Function policy_repositories 

pub fn policy_repositories(
    spec: &SnapshotPolicySpec,
) -> Result<PolicyRepositories<'_>, ValidationError>

THE exactly-one-of resolver for a policy’s repository target(s).

Never panics: a stored CR can carry garbage (both set, or neither — e.g. a write that raced an old CRD schema), so the invalid shapes come back as [ValidationError::PolicyRepositoryExactlyOne] for the caller’s defensive error path rather than as an unwrap in a reconciler.

use kopiur_api::snapshot_policy::{PolicyRepositories, policy_repositories};

let spec: kopiur_api::SnapshotPolicySpec = serde_json::from_value(serde_json::json!({
    "repository": { "kind": "Repository", "name": "r" },
    "sources": [ { "pvc": { "name": "d" } } ],
}))
.unwrap();
assert!(matches!(
    policy_repositories(&spec),
    Ok(PolicyRepositories::Single(r)) if r.name == "r"
));