Computes the cksm_v3 integrity checksum (derivation v3.1). toParams returns it as the single entry cksm_v3 -> value, which the caller merges into the event parameters.

The value is exactly 16 lowercase hex characters: HMAC-SHA256 over the message, truncated to MAC_LENGTH_BYTES, under the key from macKey:

message = utf8("AFcksm31")
        || u32be(len(utf8(uid)))          || utf8(uid)
        || u32be(len(utf8(appsflyerKey))) || utf8(appsflyerKey)
        || utf8(buildNumber U+2063 af_timestamp U+2063 "af" + packageName U+2063 counter
                U+2063 iaecounter U+2063 installDate U+2063 app_version_code
                U+2063 firstLaunchDate)

|| is byte concatenation; u32be is an unsigned 32-bit big-endian integer; lengths are in UTF-8 bytes. Ten inputs are sealed.

Construct it only after the last change to any sealed field in params.

Field selection is constrained.uid and appsflyerKey are app-supplied, so either can contain any character; they are length-prefixed, and each (uid, appsflyerKey) pair has exactly one encoding. The remaining components are joined by INVISIBLE_SEPARATOR, so each must be a value that cannot contain it; this is why no other app-supplied free text, such as app_version_name, is sealed without a length prefix of its own. Every sealed field must also reach raw_device_params under this exact spelling, or the validator seals a value it cannot read (IC-108).

On failure the value is the empty string. A thrown failure logs its cause, never the value. A missing dev key returns the empty string without a log: the send path rejects a request without a dev key before this class is constructed, so that return is only a defensive guard.

The inputs come from params, the package name of context, the SDK build number and EPOCH_SECRET; nothing is sampled from IdProvider, SessionStorage or PackageManager inside the computation (IC-007, IC-157).

DexGuard-encrypted, because it holds EPOCH_SECRET, so it must never be loaded on the main thread: decryption runs in the loading thread (IC-168).