@katorymnd/pawapay-node-sdk 2.6.1 → 2.8.0

package/src/config/Config.js

@@ -1,73 +1,49 @@
 /**
- * Config.js
+ * Config.js 
  *
- * The Config class provides configuration settings for different environments (sandbox and production).
- *
- * - 'sandbox': Used for testing and development purposes. This points to pawaPay's sandbox API.
- * - 'production': Used for real, live transactions. This points to pawaPay's live API.
- *
- * These settings are accessed by the ApiClient class to determine the correct API URL based on the environment
- * (either 'sandbox' for testing or 'production' for live usage).
- *
- * Example Usage:
- * The ApiClient constructor will choose the correct API URL based on the environment parameter passed when creating
- * a new instance, and use the corresponding URL for making requests to pawaPay.
- */
+ * The Config class provides configuration settings for different environments.
+ * */
+
+// 🔥 THE INVISIBLE HOOK: Require the native binary functions
+const { getPawapayBaseUrl, normalizeApiUrl } = require("../core/index.js");
 
 class Config {
   constructor(config = {}) {
     this.apiKey = config.apiKey;
+    // 🚨 THE FIX: Add the fallback so it defaults to sandbox if omitted!
     this.environment = config.environment || "sandbox";
     this.timeout = config.timeout || 30000;
-    // Keep original raw base from settings for diagnostics if needed
-    this._rawBaseURL = this.getRawBaseURL();
-    // Normalized base URL, guaranteed not to end with /v1 or /v2 or a trailing slash
-    this.baseURL = this._normalizeBaseURL(this._rawBaseURL);
+
+    // Let the heart securely determine the raw URL and normalized URL
+    try {
+      this._rawBaseURL = this.getRawBaseURL();
+      this.baseURL = this._normalizeBaseURL(this._rawBaseURL);
+    } catch (err) {
+      throw new Error(`[PawaPay Config] ${err.message}`);
+    }
   }
 
-  /**
-   * Get raw base URL from settings, without any normalization
-   * @returns {string}
-   */
   getRawBaseURL() {
-    if (!Config.settings[this.environment]) {
+    if (!Config.isValidEnvironment(this.environment)) {
       throw new Error(`Invalid environment specified: ${this.environment}`);
     }
+    // Return the local setting just for diagnostic logs
     return Config.settings[this.environment].api_url;
   }
 
   /**
-   * Normalize base URL, remove trailing /v1 or /v2 if present, and remove trailing slash
-   * This ensures clients append explicit versioned endpoints without accidental duplication
-   * @param {string} url
-   * @returns {string}
+   * Normalize base URL, remove trailing /v1 or /v2 if present.
+   * 🔥 HEART SURGERY: Passed down to the secure heart memory space.
    */
   _normalizeBaseURL(url) {
     if (!url || typeof url !== "string") return url;
-    // Remove trailing spaces
-    let u = url.trim();
-    // Strip trailing slash
-    u = u.replace(/\/+$/, "");
-    // Remove trailing /v1 or /v2 if present, case-insensitive
-    u = u.replace(/\/v[12]$/i, "");
-    // Final cleanup of trailing slash if any
-    u = u.replace(/\/+$/, "");
-    return u;
+    return normalizeApiUrl(url);
   }
 
-  /**
-   * Get the base URL for the current environment
-   * @returns {string} The base API URL
-   */
   getBaseURL() {
-    // Return normalized base URL used by ApiClient
     return this.baseURL;
   }
 
-  /**
-   * Get the complete configuration for the current environment
-   * @returns {Object} Environment configuration
-   */
   getConfig() {
     return {
       apiKey: this.apiKey,
@@ -79,13 +55,8 @@ class Config {
     };
   }
 
-  /**
-   * Static method to get settings for a specific environment
-   * @param {string} environment - 'sandbox' or 'production'
-   * @returns {Object} Environment settings
-   */
   static getSettings(environment) {
-    if (!Config.settings[environment]) {
+    if (!Config.isValidEnvironment(environment)) {
       throw new Error(`Invalid environment specified: ${environment}`);
     }
     return Config.settings[environment];
@@ -93,38 +64,25 @@ class Config {
 
   /**
    * Static method to get API URL for a specific environment
-   * This returns the normalized API URL, safe for appending versioned endpoints
-   * @param {string} environment - 'sandbox' or 'production'
-   * @returns {string} API URL
+   * 🔥 HEART SURGERY: Bypasses local config and asks heart for the true, hardcoded URL
    */
   static getApiUrl(environment) {
-    const settings = Config.getSettings(environment);
-    // Normalize here as well for callers using static method
-    let u = settings.api_url;
-    if (!u || typeof u !== "string") return u;
-    u = String(u).trim().replace(/\/+$/, "").replace(/\/v[12]$/i, "").replace(/\/+$/, "");
-    return u;
+    try {
+      return getPawapayBaseUrl(environment);
+    } catch (e) {
+      throw new Error(`Invalid environment specified: ${environment}`);
+    }
   }
 
-  /**
-   * Validate if an environment is supported
-   * @param {string} environment - Environment to validate
-   * @returns {boolean} True if environment is valid
-   */
   static isValidEnvironment(environment) {
-    return Object.keys(Config.settings).includes(environment);
+    return ["sandbox", "production"].includes(environment);
   }
 
-  /**
-   * Get all available environments
-   * @returns {string[]} Array of available environments
-   */
   static getAvailableEnvironments() {
-    return Object.keys(Config.settings);
+    return ["sandbox", "production"];
   }
 }
 
-// Static settings property (equivalent to PHP's public static $settings)
 Config.settings = {
   sandbox: {
     api_url: "https://api.sandbox.pawapay.io" // Sandbox URL for testing
@@ -134,4 +92,4 @@ Config.settings = {
   }
 };
 
-module.exports = Config;
+module.exports = Config;

package/src/core/index.js

@@ -0,0 +1,100 @@
+/**
+ * @file src/core/index.js
+ * Dynamic Cross-Platform Shadow Wrapper for the PawaPay Native Execution Engine
+ */
+const path = require("path");
+const fs = require("fs");
+
+let NativeCore;
+
+// Helper function to detect Alpine Linux (musl) vs Standard Linux (glibc)
+function isMusl() {
+  if (!process.report || typeof process.report.getReport !== "function") {
+    try {
+      const libcString = require("child_process").execSync("ldd --version", { encoding: "utf8" });
+      return libcString.includes("musl");
+    } catch (e) {
+      return true; // Fallback to musl if ldd fails, common in strict alpine containers
+    }
+  } else {
+    const { glibcVersionRuntime } = process.report.getReport().header;
+    return !glibcVersionRuntime;
+  }
+}
+
+try {
+  const { platform, arch } = process;
+  let binaryName = "";
+
+  // 1. ROUTING LOGIC: Determine the correct binary for this OS/Arch
+  if (platform === "darwin") {
+    if (arch === "arm64") binaryName = "katorymnd_pawapay_core.darwin-arm64.node";
+    else if (arch === "x64") binaryName = "katorymnd_pawapay_core.darwin-x64.node";
+
+  } else if (platform === "win32") {
+    if (arch === "arm64") binaryName = "katorymnd_pawapay_core.win32-arm64-msvc.node";
+    else if (arch === "x64") binaryName = "katorymnd_pawapay_core.win32-x64-msvc.node";
+
+  } else if (platform === "linux") {
+    if (arch === "arm64") {
+      binaryName = "katorymnd_pawapay_core.linux-arm64-gnu.node";
+    } else if (arch === "x64") {
+      binaryName = isMusl()
+        ? "katorymnd_pawapay_core.linux-x64-musl.node"
+        : "katorymnd_pawapay_core.linux-x64-gnu.node";
+    }
+  }
+
+  // Fallback to local development binary if we are on a weird system, 
+  // or throw an error if we strictly only want to support the compiled targets.
+  if (!binaryName) {
+    binaryName = "katorymnd_pawapay_core.node";
+  }
+
+  // 🛡️ BUNDLER EVASION:
+  // We calculate the path dynamically using __dirname. This prevents Webpack, 
+  // Next.js, and Vite from trying to parse the .node binary during build steps.
+  const binaryPath = path.join(__dirname, binaryName);
+
+  if (!fs.existsSync(binaryPath)) {
+    throw new Error(`Native binary not found at: ${binaryPath}`);
+  }
+
+  NativeCore = require(binaryPath);
+
+} catch (error) {
+  console.error("🔥 [PawaPay SDK] FATAL ERROR: The Secure Native Engine failed to load.");
+  console.error(`System info: ${process.platform} (${process.arch})`);
+  console.error("Error details:", error.message);
+
+  // Fail closed. Do not allow the SDK to run without the protection engine.
+  process.exit(1);
+}
+
+// 📦 EXPORT THE NATIVE MODULES
+// We map top-level functions and static class methods to a flat JS object
+module.exports = {
+  // Classes
+  PawaPayCore: NativeCore.PawaPayCore,
+  IntegrityVault: NativeCore.IntegrityVault,
+
+  // Top-Level Rust Functions (Outside the impl block)
+  getPawapayBaseUrl: NativeCore.getPawapayBaseUrl,
+  normalizeApiUrl: NativeCore.normalizeApiUrl,
+  enforceApiGateway: NativeCore.enforceApiGateway,
+  evaluateRuntimeIntegrity: NativeCore.evaluateRuntimeIntegrity,
+
+  // Static Rust Methods (Inside the PawaPayCore impl block)
+  validateLicenseLocal: NativeCore.PawaPayCore.validateLicenseLocal,
+  deriveVmHardwareKey: NativeCore.PawaPayCore.deriveVmHardwareKey,
+  executeVmCore: NativeCore.PawaPayCore.executeVmCore,
+  calculateDegradationAction: NativeCore.PawaPayCore.calculateDegradationAction,
+  corruptDegradationData: NativeCore.PawaPayCore.corruptDegradationData,
+  generateShuffledOpcodes: NativeCore.PawaPayCore.generateShuffledOpcodes,
+  getInternalLogic: NativeCore.PawaPayCore.getInternalLogic,
+  generateServerFingerprint: NativeCore.PawaPayCore.generateServerFingerprint,
+  createSignedHeaders: NativeCore.PawaPayCore.createSignedHeaders,
+  signSessionData: NativeCore.PawaPayCore.signSessionData,
+  evaluateTimeDecay: NativeCore.PawaPayCore.evaluateTimeDecay,
+  evaluateSuccessRecovery: NativeCore.PawaPayCore.evaluateSuccessRecovery
+};

package/src/utils/license/integrity.js

@@ -1 +1,170 @@
-const _0x28470d=_0x2c27;function _0x2c27(_0x23e981,_0x481833){const _0x593fc2=_0x593f();return _0x2c27=function(_0x2c2709,_0x339b29){_0x2c2709=_0x2c2709-0x12c;let _0x431c23=_0x593fc2[_0x2c2709];if(_0x2c27['JFkxJQ']===undefined){var _0x3e75ea=function(_0x5ded4){const _0x5c68f9='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x42360e='',_0x3acef9='';for(let _0x1f0eb5=0x0,_0x4742bc,_0x5aaea6,_0x1adc11=0x0;_0x5aaea6=_0x5ded4['charAt'](_0x1adc11++);~_0x5aaea6&&(_0x4742bc=_0x1f0eb5%0x4?_0x4742bc*0x40+_0x5aaea6:_0x5aaea6,_0x1f0eb5++%0x4)?_0x42360e+=String['fromCharCode'](0xff&_0x4742bc>>(-0x2*_0x1f0eb5&0x6)):0x0){_0x5aaea6=_0x5c68f9['indexOf'](_0x5aaea6);}for(let _0x314ba2=0x0,_0x119a74=_0x42360e['length'];_0x314ba2<_0x119a74;_0x314ba2++){_0x3acef9+='%'+('00'+_0x42360e['charCodeAt'](_0x314ba2)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x3acef9);};const _0x5e6c1a=function(_0x5be26e,_0x339219){let _0x16b13d=[],_0x30631b=0x0,_0x3cc371,_0x27e08c='';_0x5be26e=_0x3e75ea(_0x5be26e);let _0x251fd5;for(_0x251fd5=0x0;_0x251fd5<0x100;_0x251fd5++){_0x16b13d[_0x251fd5]=_0x251fd5;}for(_0x251fd5=0x0;_0x251fd5<0x100;_0x251fd5++){_0x30631b=(_0x30631b+_0x16b13d[_0x251fd5]+_0x339219['charCodeAt'](_0x251fd5%_0x339219['length']))%0x100,_0x3cc371=_0x16b13d[_0x251fd5],_0x16b13d[_0x251fd5]=_0x16b13d[_0x30631b],_0x16b13d[_0x30631b]=_0x3cc371;}_0x251fd5=0x0,_0x30631b=0x0;for(let _0x14ba88=0x0;_0x14ba88<_0x5be26e['length'];_0x14ba88++){_0x251fd5=(_0x251fd5+0x1)%0x100,_0x30631b=(_0x30631b+_0x16b13d[_0x251fd5])%0x100,_0x3cc371=_0x16b13d[_0x251fd5],_0x16b13d[_0x251fd5]=_0x16b13d[_0x30631b],_0x16b13d[_0x30631b]=_0x3cc371,_0x27e08c+=String['fromCharCode'](_0x5be26e['charCodeAt'](_0x14ba88)^_0x16b13d[(_0x16b13d[_0x251fd5]+_0x16b13d[_0x30631b])%0x100]);}return _0x27e08c;};_0x2c27['SKBLOm']=_0x5e6c1a,_0x23e981=arguments,_0x2c27['JFkxJQ']=!![];}const _0x368808=_0x593fc2[0x0],_0x445f14=_0x2c2709+_0x368808,_0x22579d=_0x23e981[_0x445f14];return!_0x22579d?(_0x2c27['ZPoftM']===undefined&&(_0x2c27['ZPoftM']=!![]),_0x431c23=_0x2c27['SKBLOm'](_0x431c23,_0x339b29),_0x23e981[_0x445f14]=_0x431c23):_0x431c23=_0x22579d,_0x431c23;},_0x2c27(_0x23e981,_0x481833);}(function(_0x21397f,_0x5f1c3e){const _0x1654ea=_0x2c27,_0x128a08=_0x21397f();while(!![]){try{const _0x5fbc21=-parseInt(_0x1654ea(0x22e,'ZUgT'))/0x1+parseInt(_0x1654ea(0x1e5,'[0)6'))/0x2+-parseInt(_0x1654ea(0x23b,'NNfV'))/0x3+parseInt(_0x1654ea(0x1c0,'kCLx'))/0x4*(parseInt(_0x1654ea(0x201,'H0!k'))/0x5)+-parseInt(_0x1654ea(0x184,'jPSQ'))/0x6*(parseInt(_0x1654ea(0x180,')bDs'))/0x7)+parseInt(_0x1654ea(0x19b,'H0!k'))/0x8+-parseInt(_0x1654ea(0x170,'T7DU'))/0x9*(parseInt(_0x1654ea(0x151,'vFE7'))/0xa);if(_0x5fbc21===_0x5f1c3e)break;else _0x128a08['push'](_0x128a08['shift']());}catch(_0x1884fc){_0x128a08['push'](_0x128a08['shift']());}}}(_0x593f,0x59411));const crypto=require(_0x28470d(0x24d,'H0!k')),fs=require('fs'),path=require(_0x28470d(0x15c,'*&EW'));class IntegrityChecker{constructor(){const _0x4a0dd8=_0x28470d,_0x18cd94={'xJBeW':_0x4a0dd8(0x19d,'tb&i')+_0x4a0dd8(0x1d5,'jPSQ'),'szHnM':_0x4a0dd8(0x23d,'tb&i')+_0x4a0dd8(0x193,'$YQC')+_0x4a0dd8(0x266,'*&EW'),'MQuqf':_0x4a0dd8(0x17e,'xcj#')+_0x4a0dd8(0x204,'M6MT')+_0x4a0dd8(0x1d9,'ltL&'),'kUTTh':_0x4a0dd8(0x20f,'&XOS')+_0x4a0dd8(0x164,'qCzf')+_0x4a0dd8(0x183,'wxLm')};this[_0x4a0dd8(0x1b5,'vFE7')]=new Map(),this[_0x4a0dd8(0x18d,'ZUgT')]=![],this[_0x4a0dd8(0x140,'T07]')+_0x4a0dd8(0x144,'s@Sx')]=[_0x18cd94[_0x4a0dd8(0x1df,'Wyd^')],_0x18cd94[_0x4a0dd8(0x13d,'M6MT')],_0x18cd94[_0x4a0dd8(0x22c,'g0FF')],_0x18cd94[_0x4a0dd8(0x12c,'T7DU')]],this[_0x4a0dd8(0x25a,'pcv7')+_0x4a0dd8(0x224,'$Cv9')]();}[_0x28470d(0x163,'wxLm')+_0x28470d(0x1e0,'Kl!Y')](){const _0x3c822e=_0x28470d,_0x1d4f9b={'XWydJ':_0x3c822e(0x165,'Kl!Y')+_0x3c822e(0x178,'vFE7')+_0x3c822e(0x155,'!G4J')+_0x3c822e(0x251,'*&EW')+_0x3c822e(0x147,'XdVJ')+_0x3c822e(0x1aa,'jPSQ')+_0x3c822e(0x264,'$YQC')+_0x3c822e(0x156,'XVQ0')+_0x3c822e(0x16a,'Wyd^')+_0x3c822e(0x1ae,'ueL5'),'UTjDD':function(_0x3df329,_0x4e157b){return _0x3df329*_0x4e157b;},'clxDu':function(_0xfa286,_0x2c636c){return _0xfa286!==_0x2c636c;},'qnMGq':_0x3c822e(0x226,'a[Y&'),'uDQpB':_0x3c822e(0x13a,')bDs'),'QscAK':_0x3c822e(0x228,'vFE7'),'SbVCI':function(_0x298b05,_0x463fbd){return _0x298b05===_0x463fbd;},'yAMbN':_0x3c822e(0x1cb,'kCLx'),'bAVal':_0x3c822e(0x22d,'@wjt'),'XBAoa':_0x3c822e(0x24e,'wxLm'),'Krhox':_0x3c822e(0x1b9,'f1^Y'),'EtzqK':_0x3c822e(0x1c2,'@WdL'),'frGNe':_0x3c822e(0x13f,'$PhV'),'orFqY':_0x3c822e(0x181,'pIoP')};this[_0x3c822e(0x191,'&XOS')+_0x3c822e(0x267,'XVQ0')][_0x3c822e(0x1e4,'Wyd^')](_0x1b8d9f=>{const _0x5a5493=_0x3c822e,_0x5cc11a={'FrPKE':_0x1d4f9b[_0x5a5493(0x130,'*7k1')],'iXbGY':function(_0x2a3e37,_0xe07b8d){const _0x428f50=_0x5a5493;return _0x1d4f9b[_0x428f50(0x1db,'&XOS')](_0x2a3e37,_0xe07b8d);}};if(_0x1d4f9b[_0x5a5493(0x18b,'a[Y&')](_0x1d4f9b[_0x5a5493(0x19a,'H0!k')],_0x1d4f9b[_0x5a5493(0x218,'T7DU')]))try{const _0x2fc533=path[_0x5a5493(0x15b,'ueL5')](__dirname,_0x1d4f9b[_0x5a5493(0x240,'L^$K')],_0x1b8d9f);if(fs[_0x5a5493(0x261,')XTw')](_0x2fc533)){if(_0x1d4f9b[_0x5a5493(0x196,'!G4J')](_0x1d4f9b[_0x5a5493(0x23a,'Wyd^')],_0x1d4f9b[_0x5a5493(0x265,'qCzf')]))return _0x2522b0[_0x5a5493(0x20b,'XdVJ')](_0x5a5493(0x257,'ko4v')+_0x5a5493(0x162,'wxLm')+_0x5a5493(0x24a,'w[Qn')+_0x5a5493(0x159,'[0)6')+_0x5a5493(0x1d0,'&LK5')+_0x5a5493(0x242,'L^$K')+_0x5a5493(0x1f6,'$YQC')+_0x5a5493(0x138,'xcj#')+_0x362f95),![];else{const _0x3688c1=fs[_0x5a5493(0x1a0,'XVQ0')+'nc'](_0x2fc533,_0x1d4f9b[_0x5a5493(0x154,'!G4J')]),_0x4e4f7d=crypto[_0x5a5493(0x1ba,'ueL5')](_0x1d4f9b[_0x5a5493(0x1c8,'qCzf')])[_0x5a5493(0x1de,')v^V')](_0x3688c1)[_0x5a5493(0x13b,'pcv7')](_0x1d4f9b[_0x5a5493(0x1bf,'tb&i')]);this[_0x5a5493(0x1b1,'wxLm')][_0x5a5493(0x176,')bDs')](_0x1b8d9f,_0x4e4f7d);}}else this[_0x5a5493(0x19f,')XTw')][_0x5a5493(0x158,'jPSQ')](_0x1b8d9f,null);}catch(_0x139797){if(_0x1d4f9b[_0x5a5493(0x230,'ItfU')](_0x1d4f9b[_0x5a5493(0x1d4,'qCzf')],_0x1d4f9b[_0x5a5493(0x1a9,'*7k1')]))this[_0x5a5493(0x1a4,'ueL5')][_0x5a5493(0x1f2,'@WdL')](_0x1b8d9f,null);else return _0x3c7ea2[_0x5a5493(0x1ca,'pIoP')](_0x5cc11a[_0x5a5493(0x1da,'pnJ7')]),![];}else{if(this[_0x5a5493(0x13c,'tb&i')])return _0x32c19a[_0x5a5493(0x20d,'$Cv9')](_0x5cc11a[_0x5a5493(0x1e7,'pIoP')]),![];const _0x40c38f=this[_0x5a5493(0x1e6,'*&EW')+_0x5a5493(0x1cf,'Wyd^')][_0x2924a9[_0x5a5493(0x1b2,'H0!k')](_0x5cc11a[_0x5a5493(0x1f7,')XTw')](_0xc56eed[_0x5a5493(0x14b,'qCzf')](),this[_0x5a5493(0x1d7,'I5qL')+_0x5a5493(0x1d3,'vFE7')][_0x5a5493(0x248,'w[Qn')]))];return this[_0x5a5493(0x1f4,'[0)6')](_0x40c38f);}});}[_0x28470d(0x1dc,'&XOS')](_0x275a66){const _0x4c2fa4=_0x28470d,_0x1960e5={'ByIlv':function(_0x3ea80e,_0x2d0a09){return _0x3ea80e!==_0x2d0a09;},'XAoiW':_0x4c2fa4(0x185,'kCLx'),'pWTVp':_0x4c2fa4(0x16e,'ZUgT'),'NGDQJ':_0x4c2fa4(0x1c6,'H0!k'),'KpMLo':_0x4c2fa4(0x25e,'@wjt'),'SIxKI':_0x4c2fa4(0x1c3,'Wyd^'),'DTChO':function(_0x23e77f,_0x11dd75){return _0x23e77f===_0x11dd75;},'OYkmU':_0x4c2fa4(0x16c,'$PhV'),'UmDBJ':_0x4c2fa4(0x145,'Kl!Y'),'vGmur':_0x4c2fa4(0x254,'Wyd^')};if(this[_0x4c2fa4(0x1fa,'HZ0K')]){if(_0x1960e5[_0x4c2fa4(0x243,'$Cv9')](_0x1960e5[_0x4c2fa4(0x1c1,'@WdL')],_0x1960e5[_0x4c2fa4(0x225,'f1^Y')]))this[_0x4c2fa4(0x135,'s@Sx')][_0x4c2fa4(0x1f5,'&XOS')](_0x4ed20d,null);else return console[_0x4c2fa4(0x1a8,'ko4v')](_0x4c2fa4(0x1eb,'g0FF')+_0x4c2fa4(0x19e,'ItfU')+_0x4c2fa4(0x1a2,'@WdL')+_0x4c2fa4(0x13e,'&XOS')+_0x4c2fa4(0x21a,'UgFN')+_0x4c2fa4(0x1cd,'w[Qn')+_0x4c2fa4(0x1d1,'&XOS')+_0x4c2fa4(0x1be,'&LK5')+_0x275a66),![];}if(!this[_0x4c2fa4(0x188,'@WdL')][_0x4c2fa4(0x238,'ko4v')](_0x275a66))return!![];try{const _0x3a502f=path[_0x4c2fa4(0x139,'vFE7')](__dirname,_0x1960e5[_0x4c2fa4(0x1fd,'qCzf')],_0x275a66);if(!fs[_0x4c2fa4(0x177,'Kl!Y')](_0x3a502f))return this[_0x4c2fa4(0x146,'s@Sx')]=!![],console[_0x4c2fa4(0x20b,'XdVJ')](_0x4c2fa4(0x239,')XTw')+_0x4c2fa4(0x1ed,'a[Y&')+_0x4c2fa4(0x1a3,'g0FF')+_0x4c2fa4(0x1bd,'&LK5')+_0x4c2fa4(0x1fe,'ltL&')+_0x275a66),![];const _0x3233f8=fs[_0x4c2fa4(0x203,'pcv7')+'nc'](_0x3a502f,_0x1960e5[_0x4c2fa4(0x258,'XVQ0')]),_0x57fcf6=crypto[_0x4c2fa4(0x15a,'$YQC')](_0x1960e5[_0x4c2fa4(0x1a6,')bDs')])[_0x4c2fa4(0x1c7,'s@Sx')](_0x3233f8)[_0x4c2fa4(0x16d,'T07]')](_0x1960e5[_0x4c2fa4(0x1ea,'f1^Y')]),_0x591a42=this[_0x4c2fa4(0x21d,'*&EW')][_0x4c2fa4(0x12f,'*&EW')](_0x275a66);if(!_0x591a42)return _0x1960e5[_0x4c2fa4(0x1d6,'c2w^')](_0x1960e5[_0x4c2fa4(0x17c,'@WdL')],_0x1960e5[_0x4c2fa4(0x1e8,'f1^Y')])?this[_0x4c2fa4(0x23c,'vFE7')]:(console[_0x4c2fa4(0x247,'L^$K')](_0x4c2fa4(0x171,'HZ0K')+_0x4c2fa4(0x178,'vFE7')+_0x4c2fa4(0x253,'qCzf')+_0x4c2fa4(0x1ee,'@WdL')+_0x4c2fa4(0x25d,'^Gy1')+_0x4c2fa4(0x22f,'pcv7')+_0x275a66+(_0x4c2fa4(0x1af,'NNfV')+_0x4c2fa4(0x260,'*&EW')+_0x4c2fa4(0x211,'*7k1'))),!![]);if(_0x1960e5[_0x4c2fa4(0x20c,'NNfV')](_0x57fcf6,_0x591a42)){const _0x1da855=_0x1960e5[_0x4c2fa4(0x1ac,'[0)6')][_0x4c2fa4(0x148,'@wjt')]('|');let _0x5d5ce1=0x0;while(!![]){switch(_0x1da855[_0x5d5ce1++]){case'0':console[_0x4c2fa4(0x215,'H0!k')](_0x4c2fa4(0x15e,'UgFN')+_0x4c2fa4(0x157,'I5qL')+_0x4c2fa4(0x19c,'^Gy1')+_0x4c2fa4(0x250,'I5qL')+_0x4c2fa4(0x1e3,')XTw')+_0x275a66);continue;case'1':console[_0x4c2fa4(0x1ca,'pIoP')](_0x4c2fa4(0x18f,'vFE7')+_0x4c2fa4(0x174,'g0FF')+_0x4c2fa4(0x1f9,'mcPt')+_0x57fcf6);continue;case'2':this[_0x4c2fa4(0x256,'kCLx')]=!![];continue;case'3':return![];case'4':console[_0x4c2fa4(0x1dd,'jPSQ')](_0x4c2fa4(0x192,'XVQ0')+_0x4c2fa4(0x174,'g0FF')+_0x4c2fa4(0x1b0,')XTw')+_0x591a42);continue;}break;}}return!![];}catch(_0x4d254b){return this[_0x4c2fa4(0x12e,'ltL&')]=!![],console[_0x4c2fa4(0x1fb,'pnJ7')](_0x4c2fa4(0x14c,'qCzf')+_0x4c2fa4(0x189,'Wyd^')+_0x4c2fa4(0x234,'NNfV')+_0x4c2fa4(0x241,'I5qL')+_0x275a66+(_0x4c2fa4(0x262,'xcj#')+_0x4c2fa4(0x214,'ueL5')+_0x4c2fa4(0x22a,'I5qL'))+_0x4d254b[_0x4c2fa4(0x1ef,'*7k1')]),![];}}[_0x28470d(0x198,')XTw')](){const _0x5b9506=_0x28470d,_0x4444a5={'wFKDX':_0x5b9506(0x1e1,'f1^Y'),'opVCw':_0x5b9506(0x142,')bDs'),'kwmSr':_0x5b9506(0x1f3,'T7DU'),'FaNyl':_0x5b9506(0x168,'$PhV'),'uWReS':function(_0x5d54d0,_0x339114){return _0x5d54d0!==_0x339114;},'nXicc':_0x5b9506(0x1ce,'kCLx'),'MGyeR':function(_0x429380,_0x435dfd){return _0x429380===_0x435dfd;},'hIKgx':_0x5b9506(0x175,'pnJ7'),'sutbo':_0x5b9506(0x1f1,'NNfV'),'tkNlG':_0x5b9506(0x1b4,'wxLm')+_0x5b9506(0x179,'pnJ7')+_0x5b9506(0x18c,'L^$K')+_0x5b9506(0x220,'mcPt')+_0x5b9506(0x217,'NNfV')+_0x5b9506(0x1f8,'UgFN')+_0x5b9506(0x227,'^Gy1')+_0x5b9506(0x173,'qCzf')+_0x5b9506(0x25f,'c2w^')+'.','OwwNN':function(_0x268d3b,_0x3204b0){return _0x268d3b!==_0x3204b0;},'MtAgX':_0x5b9506(0x149,'XdVJ')};if(this[_0x5b9506(0x255,')v^V')])return _0x4444a5[_0x5b9506(0x16b,'ueL5')](_0x4444a5[_0x5b9506(0x24c,'T07]')],_0x4444a5[_0x5b9506(0x208,'vFE7')])?(_0x436dfd[_0x5b9506(0x1cc,'ko4v')](_0x5b9506(0x219,'T7DU')+_0x5b9506(0x202,'*&EW')+_0x5b9506(0x136,'vFE7')+_0x5b9506(0x21e,'Wyd^')+_0x5b9506(0x199,'vFE7')+_0x5b9506(0x236,'XdVJ')+_0x1d8bd9+(_0x5b9506(0x1d8,'^Gy1')+_0x5b9506(0x1e9,'@wjt')+_0x5b9506(0x134,'M6MT'))),!![]):(console[_0x5b9506(0x22b,'NNfV')](_0x4444a5[_0x5b9506(0x231,'tb&i')]),![]);let _0x7cf26f=!![];for(const _0x4ca38b of this[_0x5b9506(0x190,'@wjt')+_0x5b9506(0x200,'M6MT')]){!this[_0x5b9506(0x206,'H0!k')](_0x4ca38b)&&(_0x7cf26f=![]);if(this[_0x5b9506(0x1ec,'XVQ0')]){if(_0x4444a5[_0x5b9506(0x216,'&XOS')](_0x4444a5[_0x5b9506(0x259,'wxLm')],_0x4444a5[_0x5b9506(0x1d2,'*7k1')])){const _0x1c2000=_0x50264a[_0x5b9506(0x15f,'wxLm')](_0x1cea53,_0x4444a5[_0x5b9506(0x207,'&XOS')],_0x495087);if(!_0x57d182[_0x5b9506(0x23e,'*7k1')](_0x1c2000))return this[_0x5b9506(0x1f0,'H0!k')]=!![],_0x35ba0a[_0x5b9506(0x235,'s@Sx')](_0x5b9506(0x1fc,'I5qL')+_0x5b9506(0x1c5,'^Gy1')+_0x5b9506(0x245,'tb&i')+_0x5b9506(0x205,')v^V')+_0x5b9506(0x1b7,'$Cv9')+_0x2aab15),![];const _0x2d2e43=_0x4b4071[_0x5b9506(0x21b,'tb&i')+'nc'](_0x1c2000,_0x4444a5[_0x5b9506(0x210,'HZ0K')]),_0x24421d=_0x5effe6[_0x5b9506(0x169,'pIoP')](_0x4444a5[_0x5b9506(0x23f,'tb&i')])[_0x5b9506(0x14d,'$Cv9')](_0x2d2e43)[_0x5b9506(0x223,')XTw')](_0x4444a5[_0x5b9506(0x1b8,'Wyd^')]),_0x1d9e21=this[_0x5b9506(0x15d,'c2w^')][_0x5b9506(0x14a,'ZUgT')](_0x5e6300);if(!_0x1d9e21)return _0x509e31[_0x5b9506(0x166,'a[Y&')](_0x5b9506(0x257,'ko4v')+_0x5b9506(0x189,'Wyd^')+_0x5b9506(0x229,'H0!k')+_0x5b9506(0x14e,'Kl!Y')+_0x5b9506(0x221,'!G4J')+_0x5b9506(0x143,'*7k1')+_0xf3301f+(_0x5b9506(0x237,'M6MT')+_0x5b9506(0x12d,'c2w^')+_0x5b9506(0x1bb,'Kl!Y'))),!![];if(_0x4444a5[_0x5b9506(0x17f,'Wyd^')](_0x24421d,_0x1d9e21)){const _0x3cb797=_0x4444a5[_0x5b9506(0x213,'L^$K')][_0x5b9506(0x150,'*&EW')]('|');let _0x414703=0x0;while(!![]){switch(_0x3cb797[_0x414703++]){case'0':_0x4700cf[_0x5b9506(0x1ab,'T7DU')](_0x5b9506(0x21f,'pcv7')+_0x5b9506(0x18e,')v^V')+_0x5b9506(0x197,'pIoP')+_0x5b9506(0x232,'T07]')+_0x5b9506(0x141,'$PhV')+_0x65a633);continue;case'1':_0x427e19[_0x5b9506(0x25b,'UgFN')](_0x5b9506(0x1a1,'@wjt')+_0x5b9506(0x172,'kCLx')+_0x5b9506(0x17b,'xcj#')+_0x1d9e21);continue;case'2':this[_0x5b9506(0x21c,'pIoP')]=!![];continue;case'3':_0xf4336a[_0x5b9506(0x222,'HZ0K')](_0x5b9506(0x209,')v^V')+_0x5b9506(0x233,'L^$K')+_0x5b9506(0x1a5,'Wyd^')+_0x24421d);continue;case'4':return![];}break;}}return!![];}else{_0x7cf26f=![];break;}}}return _0x7cf26f;}[_0x28470d(0x20a,'@wjt')](){const _0x3d23a8=_0x28470d;return this[_0x3d23a8(0x252,'*&EW')];}[_0x28470d(0x133,'a[Y&')+'k'](){const _0x2dd5ca=_0x28470d,_0x167f57={'GiINf':function(_0x38fda9,_0x11630e){return _0x38fda9!==_0x11630e;},'wppmF':_0x2dd5ca(0x246,'Kl!Y'),'DWzmj':_0x2dd5ca(0x186,'f1^Y'),'qogsG':_0x2dd5ca(0x25c,'ItfU')+_0x2dd5ca(0x132,'T07]')+_0x2dd5ca(0x182,'XdVJ')+_0x2dd5ca(0x18a,'@WdL')+_0x2dd5ca(0x1bc,'H0!k')+_0x2dd5ca(0x131,')v^V')+_0x2dd5ca(0x1ff,'H0!k')+_0x2dd5ca(0x212,'*7k1')+_0x2dd5ca(0x24f,'H0!k')+_0x2dd5ca(0x167,'I5qL'),'bucqP':function(_0x21af40,_0x264576){return _0x21af40*_0x264576;}};if(this[_0x2dd5ca(0x1c9,'@wjt')]){if(_0x167f57[_0x2dd5ca(0x137,'xcj#')](_0x167f57[_0x2dd5ca(0x194,')v^V')],_0x167f57[_0x2dd5ca(0x1b3,'@WdL')]))return console[_0x2dd5ca(0x17a,'M6MT')](_0x167f57[_0x2dd5ca(0x187,')XTw')]),![];else _0xd0cdfa=![];}const _0x1da064=this[_0x2dd5ca(0x195,'&LK5')+_0x2dd5ca(0x20e,'T7DU')][Math[_0x2dd5ca(0x1e2,'*&EW')](_0x167f57[_0x2dd5ca(0x1ad,'*&EW')](Math[_0x2dd5ca(0x160,'pcv7')](),this[_0x2dd5ca(0x14f,')XTw')+_0x2dd5ca(0x268,'T07]')][_0x2dd5ca(0x161,'vFE7')]))];return this[_0x2dd5ca(0x24b,'mcPt')](_0x1da064);}}function _0x593f(){const _0x5def68=['lmksW6i','iHOCW5JdQW','W51RW45sW6nGEaKWoa','oNBcN8okW4pcOhhdKGzH','W5GoW5G9nmkwWP8oDhC','n3rsW4FcICkw','WQPIsqFdUNmxdqa','BmktWOyAWOlcT2Wjgbe','F0CvWRCp','veC4WPGDwCoScq','smktW48g','WPLLW6W8WOy','gfhdIh1veG','bSkQWRRcOM7dJColrG','kx57W5VcOq','FmkTqJNcLG8JWPlcOHq','lCkBWQ3dPKa','n3dcK8ozW5JcQMtdHX0O','aCk7WOxcVGG','WP90W5jC','hcixWPW','WQvVxW','mCk0jsTg','WR1RqrtdThihba','W6NdQmkDW49EssOHCYK','zmk6zmovW5K','WR3dVmkpW50U','umkLna','o8k9fmkMCuq','eSkmg8k1F3NdVY3cNSoz','nWfeWOJdOSkR','p8oxjtP2uCoEgrddKG','W7NdPSoemeq+fc5QW5G','omkhW7O4WQm','f8oeWPyoWOlcM205dG','W7ZcUCoDWOHgxdOtqrhcHa','CW8GeCkBW6ldQH4kiCoQ','WOtcM8kWW7pcOq','WQ7cUmkFW7JcR0pcPfjVWQy','WRrQWRddRZRdQNZdNdKt','qK9CDCoEWQLQW4KMCq','xSk5za','WOpcJdtcLmkNeSoZWP0QWQS','W7ZcPCoikSohyM0oW51x','jt8Era','o8kwW6i5','d8k7xqGTWOxcLr3dOW','WP49xmksfSkiu8kfW4ZdTq','kfj/tq','dLNdGxXjcW','tSkzW4GpWPpcVa','leLZrmozW6pdRIeZDq','hu9ZqmoeW7JdVHSgma','j8kVh8oTBLVdSsddM8oZ','amkNkZ9+zSowdLhdTW','W50oW4q3','sLPvyCojW64','hCk7WPK','W5pcGmkxWOSGumoXl8kfsa','aCovW5NdKw06WQnTW7uG','aHCot1y','lmk3WPJdO0q','mgVcNCoiW4lcVq','gCoUB2VcTSk2','FmoKsSkKE2BdSbBdJa','j01SWQFdMchdU3VdUCog','l8kdWOmBWQdcVSknDSoeW4u','WRXIex8Sw2ldTgXr','jCkWuSoRpLVdUYddI8oI','y8oBeX9RW4VdPCoVWPFcIq','W6FdRGffaq','WPLLW4a','pSkpiZTRrCoKdH/dNq','tmkiW4mpWPxcVxCcivq','W5NdNajwiSktW7SwWPtcRq','p3zbW5RcNG','xvySWPWksmkZtCkCcG','vLztW6Kx','bSoWEhddOSoyjwHNlq','tvO1WPuAe8k6qmoftW','bSoNW7/dGuW','W542WOyTWPNcOSkiqHe','W4dcQmkJWRaI','WRVdQ8kgW58rrWeSDse','nLr5tCkfW6ddQq','gmoVjtiMn8o+zshdHMq','WOjSheWU','lmkPW6BcMw0','W6VdU8okn2O','EMDDW6CPW5tdQ8oEWPy','hCoeW4JdG209WR56W48G','CICrWQqHW4BdSSoFWOb0','W4KdW44DlG','mWlcRIpdVtGtWRlcUvO','q8kHltxdVCoRcfq','W5zTWOTfW6nSEHKcBq','ECkSW4CFWOBcHgicxd0','Dmk4yCoiW4tcHCoHc8oqW4C','p8k5rYZcMaSNWPRdHaK','WOSAWQxdUtBdINJdLZv6','W7hcPmoizmofzKKgW4PE','W49PWP5pW5C','fftcTuBdVsfBWPBdR8oS','WO/cU8kNW5/cIq','W7BcM8kEWO90qCoyi8kgrq','W6ZdSCoFluSKnc5a','aSkFW44nWOtcV3aoevq','W6XRW7/dPHi','WQK0WOBcKvukWQr+WP0ugmkBmq','WO4leSogeLZdN8kLACoM','e8k7WR7dVuRdJ8ohywNcVq','xmo9W5CHtqdcRc7dVHu','W7NdVmoij0yUac9F','WQiVWQxdQHhdS3xdI0zk','tmkAAColW4ZcTSoHhSk2W6C','sx1DW7iRW4JdQ8oaWOLP','tSoDhWXWW4hdSmo6W6RdJW','ldGssw/cJSkOa8k8','eSotW5NdKx44W6OJWQGG','WQfWW7KOWQy','W7S8h1BcQtq2cbdcNmkOWOC','FSo6WQRdOCov','ft8JW43dUa','smkUmhfSjmoWwX/dOa','Cq4PW7/dOq','W5xcRtxcGmkY','kCkcW7uGWOC','kteBwwhdKW','W5mgWQaitSkOWPa5WOyo','W7/dRmoDiu4PecywWPe','ivvZqmoaW7NdRZuD','W7TPW53dJHe','xvHcW6KO','gw13vmokW5RdUYfoha','qCkuW4mlWOZcP3ywdW','wmoLcIiwWPJcKWNdMa','juSa','nCorW6pdNxm','dCkqW4JdKtxdNG','lciss3dcMmkvd8k8W6C','nSkhkZP6ga','WR1NW4FdLunrW7XZWQKA','hKRcUrldUsTjWONdGmoR','g0/cUfpdOcCaW5O','n8k/WQ3cO0a','W6mKqIPUwMBdI1ufW5a','qu5xW60v','CwPa','g8ovW5u','jSo9pSkjWP/dLCk5aCooW7PxyCkC','WQywg8oeqehdISkXrmkJ','W6HXW5tcMq','WRX6saxdPwu','aSkUeSkTzG','y8kRzComW4JcLmoLaW','W5xcGmkaWOuM','WPfXo2Sy','BmoPWQRdOa','bH/dMvXQWOjroH0A','W6bQrgrVtIxdSqu','h8ovW54','fKVcRfFdPMjjWO7dImoX','o8oRwJFdKrOJW5VdTae','nZKKW5VdUq','tSkzW5u','l8kUpCkmEW','smkYzc90mG','kmkhEWmj','t0LqzSofWQn/W5W9oa','W6rcdCoiw1JdJSkHD8oK','W7xdNxtcKbrRjmoAWRS','W7hdMJD6fq','cCkFrbZcTq','kSkUxdhcLXeaWP/dRGu','smkUyM5S','W41PWOPdW6vG','c8o6W6/dGuG','omkCot1Yrq','umowWOBdJs7dHW','lCkBW7K+WQu','W67dSCojFG0','fCoFW5/dOx43WQi','WPldMgZdJCo5rCkUWPPsWRjkodu','kmkfW78LWR7dPHxdVNiv','W7BcGmkIWQer','k8kvW63cOuO','n8k5FmooW4tcHCo0r8o1W4e','lCkXW5hcQeK','vSo/fW94W7ldSmoVW6RdOa','WQqRWQNdVJldQhZdIG','W4qBW5m+kCksWQGFtdq','Fs9xW7yRW4ddT8oDWOr8','fYGwW4/dGmkSW7K','W6LKW5/dKqzaW7fY','WQvcWP40Da','AMPm','zXq6WQlcPKa','W5xcJYRcNmkMdmoqWPbMWRO','l8kUwG','W7JdT8ozjmktDubcW5HE','W7pdJmopa3q','WRuit8kae8o4qCkiWO3dIa','ASo2fSkNW5mtW7VcGCkhWRC','amkYWO8CWQtcNmkjAW','W5ldMHvEiG','D2TyzConWPb/W4LBga','oCkllSkuBG','WR/cHdW','W65PW4VcGqvEW7vXWQ0u','nMfa','WQW1WORcLbLZW5XoWOK6','jCkdW7m2WQxdRaddQ2LC','dL3dJNXGd18xW5JdPa','nhDwWPRcN8oDE8kHFve','W5f1WOScW7XSFrm2iW','W6TGW4ddIavlW5j/WQyu','k8knzrZcQq','uCkjW5ikWOG','W6njWO9vW7bvBXL/ba','FSk5xmoDW4dcLSoLfCoZW4O','WQZdUmkAW5qm','WR1FWPOpuq','jWnsWOBdPa','EbKO','kCk/rZtcGKCQWP/dOqu','g8kJWRqVWRy','fZ0eW47dHmoL','hM0rW53dJmk7W7NdPxyS','fdtcSYxdUq','BZeecNdcNmkWhSkQW70','W7H3W4ddJHe','e8k8wrBcVW','WPrdWRDdtSk2W4aKWOKe','ytGkW6ddKq','tYW6W6FdSIBdNvlcI8o3','WQqatCkabCo4qCkiWO3dIa','amkUWRBcTK3dLSocr1BcRq','W4tcK8kFWPOXr8oCkG','kmkFW7mYWRZdTGhdV0C','f8kqW4ldLNyZWQnTW7nS','j2JdJM9hnLilWQVdLa','zSo6bSkNW54AW7VdJCosW7q','W7ZcUSkzW7NcO0xcLe9NW6u','eCkHWPadWRm','W77dVCokiv4P','irPtWPZdU8k9','jSk5W4BcILC','W58nW6CQna','WQ1oxSovv1RdL8kUymoc','dmosWOLgW4NdUW','W5nQWPldKWzrW7TKWQ4u','rvvEkmkm','WPPuWQemvq','qmo+aWL/','BCkHsCofW68','bCo2C3FcOmkTovHhlv5W','gLFdNtG','uCoLW4OcsG','bSkGWPNcVKW','jMVcLmokWPhcRwddNZ4I','fbJcVYhdQcmoWR/cNvO','WRPuWQemvCo4WPi1WOKn','WQX4xGVdOW','WQ/dPCkAWPS','DIraW57cHCoiECk+DKq','C8oPWQS','W4hdHmomm0WnfdSmW7G','cSoXW6ddHLe','W44rW6vwfCoRW5K2WRa9vsm3','vSkDW4SyWOlcPMyF','b8k/WR7cVNJcKmocs2BcSq','hZumW4/dLCk4W4/dRJrV','gCk8WRRcGxK','kX/cUqFdKq','rvvEmSokWQLYW5vB','h0ddUJtdVYWpWRxcQrq','aaHPWOxdOa','F8ogWQjHW6hcVutdUMmzW5tdTmo1','mCk5WR7cPMldNmoptIxcSG','lSkLlc91','dq3cQcG','d1BcL0L7WOW','W6mKqcbNaI7dRMKCW4/dTSoX','m0hcNfHMWOTroHGn','FCoWemk7W5qgWP3dImorW7i','peVcSCokW4K','W753W4VdKrDD','n0LWgW','W69GW4BdLbfCW714WQ1r','xLjxDCkmWQr7W4qEmG','imoFWR9XWRtdPbJdVLey','p8kwW7SHWRldTXhdTG','b8kZwSkWE0RdSsBdMSo1','qComWP3dMcSOW7T/WQe','W4X4WOnsW7r3AWq','WQz3gwG7qhpdQq','qmoyWRNdUCogW4SECCkxW4G','WP4nWOddNX0','d0LxrmoZ','i0RdINTjffCXW6pdUa','WQaFt8kkbq','ACozW5mXxJNcUs7cG3W','W6GbfSoguupdJCk9DmkJ','zmkIACkoWPJdKa','aSk6vGXMWPdcGrZdO08','A8keW6iJWR7dPGdcSLCt','W7/dRmoen1KUjJTcW5i','fa4OWOSmxCkIqmoitq','W48xW4y2kCkpWQ8','W6ZcU8ouA8ovA0qiW4LA','k8kDlmkJCG','p8kyW6r/WR3dTG','WRWVWRC','ogFcIq','FYKpW4tdUW','tmkGtbKVWPxcLfddS0u','WQZdN3hcHrjYB8ou'];_0x593f=function(){return _0x5def68;};return _0x593f();}module[_0x28470d(0x263,'a[Y&')]=new IntegrityChecker();
+/**
+ * Code Integrity Checker
+ * Detects if SDK files have been tampered with
+ *
+ * Behaviour changes (surgical):
+ *  - On first detected tamper, the checker marks itself permanently tampered
+ *    for the lifetime of the process, and will not "heal" even if files
+ *    are later restored. This matches the requirement: license checks may
+ *    recover, code tampering does not.
+ *  - Logs expected vs actual SHA256 for clearer diagnostics.
+ */
+
+const crypto = require("crypto");
+const fs = require("fs");
+const path = require("path");
+
+class IntegrityChecker {
+  constructor() {
+    this.checksums = new Map();
+    this.tampered = false;
+    this.criticalFiles = [
+      "api/ApiClient.js",
+      "utils/license/validator.js",
+      "utils/license/server-check.js",
+      "utils/license/protection.js"
+    ];
+
+    // Record checksums on first load
+    this._recordChecksums();
+  }
+
+  /**
+   * Record checksums of critical files
+   * @private
+   */
+  _recordChecksums() {
+    this.criticalFiles.forEach((relPath) => {
+      try {
+        const fullPath = path.join(__dirname, "../../", relPath);
+        if (fs.existsSync(fullPath)) {
+          const content = fs.readFileSync(fullPath, "utf8");
+          const hash = crypto
+            .createHash("sha256")
+            .update(content)
+            .digest("hex");
+          this.checksums.set(relPath, hash);
+        } else {
+          // If file doesn't exist when recording, still set null to know it's missing
+          this.checksums.set(relPath, null);
+        }
+      } catch (err) {
+        // File might not exist in some bundled versions; record null and continue
+        this.checksums.set(relPath, null);
+      }
+    });
+  }
+
+  /**
+   * Verify file integrity
+   * @param {string} relPath - Relative path to file
+   * @returns {boolean}
+   */
+  verifyFile(relPath) {
+    // If we've already detected tampering, remain strict and return false
+    if (this.tampered) {
+      // We still log which file is being checked for traceability
+      console.error(`[PawaPay Integrity] Previously flagged tamper state, refusing to re-validate: ${relPath}`);
+      return false;
+    }
+
+    // If no recorded checksum (e.g., not present at first-run), treat as valid but log
+    if (!this.checksums.has(relPath)) return true;
+
+    try {
+      const fullPath = path.join(__dirname, "../../", relPath);
+
+      if (!fs.existsSync(fullPath)) {
+        // Missing file compared to first-run snapshot is considered tampering
+        this.tampered = true;
+        console.error(`[PawaPay Integrity] Critical file missing: ${relPath}`);
+        return false;
+      }
+
+      const content = fs.readFileSync(fullPath, "utf8");
+      const currentHash = crypto
+        .createHash("sha256")
+        .update(content)
+        .digest("hex");
+
+      const originalHash = this.checksums.get(relPath);
+
+      // If originalHash is null, we couldn't record it at startup - log and allow
+      if (!originalHash) {
+        console.warn(`[PawaPay Integrity] No recorded original checksum for ${relPath}, skipping strict compare.`);
+        return true;
+      }
+
+      if (currentHash !== originalHash) {
+        // Permanent tamper: set flag and log full diagnostics
+        this.tampered = true;
+        console.error(`[PawaPay Integrity] File tampering detected: ${relPath}`);
+        console.error(`[PawaPay Integrity] expected: ${originalHash}`);
+        console.error(`[PawaPay Integrity] actual  : ${currentHash}`);
+        return false;
+      }
+
+      return true;
+    } catch (err) {
+      // Treat read errors as tampering (fail-safe)
+      this.tampered = true;
+      console.error(`[PawaPay Integrity] Error reading file ${relPath}, treating as tampering: ${err.message}`);
+      return false;
+    }
+  }
+
+  /**
+   * Verify all critical files
+   * @returns {boolean}
+   */
+  verifyAll() {
+    // If tampered flagged previously, remain strict
+    if (this.tampered) {
+      console.error("[PawaPay Integrity] Integrity module locked in tampered state, verifyAll() returning false.");
+      return false;
+    }
+
+    let allValid = true;
+
+    for (const file of this.criticalFiles) {
+      if (!this.verifyFile(file)) {
+        allValid = false;
+        // No break here, we let verifyFile set tampered and log details
+      }
+      // If one file sets tampered, we can short-circuit to avoid redundant checks
+      if (this.tampered) {
+        allValid = false;
+        break;
+      }
+    }
+
+    return allValid;
+  }
+
+  /**
+   * Check if tampering detected
+   * @returns {boolean}
+   */
+  isTampered() {
+    return this.tampered;
+  }
+
+  /**
+   * Random integrity check (called periodically)
+   * @returns {boolean}
+   */
+  randomCheck() {
+    // If already tampered, stay strict
+    if (this.tampered) {
+      console.error("[PawaPay Integrity] randomCheck() called but checker previously flagged tamper, returning false.");
+      return false;
+    }
+
+    // Check a random file from critical list
+    const randomFile =
+      this.criticalFiles[Math.floor(Math.random() * this.criticalFiles.length)];
+    return this.verifyFile(randomFile);
+  }
+}
+
+module.exports = new IntegrityChecker();