[Vivswan]

Before

$ bun run typecheck          # origin/main at 9603643f
src/sections/shared/secrets-engine.ts(97,29): error TS2304: Cannot find name 'UndeclaredPolicyList'.
src/sections/shared/secrets-engine.ts(100,35): error TS18046: 'entry' is of type 'unknown'.
src/sections/shared/secrets-engine.ts(100,57): error TS18046: 'entry' is of type 'unknown'.
error: script "typecheck" exited with code 1

After

$ bun run typecheck
$ bun x tsc -p .

How

• Two green PRs crossed: refactor(sections): extract the frame the secrets and variables engines share into named-scope.ts #455 rewrote secrets-engine.ts around named-scope.ts, refactor(sections): give secretValuesOf a typed signature and drop the container checks it made necessary #468 typed secretValuesOf with UndeclaredPolicyList.
• The merged file used the type without importing it, so one import type line from src/types.ts restores the binding.
• Same source module as every sibling engine (named-scope.ts, keyed-values.ts, module.ts), an edge architecture.yml already allows.

Proof

• Gates: typecheck, biome, build:check, and package-smoke (the bundled declarations) green.
• Tests: 122 pass across test/sections/secrets-engine.test.ts and test/sections/environments.
• Review: codex rubber-duck converged in one round, no findings.

Technical details

• Files: src/sections/shared/secrets-engine.ts (+1 line, no deletions).
• No tests added: the red-to-green typecheck is the proof, and no fact beyond "the import exists" would be pinned.
• Reviewer note (Copilot): src/internal.ts also re-exports the type, but sections -> internal is not an allowed edge in architecture.yml, so the import goes to the owner module.
• Recorded, not built: combined-tree validation (merge queue or rebase-before-merge) so two green PRs cannot land a red main is repository policy, outside this change.

[github-actions]

File size check

0 over a hard cap (fails), 10 warning(s).

File	Size	Tier	Cap
.github/scripts/gen-inputs-table.ts:54	11 comment lines	warn	10
.github/scripts/release-pipeline.ts:1	34 comment lines (header)	warn	25
.github/scripts/release-pipeline.ts:453	14 comment lines	warn	10
docs/upgrading/v2-to-v3.md	1298 lines	warn	1040
src/discovery/discover.ts:91	11 comment lines	warn	10
src/github/secret-scan.ts:45	11 comment lines	warn	10
src/sections/contract/errors.ts:13	14 comment lines	warn	10
src/sections/shared/roles.ts:43	13 comment lines	warn	10
test/e2e/generators.ts	2641 lines	warn	2560
test/sections/refusal-messages.test.ts:61	19 comment lines	warn	10

Split the file, wrap the line, shorten or exempt the comment, or list the path in .file-size-allow.local with a # reason.

5 managed file(s) skipped; repo-platform owns them.

[Copilot]

Copilot review overview

🟢 Approval recommended

The import resolves the existing type reference and follows the repository's dependency boundaries.

Review effort: Balanced
Findings: None

What changed in this PR

Restores the secrets engine's missing type binding after two refactors merged.

Changes:

• Imports UndeclaredPolicyList from its owning module to fix compilation without changing runtime behavior.

File	Description
src/​sections/​shared/​secrets-engine.ts	Adds the missing type-only import.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.