Function build_repo_apply_bundle 

pub fn build_repo_apply_bundle(
    repos: &ReposConfFile,
    main_pacman_text: &str,
    selected_section: &str,
) -> Result<RepoApplyBundle, String>

What: Build privileged commands to apply enabled [[repo]] rows from repos.conf.

Inputs:

• repos: Parsed document.
• main_pacman_text: Current contents of the main pacman.conf (read from disk by the caller).
• selected_section: [repo] name for the focused modal row (trimmed; case-insensitive). The matching [[repo]] must declare apply sources (server, mirrorlist, or http/https mirrorlist_url), even when enabled = false.

Output:

• RepoApplyBundle or an actionable error string.

Details:

• Regenerates the entire managed drop-in from all enabled rows that define server, local mirrorlist, or mirrorlist_url (http/https). When none are enabled, writes a short comment-only stub file.
• Optionally downloads mirrorlist_url targets with curl (privileged) before writing the drop-in.
• Runs pacman-key --recv-keys (with optional --keyserver from key_server) / --lsign-key for each distinct fingerprint when key_id parses to at least 8 hex digits.
• Appends the managed Include block only if an active (uncommented) PACMAN_MANAGED_BEGIN line is absent.
• Appends pacman -Sy --noconfirm after repo files are updated.
• Uses active_tool for privilege wrapping; fails if no tool is configured.

Errors

• When active_tool returns an error (no privilege tool configured).
• When [build_repo_apply_bundle_with_tool] rejects the plan (bad selection, unsafe paths, invalid stanzas).