@tdxvolt/volt-client-grpc 0.17.0 → 0.18.1

package/lib/index.cjs

@@ -4,7 +4,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
 
 var lodash = require('lodash');
 var ip = require('ip');
-var voltClientWeb = require('@tdxvolt/volt-client-web');
+var js = require('@tdxvolt/volt-client-web/js');
 var debug = require('debug');
 var EventEmitter = require('events');
 var fs = require('fs');
@@ -17,27 +17,8 @@ var uuid = require('uuid');
 
 function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
 
-function _interopNamespace(e) {
-  if (e && e.__esModule) return e;
-  var n = Object.create(null);
-  if (e) {
-    Object.keys(e).forEach(function (k) {
-      if (k !== 'default') {
-        var d = Object.getOwnPropertyDescriptor(e, k);
-        Object.defineProperty(n, k, d.get ? d : {
-          enumerable: true,
-          get: function () { return e[k]; }
-        });
-      }
-    });
-  }
-  n["default"] = e;
-  return Object.freeze(n);
-}
-
 var lodash__default = /*#__PURE__*/_interopDefaultLegacy(lodash);
 var ip__default = /*#__PURE__*/_interopDefaultLegacy(ip);
-var voltClientWeb__namespace = /*#__PURE__*/_interopNamespace(voltClientWeb);
 var debug__default = /*#__PURE__*/_interopDefaultLegacy(debug);
 var EventEmitter__default = /*#__PURE__*/_interopDefaultLegacy(EventEmitter);
 var fs__default = /*#__PURE__*/_interopDefaultLegacy(fs);
@@ -46,60 +27,13 @@ var protoLoader__default = /*#__PURE__*/_interopDefaultLegacy(protoLoader);
 var bent__default = /*#__PURE__*/_interopDefaultLegacy(bent);
 var jwt__default = /*#__PURE__*/_interopDefaultLegacy(jwt);
 
-// eslint-disable-next-line import/prefer-default-export
 const constants = {
   authTokenName: "volt-token",
-  collectionOperation: {
-    add: "ADD",
-    remove: "REMOVE",
-    update: "UPDATE"
-  },
-  crypto: {
-    subjectDefaults: [
-      {
-        name: "countryName",
-        value: "GB"
-      },
-      {
-        name: "localityName",
-        value: "Southampton"
-      },
-      {
-        name: "organizationName",
-        value: "nquiringminds Ltd"
-      }
-    ],
-    userIdOID: "0.9.2342.19200300.100.1.1"
-  },
-  defaultDIDHostName: "tdxvolt.com",
+  defaultDIDHostName: "coreid.com",
   didServiceType: {
     voltConfig: "volt-discovery"
   },
-  identityType: {
-    did: "did",
-    volt: "volt"
-  },
-  onlineStatus: {
-    offline: "offline",
-    online: "online",
-    unknown: "unknown"
-  },
   privateEncryptedKeyPrefix: "-----BEGIN ENCRYPTED PRIVATE KEY-----",
-  resource: {
-    identity: "ident",
-    identityView: "ident-view",
-    proxy: "proxy",
-    proxyView: "proxy-view",
-    vc: "vc",
-    vcView: "vc-view"
-  },
-  voltStatus: {
-    pending: "",
-    online: "online",
-    offline: "offline",
-    deleted: "deleted",
-    revoked: "revoked"
-  },
   /**
    * These top-level service types should map to a protobuf definition
    * in @tdxvolt/volt-proto.
@@ -112,12 +46,7 @@ const constants = {
     relayAPI: "tdx.volt_api.relay.v1.RelayAPI",
     voltAPI: "tdx.volt_api.volt.v1.VoltAPI",
     wireAPI: "tdx.volt_api.volt.v1.WireAPI"
-  },
-  tunnelInvokeMethod: "/tdx.volt_api.volt.v1.VoltAPI/Invoke",
-  tunnelPingInterval: 10000,
-  tunnelPingTimeout: 2500,
-  tunnelReconnectAfter: 30000,
-  tunnelTimeoutInterval: 10000 * 2 // This must always be greater than `tunnelPingInterval`.
+  }
 };
 
 const createSecureContextOptions = (cryptoOptions) => {
@@ -172,7 +101,7 @@ var utils = /*#__PURE__*/Object.freeze({
   createSecureContextOptions: createSecureContextOptions,
   getServiceAddress: getServiceAddress,
   getDIDResolutionURL: getDIDResolutionURL,
-  crypto: voltClientWeb__namespace
+  crypto: js.voltUtils
 });
 
 /* eslint-disable no-underscore-dangle */
@@ -194,7 +123,7 @@ function createClient(
 ) {
   let grpcCredentials;
   if (credentials) {
-    const relaying = !!credentials.config?.volt?.relay;
+    const relaying = !!credentials.config?.volt?.relay && !Array.isArray(credentials.config?.volt?.relay);
     const ca = relaying
       ? credentials.config?.volt?.relay?.ca_pem
       : credentials.cache.ca;
@@ -202,8 +131,8 @@ function createClient(
     const { key } = credentials.cache;
 
     if (key && cert) {
-      const cryyptoOptions = { ca, cert, key };
-      const tlsOptions = createSecureContextOptions(cryyptoOptions);
+      const cryptoOptions = { ca, cert, key };
+      const tlsOptions = createSecureContextOptions(cryptoOptions);
       grpcCredentials = grpc.credentials.createSsl(
         tlsOptions.ca,
         tlsOptions.key,
@@ -418,6 +347,15 @@ var grpcUtils = /*#__PURE__*/Object.freeze({
 
 /* eslint-disable no-underscore-dangle */
 
+const {
+  createSigningKey,
+  fingerprintFromPem,
+  getIdentityToken,
+  keyFromPem: keyFromPem$2,
+  privateKeyToPem,
+  publicKeyToPem: publicKeyToPem$2
+} = js.voltUtils;
+
 const log$5 = debug__default["default"]("volt-client-grpc:volt-credential");
 
 class VoltCredential {
@@ -442,13 +380,13 @@ class VoltCredential {
       }
 
       // Need to unencrypt the private key.
-      const decrypted = voltClientWeb.keyFromPem(this._cryptoCache.key, config.p);
+      const decrypted = keyFromPem$2(this._cryptoCache.key, config.p);
 
       if (!decrypted) {
         throw new Error("failed to decrypt key - check passphrase");
       }
 
-      this._cryptoCache.key = voltClientWeb.privateKeyToPem(decrypted.privateKey);
+      this._cryptoCache.key = privateKeyToPem(decrypted.privateKey);
     }
 
     if (this._voltConfig.ca_pem) {
@@ -457,11 +395,11 @@ class VoltCredential {
         this._cryptoCache.ca = this._voltConfig.ca_pem;
       }
 
-      // Extract Volt public key (used for encrypting Relay payloads).
+      // Extract Volt public key.
       this._voltPublicKey = this._voltConfig.public_key;
 
-      const voltKey = voltClientWeb.keyFromPem(this._voltPublicKey).publicKey;
-      this._voltFingerprint = voltClientWeb.fingerprintFromPublicKey(voltKey);
+      const voltKey = keyFromPem$2(this._voltPublicKey).publicKey;
+      this._voltFingerprint = fingerprintFromPem(voltKey);
     }
   }
 
@@ -490,15 +428,19 @@ class VoltCredential {
   }
 
   get publicKey() {
-    return voltClientWeb.publicKeyToPem(this.getKey().publicKey);
+    return publicKeyToPem$2(this.getKey().publicKey);
   }
 
   get voltFingerprint() {
     return this._voltFingerprint;
   }
 
+  get key() {
+    return this.getKey();
+  }
+
   getKey() {
-    const key = voltClientWeb.keyFromPem(this._cryptoCache.key);
+    const key = keyFromPem$2(this._cryptoCache.key);
     return key;
   }
 
@@ -512,8 +454,8 @@ class VoltCredential {
       return Promise.resolve(this.getKey());
     } else {
       log$5("creating key");
-      this._cryptoCache.key = voltClientWeb.createKey();
-      const key = voltClientWeb.keyFromPem(this._cryptoCache.key);
+      this._cryptoCache.key = JSON.parse(createSigningKey()).private_pem;
+      const key = keyFromPem$2(this._cryptoCache.key);
       log$5("successfully created key");
       return Promise.resolve(key);
     }
@@ -550,9 +492,9 @@ class VoltCredential {
    * @returns
    */
   getIdentityMetadata(grpc, audience, publicKey, tunnelling = false, ttl = 60) {
-    const key = voltClientWeb.keyFromPem(this._cryptoCache.key);
+    const key = keyFromPem$2(this._cryptoCache.key);
 
-    const identityToken = voltClientWeb.getIdentityToken(
+    const identityToken = getIdentityToken(
       this.sessionId,
       key,
       audience || this._voltConfig.id,
@@ -568,8 +510,8 @@ class VoltCredential {
     const clone = { ...this._config, credential: { ...this._cryptoCache } };
     if (this._config.p) {
       // A passphrase option exists => encrypt the key before writing the cache file.
-      const key = voltClientWeb.keyFromPem(this._cryptoCache.key);
-      clone.credential.key = voltClientWeb.privateKeyToPem(key.privateKey, this._config.p);
+      const key = keyFromPem$2(this._cryptoCache.key);
+      clone.credential.key = privateKeyToPem(key.privateKey, this._config.p);
     }
 
     if (this._persistCache) {
@@ -708,6 +650,20 @@ var protoUtils = /*#__PURE__*/Object.freeze({
 
 /* eslint-disable no-underscore-dangle */
 
+const {
+  aesCreateKey,
+  aesEncrypt: aesEncrypt$1,
+  aesDecrypt: aesDecrypt$1,
+  toBase64,
+  formatPEM: formatPEM$1,
+  keyFromPem: keyFromPem$1,
+  verify,
+  deriveSharedKey: deriveSharedKey$1,
+  x25519: x25519$1
+} = js.voltUtils;
+
+const invokeMethod = "Invoke";
+
 const log$4 = debug__default["default"]("volt-client-grpc:grpc-call");
 
 function _prepareInvokeRequest(
@@ -719,10 +675,10 @@ function _prepareInvokeRequest(
     this._service?.service_description.host_type ===
     "SERVICE_HOST_TYPE_RELAYED";
 
-  const relaying = this._voltClient.isVoltRelay || isServiceRelayed;
+  const relaying = this._voltClient.isRelayed || isServiceRelayed;
 
   let targetDID = [];
-  if (this._voltClient.isVoltRelay) {
+  if (this._voltClient.isRelayed) {
     targetDID.push(this._voltClient.voltConfig.id);
   }
 
@@ -747,20 +703,23 @@ function _prepareInvokeRequest(
   let invokeRequest;
   let callMethod = method;
 
+  const voltGrpcClient = this._voltClient.getVoltAPIClient();
+
   if (relaying) {
     //
     // If the volt connection is via a relay (or the target service is relayed),
     // we wrap the rpc in a RemoteRequest message and send it via a call to Invoke().
     //
+
     // Replace the target method with a call to Invoke on the relay Volt.
-    //
-    callMethod = "Invoke";
+    callMethod = invokeMethod;
 
     // But first we need to perform a key exchange with the target service.
-    //
     if (!this._encryptionKey) {
       // We haven't exchanged keys yet, so queue the payload.
-      this._pendingRequests.push(request);
+      if (request) {
+        this._pendingRequests.push(request);
+      }
 
       if (this._keyExchangePending) {
         // We've already sent the key exchange request, so do nothing.
@@ -779,6 +738,13 @@ function _prepareInvokeRequest(
           : undefined
       };
 
+      if (this._voltClient.isRelayed) {
+        // When tunnelling, we serialise the request using the original serialisation
+        // method for Invoke.
+        invokeRequest =
+          voltGrpcClient.Invoke.requestSerializeOriginal(invokeRequest);
+      }
+
       return {
         request: invokeRequest,
         method: callMethod,
@@ -789,41 +755,45 @@ function _prepareInvokeRequest(
 
     let requestPayload;
 
-    // Serialise the rpc request.
+    // Serialise the rpc request using the original serialisation method.
     if (request) {
-      requestPayload = this._grpcClient[method].requestSerialize(request);
+      if (this._voltClient.isRelayed) {
+        requestPayload =
+          this._grpcClient[method].requestSerializeOriginal(request);
+      } else {
+        requestPayload = this._grpcClient[method].requestSerialize(request);
+      }
     } else if (request !== null) {
       log$4("****************LOOKOUT****************** - empty request");
     } else {
       log$4("explicit empty request payload");
     }
 
-    // Use this placeholder to serialise the relay request wrapper.
-    const voltGrpcClient = this._voltClient.getVoltAPIClient();
-    const tunnelMethod = voltGrpcClient.Tunnel;
-
-    const tunnelResp = {
+    // Create a tunnel message containing the method call metadata and request payload.
+    const tunnelResp = voltGrpcClient.Tunnel.responseSerialize({
       method_invoke: {
         method_name: this._grpcClient[method].path,
         method_type: methodType,
         request: requestPayload
       }
-    };
-
-    let invokePayload;
-    const iv = voltClientWeb.aesCreateKey().iv;
+    });
 
     // When sending via a relay we need to encrypt the payload.
-    invokePayload = voltClientWeb.aesEncrypt(
-      this._encryptionKey,
-      iv,
-      tunnelMethod.responseSerialize(tunnelResp)
-    );
+    const iv = aesCreateKey().iv;
+    const invokePayload = aesEncrypt$1(this._encryptionKey, iv, tunnelResp);
 
+    // Construct the Invoke request.
     invokeRequest = {
       iv,
       payload: invokePayload
     };
+
+    if (this._voltClient.isRelayed) {
+      // When tunnelling, we serialise the request using the original serialisation
+      // method for Invoke.
+      invokeRequest =
+        voltGrpcClient.Invoke.requestSerializeOriginal(invokeRequest);
+    }
   } else {
     invokeRequest = request;
   }
@@ -843,32 +813,45 @@ function _preparePayloadRequest(request, invokeInfo) {
     this._service?.service_description.host_type ===
     "SERVICE_HOST_TYPE_RELAYED";
 
-  let iv;
-  if (this._voltClient.isVoltRelay || isServiceRelayed) {
-    iv = voltClientWeb.aesCreateKey().iv;
-
-    const requestPayload =
-      this._grpcClient[invokeInfo.methodName].requestSerialize(request);
+  if (this._voltClient.isRelayed || isServiceRelayed) {
+    let requestPayload;
+    if (this._voltClient.isRelayed) {
+      // Serialise the rpc request using the original serialisation method.
+      requestPayload =
+        this._grpcClient[invokeInfo.methodName].requestSerializeOriginal(
+          request
+        );
+    } else {
+      requestPayload =
+        this._grpcClient[invokeInfo.methodName].requestSerialize(request);
+    }
 
+    // Use the Tunnel method to serialise the relay request wrapper, this
     const voltGrpcClient = this._voltClient.getVoltAPIClient();
-    const tunnelMethod = voltGrpcClient.Tunnel;
 
-    const tunnelResp = {
+    // Create a tunnel message containing the method call metadata and request payload.
+    const tunnelResp = voltGrpcClient.Tunnel.responseSerialize({
       method_payload: {
         payload: requestPayload
       }
-    };
+    });
 
-    const invokePayload = voltClientWeb.aesEncrypt(
-      this._encryptionKey,
-      iv,
-      tunnelMethod.responseSerialize(tunnelResp)
-    );
+    // Encrypt the payload using the shared key.
+    const iv = aesCreateKey().iv;
+    const invokePayload = aesEncrypt$1(this._encryptionKey, iv, tunnelResp);
 
+    // We then serialise the entire request using the original serialisation method for Invoke.
     payloadRequest = {
       iv,
       payload: invokePayload
     };
+
+    if (this._voltClient.isRelayed) {
+      // When tunnelling, we serialise the request using the original serialisation
+      // method for Invoke.
+      payloadRequest =
+        voltGrpcClient.Invoke.requestSerializeOriginal(payloadRequest);
+    }
   } else {
     payloadRequest = request;
   }
@@ -884,7 +867,14 @@ function _parseResponse(method, meta, response) {
     this._service?.service_description.host_type ===
     "SERVICE_HOST_TYPE_RELAYED";
 
-  if (this._voltClient.isVoltRelay || isServiceRelayed) {
+  const voltGrpcClient = this._voltClient.getVoltAPIClient();
+
+  if (this._voltClient.isRelayed || isServiceRelayed) {
+    if (this._voltClient.isRelayed) {
+      // Deserialise the incoming response using the original deserialisation method for Invoke.
+      response = voltGrpcClient.Invoke.responseDeserializeOriginal(response);
+    }
+
     if (response.key_exchange) {
       const encryptionKey = response.key_exchange.encryption_key;
       const nonce = response.key_exchange.nonce;
@@ -896,24 +886,24 @@ function _parseResponse(method, meta, response) {
       message.set(nonce, encryptionKey.length);
 
       // Check the signature using the target service public key.
-      const targetKey = voltClientWeb.keyFromPem(
+      const targetKey = keyFromPem$1(
         this._service?.service_description?.host_public_key ||
           this._voltClient.credential.voltPublicKey
       ).publicKey;
 
-      if (!voltClientWeb.verify(targetKey, message, signature)) {
+      if (!verify(targetKey, message, signature)) {
         throw new Error("signature verification failed");
       }
 
       invokeResponse = {
         key_exchange: {
-          encryption_key: voltClientWeb.formatPEM(voltClientWeb.toBase64(encryptionKey), "PUBLIC KEY")
+          encryption_key: formatPEM$1(toBase64(encryptionKey), "PUBLIC KEY")
         }
       };
     } else if (response.payload) {
       let decryptedPayload;
       if (this._encryptionKey) {
-        decryptedPayload = voltClientWeb.aesDecrypt(
+        decryptedPayload = aesDecrypt$1(
           this._encryptionKey,
           response.iv,
           response.payload
@@ -922,13 +912,24 @@ function _parseResponse(method, meta, response) {
         decryptedPayload = response.payload;
       }
 
-      const tunnelMethod = this._voltClient.getVoltAPIClient().Tunnel;
-      const responsePayload = tunnelMethod.requestDeserialize(decryptedPayload);
+      // Deserialise the decrypted payload using the Tunnel deserialisation method.
+      const responsePayload =
+        voltGrpcClient.Tunnel.requestDeserialize(decryptedPayload);
       if (responsePayload.payload === "method_payload") {
         try {
-          invokeResponse.payload = this._grpcClient[method].responseDeserialize(
-            responsePayload.method_payload.payload
-          );
+          // Deserialise the method payload.
+          if (this._voltClient.isRelayed) {
+            // Use the original deserialisation method for the target method.
+            invokeResponse.payload = this._grpcClient[
+              method
+            ].responseDeserializeOriginal(
+              responsePayload.method_payload.payload
+            );
+          } else {
+            invokeResponse.payload = this._grpcClient[
+              method
+            ].responseDeserialize(responsePayload.method_payload.payload);
+          }
         } catch (err) {
           log$4("failure deserialising payload for %s", this._methodName);
           throw new Error(
@@ -956,16 +957,6 @@ function _parseResponse(method, meta, response) {
       invokeResponse.methodId = response.invoke_id;
       log$4("started method %d for %s", invokeResponse.methodId, method);
     }
-  } else if (this._voltClient.isRemote && this._encryptionKey) {
-    const decryptedPayload = voltClientWeb.aesDecrypt(
-      this._encryptionKey,
-      meta.sharedKey.iv,
-      response
-    );
-    invokeResponse = {
-      payload:
-        this._grpcClient[method].responseDeserializeOriginal(decryptedPayload)
-    };
   } else {
     invokeResponse = { payload: response };
   }
@@ -1005,7 +996,7 @@ class GRPCCall extends EventEmitter__default["default"] {
       "SERVICE_HOST_TYPE_RELAYED";
 
     let callClient;
-    if (this._voltClient.isVoltRelay || isServiceRelayed) {
+    if (this._voltClient.isRelayed || isServiceRelayed) {
       callClient = this._voltClient.getVoltAPIClient();
     } else {
       callClient = this._grpcClient;
@@ -1024,14 +1015,14 @@ class GRPCCall extends EventEmitter__default["default"] {
           streamResponse
         );
         if (parsedResponse.key_exchange) {
-          const peerKey = voltClientWeb.keyFromPem(
+          const peerKey = keyFromPem$1(
             parsedResponse.key_exchange.encryption_key
           ).publicKey;
 
-          this._encryptionKey = voltClientWeb.deriveSharedKey(
+          this._encryptionKey = deriveSharedKey$1(
             this._initialRequest.meta.sharedKey.key,
             peerKey,
-            voltClientWeb.x25519
+            x25519$1
           );
 
           // We've exchanged keys, so send any queued payloads on the next tick.
@@ -1072,7 +1063,11 @@ class GRPCCall extends EventEmitter__default["default"] {
     });
 
     this._call.on("error", (err) => {
-      log$4("ERROR - intercepted stream error %s", err.message);
+      log$4(
+        "ERROR - intercepted stream error on %s: %s",
+        this._methodName,
+        err.message
+      );
       this.emit("error", err);
     });
 
@@ -1108,6 +1103,16 @@ class GRPCCall extends EventEmitter__default["default"] {
     }
   }
 
+  pause() {
+    log$4("pausing call %s", this._methodName);
+    return this._call?.pause();
+  }
+
+  resume() {
+    log$4("resuming call %s", this._methodName);
+    return this._call?.resume();
+  }
+
   get writable() {
     return this._call?.writable;
   }
@@ -1232,8 +1237,18 @@ function _doConnect(connectHello) {
         break;
       }
       case "invoke_request": {
-        log$3("received invoke request");
-        this.emit("invoke_request", response.invoke_request);
+        log$3("received invoke request %s", response.invoke_request.invoke_id);
+        // Pause the call while we process the invoke request to avoid getting
+        // CANCELLED errors from grpc - we should perhaps leave this to the
+        // client to manage as it may be overkill in some cases.
+        this.call.pause();
+        try {
+          this.emit("invoke_request", response.invoke_request);
+        } catch (err) {
+          log$3("error processing invoke request [%s]", err.message);
+        } finally {
+          this.call.resume();
+        }
         break;
       }
       case "evt": {
@@ -1305,6 +1320,10 @@ class VoltConnection extends EventEmitter__default["default"] {
     this._helloPayload = undefined;
   }
 
+  get connectionId() {
+    return this._connectionId;
+  }
+
   connect(helloPayload, throwOnFail) {
     this._helloPayload = helloPayload;
     if (throwOnFail) {
@@ -1324,19 +1343,38 @@ class VoltConnection extends EventEmitter__default["default"] {
   }
 }
 
-const log$2 = debug__default["default"]("rpc-invocation");
+const {
+  aesDecrypt,
+  aesEncrypt,
+  createEncryptionKey,
+  deriveSharedKey,
+  formatPEM,
+  fromBase64,
+  fromBase64Url,
+  keyFromPem,
+  publicKeyToPem: publicKeyToPem$1,
+  randomBytes,
+  signBase64: signBase64$1,
+  stripPemHeaders,
+  x25519
+} = js.voltUtils;
+
+const log$2 = debug__default["default"]("volt-client-grpc:rpc-invocation");
 
 class RpcInvocation extends EventEmitter__default["default"] {
   #voltClient = null;
   #voltConnection = null;
   #token = null;
+  #callerPublicKeyPem = null;
   #invokeId = null;
+  #serviceId = null;
   #payload = null;
   #isJSON = false;
   #methodDescriptor = null;
   #methodName = null;
   #derivedKey = null;
   #started = false;
+  #endEmitted = false;
 
   constructor(voltClient, voltConnection) {
     super();
@@ -1348,6 +1386,18 @@ class RpcInvocation extends EventEmitter__default["default"] {
     return this.#invokeId;
   }
 
+  get serviceId() {
+    return this.#serviceId;
+  }
+
+  get token() {
+    return this.#token;
+  }
+
+  get callerPublicKeyPem() {
+    return this.#callerPublicKeyPem;
+  }
+
   get payload() {
     if (!this.#payload) {
       return null;
@@ -1389,31 +1439,40 @@ class RpcInvocation extends EventEmitter__default["default"] {
     // The rpc implementation should do the verification using the Volt API (e.g. CanAccessResource).
     this.#token = jwt__default["default"].decode(token);
 
-    // Store the JWT key id (kid) for use in the response.
-    const callerPublicKeyPem = voltClientWeb.formatPEM(this.#token.k, "PUBLIC KEY");
-    const callerKey = voltClientWeb.keyFromPem(callerPublicKeyPem, "", voltClientWeb.x25519).publicKey;
+    if (!this.#token) {
+      log$2("failed to decode token %s", token || "null");
+      return Promise.reject(new Error("failed to decode token"));
+    }
 
-    const ephemeralKeyPem = voltClientWeb.createEncryptionKey();
-    const ephemeralKey = voltClientWeb.keyFromPem(ephemeralKeyPem, "", voltClientWeb.x25519);
-    const ephemeralPublicKey = voltClientWeb.fromBase64(
-      voltClientWeb.stripPEMHeaders(voltClientWeb.publicKeyToPem(ephemeralKey.publicKey, voltClientWeb.x25519))
+    // Store the JWT key id (kid) for use in the response.
+    this.#callerPublicKeyPem = formatPEM(this.#token.k, "PUBLIC KEY");
+    const callerKey = keyFromPem(
+      this.#callerPublicKeyPem,
+      "",
+      x25519
+    ).publicKey;
+
+    const ephemeralKeyPem = createEncryptionKey();
+    const ephemeralKey = keyFromPem(ephemeralKeyPem, "", x25519);
+    const ephemeralPublicKey = fromBase64(
+      stripPemHeaders(publicKeyToPem$1(ephemeralKey.publicKey, x25519))
     );
 
-    this.#derivedKey = voltClientWeb.deriveSharedKey(
+    this.#derivedKey = deriveSharedKey(
       ephemeralKey.privateKey,
       callerKey,
-      voltClientWeb.x25519
+      x25519
     );
 
-    const nonce = voltClientWeb.randomBytes(16);
+    const nonce = randomBytes(16);
 
     // The signed message is the encryption key and the nonce.
     const message = new Uint8Array(ephemeralPublicKey.length + nonce.length);
     message.set(ephemeralPublicKey);
     message.set(nonce, ephemeralPublicKey.length);
 
-    const signature = voltClientWeb.signBase64(
-      this.#voltClient.credential.getKey().privateKey,
+    const signature = signBase64$1(
+      this.#voltClient.credential.cache.key,
       message
     );
 
@@ -1422,7 +1481,7 @@ class RpcInvocation extends EventEmitter__default["default"] {
       key_exchange: {
         nonce,
         encryption_key: ephemeralPublicKey,
-        signature: voltClientWeb.fromBase64Url(signature)
+        signature: fromBase64Url(signature)
       }
     };
 
@@ -1434,7 +1493,10 @@ class RpcInvocation extends EventEmitter__default["default"] {
   }
 
   initialise(invoke_request) {
-    this.#invokeId = invoke_request.invoke_id;
+    if (!this.#invokeId) {
+      this.#invokeId = invoke_request.invoke_id;
+      this.#serviceId = invoke_request.target_service_id;
+    }
 
     if (!this.#derivedKey) {
       // We don't have the derived key yet, so we need to perform the key exchange.
@@ -1456,10 +1518,9 @@ class RpcInvocation extends EventEmitter__default["default"] {
 
       if (invoke_request.payload) {
         let decryptedPayload;
-
-        if (encryptIV) {
+        if (encryptIV?.length) {
           // Decrypt the actual payload using the shared key and iv.
-          decryptedPayload = voltClientWeb.aesDecrypt(
+          decryptedPayload = aesDecrypt(
             this.#derivedKey,
             encryptIV,
             invoke_request.payload
@@ -1500,7 +1561,7 @@ class RpcInvocation extends EventEmitter__default["default"] {
 
         if (this.#derivedKey) {
           // Decrypt the actual payload using the shared key and iv.
-          decryptedPayload = voltClientWeb.aesDecrypt(
+          decryptedPayload = aesDecrypt(
             this.#derivedKey,
             invoke_request.iv,
             Buffer.from(invoke_request.json_payload, "base64")
@@ -1525,8 +1586,13 @@ class RpcInvocation extends EventEmitter__default["default"] {
             );
             this.emit("payload", this);
           } else if (wrappedPayload.method_end) {
-            // We don't need to do anything here, since we notify the client when we receive the client_end.
             log$2("method_end received");
+            if (!this.#endEmitted) {
+              this.#endEmitted = true;
+              this.emit("end", this);
+            } else {
+              log$2("method_end: end already emitted");
+            }
           }
         } catch (err) {
           log$2("JSON.parse failure parsing json_payload: %s", err.message);
@@ -1535,7 +1601,12 @@ class RpcInvocation extends EventEmitter__default["default"] {
 
         resolve();
       } else if (invoke_request.client_end) {
-        this.emit("end", this);
+        if (!this.#endEmitted) {
+          this.#endEmitted = true;
+          this.emit("end", this);
+        } else {
+          log$2("client_end: end already emitted");
+        }
       } else {
         // Do we need to support json_payload here?
         reject(new Error("No payload in invoke request"));
@@ -1562,10 +1633,10 @@ class RpcInvocation extends EventEmitter__default["default"] {
       });
     }
 
-    const iv = voltClientWeb.randomBytes(16);
+    const iv = randomBytes(16);
     if (this.#derivedKey) {
       // Encrypt the response using the shared key and iv.
-      responsePayload = voltClientWeb.aesEncrypt(this.#derivedKey, iv, responsePayload);
+      responsePayload = aesEncrypt(this.#derivedKey, iv, responsePayload);
     }
 
     const invokeResponse = {
@@ -1605,10 +1676,10 @@ class RpcInvocation extends EventEmitter__default["default"] {
       endPayload = tunnelMethod.requestSerialize(endPayload);
     }
 
-    const iv = voltClientWeb.randomBytes(16);
+    const iv = randomBytes(16);
     if (this.#derivedKey) {
       // Encrypt the response using the shared key and iv.
-      endPayload = voltClientWeb.aesEncrypt(this.#derivedKey, iv, endPayload);
+      endPayload = aesEncrypt(this.#derivedKey, iv, endPayload);
     }
 
     const invokeResponse = {
@@ -1631,6 +1702,8 @@ class RpcInvocation extends EventEmitter__default["default"] {
 
 /* eslint-disable no-underscore-dangle */
 
+const { publicKeyToPem, removeCarriageReturn, signBase64 } = js.voltUtils;
+
 const { filter, pick } = lodash__default["default"];
 
 const log$1 = debug__default["default"]("volt-client-grpc:volt-client-internal");
@@ -1763,8 +1836,8 @@ async function authenticateInternal(
     }
 
     const keyPair = this._credential.getKey();
-    const publicKeyPem = voltClientWeb.removeCarriageReturn(
-      voltClientWeb.publicKeyToPem(keyPair.publicKey)
+    const publicKeyPem = removeCarriageReturn(
+      publicKeyToPem(keyPair.publicKey)
     );
 
     if (!this._credential.cache.bindIp) {
@@ -1782,8 +1855,8 @@ async function authenticateInternal(
     };
 
     if (this._voltConfig.challenge_code) {
-      authenticateRequest.challenge = voltClientWeb.signBase64(
-        keyPair.privateKey,
+      authenticateRequest.challenge = signBase64(
+        this._credential.cache.key,
         this._voltConfig.challenge_code
       );
     } else {
@@ -1813,16 +1886,18 @@ async function authenticateInternal(
         // This is because the DID document is signed and the signature
         // is over the entire document.
         const didDocument = {
-          "@context": "https://www.w3.org/ns/did/v1",
+          "@context": [
+            "https://www.w3.org/ns/did/v1",
+            "https://tdxvolt.com/ns/did/v1"
+          ],
           authentication: [`${did}#key-1`],
           controller: did,
-          description: this._config.client_name,
           id: did,
           verificationMethod: [
             {
               id: `${did}#key-1`,
               publicKeyPem: publicKeyPem,
-              type: "Ed25519VerificationKey2018"
+              type: "Ed25519Signature2018"
             }
           ]
         };
@@ -1832,8 +1907,8 @@ async function authenticateInternal(
 
         // Now sign the entire DID document, including the proof and set it in the
         // bind request. This is required by the Volt to verify that we have the private key for the DID.
-        authenticateRequest.did_document_signature = voltClientWeb.signBase64(
-          keyPair.privateKey,
+        authenticateRequest.did_document_signature = signBase64(
+          this._credential.cache.key,
           authenticateRequest.did_document
         );
 
@@ -1871,7 +1946,7 @@ async function authenticateInternal(
 
     return decision === "POLICY_DECISION_PERMIT";
   } catch (err) {
-    log$1("failure binding to Volt [%s]", err.message);
+    log$1("failure authenticating with Volt [%s]", err.message);
     throw err;
   }
 }
@@ -1887,15 +1962,7 @@ function connectInternal(helloPayload) {
       this._connected = false;
       this._session = null;
 
-      if (this._cachedClient) {
-        this._grpc.closeClient(this._cachedClient);
-        this._cachedClient = null;
-      }
-
-      if (this._cachedRemoteClient) {
-        this._grpc.closeClient(this._cachedRemoteClient);
-        this._cachedRemoteClient = null;
-      }
+      this.close();
     };
 
     this._voltConnection = new VoltConnection(this, this._grpc);
@@ -1984,7 +2051,7 @@ function connectInternal(helloPayload) {
 
 function getVoltAPIClientInternal() {
   if (!this._cachedClient) {
-    const serviceAddress = this.isRemote
+    const serviceAddress = this.isRelayed
       ? this._voltConfig.relay.address
       : this._voltConfig.address;
     log$1("creating cached VoltAPI service client on %s", serviceAddress);
@@ -1999,7 +2066,7 @@ function getVoltAPIClientInternal() {
       serviceDescriptors,
       serviceAddress,
       this._credential,
-      this.isRemote && !this.isVoltRelay,
+      this.isRelayed,
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : ""
     );
@@ -2010,7 +2077,7 @@ function getVoltAPIClientInternal() {
 
 function getAPIClientInternal(service) {
   if (!this._cachedService[service.id]) {
-    const serviceAddress = this.isRemote
+    const serviceAddress = this.isRelayed
       ? this._voltConfig.relay.address
       : service.service_description.host_address;
 
@@ -2033,7 +2100,7 @@ function getAPIClientInternal(service) {
       serviceDescriptors,
       serviceAddress,
       this._credential,
-      this.isRemote && !this.isVoltRelay,
+      this.isRelayed,
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : ""
     );
@@ -2128,9 +2195,9 @@ async function fetchVoltConfig(discovery_url) {
   }
 }
 
-async function fetchVoltConfigFromDID(volt_did) {
+async function fetchVoltConfigFromDIDInternal(volt_did, registryUrl) {
   try {
-    const didResolution = getDIDResolutionURL(volt_did);
+    const didResolution = getDIDResolutionURL(volt_did, registryUrl);
     if (!didResolution) {
       throw new Error(`Invalid Volt DID: ${volt_did}`);
     }
@@ -2149,6 +2216,8 @@ async function fetchVoltConfigFromDID(volt_did) {
       );
     }
 
+    log$1("resolved DID from %s", didResolution);
+
     const serviceEndpoint = voltConfigServices[0].serviceEndpoint;
     return await fetchVoltConfig.call(this, serviceEndpoint);
   } catch (err) {
@@ -2158,6 +2227,25 @@ async function fetchVoltConfigFromDID(volt_did) {
   }
 }
 
+async function fetchVoltConfigFromDID(
+  volt_did,
+  registryList = [constants.defaultDIDHostName]
+) {
+  for (let registryUrl of registryList) {
+    try {
+      return await fetchVoltConfigFromDIDInternal.call(
+        this,
+        volt_did,
+        registryUrl
+      );
+    } catch (err) {
+      log$1("Failed to fetch Volt config from %s: %s", registryUrl, err.message);
+    }
+  }
+
+  throw new Error("Failed to fetch Volt config from any registry");
+}
+
 const { readFile } = fs__default["default"].promises;
 const log = debug__default["default"]("volt-client-grpc:volt-client");
 
@@ -2173,7 +2261,6 @@ class VoltClient extends EventEmitter__default["default"] {
     }
     this._grpc = grpc;
     this._cachedClient = null;
-    this._cachedRemoteClient = null;
     this._session = null;
     this._config = null;
     this._voltConfig = null;
@@ -2198,12 +2285,36 @@ class VoltClient extends EventEmitter__default["default"] {
     return this._voltConfig;
   }
 
+  get connection() {
+    return this._voltConnection;
+  }
+
+  close() {
+    if (this._cachedClient) {
+      this._grpc.closeClient(this._cachedClient);
+      this._cachedClient = null;
+    }
+
+    for (let serviceKey in Object.keys(this._cachedService)) {
+      if (this._cachedService[serviceKey]) {
+        this._grpc.closeClient(this._cachedService[serviceKey]);
+      }
+    }
+
+    this._cachedService = {};
+  }
+
   /**
    * Initialises a binding and connection to the volt.
    * @param {string} [config] - the location of the Volt configuration file, or a configuration object
    * @param {object} [extras] - additional configuration properties
    */
-  async initialise(config, extras = {}) {
+  async initialise(
+    config,
+    extras = {},
+    ownDID = false,
+    didRegistryList = undefined
+  ) {
     try {
       if (!config) {
         throw new Error(
@@ -2268,7 +2379,15 @@ class VoltClient extends EventEmitter__default["default"] {
       }
 
       if (voltDID) {
-        const didConfig = await fetchVoltConfigFromDID.call(this, voltDID);
+        const didConfig = await fetchVoltConfigFromDID.call(
+          this,
+          voltDID,
+          didRegistryList
+        );
+
+        // Remove the relay list from the DID config, as it would overwrite the relay in the supplied config.
+        delete didConfig.relay;
+
         this._config = { ...this._config, volt: didConfig };
         log("resolved config from DID: %s", JSON.stringify(didConfig, null, 2));
       } else if (voltHttpAddress && !this._config?.volt?.id) {
@@ -2298,7 +2417,7 @@ class VoltClient extends EventEmitter__default["default"] {
 
       await this._credential.initialise();
 
-      if (!this.isRemote) {
+      if (!this.isRelayed) {
         // If we're not connecting via a Relay, we must have the address and CA.
         if (
           !this._voltConfig.address ||
@@ -2321,7 +2440,7 @@ class VoltClient extends EventEmitter__default["default"] {
       } else {
         // No certificate present in the cache yet => we need to authenticate.
         try {
-          isBound = await authenticateInternal.call(this);
+          isBound = await authenticateInternal.call(this, false, ownDID);
         } catch (bindErr) {
           if (bindErr.message === "invalid arguments") {
             // This is usually the result of a missing challenge signature or credential.
@@ -2338,7 +2457,7 @@ class VoltClient extends EventEmitter__default["default"] {
         throw new Error("Volt authentication failed");
       } else {
         // Perist the configuration.
-        this._config = this._credential.saveCache();
+        this._credential.saveCache();
       }
 
       return Promise.resolve(this._config);
@@ -2389,7 +2508,7 @@ class VoltClient extends EventEmitter__default["default"] {
       });
     }
 
-    if (this.isRemote) {
+    if (this.isRelayed) {
       if (!this._voltConfig?.relay?.address) {
         throw new Error(
           "Remote connection enabled but no Relay address - have you called start()?"
@@ -2416,14 +2535,10 @@ class VoltClient extends EventEmitter__default["default"] {
     }
   }
 
-  get isRemote() {
+  get isRelayed() {
     return !!(this._voltConfig?.relay && this._voltConfig.id);
   }
 
-  get isVoltRelay() {
-    return this.isRemote && !this._voltConfig?.relay.cloud;
-  }
-
   connect(helloPayload) {
     return connectInternal.call(this, helloPayload);
   }
@@ -2753,6 +2868,9 @@ class VoltClient extends EventEmitter__default["default"] {
    */
   SqlExecuteJSON(request) {
     return new Promise((resolve, reject) => {
+      if (!request.start) {
+        request = { start: request };
+      }
       const call = this.SqlExecute(request);
 
       let header;