8Array);",
+      "}",
+      "",
+      "function byteCopy(buf: Buffer | Uint8Array, start?: number, end?: number): Uint8Array {",
+      "  const view = start !== undefined ? buf.slice(start, end) : buf;",
+      "  return new Uint8Array(view);",
+      "}",
+      "",
+      "function urlSafeBase64ToStd(input: string): string {",
+      "  const normalized = input.replace(/-/g, '+').replace(/_/g, '/');",
+      "  return normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=');",
+      "}",
+      "",
+      "function hkdfSha256(ikm: Buffer, salt: Buffer, info: Buffer): Buffer {",
+      "  const prk = toBuffer(createHmac('sha256', byteCopy(salt)).update(byteCopy(ikm)).digest());",
+      "  const t1 = toBuffer(createHmac('sha256', byteCopy(prk)).update(byteCopy(Buffer.concat([info, Buffer.from([0x01])]))).digest());",
+      "  return t1.slice(0, 32);",
+      "}",
+      "",
+      "export function buildSessionAad(keyId: string, deviceId: string, apiVersion = 'v1'): Buffer {",
+      "  return Buffer.from(`{\"api_ver\":\"${apiVersion}\",\"device_id\":\"${deviceId}\",\"key_id\":\"${keyId}\"}`, 'utf8');",
+      "}",
+      "",
+      "export function deriveSessionKey(",
+      "  clientEcdh: ReturnType<typeof createECDH>,",
+      "  serverEcdhPubBase64: string,",
+      "  saltBase64: string,",
+      "  keyId: string,",
+      "  deviceId: string,",
+      "  apiVersion = 'v1',",
+      "): Buffer {",
+      "  const serverPubBytes = Buffer.from(urlSafeBase64ToStd(serverEcdhPubBase64), 'base64');",
+      "  const sharedSecret = toBuffer(clientEcdh.computeSecret(serverPubBytes as any));",
+      "  const saltBytes = Buffer.from(urlSafeBase64ToStd(saltBase64), 'base64');",
+      "  // IMPORTANT: confirm the exact info string with your backend team",
+      "  const contextInfo = `" + (config.ecHkdfInfo || 'REPLACE_WITH_BACKEND_HKDF_INFO_STRING') + "`;",
+      "  return hkdfSha256(sharedSecret, saltBytes, Buffer.from(contextInfo, 'utf8'));",
+      "}",
+      "",
+      "export function sessionEncrypt(payload: unknown, aesKey: Buffer, nonce: string, aad?: Buffer): string {",
+      "  const iv = Buffer.from(nonce, 'utf8');",
+      "  const plaintext = Buffer.from(JSON.stringify(payload), 'utf8');",
+      "  const cipher = createCipheriv('aes-256-gcm', byteCopy(aesKey), byteCopy(iv));",
+      "  if (aad && aad.length > 0) cipher.setAAD(QCBuffer.from(byteCopy(aad)));",
+      "  const encrypted = toBuffer(cipher.update(byteCopy(plaintext)));",
+      "  const finalBlock = toBuffer(cipher.final());",
+      "  const authTag = toBuffer(cipher.getAuthTag());",
+      "  return toBase64(Buffer.concat([encrypted, finalBlock, authTag]));",
+      "}",
+      "",
+      "export function sessionDecrypt(encryptedBase64: string, aesKey: Buffer, nonce: string, aad?: Buffer): string {",
+      "  const decoded = Buffer.from(encryptedBase64, 'base64');",
+      "  if (decoded.length < 16) throw new Error(`Response too short: ${decoded.length} bytes`);",
+      "  const authTag = byteCopy(decoded, decoded.length - 16);",
+      "  const ciphertext = byteCopy(decoded, 0, decoded.length - 16);",
+      "  const iv = Buffer.from(nonce, 'utf8');",
+      "  const decipher = createDecipheriv('aes-256-gcm', byteCopy(aesKey), byteCopy(iv));",
+      "  if (aad && aad.length > 0) decipher.setAAD(QCBuffer.from(byteCopy(aad)));",
+      "  decipher.setAuthTag(QCBuffer.from(authTag));",
+      "  const decrypted = toBuffer(decipher.update(ciphertext));",
+      "  const finalBlock = toBuffer(decipher.final());",
+      "  return Buffer.concat([decrypted, finalBlock]).toString('utf8');",
+      "}",
+    ].join('\n') : [
+      "import {",
+      "  createCipheriv, createECDH, createHmac, randomBytes, Buffer as QCBuffer,",
+      "} from 'react-native-quick-crypto';",
+      "import { Buffer } from 'buffer';",
+      "import type { EcEncryptedEnvelope, RequestCryptoMaterial } from './types';",
+      "",
+      "declare function btoa(input: string): string;",
+      "",
+      "export function toBase64(buf: Uint8Array): string {",
+      "  const bytes = new Uint8Array(buf);",
+      "  let binary = '';",
+      "  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);",
+      "  return btoa(binary);",
+      "}",
+      "",
+      "function toBuffer(input: unknown): Buffer {",
+      "  if (Buffer.isBuffer(input)) return input;",
+      "  return Buffer.from(input as Uint8Array);",
+      "}",
+      "",
+      "function byteCopy(buf: Buffer | Uint8Array, start?: number, end?: number): Uint8Array {",
+      "  const view = start !== undefined ? buf.slice(start, end) : buf;",
+      "  return new Uint8Array(view);",
+      "}",
+      "",
+      "function hkdfSha256(ikm: Buffer, salt: Buffer, info: Buffer): Buffer {",
+      "  const prk = toBuffer(createHmac('sha256', byteCopy(salt)).update(byteCopy(ikm)).digest());",
+      "  const t1 = toBuffer(createHmac('sha256', byteCopy(prk)).update(byteCopy(Buffer.concat([info, Buffer.from([0x01])]))).digest());",
+      "  return t1.slice(0, 32);",
+      "}",
+      "",
+      "export async function ecEncryptPayload(",
+      "  payload: unknown,",
+      "  serverEcPublicKeyBase64: string,",
+      "  nonce: string,",
+      "  keyId?: string,",
+      "): Promise<{ envelope: EcEncryptedEnvelope; material: RequestCryptoMaterial }> {",
+      "  const ecdh = createECDH('prime256v1');",
+      "  ecdh.generateKeys();",
+      "  const ephemeralPublicKeyBytes = toBuffer(ecdh.getPublicKey());",
+      "  const serverPublicKeyBytes = Buffer.from(serverEcPublicKeyBase64, 'base64');",
+      "  const sharedSecret = toBuffer(ecdh.computeSecret(serverPublicKeyBytes as any));",
+      "  const aesKey = hkdfSha256(sharedSecret, Buffer.from(nonce, 'utf8'), Buffer.from('enc', 'utf8'));",
+      "  const iv = toBuffer(randomBytes(12));",
+      "  const plaintext = Buffer.from(JSON.stringify(payload), 'utf8');",
+      "  const cipher = createCipheriv('aes-256-gcm', byteCopy(aesKey), byteCopy(iv));",
+      "  const encrypted = toBuffer(cipher.update(byteCopy(plaintext)));",
+      "  const finalBlock = toBuffer(cipher.final());",
+      "  const authTag = toBuffer(cipher.getAuthTag());",
+      "  const data = Buffer.concat([encrypted, finalBlock, authTag]);",
+      "  return {",
+      "    envelope: {",
+      "      data: toBase64(data),",
+      "      ephemeral_public_key: toBase64(ephemeralPublicKeyBytes),",
+      "      iv: toBase64(iv),",
+      "      nonce,",
+      "      key_id: keyId,",
+      "    },",
+      "    material: { aesKey, requestIv: iv, keyId },",
+      "  };",
+      "}",
+      "",
+      "export async function ecDeriveKey(",
+      "  serverEcPublicKeyBase64: string,",
+      "  nonce: string,",
+      "): Promise<{ derivedAesKeyBase64: string; ephemeralPublicKeyBase64: string }> {",
+      "  const ecdh = createECDH('prime256v1');",
+      "  ecdh.generateKeys();",
+      "  const ephemeralPublicKeyBytes = toBuffer(ecdh.getPublicKey());",
+      "  const serverPublicKeyBytes = Buffer.from(serverEcPublicKeyBase64, 'base64');",
+      "  const sharedSecret = toBuffer(ecdh.computeSecret(serverPublicKeyBytes as any));",
+      "  const aesKey = hkdfSha256(sharedSecret, Buffer.from(nonce, 'utf8'), Buffer.from('enc', 'utf8'));",
+      "  return {",
+      "    derivedAesKeyBase64: toBase64(aesKey),",
+      "    ephemeralPublicKeyBase64: toBase64(ephemeralPublicKeyBytes),",
+      "  };",
+      "}",
+    ].join('\n');
+
+    const ecConfig = [
+      "export const ENCRYPTION_MODEL   = 'ec';",
+      "export const ENCRYPTION_LAYER   = process.env.ENCRYPTION_LAYER ?? '" + (isNativeLayer ? 'native' : 'rn') + "';",
+      "export const ENCRYPTION_ENABLED = process.env.ENCRYPTION_ENABLED === 'true';",
+      "export const EC_KEY_ENDPOINT    = process.env.EC_PUBLIC_KEY_ENDPOINT ?? '" + endpoint + "';",
+      "export const HMAC_ENABLED       = process.env.HMAC_ENABLED === 'true';",
+      "export const HMAC_SECRET        = process.env.ENCRYPTION_HMAC_SECRET ?? '';",
+      "export const EXCLUDED_PATHS: string[] = [",
+      ...(config.excludeUrls || []).map(u => "  '" + u + "',"),
+      "];",
+    ].join('\n');
+
+    const ecFiles = {
+      [secDir + '/types.ts']:              ecTypes,
+      [secDir + '/ec-key.service.ts']:     ecKeyService,
+      [secDir + '/ec-crypto.util.ts']:     ecCryptoUtil,
+      [secDir + '/keychain.service.ts']:   generateRnProductionKeychainService(),
+      [secDir + '/hmac.service.ts']:       generateRnProductionHmacService(),
+      [secDir + '/encryption-config.ts']:  ecConfig,
+    };
+
+    for (const [relPath, content] of Object.entries(ecFiles)) {
+      const absPath = path.join(projectPath, relPath);
+      if (detectionMode === 'reuse' && fs.existsSync(absPath)) {
+        console.log('SKIP (reuse mode, file exists)  ' + relPath);
+        continue;
+      }
+      const targetRelPath = detectionMode === 'refactor' ? scaffoldPath(relPath) : relPath;
+      writeFile(path.join(projectPath, targetRelPath), content, dryRun);
+    }
+
+    const axiosWiringPathEc = path.join(projectPath, 'src/api/axiosInstance.ts');
+    if (!fs.existsSync(axiosWiringPathEc)) {
+      writeFile(axiosWiringPathEc, generateAxiosInstance(), dryRun);
+    }
+
+    const entryPolyfillFileEc = platformDef.entryPolyfillFile;
+    if (entryPolyfillFileEc) {
+      patchIndexPolyfill(path.join(projectPath, entryPolyfillFileEc), dryRun);
+    }
+
+    console.log('INSTALL_RESULT : SUCCESS');
+    process.exit(0);
+  }
+
+  const secDir = 'src/services/security';
+  const prodFiles = {
+    [secDir + '/types.ts']:              generateRnProductionTypes(),
+    [secDir + '/encryption.service.ts']: generateRnProductionEncryptionService(),
+    [secDir + '/decryption.service.ts']: generateRnProductionDecryptionService(),
+    [secDir + '/rsa-key.service.ts']:    generateRnProductionRsaKeyService(config),
+    [secDir + '/keychain.service.ts']:   generateRnProductionKeychainService(),
+    [secDir + '/hmac.service.ts']:       generateRnProductionHmacService(),
+    [secDir + '/encryption-config.ts']:  generateRnProductionEncryptionConfig(config),
+    [secDir + '/encryption.interceptor.ts']: generateRnProductionInterceptor(approach, config),
+  };
+
+  if (approach === 5) {
+    const androidPkg = (config.androidPackage || 'com.example.security').replace(/\./g, '/');
+    const androidDir = 'android/app/src/main/java/' + androidPkg;
+    Object.assign(prodFiles, {
+      [androidDir + '/NativeCryptoModule.kt']:  generateNativeAndroidModule(config),
+      [androidDir + '/NativeCryptoPackage.kt']: generateNativeAndroidPackage(config),
+      'ios/NativeCryptoModule.swift':            generateNativeIosModule(),
+      'ios/NativeCryptoModule.m':                generateNativeIosBridge(),
+      [secDir + '/native-crypto.module.ts']:     generateNativeJsBridge(),
+    });
+  }
+
+  for (const [relPath, content] of Object.entries(prodFiles)) {
+    const absPath = path.join(projectPath, relPath);
+    if (detectionMode === 'reuse' && fs.existsSync(absPath)) {
+      console.log('SKIP (reuse mode, file exists)  ' + relPath);
+      continue;
+    }
+    const targetRelPath = detectionMode === 'refactor' ? scaffoldPath(relPath) : relPath;
+    writeFile(path.join(projectPath, targetRelPath), content, dryRun);
+  }
+
+  // Module wiring for production approaches
+  const axiosWiringPath = path.join(projectPath, 'src/api/axiosInstance.ts');
+  const axiosContent = [
+    "import axios from 'axios';",
+    "import { applyProductionEncryptionInterceptor } from '../services/security/encryption.interceptor';",
+    '',
+    'const axiosInstance = axios.create({});',
+    'applyProductionEncryptionInterceptor(axiosInstance);',
+    '// ENCRYPTION_INTERCEPTOR_PLACEHOLDER',
+    '',
+    'export default axiosInstance;',
+  ].join('\n');
+
+  if (!fs.existsSync(axiosWiringPath)) {
+    writeFile(axiosWiringPath, axiosContent, dryRun);
+  } else {
+    patchFile(axiosWiringPath, '// ENCRYPTION_INTERCEPTOR_PLACEHOLDER',
+      '// Production encryption interceptor registered by encryption-decryption-utility skill', dryRun);
+  }
+
+  // Polyfill for quick-crypto
+  const entryPolyfillFile = platformDef.entryPolyfillFile;
+  if (entryPolyfillFile) {
+    patchIndexPolyfill(path.join(projectPath, entryPolyfillFile), dryRun);
+  }
+
+  if (detectionMode === 'refactor') {
+    console.log('');
+    console.log('REFACTOR INSTRUCTIONS:');
+    console.log('  Scaffold files written alongside your existing files (*.scaffold.* suffix).');
+    console.log('  Review each scaffold file and manually migrate logic into src/services/security/.');
+    console.log('  The wiring file was NOT modified. Register your centralized module manually.');
+  }
+
+  console.log('INSTALL_RESULT : SUCCESS');
+  process.exit(0);
+}
+
+// ── Approaches 1-3 (and all other platforms) ──────────────────────────────────
+const filePaths = platformDef.filePaths;
+
+const files = {
+  [filePaths.config]:      generateConfig(platform, config),
+  [filePaths.service]:     generateService(platform, config),
+  [filePaths.interceptor]: generateInterceptor(platform, config),
+};
+
+for (const [relPath, content] of Object.entries(files)) {
+  const absPath = path.join(projectPath, relPath);
+  if (detectionMode === 'reuse' && fs.existsSync(absPath)) {
+    console.log('SKIP (reuse mode, file exists)  ' + relPath);
+    continue;
+  }
+  const targetRelPath = detectionMode === 'refactor' ? scaffoldPath(relPath) : relPath;
+  writeFile(path.join(projectPath, targetRelPath), content, dryRun);
+}
+
+const moduleWiringPath = path.join(projectPath, filePaths.moduleWiring);
+
+// Wiring patch is skipped in refactor mode — the scaffold files must be wired manually.
+if (detectionMode !== 'refactor') {
+  // Angular 17+ standalone: app.module.ts does not exist — patch app.config.ts instead
+  if (platform === 'angular' && !fs.existsSync(moduleWiringPath)) {
+    const standaloneWiringFile = platformDef.standaloneWiringFile;
+    if (standaloneWiringFile) {
+      const standaloneWiringPath = path.join(projectPath, standaloneWiringFile);
+      const standaloneInsert = [
+        "import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http';",
+        "import { HTTP_INTERCEPTORS } from '@angular/common/http';",
+        "import { EncryptionInterceptor } from './core/encryption/encryption.interceptor';",
+        '// Encryption interceptor registered by encryption-decryption-utility skill',
+      ].join('\n');
+      patchFile(standaloneWiringPath, '// ENCRYPTION_INTERCEPTOR_PLACEHOLDER', standaloneInsert, dryRun);
+      console.log('NOTE  Angular standalone project detected. Patched app.config.ts instead of app.module.ts.');
+      console.log('NOTE  Add provideHttpClient(withInterceptorsFromDi()) and the HTTP_INTERCEPTORS provider to your appConfig.providers array manually if not already present.');
+    } else {
+      console.log('SKIP PATCH (standaloneWiringFile not defined for platform): ' + platform);
+    }
+  } else if (platform === 'react' || platform === 'react-native') {
+    // React / React Native: create axiosInstance.ts if missing, otherwise patch it
+    if (!fs.existsSync(moduleWiringPath)) {
+      writeFile(moduleWiringPath, generateAxiosInstance(), dryRun);
+    } else {
+      patchFile(
+        moduleWiringPath,
+        '// ENCRYPTION_INTERCEPTOR_PLACEHOLDER',
+        '// Encryption interceptor registered by encryption-decryption-utility skill',
+        dryRun
+      );
+    }
+    // React Native only: prepend react-native-get-random-values polyfill to index.js
+    if (platform === 'react-native') {
+      const entryPolyfillFile = platformDef.entryPolyfillFile;
+      if (entryPolyfillFile) {
+        patchIndexPolyfill(path.join(projectPath, entryPolyfillFile), dryRun);
+      }
+    }
+  } else {
+    patchFile(
+      moduleWiringPath,
+      '// ENCRYPTION_INTERCEPTOR_PLACEHOLDER',
+      '// Encryption interceptor registered by encryption-decryption-utility skill',
+      dryRun
+    );
+  }
+}
+
+if (detectionMode === 'refactor') {
+  console.log('');
+  console.log('REFACTOR INSTRUCTIONS:');
+  console.log('  Scaffold files written alongside your existing files (*.scaffold.* suffix).');
+  console.log('  Review each scaffold file and manually migrate logic into your centralized encryption module.');
+  console.log('  Files written:');
+  for (const relPath of Object.keys(files)) {
+    console.log('    ' + scaffoldPath(relPath));
+  }
+  console.log('  The wiring file was NOT modified. Register your centralized module manually.');
+}
+
+console.log('INSTALL_RESULT : SUCCESS');
+process.exit(0);