feat: add package checksum validation

tests/Unit/Package/PackageValidatorTest.php

@@ -3,6 +3,7 @@
 namespace WPContentSync\Tests\Unit\Package;
 
 use PHPUnit\Framework\TestCase;
+use WPContentSync\Package\PackageChecksum;
 use WPContentSync\Package\PackageValidator;
 
 class PackageValidatorTest extends TestCase {
@@ -53,6 +54,16 @@ class PackageValidatorTest extends TestCase {
 		self::assertSame( array( 'manifest.posts must match records.posts count.' ), $result->errors() );
 	}
 
+	public function test_it_rejects_invalid_record_checksums(): void {
+		$package                         = $this->validPackage();
+		$package['checksums']['records'] = 'sha256:wrong';
+
+		$result = ( new PackageValidator() )->validate( $package );
+
+		self::assertFalse( $result->isValid() );
+		self::assertSame( array( 'checksums.records does not match records payload.' ), $result->errors() );
+	}
+
 	/**
 	 * @return array<string, mixed>
 	 */
@@ -86,7 +97,19 @@ class PackageValidatorTest extends TestCase {
 				'custom_post_types' => array(),
 			),
 			'checksums'      => array(
-				'records' => 'sha256:abc123',
+				'records' => PackageChecksum::records(
+					array(
+						'posts'             => array(
+							array(
+								'id'   => 123,
+								'type' => 'post',
+							),
+						),
+						'terms'             => array(),
+						'media'             => array(),
+						'custom_post_types' => array(),
+					)
+				),
 			),
 		);
 	}