@tdxvolt/volt-client-grpc 0.16.0-beta.1 → 0.16.0-beta.12

package/lib/index.cjs

@@ -4,37 +4,32 @@ Object.defineProperty(exports, '__esModule', { value: true });
 
 var lodash = require('lodash');
 var ip = require('ip');
-var forge = require('node-forge');
-var bs58 = require('bs58');
 var debug = require('debug');
 var EventEmitter = require('events');
 var fs = require('fs');
-var jwt = require('jsonwebtoken');
-var crypto = require('crypto');
+var voltClientWeb = require('@tdxvolt/volt-client-web');
 var path = require('path');
 var protoLoader = require('@grpc/proto-loader');
 var url = require('url');
 var bent = require('bent');
+var jwt = require('jsonwebtoken');
 var uuid = require('uuid');
 
 function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
 
 var lodash__default = /*#__PURE__*/_interopDefaultLegacy(lodash);
 var ip__default = /*#__PURE__*/_interopDefaultLegacy(ip);
-var forge__default = /*#__PURE__*/_interopDefaultLegacy(forge);
-var bs58__default = /*#__PURE__*/_interopDefaultLegacy(bs58);
 var debug__default = /*#__PURE__*/_interopDefaultLegacy(debug);
 var EventEmitter__default = /*#__PURE__*/_interopDefaultLegacy(EventEmitter);
 var fs__default = /*#__PURE__*/_interopDefaultLegacy(fs);
-var jwt__default = /*#__PURE__*/_interopDefaultLegacy(jwt);
-var crypto__default = /*#__PURE__*/_interopDefaultLegacy(crypto);
 var path__default = /*#__PURE__*/_interopDefaultLegacy(path);
 var protoLoader__default = /*#__PURE__*/_interopDefaultLegacy(protoLoader);
 var bent__default = /*#__PURE__*/_interopDefaultLegacy(bent);
+var jwt__default = /*#__PURE__*/_interopDefaultLegacy(jwt);
 
 // eslint-disable-next-line import/prefer-default-export
 const constants = {
-  authTokenName: "tdx-token",
+  authTokenName: "volt-token",
   collectionOperation: {
     add: "ADD",
     remove: "REMOVE",
@@ -57,9 +52,9 @@ const constants = {
     ],
     userIdOID: "0.9.2342.19200300.100.1.1"
   },
-  defaultDIDHostName: "cloud.tdxvolt.com",
+  defaultDIDHostName: "tdxvolt.com",
   didServiceType: {
-    voltConfig: "tdx-volt-config"
+    voltConfig: "volt-discovery"
   },
   identityType: {
     did: "did",
@@ -70,8 +65,6 @@ const constants = {
     online: "online",
     unknown: "unknown"
   },
-  publicKeyPrefix: "-----BEGIN PUBLIC KEY-----",
-  privateKeyPrefix: "-----BEGIN RSA PRIVATE KEY-----",
   privateEncryptedKeyPrefix: "-----BEGIN ENCRYPTED PRIVATE KEY-----",
   resource: {
     identity: "ident",
@@ -108,8 +101,6 @@ const constants = {
   tunnelTimeoutInterval: 10000 * 2 // This must always be greater than `tunnelPingInterval`.
 };
 
-const { pki: pki$2 } = forge__default["default"];
-
 const createSecureContextOptions = (cryptoOptions) => {
   const tlsOptions = {
     cert: Buffer.from(cryptoOptions.cert),
@@ -139,53 +130,7 @@ const getServiceAddress = (mdnsService) => {
   return address;
 };
 
-const privateKeyToPem = (keyPair) => {
-  return pki$2.privateKeyToPem(keyPair.privateKey);
-};
-
-const publicKeyToPem = (keyPair) => {
-  return pki$2.publicKeyToPem(keyPair.publicKey);
-};
-
-const deserialisePEM = (pem) => {
-  return pem.replace(/\\r\\n/g, "\r\n");
-};
-
-const removeCarriageReturn = (inp) => {
-  return inp.replace(/\r\n/g, "\n");
-};
-
-const createBase58Hash = (inp) => {
-  const md = forge__default["default"].md.sha256.create();
-  md.update(inp);
-  const hashBuf = Buffer.from(md.digest().getBytes(), "binary");
-  return bs58__default["default"].encode(hashBuf);
-};
-
-const createPublicKeyFingerprint = (key) => {
-  // Remove carriage returns before creating hash to bring into line with openSSL / volt format.
-  return createBase58Hash(removeCarriageReturn(key));
-};
-
-const base64ToBase64Url = (base64) => {
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-};
-
-const signBase64 = (key, msg) => {
-  const md = forge__default["default"].md.sha256.create();
-  md.update(msg);
-  const signature = key.sign(md);
-  const base64Standard = forge__default["default"].util.encode64(signature);
-  return base64ToBase64Url(base64Standard);
-};
-
-const verifyBase64 = (key, msg, signature) => {
-  const md = forge__default["default"].md.sha256.create();
-  md.update(msg);
-  return key.verify(md.digest().bytes(), forge__default["default"].util.decode64(signature));
-};
-
-const getDIDResolutionURL = (didIn) => {
+const getDIDResolutionURL = (didIn, registryUrl = "") => {
   const did = didIn.toLowerCase().split(":");
   if (did.length < 3) {
     return "";
@@ -195,97 +140,19 @@ const getDIDResolutionURL = (didIn) => {
     return "";
   }
 
-  if (did[1] !== "tdx") {
+  if (did[1] !== "volt") {
     return "";
   }
 
-  let hostName;
-  let didGUID;
-  if (did.length === 3) {
-    hostName = constants.defaultDIDHostName;
-    didGUID = did[2];
-  } else {
-    hostName = did[2];
-    didGUID = did[3];
-  }
-
-  return `https://${hostName}/api/identity/${didGUID}`;
-};
-
-const forgePrivateKeyToPem = (decryptedKey) => {
-  // Convert a Forge private key to an ASN.1 RSAPrivateKey
-  const asnPrivateKey = pki$2.privateKeyToAsn1(decryptedKey);
-
-  // Wrap an RSAPrivateKey ASN.1 object in a PKCS#8 ASN.1 PrivateKeyInfo
-  const privateKeyInfo = pki$2.wrapRsaPrivateKey(asnPrivateKey);
-
-  // Convert a PKCS#8 ASN.1 PrivateKeyInfo to PEM
-  return pki$2.privateKeyInfoToPem(privateKeyInfo);
-};
-
-const createRSAKey = (passphrase = "") => {
-  return new Promise((resolve, reject) => {
-    pki$2.rsa.generateKeyPair({ bits: 2048, workers: -1 }, (err, keypair) => {
-      if (err) {
-        reject(err);
-      } else {
-        let pem;
-        if (passphrase) {
-          pem = pki$2.encryptRsaPrivateKey(keypair.privateKey, passphrase);
-        } else {
-          pem = forgePrivateKeyToPem(keypair.privateKey);
-        }
-
-        resolve({ keypair, pem });
-      }
-    });
-  });
-};
-
-const sha256Base64 = (msg) => {
-  const md = forge__default["default"].md.sha256.create();
-  md.update(msg);
-  const base64Standard = forge__default["default"].util.encode64(md.digest().bytes());
-  return base64ToBase64Url(base64Standard);
-};
-
-const decryptPrivateKey = (pem, passphrase) => {
-  const decryptedKey = pki$2.decryptRsaPrivateKey(pem, passphrase);
-  return forgePrivateKeyToPem(decryptedKey);
-};
-
-const jwsSignature = (signature) => {
-  //
-  // Use an unattached payload JWS signature for the DID document proof.
-  // This is a JWS with an empty payload and a detached payload digest.
-  //
-  // (https://tools.ietf.org/html/rfc7797#appendix-F) as used in the VC spec
-  // (https://www.w3.org/TR/vc-data-model/).
-  //
-  const jwsHeader = base64ToBase64Url(
-    forge__default["default"].util.encode64('{"alg":"RS256","b64": false}')
-  );
-  return jwsHeader + ".." + signature;
+  const lookupUrl = registryUrl || `https://${constants.defaultDIDHostName}`;
+  return `${lookupUrl}/did/${didIn}`;
 };
 
 var utils = /*#__PURE__*/Object.freeze({
   __proto__: null,
   createSecureContextOptions: createSecureContextOptions,
   getServiceAddress: getServiceAddress,
-  privateKeyToPem: privateKeyToPem,
-  publicKeyToPem: publicKeyToPem,
-  deserialisePEM: deserialisePEM,
-  removeCarriageReturn: removeCarriageReturn,
-  createBase58Hash: createBase58Hash,
-  createPublicKeyFingerprint: createPublicKeyFingerprint,
-  base64ToBase64Url: base64ToBase64Url,
-  signBase64: signBase64,
-  verifyBase64: verifyBase64,
-  getDIDResolutionURL: getDIDResolutionURL,
-  createRSAKey: createRSAKey,
-  sha256Base64: sha256Base64,
-  decryptPrivateKey: decryptPrivateKey,
-  jwsSignature: jwsSignature
+  getDIDResolutionURL: getDIDResolutionURL
 });
 
 /* eslint-disable no-underscore-dangle */
@@ -307,8 +174,11 @@ function createClient(
 ) {
   let grpcCredentials;
   if (credentials) {
-    const ca = credentials.config?.volt?.relay?.ca_pem || credentials.cache.ca;
-    const cert = credentials.cache.cloud_cert || credentials.cache.cert;
+    const relaying = !!credentials.config?.volt?.relay;
+    const ca = relaying
+      ? credentials.config?.volt?.relay?.ca_pem
+      : credentials.cache.ca;
+    const cert = relaying ? "" : credentials.cache.cert;
     const { key } = credentials.cache;
 
     if (key && cert) {
@@ -320,8 +190,9 @@ function createClient(
         tlsOptions.cert
       );
     } else {
-      // Cache has no private key, this implies we are connecting without supplying a client certificate.
-      // Simply connect using the CA certificate.
+      // Cache has no private key or certificate, this implies we are connecting without supplying a client certificate.
+      // We might be connecting to a relay, or making an initial Authenticate call.
+      // Simply connect using the CA certificate, and the a JWT will be used to authenticate.
       grpcCredentials = grpc.credentials.createSsl(Buffer.from(ca));
     }
   } else {
@@ -527,10 +398,7 @@ var grpcUtils = /*#__PURE__*/Object.freeze({
 
 /* eslint-disable no-underscore-dangle */
 
-const { pki: pki$1 } = forge__default["default"];
 const log$5 = debug__default["default"]("volt-client-grpc:volt-credential");
-const aesAlgorithm = "aes-256-cbc";
-const rs256Algorithm = "RS256";
 
 class VoltCredential {
   constructor(config, configPath) {
@@ -554,14 +422,13 @@ class VoltCredential {
       }
 
       // Need to unencrypt the private key.
-      const decrypted = pki$1.decryptRsaPrivateKey(
-        this._cryptoCache.key,
-        config.p
-      );
+      const decrypted = voltClientWeb.keyFromPem(this._cryptoCache.key, config.p);
+
       if (!decrypted) {
         throw new Error("failed to decrypt key - check passphrase");
       }
-      this._cryptoCache.key = pki$1.privateKeyToPem(decrypted);
+
+      this._cryptoCache.key = voltClientWeb.privateKeyToPem(decrypted);
     }
 
     if (this._voltConfig.ca_pem) {
@@ -570,14 +437,11 @@ class VoltCredential {
         this._cryptoCache.ca = this._voltConfig.ca_pem;
       }
 
-      // Pre-cache the target Volt public key by extracting it from the signing certificate.
-      const voltCert = forge__default["default"].pki.certificateFromPem(this._voltConfig.ca_pem);
-
       // Extract Volt public key (used for encrypting Relay payloads).
-      this._voltPublicKey = forge__default["default"].pki.publicKeyToPem(voltCert.publicKey);
-      this._voltFingerprint = createPublicKeyFingerprint(
-        this._voltPublicKey
-      );
+      this._voltPublicKey = this._voltConfig.public_key;
+
+      const voltKey = voltClientWeb.keyFromPem(this._voltPublicKey).publicKey;
+      this._voltFingerprint = voltClientWeb.fingerprintFromPublicKey(voltKey);
     }
   }
 
@@ -589,8 +453,16 @@ class VoltCredential {
     return this._cryptoCache;
   }
 
-  get clientId() {
-    return this._cryptoCache.client_id;
+  get certificate() {
+    return this._cryptoCache.cert;
+  }
+
+  get sessionId() {
+    return this._cryptoCache.session_id;
+  }
+
+  get identityId() {
+    return this._cryptoCache.identity_did;
   }
 
   get voltPublicKey() {
@@ -598,7 +470,7 @@ class VoltCredential {
   }
 
   get publicKey() {
-    return pki$1.publicKeyToPem(this.getKey().publicKey);
+    return voltClientWeb.publicKeyToPem(this.getKey().publicKey);
   }
 
   get voltFingerprint() {
@@ -606,9 +478,8 @@ class VoltCredential {
   }
 
   getKey() {
-    const privateKey = pki$1.privateKeyFromPem(this._cryptoCache.key);
-    const publicKey = pki$1.rsa.setPublicKey(privateKey.n, privateKey.e);
-    return { privateKey, publicKey };
+    const key = voltClientWeb.keyFromPem(this._cryptoCache.key);
+    return key;
   }
 
   /**
@@ -621,16 +492,10 @@ class VoltCredential {
       return Promise.resolve(this.getKey());
     } else {
       log$5("creating key");
-      return createRSAKey()
-        .then((keyInfo) => {
-          log$5("successfully created key");
-          this._cryptoCache.key = keyInfo.pem;
-          return keyInfo.keypair;
-        })
-        .catch((err) => {
-          log$5("failure creating key [%s]", err.message);
-          return Promise.reject(err);
-        });
+      this._cryptoCache.key = voltClientWeb.createKey();
+      const key = voltClientWeb.keyFromPem(this._cryptoCache.key);
+      log$5("successfully created key");
+      return Promise.resolve(key);
     }
   }
 
@@ -655,55 +520,6 @@ class VoltCredential {
     return !!this._cryptoCache.cert;
   }
 
-  /**
-   * Signs the identity resource id using the private key.
-   * @param {*} audience the token audience (usually the target volt)
-   * @param {*} tunnelling flag indicating if the token is required for a tunnelled connection
-   * @param {*} ttl time to live in seconds (default to 1 minute)
-   */
-  getIdentityToken(audience, publicKey, tunnelling = false, ttl = 60) {
-    if (!this._cryptoCache.key) {
-      throw new Error("crypto cache invalid");
-    }
-
-    const keyPair = this.getKey();
-    const publicKeyPem = pki$1.publicKeyToPem(keyPair.publicKey);
-    const base58Key = createPublicKeyFingerprint(publicKeyPem);
-
-    log$5("base58 key is %s", base58Key);
-
-    // Allow TTL either side of the current time.
-    // @todo - fix with server time sync on volt connection.
-    const payload = {
-      aud: audience,
-      iat: Math.floor(Date.now() / 1000) - ttl,
-      exp: Math.floor(Date.now() / 1000) + ttl,
-      sub: this._cryptoCache.client_id
-    };
-
-    let sharedKey;
-    if (tunnelling) {
-      // Initialise the Relay encryption key.
-      sharedKey = VoltCredential.aesCreateKey();
-
-      // Encrypt the key details using the target Volt public key and include this in the JWT payload.
-      payload.sk = VoltCredential.rsaEncrypt(publicKey, sharedKey.key);
-      payload.iv = VoltCredential.rsaEncrypt(publicKey, sharedKey.iv);
-    }
-
-    // Sign synchronously.
-    const token = jwt__default["default"].sign(payload, this._cryptoCache.key, {
-      algorithm: rs256Algorithm,
-      keyid: base58Key
-    });
-
-    // Return the token along with any encryption key details.
-    return {
-      token,
-      sharedKey
-    };
-  }
-
   /**
    * Creates the metadata required for a grpc call, including the Volt authentication token
    * and optionally tunnel encryption parameters.
@@ -714,9 +530,12 @@ class VoltCredential {
    * @returns
    */
   getIdentityMetadata(grpc, audience, publicKey, tunnelling = false, ttl = 60) {
-    const identityToken = this.getIdentityToken(
+    const key = voltClientWeb.keyFromPem(this._cryptoCache.key);
+
+    const identityToken = voltClientWeb.getIdentityToken(
+      this.sessionId,
+      key,
       audience || this._voltConfig.id,
-      publicKey,
       tunnelling,
       ttl
     );
@@ -726,48 +545,18 @@ class VoltCredential {
   }
 
   saveCache() {
+    const clone = { ...this._config, credential: { ...this._cryptoCache } };
+    if (this._config.p) {
+      // A passphrase option exists => encrypt the key before writing the cache file.
+      const key = voltClientWeb.keyFromPem(this._cryptoCache.key);
+      clone.credential.key = voltClientWeb.privateKeyToPem(key.privateKey, this._config.p);
+    }
+
     if (this._persistCache) {
-      const clone = { ...this._config, credential: { ...this._cryptoCache } };
-      if (this._config.p) {
-        // A passphrase option exists => encrypt the key before writing the cache file.
-        const privateKey = pki$1.privateKeyFromPem(this._cryptoCache.key);
-        clone.credential.key = pki$1.encryptRsaPrivateKey(
-          privateKey,
-          this._config.p
-        );
-      }
       fs__default["default"].writeFileSync(this._configPath, JSON.stringify(clone, null, 2));
     }
-  }
-
-  static aesCreateKey() {
-    // Generate random key for the AES-256 algorithm (32 bytes = 256 bits).
-    const key = crypto__default["default"].randomBytes(32);
-    const iv = crypto__default["default"].randomBytes(16);
-    return { key, iv };
-  }
 
-  static aesEncrypt(buffer, key, iv) {
-    const cipher = crypto__default["default"].createCipheriv(aesAlgorithm, key, iv);
-    const crypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
-    return crypted;
-  }
-
-  static aesDecrypt(buffer, key, iv) {
-    const cipher = crypto__default["default"].createDecipheriv(aesAlgorithm, key, iv);
-    const decrypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
-    return decrypted;
-  }
-
-  static rsaEncrypt(key, buffer) {
-    const cipher = crypto__default["default"].publicEncrypt(key, buffer);
-    return cipher.toString("base64url");
-  }
-
-  static rsaDecrypt(key, buffer) {
-    const keyObj = crypto__default["default"].createPrivateKey(key);
-    const cipher = Buffer.from(buffer, "base64url");
-    return Buffer.from(crypto__default["default"].privateDecrypt(keyObj, cipher));
+    return clone;
   }
 }
 
@@ -910,6 +699,21 @@ function _prepareInvokeRequest(
     this._service?.service_description.host_type ===
     "SERVICE_HOST_TYPE_RELAYED";
 
+  const relaying = this._voltClient.isVoltRelay || isServiceRelayed;
+
+  let targetDID = [];
+  if (this._voltClient.isVoltRelay) {
+    targetDID.push(this._voltClient.voltConfig.id);
+  }
+
+  if (isServiceRelayed) {
+    // Add another relay hop if the target service is relayed.
+    log$4("target service is relayed");
+    targetDID.push(this._service.service_description.host_client_id);
+  }
+
+  log$4("target is %j", targetDID);
+
   // Use the service's host client id and public key if the service is relayed.
   const methodToken = this._voltClient.credential.getIdentityMetadata(
     this._voltClient.grpc,
@@ -917,17 +721,52 @@ function _prepareInvokeRequest(
       this._voltClient.voltConfig.id,
     this._service?.service_description.host_public_key ||
       this._voltClient.credential.voltPublicKey,
-    true
+    relaying
   );
 
   let invokeRequest;
   let callMethod = method;
 
-  if (this._voltClient.isVoltRelay || isServiceRelayed) {
+  if (relaying) {
     //
     // If the volt connection is via a relay (or the target service is relayed),
     // we wrap the rpc in a RemoteRequest message and send it via a call to Invoke().
     //
+    // Replace the target method with a call to Invoke on the relay Volt.
+    //
+    callMethod = "Invoke";
+
+    // But first we need to perform a key exchange with the target service.
+    //
+    if (!this._encryptionKey) {
+      // We haven't exchanged keys yet, so queue the payload.
+      this._pendingRequests.push(request);
+
+      if (this._keyExchangePending) {
+        // We've already sent the key exchange request, so do nothing.
+        log$4("key exchange pending, not sending payload");
+        return;
+      }
+
+      this._keyExchangePending = true;
+
+      // Send the key exchange request.
+      invokeRequest = {
+        token: methodToken.token,
+        target_did: targetDID,
+        target_service_id: isServiceRelayed
+          ? this._service.service_description.host_service_id
+          : undefined
+      };
+
+      return {
+        request: invokeRequest,
+        method: callMethod,
+        methodName: method,
+        meta: methodToken
+      };
+    }
+
     let requestPayload;
 
     // Serialise the rpc request.
@@ -947,45 +786,24 @@ function _prepareInvokeRequest(
       method_invoke: {
         method_name: this._grpcClient[method].path,
         method_type: methodType,
-        token: methodToken.token,
         request: requestPayload
       }
     };
 
-    let targetDID = [];
     let invokePayload;
-    if (this._voltClient.isVoltRelay || isServiceRelayed) {
-      // When sending via a relay we need to encrypt the payload.
-      invokePayload = VoltCredential.aesEncrypt(
-        tunnelMethod.responseSerialize(tunnelResp),
-        methodToken.sharedKey.key,
-        methodToken.sharedKey.iv
-      );
-    } else {
-      invokePayload = tunnelMethod.responseSerialize(tunnelResp);
-    }
-
-    if (this._voltClient.isVoltRelay) {
-      targetDID.push(this._voltClient.voltConfig.id);
-    }
-
-    if (isServiceRelayed) {
-      // Add another relay hop if the target service is relayed.
-      log$4("target service is relayed");
-      targetDID.push(this._service.service_description.host_client_id);
-    }
+    const iv = voltClientWeb.aesCreateKey().iv;
 
-    log$4("target is %j", targetDID);
+    // When sending via a relay we need to encrypt the payload.
+    invokePayload = voltClientWeb.aesEncrypt(
+      this._encryptionKey,
+      iv,
+      tunnelMethod.responseSerialize(tunnelResp)
+    );
 
     invokeRequest = {
-      target_did: targetDID,
-      token: methodToken.token,
-      payload: invokePayload,
-      target_service_id: isServiceRelayed ? this._service.id : undefined
+      iv,
+      payload: invokePayload
     };
-
-    // Replace the target method with a call to Invoke on the relay Volt.
-    callMethod = "Invoke";
   } else {
     invokeRequest = request;
   }
@@ -1005,7 +823,10 @@ function _preparePayloadRequest(request, invokeInfo) {
     this._service?.service_description.host_type ===
     "SERVICE_HOST_TYPE_RELAYED";
 
+  let iv;
   if (this._voltClient.isVoltRelay || isServiceRelayed) {
+    iv = voltClientWeb.aesCreateKey().iv;
+
     const requestPayload =
       this._grpcClient[invokeInfo.methodName].requestSerialize(request);
 
@@ -1018,13 +839,14 @@ function _preparePayloadRequest(request, invokeInfo) {
       }
     };
 
-    const invokePayload = VoltCredential.aesEncrypt(
-      tunnelMethod.responseSerialize(tunnelResp),
-      invokeInfo.meta.sharedKey.key,
-      invokeInfo.meta.sharedKey.iv
+    const invokePayload = voltClientWeb.aesEncrypt(
+      this._encryptionKey,
+      iv,
+      tunnelMethod.responseSerialize(tunnelResp)
     );
 
     payloadRequest = {
+      iv,
       payload: invokePayload
     };
   } else {
@@ -1043,13 +865,38 @@ function _parseResponse(method, meta, response) {
     "SERVICE_HOST_TYPE_RELAYED";
 
   if (this._voltClient.isVoltRelay || isServiceRelayed) {
-    if (response.payload) {
+    if (response.key_exchange) {
+      const encryptionKey = response.key_exchange.encryption_key;
+      const nonce = response.key_exchange.nonce;
+      const signature = response.key_exchange.signature;
+
+      // The signed message is the encryption key and the nonce.
+      const message = new Uint8Array(encryptionKey.length + nonce.length);
+      message.set(encryptionKey);
+      message.set(nonce, encryptionKey.length);
+
+      // Check the signature using the target service public key.
+      const targetKey = voltClientWeb.keyFromPem(
+        this._service?.service_description?.host_public_key ||
+          this._voltClient.credential.voltPublicKey
+      ).publicKey;
+
+      if (!voltClientWeb.verify(targetKey, message, signature)) {
+        throw new Error("signature verification failed");
+      }
+
+      invokeResponse = {
+        key_exchange: {
+          encryption_key: voltClientWeb.formatPEM(voltClientWeb.toBase64(encryptionKey), "PUBLIC KEY")
+        }
+      };
+    } else if (response.payload) {
       let decryptedPayload;
-      if (meta.sharedKey.key) {
-        decryptedPayload = VoltCredential.aesDecrypt(
-          response.payload,
-          meta.sharedKey.key,
-          meta.sharedKey.iv
+      if (this._encryptionKey) {
+        decryptedPayload = voltClientWeb.aesDecrypt(
+          this._encryptionKey,
+          response.iv,
+          response.payload
         );
       } else {
         decryptedPayload = response.payload;
@@ -1089,11 +936,11 @@ function _parseResponse(method, meta, response) {
       invokeResponse.methodId = response.invoke_id;
       log$4("started method %d for %s", invokeResponse.methodId, method);
     }
-  } else if (this._voltClient.isRemote && meta.sharedKey.key) {
-    const decryptedPayload = VoltCredential.aesDecrypt(
-      response,
-      meta.sharedKey.key,
-      meta.sharedKey.iv
+  } else if (this._voltClient.isRemote && this._encryptionKey) {
+    const decryptedPayload = voltClientWeb.aesDecrypt(
+      this._encryptionKey,
+      meta.sharedKey.iv,
+      response
     );
     invokeResponse = {
       payload:
@@ -1114,6 +961,9 @@ class GRPCCall extends EventEmitter__default["default"] {
     this._call = null;
     this._voltClient = voltClient;
     this._service = service;
+    this._keyExchangePending = false;
+    this._pendingRequests = [];
+    this._encryptionKey = null;
   }
 
   start(grpcClient, request) {
@@ -1142,7 +992,7 @@ class GRPCCall extends EventEmitter__default["default"] {
     }
 
     this._call = callClient[this._initialRequest.method](
-      this._initialRequest.meta.metadata
+      this._initialRequest?.meta?.metadata
     );
 
     this._call.on("data", (streamResponse) => {
@@ -1153,7 +1003,25 @@ class GRPCCall extends EventEmitter__default["default"] {
           this._initialRequest.meta,
           streamResponse
         );
-        if (parsedResponse.payload) {
+        if (parsedResponse.key_exchange) {
+          const peerKey = voltClientWeb.keyFromPem(
+            parsedResponse.key_exchange.encryption_key
+          ).publicKey;
+
+          this._encryptionKey = voltClientWeb.deriveSharedKey(
+            this._initialRequest.meta.sharedKey.key,
+            peerKey,
+            voltClientWeb.x25519
+          );
+
+          // We've exchanged keys, so send any queued payloads on the next tick.
+          process.nextTick(() => {
+            this._pendingRequests.forEach((pendingRequest) => {
+              this.write(pendingRequest);
+            });
+            this._pendingRequests = [];
+          });
+        } else if (parsedResponse.payload) {
           // Interpret a non-empty status message as an error.
           if (parsedResponse.payload?.status?.message) {
             this.emit(
@@ -1228,7 +1096,7 @@ class GRPCCall extends EventEmitter__default["default"] {
     if (!this._call) {
       log$4("ERROR - call not initialised");
       throw new Error("call not initialised");
-    } else if (this._initialRequest) {
+    } else if (this._initialRequest && !this._keyExchangePending) {
       const payloadRequest = _preparePayloadRequest.call(
         this,
         request,
@@ -1236,6 +1104,8 @@ class GRPCCall extends EventEmitter__default["default"] {
       );
       return this._call.write(payloadRequest);
     } else {
+      this._keyExchangePending = false;
+
       this._initialRequest = _prepareInvokeRequest.call(
         this,
         request,
@@ -1265,10 +1135,9 @@ function _cleanUp(immediateReconnect) {
     this._pingTimeoutTimer = 0;
   }
 
-  if (
-    !this._dying &&
-    (immediateReconnect || (this._autoRetry && !this._reconnectTimer))
-  ) {
+  if (this._dying) {
+    clearTimeout(this._reconnectTimer);
+  } else if (immediateReconnect || (this._autoRetry && !this._reconnectTimer)) {
     this._reconnectTimer = setTimeout(
       () => {
         this._reconnectTimer = 0;
@@ -1294,13 +1163,18 @@ function _doConnect(connectHello) {
 
   const grpcClient = this._voltClient.getVoltAPIClient();
 
-  let helloPayload = connectHello;
-  if (!helloPayload) {
-    log$3("defaulting hello payload");
-    helloPayload = {
-      hello: {}
-    };
-  }
+  // Notify the Volt of our ping interval. If the Volt doesn't receive a ping from us
+  // within this time, it will assume the connection is dead.
+  const defaultHello = {
+    ping_interval: this._pingInterval,
+    timestamp: Date.now()
+  };
+
+  const helloPayload = { ...connectHello } || {};
+
+  helloPayload.hello = { ...defaultHello, ...connectHello?.hello };
+
+  log$3("hello is %j", helloPayload);
 
   this.call.on("error", (err) => {
     log$3("error on connection stream [%s]", err.message);
@@ -1318,17 +1192,22 @@ function _doConnect(connectHello) {
           clearTimeout(this._pingTimeoutTimer);
         }
 
-        // Schedule the next ping.
-        _startPingTimer.call(this);
-
         this.emit("ping", response.ping.timestamp);
         break;
       }
       case "acknowledge": {
         if (!this._connectionId) {
           this._connectionId = response.acknowledge.connection_id;
+
+          // Set the ping timeout interval to the value returned by the Volt. If we don't
+          // hear from the Volt in this time, we'll assume the connection is dead.
+          this._timeoutInterval = response.acknowledge.ping_interval;
+
           log$3("connection id is %s", this._connectionId);
           this.emit("connected", this._connectionId);
+
+          // Schedule the next ping.
+          _startPingTimer.call(this);
         }
         break;
       }
@@ -1356,8 +1235,6 @@ function _doConnect(connectHello) {
   });
 
   this.call.start(grpcClient, helloPayload);
-
-  _startPingTimer.call(this);
 }
 
 function _startPingTimer() {
@@ -1384,6 +1261,8 @@ function _startPingTimer() {
       _connectionTimeoutHandler.bind(this),
       this._timeoutInterval
     );
+
+    _startPingTimer.call(this);
   }, this._pingInterval);
 }
 
@@ -1431,13 +1310,13 @@ class RpcInvocation extends EventEmitter__default["default"] {
   #voltClient = null;
   #voltConnection = null;
   #token = null;
-  #encryptKey = null;
-  #encryptIV = null;
   #invokeId = null;
   #payload = null;
   #isJSON = false;
   #methodDescriptor = null;
   #methodName = null;
+  #derivedKey = null;
+  #started = false;
 
   constructor(voltClient, voltConnection) {
     super();
@@ -1481,51 +1360,89 @@ class RpcInvocation extends EventEmitter__default["default"] {
     this.#methodDescriptor = methodDescriptor;
   }
 
-  #decodeToken(token) {
+  get started() {
+    return this.#started;
+  }
+
+  #keyExchange(token) {
     // We don't verify the token at this point, as we don't know the public key.
     // The rpc implementation should do the verification using the Volt API (e.g. CanAccessResource).
     this.#token = jwt__default["default"].decode(token);
 
-    if (this.#token.sk) {
-      // Decrypt the shared key and iv using the private key.
-      this.#encryptKey = VoltCredential.rsaDecrypt(
-        this.#voltClient.credential.cache.key,
-        this.#token.sk
-      );
-      this.#encryptIV = VoltCredential.rsaDecrypt(
-        this.#voltClient.credential.cache.key,
-        this.#token.iv
-      );
-    }
+    // Store the JWT key id (kid) for use in the response.
+    const callerPublicKeyPem = voltClientWeb.formatPEM(this.#token.k, "PUBLIC KEY");
+    const callerKey = voltClientWeb.keyFromPem(callerPublicKeyPem, "", voltClientWeb.x25519).publicKey;
+
+    const ephemeralKeyPem = voltClientWeb.createEncryptionKey();
+    const ephemeralKey = voltClientWeb.keyFromPem(ephemeralKeyPem, "", voltClientWeb.x25519);
+    const ephemeralPublicKey = voltClientWeb.fromBase64(
+      voltClientWeb.stripPEMHeaders(voltClientWeb.publicKeyToPem(ephemeralKey.publicKey, voltClientWeb.x25519))
+    );
+
+    this.#derivedKey = voltClientWeb.deriveSharedKey(
+      ephemeralKey.privateKey,
+      callerKey,
+      voltClientWeb.x25519
+    );
 
-    return Promise.resolve(this.#token);
+    const nonce = voltClientWeb.randomBytes(16);
+
+    // The signed message is the encryption key and the nonce.
+    const message = new Uint8Array(ephemeralPublicKey.length + nonce.length);
+    message.set(ephemeralPublicKey);
+    message.set(nonce, ephemeralPublicKey.length);
+
+    const signature = voltClientWeb.signBase64(
+      this.#voltClient.credential.getKey().privateKey,
+      message
+    );
+
+    const keyExchangeResponse = {
+      invoke_id: this.#invokeId,
+      key_exchange: {
+        nonce,
+        encryption_key: ephemeralPublicKey,
+        signature: voltClientWeb.fromBase64Url(signature)
+      }
+    };
+
+    this.#voltConnection.send({
+      invoke_response: keyExchangeResponse
+    });
+
+    return Promise.resolve(keyExchangeResponse);
   }
 
   initialise(invoke_request) {
     this.#invokeId = invoke_request.invoke_id;
 
-    return this.#decodeToken(invoke_request.token)
-      .then(() => {
-        // Parse the initial payload.
-        return this.parsePayload(invoke_request);
-      })
-      .catch((err) => {
+    if (!this.#derivedKey) {
+      // We don't have the derived key yet, so we need to perform the key exchange.
+      return this.#keyExchange(invoke_request.token).catch((err) => {
         log$2("failure initialising invocation: %s", err.message);
         return Promise.reject(err);
       });
+    } else {
+      // We already have the derived key, so we can just parse the payload.
+      return this.parsePayload(invoke_request);
+    }
   }
 
   parsePayload(invoke_request) {
+    this.#started = true;
+
     return new Promise((resolve, reject) => {
+      const encryptIV = invoke_request.iv;
+
       if (invoke_request.payload) {
         let decryptedPayload;
 
-        if (this.#encryptKey) {
+        if (encryptIV) {
           // Decrypt the actual payload using the shared key and iv.
-          decryptedPayload = VoltCredential.aesDecrypt(
-            invoke_request.payload,
-            this.#encryptKey,
-            this.#encryptIV
+          decryptedPayload = voltClientWeb.aesDecrypt(
+            this.#derivedKey,
+            encryptIV,
+            invoke_request.payload
           );
         } else {
           // No encryption => just use the payload.
@@ -1561,12 +1478,12 @@ class RpcInvocation extends EventEmitter__default["default"] {
 
         this.#isJSON = true;
 
-        if (this.#encryptKey) {
+        if (this.#derivedKey) {
           // Decrypt the actual payload using the shared key and iv.
-          decryptedPayload = VoltCredential.aesDecrypt(
-            Buffer.from(invoke_request.json_payload, "base64"),
-            this.#encryptKey,
-            this.#encryptIV
+          decryptedPayload = voltClientWeb.aesDecrypt(
+            this.#derivedKey,
+            invoke_request.iv,
+            Buffer.from(invoke_request.json_payload, "base64")
           );
         } else {
           // No encryption => just use the payload.
@@ -1625,17 +1542,15 @@ class RpcInvocation extends EventEmitter__default["default"] {
       });
     }
 
-    if (this.#token.sk) {
+    const iv = voltClientWeb.randomBytes(16);
+    if (this.#derivedKey) {
       // Encrypt the response using the shared key and iv.
-      responsePayload = VoltCredential.aesEncrypt(
-        responsePayload,
-        this.#encryptKey,
-        this.#encryptIV
-      );
+      responsePayload = voltClientWeb.aesEncrypt(this.#derivedKey, iv, responsePayload);
     }
 
     const invokeResponse = {
-      invoke_id: this.#invokeId
+      invoke_id: this.#invokeId,
+      iv
     };
 
     if (this.#isJSON) {
@@ -1670,18 +1585,16 @@ class RpcInvocation extends EventEmitter__default["default"] {
       endPayload = tunnelMethod.requestSerialize(endPayload);
     }
 
-    if (this.#token.sk) {
+    const iv = voltClientWeb.randomBytes(16);
+    if (this.#derivedKey) {
       // Encrypt the response using the shared key and iv.
-      endPayload = VoltCredential.aesEncrypt(
-        endPayload,
-        this.#encryptKey,
-        this.#encryptIV
-      );
+      endPayload = voltClientWeb.aesEncrypt(this.#derivedKey, iv, endPayload);
     }
 
     const invokeResponse = {
       invoke_id: this.#invokeId,
-      server_end: true
+      server_end: true,
+      iv
     };
 
     if (this.#isJSON) {
@@ -1698,7 +1611,6 @@ class RpcInvocation extends EventEmitter__default["default"] {
 
 /* eslint-disable no-underscore-dangle */
 
-const { pki } = forge__default["default"];
 const { filter, pick } = lodash__default["default"];
 
 const log$1 = debug__default["default"]("volt-client-grpc:volt-client-internal");
@@ -1734,8 +1646,15 @@ function issueAuthenticate(authenticateRequest, ttl) {
             // This is the signing CA used by the volt.
             this._credential.cache.ca = authenticateResponse.chain;
 
-            // Identity resource id is assigned by the volt.
-            this._credential.cache.client_id = authenticateResponse.session_id;
+            // The session id is assigned by the volt.
+            this._credential.cache.session_id = authenticateResponse.session_id;
+
+            if (!this._credential.cache.identity_did) {
+              // Identity DID has been assigned by the volt.
+              this._credential.cache.identity_did =
+                authenticateResponse.identity_did;
+            }
+
             this._credential.saveCache();
             break;
           }
@@ -1746,6 +1665,20 @@ function issueAuthenticate(authenticateRequest, ttl) {
           case "POLICY_DECISION_PROMPT":
           case "POLICY_DECISION_PENDING": {
             log$1("access pending approval - waiting...");
+
+            // This is the signing CA used by the volt.
+            this._credential.cache.ca = authenticateResponse.chain;
+
+            // The session id is assigned by the volt.
+            this._credential.cache.session_id = authenticateResponse.session_id;
+
+            if (!this._credential.cache.identity_did) {
+              // Identity DID has been assigned by the volt.
+              this._credential.cache.identity_did =
+                authenticateResponse.identity_did;
+            }
+
+            this._credential.saveCache();
             break;
           }
           default:
@@ -1770,8 +1703,10 @@ function findDIDDocumentService(document, serviceType) {
   return matches;
 }
 
-
-async function authenticateInternal() {
+async function authenticateInternal(
+  sessionOnly = false,
+  ownDID = false
+) {
   try {
     // Check if we need to resolve a Relay volt.
     if (
@@ -1783,7 +1718,7 @@ async function authenticateInternal() {
       log$1("attempting to retrieve Relay information from %s", relayURL);
       this._voltConfig.relay = await fetchVoltConfig.call(
         this,
-        `${relayURL}/discovery`
+        `${relayURL}/discover`
       );
 
       if (this._voltConfig.relay.ca_pem) {
@@ -1808,7 +1743,9 @@ async function authenticateInternal() {
     }
 
     const keyPair = this._credential.getKey();
-    const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
+    const publicKeyPem = voltClientWeb.removeCarriageReturn(
+      voltClientWeb.publicKeyToPem(keyPair.publicKey)
+    );
 
     if (!this._credential.cache.bindIp) {
       // Default the IP address if none is specified. This is used to set the SAN in the
@@ -1820,13 +1757,12 @@ async function authenticateInternal() {
 
     // Form the request message.
     const authenticateRequest = {
-      binding_name: this._config.client_name,
-      public_key: publicKeyPem,
-      host: this._credential.cache.bindIp,
+      client_name: this._config.client_name,
+      host: this._credential.cache.bindIp
     };
 
     if (this._voltConfig.challenge_code) {
-      authenticateRequest.challenge = signBase64(
+      authenticateRequest.challenge = voltClientWeb.signBase64(
         keyPair.privateKey,
         this._voltConfig.challenge_code
       );
@@ -1836,6 +1772,60 @@ async function authenticateInternal() {
       );
     }
 
+    if (sessionOnly) {
+      // We want to create a session-based authentication based simply on our key, rather than a
+      // fully-blown DID-based authentication.
+      log$1("creating session-only request");
+      authenticateRequest.public_key = publicKeyPem;
+    } else if (!this._credential.cache.identity_did) {
+      if (!ownDID) {
+        // We don't want to have to manage our own DID, so we ask the Volt to do it for us.
+        // The Volt will create a new DID and return it to us in the response.
+        log$1("creating DID-based request");
+        authenticateRequest.did_public_key = publicKeyPem;
+      } else {
+        // We want to create and manage our own DID.
+        const did =
+          (this._credential.cache.identity_did = `did:volt:${uuid.v4()}`);
+
+        // Order of properties in the DID document is important,
+        // they must be in alphabetical order throughout the document.
+        // This is because the DID document is signed and the signature
+        // is over the entire document.
+        const didDocument = {
+          "@context": "https://www.w3.org/ns/did/v1",
+          authentication: [`${did}#key-1`],
+          controller: did,
+          description: this._config.client_name,
+          id: did,
+          verificationMethod: [
+            {
+              id: `${did}#key-1`,
+              publicKeyPem: publicKeyPem,
+              type: "Ed25519VerificationKey2018"
+            }
+          ]
+        };
+
+        // Set the DID document with proof in the authenticate request.
+        authenticateRequest.did_document = JSON.stringify(didDocument, null, 2);
+
+        // Now sign the entire DID document, including the proof and set it in the
+        // bind request. This is required by the Volt to verify that we have the private key for the DID.
+        authenticateRequest.did_document_signature = voltClientWeb.signBase64(
+          keyPair.privateKey,
+          authenticateRequest.did_document
+        );
+
+        log$1("did document is %s", authenticateRequest.did_document);
+        log$1("did signature is %s", authenticateRequest.did_document_signature);
+      }
+    } else {
+      // We already have a DID cached, so re-use it.
+      log$1("using cached DID %s", this._credential.cache.identity_did);
+      authenticateRequest.did = this._credential.cache.identity_did;
+    }
+
     log$1("authenticate TTL is ", this._config.bindRequestTTL);
 
     // This will block while the request is pending.
@@ -1906,6 +1896,15 @@ function connectInternal(helloPayload) {
         onDisconnected();
         this.emit("connected", false);
       }
+
+      if (err.message.endsWith("session invalid")) {
+        log$1("Volt session invalid - clearing session");
+        delete this._credential.cache.session_id;
+        delete this._credential.cache.cert;
+        this._credential.saveCache();
+      }
+
+      this.emit("connectionError", err);
     });
 
     this._voltConnection.on("evt", (evt) => {
@@ -1918,10 +1917,24 @@ function connectInternal(helloPayload) {
 
     this._voltConnection.on("invoke_request", (invoke_request) => {
       const invokeId = invoke_request.invoke_id;
-      if (this._activeRPC[invokeId]) {
-        this._activeRPC[invokeId].parsePayload(invoke_request);
+
+      let rpcInvocation = this._activeRPC[invokeId];
+
+      if (rpcInvocation) {
+        if (rpcInvocation.started) {
+          rpcInvocation.parsePayload(invoke_request);
+        } else {
+          rpcInvocation
+            .initialise(invoke_request)
+            .then(() => {
+              this.emit("invoke_request", rpcInvocation);
+            })
+            .catch((err) => {
+              log$1("invoke_request - error [%s]", err.message);
+            });
+        }
       } else {
-        const rpcInvocation = new RpcInvocation(this, this._voltConnection);
+        rpcInvocation = new RpcInvocation(this, this._voltConnection);
 
         rpcInvocation.on("end", () => {
           log$1("removing active RPC [%s]", invokeId);
@@ -1930,9 +1943,11 @@ function connectInternal(helloPayload) {
 
         rpcInvocation
           .initialise(invoke_request)
-          .then(() => {
+          .then((response) => {
             this._activeRPC[invokeId] = rpcInvocation;
-            this.emit("invoke_request", rpcInvocation);
+            if (!response.key_exchange) {
+              this.emit("invoke_request", rpcInvocation);
+            }
           })
           .catch((err) => {
             log$1("invoke_request - error [%s]", err.message);
@@ -2078,6 +2093,7 @@ async function fetchVoltConfig(discovery_url) {
       "public_key",
       "fingerprint",
       "address",
+      "http_address",
       "ca_pem",
       "challenge_code",
       "cloud",
@@ -2165,6 +2181,7 @@ class VoltClient extends EventEmitter__default["default"] {
   /**
    * Initialises a binding and connection to the volt.
    * @param {string} [config] - the location of the Volt configuration file, or a configuration object
+   * @param {object} [extras] - additional configuration properties
    */
   async initialise(config, extras = {}) {
     try {
@@ -2180,10 +2197,15 @@ class VoltClient extends EventEmitter__default["default"] {
         configPath = path__default["default"].resolve(config);
         log("Attempt to load config from file %s", configPath);
         try {
-          const configContents = await readFile(
-            new URL(configPath, (typeof document === 'undefined' ? new (require('u' + 'rl').URL)('file:' + __filename).href : (document.currentScript && document.currentScript.src || new URL('index.cjs', document.baseURI).href)))
-          );
-          configJSON = JSON.parse(configContents);
+          if (fs__default["default"].existsSync(configPath)) {
+            const configContents = await readFile(
+              new URL(configPath, (typeof document === 'undefined' ? new (require('u' + 'rl').URL)('file:' + __filename).href : (document.currentScript && document.currentScript.src || new URL('index.cjs', document.baseURI).href)))
+            );
+            configJSON = JSON.parse(configContents);
+          } else {
+            // There is currently no file at the given configuration path.
+            configJSON = {};
+          }
         } catch (err) {
           log("failure loading config file %s [%s]", configPath, err.message);
           throw new Error(
@@ -2200,15 +2222,15 @@ class VoltClient extends EventEmitter__default["default"] {
         throw new Error("config argument is required to be an object");
       }
 
+      this._config = { ...extras, ...configJSON };
+
       if (
-        !configJSON.client_name ||
-        typeof configJSON.client_name !== "string"
+        !this._config.client_name ||
+        typeof this._config.client_name !== "string"
       ) {
         throw new Error("client_name property required in config");
       }
 
-      this._config = { ...configJSON, ...extras };
-
       let voltDID = "";
       let voltHttpAddress = "";
       if (typeof this._config.volt === "string") {
@@ -2217,6 +2239,7 @@ class VoltClient extends EventEmitter__default["default"] {
         } else {
           voltHttpAddress = this._config.volt;
         }
+        delete this._config.volt;
       } else if (typeof this._config.volt !== "object") {
         throw new Error("configuration is missing the 'volt' object");
       } else {
@@ -2231,7 +2254,7 @@ class VoltClient extends EventEmitter__default["default"] {
       } else if (voltHttpAddress && !this._config?.volt?.id) {
         const discoConfig = await fetchVoltConfig.call(
           this,
-          `${voltHttpAddress}/discovery`
+          `${voltHttpAddress}/discover`
         );
         this._config = {
           ...this._config,
@@ -2240,8 +2263,12 @@ class VoltClient extends EventEmitter__default["default"] {
       }
 
       this._voltConfig = this._config.volt;
-      this._voltConfig.did = voltDID;
-      this._voltConfig.http_address = voltHttpAddress;
+      if (voltDID) {
+        this._voltConfig.did = voltDID;
+      }
+      if (voltHttpAddress) {
+        this._voltConfig.http_address = voltHttpAddress;
+      }
 
       if (!this._voltConfig.id || typeof this._voltConfig.id !== "string") {
         throw new Error("'id' property is missing in Volt configuration");
@@ -2289,9 +2316,12 @@ class VoltClient extends EventEmitter__default["default"] {
       if (!isBound) {
         // This is usually because of request being denied.
         throw new Error("Volt authentication failed");
+      } else {
+        // Perist the configuration.
+        this._config = this._credential.saveCache();
       }
 
-      return Promise.resolve();
+      return Promise.resolve(this._config);
     } catch (err) {
       log("Failure starting Volt client [%s]", err.message);
       throw err;
@@ -2758,6 +2788,13 @@ class VoltClient extends EventEmitter__default["default"] {
     });
   }
 
+  SqlTransaction(request) {
+    const grpcClient = this.getVoltAPIClient();
+
+    const call = new GRPCCall(this, "Transaction", "METHOD_TYPE_BIDI");
+    return call.start(grpcClient, request);
+  }
+
   /**
    * WireAPI
    */