<?php
namespace Modules\Marketplace\Services;
use RuntimeException;
final class PackageVerifier
{
    public function verify(string $path,array $manifest,?string $expectedChecksum=null): array
    {
        if (!is_file($path)) throw new RuntimeException("Package archive [$path] does not exist.");
        $actual=hash_file('sha256',$path);
        $expected=$expectedChecksum ?: ($manifest['checksum'] ?? null);
        if (config('marketplace.require_checksum',true) && blank($expected)) throw new RuntimeException('A SHA-256 checksum is required.');
        if (filled($expected) && !hash_equals(strtolower((string)$expected),strtolower($actual))) throw new RuntimeException('Package checksum verification failed.');
        if (config('marketplace.require_signature',false) && blank($manifest['signature'] ?? null)) throw new RuntimeException('A package signature is required.');
        return ['verified'=>true,'checksum'=>$actual,'signature_present'=>filled($manifest['signature'] ?? null)];
    }
}