<?php

declare(strict_types=1);

namespace Drupal\flowdrop\Service\Bundle;

/**
 * Resolves a trusted publisher's signing key by id.
 *
 * Decouples signature verification from how trusted publishers are stored. The
 * production implementation reads enabled flowdrop_trusted_publisher config
 * entities; tests can supply a fixed map. The module ships with an EMPTY
 * trusted set — there is no hardcoded marketplace trust root. A site grants
 * trust by enabling a publisher entity (the FlowDrop marketplace is one such
 * publisher a site may opt into, never a baked-in default).
 *
 * @internal
 */
interface TrustedPublisherResolverInterface {

  /**
   * Returns the raw Ed25519 public key for an enabled trusted publisher.
   *
   * @param string $keyId
   *   The publisher key id claimed by a bundle signature.
   *
   * @return string|null
   *   The 32-byte raw public key, or NULL when no enabled publisher matches
   *   that key id.
   */
  public function getPublicKey(string $keyId): ?string;

}
