knodin 0.12.2 → 0.13.1

package/dist/src/engine/state-paths.js

@@ -1,3 +1,4 @@
+import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -32,6 +33,28 @@ export const MIRROR_STATE_DIR = "state";
 /** In-tree state directory name for a normal checkout. */
 export const IN_TREE_STATE_DIR = ".knodin";
 const REGISTRY_VERSION = 1;
+const MIRROR_IDENTITY = /^repo_[0-9a-f]{20}$/;
+function assertMirrorIdentity(identity) {
+    if (!MIRROR_IDENTITY.test(identity))
+        throw new Error("mirror registry: invalid repository identity");
+}
+function containedMirrorDirectory(parent, name) {
+    const target = path.join(parent, name);
+    for (const directory of [parent, target]) {
+        try {
+            const stat = fs.lstatSync(directory);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                throw new Error("mirror registry: unsafe state directory");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    if (fs.existsSync(target) && path.dirname(fs.realpathSync(target)) !== fs.realpathSync(parent))
+        throw new Error("mirror registry: escaped state directory");
+    return target;
+}
 const EMPTY_REGISTRY = { version: REGISTRY_VERSION, mirrors: [] };
 /**
  * Root for all mirror storage. Defaults to `~/.knodin/mirrors` rather than an
@@ -49,19 +72,20 @@ export function mirrorRegistryPath() {
 }
 /** Root for in-progress clones, renamed into place only once complete. */
 export function mirrorStagingRoot() {
-    return path.join(mirrorRoot(), ".staging");
+    return containedMirrorDirectory(mirrorRoot(), ".staging");
 }
 /** Entry root for one mirror: the parent of both `source/` and `state/`. */
 export function mirrorEntryPath(identity) {
-    return path.join(mirrorRoot(), identity);
+    assertMirrorIdentity(identity);
+    return containedMirrorDirectory(mirrorRoot(), identity);
 }
 /** Absolute path to a mirror's shallow clone. */
 export function mirrorSourcePath(identity) {
-    return path.join(mirrorEntryPath(identity), MIRROR_SOURCE_DIR);
+    return containedMirrorDirectory(mirrorEntryPath(identity), MIRROR_SOURCE_DIR);
 }
 /** Absolute path to a mirror's graph state directory. */
 export function mirrorStatePath(identity) {
-    return path.join(mirrorEntryPath(identity), MIRROR_STATE_DIR);
+    return containedMirrorDirectory(mirrorEntryPath(identity), MIRROR_STATE_DIR);
 }
 let cache = null;
 function isMirrorRecord(value) {
@@ -69,10 +93,13 @@ function isMirrorRecord(value) {
         return false;
     const record = value;
     return (typeof record.identity === "string" &&
+        MIRROR_IDENTITY.test(record.identity) &&
         typeof record.url === "string" &&
         typeof record.path === "string" &&
         typeof record.fetchedAt === "string" &&
-        typeof record.sha === "string");
+        typeof record.sha === "string" &&
+        record.readOnly === true &&
+        path.isAbsolute(record.path));
 }
 function indexByPath(registry) {
     const byPath = new Map();
@@ -80,57 +107,172 @@ function indexByPath(registry) {
         byPath.set(path.resolve(record.path), record);
     return byPath;
 }
+function assertMirrorRecordPath(record) {
+    const expected = mirrorSourcePath(record.identity);
+    try {
+        if (fs.realpathSync(record.path) !== fs.realpathSync(expected))
+            throw new Error("mirror registry: clone path does not match repository identity");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        // A missing clone remains registered for actionable recovery, but only at
+        // its deterministic managed location. A missing alias cannot be verified.
+        if (path.resolve(record.path) !== path.resolve(expected))
+            throw new Error("mirror registry: missing clone path does not match repository identity");
+    }
+}
 /**
  * Reads the mirror registry, memoized against the file's mtime and size so a
  * mirror added by a concurrent `knodin remote add` is picked up without paying a
  * JSON parse on every path resolution.
  *
- * The memo key is (mtimeMs, size), which is a heuristic rather than a guarantee:
- * an out-of-process write landing in the same millisecond AND producing the same
- * byte length would not invalidate it. Accepted deliberately — that requires a
- * concurrent edit of identical length within one millisecond, the in-process
- * writer drops the memo explicitly, and the cost of being wrong is one stale
- * read, not corruption. Recorded so it reads as a decision, not an oversight.
+ * The metadata memo includes inode/device, ctime, mtime and size. Registry reads
+ * use a bounded no-follow descriptor and verify file identity before caching.
+ * This is substitution detection, not atomic isolation from hostile filesystem
+ * writers; every derived mirror-state path also checks directory containment.
  *
- * A missing or corrupt registry reads as empty. That is deliberate too: it
- * degrades to "no mirrors configured", which routes every repository to its
- * in-tree state — the pre-existing behaviour — rather than failing a query
- * outright.
+ * Only a genuinely absent registry reads as empty. Corrupt, unsafe or unreadable
+ * registries fail closed: fallback could redirect a mirror into its source tree.
  */
 export function readMirrorRegistry() {
     const file = mirrorRegistryPath();
     let stat;
     try {
-        stat = fs.statSync(file);
+        stat = fs.lstatSync(file);
     }
-    catch {
+    catch (error) {
+        cache = null;
+        if (error.code === "ENOENT")
+            return EMPTY_REGISTRY;
+        throw new Error("mirror registry: unavailable registry", { cause: error });
+    }
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1_048_576) {
         cache = null;
-        return EMPTY_REGISTRY;
+        throw new Error("mirror registry: unsafe or oversized registry");
     }
-    if (cache?.mtimeMs === stat.mtimeMs && cache?.size === stat.size)
+    if (cache?.device === stat.dev &&
+        cache.inode === stat.ino &&
+        cache.ctimeMs === stat.ctimeMs &&
+        cache.mtimeMs === stat.mtimeMs &&
+        cache.size === stat.size)
         return cache.registry;
     try {
-        const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
-        const mirrors = typeof parsed === "object" &&
-            parsed !== null &&
-            Array.isArray(parsed.mirrors)
-            ? parsed.mirrors.filter(isMirrorRecord)
-            : [];
+        const descriptor = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+        let parsed;
+        try {
+            const opened = fs.fstatSync(descriptor);
+            if (opened.dev !== stat.dev || opened.ino !== stat.ino || opened.size !== stat.size)
+                throw new Error("registry changed during open");
+            const bytes = Buffer.alloc(stat.size + 1);
+            const count = fs.readSync(descriptor, bytes, 0, bytes.length, 0);
+            const final = fs.fstatSync(descriptor);
+            const current = fs.lstatSync(file);
+            if (count !== stat.size ||
+                final.size !== stat.size ||
+                final.ctimeMs !== stat.ctimeMs ||
+                current.dev !== stat.dev ||
+                current.ino !== stat.ino ||
+                current.ctimeMs !== stat.ctimeMs)
+                throw new Error("registry changed during read");
+            parsed = JSON.parse(bytes.subarray(0, count).toString("utf8"));
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        if (!parsed ||
+            typeof parsed !== "object" ||
+            parsed.version !== REGISTRY_VERSION ||
+            !Array.isArray(parsed.mirrors) ||
+            !parsed.mirrors.every(isMirrorRecord))
+            throw new Error("invalid mirror registry records");
+        const mirrors = parsed.mirrors;
+        if (new Set(mirrors.map((record) => record.identity)).size !== mirrors.length)
+            throw new Error("duplicate mirror identity");
+        for (const record of mirrors) {
+            mirrorStatePath(record.identity);
+            assertMirrorRecordPath(record);
+        }
+        const canonicalPaths = mirrors.map((record) => fs.existsSync(record.path) ? fs.realpathSync(record.path) : path.resolve(record.path));
+        if (new Set(canonicalPaths).size !== canonicalPaths.length)
+            throw new Error("duplicate mirror clone path");
         const registry = { version: REGISTRY_VERSION, mirrors };
-        cache = { mtimeMs: stat.mtimeMs, size: stat.size, registry, byPath: indexByPath(registry) };
+        cache = {
+            device: stat.dev,
+            inode: stat.ino,
+            ctimeMs: stat.ctimeMs,
+            mtimeMs: stat.mtimeMs,
+            size: stat.size,
+            registry,
+            byPath: indexByPath(registry),
+        };
         return registry;
     }
-    catch {
+    catch (error) {
         cache = null;
-        return EMPTY_REGISTRY;
+        throw new Error("mirror registry: invalid or unsafe registry; restore it before graph access", {
+            cause: error,
+        });
     }
 }
 /** Persists the registry and drops the memo so the next read reloads it. */
 export function writeMirrorRegistry(registry) {
+    if (!registry.mirrors.every(isMirrorRecord))
+        throw new Error("mirror registry: invalid records");
+    for (const record of registry.mirrors) {
+        mirrorStatePath(record.identity);
+        assertMirrorRecordPath(record);
+    }
     const file = mirrorRegistryPath();
-    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const parent = path.dirname(file);
+    containedMirrorDirectory(parent, ".staging");
+    fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const parentIdentity = fs.lstatSync(parent);
+    const canonicalParent = fs.realpathSync(parent);
+    const verifyDestination = () => {
+        const current = fs.lstatSync(parent);
+        if (!current.isDirectory() ||
+            current.isSymbolicLink() ||
+            current.dev !== parentIdentity.dev ||
+            current.ino !== parentIdentity.ino ||
+            fs.realpathSync(parent) !== canonicalParent)
+            throw new Error("mirror registry: parent identity changed");
+        try {
+            const target = fs.lstatSync(file);
+            if (!target.isFile() || target.isSymbolicLink())
+                throw new Error("mirror registry: unsafe registry destination");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    };
+    verifyDestination();
     const document = { version: REGISTRY_VERSION, mirrors: registry.mirrors };
-    fs.writeFileSync(file, `${JSON.stringify(document, null, 2)}\n`);
+    const bytes = Buffer.from(`${JSON.stringify(document, null, 2)}\n`);
+    if (bytes.length > 1_048_576)
+        throw new Error("mirror registry: oversized registry");
+    const temporary = path.join(parent, `.registry-${process.pid}-${crypto.randomUUID()}.tmp`);
+    try {
+        const descriptor = fs.openSync(temporary, "wx", 0o600);
+        try {
+            fs.writeFileSync(descriptor, bytes);
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        verifyDestination();
+        fs.renameSync(temporary, file);
+    }
+    finally {
+        // Only remove the exclusive temporary name while its parent is unchanged.
+        const current = fs.lstatSync(parent);
+        if (current.dev === parentIdentity.dev &&
+            current.ino === parentIdentity.ino &&
+            !current.isSymbolicLink())
+            fs.rmSync(temporary, { force: true });
+    }
     cache = null;
 }
 /** Clears the in-process registry memo. Test seam. */
@@ -144,7 +286,26 @@ export function __resetMirrorRegistryCache() {
  */
 export function lookupMirror(repoPath) {
     readMirrorRegistry();
-    return cache?.byPath.get(path.resolve(repoPath));
+    const exact = cache?.byPath.get(path.resolve(repoPath));
+    if (exact)
+        return exact;
+    let canonical;
+    try {
+        canonical = fs.realpathSync(repoPath);
+    }
+    catch {
+        return undefined;
+    }
+    for (const record of cache?.byPath.values() ?? []) {
+        try {
+            if (fs.realpathSync(record.path) === canonical)
+                return record;
+        }
+        catch {
+            /* Missing clones do not match. */
+        }
+    }
+    return undefined;
 }
 /** True when `repoPath` is a registered read-only mirror clone. */
 export function isMirror(repoPath) {

package/dist/src/evidence-bundle.js

@@ -0,0 +1,283 @@
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import fs from "node:fs";
+import { compareBytes } from "./compare.js";
+import { indexCoverageCore } from "./index-coverage-read.js";
+import { evidenceHandleSecret, normalizeEvidenceFile } from "./progressive-evidence.js";
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const MAX_FILES = 32;
+const MAX_SOURCE_BYTES = 8 * 1024 * 1024;
+/** This text protocol must not certify replacement characters for malformed disk bytes. */
+export function readEvidenceUtf8(absolute) {
+    if (fs.statSync(absolute).size > MAX_SOURCE_BYTES)
+        throw new RangeError("evidence bundle source exceeds 8 MiB; narrow the selection");
+    const raw = fs.readFileSync(absolute);
+    if (raw.length > MAX_SOURCE_BYTES)
+        throw new RangeError("evidence bundle source exceeds 8 MiB; narrow the selection");
+    const source = raw.toString("utf8");
+    if (!Buffer.from(source, "utf8").equals(raw))
+        throw new Error("evidence bundle requires valid UTF-8 source");
+    return { source, bytes: raw.length };
+}
+function sign(value, secret) {
+    const body = Buffer.from(JSON.stringify(value)).toString("base64url");
+    return `peb1.${body}.${createHmac("sha256", secret).update(body).digest("hex")}`;
+}
+function verify(value, secret) {
+    if (typeof value !== "string" || value.length > 4096)
+        throw new Error("invalid evidence bundle handle");
+    const [prefix, body, signature, extra] = value.split(".");
+    if (prefix !== "peb1" || !body || !signature || extra !== undefined)
+        throw new Error("invalid evidence bundle handle");
+    const expected = Buffer.from(createHmac("sha256", secret).update(body).digest("hex"));
+    const actual = Buffer.from(signature);
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+        throw new Error("invalid evidence bundle handle");
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    }
+    catch {
+        throw new Error("invalid evidence bundle handle");
+    }
+    if (!parsed || typeof parsed !== "object")
+        throw new Error("invalid evidence bundle handle");
+    if (parsed.type === "file-complete" &&
+        typeof parsed.file === "string" &&
+        /^[a-f0-9]{64}$/.test(parsed.hash) &&
+        Number.isSafeInteger(parsed.bytes) &&
+        parsed.bytes >= 0)
+        return parsed;
+    if (parsed.type === "cursor" &&
+        /^[a-f0-9]{64}$/.test(parsed.digest) &&
+        Number.isSafeInteger(parsed.fileIndex) &&
+        parsed.fileIndex >= 0 &&
+        Number.isSafeInteger(parsed.lineIndex) &&
+        parsed.lineIndex >= 0)
+        return parsed;
+    throw new Error("invalid evidence bundle handle");
+}
+function limit(value, fallback) {
+    const result = value ?? fallback;
+    if (!Number.isSafeInteger(result) || result < 1)
+        throw new Error("evidence bundle budgets must be positive integers");
+    return result;
+}
+/** Graph associations come only from the injected adapter; source is always reread locally. */
+export async function deliverEvidenceBundle(request, adapter) {
+    if (!Array.isArray(request.files) ||
+        request.files.length === 0 ||
+        request.files.length > MAX_FILES)
+        throw new Error(`evidence bundle requires 1-${MAX_FILES} files`);
+    if (request.level !== undefined && request.level !== "evidence" && request.level !== "expand")
+        throw new Error("invalid evidence bundle level");
+    if ((request.alreadyPresent?.length ?? 0) > MAX_FILES)
+        throw new Error("too many already-present evidence handles");
+    const initial = request.files.map((file) => normalizeEvidenceFile(request.repo, file));
+    const root = initial[0].root;
+    const requested = [...new Set(initial.map((file) => file.relative))].sort(compareBytes);
+    const graph = request.level === "expand" && adapter
+        ? await adapter.relatedFiles(root, requested)
+        : {
+            files: [],
+            freshness: "unknown",
+            indexCoverage: undefined,
+            coverageNotice: undefined,
+            sourceHashes: undefined,
+            validate: undefined,
+            omissions: request.level === "expand"
+                ? ["Graph adapter unavailable; related files were not selected."]
+                : [],
+        };
+    const omissions = [...graph.omissions];
+    const relations = graph.freshness === "fresh" ? graph.files : [];
+    if (graph.freshness !== "fresh" && graph.files.length)
+        omissions.push("Related files omitted because graph evidence is not fresh.");
+    const candidates = [...requested];
+    for (const relation of relations) {
+        const normalized = normalizeEvidenceFile(root, relation.file).relative;
+        if (!candidates.includes(normalized))
+            candidates.push(normalized);
+    }
+    if (candidates.length > MAX_FILES)
+        throw new RangeError(`evidence bundle exceeds ${MAX_FILES} files; narrow the selected graph scope`);
+    const key = evidenceHandleSecret(root);
+    const keyStat = fs.statSync(key.path);
+    let totalBytes = 0;
+    const contents = candidates.map((file) => {
+        const normalized = normalizeEvidenceFile(root, file);
+        const stat = fs.statSync(normalized.absolute);
+        if (stat.dev === keyStat.dev && stat.ino === keyStat.ino)
+            throw new Error("evidence bundle refuses an alias of internal knodin state");
+        totalBytes += stat.size;
+        if (totalBytes > MAX_SOURCE_BYTES)
+            throw new RangeError("evidence bundle source exceeds 8 MiB; narrow the selection");
+        const { source, bytes } = readEvidenceUtf8(normalized.absolute);
+        const contentHash = hash(source);
+        if (graph.sourceHashes && graph.sourceHashes[file] !== contentHash)
+            throw new Error("evidence bundle source changed after graph selection; restart the bundle");
+        // A concurrent append may outgrow the pre-read stat; account actual returned bytes too.
+        totalBytes += bytes - stat.size;
+        if (totalBytes > MAX_SOURCE_BYTES)
+            throw new RangeError("evidence bundle source exceeds 8 MiB; narrow the selection");
+        return {
+            file,
+            source,
+            stat,
+            lines: source.split("\n"),
+            hash: contentHash,
+            bytes,
+        };
+    });
+    const manifest = contents.map((file) => ({
+        file: file.file,
+        contentHash: file.hash,
+        contentBytes: file.bytes,
+        evidenceHandle: null,
+        relations: relations.filter((relation) => normalizeEvidenceFile(root, relation.file).relative === file.file),
+    }));
+    const receipts = (request.alreadyPresent ?? []).map((value) => {
+        const receipt = verify(value, key.secret);
+        if (receipt.type !== "file-complete")
+            throw new Error("alreadyPresent requires per-file evidence handles");
+        return receipt;
+    });
+    const invalidated = receipts
+        .filter((receipt) => !contents.some((file) => file.file === receipt.file &&
+        file.hash === receipt.hash &&
+        file.bytes === receipt.bytes))
+        .map((receipt) => receipt.file);
+    const present = new Set(contents
+        .filter((file) => receipts.some((receipt) => file.file === receipt.file &&
+        file.hash === receipt.hash &&
+        file.bytes === receipt.bytes))
+        .map((file) => file.file));
+    // Bind membership, provenance, content and reuse assertions, so a cursor cannot silently skip changed evidence.
+    const manifestHash = hash(JSON.stringify({
+        requested,
+        level: request.level ?? "evidence",
+        manifest,
+        present: [...present],
+        freshness: graph.freshness,
+        indexCoverage: indexCoverageCore(graph.indexCoverage),
+        omissions,
+    }));
+    const cursor = request.continuation ? verify(request.continuation, key.secret) : undefined;
+    if (cursor && (cursor.type !== "cursor" || cursor.digest !== manifestHash))
+        throw new Error("stale or changed evidence bundle continuation; restart the bundle");
+    let fileIndex = cursor?.type === "cursor" ? cursor.fileIndex : 0;
+    let lineIndex = cursor?.type === "cursor" ? cursor.lineIndex : 0;
+    if (fileIndex > contents.length ||
+        (fileIndex < contents.length && lineIndex >= contents[fileIndex].lines.length))
+        throw new Error("invalid evidence bundle cursor range");
+    const tokenLimit = limit(request.tokenLimit, 16384);
+    const byteLimit = Math.min(limit(request.byteLimit, 65536), tokenLimit * 4);
+    const itemLimit = limit(request.itemLimit, 100);
+    const response = {
+        protocol: "knodin-evidence-bundle-v1",
+        manifest,
+        manifestHash,
+        files: [],
+        reused: [],
+        invalidated,
+        graphFreshness: graph.freshness,
+        ...(graph.indexCoverage ? { indexCoverage: indexCoverageCore(graph.indexCoverage) } : {}),
+        ...(graph.coverageNotice ? { coverageNotice: graph.coverageNotice } : {}),
+        sourceFreshness: "fresh",
+        omissions,
+        more: fileIndex < contents.length,
+        continuation: null,
+        budget: {
+            byteLimit,
+            tokenLimit,
+            itemLimit,
+            serializedBytes: 0,
+            estimatedTokens: 0,
+            returnedItems: 0,
+            truncated: false,
+        },
+    };
+    const refresh = () => {
+        for (const [index, entry] of manifest.entries()) {
+            entry.evidenceHandle =
+                index < fileIndex || present.has(entry.file)
+                    ? sign({
+                        type: "file-complete",
+                        file: entry.file,
+                        hash: entry.contentHash,
+                        bytes: entry.contentBytes,
+                    }, key.secret)
+                    : null;
+        }
+        response.more = fileIndex < contents.length;
+        response.continuation = response.more
+            ? sign({ type: "cursor", digest: manifestHash, fileIndex, lineIndex }, key.secret)
+            : null;
+        response.budget.truncated = response.more || omissions.length > 0;
+        for (let iteration = 0; iteration < 6; iteration++) {
+            response.budget.serializedBytes = Buffer.byteLength(JSON.stringify(response));
+            response.budget.estimatedTokens = Math.ceil(response.budget.serializedBytes / 4);
+        }
+    };
+    refresh();
+    if (response.budget.serializedBytes > byteLimit)
+        throw new RangeError("evidence bundle manifest exceeds hard byte/token budget; increase budget or narrow files");
+    while (fileIndex < contents.length && response.budget.returnedItems < itemLimit) {
+        const file = contents[fileIndex];
+        const previousFile = fileIndex;
+        const previousLine = lineIndex;
+        const previousFiles = response.files.map((entry) => ({
+            ...entry,
+            sourceRange: { ...entry.sourceRange },
+        }));
+        const previousReused = [...response.reused];
+        if (present.has(file.file)) {
+            response.reused.push(file.file);
+            fileIndex++;
+            lineIndex = 0;
+        }
+        else {
+            let delivered = response.files.at(-1);
+            if (!delivered || delivered.file !== file.file) {
+                delivered = {
+                    file: file.file,
+                    source: file.lines[lineIndex],
+                    sourceRange: { startLine: lineIndex + 1, endLine: lineIndex + 1 },
+                };
+                response.files.push(delivered);
+            }
+            else {
+                delivered.source += `\n${file.lines[lineIndex]}`;
+                delivered.sourceRange.endLine = lineIndex + 1;
+            }
+            lineIndex++;
+            if (lineIndex === file.lines.length) {
+                fileIndex++;
+                lineIndex = 0;
+            }
+        }
+        response.budget.returnedItems++;
+        refresh();
+        if (response.budget.serializedBytes > byteLimit) {
+            fileIndex = previousFile;
+            lineIndex = previousLine;
+            response.files = previousFiles;
+            response.reused = previousReused;
+            response.budget.returnedItems--;
+            refresh();
+            break;
+        }
+    }
+    // Rendering can overlap external edits. Never return fresh source or reusable
+    // completion receipts for a selection that changed while this page was built.
+    await graph.validate?.();
+    for (const file of contents) {
+        const normalized = normalizeEvidenceFile(root, file.file);
+        const stat = fs.statSync(normalized.absolute);
+        if (stat.dev !== file.stat.dev ||
+            stat.ino !== file.stat.ino ||
+            stat.size !== file.stat.size ||
+            hash(readEvidenceUtf8(normalized.absolute).source) !== file.hash)
+            throw new Error("evidence bundle source changed during delivery; restart the bundle");
+    }
+    return response;
+}