@tdxvolt/volt-client-grpc 0.14.60 → 0.14.134

package/lib/index.cjs

@@ -462,7 +462,7 @@ var grpcUtils = /*#__PURE__*/Object.freeze({
 /* eslint-disable no-underscore-dangle */
 
 const { pki: pki$1 } = forge__default["default"];
-const log$4 = debug__default["default"]("volt-client-grpc:volt-credential");
+const log$5 = debug__default["default"]("volt-client-grpc:volt-credential");
 const aesAlgorithm = "aes-256-cbc";
 const rs256Algorithm = "RS256";
 
@@ -523,6 +523,18 @@ class VoltCredential {
     return this._cryptoCache;
   }
 
+  get clientId() {
+    return this._cryptoCache.client_id;
+  }
+
+  get voltPublicKey() {
+    return this._voltPublicKey;
+  }
+
+  get publicKey() {
+    return pki$1.publicKeyToPem(this.getKey().publicKey);
+  }
+
   get voltFingerprint() {
     return this._voltFingerprint;
   }
@@ -539,17 +551,17 @@ class VoltCredential {
   createKey() {
     if (this._cryptoCache.key) {
       // Already have key data in the cache in pem format => create fully-formed pki instances.
-      log$4("createKey - key already exists");
+      log$5("createKey - key already exists");
       return Promise.resolve(this.getKey());
     } else {
-      log$4("creating key");
+      log$5("creating key");
       return new Promise((resolve, reject) => {
         pki$1.rsa.generateKeyPair({ bits: 2048, workers: -1 }, (err, keypair) => {
           if (err) {
-            log$4("failure creating key [%s]", err.message);
+            log$5("failure creating key [%s]", err.message);
             reject(err);
           } else {
-            log$4("successfully created key");
+            log$5("successfully created key");
             const pem = pki$1.privateKeyToPem(keypair.privateKey);
             this._cryptoCache.key = pem;
             resolve(keypair);
@@ -571,7 +583,7 @@ class VoltCredential {
         return this._cryptoCache;
       })
       .catch((err) => {
-        log$4("failure initialising crypto [%s]", err.message);
+        log$5("failure initialising crypto [%s]", err.message);
         return Promise.reject(err);
       });
   }
@@ -586,7 +598,7 @@ class VoltCredential {
    * @param {*} tunnelling flag indicating if the token is required for a tunnelled connection
    * @param {*} ttl time to live in seconds (default to 1 minute)
    */
-  getIdentityToken(audience, tunnelling = false, ttl = 60) {
+  getIdentityToken(audience, publicKey, tunnelling = false, ttl = 60) {
     if (!this._cryptoCache.key) {
       throw new Error("crypto cache invalid");
     }
@@ -595,7 +607,7 @@ class VoltCredential {
     const publicKeyPem = pki$1.publicKeyToPem(keyPair.publicKey);
     const base58Key = createPublicKeyFingerprint(publicKeyPem);
 
-    log$4("base58 key is %s", base58Key);
+    log$5("base58 key is %s", base58Key);
 
     // Allow TTL either side of the current time.
     // @todo - fix with server time sync on volt connection.
@@ -612,11 +624,8 @@ class VoltCredential {
       sharedKey = VoltCredential.aesCreateKey();
 
       // Encrypt the key details using the target Volt public key and include this in the JWT payload.
-      payload.sk = VoltCredential.rsaEncrypt(
-        this._voltPublicKey,
-        sharedKey.key,
-      );
-      payload.iv = VoltCredential.rsaEncrypt(this._voltPublicKey, sharedKey.iv);
+      payload.sk = VoltCredential.rsaEncrypt(publicKey, sharedKey.key);
+      payload.iv = VoltCredential.rsaEncrypt(publicKey, sharedKey.iv);
     }
 
     // Sign synchronously.
@@ -641,9 +650,10 @@ class VoltCredential {
    * @param {*} ttl
    * @returns
    */
-  getIdentityMetadata(grpc, audience, tunnelling = false, ttl = 60) {
+  getIdentityMetadata(grpc, audience, publicKey, tunnelling = false, ttl = 60) {
     const identityToken = this.getIdentityToken(
       audience || this._voltConfig.id,
+      publicKey,
       tunnelling,
       ttl,
     );
@@ -689,6 +699,12 @@ class VoltCredential {
   static rsaEncrypt(key, buffer) {
     return crypto__default["default"].publicEncrypt(key, buffer).toString("base64");
   }
+
+  static rsaDecrypt(key, buffer) {
+    const keyObj = crypto__default["default"].createPrivateKey(key);
+    const cipher = Buffer.from(buffer, "base64");
+    return Buffer.from(crypto__default["default"].privateDecrypt(keyObj, cipher));
+  }
 }
 
 const { get: getProp, snakeCase } = lodash__default["default"];
@@ -705,23 +721,23 @@ const defaultLoaderOptions = {
   includeDirs: [defaultProtoPath],
 };
 
-const getProtoDescriptors = (grpc, protoPath, opts) => {
+function getProtoDescriptors(grpc, protoPath, opts) {
   const definition = protoLoader__default["default"].loadSync(
     protoPath,
     opts || defaultLoaderOptions,
   );
   const descriptors = grpc.loadPackageDefinition(definition);
   return descriptors;
-};
+}
 
-const getProtoService = (descriptors, servicePath) => {
+function getProtoService(descriptors, servicePath) {
   const serviceDef = getProp(descriptors, servicePath);
   if (serviceDef?.service) {
     return serviceDef.service;
   } else {
     return null;
   }
-};
+}
 
 function getServiceDescriptorsFromPath(
   grpc,
@@ -729,8 +745,30 @@ function getServiceDescriptorsFromPath(
   servicePackageName,
   opts,
 ) {
+  if (!opts) {
+    opts = { ...defaultLoaderOptions };
+    opts.includeDirs = [protoPath];
+  }
+
+  // Extract the package components of the service proto package. The package name should be of the
+  // fully qualified proto path, e.g. tdx.volt_api.webcam.v1.WebcamControlAPI.
+  const protoServiceComponents = servicePackageName.split(".");
+
+  // The service name is the last component of the path.
+  const protoServiceName = protoServiceComponents.pop();
+
+  // The actual file name should match the snake case of the service name.
+  const protoFileName = `${snakeCase(protoServiceName).toLowerCase()}.proto`;
+
+  // The path to the proto file should match each component of the package name.
+  const serviceProtoPath = path.join(
+    protoPath,
+    ...protoServiceComponents,
+    protoFileName,
+  );
+
   let serviceDescriptors;
-  const descriptors = getProtoDescriptors(grpc, protoPath, opts);
+  const descriptors = getProtoDescriptors(grpc, serviceProtoPath, opts);
   if (descriptors) {
     serviceDescriptors = getProtoService(descriptors, servicePackageName);
   }
@@ -778,8 +816,17 @@ function getProtoDescriptorMethods(protoDescriptor) {
   return methods;
 }
 
+function createServiceProtobufFiles(service, protoPath) {
+  for (let protoFile of service.service_description.proto_file) {
+    const filePath = path.join(protoPath, protoFile.file_path);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, protoFile.protobuf);
+  }
+}
+
 var protoUtils = /*#__PURE__*/Object.freeze({
   __proto__: null,
+  createServiceProtobufFiles: createServiceProtobufFiles,
   getServiceDescriptors: getServiceDescriptors,
   getProtoDescriptors: getProtoDescriptors,
   getProtoDescriptorMethods: getProtoDescriptorMethods,
@@ -788,70 +835,101 @@ var protoUtils = /*#__PURE__*/Object.freeze({
 
 /* eslint-disable no-underscore-dangle */
 
-const log$3 = debug__default["default"]("volt-client-grpc:grpc-call");
+const log$4 = debug__default["default"]("volt-client-grpc:grpc-call");
 
 function _prepareInvokeRequest(
   request,
   method,
   methodType = "METHOD_TYPE_UNARY",
 ) {
-  const meta = this._voltClient.credential.getIdentityMetadata(
+  const isServiceRelayed =
+    this._service?.service_description.host_type ===
+    "SERVICE_HOST_TYPE_RELAYED";
+
+  // Use the service's host client id and public key if the service is relayed.
+  const methodToken = this._voltClient.credential.getIdentityMetadata(
     this._voltClient.grpc,
-    this._voltClient.voltConfig.id,
-    this._voltClient.isRemote,
+    this._service?.service_description.host_client_id ||
+      this._voltClient.voltConfig.id,
+    this._service?.service_description.host_public_key ||
+      this._voltClient.credential.voltPublicKey,
+    true,
   );
+
   let invokeRequest;
   let callMethod = method;
 
-  if (this._voltClient.isVoltRelay) {
+  if (this._voltClient.isVoltRelay || isServiceRelayed) {
+    //
+    // If the volt connection is via a relay (or the target service is relayed),
+    // we wrap the rpc in a RemoteRequest message and send it via a call to Invoke().
+    //
     let requestPayload;
+
+    // Serialise the rpc request.
     if (request) {
       requestPayload = this._grpcClient[method].requestSerialize(request);
     } else if (request !== null) {
-      log$3("****************LOOKOUT****************** - empty request");
+      log$4("****************LOOKOUT****************** - empty request");
     } else {
-      log$3("explicit empty request payload");
+      log$4("explicit empty request payload");
     }
 
-    const tunnelMethod = this._grpcClient.Tunnel;
+    // Use this placeholder to serialise the relay request wrapper.
+    const voltGrpcClient = this._voltClient.getVoltAPIClient();
+    const tunnelMethod = voltGrpcClient.Tunnel;
 
     const tunnelResp = {
       method_invoke: {
         method_name: this._grpcClient[method].path,
         method_type: methodType,
-        token: meta.token,
+        token: methodToken.token,
         request: requestPayload,
       },
     };
 
-    const invokePayload = VoltCredential.aesEncrypt(
-      tunnelMethod.responseSerialize(tunnelResp),
-      meta.sharedKey.key,
-      meta.sharedKey.iv,
-    );
+    let targetFingerprint = [];
+    let invokePayload;
+    if (this._voltClient.isVoltRelay || isServiceRelayed) {
+      // When sending via a relay we need to encrypt the payload.
+      invokePayload = VoltCredential.aesEncrypt(
+        tunnelMethod.responseSerialize(tunnelResp),
+        methodToken.sharedKey.key,
+        methodToken.sharedKey.iv,
+      );
+    } else {
+      invokePayload = tunnelMethod.responseSerialize(tunnelResp);
+    }
+
+    if (this._voltClient.isVoltRelay) {
+      targetFingerprint.push(this._voltClient.credential.voltFingerprint);
+    }
+
+    if (isServiceRelayed) {
+      // Add another relay hop if the target service is relayed.
+      log$4("target service is relayed");
+      targetFingerprint.push(
+        this._service.service_description.host_fingerprint,
+      );
+    }
 
-    log$3("target volt is %s", this._voltClient.credential.voltFingerprint);
+    log$4("target is %j", targetFingerprint);
 
     invokeRequest = {
-      identity_fingerprint: this._voltClient.credential.voltFingerprint,
+      target_fingerprint: targetFingerprint,
+      token: methodToken.token,
       payload: invokePayload,
+      target_service_id: isServiceRelayed ? this._service.id : undefined,
     };
 
+    // Replace the target method with a call to Invoke on the relay Volt.
     callMethod = "Invoke";
-  } else if (this._voltClient.isRemote && meta.sharedKey.key) {
-    const requestPayload =
-      this._grpcClient[method].requestSerializeOriginal(request);
-    invokeRequest = VoltCredential.aesEncrypt(
-      requestPayload,
-      meta.sharedKey.key,
-      meta.sharedKey.iv,
-    );
   } else {
     invokeRequest = request;
   }
 
   return {
-    meta,
+    meta: methodToken,
     method: callMethod,
     methodName: method,
     request: invokeRequest,
@@ -861,10 +939,16 @@ function _prepareInvokeRequest(
 function _preparePayloadRequest(request, invokeInfo) {
   let payloadRequest;
 
-  if (this._voltClient.isVoltRelay) {
+  const isServiceRelayed =
+    this._service?.service_description.host_type ===
+    "SERVICE_HOST_TYPE_RELAYED";
+
+  if (this._voltClient.isVoltRelay || isServiceRelayed) {
     const requestPayload =
       this._grpcClient[invokeInfo.methodName].requestSerialize(request);
-    const tunnelMethod = this._grpcClient.Tunnel;
+
+    const voltGrpcClient = this._voltClient.getVoltAPIClient();
+    const tunnelMethod = voltGrpcClient.Tunnel;
 
     const tunnelResp = {
       method_payload: {
@@ -881,14 +965,6 @@ function _preparePayloadRequest(request, invokeInfo) {
     payloadRequest = {
       payload: invokePayload,
     };
-  } else if (this._voltClient.isRemote && invokeInfo.meta.sharedKey.key) {
-    const requestPayload =
-      this._grpcClient[invokeInfo.methodName].requestSerializeOriginal(request);
-    payloadRequest = VoltCredential.aesEncrypt(
-      requestPayload,
-      invokeInfo.meta.sharedKey.key,
-      invokeInfo.meta.sharedKey.iv,
-    );
   } else {
     payloadRequest = request;
   }
@@ -897,29 +973,47 @@ function _preparePayloadRequest(request, invokeInfo) {
 }
 
 function _parseResponse(method, meta, response) {
+  // log("parseResponse for %s", this._methodName);
   let invokeResponse = {};
 
-  if (this._voltClient.isVoltRelay) {
+  const isServiceRelayed =
+    this._service?.service_description.host_type ===
+    "SERVICE_HOST_TYPE_RELAYED";
+
+  if (this._voltClient.isVoltRelay || isServiceRelayed) {
     if (response.payload) {
-      const decryptedPayload = VoltCredential.aesDecrypt(
-        response.payload,
-        meta.sharedKey.key,
-        meta.sharedKey.iv,
-      );
-      const tunnelMethod = this._grpcClient.Tunnel;
+      let decryptedPayload;
+      if (meta.sharedKey.key) {
+        decryptedPayload = VoltCredential.aesDecrypt(
+          response.payload,
+          meta.sharedKey.key,
+          meta.sharedKey.iv,
+        );
+      } else {
+        decryptedPayload = response.payload;
+      }
+
+      const tunnelMethod = this._voltClient.getVoltAPIClient().Tunnel;
       const responsePayload = tunnelMethod.requestDeserialize(decryptedPayload);
       if (responsePayload.payload === "method_payload") {
-        invokeResponse.payload = this._grpcClient[method].responseDeserialize(
-          responsePayload.method_payload.payload,
-        );
+        try {
+          invokeResponse.payload = this._grpcClient[method].responseDeserialize(
+            responsePayload.method_payload.payload,
+          );
+        } catch (err) {
+          log$4("failure deserialising payload for %s", this._methodName);
+          throw new Error(
+            "failure deserialising payload - check protobuf definition matches with data being sent",
+          );
+        }
       } else if (responsePayload.payload === "method_end") {
         invokeResponse = responsePayload.method_end;
       } else {
-        log$3("unexpected tunnel payload type: %s", responsePayload.payload);
+        log$4("unexpected tunnel payload type: %s", responsePayload.payload);
       }
     } else if (response.status?.message) {
       // There's been an error in the tunnel.
-      log$3(
+      log$4(
         "Tunnel status received: %s, code %d, description: %s",
         response.status.message,
         response.status.code,
@@ -931,7 +1025,7 @@ function _parseResponse(method, meta, response) {
       };
     } else {
       invokeResponse.methodId = response.invoke_id;
-      log$3("started method %d for %s", invokeResponse.methodId, method);
+      log$4("started method %d for %s", invokeResponse.methodId, method);
     }
   } else if (this._voltClient.isRemote && meta.sharedKey.key) {
     const decryptedPayload = VoltCredential.aesDecrypt(
@@ -951,17 +1045,22 @@ function _parseResponse(method, meta, response) {
 }
 
 class GRPCCall extends EventEmitter__default["default"] {
-  constructor(voltClient, methodName, methodType) {
+  constructor(voltClient, methodName, methodType, service = undefined) {
     super();
     this._methodName = methodName;
     this._methodType = methodType;
     this._call = null;
     this._voltClient = voltClient;
+    this._service = service;
   }
 
   start(grpcClient, request) {
     this._grpcClient = grpcClient;
 
+    if (typeof this._grpcClient[this._methodName] !== "function") {
+      throw new Error(`method not found: '${this._methodName}'`);
+    }
+
     this._initialRequest = _prepareInvokeRequest.call(
       this,
       request,
@@ -969,13 +1068,18 @@ class GRPCCall extends EventEmitter__default["default"] {
       this._methodType,
     );
 
-    if (!this._grpcClient[this._initialRequest.method]) {
-      return reject(
-        new Error(`method not found: '${this._initialRequest.method}'`),
-      );
+    const isServiceRelayed =
+      this._service?.service_description.host_type ===
+      "SERVICE_HOST_TYPE_RELAYED";
+
+    let callClient;
+    if (this._voltClient.isVoltRelay || isServiceRelayed) {
+      callClient = this._voltClient.getVoltAPIClient();
+    } else {
+      callClient = this._grpcClient;
     }
 
-    this._call = this._grpcClient[this._initialRequest.method](
+    this._call = callClient[this._initialRequest.method](
       this._initialRequest.meta.metadata,
     );
 
@@ -1005,28 +1109,32 @@ class GRPCCall extends EventEmitter__default["default"] {
             this.emit("end");
           }
         } else {
-          log$3("method id is %s", parsedResponse.methodId);
+          log$4("method id is %s", parsedResponse.methodId);
         }
       } catch (err) {
-        log$3("failure processing connect response: %s", err.message);
+        log$4(
+          "failure processing %s call response: %s",
+          this._methodName,
+          err.message,
+        );
         this.emit("error", err);
       }
     });
 
     this._call.on("error", (err) => {
-      log$3("ERROR - intercepted stream error %s", err.message);
+      log$4("ERROR - intercepted stream error %s", err.message);
       this.emit("error", err);
     });
 
     this._call.on("finish", () => {
       // The read side has ended (i.e. we called end()).
-      log$3("finished call %s", this._methodName);
+      log$4("finished call %s", this._methodName);
       this.emit("finish");
     });
 
     this._call.on("end", () => {
       // The remote peer ended the stream.
-      log$3(
+      log$4(
         "ended call %s, method id: %s",
         this._methodName,
         this._initialRequest.methodId || "n/a - not tunnelling",
@@ -1056,7 +1164,7 @@ class GRPCCall extends EventEmitter__default["default"] {
 
   write(request) {
     if (!this._call) {
-      log$3("ERROR - call not initialised");
+      log$4("ERROR - call not initialised");
       throw new Error("call not initialised");
     } else if (this._initialRequest) {
       const payloadRequest = _preparePayloadRequest.call(
@@ -1080,7 +1188,7 @@ class GRPCCall extends EventEmitter__default["default"] {
 
 /* eslint-disable no-use-before-define */
 
-const log$2 = debug__default["default"]("volt-client-grpc:volt-connection");
+const log$3 = debug__default["default"]("volt-client-grpc:volt-connection");
 
 function _cleanUp(immediateReconnect) {
   this._connectionId = "";
@@ -1114,7 +1222,7 @@ function _cleanUp(immediateReconnect) {
 }
 
 function _connectionTimeoutHandler() {
-  log$2("server timed out");
+  log$3("server timed out");
   this.emit("connected", false);
   _cleanUp.call(this);
 }
@@ -1126,14 +1234,14 @@ function _doConnect(connectHello) {
 
   let helloPayload = connectHello;
   if (!connectHello) {
-    log$2("defaulting hello payload");
+    log$3("defaulting hello payload");
     helloPayload = {
       hello: {},
     };
   }
 
   this.call.on("error", (err) => {
-    log$2("error on connection stream [%s]", err.message);
+    log$3("error on connection stream [%s]", err.message);
     _cleanUp.call(this);
     this.emit("error", err);
   });
@@ -1141,7 +1249,7 @@ function _doConnect(connectHello) {
   this.call.on("data", (response) => {
     switch (response.payload) {
       case "ping": {
-        log$2("pinged");
+        log$3("pinged");
 
         // Received ping response from server => clear timeout.
         if (this._pingTimeoutTimer) {
@@ -1155,18 +1263,23 @@ function _doConnect(connectHello) {
       case "acknowledge": {
         if (!this._connectionId) {
           this._connectionId = response.acknowledge.connection_id;
-          log$2("connection id is %s", this._connectionId);
+          log$3("connection id is %s", this._connectionId);
           this.emit("connected", this._connectionId);
         }
         break;
       }
+      case "invoke_request": {
+        log$3("received invoke request");
+        this.emit("invoke_request", response.invoke_request);
+        break;
+      }
       case "evt": {
-        log$2("received event %s", response.evt.event_type);
+        log$3("received event %s", response.evt.event_type);
         this.emit("evt", response.evt);
         break;
       }
       default:
-        log$2("unimplemented connect response payload: %s", response.payload);
+        log$3("unimplemented connect response payload: %s", response.payload);
         break;
     }
   });
@@ -1185,7 +1298,7 @@ function _doConnect(connectHello) {
 
 function _startPingTimer() {
   if (this._pingTimer) {
-    log$2("ping timer running");
+    log$3("ping timer running");
     return;
   }
 
@@ -1193,7 +1306,7 @@ function _startPingTimer() {
     // Send next ping to server.
     const request = { ping: { timestamp: Date.now() } };
 
-    log$2("pinging Volt");
+    log$3("pinging Volt");
     this.call.write(request);
 
     this._pingTimer = 0;
@@ -1242,6 +1355,277 @@ class VoltConnection extends EventEmitter__default["default"] {
     this._dying = true;
     _cleanUp.call(this);
   }
+
+  send(request) {
+    this.call.write(request);
+  }
+}
+
+const log$2 = debug__default["default"]("rpc-invocation");
+
+class RpcInvocation extends EventEmitter__default["default"] {
+  #voltClient = null;
+  #voltConnection = null;
+  #token = null;
+  #encryptKey = null;
+  #encryptIV = null;
+  #invokeId = null;
+  #payload = null;
+  #isJSON = false;
+  #methodDescriptor = null;
+  #methodName = null;
+
+  constructor(voltClient, voltConnection) {
+    super();
+    this.#voltClient = voltClient;
+    this.#voltConnection = voltConnection;
+  }
+
+  get id() {
+    return this.#invokeId;
+  }
+
+  get payload() {
+    if (!this.#payload) {
+      return null;
+    }
+
+    let deserialisedPayload = null;
+
+    if (this.#isJSON) {
+      // Don't need to deserialise JSON payload.
+      deserialisedPayload = this.#payload;
+    } else if (this.#methodDescriptor) {
+      deserialisedPayload = this.#methodDescriptor.requestDeserialize(
+        this.#payload,
+      );
+    } else {
+      log$2("unexpected: no method descriptor");
+      throw new Error(
+        "no method descriptor - set this before accessing payload",
+      );
+    }
+
+    return deserialisedPayload;
+  }
+
+  get methodName() {
+    return this.#methodName;
+  }
+
+  set methodDescriptor(methodDescriptor) {
+    this.#methodDescriptor = methodDescriptor;
+  }
+
+  #decodeToken(token) {
+    // We don't verify the token at this point, as we don't know the public key.
+    // The rpc implementation should do the verification using the Volt API (e.g. CanAccessResource).
+    this.#token = jwt__default["default"].decode(token);
+
+    if (this.#token.sk) {
+      // Decrypt the shared key and iv using the private key.
+      this.#encryptKey = VoltCredential.rsaDecrypt(
+        this.#voltClient.credential.cache.key,
+        this.#token.sk,
+      );
+      this.#encryptIV = VoltCredential.rsaDecrypt(
+        this.#voltClient.credential.cache.key,
+        this.#token.iv,
+      );
+    }
+
+    return Promise.resolve(this.#token);
+  }
+
+  initialise(invoke_request) {
+    this.#invokeId = invoke_request.invoke_id;
+
+    return this.#decodeToken(invoke_request.token)
+      .then(() => {
+        // Parse the initial payload.
+        return this.parsePayload(invoke_request);
+      })
+      .catch((err) => {
+        log$2("failure initialising invocation: %s", err.message);
+        return Promise.reject(err);
+      });
+  }
+
+  parsePayload(invoke_request) {
+    return new Promise((resolve, reject) => {
+      if (invoke_request.payload) {
+        let decryptedPayload;
+
+        if (this.#encryptKey) {
+          // Decrypt the actual payload using the shared key and iv.
+          decryptedPayload = VoltCredential.aesDecrypt(
+            invoke_request.payload,
+            this.#encryptKey,
+            this.#encryptIV,
+          );
+        } else {
+          // No encryption => just use the payload.
+          decryptedPayload = invoke_request.payload;
+        }
+
+        const tunnelMethod = this.#voltClient.getVoltAPIClient().Tunnel;
+        const wrappedPayload =
+          tunnelMethod.responseDeserialize(decryptedPayload);
+
+        if (wrappedPayload.method_invoke) {
+          // This is the initial request payload.
+          this.#methodName = wrappedPayload.method_invoke.method_name;
+          this.#payload = wrappedPayload.method_invoke.request;
+          this.emit("payload", this);
+        } else if (wrappedPayload.method_payload) {
+          // This is a subsequent payload, e.g. for streaming rpcs.
+          this.#payload = wrappedPayload.method_payload.payload;
+          this.emit("payload", this);
+        } else if (wrappedPayload.method_end) {
+          // This indicates the client has finished sending payloads.
+          // We don't need to do anything here, since we notify the client when we receive the client_end.
+          log$2("method_end received");
+        }
+
+        resolve();
+      } else if (invoke_request.json_payload) {
+        let decryptedPayload;
+
+        this.#isJSON = true;
+
+        if (this.#encryptKey) {
+          // Decrypt the actual payload using the shared key and iv.
+          decryptedPayload = VoltCredential.aesDecrypt(
+            Buffer.from(invoke_request.json_payload, "base64"),
+            this.#encryptKey,
+            this.#encryptIV,
+          );
+        } else {
+          // No encryption => just use the payload.
+          decryptedPayload = invoke_request.json_payload;
+        }
+
+        try {
+          const wrappedPayload = JSON.parse(decryptedPayload.toString());
+
+          if (wrappedPayload.method_invoke) {
+            this.#methodName = wrappedPayload.method_invoke.method_name;
+            this.#payload = JSON.parse(
+              wrappedPayload.method_invoke.json_request,
+            );
+            this.emit("payload", this);
+          } else if (wrappedPayload.method_payload) {
+            this.#payload = JSON.parse(
+              wrappedPayload.method_payload.json_payload,
+            );
+            this.emit("payload", this);
+          } else if (wrappedPayload.method_end) {
+            // We don't need to do anything here, since we notify the client when we receive the client_end.
+            log$2("method_end received");
+          }
+        } catch (err) {
+          log$2("JSON.parse failure parsing json_payload: %s", err.message);
+          reject(err);
+        }
+
+        resolve();
+      } else if (invoke_request.client_end) {
+        this.emit("end", this);
+      } else {
+        // Do we need to support json_payload here?
+        reject(new Error("No payload in invoke request"));
+      }
+    }).catch((err) => {
+      log$2("failure parsing payload: %s", err.message);
+      return Promise.reject(err);
+    });
+  }
+
+  sendResponse(response) {
+    let responsePayload;
+    if (this.#isJSON) {
+      responsePayload = JSON.stringify({
+        method_payload: { json_payload: JSON.stringify(response) },
+      });
+    } else {
+      // We need to serialise the response, and then wrap it in a RemoteRequest.
+      const serialisedResponse =
+        this.#methodDescriptor.responseSerialize(response);
+      const tunnelMethod = this.#voltClient.getVoltAPIClient().Tunnel;
+      responsePayload = tunnelMethod.requestSerialize({
+        method_payload: { payload: serialisedResponse },
+      });
+    }
+
+    if (this.#token.sk) {
+      // Encrypt the response using the shared key and iv.
+      responsePayload = VoltCredential.aesEncrypt(
+        responsePayload,
+        this.#encryptKey,
+        this.#encryptIV,
+      );
+    }
+
+    const invokeResponse = {
+      invoke_id: this.#invokeId,
+    };
+
+    if (this.#isJSON) {
+      invokeResponse.json_payload =
+        Buffer.from(responsePayload).toString("base64");
+    } else {
+      invokeResponse.payload = responsePayload;
+    }
+
+    this.#voltConnection.send({
+      invoke_response: invokeResponse,
+    });
+  }
+
+  sendEnd(errorMessage) {
+    const tunnelMethod = this.#voltClient.getVoltAPIClient().Tunnel;
+
+    let endPayload;
+    if (errorMessage) {
+      endPayload = {
+        method_end: { error: errorMessage, ended: true },
+      };
+    } else {
+      endPayload = {
+        method_end: { ended: true },
+      };
+    }
+
+    if (this.#isJSON) {
+      endPayload = JSON.stringify(endPayload);
+    } else {
+      endPayload = tunnelMethod.requestSerialize(endPayload);
+    }
+
+    if (this.#token.sk) {
+      // Encrypt the response using the shared key and iv.
+      endPayload = VoltCredential.aesEncrypt(
+        endPayload,
+        this.#encryptKey,
+        this.#encryptIV,
+      );
+    }
+
+    const invokeResponse = {
+      invoke_id: this.#invokeId,
+      server_end: true,
+    };
+
+    if (this.#isJSON) {
+      invokeResponse.json_payload = Buffer.from(endPayload).toString("base64");
+    } else {
+      invokeResponse.payload = endPayload;
+    }
+
+    this.#voltConnection.send({
+      invoke_response: invokeResponse,
+    });
+  }
 }
 
 /* eslint-disable no-underscore-dangle */
@@ -1262,46 +1646,48 @@ const voltServices = [
 
 function issueBind(bindRequest, ttl) {
   // eslint-disable-next-line no-use-before-define
-  return unaryCall.call(this, "Bind", bindRequest).then((bindResponse) => {
-    log$1("got binding request response %j", bindResponse);
-    if (bindResponse.status?.code) {
-      log$1("error in bind response: %s", bindResponse.status.message);
-      return Promise.reject(new Error(bindResponse.status.message));
-    } else {
-      switch (bindResponse.decision) {
-        case "POLICY_DECISION_PERMIT": {
-          //
-          // The request status is permit => cache the bind response info.
-          //
-
-          // This is the certificate assigned to us by the volt.
-          this._credential.cache.cert = bindResponse.cert;
-
-          // This is the signing CA used by the volt.
-          this._credential.cache.ca = bindResponse.chain;
-
-          // Identity resource id is assigned by the volt.
-          this._credential.cache.client_id = bindResponse.identity_id;
-          this._credential.saveCache();
-          break;
-        }
-        case "POLICY_DECISION_DENY": {
-          log$1(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
-          break;
-        }
-        case "POLICY_DECISION_PROMPT":
-        case "POLICY_DECISION_PENDING": {
-          log$1("access pending approval - waiting...");
-          break;
+  return unaryCallInternal
+    .call(this, "Bind", bindRequest)
+    .then((bindResponse) => {
+      log$1("got binding request response %j", bindResponse);
+      if (bindResponse.status?.code) {
+        log$1("error in bind response: %s", bindResponse.status.message);
+        return Promise.reject(new Error(bindResponse.status.message));
+      } else {
+        switch (bindResponse.decision) {
+          case "POLICY_DECISION_PERMIT": {
+            //
+            // The request status is permit => cache the bind response info.
+            //
+
+            // This is the certificate assigned to us by the volt.
+            this._credential.cache.cert = bindResponse.cert;
+
+            // This is the signing CA used by the volt.
+            this._credential.cache.ca = bindResponse.chain;
+
+            // Identity resource id is assigned by the volt.
+            this._credential.cache.client_id = bindResponse.identity_id;
+            this._credential.saveCache();
+            break;
+          }
+          case "POLICY_DECISION_DENY": {
+            log$1(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
+            break;
+          }
+          case "POLICY_DECISION_PROMPT":
+          case "POLICY_DECISION_PENDING": {
+            log$1("access pending approval - waiting...");
+            break;
+          }
+          default:
+            log$1("ignoring unknown bind descision %s", bindResponse.status);
+            break;
         }
-        default:
-          log$1("ignoring unknown bind descision %s", bindResponse.status);
-          break;
       }
-    }
 
-    return bindResponse.decision;
-  });
+      return bindResponse.decision;
+    });
 }
 
 function findDIDDocumentService(document, serviceType) {
@@ -1468,6 +1854,30 @@ function connectInternal(helloPayload) {
       this.emit("evt", evt);
     });
 
+    this._voltConnection.on("invoke_request", (invoke_request) => {
+      const invokeId = invoke_request.invoke_id;
+      if (this._activeRPC[invokeId]) {
+        this._activeRPC[invokeId].parsePayload(invoke_request);
+      } else {
+        const rpcInvocation = new RpcInvocation(this, this._voltConnection);
+
+        rpcInvocation.on("end", () => {
+          log$1("removing active RPC [%s]", invokeId);
+          this._activeRPC[invokeId] = undefined;
+        });
+
+        rpcInvocation
+          .initialise(invoke_request)
+          .then(() => {
+            this._activeRPC[invokeId] = rpcInvocation;
+            this.emit("invoke_request", rpcInvocation);
+          })
+          .catch((err) => {
+            log$1("invoke_request - error [%s]", err.message);
+          });
+      }
+    });
+
     return this._voltConnection.connect(helloPayload);
   } catch (err) {
     log$1("connect - error [%s]", err.message);
@@ -1501,11 +1911,61 @@ function getVoltAPIClientInternal() {
   return this._cachedClient;
 }
 
-function unaryCall(method, request) {
-  return new Promise((resolve, reject) => {
-    const grpcClient = this.getVoltAPIClient();
+function getAPIClientInternal(service) {
+  if (!this._cachedService[service.id]) {
+    service.service_description.host_type === "SERVICE_HOST_TYPE_RELAYED";
+
+    const serviceAddress = this.isRemote
+      ? this._voltConfig.relay.address
+      : service.service_description.host_address;
+
+    createServiceProtobufFiles(service, "./service-proto");
+
+    log$1("creating API service client on %s", serviceAddress);
+    let serviceDescriptors = {};
+    const fullProtoPath = path.join(process.cwd(), "./service-proto");
+    for (let api of service.service_description.service_api) {
+      const packageDescriptors = getServiceDescriptorsFromPath(
+        this._grpc,
+        fullProtoPath,
+        api,
+      );
+      serviceDescriptors = { ...serviceDescriptors, ...packageDescriptors };
+    }
+
+    this._cachedService[service.id] = createClient(
+      this._grpc,
+      serviceDescriptors,
+      serviceAddress,
+      this._credential,
+      this.isRemote && !this.isVoltRelay,
+      this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
+      this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
+    );
+  }
+
+  return this._cachedService[service.id];
+}
+
+function getServiceClient(service) {
+  let grpcClient;
+  if (
+    service &&
+    service?.service_description.host_type !== "SERVICE_HOST_TYPE_BUILTIN"
+  ) {
+    grpcClient = getAPIClientInternal.call(this, service);
+  } else {
+    grpcClient = getVoltAPIClientInternal.call(this);
+  }
 
-    const call = new GRPCCall(this, method, "METHOD_TYPE_UNARY");
+  return grpcClient;
+}
+
+function unaryCallInternal(method, request, service) {
+  const grpcClient = getServiceClient.call(this, service);
+
+  return new Promise((resolve, reject) => {
+    const call = new GRPCCall(this, method, "METHOD_TYPE_UNARY", service);
 
     let response = null;
 
@@ -1533,6 +1993,16 @@ function unaryCall(method, request) {
   });
 }
 
+function streamingCallInternal(methodType, method, request, service) {
+  const grpcClient = getServiceClient.call(this, service);
+
+  const call = new GRPCCall(this, method, methodType, service);
+
+  call.start(grpcClient, request);
+
+  return call;
+}
+
 async function fetchVoltConfig(discovery_url) {
   try {
     const getJSON = bent__default["default"]("json");
@@ -1613,6 +2083,8 @@ class VoltClient extends EventEmitter__default["default"] {
     this._config = null;
     this._voltConfig = null;
     this._voltConnection = null;
+    this._cachedService = {};
+    this._activeRPC = {};
   }
 
   get config() {
@@ -1858,6 +2330,40 @@ class VoltClient extends EventEmitter__default["default"] {
     return getVoltAPIClientInternal.call(this);
   }
 
+  unaryCall(method, request, service) {
+    return unaryCallInternal.call(this, method, request, service);
+  }
+
+  bidiStreamingCall(method, request, service) {
+    return streamingCallInternal.call(
+      this,
+      "METHOD_TYPE_BIDI",
+      method,
+      request,
+      service,
+    );
+  }
+
+  clientStreamingCall(method, request, service) {
+    return streamingCallInternal.call(
+      this,
+      "METHOD_TYPE_CLIENT_STREAM",
+      method,
+      request,
+      service,
+    );
+  }
+
+  serverStreamingCall(method, request, service) {
+    return streamingCallInternal.call(
+      this,
+      "METHOD_TYPE_SERVER_STREAM",
+      method,
+      request,
+      service,
+    );
+  }
+
   /**
    * Request resource access.
    * @param {*} targetResourceId
@@ -1902,47 +2408,47 @@ class VoltClient extends EventEmitter__default["default"] {
    */
 
   CanAccessResource(request) {
-    return unaryCall.call(this, "CanAccessResource", request);
+    return unaryCallInternal.call(this, "CanAccessResource", request);
   }
 
   DeleteResource(request) {
-    return unaryCall.call(this, "DeleteResource", request);
+    return unaryCallInternal.call(this, "DeleteResource", request);
   }
 
   DiscoverServices(request) {
-    return unaryCall.call(this, "DiscoverServices", request);
+    return unaryCallInternal.call(this, "DiscoverServices", request);
   }
 
   GetResource(request) {
-    return unaryCall.call(this, "GetResource", request);
+    return unaryCallInternal.call(this, "GetResource", request);
   }
 
   GetResources(request) {
-    return unaryCall.call(this, "GetResources", request);
+    return unaryCallInternal.call(this, "GetResources", request);
   }
 
   GetResourceAncestors(request) {
-    return unaryCall.call(this, "GetResourceAncestors", request);
+    return unaryCallInternal.call(this, "GetResourceAncestors", request);
   }
 
   GetResourceDescendants(request) {
-    return unaryCall.call(this, "GetResourceDescendants", request);
+    return unaryCallInternal.call(this, "GetResourceDescendants", request);
   }
 
   RequestAccess(request) {
-    return unaryCall.call(this, "RequestAccess", request);
+    return unaryCallInternal.call(this, "RequestAccess", request);
   }
 
   SaveResource(request) {
-    return unaryCall.call(this, "SaveResource", request);
+    return unaryCallInternal.call(this, "SaveResource", request);
   }
 
   SaveResourceAttribute(request) {
-    return unaryCall.call(this, "SaveResourceAttribute", request);
+    return unaryCallInternal.call(this, "SaveResourceAttribute", request);
   }
 
   SetServiceStatus(request) {
-    return unaryCall.call(this, "SetServiceStatus", request);
+    return unaryCallInternal.call(this, "SetServiceStatus", request);
   }
 
   /**
@@ -1950,82 +2456,82 @@ class VoltClient extends EventEmitter__default["default"] {
    */
 
   Bind(request) {
-    return unaryCall.call(this, "Bind", request);
+    return unaryCallInternal.call(this, "Bind", request);
   }
 
   DeleteAccess(request) {
-    return unaryCall.call(this, "DeleteAccess", request);
+    return unaryCallInternal.call(this, "DeleteAccess", request);
   }
 
   DeleteVolt(request) {
-    return unaryCall.call(this, "DeleteVolt", request);
+    return unaryCallInternal.call(this, "DeleteVolt", request);
   }
 
   GetAccess(request) {
-    return unaryCall.call(this, "GetAccess", request);
+    return unaryCallInternal.call(this, "GetAccess", request);
   }
 
   GetBindings(request) {
-    return unaryCall.call(this, "GetBindings", request);
+    return unaryCallInternal.call(this, "GetBindings", request);
   }
 
   GetIdentities(request) {
-    return unaryCall.call(this, "GetIdentities", request);
+    return unaryCallInternal.call(this, "GetIdentities", request);
   }
 
   GetIdentity(request) {
-    return unaryCall.call(this, "GetIdentity", request);
+    return unaryCallInternal.call(this, "GetIdentity", request);
   }
 
   GetIdentityToken(request) {
-    return unaryCall.call(this, "GetIdentityToken", request);
+    return unaryCallInternal.call(this, "GetIdentityToken", request);
   }
 
   GetPolicy(request) {
-    return unaryCall.call(this, "GetPolicy", request);
+    return unaryCallInternal.call(this, "GetPolicy", request);
   }
 
   GetSettings(request) {
-    return unaryCall.call(this, "GetSettings", request);
+    return unaryCallInternal.call(this, "GetSettings", request);
   }
 
   SaveAccess(request) {
-    return unaryCall.call(this, "SaveAccess", request);
+    return unaryCallInternal.call(this, "SaveAccess", request);
   }
 
   SaveCloudConnection(request) {
-    return unaryCall.call(this, "SaveCloudConnection", request);
+    return unaryCallInternal.call(this, "SaveCloudConnection", request);
   }
 
   SaveIdentity(request) {
-    return unaryCall.call(this, "SaveIdentity", request);
+    return unaryCallInternal.call(this, "SaveIdentity", request);
   }
 
   SaveSettings(request) {
-    return unaryCall.call(this, "SaveSettings", request);
+    return unaryCallInternal.call(this, "SaveSettings", request);
   }
 
   SetAccessRequestDecision(request) {
-    return unaryCall.call(this, "SetAccessRequestDecision", request);
+    return unaryCallInternal.call(this, "SetAccessRequestDecision", request);
   }
 
   SetBindingDecision(request) {
-    return unaryCall.call(this, "SetBindingDecision", request);
+    return unaryCallInternal.call(this, "SetBindingDecision", request);
   }
 
   Shutdown(request) {
-    return unaryCall.call(this, "Shutdown", request);
+    return unaryCallInternal.call(this, "Shutdown", request);
   }
 
   SignVerify(request) {
-    return unaryCall.call(this, "SignVerify", request);
+    return unaryCallInternal.call(this, "SignVerify", request);
   }
 
   /**
    * FileAPI
    */
   GetFileDescendants(request) {
-    return unaryCall.call(this, "GetFileDescendants", request);
+    return unaryCallInternal.call(this, "GetFileDescendants", request);
   }
 
   /**
@@ -2103,6 +2609,10 @@ class VoltClient extends EventEmitter__default["default"] {
   /**
    * SqliteDatabaseAPI
    */
+  BulkUpdate(request) {
+    return unaryCallInternal.call(this, "BulkUpdate", request);
+  }
+
   SqlExecute(request) {
     const grpcClient = this.getVoltAPIClient();