ultra-builder-pro-cli 0.23.0 → 0.24.1

package/mcp-server/lib/init-project.cjs

@@ -23,7 +23,7 @@ const gitBootstrap = require('./git-bootstrap.cjs');
 const runtimePaths = require('./runtime-paths.cjs');
 const runtimeState = require('./runtime-state.cjs');
 const ops = require('./state-ops.cjs');
-const workflows = require('./workflow-state.cjs');
+const stageCheckpoints = require('./stage-checkpoints.cjs');
 
 const REPO_ROOT = process.env.UBP_RUNTIME_ROOT
   ? path.resolve(process.env.UBP_RUNTIME_ROOT)
@@ -544,42 +544,73 @@ function projectionMigrationError(projection) {
   );
 }
 
-function ensureInitializationWorkflows(db, baseline, { rootDir }) {
-  let initRun = workflows.listWorkflows(
-    db, { kind: 'init', baseline_id: baseline.id, limit: 1 }, { rootDir },
-  )[0];
-  const researchRun = workflows.listWorkflows(
-    db, { kind: 'research', baseline_id: baseline.id, limit: 1 }, { rootDir },
-  )[0];
-  if (!initRun) {
-    initRun = workflows.startWorkflow(db, {
-      kind: 'init', baseline_id: baseline.id,
-      subject: `Initialize Ultra authority for ${baseline.project_name}.`,
-      metadata: { repository_revision: baseline.repository_revision, scope: baseline.scope },
-    }, { rootDir });
-    for (const stepId of ['inspect-authority', 'classify-repository', 'scaffold-authority']) {
-      initRun = workflows.recordWorkflowStep(db, {
-        id: initRun.id, step_id: stepId, status: 'completed',
-      }, { rootDir });
-    }
-    initRun = workflows.recordWorkflowStep(db, {
-      id: initRun.id,
-      step_id: 'verify-initialization',
-      status: 'completed',
+function ensureInitializationCheckpoint(db, baseline) {
+  let initCheckpoint = stageCheckpoints.currentCheckpoint(
+    db,
+    'init',
+    { baseline_id: baseline.id },
+    { includeDraft: false },
+  );
+  if (!initCheckpoint) {
+    const draft = stageCheckpoints.saveDraft(db, {
+      stage: 'init',
+      scope: { baseline_id: baseline.id },
+      payload: {
+        project_name: baseline.project_name,
+        repository_revision: baseline.repository_revision,
+        scope: baseline.scope,
+      },
       evidence: [{
         kind: 'authority',
         ref: '.ultra/.runtime/state.db',
         summary: 'State authority, scaffold, projection, and repository classification were verified.',
       }],
-    }, { rootDir });
-    initRun = workflows.completeWorkflow(db, { id: initRun.id }, { rootDir });
+      diagnostics: [],
+      idempotency_key: `init:${baseline.id}:draft`,
+    });
+    initCheckpoint = stageCheckpoints.acceptDraft(db, {
+      id: draft.id,
+      idempotency_key: `init:${baseline.id}:accept`,
+    });
+  }
+  let researchCheckpoint = stageCheckpoints.currentCheckpoint(
+    db,
+    'research',
+    { baseline_id: baseline.id },
+    { includeDraft: false },
+  );
+  const legacyResearch = db.prepare(
+    `SELECT id, mode, status FROM workflow_runs
+     WHERE kind = 'research' AND baseline_id = ?
+     ORDER BY started_at DESC, rowid DESC LIMIT 1`,
+  ).get(baseline.id);
+  if (!researchCheckpoint && legacyResearch?.status === 'completed') {
+    const draft = stageCheckpoints.saveDraft(db, {
+      stage: 'research',
+      scope: { baseline_id: baseline.id },
+      payload: {
+        migration_source: 'workflow_runs',
+        legacy_run_id: legacyResearch.id,
+        mode: legacyResearch.mode,
+      },
+      evidence: [{
+        kind: 'legacy_workflow',
+        ref: legacyResearch.id,
+        summary: 'Completed legacy research provenance migrated during project resume.',
+      }],
+      diagnostics: [],
+      idempotency_key: `research:${baseline.id}:legacy:${legacyResearch.id}:draft`,
+    });
+    researchCheckpoint = stageCheckpoints.acceptDraft(db, {
+      id: draft.id,
+      idempotency_key: `research:${baseline.id}:legacy:${legacyResearch.id}:accept`,
+    });
   }
   const compatibilityOnly = baseline.mode === 'migrated';
   const provenanceComplete = !compatibilityOnly
     && baseline.status === 'ready'
-    && initRun.status === 'completed'
-    && researchRun?.status === 'completed'
-    && baseline.research_run_id === researchRun.id;
+    && initCheckpoint.status === 'accepted'
+    && researchCheckpoint?.status === 'accepted';
   const readyWithoutProvenance = baseline.status === 'ready' && !provenanceComplete;
   const allowedTransitions = provenanceComplete
     ? ['ultra-change', 'ultra-research', 'ultra-status', 'ultra-doctor']
@@ -587,11 +618,19 @@ function ensureInitializationWorkflows(db, baseline, { rootDir }) {
       ? ['ultra-doctor', 'ultra-research', 'ultra-status']
       : ['ultra-research', 'ultra-status', 'ultra-doctor']);
   return {
-    init_id: initRun.id,
-    init_status: initRun.status,
-    research_id: researchRun?.id || null,
-    research_mode: researchRun?.mode || null,
-    research_status: researchRun?.status || 'not_started',
+    init: {
+      id: initCheckpoint.id,
+      status: initCheckpoint.status,
+      revision: initCheckpoint.revision,
+      digest: initCheckpoint.digest,
+    },
+    research: researchCheckpoint ? {
+      id: researchCheckpoint.id,
+      status: researchCheckpoint.status,
+      revision: researchCheckpoint.revision,
+      digest: researchCheckpoint.digest,
+      mode: researchCheckpoint.payload?.mode || null,
+    } : null,
     provenance_status: compatibilityOnly
       ? 'compatibility_only'
       : (provenanceComplete ? 'complete' : (readyWithoutProvenance ? 'incomplete' : 'pending_research')),
@@ -623,7 +662,7 @@ function resumeProject({
   let initialized;
   let copiedFiles = [];
   let baselineResult;
-  let workflowResult;
+  let checkpointResult;
   let teamCheckpoint;
   let resumeSnapshot;
   const completeResume = () => {
@@ -660,7 +699,7 @@ function resumeProject({
           classification: repositoryProfile,
         }, { rootDir: absTarget });
       }
-      workflowResult = ensureInitializationWorkflows(db, baselineResult, { rootDir: absTarget });
+      checkpointResult = ensureInitializationCheckpoint(db, baselineResult);
       if (projection?.kind === 'legacy-task-projection') {
         const publication = taskLedger.publishTaskLedger(db, {
           rootDir: absTarget,
@@ -782,7 +821,7 @@ function resumeProject({
     copied_files: copiedFiles,
     repository_profile: repositoryProfile,
     git: gitSetup.result,
-    workflow: workflowResult,
+    checkpoint: checkpointResult,
   };
   if (teamCheckpoint) {
     result.team_checkpoint = {
@@ -889,7 +928,7 @@ function initProject({
 
   let copiedFiles;
   let baselineResult;
-  let workflowResult;
+  let checkpointResult;
   let gitSetup;
   try {
     fs.mkdirSync(ultraDir, { recursive: true });
@@ -908,7 +947,7 @@ function initProject({
         scope: scope === undefined ? ['.'] : scope,
         classification: repositoryProfile,
       }, { rootDir: absTarget });
-      workflowResult = ensureInitializationWorkflows(db, baselineResult, { rootDir: absTarget });
+      checkpointResult = ensureInitializationCheckpoint(db, baselineResult);
       ops.appendEvent(db, {
         type: 'project_initialized',
         payload: {
@@ -966,7 +1005,7 @@ function initProject({
     copied_files: copiedFiles,
     repository_profile: repositoryProfile,
     git: gitSetup.result,
-    workflow: workflowResult,
+    checkpoint: checkpointResult,
   };
   if (backupPath) result.backup_path = backupPath;
   return result;

package/mcp-server/lib/managed-file-write.cjs

@@ -0,0 +1,116 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { normalizeProjectRelative } = require('./safe-project-file.cjs');
+
+class ManagedFileWriteError extends Error {
+  constructor(code, message, details) {
+    super(message);
+    this.name = 'ManagedFileWriteError';
+    this.code = code;
+    if (details) this.details = details;
+  }
+}
+
+function physicalProjectRoot(rootDir) {
+  const root = path.resolve(rootDir);
+  const stat = fs.lstatSync(root, { throwIfNoEntry: false });
+  if (!stat || !stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new ManagedFileWriteError('PATH_AUTHORITY_VIOLATION', `unsafe project root: ${root}`);
+  }
+  return { root, physical: fs.realpathSync.native(root) };
+}
+
+function ensureDirectory(rootDir, relativeDir) {
+  const project = physicalProjectRoot(rootDir);
+  const components = normalizeProjectRelative(`${relativeDir}/.managed-target`).split('/').slice(0, -1);
+  let current = project.physical;
+  for (const component of components) {
+    current = path.join(current, component);
+    let stat = fs.lstatSync(current, { throwIfNoEntry: false });
+    if (!stat) {
+      fs.mkdirSync(current, { mode: 0o700 });
+      stat = fs.lstatSync(current);
+    }
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+      throw new ManagedFileWriteError(
+        'PATH_AUTHORITY_VIOLATION',
+        `managed artifact ancestor is unsafe: ${path.relative(project.root, current)}`,
+      );
+    }
+    const physical = fs.realpathSync.native(current);
+    if (physical !== project.physical && !physical.startsWith(`${project.physical}${path.sep}`)) {
+      throw new ManagedFileWriteError(
+        'PATH_AUTHORITY_VIOLATION',
+        `managed artifact ancestor escapes the project: ${relativeDir}`,
+      );
+    }
+  }
+  return { project, directory: current };
+}
+
+function writeManagedFile(rootDir, relativePath, bytes, { mode = 0o600 } = {}) {
+  const relative = normalizeProjectRelative(relativePath);
+  const directoryRelative = path.posix.dirname(relative);
+  const basename = path.posix.basename(relative);
+  const prepared = ensureDirectory(rootDir, directoryRelative);
+  const target = path.join(prepared.directory, basename);
+  const existing = fs.lstatSync(target, { throwIfNoEntry: false });
+  if (existing && (existing.isSymbolicLink() || !existing.isFile())) {
+    throw new ManagedFileWriteError(
+      'PATH_AUTHORITY_VIOLATION',
+      `managed artifact target is unsafe: ${relative}`,
+    );
+  }
+  const tempName = `.${basename}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  const temporary = path.join(prepared.directory, tempName);
+  let fd;
+  try {
+    fd = fs.openSync(
+      temporary,
+      fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL
+        | (fs.constants.O_NOFOLLOW || 0),
+      mode,
+    );
+    fs.writeFileSync(fd, bytes);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd);
+    fd = undefined;
+    fs.renameSync(temporary, target);
+    const targetStat = fs.lstatSync(target);
+    if (!targetStat.isFile() || targetStat.isSymbolicLink()) {
+      throw new ManagedFileWriteError(
+        'PATH_AUTHORITY_VIOLATION',
+        `managed artifact publication changed identity: ${relative}`,
+      );
+    }
+    return {
+      path: relative,
+      digest: crypto.createHash('sha256').update(bytes).digest('hex'),
+      bytes: Buffer.byteLength(bytes),
+    };
+  } catch (error) {
+    if (fd !== undefined) fs.closeSync(fd);
+    try { fs.unlinkSync(temporary); } catch {}
+    if (error instanceof ManagedFileWriteError) throw error;
+    const wrapped = new ManagedFileWriteError(
+      'PATH_AUTHORITY_VIOLATION',
+      `managed artifact write failed: ${relative}`,
+      { cause: error.message },
+    );
+    throw wrapped;
+  }
+}
+
+function writeManagedJson(rootDir, relativePath, value) {
+  return writeManagedFile(rootDir, relativePath, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+module.exports = {
+  ManagedFileWriteError,
+  writeManagedFile,
+  writeManagedJson,
+};

package/mcp-server/lib/plan-checkpoint.cjs

@@ -0,0 +1,177 @@
+'use strict';
+
+const path = require('node:path');
+
+const artifacts = require('./artifact-registry.cjs');
+const changes = require('./change-workflow.cjs');
+const ops = require('./state-ops.cjs');
+const planStore = require('./plan-store.cjs');
+const taskLedger = require('./task-ledger.cjs');
+
+class PlanCheckpointError extends Error {
+  constructor(code, message, details) {
+    super(message);
+    this.name = 'PlanCheckpointError';
+    this.code = code;
+    if (details !== undefined) this.details = details;
+  }
+}
+
+function publishPlan(db, {
+  change_id: changeId,
+  context,
+} = {}, {
+  rootDir = process.cwd(),
+  markRecoveryRequired = null,
+} = {}) {
+  const change = changes.readChange(db, changeId);
+  if (!change) {
+    throw new PlanCheckpointError('CHANGE_NOT_FOUND', `change ${changeId} not found`);
+  }
+  if (change.status !== 'active') {
+    throw new PlanCheckpointError(
+      'CHANGE_NOT_MUTABLE',
+      `change ${change.id} is ${change.status}`,
+    );
+  }
+  const tasks = ops.listTasks(db, { change_id: change.id });
+  if (tasks.length === 0) {
+    throw new PlanCheckpointError('NO_TASKS', 'a Plan checkpoint requires at least one task');
+  }
+  if (!context?.id || !context?.artifact_path || !context?.digest) {
+    throw new PlanCheckpointError(
+      'PLAN_CONTEXT_REQUIRED',
+      'a Plan checkpoint requires one canonical Context Envelope',
+    );
+  }
+
+  const plan = planStore.buildPlan(tasks, { changeId: change.id });
+  const publication = planStore.prepareChangePlanPublication(plan, {
+    rootDir,
+    change,
+    tasks,
+    context: {
+      snapshot_id: context.id,
+      manifest_path: context.artifact_path,
+      manifest_digest: context.digest,
+    },
+  });
+  const contextArtifact = db.prepare(
+    `SELECT id FROM artifacts
+     WHERE path = ? AND status <> 'archived'
+     ORDER BY updated_at DESC, rowid DESC LIMIT 1`,
+  ).get(context.artifact_path);
+  const artifactInputs = publication.artifacts.map(({ kind, path: file, digest }) => ({
+    digest,
+    input: {
+      owner_type: 'change',
+      owner_id: change.id,
+      kind,
+      path: path.relative(rootDir, file).split(path.sep).join('/'),
+      source_refs: [
+        { type: 'change', id: change.id, relation: 'planned_for' },
+        ...(contextArtifact
+          ? [{ type: 'artifact', id: contextArtifact.id, relation: 'compiled_from' }]
+          : []),
+        ...tasks.map((task) => ({
+          type: 'task',
+          id: task.id,
+          relation: 'compiled_from_task_contract',
+        })),
+      ],
+      consumer_refs: [{
+        type: 'external',
+        id: 'ultra-dev',
+        relation: 'consumed_by',
+      }],
+      provenance: {
+        writer: 'ultra.checkpoint',
+        stage: 'plan',
+        publication_transaction_id: publication.transaction_id,
+      },
+      metadata: {
+        context_envelope_id: context.id,
+        context_digest: context.digest,
+        terminal_role: true,
+      },
+    },
+  }));
+
+  try {
+    ops.tx(db, () => {
+      const preflight = artifactInputs.map(({ input }) => (
+        artifacts.preflightArtifactPublication(db, input, { rootDir })
+      ));
+      publication.publish();
+      artifactInputs.forEach(({ input, digest }, index) => {
+        artifacts.recordArtifactInTx(db, {
+          ...input,
+          id: preflight[index].artifact_id || undefined,
+          expected_before_digest: preflight[index].expected_before_digest,
+          content_digest: digest,
+        }, { rootDir });
+      });
+      ops.appendEventInTx(db, {
+        type: 'plan_checkpoint_published',
+        change_id: change.id,
+        payload: {
+          context_envelope_id: context.id,
+          context_digest: context.digest,
+          plan_path: path.relative(rootDir, publication.plan_path).split(path.sep).join('/'),
+          plan_md_path: path.relative(rootDir, publication.plan_md_path).split(path.sep).join('/'),
+          publication_transaction_id: publication.transaction_id,
+          wave_count: plan.waves.length,
+        },
+      });
+    });
+  } catch (error) {
+    const rollback = publication.rollback();
+    const failure = rollback?.rolled_back === false
+      ? planStore.planRecoveryRequiredError(error, rollback, publication.transaction_id)
+      : error;
+    if (failure.code === 'PLAN_RECOVERY_REQUIRED') {
+      markRecoveryRequired?.({
+        recovered: 0,
+        finalized: 0,
+        pending: 1,
+        issues: [failure.details?.rollback_issue || {
+          code: failure.cause?.code || 'PLAN_RECOVERY_FAILED',
+          message: failure.cause?.message || failure.message,
+        }],
+      });
+    }
+    throw failure;
+  }
+
+  try {
+    publication.commit();
+  } catch (error) {
+    markRecoveryRequired?.({
+      recovered: 0,
+      finalized: 0,
+      pending: 1,
+      issues: [error.details?.issue || {
+        code: error.cause?.code || 'PLAN_RECOVERY_FAILED',
+        message: error.cause?.message || error.message,
+      }],
+    });
+    throw error;
+  }
+
+  return {
+    plan_path: path.relative(rootDir, publication.plan_path).split(path.sep).join('/'),
+    plan_md_path: path.relative(rootDir, publication.plan_md_path).split(path.sep).join('/'),
+    wave_count: plan.waves.length,
+    task_count: tasks.length,
+    task_contract_digests: Object.fromEntries(
+      tasks.map((task) => [task.id, taskLedger.durableTask(task).digest]),
+    ),
+    context_envelope_id: context.id,
+    context_digest: context.digest,
+  };
+}
+
+module.exports = {
+  PlanCheckpointError,
+  publishPlan,
+};

package/mcp-server/lib/project-context.cjs

@@ -0,0 +1,178 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const Database = require('better-sqlite3');
+
+const contextEnvelope = require('./context-envelope.cjs');
+const { EXPECTED_VERSION, REQUIRED_TABLES } = require('./state-db.cjs');
+const runtimePaths = require('./runtime-paths.cjs');
+
+function diagnosticEnvelope(rootDir, runtime, code, details = {}) {
+  return {
+    schema_version: '1.0',
+    digest: null,
+    detail: 'summary',
+    envelope: {
+      project: {
+        root: '.',
+        runtime,
+        health: 'needs_attention',
+      },
+      git: null,
+      baseline: null,
+      change: null,
+      task: null,
+      decisions: [],
+      checkpoints: [],
+      evidence: [],
+      execution: { stage: 'project', session: null },
+      team_checkpoint: null,
+      diagnostics: {
+        warnings: [],
+        needs_attention: [{
+          code,
+          severity: 'needs_attention',
+          ...details,
+        }],
+        hard_conflicts: [],
+      },
+    },
+    bytes: 0,
+    root: path.resolve(rootDir),
+  };
+}
+
+function tableNames(db) {
+  return new Set(db.prepare(
+    "SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'",
+  ).all().map((row) => row.name));
+}
+
+function latestSchemaVersion(db) {
+  return db.prepare(
+    'SELECT version FROM schema_version ORDER BY applied_at DESC, rowid DESC LIMIT 1',
+  ).get()?.version || null;
+}
+
+function readProjectContextEnvelope(rootDir, {
+  runtime = 'hook',
+  stage = 'project',
+  scope = {},
+} = {}) {
+  const root = path.resolve(rootDir || process.cwd());
+  if (!fs.existsSync(path.join(root, '.ultra'))) return null;
+  const dbPath = runtimePaths.locateStateDb(root);
+  if (!fs.existsSync(dbPath)) {
+    return diagnosticEnvelope(root, runtime, 'STATE_DB_MISSING');
+  }
+
+  let db;
+  try {
+    db = new Database(dbPath, { readonly: true, fileMustExist: true });
+    db.pragma('query_only = ON');
+    db.pragma('busy_timeout = 1000');
+    const tables = tableNames(db);
+    if (!tables.has('schema_version')) {
+      return diagnosticEnvelope(root, runtime, 'STATE_SCHEMA_MIGRATION_REQUIRED', {
+        version: null,
+      });
+    }
+    const version = latestSchemaVersion(db);
+    if (version !== EXPECTED_VERSION) {
+      return diagnosticEnvelope(root, runtime, 'STATE_SCHEMA_MIGRATION_REQUIRED', {
+        version,
+        expected: EXPECTED_VERSION,
+      });
+    }
+    const missing = REQUIRED_TABLES.filter((name) => !tables.has(name));
+    if (missing.length > 0) {
+      return diagnosticEnvelope(root, runtime, 'STATE_SCHEMA_INCOMPLETE', {
+        missing_tables: missing,
+      });
+    }
+    return {
+      ...contextEnvelope.buildEnvelope(
+        db,
+        { detail: 'summary', stage, scope },
+        { rootDir: root, runtime },
+      ),
+      root,
+    };
+  } catch (error) {
+    return diagnosticEnvelope(root, runtime, 'STATE_DB_UNREADABLE', {
+      cause: error.code || error.message,
+    });
+  } finally {
+    if (db) db.close();
+  }
+}
+
+function compact(value, maximum = 240) {
+  const normalized = String(value || '').replace(/\s+/g, ' ').trim();
+  if (normalized.length <= maximum) return normalized;
+  return `${normalized.slice(0, maximum - 3).trimEnd()}...`;
+}
+
+function renderProjectContextEnvelope(rootDir, context) {
+  if (!context?.envelope) return '';
+  const root = path.resolve(rootDir || context.root || process.cwd());
+  const envelope = context.envelope;
+  const baseline = envelope.baseline || {};
+  const change = envelope.change || {};
+  const task = envelope.task || {};
+  const lines = [
+    '[Ultra Context Envelope]',
+    `Project: ${root}`,
+    `Stage: ${envelope.execution?.stage || 'project'}`,
+    `Baseline: ${baseline.id || 'none'} (${
+      baseline.mode ? `${baseline.mode}/` : ''
+    }${baseline.status || 'none'})`,
+    `Change: ${change.id || 'none'} (${change.status || 'none'})`,
+    `Task: ${task.id || 'none'} (${task.status || 'none'})`,
+  ];
+  for (const decision of (envelope.decisions || []).slice(0, 5)) {
+    lines.push(
+      `Accepted decision: ${decision.id || 'unknown'} — ${
+        compact(decision.decision || decision.summary || decision.question || 'recorded')
+      }`,
+    );
+  }
+  for (const checkpoint of (envelope.checkpoints || []).slice(0, 5)) {
+    lines.push(
+      `Checkpoint: ${checkpoint.stage || 'unknown'} ${
+        checkpoint.status || 'recorded'
+      } (${checkpoint.id || 'unknown'})`,
+    );
+  }
+  const warnings = envelope.diagnostics?.warnings || [];
+  const attention = envelope.diagnostics?.needs_attention || [];
+  const conflicts = envelope.diagnostics?.hard_conflicts || [];
+  if (warnings.length > 0) {
+    lines.push(`Warnings: ${warnings.map((item) => item.code).join(', ')}`);
+  }
+  if (attention.length > 0) {
+    lines.push(`Needs attention: ${attention.map((item) => item.code).join(', ')}`);
+  }
+  if (conflicts.length > 0) {
+    lines.push(`Hard conflicts: ${conflicts.map((item) => item.code).join(', ')}`);
+  }
+  if (envelope.team_checkpoint) {
+    lines.push(
+      `Team checkpoint: ${envelope.team_checkpoint.status || 'unknown'} ${
+        envelope.team_checkpoint.state_digest || ''
+      }`.trim(),
+    );
+  }
+  lines.push(
+    'Authority: digest-bound .ultra documents plus checkout-local .ultra/.runtime/state.db.',
+    'Hooks are observational. Use ultra.context for the complete live envelope and public Ultra tools for changes.',
+  );
+  return lines.join('\n');
+}
+
+module.exports = {
+  readProjectContextEnvelope,
+  renderProjectContextEnvelope,
+};