EDEN Telegram Support Bot 100.9.6 — Static Validation Report
Date: 2026-10-14

Scope:
- NextPay token creation and hosted payment URL integration.
- NextPay callback validation against local trans_id/authority, order_id, and Toman amount.
- Server-side verify request; accept success only when provider verify code is 0 and the verified order and amount match.
- Lock wallet payment row and credit balance/ledger in one database transaction to prevent duplicate callback crediting.
- Encrypted API-key storage through the existing wallet secret-storage helper.
- Database migration adds wallet_payments.order_id and keeps migration retryable if that column could not be created. NextPay is considered configured only when the new column is available.
- Existing ZarinPal and Zibal branches retained.

Checks:
- PHP syntax lint passed for all 75 PHP files.
- update.json is valid JSON, release version and VERSION agree, all manifest paths exist, and manifest entries are unique.
- Static source checks cover endpoints, gateway selection, configuration control, callback matching, HTTPS enforcement, verify success code, and idempotency lock.
- ZIP archive integrity is checked at packaging time.

Not performed:
- No live NextPay token or verify API call was made.
- No production database migration or actual bank payment was performed.
- Runtime server must have the PHP cURL extension, outbound HTTPS, a configured NextPay API key, and a public HTTPS callback URL.
