@7h3/protocol 0.1.2 → 0.5.0

package/bin/7h3.ts

@@ -0,0 +1,406 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util'
+import { createServer } from 'node:http'
+import { writeFileSync } from 'node:fs'
+
+const USAGE = `
+7h3 — Aurelion Interaction Protocol CLI (wire version 7h3/0.1)
+
+Usage:
+  7h3 keygen [--output <file>]
+  7h3 sign   --private-key <key> --sender <id> [--recipient <id>] [--payload <str>] [--ttl <ms>]
+  7h3 verify --public-key <key> --envelope <json>
+  7h3 inspect --envelope <json>
+  7h3 gateway --upstream <url> [--port <n>] [--public-key <key>] [--require ed25519|none]
+              [--sign-responses] [--private-key <key>] [--sender <id>] [--metrics-port <n>]
+  7h3 keys serve [--public-key <key>] [--key-id <id>] [--port <n>]
+  7h3 help
+
+Commands:
+  keygen     Generate an Ed25519 keypair (PKCS8/SPKI, base64url-encoded)
+  sign       Create and sign an AIP envelope
+  verify     Verify an AIP envelope signature
+  inspect    Pretty-print an AIP envelope fields
+  gateway    Run a verifying HTTP proxy gateway
+  keys serve Serve a /.well-known/7h3-keys endpoint
+  help       Show this usage table
+`
+
+function die(msg: string): never {
+  process.stderr.write(`Error: ${msg}\n`)
+  process.exit(1)
+}
+
+async function cmdKeygen(argv: string[]): Promise<void> {
+  const { values } = parseArgs({
+    args: argv,
+    options: {
+      output: { type: 'string', short: 'o' },
+    },
+    strict: false,
+  })
+
+  const { generateEd25519KeypairBase64Url } = await import('../src/protocol.js')
+  const { publicKey, privateKey } = await generateEd25519KeypairBase64Url()
+
+  const result = {
+    algorithm: 'Ed25519',
+    wireVersion: '7h3/0.1',
+    publicKey,
+    privateKey,
+    createdAt: new Date().toISOString(),
+    warning: 'Keep privateKey secret — it grants signing authority over your agent identity.',
+  }
+
+  const json = JSON.stringify(result, null, 2)
+
+  if (values.output) {
+    writeFileSync(values.output as string, json, 'utf8')
+    process.stdout.write(`Keypair written to ${values.output}\n`)
+    process.stdout.write(`  algorithm : Ed25519\n`)
+    process.stdout.write(`  publicKey : ${publicKey}\n`)
+    process.stdout.write(`  createdAt : ${result.createdAt}\n`)
+  } else {
+    process.stdout.write(json + '\n')
+  }
+}
+
+async function cmdSign(argv: string[]): Promise<void> {
+  const { values } = parseArgs({
+    args: argv,
+    options: {
+      'private-key': { type: 'string' },
+      sender: { type: 'string' },
+      recipient: { type: 'string' },
+      payload: { type: 'string' },
+      ttl: { type: 'string' },
+    },
+    strict: false,
+  })
+
+  const privateKey = values['private-key'] as string | undefined
+  const sender = values['sender'] as string | undefined
+
+  if (!privateKey) die('--private-key is required')
+  if (!sender) die('--sender is required')
+
+  const { createEnvelope, signEnvelopeEd25519 } = await import('../src/protocol.js')
+
+  const envelope = createEnvelope({
+    sender: sender!,
+    recipient: values['recipient'] as string | undefined,
+    intent: 'PING',
+    content: (values['payload'] as string | undefined) ?? '',
+    ttlMs: values['ttl'] ? parseInt(values['ttl'] as string, 10) : 60_000,
+  })
+
+  const signed = await signEnvelopeEd25519(envelope, privateKey!)
+  process.stdout.write(JSON.stringify(signed) + '\n')
+}
+
+async function cmdVerify(argv: string[]): Promise<void> {
+  const { values } = parseArgs({
+    args: argv,
+    options: {
+      'public-key': { type: 'string' },
+      envelope: { type: 'string' },
+    },
+    strict: false,
+  })
+
+  const publicKey = values['public-key'] as string | undefined
+  const envelopeJson = values['envelope'] as string | undefined
+
+  if (!publicKey) die('--public-key is required')
+  if (!envelopeJson) die('--envelope is required')
+
+  const { validateEnvelope, verifyEnvelopeEd25519 } = await import('../src/protocol.js')
+
+  let envelope: ReturnType<typeof JSON.parse>
+  try {
+    envelope = JSON.parse(envelopeJson!)
+  } catch {
+    die('--envelope is not valid JSON')
+  }
+
+  const diagnostics = validateEnvelope(envelope)
+  const errors = diagnostics.filter(d => d.level === 'error')
+  const warnings = diagnostics.filter(d => d.level === 'warning')
+
+  if (errors.length > 0) {
+    process.stdout.write('INVALID — envelope validation errors:\n')
+    for (const e of errors) process.stdout.write(`  [error] ${e.message}\n`)
+    for (const w of warnings) process.stdout.write(`  [warning] ${w.message}\n`)
+    process.exit(1)
+  }
+
+  const valid = await verifyEnvelopeEd25519(envelope, publicKey!)
+
+  if (valid) {
+    process.stdout.write('Signature valid\n')
+    if (warnings.length > 0) {
+      for (const w of warnings) process.stdout.write(`  [warning] ${w.message}\n`)
+    }
+  } else {
+    process.stdout.write('INVALID — signature verification failed\n')
+    process.stdout.write(`  alg   : ${envelope.signature?.alg ?? 'none'}\n`)
+    process.stdout.write(`  keyId : ${envelope.signature?.keyId ?? 'none'}\n`)
+    process.exit(1)
+  }
+}
+
+async function cmdInspect(argv: string[]): Promise<void> {
+  const { values } = parseArgs({
+    args: argv,
+    options: {
+      envelope: { type: 'string' },
+    },
+    strict: false,
+  })
+
+  const envelopeJson = values['envelope'] as string | undefined
+  if (!envelopeJson) die('--envelope is required')
+
+  let envelope: ReturnType<typeof JSON.parse>
+  try {
+    envelope = JSON.parse(envelopeJson!)
+  } catch {
+    die('--envelope is not valid JSON')
+  }
+
+  const h = envelope.header ?? {}
+  const b = envelope.body ?? {}
+  const s = envelope.signature
+
+  const nowMs = Date.now()
+  const expiresMs = (h.timestampMs ?? 0) + (h.ttlMs ?? 0)
+  const expired = expiresMs < nowMs
+  const expiresStatus = expired
+    ? `EXPIRED (${new Date(expiresMs).toISOString()})`
+    : `OK — expires ${new Date(expiresMs).toISOString()}`
+
+  const content: string = typeof b.content === 'string' ? b.content : ''
+  const contentPreview = content.length > 80 ? content.slice(0, 77) + '...' : content
+
+  process.stdout.write(`Wire Version : ${h.version ?? '(none)'}\n`)
+  process.stdout.write(`Message ID   : ${h.messageId ?? '(none)'}\n`)
+  process.stdout.write(`Sender       : ${h.sender ?? '(none)'}\n`)
+  process.stdout.write(`Recipient    : ${h.recipient ?? '(none)'}\n`)
+  process.stdout.write(`Timestamp    : ${h.timestampMs ? new Date(h.timestampMs).toISOString() : '(none)'}\n`)
+  process.stdout.write(`TTL          : ${h.ttlMs ?? '(none)'} ms\n`)
+  process.stdout.write(`Expires      : ${expiresStatus}\n`)
+  process.stdout.write(`Intent       : ${b.intent ?? '(none)'}\n`)
+  process.stdout.write(`Content      : ${contentPreview || '(empty)'}\n`)
+  if (s) {
+    process.stdout.write(`Sig alg      : ${s.alg}\n`)
+    process.stdout.write(`Sig keyId    : ${s.keyId}\n`)
+  } else {
+    process.stdout.write(`Signature    : (none)\n`)
+  }
+}
+
+async function cmdGateway(argv: string[]): Promise<void> {
+  const { values } = parseArgs({
+    args: argv,
+    options: {
+      upstream: { type: 'string' },
+      port: { type: 'string' },
+      'public-key': { type: 'string' },
+      require: { type: 'string' },
+      'sign-responses': { type: 'boolean' },
+      'private-key': { type: 'string' },
+      sender: { type: 'string' },
+      'metrics-port': { type: 'string' },
+    },
+    strict: false,
+  })
+
+  const upstream = values['upstream'] as string | undefined
+  if (!upstream) die('--upstream is required')
+
+  const port = parseInt((values['port'] as string | undefined) ?? '8080', 10)
+  const publicKey = values['public-key'] as string | undefined
+  const requireMode = (values['require'] as string | undefined) ?? (publicKey ? 'ed25519' : 'none')
+  const signResponses = !!(values['sign-responses'])
+  const privateKey = values['private-key'] as string | undefined
+  const sender = values['sender'] as string | undefined
+  const metricsPortRaw = values['metrics-port'] as string | undefined
+  const metricsPort = metricsPortRaw ? parseInt(metricsPortRaw, 10) : undefined
+
+  const { createGateway } = await import('../src/gateway.js')
+  const { createStaticKeyRegistry } = await import('../src/keyRegistry.js')
+
+  const keys: Record<string, string> = {}
+  if (publicKey && sender) keys[sender] = publicKey
+  const keyRegistry = createStaticKeyRegistry(keys)
+
+  const gateway = createGateway({
+    upstream: upstream!,
+    keyRegistry,
+    signResponses: signResponses && !!privateKey,
+    privateKey,
+    sender,
+    defaultPolicy: requireMode === 'none' ? 'allow' : 'deny',
+  })
+
+  const server = createServer(async (req, res) => {
+    const chunks: Buffer[] = []
+    req.on('data', (chunk: Buffer) => chunks.push(chunk))
+    req.on('end', async () => {
+      const body = Buffer.concat(chunks)
+
+      // Flatten headers: string | string[] => string
+      const headers: Record<string, string> = {}
+      for (const [k, v] of Object.entries(req.headers)) {
+        if (v === undefined) continue
+        headers[k] = Array.isArray(v) ? v.join(', ') : v
+      }
+
+      try {
+        const result = await gateway.handle({
+          method: req.method ?? 'GET',
+          path: req.url ?? '/',
+          headers,
+          body: body.length > 0 ? body.toString('utf8') : undefined,
+        })
+        res.writeHead(result.status, result.headers)
+        res.end(result.body)
+      } catch (err) {
+        res.writeHead(502, { 'content-type': 'text/plain' })
+        res.end(`Gateway error: ${String(err)}`)
+      }
+    })
+  })
+
+  server.listen(port, () => {
+    process.stderr.write(`7h3 gateway listening on port ${port}\n`)
+    process.stderr.write(`  upstream      : ${upstream}\n`)
+    process.stderr.write(`  verify mode   : ${requireMode}\n`)
+    process.stderr.write(`  sign-responses: ${signResponses && !!privateKey}\n`)
+    if (sender) process.stderr.write(`  sender        : ${sender}\n`)
+  })
+
+  // Optional: dedicated metrics server
+  if (metricsPort !== undefined) {
+    const { metrics: globalMetrics, renderPrometheusText } = await import('../src/telemetry.js')
+    const metricsServer = createServer((req, res) => {
+      if (req.url === '/metrics' && req.method === 'GET') {
+        const body = renderPrometheusText(globalMetrics)
+        res.writeHead(200, { 'content-type': 'text/plain; version=0.0.4; charset=utf-8' })
+        res.end(body)
+      } else {
+        res.writeHead(404, { 'content-type': 'text/plain' })
+        res.end('Not Found')
+      }
+    })
+    metricsServer.listen(metricsPort, () => {
+      process.stderr.write(`7h3 metrics listening on :${metricsPort}/metrics\n`)
+    })
+  }
+}
+
+async function cmdKeysServe(argv: string[]): Promise<void> {
+  const { values } = parseArgs({
+    args: argv,
+    options: {
+      'public-key': { type: 'string' },
+      'key-id': { type: 'string' },
+      port: { type: 'string' },
+    },
+    strict: false,
+  })
+
+  const publicKey = values['public-key'] as string | undefined
+  const keyId = (values['key-id'] as string | undefined) ?? 'default'
+  const port = parseInt((values['port'] as string | undefined) ?? '8081', 10)
+
+  const { serveWellKnownKeys } = await import('../src/keyInfra.js')
+
+  const doc = {
+    version: '7h3/0.1' as const,
+    updated: Date.now(),
+    keys: publicKey
+      ? [
+          {
+            id: keyId,
+            algorithm: 'Ed25519' as const,
+            publicKey,
+            created: Date.now(),
+          },
+        ]
+      : [],
+  }
+
+  const body = serveWellKnownKeys(doc)
+
+  const server = createServer((req, res) => {
+    if (req.url === '/.well-known/7h3-keys') {
+      res.writeHead(200, { 'content-type': 'application/json' })
+      res.end(body)
+    } else {
+      res.writeHead(404, { 'content-type': 'text/plain' })
+      res.end('Not Found')
+    }
+  })
+
+  server.listen(port, () => {
+    process.stderr.write(`7h3 key server listening on port ${port}\n`)
+    process.stderr.write(`  GET /.well-known/7h3-keys\n`)
+    if (publicKey) process.stderr.write(`  key-id: ${keyId}\n`)
+    else process.stderr.write(`  (no keys configured — empty document)\n`)
+  })
+}
+
+async function main(): Promise<void> {
+  const args = process.argv.slice(2)
+  const command = args[0] ?? 'help'
+  const rest = args.slice(1)
+
+  switch (command) {
+    case 'keygen':
+      await cmdKeygen(rest)
+      break
+
+    case 'sign':
+      await cmdSign(rest)
+      break
+
+    case 'verify':
+      await cmdVerify(rest)
+      break
+
+    case 'inspect':
+      await cmdInspect(rest)
+      break
+
+    case 'gateway':
+      await cmdGateway(rest)
+      break
+
+    case 'keys': {
+      const sub = rest[0]
+      if (sub === 'serve') {
+        await cmdKeysServe(rest.slice(1))
+      } else {
+        die(`Unknown subcommand 'keys ${sub ?? ''}'. Did you mean 'keys serve'?`)
+      }
+      break
+    }
+
+    case 'help':
+    case '--help':
+    case '-h':
+      process.stdout.write(USAGE)
+      break
+
+    default:
+      process.stderr.write(`Unknown command: ${command}\n`)
+      process.stdout.write(USAGE)
+      process.exit(1)
+  }
+}
+
+main().catch(err => {
+  process.stderr.write(`Fatal: ${String(err)}\n`)
+  process.exit(1)
+})

package/conformance/7h3_v0_1.json

@@ -0,0 +1,77 @@
+{
+  "version": "7h3/0.1",
+  "vectors": [
+    {
+      "id": "task-with-capability-and-recipient",
+      "secret": "vector-secret-1",
+      "keyId": "vector-key-1",
+      "envelope": {
+        "header": {
+          "version": "7h3/0.1",
+          "messageId": "vec-1",
+          "timestampMs": 1712500000000,
+          "ttlMs": 60000,
+          "sender": "agent.alpha",
+          "recipient": "agent.beta",
+          "nonce": "nonce-vec-1"
+        },
+        "body": {
+          "intent": "TASK",
+          "content": "route:alpha->beta",
+          "capability": "task.plan",
+          "correlationId": "corr-1"
+        }
+      },
+      "canonical": "{\"body\":{\"capability\":\"task.plan\",\"content\":\"route:alpha->beta\",\"correlationId\":\"corr-1\",\"intent\":\"TASK\"},\"header\":{\"messageId\":\"vec-1\",\"nonce\":\"nonce-vec-1\",\"recipient\":\"agent.beta\",\"sender\":\"agent.alpha\",\"timestampMs\":1712500000000,\"ttlMs\":60000,\"version\":\"7h3/0.1\"}}",
+      "signature": "bZP1N1f4w4RGSKw6pfdcA6dQjvpv9nIHAQCttjNCZyI"
+    },
+    {
+      "id": "result-with-minimal-fields",
+      "secret": "vector-secret-2",
+      "keyId": "vector-key-2",
+      "envelope": {
+        "header": {
+          "version": "7h3/0.1",
+          "messageId": "vec-2",
+          "timestampMs": 1712500005000,
+          "ttlMs": 30000,
+          "sender": "memory.agent",
+          "nonce": "nonce-vec-2"
+        },
+        "body": {
+          "intent": "RESULT",
+          "content": "memory:ok"
+        }
+      },
+      "canonical": "{\"body\":{\"content\":\"memory:ok\",\"intent\":\"RESULT\"},\"header\":{\"messageId\":\"vec-2\",\"nonce\":\"nonce-vec-2\",\"sender\":\"memory.agent\",\"timestampMs\":1712500005000,\"ttlMs\":30000,\"version\":\"7h3/0.1\"}}",
+      "signature": "_soWM4GZS8qWZDWyXEeXPaQp7Diyp2SQua9mKy2q0BQ"
+    }
+  ],
+  "ed25519Vectors": [
+    {
+      "id": "task-ed25519-with-recipient",
+      "keyId": "ed-vector-key-1",
+      "publicKey": "MCowBQYDK2VwAyEA-mUFiTQtcKN4nnD19V_-Wyy4q19OivnAutRUPhOcC78",
+      "privateKey": "MC4CAQAwBQYDK2VwBCIEICheZbQGuDVb6hezIlcs0QnCHGxz6IhiLkC9M0qr8OOZ",
+      "envelope": {
+        "header": {
+          "version": "7h3/0.1",
+          "messageId": "vec-ed-1",
+          "timestampMs": 1712500010000,
+          "ttlMs": 45000,
+          "sender": "agent.ed",
+          "recipient": "agent.verify",
+          "nonce": "nonce-ed-1"
+        },
+        "body": {
+          "intent": "TASK",
+          "content": "route:ed25519",
+          "capability": "task.sign",
+          "correlationId": "corr-ed-1"
+        }
+      },
+      "canonical": "{\"body\":{\"capability\":\"task.sign\",\"content\":\"route:ed25519\",\"correlationId\":\"corr-ed-1\",\"intent\":\"TASK\"},\"header\":{\"messageId\":\"vec-ed-1\",\"nonce\":\"nonce-ed-1\",\"recipient\":\"agent.verify\",\"sender\":\"agent.ed\",\"timestampMs\":1712500010000,\"ttlMs\":45000,\"version\":\"7h3/0.1\"}}",
+      "signature": "AAWu-6pp7NQZ-NtWKrgREWlMBx-kMZZzZ5dIiBqOdT-zdr-u4HtS6upE79yX7UUNPYUfyKs7lfssi0EeOvIxAA"
+    }
+  ]
+}

package/conformance/7h3_v0_1_binary.json

@@ -0,0 +1,20 @@
+{
+  "generatedAt": "2026-06-28T00:56:52.383Z",
+  "vectors": [
+    {
+      "id": "task-with-capability-and-recipient",
+      "alg": "HS256",
+      "binaryHex": "41495042010f0000018eb8f445000000ea60000000073768332f302e31000000057665632d310000000b6167656e742e616c7068610000000b6e6f6e63652d7665632d31000000045441534b00000011726f7574653a616c7068612d3e626574610000000a6167656e742e62657461000000097461736b2e706c616e00000006636f72722d31010000000c766563746f722d6b65792d310000002b625a50314e31663477345247534b773670666463413664516a767076396e494841514374746a4e435a7949"
+    },
+    {
+      "id": "result-with-minimal-fields",
+      "alg": "HS256",
+      "binaryHex": "4149504201080000018eb8f4588800007530000000073768332f302e31000000057665632d320000000c6d656d6f72792e6167656e740000000b6e6f6e63652d7665632d3200000006524553554c54000000096d656d6f72793a6f6b010000000c766563746f722d6b65792d320000002b5f736f574d34475a533871575a445779584565585061517037446979703253517561396d4b793271304251"
+    },
+    {
+      "id": "task-ed25519-with-recipient",
+      "alg": "ED25519",
+      "binaryHex": "41495042010f0000018eb8f46c100000afc8000000073768332f302e31000000087665632d65642d31000000086167656e742e65640000000a6e6f6e63652d65642d31000000045441534b0000000d726f7574653a656432353531390000000c6167656e742e766572696679000000097461736b2e7369676e00000009636f72722d65642d31020000000f65642d766563746f722d6b65792d3100000056414157752d367070374e515a2d4e74574b72675245576c4d42782d6b4d5a5a7a5a3564496942714f64542d7a64722d753448745336757045373979583755554e50595566794b73376c667373693045654f7649784141"
+    }
+  ]
+}

package/conformance/aip_v0_1_binary.json

@@ -0,0 +1,20 @@
+{
+  "generatedAt": "2026-05-04T04:49:29.647Z",
+  "vectors": [
+    {
+      "id": "task-with-capability-and-recipient",
+      "alg": "HS256",
+      "binaryHex": "41495042010f0000018eb8f445000000ea60000000076169702f302e31000000057665632d310000000b6167656e742e616c7068610000000b6e6f6e63652d7665632d31000000045441534b00000011726f7574653a616c7068612d3e626574610000000a6167656e742e62657461000000097461736b2e706c616e00000006636f72722d31010000000c766563746f722d6b65792d310000002b4f6c376c516b5259336c52534961303576686b43795a32336f705973525139416250774670326378324430"
+    },
+    {
+      "id": "result-with-minimal-fields",
+      "alg": "HS256",
+      "binaryHex": "4149504201080000018eb8f4588800007530000000076169702f302e31000000057665632d320000000c6d656d6f72792e6167656e740000000b6e6f6e63652d7665632d3200000006524553554c54000000096d656d6f72793a6f6b010000000c766563746f722d6b65792d320000002b5a57775a5045787732646341416c354278507a33313337386d4351352d674768395566587536705a4b646f"
+    },
+    {
+      "id": "task-ed25519-with-recipient",
+      "alg": "ED25519",
+      "binaryHex": "41495042010f0000018eb8f46c100000afc8000000076169702f302e31000000087665632d65642d31000000086167656e742e65640000000a6e6f6e63652d65642d31000000045441534b0000000d726f7574653a656432353531390000000c6167656e742e766572696679000000097461736b2e7369676e00000009636f72722d65642d31020000000f65642d766563746f722d6b65792d310000005677787941674e494b6f66344d563478487757697a73623366366b326a574168325a7a7132703967684153456b5f464a4157346774366239317a76327a363344506b73416f485a365135334a64656a486f6150316f4251"
+    }
+  ]
+}

package/docker-compose.yaml

@@ -0,0 +1,77 @@
+# 7h3 Protocol — Docker Compose development stack
+# Brings up:
+#   gateway — verifying AIP proxy (port 8080)
+#   api     — minimal example upstream (port 3000, internal only)
+#
+# Quick start:
+#   docker compose up --build
+
+services:
+
+  # ---------------------------------------------------------------------------
+  # gateway — 7h3 Protocol verifying HTTP proxy
+  # ---------------------------------------------------------------------------
+  gateway:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    ports:
+      - "8080:8080"
+    command:
+      - "--port"
+      - "8080"
+      - "--upstream"
+      - "http://api:3000"
+      - "--require"
+      - "ed25519"
+    environment:
+      # Override these at runtime to enable response signing:
+      #   GATEWAY_PRIVATE_KEY=<base64url private key>
+      #   GATEWAY_SENDER=gateway@my-service.example.com
+      NODE_ENV: production
+    depends_on:
+      api:
+        condition: service_started
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 5s
+      start_period: 10s
+      retries: 3
+
+  # ---------------------------------------------------------------------------
+  # api — minimal example upstream service
+  #
+  # This is a self-contained inline Node.js server that demonstrates the
+  # headers the gateway injects after successful envelope verification:
+  #   x-7h3-sender   — verified sender identity from the AIP envelope
+  #   x-7h3-verified — always "true" when the gateway passed the request
+  #
+  # Replace this service with your actual application in production.
+  # ---------------------------------------------------------------------------
+  api:
+    image: node:22-alpine
+    command: >
+      node -e "
+        const http = require('http');
+        const server = http.createServer((req, res) => {
+          const sender = req.headers['x-7h3-sender'] || null;
+          const verified = req.headers['x-7h3-verified'] === 'true';
+          const body = JSON.stringify({
+            ok: true,
+            path: req.url,
+            sender,
+            verified,
+            method: req.method,
+          });
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(body);
+        });
+        server.listen(3000, () => {
+          process.stderr.write('example api listening on port 3000\n');
+        });
+      "
+    expose:
+      - "3000"
+    restart: unless-stopped