@kya-os/mcp-i 1.12.3 → 1.13.0

package/dist/runtime/identity.d.ts

@@ -75,8 +75,34 @@ export declare class IdentityManager {
     /**
      * Generate new development identity
      * Requirements: 4.1, 4.4
+     *
+     * @param preserveDid - use this DID instead of minting a fresh
+     *   did:web:localhost:... one. Added for `rotateDevIdentity()`'s benefit
+     *   (a rotation keeps the agent's DID stable by default); every existing
+     *   caller passes no argument and is unaffected.
      */
     private generateDevIdentity;
+    /**
+     * Force-generate a fresh Ed25519 keypair and persist it to
+     * `devIdentityPath`, unconditionally overwriting whatever identity (if
+     * any) is already there. Unlike `ensureIdentity()`, which loads an
+     * existing valid identity rather than replacing it, this always mints a
+     * new one -- the primitive `mcpi keys rotate` needs.
+     *
+     * Deliberately reuses this same jose-based, 32-byte-raw-key generation
+     * path (rather than a second, independent key generator) so a rotated
+     * identity file is always in the one format every other identity path in
+     * this codebase already produces and consumes -- `CLIIdentityFileSchema`
+     * (`packages/contracts/src/cli.ts`) requires exactly 44 base64 characters
+     * (a raw 32-byte key), which the CLI's own `node:crypto`-based DER
+     * keypair (PKCS8/SPKI, `utils/identity-manager.ts`'s `generateKeyPair`)
+     * does not produce -- confirmed by direct inspection, not assumed.
+     *
+     * @param preserveDid - reuse this DID instead of minting a fresh one,
+     *   mirroring `mcpi keys rotate`'s own default of keeping the DID stable
+     *   across a rotation unless `--new-did` is passed.
+     */
+    rotateDevIdentity(preserveDid?: string): Promise<AgentIdentity>;
     /**
      * Generate multibase-encoded key identifier (z-prefix base58btc)
      */

package/dist/runtime/identity.js

@@ -120,8 +120,13 @@ class IdentityManager {
     /**
      * Generate new development identity
      * Requirements: 4.1, 4.4
+     *
+     * @param preserveDid - use this DID instead of minting a fresh
+     *   did:web:localhost:... one. Added for `rotateDevIdentity()`'s benefit
+     *   (a rotation keeps the agent's DID stable by default); every existing
+     *   caller passes no argument and is unaffected.
      */
-    async generateDevIdentity() {
+    async generateDevIdentity(preserveDid) {
         // Generate Ed25519 keypair
         const keyPair = await (0, jose_1.generateKeyPair)("EdDSA", { crv: "Ed25519" });
         // Export keys to JWK format
@@ -133,10 +138,11 @@ class IdentityManager {
         const publicKey = Buffer.from(privateKeyJwk.x, "base64url").toString("base64");
         // Generate multibase-encoded key ID
         const kid = this.generateMultibaseKid(publicKey);
-        // Generate DID (for dev, use localhost)
-        // Extract a short identifier for the DID path (first 8 chars of hash for readability)
+        // Generate DID (for dev, use localhost), unless the caller wants to
+        // keep an existing one. Extract a short identifier for the DID path
+        // (first 8 chars of hash for readability).
         const shortId = (0, crypto_1.createHash)("sha256").update(publicKey).digest("hex").substring(0, 8);
-        const did = `did:web:localhost:3000:agents:${shortId}`;
+        const did = preserveDid ?? `did:web:localhost:3000:agents:${shortId}`;
         const now = new Date().toISOString();
         const identity = {
             did,
@@ -149,6 +155,33 @@ class IdentityManager {
         await this.saveDevIdentity(identity);
         return identity;
     }
+    /**
+     * Force-generate a fresh Ed25519 keypair and persist it to
+     * `devIdentityPath`, unconditionally overwriting whatever identity (if
+     * any) is already there. Unlike `ensureIdentity()`, which loads an
+     * existing valid identity rather than replacing it, this always mints a
+     * new one -- the primitive `mcpi keys rotate` needs.
+     *
+     * Deliberately reuses this same jose-based, 32-byte-raw-key generation
+     * path (rather than a second, independent key generator) so a rotated
+     * identity file is always in the one format every other identity path in
+     * this codebase already produces and consumes -- `CLIIdentityFileSchema`
+     * (`packages/contracts/src/cli.ts`) requires exactly 44 base64 characters
+     * (a raw 32-byte key), which the CLI's own `node:crypto`-based DER
+     * keypair (PKCS8/SPKI, `utils/identity-manager.ts`'s `generateKeyPair`)
+     * does not produce -- confirmed by direct inspection, not assumed.
+     *
+     * @param preserveDid - reuse this DID instead of minting a fresh one,
+     *   mirroring `mcpi keys rotate`'s own default of keeping the DID stable
+     *   across a rotation unless `--new-did` is passed.
+     */
+    async rotateDevIdentity(preserveDid) {
+        const identity = await this.generateDevIdentity(preserveDid);
+        const rotated = { ...identity, lastRotated: identity.createdAt };
+        await this.saveDevIdentity(rotated);
+        this.cachedIdentity = rotated;
+        return rotated;
+    }
     /**
      * Generate multibase-encoded key identifier (z-prefix base58btc)
      */

package/dist/runtime/index.d.ts

@@ -18,11 +18,12 @@ export { type AuthHandshakeConfig, type VerifyOrHintsResult, type AgentReputatio
 export { createResumeTokenStore, type ResumeTokenStoreConfig, } from "./resume-token-store";
 export { CloudflareKVResumeTokenStore, type ResumeTokenKVNamespace, } from "./resume-token-store-kv";
 export { ensureOutboundIdentityBridge } from "./outbound-identity-bridge";
-export { type ProofDestination, type ProofSubmission, type ProofBatchQueueConfig, ProofBatchQueue, KTAProofDestination, AgentShieldProofDestination, PartialProofSubmissionError, createProofBatchQueue, } from "./proof-batch-queue";
+export { type ProofDestination, type ProofSubmission, type ProofBatchQueueConfig, ProofBatchQueue, KTAProofDestination, CheckpointProofDestination, PartialProofSubmissionError, createProofBatchQueue, } from "./proof-batch-queue";
 export { CloudflareKVDelegationVerifier, } from "./delegation-verifier-kv";
-export { AgentShieldAPIDelegationVerifier, } from "./delegation-verifier-agentshield";
+export { CheckpointAPIDelegationVerifier, } from "./delegation-verifier-checkpoint";
 export { MemoryDelegationVerifier, } from "./delegation-verifier-memory";
-export { type ToolProtectionConfig, type ToolProtectionMap, type ToolProtectionConfigSource, ToolProtectionResolver, createToolProtectionResolver, InlineToolProtectionSource, FileToolProtectionSource, AgentShieldToolProtectionSource, } from "./tool-protection";
+export { type ToolProtectionConfig, type ToolProtectionMap, type ToolProtectionConfigSource, ToolProtectionResolver, createToolProtectionResolver, InlineToolProtectionSource, FileToolProtectionSource, CheckpointToolProtectionSource, } from "./tool-protection";
+export * from "./former-names";
 export { toolProtectionRegistry, isToolProtected, getToolProtection, } from "./tool-protection-registry";
 export type { HandshakeRequest, SessionContext, NonceCache, NonceCacheEntry, NonceCacheConfig, } from "@kya-os/contracts/handshake";
 export type { ProofMeta, DetachedProof, CanonicalHashes, AuditRecord, } from "@kya-os/mcp/types" with { "resolution-mode": "import" };

package/dist/runtime/index.js

@@ -5,8 +5,22 @@
  * Identity-aware MCP runtime with proof generation, session management,
  * canonical audit trails, and well-known endpoints.
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentShieldToolProtectionSource = exports.FileToolProtectionSource = exports.InlineToolProtectionSource = exports.createToolProtectionResolver = exports.ToolProtectionResolver = exports.MemoryDelegationVerifier = exports.AgentShieldAPIDelegationVerifier = exports.CloudflareKVDelegationVerifier = exports.createProofBatchQueue = exports.PartialProofSubmissionError = exports.AgentShieldProofDestination = exports.KTAProofDestination = exports.ProofBatchQueue = exports.ensureOutboundIdentityBridge = exports.CloudflareKVResumeTokenStore = exports.createResumeTokenStore = exports.MemoryResumeTokenStore = exports.hasSensitiveScopes = exports.verifyOrHints = exports.extractScopes = exports.validateDelegation = exports.checkScopes = exports.createDelegationVerifier = exports.formatVerifyLink = exports.DemoConsole = exports.createDemoManager = exports.DemoManager = exports.createDebugEndpoint = exports.DebugManager = exports.extractDIDFromPath = exports.validateAgentDocument = exports.validateDIDDocument = exports.createWellKnownHandler = exports.WellKnownManager = exports.extractCanonicalData = exports.createProofResponse = exports.ProofGenerator = exports.validateHandshakeFormat = exports.createHandshakeRequest = exports.defaultSessionManager = exports.SessionManager = exports.IDENTITY_ERRORS = exports.ensureIdentity = exports.defaultIdentityManager = exports.IdentityManager = exports.RUNTIME_ERRORS = exports.RuntimeFactory = exports.createMCPIRuntime = exports.MCPIRuntime = exports.MCPINodeRuntimeWrapper = void 0;
+exports.CheckpointToolProtectionSource = exports.FileToolProtectionSource = exports.InlineToolProtectionSource = exports.createToolProtectionResolver = exports.ToolProtectionResolver = exports.MemoryDelegationVerifier = exports.CheckpointAPIDelegationVerifier = exports.CloudflareKVDelegationVerifier = exports.createProofBatchQueue = exports.PartialProofSubmissionError = exports.CheckpointProofDestination = exports.KTAProofDestination = exports.ProofBatchQueue = exports.ensureOutboundIdentityBridge = exports.CloudflareKVResumeTokenStore = exports.createResumeTokenStore = exports.MemoryResumeTokenStore = exports.hasSensitiveScopes = exports.verifyOrHints = exports.extractScopes = exports.validateDelegation = exports.checkScopes = exports.createDelegationVerifier = exports.formatVerifyLink = exports.DemoConsole = exports.createDemoManager = exports.DemoManager = exports.createDebugEndpoint = exports.DebugManager = exports.extractDIDFromPath = exports.validateAgentDocument = exports.validateDIDDocument = exports.createWellKnownHandler = exports.WellKnownManager = exports.extractCanonicalData = exports.createProofResponse = exports.ProofGenerator = exports.validateHandshakeFormat = exports.createHandshakeRequest = exports.defaultSessionManager = exports.SessionManager = exports.IDENTITY_ERRORS = exports.ensureIdentity = exports.defaultIdentityManager = exports.IdentityManager = exports.RUNTIME_ERRORS = exports.RuntimeFactory = exports.createMCPIRuntime = exports.MCPIRuntime = exports.MCPINodeRuntimeWrapper = void 0;
 exports.getToolProtection = exports.isToolProtected = exports.toolProtectionRegistry = void 0;
 // Main runtime - Node.js implementation with providers
 var mcpi_runtime_wrapper_1 = require("./mcpi-runtime-wrapper");
@@ -74,13 +88,13 @@ Object.defineProperty(exports, "ensureOutboundIdentityBridge", { enumerable: tru
 var proof_batch_queue_1 = require("./proof-batch-queue");
 Object.defineProperty(exports, "ProofBatchQueue", { enumerable: true, get: function () { return proof_batch_queue_1.ProofBatchQueue; } });
 Object.defineProperty(exports, "KTAProofDestination", { enumerable: true, get: function () { return proof_batch_queue_1.KTAProofDestination; } });
-Object.defineProperty(exports, "AgentShieldProofDestination", { enumerable: true, get: function () { return proof_batch_queue_1.AgentShieldProofDestination; } });
+Object.defineProperty(exports, "CheckpointProofDestination", { enumerable: true, get: function () { return proof_batch_queue_1.CheckpointProofDestination; } });
 Object.defineProperty(exports, "PartialProofSubmissionError", { enumerable: true, get: function () { return proof_batch_queue_1.PartialProofSubmissionError; } });
 Object.defineProperty(exports, "createProofBatchQueue", { enumerable: true, get: function () { return proof_batch_queue_1.createProofBatchQueue; } });
 var delegation_verifier_kv_1 = require("./delegation-verifier-kv");
 Object.defineProperty(exports, "CloudflareKVDelegationVerifier", { enumerable: true, get: function () { return delegation_verifier_kv_1.CloudflareKVDelegationVerifier; } });
-var delegation_verifier_agentshield_1 = require("./delegation-verifier-agentshield");
-Object.defineProperty(exports, "AgentShieldAPIDelegationVerifier", { enumerable: true, get: function () { return delegation_verifier_agentshield_1.AgentShieldAPIDelegationVerifier; } });
+var delegation_verifier_checkpoint_1 = require("./delegation-verifier-checkpoint");
+Object.defineProperty(exports, "CheckpointAPIDelegationVerifier", { enumerable: true, get: function () { return delegation_verifier_checkpoint_1.CheckpointAPIDelegationVerifier; } });
 var delegation_verifier_memory_1 = require("./delegation-verifier-memory");
 Object.defineProperty(exports, "MemoryDelegationVerifier", { enumerable: true, get: function () { return delegation_verifier_memory_1.MemoryDelegationVerifier; } });
 // Tool protection (NEW - Phase 1.5)
@@ -89,7 +103,9 @@ Object.defineProperty(exports, "ToolProtectionResolver", { enumerable: true, get
 Object.defineProperty(exports, "createToolProtectionResolver", { enumerable: true, get: function () { return tool_protection_1.createToolProtectionResolver; } });
 Object.defineProperty(exports, "InlineToolProtectionSource", { enumerable: true, get: function () { return tool_protection_1.InlineToolProtectionSource; } });
 Object.defineProperty(exports, "FileToolProtectionSource", { enumerable: true, get: function () { return tool_protection_1.FileToolProtectionSource; } });
-Object.defineProperty(exports, "AgentShieldToolProtectionSource", { enumerable: true, get: function () { return tool_protection_1.AgentShieldToolProtectionSource; } });
+Object.defineProperty(exports, "CheckpointToolProtectionSource", { enumerable: true, get: function () { return tool_protection_1.CheckpointToolProtectionSource; } });
+// Former AgentShield names, kept as deprecated aliases.
+__exportStar(require("./former-names"), exports);
 var tool_protection_registry_1 = require("./tool-protection-registry");
 Object.defineProperty(exports, "toolProtectionRegistry", { enumerable: true, get: function () { return tool_protection_registry_1.toolProtectionRegistry; } });
 Object.defineProperty(exports, "isToolProtected", { enumerable: true, get: function () { return tool_protection_registry_1.isToolProtected; } });

package/dist/runtime/mcpi-runtime-wrapper.js

@@ -14,6 +14,7 @@ exports.createMCPIRuntime = createMCPIRuntime;
 const mcp_i_runtime_1 = require("@kya-os/mcp-i-runtime");
 const node_providers_1 = require("../providers/node-providers");
 const path_1 = __importDefault(require("path"));
+const config_1 = require("@kya-os/contracts/config");
 /**
  * Convert legacy config to provider-based config
  */
@@ -67,8 +68,9 @@ class MCPINodeRuntimeWrapper extends mcp_i_runtime_1.MCPIRuntimeBase {
             timestampSkewSeconds: coreConfig.session?.timestampSkewSeconds || 120,
         });
         // Instantiate AccessControlApiService if API key is available
-        const apiKey = process.env.AGENTSHIELD_API_KEY;
-        const apiUrl = process.env.AGENTSHIELD_API_URL || "https://kya.vouched.id";
+        const checkpoint = (0, config_1.withCheckpointNames)(process.env);
+        const apiKey = checkpoint.CHECKPOINT_API_KEY;
+        const apiUrl = checkpoint.CHECKPOINT_API_URL || "https://kya.vouched.id";
         if (apiKey) {
             this.accessControlService = new mcp_i_runtime_1.AccessControlApiService({
                 baseUrl: apiUrl,

package/dist/runtime/mcpi-runtime.d.ts

@@ -47,10 +47,11 @@ export interface MCPIRuntimeConfig {
         enabled?: boolean;
         /** Proof batch queue configuration */
         batchQueue?: {
-            /** Proof submission destinations (AgentShield, KTA, etc.) */
+            /** Proof submission destinations (Checkpoint, KTA, etc.) */
             destinations?: Array<{
                 /** Destination type */
-                type: "agentshield" | "kta";
+                /** `"agentshield"` is the former name of `"checkpoint"`. */
+                type: "checkpoint" | "agentshield" | "kta";
                 /** API base URL */
                 apiUrl: string;
                 /** API key for authentication */
@@ -101,7 +102,12 @@ export interface MCPIRuntimeConfig {
         toolProtections?: ToolProtectionMap;
         /** Local tool protection file path (default: tool-protections.json) */
         toolProtectionsFile?: string | false;
-        /** AgentShield API configuration for fetching tool protections */
+        /** Checkpoint API configuration for fetching tool protections */
+        checkpoint?: {
+            apiUrl: string;
+            apiKey?: string;
+        };
+        /** @deprecated Use `checkpoint`; read only when `checkpoint` is absent. */
         agentShield?: {
             apiUrl: string;
             apiKey?: string;

package/dist/runtime/mcpi-runtime.js

@@ -66,7 +66,7 @@ class MCPIRuntime {
             this.delegationVerifier = (0, delegation_verifier_1.createDelegationVerifier)(config.delegation.verifier);
         }
         // NOTE: Tool protection resolver is created in initialize()
-        // after identity is loaded, because AgentShield API needs the agent DID
+        // after identity is loaded, because Checkpoint API needs the agent DID
     }
     /**
      * Initialize the runtime (async setup)
@@ -80,14 +80,15 @@ class MCPIRuntime {
         this.sessionManager.setServerDid(this.cachedIdentity.did);
         // Create tool protection resolver NOW that we have the agent DID (NEW - Phase 1.5)
         if (this.config.delegation?.enabled) {
+            const checkpointApi = this.config.delegation.checkpoint ?? this.config.delegation.agentShield;
             this.toolProtectionResolver = (0, tool_protection_1.createToolProtectionResolver)({
                 inline: this.config.delegation.toolProtections,
                 localFile: this.config.delegation.toolProtectionsFile,
-                agentShield: this.config.delegation.agentShield
+                checkpoint: checkpointApi
                     ? {
-                        apiUrl: this.config.delegation.agentShield.apiUrl,
+                        apiUrl: checkpointApi.apiUrl,
                         agentDid: this.cachedIdentity.did, // ← FIX: Use actual DID!
-                        apiKey: this.config.delegation.agentShield.apiKey,
+                        apiKey: checkpointApi.apiKey,
                     }
                     : undefined,
                 debug: this.config.identity?.environment === 'development',
@@ -135,7 +136,7 @@ class MCPIRuntime {
                     kta: this.config.delegation?.authorization?.kta,
                     bouncer: {
                         authorizationUrl: this.config.delegation?.authorization?.authorizationUrl ||
-                            "https://agentshield.example.com/consent",
+                            "https://checkpoint.example.com/consent",
                         resumeTokenTtl: this.config.delegation?.authorization?.resumeTokenTtl,
                         minReputationScore: this.config.delegation?.authorization?.minReputationScore,
                         requireAuthForUnknown: this.config.delegation?.authorization?.requireAuthForUnknown,
@@ -196,7 +197,7 @@ class MCPIRuntime {
                     kta: this.config.delegation.authorization?.kta,
                     bouncer: {
                         authorizationUrl: this.config.delegation.authorization?.authorizationUrl ||
-                            "https://agentshield.example.com/consent",
+                            "https://checkpoint.example.com/consent",
                         resumeTokenTtl: this.config.delegation.authorization?.resumeTokenTtl,
                         minReputationScore: this.config.delegation.authorization?.minReputationScore,
                         requireAuthForUnknown: this.config.delegation.authorization?.requireAuthForUnknown,

package/dist/runtime/proof-batch-queue.d.ts

@@ -1,7 +1,7 @@
 /**
  * Proof Batch Queue
  *
- * Collects proofs in memory and submits them in batches to KTA and AgentShield.
+ * Collects proofs in memory and submits them in batches to KTA and Checkpoint.
  * This prevents blocking tool execution while ensuring proofs are eventually submitted.
  *
  * Performance:
@@ -74,12 +74,12 @@ export declare class KTAProofDestination implements ProofDestination {
     private submitOne;
 }
 /**
- * AgentShield proof submission destination
+ * Checkpoint proof submission destination
  *
- * Submits proofs to AgentShield's /api/v1/bouncer/proofs endpoint
+ * Submits proofs to Checkpoint's /api/v1/bouncer/proofs endpoint
  * with proper authentication and session grouping.
  */
-export declare class AgentShieldProofDestination implements ProofDestination {
+export declare class CheckpointProofDestination implements ProofDestination {
     name: string;
     private apiUrl;
     private apiKey;

package/dist/runtime/proof-batch-queue.js

@@ -2,7 +2,7 @@
 /**
  * Proof Batch Queue
  *
- * Collects proofs in memory and submits them in batches to KTA and AgentShield.
+ * Collects proofs in memory and submits them in batches to KTA and Checkpoint.
  * This prevents blocking tool execution while ensuring proofs are eventually submitted.
  *
  * Performance:
@@ -18,7 +18,7 @@
  * Related: PHASE_1_XMCP_I_SERVER.md Epic 3 (Proof Batching)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProofBatchQueue = exports.AgentShieldProofDestination = exports.KTAProofDestination = exports.PartialProofSubmissionError = void 0;
+exports.ProofBatchQueue = exports.CheckpointProofDestination = exports.KTAProofDestination = exports.PartialProofSubmissionError = void 0;
 exports.createProofBatchQueue = createProofBatchQueue;
 /**
  * Thrown by a ProofDestination whose submit() made independent per-item
@@ -121,13 +121,13 @@ class KTAProofDestination {
 }
 exports.KTAProofDestination = KTAProofDestination;
 /**
- * AgentShield proof submission destination
+ * Checkpoint proof submission destination
  *
- * Submits proofs to AgentShield's /api/v1/bouncer/proofs endpoint
+ * Submits proofs to Checkpoint's /api/v1/bouncer/proofs endpoint
  * with proper authentication and session grouping.
  */
-class AgentShieldProofDestination {
-    name = "AgentShield";
+class CheckpointProofDestination {
+    name = "Checkpoint";
     apiUrl;
     apiKey;
     constructor(apiUrl, apiKey) {
@@ -139,13 +139,13 @@ class AgentShieldProofDestination {
             return;
         }
         const proofs = submissions.map((submission) => submission.proof);
-        // Extract session_id from first proof for AgentShield session grouping
-        // AgentShield uses this for analytics and detection monitoring
+        // Extract session_id from first proof for Checkpoint session grouping
+        // Checkpoint uses this for analytics and detection monitoring
         const sessionId = proofs[0]?.meta?.sessionId || "unknown";
-        // AgentShield API format requires delegation_id and session_id wrapper
+        // Checkpoint API format requires delegation_id and session_id wrapper
         const requestBody = {
             delegation_id: null, // null for proofs without delegation context
-            session_id: sessionId, // AgentShield session grouping (same as meta.sessionId)
+            session_id: sessionId, // Checkpoint session grouping (same as meta.sessionId)
             proofs: proofs,
         };
         const response = await fetch(`${this.apiUrl}/api/v1/bouncer/proofs`, {
@@ -161,11 +161,11 @@ class AgentShieldProofDestination {
             const errorBody = await response
                 .text()
                 .catch(() => "Unable to read error body");
-            throw new Error(`AgentShield proof submission failed: ${response.status} ${response.statusText}\n${errorBody}`);
+            throw new Error(`Checkpoint proof submission failed: ${response.status} ${response.statusText}\n${errorBody}`);
         }
     }
 }
-exports.AgentShieldProofDestination = AgentShieldProofDestination;
+exports.CheckpointProofDestination = CheckpointProofDestination;
 /**
  * Proof Batch Queue
  *