refactor(snapshot): take the engine's SectionSelection and Result at the snapshot boundary

The snapshot options carry the engine's SectionSelection instead of a bare allowlist set, so the allowlist predicate is the one the apply pipeline reads. The per-section validation reads the Result validateSettingsDoc now returns and renders a refused fragment through describeProblem. Nothing else in the ten replayed commits changed.

Author: settings-as-code-release

src/engine/snapshot.ts

@@ -8,6 +8,7 @@ import { stringify as stringifyYaml } from "yaml";
 import type { RepoRef } from "../discovery/targets.js";
 import type { GithubClient } from "../github/api.js";
 import type { Io } from "../io.js";
+import { describeProblem } from "../problem.js";
 import type { SectionKey } from "../schema.js";
 import {
   type EndpointDecl,
@@ -23,7 +24,7 @@ import {
 } from "../sections/contract/module.js";
 import { planContext } from "../sections/contract/plan.js";
 import { SECTIONS } from "../sections/registry.js";
-import { deniedSectionStatus, excludedBySections, type ValidatedSettings, type ValidatedSettings, validateSettingsDoc, validateSettingsDoc } from "./orchestrate.js";
+import { type ValidatedSettings, validateSettingsDoc } from "./orchestrate.js";
 import type { SectionSelection } from "./section-selection.js";
 
 export interface SnapshotOptions {
@@ -181,14 +182,14 @@ export async function snapshotRepository(
       new Set(),
       io,
     );
-    if ("error" in verdict) {
-      const detail = `BUG: ${section.key} produced a snapshot its own schema rejects - ${verdict.error}`;
+    if (verdict.isErr()) {
+      const detail = `BUG: ${section.key} produced a snapshot its own schema rejects - ${describeProblem(verdict.error)}`;
       io.annotate("error", detail);
       outcomes.push({ key: section.key, status: "failed", detail: [...snapshot.notes, detail] });
       failed = true;
       continue;
     }
-    document[section.key] = verdict.settings[section.key];
+    document[section.key] = verdict.value[section.key];
     outcomes.push({ key: section.key, status: "snapshot", detail: [...snapshot.notes] });
   }
 
@@ -198,15 +199,15 @@ export async function snapshotRepository(
   // The brand's one mint, over the already-parsed fragments: every section validated alone
   // above, so the whole cannot fail.
   const verdict = validateSettingsDoc(document, `the snapshot of ${opts.repo.slug}`, new Set(), io);
-  if ("error" in verdict) {
+  if (verdict.isErr()) {
     throw new Error(
-      `BUG: the assembled snapshot of ${opts.repo.slug} failed validation after every section validated on its own: ${verdict.error}`,
+      `BUG: the assembled snapshot of ${opts.repo.slug} failed validation after every section validated on its own: ${describeProblem(verdict.error)}`,
     );
   }
   return {
     repo: opts.repo.slug,
     result: partial ? "partial" : "snapshot",
-    settings: verdict.settings,
+    settings: verdict.value,
     outcomes,
   };
 }

test/engine/secrets.test.ts

@@ -4,9 +4,8 @@ import {
   type ValidatedSettings,
   validateSettingsDoc,
 } from "../../src/engine/orchestrate.js";
-import type { SettingsSource } from "../../src/engine/secret-refs.js";
 import { type SettingsSource, validateSecretRef } from "../../src/engine/secret-refs.js";
-import { collectSecretValues, collectSecretValues, snapshotSecretReference } from "../../src/engine/secrets.js";
+import { collectSecretValues, snapshotSecretReference } from "../../src/engine/secrets.js";
 import { SectionSelection } from "../../src/engine/section-selection.js";
 import { type Io, maskRegistry } from "../../src/io.js";
 import { describeProblem } from "../../src/problem.js";

test/engine/snapshot.test.ts

@@ -149,7 +149,10 @@ describe("snapshotRepository", () => {
     const { io, annotations } = captureIo();
     const result = await snapshotRepository(
       denied,
-      { ...opts(), onlySections: new Set(["pages", "custom_properties"]) },
+      {
+        ...opts(),
+        sections: SectionSelection.of({ only: ["pages", "custom_properties"] })._unsafeUnwrap(),
+      },
       io,
     );
     const note =
@@ -173,7 +176,7 @@ describe("snapshotRepository", () => {
     });
     const present = await snapshotRepository(
       live,
-      { ...opts(), onlySections: new Set(["pages"]) },
+      { ...opts(), sections: SectionSelection.of({ only: ["pages"] })._unsafeUnwrap() },
       captureIo().io,
     );
     expect(present.outcomes).toEqual([{ key: "pages", status: "snapshot", detail: [] }]);
@@ -185,7 +188,7 @@ describe("snapshotRepository", () => {
       const quiet = captureIo();
       const nothing = await snapshotRepository(
         live,
-        { ...opts(), onlySections: new Set(["pages"]) },
+        { ...opts(), sections: SectionSelection.of({ only: ["pages"] })._unsafeUnwrap() },
         quiet.io,
       );
       expect(nothing.outcomes).toEqual([{ key: "pages", status: "snapshot", detail: [NOTHING] }]);
@@ -294,7 +297,12 @@ describe("snapshotRepository shape guard", () => {
     };
     const result = await snapshotRepository(
       nulling,
-      { ...opts(), onlySections: new Set(["code_scanning_default_setup", "labels"]) },
+      {
+        ...opts(),
+        sections: SectionSelection.of({
+          only: ["code_scanning_default_setup", "labels"],
+        })._unsafeUnwrap(),
+      },
       captureIo().io,
     );
     expect(result.result).toBe("failed");
@@ -323,7 +331,7 @@ describe("pages null body", () => {
     };
     const result = await snapshotRepository(
       nulling,
-      { ...opts(), onlySections: new Set(["pages"]) },
+      { ...opts(), sections: SectionSelection.of({ only: ["pages"] })._unsafeUnwrap() },
       captureIo().io,
     );
     expect(result.result).toBe("partial");