// Repository blob integrity verification helper.

fn verify_repository_blob_batch(
    store: &RocksStore,
    batch: &[(String, String)],
    summary: &mut RepositoryBlobVerificationSummary,
) -> StorageResult<()> {
    let hashes = batch
        .iter()
        .map(|(_, hash)| hash.clone())
        .collect::<Vec<_>>();
    let blobs = store.get_blob_bytes_batch(&hashes)?;
    for ((uri, expected_hash), blob) in batch.iter().zip(blobs.into_iter()) {
        let bytes = blob.as_ref().ok_or(StorageError::InvalidData {
            entity: "repository_blob_verification",
            detail: format!("blob missing for URI {uri} (hash={expected_hash})"),
        })?;
        let actual_hash = hex::encode(compute_sha256_32(bytes));
        if !actual_hash.eq_ignore_ascii_case(expected_hash) {
            return Err(StorageError::InvalidData {
                entity: "repository_blob_verification",
                detail: format!(
                    "blob hash mismatch for URI {uri}: expected={expected_hash}, actual={actual_hash}"
                ),
            });
        }
        summary.current_objects += 1;
        summary.bytes_verified += bytes.len() as u64;
    }
    summary.batches += 1;
    Ok(())
}