@tdxvolt/volt-client-grpc 0.14.61 → 0.15.0

package/lib/index.cjs

@@ -114,7 +114,7 @@ const createSecureContextOptions = (cryptoOptions) => {
   const tlsOptions = {
     cert: Buffer.from(cryptoOptions.cert),
     ca: Buffer.from(cryptoOptions.ca),
-    key: Buffer.from(cryptoOptions.key),
+    key: Buffer.from(cryptoOptions.key)
   };
   return tlsOptions;
 };
@@ -130,7 +130,7 @@ const getServiceAddress = (mdnsService) => {
     const ipv4 = lodash__default["default"].find(mdnsService.addresses, (addy) => ip__default["default"].isV4Format(addy));
     const serviceDetails = {
       host: ipv4,
-      port: mdnsService.port,
+      port: mdnsService.port
     };
 
     address = `${serviceDetails.host}:${serviceDetails.port}`;
@@ -207,6 +207,47 @@ const getDIDResolutionURL = (didIn) => {
   return `https://${hostName}/api/identity/${didGUID}`;
 };
 
+const forgePrivateKeyToPem = (decryptedKey) => {
+  // Convert a Forge private key to an ASN.1 RSAPrivateKey
+  const asnPrivateKey = pki$2.privateKeyToAsn1(decryptedKey);
+
+  // Wrap an RSAPrivateKey ASN.1 object in a PKCS#8 ASN.1 PrivateKeyInfo
+  const privateKeyInfo = pki$2.wrapRsaPrivateKey(asnPrivateKey);
+
+  // Convert a PKCS#8 ASN.1 PrivateKeyInfo to PEM
+  return pki$2.privateKeyInfoToPem(privateKeyInfo);
+};
+
+const createRSAKey = (passphrase = "") => {
+  return new Promise((resolve, reject) => {
+    pki$2.rsa.generateKeyPair({ bits: 2048, workers: -1 }, (err, keypair) => {
+      if (err) {
+        reject(err);
+      } else {
+        let pem;
+        if (passphrase) {
+          pem = pki$2.encryptRsaPrivateKey(keypair.privateKey, passphrase);
+        } else {
+          pem = forgePrivateKeyToPem(keypair.privateKey);
+        }
+
+        resolve({ keypair, pem });
+      }
+    });
+  });
+};
+
+const sha256Base64 = (msg) => {
+  const md = forge__default["default"].md.sha256.create();
+  md.update(msg);
+  return forge__default["default"].util.encode64(md.digest().bytes());
+};
+
+const decryptPrivateKey = (pem, passphrase) => {
+  const decryptedKey = pki$2.decryptRsaPrivateKey(pem, passphrase);
+  return forgePrivateKeyToPem(decryptedKey);
+};
+
 var utils = /*#__PURE__*/Object.freeze({
   __proto__: null,
   createSecureContextOptions: createSecureContextOptions,
@@ -219,7 +260,10 @@ var utils = /*#__PURE__*/Object.freeze({
   createPublicKeyFingerprint: createPublicKeyFingerprint,
   signBase64: signBase64,
   verifyBase64: verifyBase64,
-  getDIDResolutionURL: getDIDResolutionURL
+  getDIDResolutionURL: getDIDResolutionURL,
+  createRSAKey: createRSAKey,
+  sha256Base64: sha256Base64,
+  decryptPrivateKey: decryptPrivateKey
 });
 
 /* eslint-disable no-underscore-dangle */
@@ -237,7 +281,7 @@ function createClient(
   credentials,
   noSerialise,
   voltId,
-  serviceId,
+  serviceId
 ) {
   let grpcCredentials;
   if (credentials) {
@@ -251,7 +295,7 @@ function createClient(
       grpcCredentials = grpc.credentials.createSsl(
         tlsOptions.ca,
         tlsOptions.key,
-        tlsOptions.cert,
+        tlsOptions.cert
       );
     } else {
       // Cache has no private key, this implies we are connecting without supplying a client certificate.
@@ -313,7 +357,7 @@ const grpcWrap = (api) => {
   // Support class instances and PoJos
   const isClass = api.constructor !== Object;
   const iterate = Object.getOwnPropertyNames(
-    isClass ? api.constructor.prototype : api,
+    isClass ? api.constructor.prototype : api
   );
 
   // Wrap each method on the api.
@@ -327,7 +371,7 @@ const grpcWrap = (api) => {
         // Enforce promise results.
         if (!(resultPromise?.then && resultPromise?.catch)) {
           throw new Error(
-            `implementation methods must return a Promise [${name}]`,
+            `implementation methods must return a Promise [${name}]`
           );
         }
 
@@ -364,7 +408,7 @@ class GrpcServer {
       "grpc.http2.max_pings_without_data": 0,
       "grpc.keepalive_permit_without_calls": 1,
       "grpc.http2.min_ping_interval_without_data_ms": 250,
-      "grpc.http2.max_ping_strikes": 0,
+      "grpc.http2.max_ping_strikes": 0
     });
 
     if (tlsOptions) {
@@ -374,7 +418,7 @@ class GrpcServer {
         caList.push(tlsOption.ca);
         certChains.push({
           private_key: tlsOption.key,
-          cert_chain: tlsOption.cert,
+          cert_chain: tlsOption.cert
         });
       });
 
@@ -385,7 +429,7 @@ class GrpcServer {
         // The certificate chain(s) we present to the client.
         certChains,
         // Flag indicating if we insist on a client certificate.
-        requireClientCert,
+        requireClientCert
       );
     } else {
       this._credentials = grpc.ServerCredentials.createInsecure();
@@ -437,7 +481,7 @@ function createServer(
   serviceDescriptors,
   routes,
   cryptoCache,
-  requireClientCert,
+  requireClientCert
 ) {
   let tlsOptions;
   if (cryptoCache) {
@@ -448,7 +492,7 @@ function createServer(
     serviceDescriptors,
     routes,
     tlsOptions,
-    requireClientCert,
+    requireClientCert
   };
   return new GrpcServer(serverArgs);
 }
@@ -462,7 +506,7 @@ var grpcUtils = /*#__PURE__*/Object.freeze({
 /* eslint-disable no-underscore-dangle */
 
 const { pki: pki$1 } = forge__default["default"];
-const log$4 = debug__default["default"]("volt-client-grpc:volt-credential");
+const log$5 = debug__default["default"]("volt-client-grpc:volt-credential");
 const aesAlgorithm = "aes-256-cbc";
 const rs256Algorithm = "RS256";
 
@@ -490,7 +534,7 @@ class VoltCredential {
       // Need to unencrypt the private key.
       const decrypted = pki$1.decryptRsaPrivateKey(
         this._cryptoCache.key,
-        config.p,
+        config.p
       );
       if (!decrypted) {
         throw new Error("failed to decrypt key - check passphrase");
@@ -510,7 +554,7 @@ class VoltCredential {
       // Extract Volt public key (used for encrypting Relay payloads).
       this._voltPublicKey = forge__default["default"].pki.publicKeyToPem(voltCert.publicKey);
       this._voltFingerprint = createPublicKeyFingerprint(
-        this._voltPublicKey,
+        this._voltPublicKey
       );
     }
   }
@@ -527,6 +571,10 @@ class VoltCredential {
     return this._cryptoCache.client_id;
   }
 
+  get voltPublicKey() {
+    return this._voltPublicKey;
+  }
+
   get publicKey() {
     return pki$1.publicKeyToPem(this.getKey().publicKey);
   }
@@ -547,23 +595,20 @@ class VoltCredential {
   createKey() {
     if (this._cryptoCache.key) {
       // Already have key data in the cache in pem format => create fully-formed pki instances.
-      log$4("createKey - key already exists");
+      log$5("createKey - key already exists");
       return Promise.resolve(this.getKey());
     } else {
-      log$4("creating key");
-      return new Promise((resolve, reject) => {
-        pki$1.rsa.generateKeyPair({ bits: 2048, workers: -1 }, (err, keypair) => {
-          if (err) {
-            log$4("failure creating key [%s]", err.message);
-            reject(err);
-          } else {
-            log$4("successfully created key");
-            const pem = pki$1.privateKeyToPem(keypair.privateKey);
-            this._cryptoCache.key = pem;
-            resolve(keypair);
-          }
+      log$5("creating key");
+      return createRSAKey()
+        .then((keyInfo) => {
+          log$5("successfully created key");
+          this._cryptoCache.key = keyInfo.pem;
+          return keyInfo.keypair;
+        })
+        .catch((err) => {
+          log$5("failure creating key [%s]", err.message);
+          return Promise.reject(err);
         });
-      });
     }
   }
 
@@ -579,7 +624,7 @@ class VoltCredential {
         return this._cryptoCache;
       })
       .catch((err) => {
-        log$4("failure initialising crypto [%s]", err.message);
+        log$5("failure initialising crypto [%s]", err.message);
         return Promise.reject(err);
       });
   }
@@ -594,7 +639,7 @@ class VoltCredential {
    * @param {*} tunnelling flag indicating if the token is required for a tunnelled connection
    * @param {*} ttl time to live in seconds (default to 1 minute)
    */
-  getIdentityToken(audience, tunnelling = false, ttl = 60) {
+  getIdentityToken(audience, publicKey, tunnelling = false, ttl = 60) {
     if (!this._cryptoCache.key) {
       throw new Error("crypto cache invalid");
     }
@@ -603,7 +648,7 @@ class VoltCredential {
     const publicKeyPem = pki$1.publicKeyToPem(keyPair.publicKey);
     const base58Key = createPublicKeyFingerprint(publicKeyPem);
 
-    log$4("base58 key is %s", base58Key);
+    log$5("base58 key is %s", base58Key);
 
     // Allow TTL either side of the current time.
     // @todo - fix with server time sync on volt connection.
@@ -611,7 +656,7 @@ class VoltCredential {
       aud: audience,
       iat: Math.floor(Date.now() / 1000) - ttl,
       exp: Math.floor(Date.now() / 1000) + ttl,
-      sub: this._cryptoCache.client_id,
+      sub: this._cryptoCache.client_id
     };
 
     let sharedKey;
@@ -620,23 +665,20 @@ class VoltCredential {
       sharedKey = VoltCredential.aesCreateKey();
 
       // Encrypt the key details using the target Volt public key and include this in the JWT payload.
-      payload.sk = VoltCredential.rsaEncrypt(
-        this._voltPublicKey,
-        sharedKey.key,
-      );
-      payload.iv = VoltCredential.rsaEncrypt(this._voltPublicKey, sharedKey.iv);
+      payload.sk = VoltCredential.rsaEncrypt(publicKey, sharedKey.key);
+      payload.iv = VoltCredential.rsaEncrypt(publicKey, sharedKey.iv);
     }
 
     // Sign synchronously.
     const token = jwt__default["default"].sign(payload, this._cryptoCache.key, {
       algorithm: rs256Algorithm,
-      keyid: base58Key,
+      keyid: base58Key
     });
 
     // Return the token along with any encryption key details.
     return {
       token,
-      sharedKey,
+      sharedKey
     };
   }
 
@@ -649,11 +691,12 @@ class VoltCredential {
    * @param {*} ttl
    * @returns
    */
-  getIdentityMetadata(grpc, audience, tunnelling = false, ttl = 60) {
+  getIdentityMetadata(grpc, audience, publicKey, tunnelling = false, ttl = 60) {
     const identityToken = this.getIdentityToken(
       audience || this._voltConfig.id,
+      publicKey,
       tunnelling,
-      ttl,
+      ttl
     );
     const metadata = new grpc.Metadata();
     metadata.add(constants.authTokenName, identityToken.token);
@@ -668,7 +711,7 @@ class VoltCredential {
         const privateKey = pki$1.privateKeyFromPem(this._cryptoCache.key);
         clone.credential.key = pki$1.encryptRsaPrivateKey(
           privateKey,
-          this._config.p,
+          this._config.p
         );
       }
       fs__default["default"].writeFileSync(this._configPath, JSON.stringify(clone, null, 2));
@@ -697,6 +740,12 @@ class VoltCredential {
   static rsaEncrypt(key, buffer) {
     return crypto__default["default"].publicEncrypt(key, buffer).toString("base64");
   }
+
+  static rsaDecrypt(key, buffer) {
+    const keyObj = crypto__default["default"].createPrivateKey(key);
+    const cipher = Buffer.from(buffer, "base64");
+    return Buffer.from(crypto__default["default"].privateDecrypt(keyObj, cipher));
+  }
 }
 
 const { get: getProp, snakeCase } = lodash__default["default"];
@@ -713,23 +762,23 @@ const defaultLoaderOptions = {
   includeDirs: [defaultProtoPath],
 };
 
-const getProtoDescriptors = (grpc, protoPath, opts) => {
+function getProtoDescriptors(grpc, protoPath, opts) {
   const definition = protoLoader__default["default"].loadSync(
     protoPath,
     opts || defaultLoaderOptions,
   );
   const descriptors = grpc.loadPackageDefinition(definition);
   return descriptors;
-};
+}
 
-const getProtoService = (descriptors, servicePath) => {
+function getProtoService(descriptors, servicePath) {
   const serviceDef = getProp(descriptors, servicePath);
   if (serviceDef?.service) {
     return serviceDef.service;
   } else {
     return null;
   }
-};
+}
 
 function getServiceDescriptorsFromPath(
   grpc,
@@ -737,8 +786,30 @@ function getServiceDescriptorsFromPath(
   servicePackageName,
   opts,
 ) {
+  if (!opts) {
+    opts = { ...defaultLoaderOptions };
+    opts.includeDirs = [protoPath];
+  }
+
+  // Extract the package components of the service proto package. The package name should be of the
+  // fully qualified proto path, e.g. tdx.volt_api.webcam.v1.WebcamControlAPI.
+  const protoServiceComponents = servicePackageName.split(".");
+
+  // The service name is the last component of the path.
+  const protoServiceName = protoServiceComponents.pop();
+
+  // The actual file name should match the snake case of the service name.
+  const protoFileName = `${snakeCase(protoServiceName).toLowerCase()}.proto`;
+
+  // The path to the proto file should match each component of the package name.
+  const serviceProtoPath = path.join(
+    protoPath,
+    ...protoServiceComponents,
+    protoFileName,
+  );
+
   let serviceDescriptors;
-  const descriptors = getProtoDescriptors(grpc, protoPath, opts);
+  const descriptors = getProtoDescriptors(grpc, serviceProtoPath, opts);
   if (descriptors) {
     serviceDescriptors = getProtoService(descriptors, servicePackageName);
   }
@@ -786,8 +857,17 @@ function getProtoDescriptorMethods(protoDescriptor) {
   return methods;
 }
 
+function createServiceProtobufFiles(service, protoPath) {
+  for (let protoFile of service.service_description.proto_file) {
+    const filePath = path.join(protoPath, protoFile.file_path);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, protoFile.protobuf);
+  }
+}
+
 var protoUtils = /*#__PURE__*/Object.freeze({
   __proto__: null,
+  createServiceProtobufFiles: createServiceProtobufFiles,
   getServiceDescriptors: getServiceDescriptors,
   getProtoDescriptors: getProtoDescriptors,
   getProtoDescriptorMethods: getProtoDescriptorMethods,
@@ -796,70 +876,101 @@ var protoUtils = /*#__PURE__*/Object.freeze({
 
 /* eslint-disable no-underscore-dangle */
 
-const log$3 = debug__default["default"]("volt-client-grpc:grpc-call");
+const log$4 = debug__default["default"]("volt-client-grpc:grpc-call");
 
 function _prepareInvokeRequest(
   request,
   method,
   methodType = "METHOD_TYPE_UNARY",
 ) {
-  const meta = this._voltClient.credential.getIdentityMetadata(
+  const isServiceRelayed =
+    this._service?.service_description.host_type ===
+    "SERVICE_HOST_TYPE_RELAYED";
+
+  // Use the service's host client id and public key if the service is relayed.
+  const methodToken = this._voltClient.credential.getIdentityMetadata(
     this._voltClient.grpc,
-    this._voltClient.voltConfig.id,
-    this._voltClient.isRemote,
+    this._service?.service_description.host_client_id ||
+      this._voltClient.voltConfig.id,
+    this._service?.service_description.host_public_key ||
+      this._voltClient.credential.voltPublicKey,
+    true,
   );
+
   let invokeRequest;
   let callMethod = method;
 
-  if (this._voltClient.isVoltRelay) {
+  if (this._voltClient.isVoltRelay || isServiceRelayed) {
+    //
+    // If the volt connection is via a relay (or the target service is relayed),
+    // we wrap the rpc in a RemoteRequest message and send it via a call to Invoke().
+    //
     let requestPayload;
+
+    // Serialise the rpc request.
     if (request) {
       requestPayload = this._grpcClient[method].requestSerialize(request);
     } else if (request !== null) {
-      log$3("****************LOOKOUT****************** - empty request");
+      log$4("****************LOOKOUT****************** - empty request");
     } else {
-      log$3("explicit empty request payload");
+      log$4("explicit empty request payload");
     }
 
-    const tunnelMethod = this._grpcClient.Tunnel;
+    // Use this placeholder to serialise the relay request wrapper.
+    const voltGrpcClient = this._voltClient.getVoltAPIClient();
+    const tunnelMethod = voltGrpcClient.Tunnel;
 
     const tunnelResp = {
       method_invoke: {
         method_name: this._grpcClient[method].path,
         method_type: methodType,
-        token: meta.token,
+        token: methodToken.token,
         request: requestPayload,
       },
     };
 
-    const invokePayload = VoltCredential.aesEncrypt(
-      tunnelMethod.responseSerialize(tunnelResp),
-      meta.sharedKey.key,
-      meta.sharedKey.iv,
-    );
+    let targetFingerprint = [];
+    let invokePayload;
+    if (this._voltClient.isVoltRelay || isServiceRelayed) {
+      // When sending via a relay we need to encrypt the payload.
+      invokePayload = VoltCredential.aesEncrypt(
+        tunnelMethod.responseSerialize(tunnelResp),
+        methodToken.sharedKey.key,
+        methodToken.sharedKey.iv,
+      );
+    } else {
+      invokePayload = tunnelMethod.responseSerialize(tunnelResp);
+    }
 
-    log$3("target volt is %s", this._voltClient.credential.voltFingerprint);
+    if (this._voltClient.isVoltRelay) {
+      targetFingerprint.push(this._voltClient.credential.voltFingerprint);
+    }
+
+    if (isServiceRelayed) {
+      // Add another relay hop if the target service is relayed.
+      log$4("target service is relayed");
+      targetFingerprint.push(
+        this._service.service_description.host_fingerprint,
+      );
+    }
+
+    log$4("target is %j", targetFingerprint);
 
     invokeRequest = {
-      identity_fingerprint: this._voltClient.credential.voltFingerprint,
+      target_fingerprint: targetFingerprint,
+      token: methodToken.token,
       payload: invokePayload,
+      target_service_id: isServiceRelayed ? this._service.id : undefined,
     };
 
+    // Replace the target method with a call to Invoke on the relay Volt.
     callMethod = "Invoke";
-  } else if (this._voltClient.isRemote && meta.sharedKey.key) {
-    const requestPayload =
-      this._grpcClient[method].requestSerializeOriginal(request);
-    invokeRequest = VoltCredential.aesEncrypt(
-      requestPayload,
-      meta.sharedKey.key,
-      meta.sharedKey.iv,
-    );
   } else {
     invokeRequest = request;
   }
 
   return {
-    meta,
+    meta: methodToken,
     method: callMethod,
     methodName: method,
     request: invokeRequest,
@@ -869,10 +980,16 @@ function _prepareInvokeRequest(
 function _preparePayloadRequest(request, invokeInfo) {
   let payloadRequest;
 
-  if (this._voltClient.isVoltRelay) {
+  const isServiceRelayed =
+    this._service?.service_description.host_type ===
+    "SERVICE_HOST_TYPE_RELAYED";
+
+  if (this._voltClient.isVoltRelay || isServiceRelayed) {
     const requestPayload =
       this._grpcClient[invokeInfo.methodName].requestSerialize(request);
-    const tunnelMethod = this._grpcClient.Tunnel;
+
+    const voltGrpcClient = this._voltClient.getVoltAPIClient();
+    const tunnelMethod = voltGrpcClient.Tunnel;
 
     const tunnelResp = {
       method_payload: {
@@ -889,14 +1006,6 @@ function _preparePayloadRequest(request, invokeInfo) {
     payloadRequest = {
       payload: invokePayload,
     };
-  } else if (this._voltClient.isRemote && invokeInfo.meta.sharedKey.key) {
-    const requestPayload =
-      this._grpcClient[invokeInfo.methodName].requestSerializeOriginal(request);
-    payloadRequest = VoltCredential.aesEncrypt(
-      requestPayload,
-      invokeInfo.meta.sharedKey.key,
-      invokeInfo.meta.sharedKey.iv,
-    );
   } else {
     payloadRequest = request;
   }
@@ -905,29 +1014,47 @@ function _preparePayloadRequest(request, invokeInfo) {
 }
 
 function _parseResponse(method, meta, response) {
+  // log("parseResponse for %s", this._methodName);
   let invokeResponse = {};
 
-  if (this._voltClient.isVoltRelay) {
+  const isServiceRelayed =
+    this._service?.service_description.host_type ===
+    "SERVICE_HOST_TYPE_RELAYED";
+
+  if (this._voltClient.isVoltRelay || isServiceRelayed) {
     if (response.payload) {
-      const decryptedPayload = VoltCredential.aesDecrypt(
-        response.payload,
-        meta.sharedKey.key,
-        meta.sharedKey.iv,
-      );
-      const tunnelMethod = this._grpcClient.Tunnel;
+      let decryptedPayload;
+      if (meta.sharedKey.key) {
+        decryptedPayload = VoltCredential.aesDecrypt(
+          response.payload,
+          meta.sharedKey.key,
+          meta.sharedKey.iv,
+        );
+      } else {
+        decryptedPayload = response.payload;
+      }
+
+      const tunnelMethod = this._voltClient.getVoltAPIClient().Tunnel;
       const responsePayload = tunnelMethod.requestDeserialize(decryptedPayload);
       if (responsePayload.payload === "method_payload") {
-        invokeResponse.payload = this._grpcClient[method].responseDeserialize(
-          responsePayload.method_payload.payload,
-        );
+        try {
+          invokeResponse.payload = this._grpcClient[method].responseDeserialize(
+            responsePayload.method_payload.payload,
+          );
+        } catch (err) {
+          log$4("failure deserialising payload for %s", this._methodName);
+          throw new Error(
+            "failure deserialising payload - check protobuf definition matches with data being sent",
+          );
+        }
       } else if (responsePayload.payload === "method_end") {
         invokeResponse = responsePayload.method_end;
       } else {
-        log$3("unexpected tunnel payload type: %s", responsePayload.payload);
+        log$4("unexpected tunnel payload type: %s", responsePayload.payload);
       }
     } else if (response.status?.message) {
       // There's been an error in the tunnel.
-      log$3(
+      log$4(
         "Tunnel status received: %s, code %d, description: %s",
         response.status.message,
         response.status.code,
@@ -939,7 +1066,7 @@ function _parseResponse(method, meta, response) {
       };
     } else {
       invokeResponse.methodId = response.invoke_id;
-      log$3("started method %d for %s", invokeResponse.methodId, method);
+      log$4("started method %d for %s", invokeResponse.methodId, method);
     }
   } else if (this._voltClient.isRemote && meta.sharedKey.key) {
     const decryptedPayload = VoltCredential.aesDecrypt(
@@ -959,17 +1086,22 @@ function _parseResponse(method, meta, response) {
 }
 
 class GRPCCall extends EventEmitter__default["default"] {
-  constructor(voltClient, methodName, methodType) {
+  constructor(voltClient, methodName, methodType, service = undefined) {
     super();
     this._methodName = methodName;
     this._methodType = methodType;
     this._call = null;
     this._voltClient = voltClient;
+    this._service = service;
   }
 
   start(grpcClient, request) {
     this._grpcClient = grpcClient;
 
+    if (typeof this._grpcClient[this._methodName] !== "function") {
+      throw new Error(`method not found: '${this._methodName}'`);
+    }
+
     this._initialRequest = _prepareInvokeRequest.call(
       this,
       request,
@@ -977,13 +1109,18 @@ class GRPCCall extends EventEmitter__default["default"] {
       this._methodType,
     );
 
-    if (!this._grpcClient[this._initialRequest.method]) {
-      return reject(
-        new Error(`method not found: '${this._initialRequest.method}'`),
-      );
+    const isServiceRelayed =
+      this._service?.service_description.host_type ===
+      "SERVICE_HOST_TYPE_RELAYED";
+
+    let callClient;
+    if (this._voltClient.isVoltRelay || isServiceRelayed) {
+      callClient = this._voltClient.getVoltAPIClient();
+    } else {
+      callClient = this._grpcClient;
     }
 
-    this._call = this._grpcClient[this._initialRequest.method](
+    this._call = callClient[this._initialRequest.method](
       this._initialRequest.meta.metadata,
     );
 
@@ -1013,28 +1150,32 @@ class GRPCCall extends EventEmitter__default["default"] {
             this.emit("end");
           }
         } else {
-          log$3("method id is %s", parsedResponse.methodId);
+          log$4("method id is %s", parsedResponse.methodId);
         }
       } catch (err) {
-        log$3("failure processing connect response: %s", err.message);
+        log$4(
+          "failure processing %s call response: %s",
+          this._methodName,
+          err.message,
+        );
         this.emit("error", err);
       }
     });
 
     this._call.on("error", (err) => {
-      log$3("ERROR - intercepted stream error %s", err.message);
+      log$4("ERROR - intercepted stream error %s", err.message);
       this.emit("error", err);
     });
 
     this._call.on("finish", () => {
       // The read side has ended (i.e. we called end()).
-      log$3("finished call %s", this._methodName);
+      log$4("finished call %s", this._methodName);
       this.emit("finish");
     });
 
     this._call.on("end", () => {
       // The remote peer ended the stream.
-      log$3(
+      log$4(
         "ended call %s, method id: %s",
         this._methodName,
         this._initialRequest.methodId || "n/a - not tunnelling",
@@ -1064,7 +1205,7 @@ class GRPCCall extends EventEmitter__default["default"] {
 
   write(request) {
     if (!this._call) {
-      log$3("ERROR - call not initialised");
+      log$4("ERROR - call not initialised");
       throw new Error("call not initialised");
     } else if (this._initialRequest) {
       const payloadRequest = _preparePayloadRequest.call(
@@ -1088,7 +1229,7 @@ class GRPCCall extends EventEmitter__default["default"] {
 
 /* eslint-disable no-use-before-define */
 
-const log$2 = debug__default["default"]("volt-client-grpc:volt-connection");
+const log$3 = debug__default["default"]("volt-client-grpc:volt-connection");
 
 function _cleanUp(immediateReconnect) {
   this._connectionId = "";
@@ -1112,7 +1253,7 @@ function _cleanUp(immediateReconnect) {
         this._reconnectTimer = 0;
         _doConnect.call(this, this._helloPayload);
       },
-      immediateReconnect ? 0 : this._reconnectInterval,
+      immediateReconnect ? 0 : this._reconnectInterval
     );
   }
 
@@ -1122,7 +1263,7 @@ function _cleanUp(immediateReconnect) {
 }
 
 function _connectionTimeoutHandler() {
-  log$2("server timed out");
+  log$3("server timed out");
   this.emit("connected", false);
   _cleanUp.call(this);
 }
@@ -1133,15 +1274,15 @@ function _doConnect(connectHello) {
   const grpcClient = this._voltClient.getVoltAPIClient();
 
   let helloPayload = connectHello;
-  if (!connectHello) {
-    log$2("defaulting hello payload");
+  if (!helloPayload) {
+    log$3("defaulting hello payload");
     helloPayload = {
-      hello: {},
+      hello: {}
     };
   }
 
   this.call.on("error", (err) => {
-    log$2("error on connection stream [%s]", err.message);
+    log$3("error on connection stream [%s]", err.message);
     _cleanUp.call(this);
     this.emit("error", err);
   });
@@ -1149,7 +1290,7 @@ function _doConnect(connectHello) {
   this.call.on("data", (response) => {
     switch (response.payload) {
       case "ping": {
-        log$2("pinged");
+        log$3("pinged");
 
         // Received ping response from server => clear timeout.
         if (this._pingTimeoutTimer) {
@@ -1158,23 +1299,30 @@ function _doConnect(connectHello) {
 
         // Schedule the next ping.
         _startPingTimer.call(this);
+
+        this.emit("ping", response.ping.timestamp);
         break;
       }
       case "acknowledge": {
         if (!this._connectionId) {
           this._connectionId = response.acknowledge.connection_id;
-          log$2("connection id is %s", this._connectionId);
+          log$3("connection id is %s", this._connectionId);
           this.emit("connected", this._connectionId);
         }
         break;
       }
+      case "invoke_request": {
+        log$3("received invoke request");
+        this.emit("invoke_request", response.invoke_request);
+        break;
+      }
       case "evt": {
-        log$2("received event %s", response.evt.event_type);
+        log$3("received event %s", Object.keys(response.evt)[0]);
         this.emit("evt", response.evt);
         break;
       }
       default:
-        log$2("unimplemented connect response payload: %s", response.payload);
+        log$3("unimplemented connect response payload: %s", response.payload);
         break;
     }
   });
@@ -1193,7 +1341,7 @@ function _doConnect(connectHello) {
 
 function _startPingTimer() {
   if (this._pingTimer) {
-    log$2("ping timer running");
+    log$3("ping timer running");
     return;
   }
 
@@ -1201,7 +1349,7 @@ function _startPingTimer() {
     // Send next ping to server.
     const request = { ping: { timestamp: Date.now() } };
 
-    log$2("pinging Volt");
+    log$3("pinging Volt");
     this.call.write(request);
 
     this._pingTimer = 0;
@@ -1213,7 +1361,7 @@ function _startPingTimer() {
 
     this._pingTimeoutTimer = setTimeout(
       _connectionTimeoutHandler.bind(this),
-      this._timeoutInterval,
+      this._timeoutInterval
     );
   }, this._pingInterval);
 }
@@ -1250,6 +1398,281 @@ class VoltConnection extends EventEmitter__default["default"] {
     this._dying = true;
     _cleanUp.call(this);
   }
+
+  send(request) {
+    this.call.write(request);
+  }
+}
+
+const log$2 = debug__default["default"]("rpc-invocation");
+
+class RpcInvocation extends EventEmitter__default["default"] {
+  #voltClient = null;
+  #voltConnection = null;
+  #token = null;
+  #encryptKey = null;
+  #encryptIV = null;
+  #invokeId = null;
+  #payload = null;
+  #isJSON = false;
+  #methodDescriptor = null;
+  #methodName = null;
+
+  constructor(voltClient, voltConnection) {
+    super();
+    this.#voltClient = voltClient;
+    this.#voltConnection = voltConnection;
+  }
+
+  get id() {
+    return this.#invokeId;
+  }
+
+  get payload() {
+    if (!this.#payload) {
+      return null;
+    }
+
+    let deserialisedPayload = null;
+
+    if (this.#isJSON) {
+      // Don't need to deserialise JSON payload.
+      deserialisedPayload = this.#payload;
+    } else if (this.#methodDescriptor) {
+      deserialisedPayload = this.#methodDescriptor.requestDeserialize(
+        this.#payload
+      );
+    } else {
+      log$2("unexpected: no method descriptor");
+      throw new Error(
+        "no method descriptor - set this before accessing payload"
+      );
+    }
+
+    return deserialisedPayload;
+  }
+
+  get methodName() {
+    return this.#methodName;
+  }
+
+  set methodDescriptor(methodDescriptor) {
+    this.#methodDescriptor = methodDescriptor;
+  }
+
+  #decodeToken(token) {
+    // We don't verify the token at this point, as we don't know the public key.
+    // The rpc implementation should do the verification using the Volt API (e.g. CanAccessResource).
+    this.#token = jwt__default["default"].decode(token);
+
+    if (this.#token.sk) {
+      // Decrypt the shared key and iv using the private key.
+      this.#encryptKey = VoltCredential.rsaDecrypt(
+        this.#voltClient.credential.cache.key,
+        this.#token.sk
+      );
+      this.#encryptIV = VoltCredential.rsaDecrypt(
+        this.#voltClient.credential.cache.key,
+        this.#token.iv
+      );
+    }
+
+    return Promise.resolve(this.#token);
+  }
+
+  initialise(invoke_request) {
+    this.#invokeId = invoke_request.invoke_id;
+
+    return this.#decodeToken(invoke_request.token)
+      .then(() => {
+        // Parse the initial payload.
+        return this.parsePayload(invoke_request);
+      })
+      .catch((err) => {
+        log$2("failure initialising invocation: %s", err.message);
+        return Promise.reject(err);
+      });
+  }
+
+  parsePayload(invoke_request) {
+    return new Promise((resolve, reject) => {
+      if (invoke_request.payload) {
+        let decryptedPayload;
+
+        if (this.#encryptKey) {
+          // Decrypt the actual payload using the shared key and iv.
+          decryptedPayload = VoltCredential.aesDecrypt(
+            invoke_request.payload,
+            this.#encryptKey,
+            this.#encryptIV
+          );
+        } else {
+          // No encryption => just use the payload.
+          decryptedPayload = invoke_request.payload;
+        }
+
+        const tunnelMethod = this.#voltClient.getVoltAPIClient().Tunnel;
+        const wrappedPayload =
+          tunnelMethod.responseDeserialize(decryptedPayload);
+
+        if (wrappedPayload.method_invoke) {
+          // This is the initial request payload.
+          this.#methodName = wrappedPayload.method_invoke.method_name;
+          this.#payload = wrappedPayload.method_invoke.request;
+          this.emit("payload", this);
+        } else if (wrappedPayload.method_payload) {
+          // This is a subsequent payload, e.g. for streaming rpcs.
+          this.#payload = wrappedPayload.method_payload.payload;
+          this.emit("payload", this);
+        } else if (wrappedPayload.method_end) {
+          this.#payload = wrappedPayload.method_end;
+          if (wrappedPayload.method_end.error) {
+            // The client has sent an error.
+            this.emit("error", this);
+          } else {
+            this.emit("end", this);
+          }
+        }
+
+        resolve();
+      } else if (invoke_request.json_payload) {
+        let decryptedPayload;
+
+        this.#isJSON = true;
+
+        if (this.#encryptKey) {
+          // Decrypt the actual payload using the shared key and iv.
+          decryptedPayload = VoltCredential.aesDecrypt(
+            Buffer.from(invoke_request.json_payload, "base64"),
+            this.#encryptKey,
+            this.#encryptIV
+          );
+        } else {
+          // No encryption => just use the payload.
+          decryptedPayload = invoke_request.json_payload;
+        }
+
+        try {
+          const wrappedPayload = JSON.parse(decryptedPayload.toString());
+
+          if (wrappedPayload.method_invoke) {
+            this.#methodName = wrappedPayload.method_invoke.method_name;
+            this.#payload = JSON.parse(
+              wrappedPayload.method_invoke.json_request
+            );
+            this.emit("payload", this);
+          } else if (wrappedPayload.method_payload) {
+            this.#payload = JSON.parse(
+              wrappedPayload.method_payload.json_payload
+            );
+            this.emit("payload", this);
+          } else if (wrappedPayload.method_end) {
+            // We don't need to do anything here, since we notify the client when we receive the client_end.
+            log$2("method_end received");
+          }
+        } catch (err) {
+          log$2("JSON.parse failure parsing json_payload: %s", err.message);
+          reject(err);
+        }
+
+        resolve();
+      } else if (invoke_request.client_end) {
+        this.emit("end", this);
+      } else {
+        // Do we need to support json_payload here?
+        reject(new Error("No payload in invoke request"));
+      }
+    }).catch((err) => {
+      log$2("failure parsing payload: %s", err.message);
+      return Promise.reject(err);
+    });
+  }
+
+  sendResponse(response) {
+    let responsePayload;
+    if (this.#isJSON) {
+      responsePayload = JSON.stringify({
+        method_payload: { json_payload: JSON.stringify(response) }
+      });
+    } else {
+      // We need to serialise the response, and then wrap it in a RemoteRequest.
+      const serialisedResponse =
+        this.#methodDescriptor.responseSerialize(response);
+      const tunnelMethod = this.#voltClient.getVoltAPIClient().Tunnel;
+      responsePayload = tunnelMethod.requestSerialize({
+        method_payload: { payload: serialisedResponse }
+      });
+    }
+
+    if (this.#token.sk) {
+      // Encrypt the response using the shared key and iv.
+      responsePayload = VoltCredential.aesEncrypt(
+        responsePayload,
+        this.#encryptKey,
+        this.#encryptIV
+      );
+    }
+
+    const invokeResponse = {
+      invoke_id: this.#invokeId
+    };
+
+    if (this.#isJSON) {
+      invokeResponse.json_payload =
+        Buffer.from(responsePayload).toString("base64");
+    } else {
+      invokeResponse.payload = responsePayload;
+    }
+
+    this.#voltConnection.send({
+      invoke_response: invokeResponse
+    });
+  }
+
+  sendEnd(errorMessage) {
+    const tunnelMethod = this.#voltClient.getVoltAPIClient().Tunnel;
+
+    let endPayload;
+    if (errorMessage) {
+      endPayload = {
+        method_end: { error: errorMessage, ended: true }
+      };
+    } else {
+      endPayload = {
+        method_end: { ended: true }
+      };
+    }
+
+    if (this.#isJSON) {
+      endPayload = JSON.stringify(endPayload);
+    } else {
+      endPayload = tunnelMethod.requestSerialize(endPayload);
+    }
+
+    if (this.#token.sk) {
+      // Encrypt the response using the shared key and iv.
+      endPayload = VoltCredential.aesEncrypt(
+        endPayload,
+        this.#encryptKey,
+        this.#encryptIV
+      );
+    }
+
+    const invokeResponse = {
+      invoke_id: this.#invokeId,
+      server_end: true
+    };
+
+    if (this.#isJSON) {
+      invokeResponse.json_payload = Buffer.from(endPayload).toString("base64");
+    } else {
+      invokeResponse.payload = endPayload;
+    }
+
+    this.#voltConnection.send({
+      invoke_response: invokeResponse
+    });
+  }
 }
 
 /* eslint-disable no-underscore-dangle */
@@ -1265,51 +1688,53 @@ const voltServices = [
   constants.serviceType.sqliteServerAPI,
   constants.serviceType.ssiAPI,
   constants.serviceType.relayAPI,
-  constants.serviceType.wireAPI,
+  constants.serviceType.wireAPI
 ];
 
 function issueBind(bindRequest, ttl) {
   // eslint-disable-next-line no-use-before-define
-  return unaryCall.call(this, "Bind", bindRequest).then((bindResponse) => {
-    log$1("got binding request response %j", bindResponse);
-    if (bindResponse.status?.code) {
-      log$1("error in bind response: %s", bindResponse.status.message);
-      return Promise.reject(new Error(bindResponse.status.message));
-    } else {
-      switch (bindResponse.decision) {
-        case "POLICY_DECISION_PERMIT": {
-          //
-          // The request status is permit => cache the bind response info.
-          //
-
-          // This is the certificate assigned to us by the volt.
-          this._credential.cache.cert = bindResponse.cert;
-
-          // This is the signing CA used by the volt.
-          this._credential.cache.ca = bindResponse.chain;
-
-          // Identity resource id is assigned by the volt.
-          this._credential.cache.client_id = bindResponse.identity_id;
-          this._credential.saveCache();
-          break;
-        }
-        case "POLICY_DECISION_DENY": {
-          log$1(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
-          break;
-        }
-        case "POLICY_DECISION_PROMPT":
-        case "POLICY_DECISION_PENDING": {
-          log$1("access pending approval - waiting...");
-          break;
+  return unaryCallInternal
+    .call(this, "Bind", bindRequest)
+    .then((bindResponse) => {
+      log$1("got binding request response %j", bindResponse);
+      if (bindResponse.status?.code) {
+        log$1("error in bind response: %s", bindResponse.status.message);
+        return Promise.reject(new Error(bindResponse.status.message));
+      } else {
+        switch (bindResponse.decision) {
+          case "POLICY_DECISION_PERMIT": {
+            //
+            // The request status is permit => cache the bind response info.
+            //
+
+            // This is the certificate assigned to us by the volt.
+            this._credential.cache.cert = bindResponse.cert;
+
+            // This is the signing CA used by the volt.
+            this._credential.cache.ca = bindResponse.chain;
+
+            // Identity resource id is assigned by the volt.
+            this._credential.cache.client_id = bindResponse.identity_id;
+            this._credential.saveCache();
+            break;
+          }
+          case "POLICY_DECISION_DENY": {
+            log$1(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
+            break;
+          }
+          case "POLICY_DECISION_PROMPT":
+          case "POLICY_DECISION_PENDING": {
+            log$1("access pending approval - waiting...");
+            break;
+          }
+          default:
+            log$1("ignoring unknown bind descision %s", bindResponse.status);
+            break;
         }
-        default:
-          log$1("ignoring unknown bind descision %s", bindResponse.status);
-          break;
       }
-    }
 
-    return bindResponse.decision;
-  });
+      return bindResponse.decision;
+    });
 }
 
 function findDIDDocumentService(document, serviceType) {
@@ -1333,13 +1758,13 @@ async function bindInternal() {
       log$1("attempting to retrieve Relay information from %s", relayURL);
       this._voltConfig.relay = await fetchVoltConfig.call(
         this,
-        `${relayURL}/discovery`,
+        `${relayURL}/discovery`
       );
       if (this._voltConfig.relay.ca_pem) {
         log$1(
           "Auto-fetched Relay CA %s, remote address %s",
           this._voltConfig.relay.ca_pem,
-          this._voltConfig.relay.address,
+          this._voltConfig.relay.address
         );
       } else {
         throw new Error("Unable to fetch Relay CA - cannot securely connect.");
@@ -1352,7 +1777,7 @@ async function bindInternal() {
 
     if (!this._credential.cache.ca) {
       throw new Error(
-        "No certificate authority found in configuration for target Volt - check configuration",
+        "No certificate authority found in configuration for target Volt - check configuration"
       );
     }
 
@@ -1372,30 +1797,30 @@ async function bindInternal() {
       binding_name: this._config.client_name,
       public_key: publicKeyPem,
       host: this._credential.cache.bindIp,
-      x509_credential: [],
+      x509_credential: []
     };
 
     if (this._credential.cache.cert) {
       bindRequest.x509_credential = [
-        this._credential.cache.cert + this._credential.cache.ca,
+        this._credential.cache.cert + this._credential.cache.ca
       ];
     }
 
     if (this._voltConfig.challenge_code) {
       bindRequest.challenge = signBase64(
         keyPair.privateKey,
-        this._voltConfig.challenge_code,
+        this._voltConfig.challenge_code
       );
     } else {
       log$1(
-        "****no Volt challenge code available**** => not sending challenge signature",
+        "****no Volt challenge code available**** => not sending challenge signature"
       );
     }
 
     // For remote connections, add our cloud-issued certificate as an additional credential.
     if (this._voltConfig?.relay?.ca_pem && this._credential.cache.cloud_cert) {
       bindRequest.x509_credential = bindRequest.x509_credential.concat(
-        this._credential.cache.cloud_cert + this._voltConfig.relay.ca_pem,
+        this._credential.cache.cloud_cert + this._voltConfig.relay.ca_pem
       );
     }
 
@@ -1415,7 +1840,7 @@ async function bindInternal() {
       decision = await issueBind.call(
         this,
         bindRequest,
-        this._voltConfig.bindRequestTTL,
+        this._voltConfig.bindRequestTTL
       );
       log$1("binding decision: %s", decision);
     } while (
@@ -1476,6 +1901,34 @@ function connectInternal(helloPayload) {
       this.emit("evt", evt);
     });
 
+    this._voltConnection.on("ping", (ping) => {
+      this.emit("ping", ping);
+    });
+
+    this._voltConnection.on("invoke_request", (invoke_request) => {
+      const invokeId = invoke_request.invoke_id;
+      if (this._activeRPC[invokeId]) {
+        this._activeRPC[invokeId].parsePayload(invoke_request);
+      } else {
+        const rpcInvocation = new RpcInvocation(this, this._voltConnection);
+
+        rpcInvocation.on("end", () => {
+          log$1("removing active RPC [%s]", invokeId);
+          this._activeRPC[invokeId] = undefined;
+        });
+
+        rpcInvocation
+          .initialise(invoke_request)
+          .then(() => {
+            this._activeRPC[invokeId] = rpcInvocation;
+            this.emit("invoke_request", rpcInvocation);
+          })
+          .catch((err) => {
+            log$1("invoke_request - error [%s]", err.message);
+          });
+      }
+    });
+
     return this._voltConnection.connect(helloPayload);
   } catch (err) {
     log$1("connect - error [%s]", err.message);
@@ -1502,18 +1955,68 @@ function getVoltAPIClientInternal() {
       this._credential,
       this.isRemote && !this.isVoltRelay,
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
-      this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
+      this._voltConfig?.relay?.cloud ? this._voltConfig.id : ""
     );
   }
 
   return this._cachedClient;
 }
 
-function unaryCall(method, request) {
-  return new Promise((resolve, reject) => {
-    const grpcClient = this.getVoltAPIClient();
+function getAPIClientInternal(service) {
+  if (!this._cachedService[service.id]) {
+    service.service_description.host_type === "SERVICE_HOST_TYPE_RELAYED";
+
+    const serviceAddress = this.isRemote
+      ? this._voltConfig.relay.address
+      : service.service_description.host_address;
+
+    createServiceProtobufFiles(service, "./service-proto");
+
+    log$1("creating API service client on %s", serviceAddress);
+    let serviceDescriptors = {};
+    const fullProtoPath = path.join(process.cwd(), "./service-proto");
+    for (let api of service.service_description.service_api) {
+      const packageDescriptors = getServiceDescriptorsFromPath(
+        this._grpc,
+        fullProtoPath,
+        api
+      );
+      serviceDescriptors = { ...serviceDescriptors, ...packageDescriptors };
+    }
+
+    this._cachedService[service.id] = createClient(
+      this._grpc,
+      serviceDescriptors,
+      serviceAddress,
+      this._credential,
+      this.isRemote && !this.isVoltRelay,
+      this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
+      this._voltConfig?.relay?.cloud ? this._voltConfig.id : ""
+    );
+  }
+
+  return this._cachedService[service.id];
+}
+
+function getServiceClient(service) {
+  let grpcClient;
+  if (
+    service &&
+    service?.service_description.host_type !== "SERVICE_HOST_TYPE_BUILTIN"
+  ) {
+    grpcClient = getAPIClientInternal.call(this, service);
+  } else {
+    grpcClient = getVoltAPIClientInternal.call(this);
+  }
+
+  return grpcClient;
+}
 
-    const call = new GRPCCall(this, method, "METHOD_TYPE_UNARY");
+function unaryCallInternal(method, request, service) {
+  const grpcClient = getServiceClient.call(this, service);
+
+  return new Promise((resolve, reject) => {
+    const call = new GRPCCall(this, method, "METHOD_TYPE_UNARY", service);
 
     let response = null;
 
@@ -1541,6 +2044,16 @@ function unaryCall(method, request) {
   });
 }
 
+function streamingCallInternal(methodType, method, request, service) {
+  const grpcClient = getServiceClient.call(this, service);
+
+  const call = new GRPCCall(this, method, methodType, service);
+
+  call.start(grpcClient, request);
+
+  return call;
+}
+
 async function fetchVoltConfig(discovery_url) {
   try {
     const getJSON = bent__default["default"]("json");
@@ -1560,13 +2073,13 @@ async function fetchVoltConfig(discovery_url) {
       "ca_pem",
       "challenge_code",
       "cloud",
-      "relay",
+      "relay"
     );
 
     return voltConfig;
   } catch (err) {
     throw new Error(
-      `Failure loading config from ${discovery_url}: ${err.message}`,
+      `Failure loading config from ${discovery_url}: ${err.message}`
     );
   }
 }
@@ -1582,13 +2095,13 @@ async function fetchVoltConfigFromDID(volt_did) {
     const didDocument = await getJSON(didResolution);
     const voltConfigServices = findDIDDocumentService(
       didDocument,
-      constants.didServiceType.voltConfig,
+      constants.didServiceType.voltConfig
     );
     if (voltConfigServices.length !== 1) {
       log$1(
         "Unexpected number of Volt configuration endpoints found in DID document for %s, services found: %d",
         volt_did,
-        voltConfigServices.length,
+        voltConfigServices.length
       );
     }
 
@@ -1596,7 +2109,7 @@ async function fetchVoltConfigFromDID(volt_did) {
     return await fetchVoltConfig.call(this, serviceEndpoint);
   } catch (err) {
     throw new Error(
-      `Failure fetching Volt config from DID document ${volt_did}: ${err.message}`,
+      `Failure fetching Volt config from DID document ${volt_did}: ${err.message}`
     );
   }
 }
@@ -1621,6 +2134,8 @@ class VoltClient extends EventEmitter__default["default"] {
     this._config = null;
     this._voltConfig = null;
     this._voltConnection = null;
+    this._cachedService = {};
+    this._activeRPC = {};
   }
 
   get config() {
@@ -1647,7 +2162,7 @@ class VoltClient extends EventEmitter__default["default"] {
     try {
       if (!config) {
         throw new Error(
-          "configPath argument is required to be a non-empty string",
+          "configPath argument is required to be a non-empty string"
         );
       }
 
@@ -1658,13 +2173,13 @@ class VoltClient extends EventEmitter__default["default"] {
         log("Attempt to load config from file %s", configPath);
         try {
           const configContents = await readFile(
-            new URL(configPath, (typeof document === 'undefined' ? new (require('u' + 'rl').URL)('file:' + __filename).href : (document.currentScript && document.currentScript.src || new URL('index.cjs', document.baseURI).href))),
+            new URL(configPath, (typeof document === 'undefined' ? new (require('u' + 'rl').URL)('file:' + __filename).href : (document.currentScript && document.currentScript.src || new URL('index.cjs', document.baseURI).href)))
           );
           configJSON = JSON.parse(configContents);
         } catch (err) {
           log("failure loading config file %s [%s]", configPath, err.message);
           throw new Error(
-            `failed to load configuration - check JSON format in ${configPath}`,
+            `failed to load configuration - check JSON format in ${configPath}`
           );
         }
       } else if (typeof config === "object") {
@@ -1705,14 +2220,14 @@ class VoltClient extends EventEmitter__default["default"] {
         const didConfig = await fetchVoltConfigFromDID.call(this, voltDID);
         this._config = { ...this._config, volt: didConfig };
         log("resolved config from DID: %s", JSON.stringify(didConfig, null, 2));
-      } else if (voltHttpAddress) {
+      } else if (voltHttpAddress && !this._config?.volt?.id) {
         const discoConfig = await fetchVoltConfig.call(
           this,
-          `${voltHttpAddress}/discovery`,
+          `${voltHttpAddress}/discovery`
         );
         this._config = {
           ...this._config,
-          volt: { ...this._config.volt, ...discoConfig },
+          volt: { ...this._config.volt, ...discoConfig }
         };
       }
 
@@ -1756,7 +2271,7 @@ class VoltClient extends EventEmitter__default["default"] {
           if (bindErr.message === "invalid arguments") {
             // This is usually the result of a missing challenge signature or credential.
             log(
-              "failure binding to Volt - did you supply a challenge code or verified credential?",
+              "failure binding to Volt - did you supply a challenge code or verified credential?"
             );
             throw bindErr;
           }
@@ -1819,7 +2334,7 @@ class VoltClient extends EventEmitter__default["default"] {
     if (this.isRemote) {
       if (!this._voltConfig?.relay?.address) {
         throw new Error(
-          "Remote connection enabled but no Relay address - have you called start()?",
+          "Remote connection enabled but no Relay address - have you called start()?"
         );
       }
 
@@ -1831,14 +2346,14 @@ class VoltClient extends EventEmitter__default["default"] {
         this._credential,
         false,
         service.volt_id,
-        service.id,
+        service.id
       );
     } else {
       return createClient(
         this._grpc,
         serviceDescriptors,
         service.service_description.address,
-        this._credential,
+        this._credential
       );
     }
   }
@@ -1866,6 +2381,40 @@ class VoltClient extends EventEmitter__default["default"] {
     return getVoltAPIClientInternal.call(this);
   }
 
+  unaryCall(method, request, service) {
+    return unaryCallInternal.call(this, method, request, service);
+  }
+
+  bidiStreamingCall(method, request, service) {
+    return streamingCallInternal.call(
+      this,
+      "METHOD_TYPE_BIDI",
+      method,
+      request,
+      service
+    );
+  }
+
+  clientStreamingCall(method, request, service) {
+    return streamingCallInternal.call(
+      this,
+      "METHOD_TYPE_CLIENT_STREAM",
+      method,
+      request,
+      service
+    );
+  }
+
+  serverStreamingCall(method, request, service) {
+    return streamingCallInternal.call(
+      this,
+      "METHOD_TYPE_SERVER_STREAM",
+      method,
+      request,
+      service
+    );
+  }
+
   /**
    * Request resource access.
    * @param {*} targetResourceId
@@ -1873,12 +2422,12 @@ class VoltClient extends EventEmitter__default["default"] {
    */
   async RequestAccessBlocking(
     targetResourceId,
-    accessType = "VOLT_ACCESS_READ",
+    accessType = "VOLT_ACCESS_READ"
   ) {
     try {
       const accessRequest = {
         access: accessType,
-        resource_id: targetResourceId,
+        resource_id: targetResourceId
       };
 
       // This will block while the request is pending.
@@ -1910,47 +2459,47 @@ class VoltClient extends EventEmitter__default["default"] {
    */
 
   CanAccessResource(request) {
-    return unaryCall.call(this, "CanAccessResource", request);
+    return unaryCallInternal.call(this, "CanAccessResource", request);
   }
 
   DeleteResource(request) {
-    return unaryCall.call(this, "DeleteResource", request);
+    return unaryCallInternal.call(this, "DeleteResource", request);
   }
 
   DiscoverServices(request) {
-    return unaryCall.call(this, "DiscoverServices", request);
+    return unaryCallInternal.call(this, "DiscoverServices", request);
   }
 
   GetResource(request) {
-    return unaryCall.call(this, "GetResource", request);
+    return unaryCallInternal.call(this, "GetResource", request);
   }
 
   GetResources(request) {
-    return unaryCall.call(this, "GetResources", request);
+    return unaryCallInternal.call(this, "GetResources", request);
   }
 
   GetResourceAncestors(request) {
-    return unaryCall.call(this, "GetResourceAncestors", request);
+    return unaryCallInternal.call(this, "GetResourceAncestors", request);
   }
 
   GetResourceDescendants(request) {
-    return unaryCall.call(this, "GetResourceDescendants", request);
+    return unaryCallInternal.call(this, "GetResourceDescendants", request);
   }
 
   RequestAccess(request) {
-    return unaryCall.call(this, "RequestAccess", request);
+    return unaryCallInternal.call(this, "RequestAccess", request);
   }
 
   SaveResource(request) {
-    return unaryCall.call(this, "SaveResource", request);
+    return unaryCallInternal.call(this, "SaveResource", request);
   }
 
   SaveResourceAttribute(request) {
-    return unaryCall.call(this, "SaveResourceAttribute", request);
+    return unaryCallInternal.call(this, "SaveResourceAttribute", request);
   }
 
   SetServiceStatus(request) {
-    return unaryCall.call(this, "SetServiceStatus", request);
+    return unaryCallInternal.call(this, "SetServiceStatus", request);
   }
 
   /**
@@ -1958,82 +2507,82 @@ class VoltClient extends EventEmitter__default["default"] {
    */
 
   Bind(request) {
-    return unaryCall.call(this, "Bind", request);
+    return unaryCallInternal.call(this, "Bind", request);
   }
 
   DeleteAccess(request) {
-    return unaryCall.call(this, "DeleteAccess", request);
+    return unaryCallInternal.call(this, "DeleteAccess", request);
   }
 
   DeleteVolt(request) {
-    return unaryCall.call(this, "DeleteVolt", request);
+    return unaryCallInternal.call(this, "DeleteVolt", request);
   }
 
   GetAccess(request) {
-    return unaryCall.call(this, "GetAccess", request);
+    return unaryCallInternal.call(this, "GetAccess", request);
   }
 
   GetBindings(request) {
-    return unaryCall.call(this, "GetBindings", request);
+    return unaryCallInternal.call(this, "GetBindings", request);
   }
 
   GetIdentities(request) {
-    return unaryCall.call(this, "GetIdentities", request);
+    return unaryCallInternal.call(this, "GetIdentities", request);
   }
 
   GetIdentity(request) {
-    return unaryCall.call(this, "GetIdentity", request);
+    return unaryCallInternal.call(this, "GetIdentity", request);
   }
 
   GetIdentityToken(request) {
-    return unaryCall.call(this, "GetIdentityToken", request);
+    return unaryCallInternal.call(this, "GetIdentityToken", request);
   }
 
   GetPolicy(request) {
-    return unaryCall.call(this, "GetPolicy", request);
+    return unaryCallInternal.call(this, "GetPolicy", request);
   }
 
   GetSettings(request) {
-    return unaryCall.call(this, "GetSettings", request);
+    return unaryCallInternal.call(this, "GetSettings", request);
   }
 
   SaveAccess(request) {
-    return unaryCall.call(this, "SaveAccess", request);
+    return unaryCallInternal.call(this, "SaveAccess", request);
   }
 
   SaveCloudConnection(request) {
-    return unaryCall.call(this, "SaveCloudConnection", request);
+    return unaryCallInternal.call(this, "SaveCloudConnection", request);
   }
 
   SaveIdentity(request) {
-    return unaryCall.call(this, "SaveIdentity", request);
+    return unaryCallInternal.call(this, "SaveIdentity", request);
   }
 
   SaveSettings(request) {
-    return unaryCall.call(this, "SaveSettings", request);
+    return unaryCallInternal.call(this, "SaveSettings", request);
   }
 
   SetAccessRequestDecision(request) {
-    return unaryCall.call(this, "SetAccessRequestDecision", request);
+    return unaryCallInternal.call(this, "SetAccessRequestDecision", request);
   }
 
   SetBindingDecision(request) {
-    return unaryCall.call(this, "SetBindingDecision", request);
+    return unaryCallInternal.call(this, "SetBindingDecision", request);
   }
 
   Shutdown(request) {
-    return unaryCall.call(this, "Shutdown", request);
+    return unaryCallInternal.call(this, "Shutdown", request);
   }
 
   SignVerify(request) {
-    return unaryCall.call(this, "SignVerify", request);
+    return unaryCallInternal.call(this, "SignVerify", request);
   }
 
   /**
    * FileAPI
    */
   GetFileDescendants(request) {
-    return unaryCall.call(this, "GetFileDescendants", request);
+    return unaryCallInternal.call(this, "GetFileDescendants", request);
   }
 
   /**
@@ -2047,11 +2596,19 @@ class VoltClient extends EventEmitter__default["default"] {
     const downloadCall = new GRPCCall(
       this,
       "DownloadFile",
-      "METHOD_TYPE_SERVER_STREAM",
+      "METHOD_TYPE_SERVER_STREAM"
     );
     return downloadCall.start(grpcClient, request);
   }
 
+  GetFileContent(request) {
+    return unaryCallInternal.call(this, "GetFileContent", request);
+  }
+
+  SetFileContent(request) {
+    return unaryCallInternal.call(this, "SetFileContent", request);
+  }
+
   UploadFile(request) {
     const grpcClient = this.getVoltAPIClient();
 
@@ -2073,7 +2630,7 @@ class VoltClient extends EventEmitter__default["default"] {
       const call = new GRPCCall(
         this,
         "DownloadFile",
-        "METHOD_TYPE_SERVER_STREAM",
+        "METHOD_TYPE_SERVER_STREAM"
       );
 
       call.on("data", (response) => {
@@ -2111,6 +2668,10 @@ class VoltClient extends EventEmitter__default["default"] {
   /**
    * SqliteDatabaseAPI
    */
+  BulkUpdate(request) {
+    return unaryCallInternal.call(this, "BulkUpdate", request);
+  }
+
   SqlExecute(request) {
     const grpcClient = this.getVoltAPIClient();
 
@@ -2194,7 +2755,7 @@ class VoltClient extends EventEmitter__default["default"] {
     const subscribeCall = new GRPCCall(
       this,
       "SubscribeWire",
-      "METHOD_TYPE_BIDI",
+      "METHOD_TYPE_BIDI"
     );
     return subscribeCall.start(grpcClient, request);
   }