devendra-skill-package 1.0.2

package/.github/skills/encryption-decryption-utility/scripts/setup.js

@@ -0,0 +1,800 @@
+#!/usr/bin/env node
+/**
+ * setup.js - Encryption-Decryption Generator Skill
+ *
+ * Interactive wizard that collects platform/approach/key choices,
+ * validates against platform-matrix.json, runs detect.js, writes a
+ * resolved config, calls install.js, runs the project build, and prints
+ * a deterministic 6-field report.
+ *
+ * Usage:
+ *   node setup.js --project-path <path> [--help]
+ *
+ * Exit codes:
+ *   0  Setup complete, build pass
+ *   1  User-input validation failed
+ *   2  detect.js found existing encryption code (user must confirm override)
+ *   3  install.js write error
+ *   4  Build failed after max retries
+ */
+
+'use strict';
+
+const fs       = require('fs');
+const path     = require('path');
+const readline = require('readline');
+const { spawnSync } = require('child_process');
+
+// ── React Native compatible version table ─────────────────────────────────────
+//
+// Entries are evaluated in order; the first match where RN major.minor >= minMajor.minMinor wins.
+// Packages not in this table are installed without a pinned version (latest).
+//
+const VERSION_COMPAT = {
+  'react-native-quick-crypto': [
+    { minMajor: 0, minMinor: 71, version: '^0.7.4' },
+    { minMajor: 0, minMinor: 68, version: '^0.6.1' },
+    { minMajor: 0, minMinor: 0,  version: '^0.7.4' },  // fallback: latest stable
+  ],
+  '@craftzdog/react-native-buffer': [
+    { minMajor: 0, minMinor: 0,  version: '^6.0.3' },
+  ],
+  'react-native-keychain': [
+    { minMajor: 0, minMinor: 73, version: '^9.0.0' },  // new arch support
+    { minMajor: 0, minMinor: 60, version: '^8.2.0' },
+    { minMajor: 0, minMinor: 0,  version: '^8.2.0' },
+  ],
+  'react-native-get-random-values': [
+    { minMajor: 0, minMinor: 0,  version: '^1.9.0' },
+  ],
+  'jsencrypt': [
+    { minMajor: 0, minMinor: 0,  version: '^3.3.2' },
+  ],
+  'crypto-js': [
+    { minMajor: 0, minMinor: 0,  version: '^4.2.0' },
+  ],
+  '@types/crypto-js': [
+    { minMajor: 0, minMinor: 0,  version: '^4.2.2' },
+  ],
+  'axios': [
+    { minMajor: 0, minMinor: 0,  version: '^1.7.2' },
+  ],
+};
+
+// ── Paths ─────────────────────────────────────────────────────────────────────
+
+const SKILL_ROOT     = path.resolve(__dirname, '..');
+const MATRIX_PATH    = path.join(SKILL_ROOT, 'assets', 'platform-matrix.json');
+const TEMPLATE_PATH  = path.join(SKILL_ROOT, 'assets', 'encryption-config-template.json');
+const DETECT_SCRIPT  = path.join(__dirname, 'detect.js');
+const INSTALL_SCRIPT = path.join(__dirname, 'install.js');
+
+const MAX_BUILD_RETRIES = 3;
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+function loadJson(filePath, label) {
+  if (!fs.existsSync(filePath)) {
+    console.error('Error: ' + label + ' not found: ' + filePath);
+    process.exit(1);
+  }
+  try {
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  } catch (e) {
+    console.error('Error: ' + label + ' is not valid JSON: ' + e.message);
+    process.exit(1);
+  }
+}
+
+function prompt(rl, question) {
+  return new Promise(resolve => rl.question(question, resolve));
+}
+
+function runSync(nodeScript, scriptArgs) {
+  const result = spawnSync(process.execPath, [nodeScript, ...scriptArgs], { encoding: 'utf8' });
+  return {
+    code:   result.status,
+    stdout: result.stdout || '',
+    stderr: result.stderr || '',
+  };
+}
+
+// ── Package version helpers ───────────────────────────────────────────────────
+
+/**
+ * Reads the project's package.json and extracts the react-native version.
+ * Returns { major, minor, patch, raw } or null if not found.
+ */
+function parseRnVersion(projectPath) {
+  const pkgPath = path.join(projectPath, 'package.json');
+  if (!fs.existsSync(pkgPath)) return null;
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    const raw = (pkg.dependencies && pkg.dependencies['react-native'])
+              || (pkg.devDependencies && pkg.devDependencies['react-native'])
+              || null;
+    if (!raw) return null;
+    const cleaned = raw.replace(/^[\^~>=<\s]+/, '');
+    const m = cleaned.match(/^(\d+)\.(\d+)\.?(\d*)/);
+    if (!m) return null;
+    return { major: parseInt(m[1], 10), minor: parseInt(m[2], 10), patch: parseInt(m[3] || '0', 10), raw };
+  } catch (e) {
+    return null;
+  }
+}
+
+/**
+ * Given a React Native version object (or null) and an array of bare package names,
+ * returns an array of versioned install specs like "pkg@^x.y.z".
+ */
+function resolvePackageVersions(rnVersion, packageNames) {
+  return packageNames.map(name => {
+    const compat = VERSION_COMPAT[name];
+    if (!compat) return name;  // no entry — install latest
+    if (!rnVersion) {
+      // No RN version detected — use the fallback (last entry)
+      return name + '@' + compat[compat.length - 1].version;
+    }
+    for (const entry of compat) {
+      const majorOk = rnVersion.major > entry.minMajor;
+      const minorOk = rnVersion.major === entry.minMajor && rnVersion.minor >= entry.minMinor;
+      if (majorOk || minorOk) {
+        return name + '@' + entry.version;
+      }
+    }
+    return name + '@' + compat[compat.length - 1].version;  // fallback
+  });
+}
+
+/**
+ * Returns the set of packages already present in the project's package.json.
+ */
+function getInstalledPackages(projectPath) {
+  const pkgPath = path.join(projectPath, 'package.json');
+  if (!fs.existsSync(pkgPath)) return {};
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    return Object.assign({}, pkg.dependencies || {}, pkg.devDependencies || {});
+  } catch (e) {
+    return {};
+  }
+}
+
+/**
+ * Extracts the bare package name from a versioned spec such as
+ *   "react-native-quick-crypto@^0.7.4"  → "react-native-quick-crypto"
+ *   "@craftzdog/react-native-buffer@^6.0.3" → "@craftzdog/react-native-buffer"
+ */
+function extractPackageName(spec) {
+  if (spec.startsWith('@')) {
+    const atIdx = spec.indexOf('@', 1);
+    return atIdx === -1 ? spec : spec.slice(0, atIdx);
+  }
+  const atIdx = spec.indexOf('@');
+  return atIdx === -1 ? spec : spec.slice(0, atIdx);
+}
+
+/**
+ * Filters out packages that are already listed in the project's package.json,
+ * returning only packages that need to be installed.
+ */
+function filterNewPackages(projectPath, versionedSpecs) {
+  const installed = getInstalledPackages(projectPath);
+  return versionedSpecs.filter(spec => !installed[extractPackageName(spec)]);
+}
+
+/**
+ * Detects whether the project uses yarn, pnpm, or npm by checking lock files.
+ */
+function detectPackageManager(projectPath) {
+  if (fs.existsSync(path.join(projectPath, 'yarn.lock')))       return 'yarn';
+  if (fs.existsSync(path.join(projectPath, 'pnpm-lock.yaml')))  return 'pnpm';
+  return 'npm';
+}
+
+/**
+ * Runs the detected package manager to install the given versioned specs.
+ * Logs what it's about to install. Returns true on success, false on failure.
+ */
+function installPackages(projectPath, versionedSpecs) {
+  if (!versionedSpecs || versionedSpecs.length === 0) return true;
+  const pm = detectPackageManager(projectPath);
+  const addCmd = pm === 'npm' ? 'install' : 'add';
+  const saveFlags = pm === 'npm' ? ['--save'] : [];
+
+  console.log('\nInstalling dependencies with ' + pm + ':');
+  versionedSpecs.forEach(s => console.log('  ' + s));
+
+  const result = spawnSync(pm, [addCmd, ...saveFlags, ...versionedSpecs], {
+    cwd:      projectPath,
+    encoding: 'utf8',
+    shell:    true,
+    stdio:    'inherit',
+  });
+
+  if (result.status !== 0) {
+    console.error('\nPackage install failed (exit ' + result.status + ').');
+    console.error('Run manually:  ' + pm + ' ' + addCmd + ' ' + versionedSpecs.join(' '));
+    return false;
+  }
+  console.log('Packages installed successfully.');
+  return true;
+}
+
+// ── Main ──────────────────────────────────────────────────────────────────────
+
+const args = process.argv.slice(2);
+
+if (args.includes('--help') || args.includes('-h')) {
+  console.log([
+    'Usage: node setup.js --project-path <path> [--help]',
+    '',
+    'Runs an interactive wizard to configure and install encryption.',
+    '',
+    'Options:',
+    '  --project-path  Absolute path to the project root (required)',
+    '  --help          Print this help and exit',
+    '',
+    'Exit codes:',
+    '  0  Setup complete, build passed',
+    '  1  Input validation failed',
+    '  2  Existing encryption detected (override not confirmed)',
+    '  3  Install write error',
+    '  4  Build failed after ' + MAX_BUILD_RETRIES + ' retries',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const ppIndex = args.indexOf('--project-path');
+if (ppIndex === -1 || !args[ppIndex + 1]) {
+  console.error('Error: --project-path is required.');
+  console.error('Run with --help for usage.');
+  process.exit(1);
+}
+
+const projectPath = path.resolve(args[ppIndex + 1]);
+if (!fs.existsSync(projectPath)) {
+  console.error('Error: project path does not exist: ' + projectPath);
+  process.exit(1);
+}
+
+async function main() {
+  const matrix   = loadJson(MATRIX_PATH, 'platform-matrix.json');
+  const template = loadJson(TEMPLATE_PATH, 'encryption-config-template.json');
+
+  const rl = readline.createInterface({
+    input:  process.stdin,
+    output: process.stdout,
+  });
+
+  const platforms = Object.keys(matrix.platforms);
+
+  // ── Step 1: Detect existing encryption ─────────────────────────────────────
+  console.log('\nScanning project for existing encryption code...');
+  const detect = runSync(DETECT_SCRIPT, ['--project-path', projectPath]);
+  let detectionMode = 'replace';
+  if (detect.code === 1) {
+    if (detect.stdout) process.stdout.write(detect.stdout.trim() + '\n');
+    console.log('\nExisting encryption logic detected. Choose how to proceed:');
+    console.log('  1. Reuse existing logic (use existing service/interceptor, generate only missing parts)');
+    console.log('  2. Replace with new implementation');
+    console.log('  3. Refactor and centralize existing logic (scaffold common module, do not overwrite existing)');
+    console.log('  4. Cancel setup');
+    let choice = '';
+    while (!['1', '2', '3', '4'].includes(choice)) {
+      choice = (await prompt(rl, '\nEnter choice [1/2/3/4]: ')).trim();
+      if (!['1', '2', '3', '4'].includes(choice)) {
+        console.log('  Invalid choice. Enter 1, 2, 3, or 4.');
+      }
+    }
+    if (choice === '4') {
+      console.log('Setup cancelled by user.');
+      rl.close();
+      process.exit(2);
+    }
+    detectionMode = { '1': 'reuse', '2': 'replace', '3': 'refactor' }[choice];
+  }
+
+  // ── Step 2: Platform ────────────────────────────────────────────────────────
+  console.log('\nSupported platforms: ' + platforms.join(', '));
+  let platform = '';
+  while (!platform) {
+    const input = await prompt(rl, 'Select platform [' + platforms.join('/') + ']: ');
+    const trimmed = input.trim().toLowerCase();
+    if (platforms.includes(trimmed)) {
+      platform = trimmed;
+    } else {
+      console.log('  Invalid platform. Choose from: ' + platforms.join(', '));
+    }
+  }
+
+  const platformDef = matrix.platforms[platform];
+  const validApproaches = platformDef.approaches;
+
+  // ── Step 3: Approach ────────────────────────────────────────────────────────
+  console.log('\nSupported approaches for ' + platform + ': ' + validApproaches.join(', '));
+  console.log('  1 = RSA-OAEP + AES-256-GCM (Web Crypto)');
+  console.log('  2 = RSA + AES-256-CBC (jsencrypt + crypto-js)');
+  console.log('  3 = AES-256-CBC shared key (crypto-js)');
+  if (platform === 'react-native') {
+    console.log('  4 = Production JS: AES-256-GCM + RSA-OAEP (react-native-quick-crypto, per-request ephemeral keys)');
+    console.log('  5 = Production Native: OS-level crypto (javax.crypto.Cipher / CryptoKit), same interceptor shape');
+    console.log('  6 = EC (ECDH+AES-256-GCM): per-request forward secrecy via P-256 ECDH + HKDF-SHA256; per-request or session-init variants');
+  }
+  let approach = 0;
+  while (!approach) {
+    const input = await prompt(rl, 'Select approach [' + validApproaches.join('/') + ']: ');
+    const num = parseInt(input.trim(), 10);
+    if (validApproaches.includes(num)) {
+      approach = num;
+    } else {
+      console.log('  Invalid approach. Choose from: ' + validApproaches.join(', '));
+    }
+  }
+
+  const config = Object.assign({}, template, { platform, projectPath, approach });
+
+  // ── Step 4 (Production RN approaches 4 & 5) ─────────────────────────────────
+  if (platform === 'react-native' && (approach === 4 || approach === 5 || approach === 6)) {
+    console.log('\n-- Production React Native Setup --');
+
+    // ── Approach 6 (EC) — separate question flow ─────────────────────────────
+    if (approach === 6) {
+      const ecContractAnswer = await prompt(rl, 'EC contract type? (per-request/session-init) [per-request]: ');
+      config.ecContractType = ecContractAnswer.trim().toLowerCase() === 'session-init' ? 'session-init' : 'per-request';
+
+      const ecSourceAnswer = await prompt(rl, 'How is the EC public key provided? (api/env) [api]: ');
+      config.ecKeySource = ecSourceAnswer.trim().toLowerCase() === 'env' ? 'env' : 'api';
+
+      if (config.ecKeySource === 'api') {
+        const ecEndpointAnswer = await prompt(rl, 'EC key endpoint URL [<API_BASE_URL>/api/security/ec-public-key]: ');
+        config.ecKeyEndpoint = ecEndpointAnswer.trim() || '<API_BASE_URL>/api/security/ec-public-key';
+        const ecRetriesAnswer = await prompt(rl, 'Max retries for EC key fetch [3]: ');
+        const ecRetries = parseInt(ecRetriesAnswer.trim(), 10);
+        config.ecKeyRetries = (!isNaN(ecRetries) && ecRetries > 0) ? ecRetries : 3;
+      } else {
+        let ecPubKey = '';
+        while (!ecPubKey) {
+          const input = await prompt(rl, 'Enter EC public key (base64 of 65-byte uncompressed P-256 point): ');
+          const trimmed = input.trim();
+          if (!trimmed) { console.log('  Warning: no EC key provided.'); break; }
+          const decoded = Buffer.from(trimmed, 'base64');
+          if (decoded.length !== 65 || decoded[0] !== 0x04) {
+            console.log('  Invalid EC public key: must be 65-byte uncompressed P-256 point (base64).');
+          } else {
+            config.ecPublicKey = trimmed;
+            ecPubKey = trimmed;
+          }
+        }
+      }
+
+      if (config.ecContractType === 'session-init') {
+        const initEndpointAnswer = await prompt(rl, 'Session init endpoint URL: ');
+        config.ecSessionInitEndpoint = initEndpointAnswer.trim();
+        const hkdfInfoAnswer = await prompt(rl, 'HKDF info string (backend-specific, must be confirmed — no default): ');
+        config.ecHkdfInfo = hkdfInfoAnswer.trim();
+        const nonceFormatAnswer = await prompt(rl, 'Nonce format/length (e.g. "12-char alphanumeric", "12 random bytes base64", etc. — no default): ');
+        config.ecNonceFormat = nonceFormatAnswer.trim();
+        const aadAnswer = await prompt(rl, 'Is AAD required for AES-GCM? (yes/no) [no]: ');
+        config.ecAadRequired = aadAnswer.trim().toLowerCase() === 'yes';
+        if (config.ecAadRequired) {
+          const aadShapeAnswer = await prompt(rl, 'AAD canonical JSON shape (e.g. {"api_ver":"v1","device_id":"...","key_id":"..."}): ');
+          config.ecAadShape = aadShapeAnswer.trim();
+        }
+        const respIvAnswer = await prompt(rl, 'Response IV source? (nonce-utf8 / nonce-base64 / iv-field / other) [nonce-utf8]: ');
+        config.ecResponseIvSource = respIvAnswer.trim() || 'nonce-utf8';
+        const createSessionAnswer = await prompt(rl, 'Token/session endpoint URL (CREATE_SESSION_ENDPOINT) — no default: ');
+        config.ecCreateSessionEndpoint = createSessionAnswer.trim();
+        const responseEncodingAnswer = await prompt(rl, 'Response payload encoding (standard-base64/base64url) [standard-base64]: ');
+        config.ecResponseEncoding = responseEncodingAnswer.trim().toLowerCase() === 'base64url' ? 'base64url' : 'standard-base64';
+        const deviceIdAnswer = await prompt(rl, 'DEVICE_ID_SOURCE — how is the stable device_id generated/retrieved? (no default): ');
+        config.ecDeviceIdSource = deviceIdAnswer.trim();
+        const encryptedAesAnswer = await prompt(rl, 'Does backend return encrypted_shared_aes_key? Should it be used or ignored? (used/ignored) [ignored]: ');
+        config.ecEncryptedAesKeyHandling = encryptedAesAnswer.trim().toLowerCase() === 'used' ? 'used' : 'ignored';
+      }
+
+      // API client type
+      const ecApiClientAnswer = await prompt(rl, 'API client type? (axios/fetch/custom) [axios]: ');
+      config.apiClientType = ['fetch', 'custom'].includes(ecApiClientAnswer.trim().toLowerCase())
+        ? ecApiClientAnswer.trim().toLowerCase() : 'axios';
+
+      const ecApiPathAnswer = await prompt(rl, 'API layer path [src/services/api.ts]: ');
+      config.apiLayerPath = ecApiPathAnswer.trim() || 'src/services/api.ts';
+
+      const ecLayerAnswer = await prompt(rl, 'Encryption layer? (rn/native) [rn]: ');
+      config.encryptionLayer = ecLayerAnswer.trim().toLowerCase() === 'native' ? 'native' : 'rn';
+
+      const ecHmacAnswer = await prompt(rl, 'Enable HMAC request signing? (yes/no) [no]: ');
+      config.hmac = { enabled: false };
+      if (ecHmacAnswer.trim().toLowerCase() === 'yes') {
+        config.hmac.enabled = true;
+        console.log('  HMAC enabled. Set the ENCRYPTION_HMAC_SECRET environment variable before running.');
+      }
+
+      const ecExcludeAnswer = await prompt(rl, 'Exclude any URL paths from encryption? (comma-separated, or leave blank): ');
+      if (ecExcludeAnswer.trim()) {
+        config.excludeUrls = ecExcludeAnswer.split(',').map(u => u.trim()).filter(Boolean);
+      }
+
+      config.encryptionEnabled = true;
+      config.encryptionModel = 'ec';
+
+      rl.close();
+
+      const tmpConfig = path.join(projectPath, '.encryption-resolved-config.tmp.json');
+      try {
+        fs.writeFileSync(tmpConfig, JSON.stringify(config, null, 2), 'utf8');
+      } catch (e) {
+        console.error('Error: could not write temp config: ' + e.message);
+        process.exit(3);
+      }
+
+      console.log('\nInstalling EC encryption files...');
+      const installEc = runSync(INSTALL_SCRIPT, ['--config-json', tmpConfig, '--detection-mode', detectionMode]);
+      if (installEc.stdout) process.stdout.write(installEc.stdout);
+      if (installEc.stderr) process.stderr.write(installEc.stderr);
+      try { fs.unlinkSync(tmpConfig); } catch {}
+
+      if (installEc.code !== 0) {
+        console.error('INSTALL_RESULT : ERROR');
+        process.exit(3);
+      }
+
+      const rnVersionEc = parseRnVersion(projectPath);
+      const approachDepsEc = (matrix.platforms[platform].dependencies || {})[String(approach)] || [];
+      const versionedDepsEc = resolvePackageVersions(rnVersionEc, approachDepsEc);
+      const newDepsEc = filterNewPackages(projectPath, versionedDepsEc);
+      let pkgOkEc = true;
+      if (newDepsEc.length > 0) {
+        pkgOkEc = installPackages(projectPath, newDepsEc);
+      } else {
+        console.log('\nAll required packages are already installed.');
+      }
+
+      console.log([
+        '',
+        '=== SETUP REPORT ===',
+        'Platform                : ' + platform,
+        'Approach                : 6 (EC / ECDH+AES-256-GCM)',
+        'EC contract type        : ' + config.ecContractType,
+        config.ecContractType === 'session-init' ? 'Session init endpoint   : ' + (config.ecSessionInitEndpoint || '(not set)') : null,
+        config.ecContractType === 'session-init' ? 'Create session endpoint : ' + (config.ecCreateSessionEndpoint || '(not set)') : null,
+        config.ecContractType === 'session-init' ? 'Response encoding       : ' + config.ecResponseEncoding : null,
+        config.ecContractType === 'session-init' ? 'Device ID source        : ' + (config.ecDeviceIdSource || '(not set)') : null,
+        config.ecContractType === 'session-init' ? 'Enc. AES key handling   : ' + config.ecEncryptedAesKeyHandling : null,
+        'Encryption layer        : ' + config.encryptionLayer,
+        'HMAC enabled            : ' + config.hmac.enabled,
+        'URL exclusions          : ' + (config.excludeUrls || []).join(', '),
+        newDepsEc.length > 0
+          ? 'Packages installed      : ' + newDepsEc.join(', ')
+          : 'Packages installed      : none (all already present)',
+        !pkgOkEc ? 'WARNING: Package install had errors — run manually' : null,
+        '====================',
+      ].filter(l => l !== null).join('\n'));
+
+      process.exit(0);
+    }
+
+    // RSA key source (approaches 4 and 5 only)
+    const rsaSourceAnswer = await prompt(rl, 'How is the RSA public key provided? (api/env) [api]: ');
+    const rsaKeySource = rsaSourceAnswer.trim().toLowerCase() === 'env' ? 'env' : 'api';
+    config.rsaKeySource = rsaKeySource;
+
+    if (rsaKeySource === 'api') {
+      const endpointAnswer = await prompt(rl, 'RSA key endpoint URL [<API_BASE_URL>/api/security/public-key]: ');
+      config.rsaKeyEndpoint = endpointAnswer.trim() || '<API_BASE_URL>/api/security/public-key';
+      const retriesAnswer = await prompt(rl, 'Max retries for RSA key fetch [3]: ');
+      const retries = parseInt(retriesAnswer.trim(), 10);
+      config.rsaKeyRetries = (!isNaN(retries) && retries > 0) ? retries : 3;
+    } else {
+      // env mode: get PEM inline
+      let pubKey = '';
+      while (!pubKey) {
+        const input = await prompt(rl, 'Enter RSA public key PEM (must begin with -----BEGIN PUBLIC KEY-----): ');
+        const trimmed = input.trim();
+        if (!trimmed) {
+          console.log('  Warning: no public key provided — encryption will fail at runtime.');
+          break;
+        }
+        if (!trimmed.includes('-----BEGIN') || !trimmed.includes('-----END')) {
+          console.log('  Invalid PEM format. Must contain -----BEGIN ... KEY----- / -----END ... KEY----- headers.');
+        } else {
+          config.publicKeyPem = trimmed;
+          pubKey = trimmed;
+        }
+      }
+    }
+
+    // Approach 5 — additional native settings
+    if (approach === 5) {
+      const iosVersionAnswer = await prompt(rl, 'Minimum iOS deployment target [13]: ');
+      const iosV = parseInt(iosVersionAnswer.trim(), 10);
+      config.minIosVersion = (!isNaN(iosV) && iosV >= 13) ? iosV : 13;
+
+      if (!isNaN(iosV) && iosV < 13) {
+        console.log('  NOTE: iOS < 13 — CryptoKit unavailable. CommonCrypto fallback (CCCryptorGCM) will be used.');
+        console.log('  Deployment target raised to 13. Recommend targeting >= 13.0 for new projects.');
+      }
+
+      const androidPkgAnswer = await prompt(rl, 'Android Kotlin package for NativeCryptoModule [com.example.security]: ');
+      config.androidPackage = androidPkgAnswer.trim() || 'com.example.security';
+
+      // Warn about Android minSdkVersion
+      const androidGradle = path.join(projectPath, 'android/app/build.gradle');
+      if (fs.existsSync(androidGradle)) {
+        const gradleContent = fs.readFileSync(androidGradle, 'utf8');
+        const sdkMatch = gradleContent.match(/minSdkVersion\s*[=:]\s*(\d+)/);
+        if (sdkMatch && parseInt(sdkMatch[1], 10) < 23) {
+          console.log('  WARNING: minSdkVersion is ' + sdkMatch[1] + '. AES/GCM/NoPadding requires minSdkVersion >= 23.');
+          console.log('  Update android/app/build.gradle: minSdkVersion = 23');
+        }
+      }
+    }
+
+    // API client type
+    const apiClientAnswer = await prompt(rl, 'API client type? (axios/fetch/custom) [axios]: ');
+    config.apiClientType = ['fetch', 'custom'].includes(apiClientAnswer.trim().toLowerCase())
+      ? apiClientAnswer.trim().toLowerCase() : 'axios';
+
+    // API layer path
+    const apiPathAnswer = await prompt(rl, 'API layer path [src/services/api.ts]: ');
+    config.apiLayerPath = apiPathAnswer.trim() || 'src/services/api.ts';
+
+    // Encryption toggle policy
+    const toggleAnswer = await prompt(rl, 'Encryption toggle policy? (env-flag/always-on) [env-flag]: ');
+    config.encryptionToggle = toggleAnswer.trim().toLowerCase() === 'always-on' ? 'always-on' : 'env-flag';
+
+    // Keychain for tokens
+    const keychainAnswer = await prompt(rl, 'Use react-native-keychain for secure token storage? (yes/no) [yes]: ');
+    config.useKeychain = keychainAnswer.trim().toLowerCase() !== 'no';
+
+    // HMAC
+    const hmacAnswer = await prompt(rl, 'Enable HMAC request signing? (yes/no) [no]: ');
+    config.hmac = { enabled: false };
+    if (hmacAnswer.trim().toLowerCase() === 'yes') {
+      config.hmac.enabled = true;
+      console.log('  HMAC enabled. Set the HMAC_SECRET environment variable in your app before running.');
+    }
+
+    // URL exclusions
+    const excludeAnswer = await prompt(rl, 'Exclude any URL paths from encryption? (comma-separated, or leave blank): ');
+    if (excludeAnswer.trim()) {
+      config.excludeUrls = excludeAnswer.split(',').map(u => u.trim()).filter(Boolean);
+    }
+
+    config.encryptionEnabled = true;
+    rl.close();
+
+    // Write temp config and call install.js
+    const tmpConfig = path.join(projectPath, '.encryption-resolved-config.tmp.json');
+    try {
+      const safeConfig = Object.assign({}, config, { hmac: { enabled: config.hmac.enabled } });
+      fs.writeFileSync(tmpConfig, JSON.stringify(safeConfig, null, 2), 'utf8');
+    } catch (e) {
+      console.error('Error: could not write temp config: ' + e.message);
+      process.exit(3);
+    }
+
+    console.log('\nInstalling production encryption files...');
+    const install = runSync(INSTALL_SCRIPT, ['--config-json', tmpConfig, '--detection-mode', detectionMode]);
+    if (install.stdout) process.stdout.write(install.stdout);
+    if (install.stderr) process.stderr.write(install.stderr);
+    try { fs.unlinkSync(tmpConfig); } catch {}
+
+    if (install.code !== 0) {
+      console.error('INSTALL_RESULT : ERROR');
+      process.exit(3);
+    }
+
+    // ── Detect RN version and install compatible packages ────────────────────
+    const rnVersionProd = parseRnVersion(projectPath);
+    if (rnVersionProd) {
+      console.log('\nDetected React Native version: ' + rnVersionProd.major + '.' + rnVersionProd.minor + '.' + rnVersionProd.patch + ' (from ' + rnVersionProd.raw + ')');
+    } else {
+      console.log('\nWARNING: Could not detect React Native version — installing latest compatible versions.');
+    }
+    const approachDeps = (matrix.platforms[platform].dependencies || {})[String(approach)] || [];
+    const versionedDepsProd = resolvePackageVersions(rnVersionProd, approachDeps);
+    const newDepsProd = filterNewPackages(projectPath, versionedDepsProd);
+    let pkgInstallOkProd = true;
+    if (newDepsProd.length > 0) {
+      pkgInstallOkProd = installPackages(projectPath, newDepsProd);
+      if (!pkgInstallOkProd) {
+        console.error('WARNING: Some packages could not be installed automatically.');
+      }
+    } else {
+      console.log('\nAll required packages are already installed.');
+    }
+
+    console.log([
+      '',
+      '=== SETUP REPORT ===',
+      'Platform                : ' + platform,
+      'Approach                : ' + approach + (approach === 4 ? ' (Production JS)' : ' (Production Native)'),
+      'RN version              : ' + (rnVersionProd ? rnVersionProd.raw : 'unknown'),
+      'RSA key source          : ' + config.rsaKeySource,
+      'RSA key endpoint        : ' + (config.rsaKeyEndpoint || 'env'),
+      'API client type         : ' + (config.apiClientType || 'axios'),
+      'Encryption toggle       : ' + (config.encryptionToggle || 'env-flag'),
+      'HMAC enabled            : ' + config.hmac.enabled,
+      'URL exclusions          : ' + (config.excludeUrls || []).join(', '),
+      approach === 5 ? ('Min iOS version         : ' + config.minIosVersion) : null,
+      approach === 5 ? ('Android package         : ' + (config.androidPackage || 'com.example.security')) : null,
+      config.apiLayerPath && config.apiLayerPath !== 'src/services/api.ts'
+        ? 'NOTE: Interceptor wired into src/api/axiosInstance.ts — integrate with your existing API layer at: ' + config.apiLayerPath
+        : null,
+      newDepsProd.length > 0
+        ? 'Packages installed      : ' + newDepsProd.join(', ')
+        : 'Packages installed      : none (all already present)',
+      !pkgInstallOkProd ? 'WARNING: Package install had errors — run manually' : null,
+      '====================',
+    ].filter(l => l !== null).join('\n'));
+
+    process.exit(0);
+  }
+
+  // ── Step 4–6: Public/private/shared key prompts ─────────────────────────────
+  if (approach === 1 || approach === 2) {
+    let pubKey = '';
+    while (!pubKey) {
+      const input = await prompt(rl, 'Enter public key PEM (must begin with -----BEGIN PUBLIC KEY-----): ');
+      const trimmed = input.trim();
+      if (!trimmed) {
+        console.log('  Warning: no public key provided — encryption will fail at runtime.');
+        break;
+      }
+      if (!trimmed.includes('-----BEGIN') || !trimmed.includes('-----END')) {
+        console.log('  Invalid PEM format. Must contain -----BEGIN ... KEY----- / -----END ... KEY----- headers.');
+      } else {
+        config.publicKeyPem = trimmed;
+        pubKey = trimmed;
+      }
+    }
+  }
+
+  if (approach === 1 || approach === 2) {
+    const decryptResponse = await prompt(rl, 'Decrypt responses too? (yes/no) [no]: ');
+    if (decryptResponse.trim().toLowerCase() === 'yes') {
+      const privKey = await prompt(rl, 'Enter private key PEM (paste on one line, or leave blank to skip): ');
+      if (privKey.trim()) config.privateKeyPem = privKey.trim();
+    }
+  }
+
+  if (approach === 3) {
+    let sharedKey = '';
+    while (!sharedKey) {
+      const input = await prompt(rl, 'Enter shared secret key (min 32 characters): ');
+      const trimmed = input.trim();
+      if (!trimmed) {
+        console.log('  Warning: no shared key provided — encryption will fail at runtime.');
+        break;
+      }
+      if (trimmed.length < 32) {
+        console.log('  Error: shared key must be at least 32 characters. Got ' + trimmed.length + '.');
+      } else {
+        config.sharedKey = trimmed;
+        sharedKey = trimmed;
+      }
+    }
+  }
+
+  // ── Step 7: HMAC ────────────────────────────────────────────────────────────
+  const hmacAnswer = await prompt(rl, 'Enable HMAC signing? (yes/no) [no]: ');
+  config.hmac = { enabled: false };
+  if (hmacAnswer.trim().toLowerCase() === 'yes') {
+    config.hmac.enabled = true;
+    // HMAC secret is intentionally NOT stored in config or temp file.
+    // Set it as env var ENCRYPTION_HMAC_SECRET before running the app.
+    console.log('  HMAC enabled. Set the ENCRYPTION_HMAC_SECRET environment variable in your app before running.');
+  }
+
+  // ── Step 8: URL exclusions ──────────────────────────────────────────────────
+  const excludeAnswer = await prompt(rl, 'Exclude any URL prefixes from encryption? (comma-separated, or leave blank): ');
+  if (excludeAnswer.trim()) {
+    config.excludeUrls = excludeAnswer.split(',').map(u => u.trim()).filter(Boolean);
+  }
+
+  config.encryptionEnabled = true;
+  rl.close();
+
+  // ── Write temp config and call install.js ───────────────────────────────────
+  const tmpConfig = path.join(projectPath, '.encryption-resolved-config.tmp.json');
+  try {
+    // HMAC secret is never written to disk; generated files read it from ENCRYPTION_HMAC_SECRET env var
+    const safeConfig = Object.assign({}, config, { hmac: { enabled: config.hmac.enabled } });
+    fs.writeFileSync(tmpConfig, JSON.stringify(safeConfig, null, 2), 'utf8');
+  } catch (e) {
+    console.error('Error: could not write temp config: ' + e.message);
+    process.exit(3);
+  }
+
+  console.log('\nInstalling encryption files...');
+  const install = runSync(INSTALL_SCRIPT, ['--config-json', tmpConfig, '--detection-mode', detectionMode]);
+  if (install.stdout) process.stdout.write(install.stdout);
+  if (install.stderr) process.stderr.write(install.stderr);
+
+  try { fs.unlinkSync(tmpConfig); } catch {}
+
+  if (install.code !== 0) {
+    console.error('INSTALL_RESULT : ERROR');
+    process.exit(3);
+  }
+
+  // ── Detect RN/project version and install compatible packages ───────────────
+  const rnVersion = parseRnVersion(projectPath);
+  if (platform === 'react-native') {
+    if (rnVersion) {
+      console.log('\nDetected React Native version: ' + rnVersion.major + '.' + rnVersion.minor + '.' + rnVersion.patch + ' (from ' + rnVersion.raw + ')');
+    } else {
+      console.log('\nWARNING: Could not detect React Native version — installing latest compatible versions.');
+    }
+  }
+  const approachDepsRegular = (platformDef.dependencies || {})[String(approach)] || [];
+  if (approachDepsRegular.length > 0) {
+    const versionedDepsRegular = resolvePackageVersions(rnVersion, approachDepsRegular);
+    const newDepsRegular = filterNewPackages(projectPath, versionedDepsRegular);
+    if (newDepsRegular.length > 0) {
+      const pkgOk = installPackages(projectPath, newDepsRegular);
+      if (!pkgOk) {
+        console.error('WARNING: Some packages could not be installed. The build may fail.');
+      }
+    } else {
+      console.log('\nAll required packages are already installed.');
+    }
+  }
+
+  // ── Build with retries ──────────────────────────────────────────────────────
+  const buildCmd = platformDef.buildCommand;
+  let buildResult = null;
+  let buildAttempts = 0;
+  let buildPassed = false;
+
+  if (buildCmd) {
+    console.log('\nRunning build: ' + buildCmd);
+    const [cmd, ...cmdArgs] = buildCmd.split(' ');
+    while (buildAttempts < MAX_BUILD_RETRIES) {
+      buildAttempts++;
+      const build = spawnSync(cmd, cmdArgs, {
+        cwd:      projectPath,
+        encoding: 'utf8',
+        shell:    true,
+      });
+      buildResult = build;
+      if (build.status === 0) {
+        buildPassed = true;
+        break;
+      }
+      console.log('  Build attempt ' + buildAttempts + '/' + MAX_BUILD_RETRIES + ' failed.');
+    }
+  } else {
+    buildPassed = true;
+  }
+
+  // ── Report ──────────────────────────────────────────────────────────────────
+  const filesWritten = (install.stdout.match(/^(WROTE|PATCHED)\s+/mg) || []).length;
+  const buildErrors  = (!buildPassed && buildResult) ? (buildResult.stderr || '').split('\n').slice(0, 5).join('\n') : '';
+
+  console.log([
+    '',
+    '=== SETUP REPORT ===',
+    'Platform                : ' + platform,
+    'Approach                : ' + approach,
+    'HMAC enabled            : ' + config.hmac.enabled,
+    'URL exclusions          : ' + (config.excludeUrls || []).join(', '),
+    'Files written/patched   : ' + filesWritten,
+    'Build status            : ' + (buildPassed ? 'PASS' : 'FAIL'),
+    buildErrors ? ('Build errors (first 5 lines):\n' + buildErrors) : null,
+    '====================',
+  ].filter(l => l !== null).join('\n'));
+
+  if (!buildPassed) {
+    process.exit(4);
+  }
+
+  process.exit(0);
+}
+
+main().catch(e => {
+  console.error('Unexpected error: ' + e.message);
+  process.exit(1);
+});