@tdxvolt/volt-client-grpc 0.18.0 → 0.18.2

package/lib/index.cjs

@@ -29,7 +29,7 @@ var jwt__default = /*#__PURE__*/_interopDefaultLegacy(jwt);
 
 const constants = {
   authTokenName: "volt-token",
-  defaultDIDHostName: "tdxvolt.com",
+  defaultDIDHostName: "coreid.com",
   didServiceType: {
     voltConfig: "volt-discovery"
   },
@@ -123,7 +123,7 @@ function createClient(
 ) {
   let grpcCredentials;
   if (credentials) {
-    const relaying = !!credentials.config?.volt?.relay;
+    const relaying = !!credentials.config?.volt?.relay && !Array.isArray(credentials.config?.volt?.relay);
     const ca = relaying
       ? credentials.config?.volt?.relay?.ca_pem
       : credentials.cache.ca;
@@ -131,8 +131,8 @@ function createClient(
     const { key } = credentials.cache;
 
     if (key && cert) {
-      const cryyptoOptions = { ca, cert, key };
-      const tlsOptions = createSecureContextOptions(cryyptoOptions);
+      const cryptoOptions = { ca, cert, key };
+      const tlsOptions = createSecureContextOptions(cryptoOptions);
       grpcCredentials = grpc.credentials.createSsl(
         tlsOptions.ca,
         tlsOptions.key,
@@ -395,7 +395,7 @@ class VoltCredential {
         this._cryptoCache.ca = this._voltConfig.ca_pem;
       }
 
-      // Extract Volt public key (used for encrypting Relay payloads).
+      // Extract Volt public key.
       this._voltPublicKey = this._voltConfig.public_key;
 
       const voltKey = keyFromPem$2(this._voltPublicKey).publicKey;
@@ -435,6 +435,10 @@ class VoltCredential {
     return this._voltFingerprint;
   }
 
+  get key() {
+    return this.getKey();
+  }
+
   getKey() {
     const key = keyFromPem$2(this._cryptoCache.key);
     return key;
@@ -450,7 +454,7 @@ class VoltCredential {
       return Promise.resolve(this.getKey());
     } else {
       log$5("creating key");
-      this._cryptoCache.key = createSigningKey();
+      this._cryptoCache.key = JSON.parse(createSigningKey()).private_pem;
       const key = keyFromPem$2(this._cryptoCache.key);
       log$5("successfully created key");
       return Promise.resolve(key);
@@ -658,6 +662,8 @@ const {
   x25519: x25519$1
 } = js.voltUtils;
 
+const invokeMethod = "Invoke";
+
 const log$4 = debug__default["default"]("volt-client-grpc:grpc-call");
 
 function _prepareInvokeRequest(
@@ -669,10 +675,10 @@ function _prepareInvokeRequest(
     this._service?.service_description.host_type ===
     "SERVICE_HOST_TYPE_RELAYED";
 
-  const relaying = this._voltClient.isVoltRelay || isServiceRelayed;
+  const relaying = this._voltClient.isRelayed || isServiceRelayed;
 
   let targetDID = [];
-  if (this._voltClient.isVoltRelay) {
+  if (this._voltClient.isRelayed) {
     targetDID.push(this._voltClient.voltConfig.id);
   }
 
@@ -697,20 +703,23 @@ function _prepareInvokeRequest(
   let invokeRequest;
   let callMethod = method;
 
+  const voltGrpcClient = this._voltClient.getVoltAPIClient();
+
   if (relaying) {
     //
     // If the volt connection is via a relay (or the target service is relayed),
     // we wrap the rpc in a RemoteRequest message and send it via a call to Invoke().
     //
+
     // Replace the target method with a call to Invoke on the relay Volt.
-    //
-    callMethod = "Invoke";
+    callMethod = invokeMethod;
 
     // But first we need to perform a key exchange with the target service.
-    //
     if (!this._encryptionKey) {
       // We haven't exchanged keys yet, so queue the payload.
-      this._pendingRequests.push(request);
+      if (request) {
+        this._pendingRequests.push(request);
+      }
 
       if (this._keyExchangePending) {
         // We've already sent the key exchange request, so do nothing.
@@ -729,6 +738,13 @@ function _prepareInvokeRequest(
           : undefined
       };
 
+      if (this._voltClient.isRelayed) {
+        // When tunnelling, we serialise the request using the original serialisation
+        // method for Invoke.
+        invokeRequest =
+          voltGrpcClient.Invoke.requestSerializeOriginal(invokeRequest);
+      }
+
       return {
         request: invokeRequest,
         method: callMethod,
@@ -739,41 +755,45 @@ function _prepareInvokeRequest(
 
     let requestPayload;
 
-    // Serialise the rpc request.
+    // Serialise the rpc request using the original serialisation method.
     if (request) {
-      requestPayload = this._grpcClient[method].requestSerialize(request);
+      if (this._voltClient.isRelayed) {
+        requestPayload =
+          this._grpcClient[method].requestSerializeOriginal(request);
+      } else {
+        requestPayload = this._grpcClient[method].requestSerialize(request);
+      }
     } else if (request !== null) {
       log$4("****************LOOKOUT****************** - empty request");
     } else {
       log$4("explicit empty request payload");
     }
 
-    // Use this placeholder to serialise the relay request wrapper.
-    const voltGrpcClient = this._voltClient.getVoltAPIClient();
-    const tunnelMethod = voltGrpcClient.Tunnel;
-
-    const tunnelResp = {
+    // Create a tunnel message containing the method call metadata and request payload.
+    const tunnelResp = voltGrpcClient.Tunnel.responseSerialize({
       method_invoke: {
         method_name: this._grpcClient[method].path,
         method_type: methodType,
         request: requestPayload
       }
-    };
-
-    let invokePayload;
-    const iv = aesCreateKey().iv;
+    });
 
     // When sending via a relay we need to encrypt the payload.
-    invokePayload = aesEncrypt$1(
-      this._encryptionKey,
-      iv,
-      tunnelMethod.responseSerialize(tunnelResp)
-    );
+    const iv = aesCreateKey().iv;
+    const invokePayload = aesEncrypt$1(this._encryptionKey, iv, tunnelResp);
 
+    // Construct the Invoke request.
     invokeRequest = {
       iv,
       payload: invokePayload
     };
+
+    if (this._voltClient.isRelayed) {
+      // When tunnelling, we serialise the request using the original serialisation
+      // method for Invoke.
+      invokeRequest =
+        voltGrpcClient.Invoke.requestSerializeOriginal(invokeRequest);
+    }
   } else {
     invokeRequest = request;
   }
@@ -793,32 +813,45 @@ function _preparePayloadRequest(request, invokeInfo) {
     this._service?.service_description.host_type ===
     "SERVICE_HOST_TYPE_RELAYED";
 
-  let iv;
-  if (this._voltClient.isVoltRelay || isServiceRelayed) {
-    iv = aesCreateKey().iv;
-
-    const requestPayload =
-      this._grpcClient[invokeInfo.methodName].requestSerialize(request);
+  if (this._voltClient.isRelayed || isServiceRelayed) {
+    let requestPayload;
+    if (this._voltClient.isRelayed) {
+      // Serialise the rpc request using the original serialisation method.
+      requestPayload =
+        this._grpcClient[invokeInfo.methodName].requestSerializeOriginal(
+          request
+        );
+    } else {
+      requestPayload =
+        this._grpcClient[invokeInfo.methodName].requestSerialize(request);
+    }
 
+    // Use the Tunnel method to serialise the relay request wrapper, this
     const voltGrpcClient = this._voltClient.getVoltAPIClient();
-    const tunnelMethod = voltGrpcClient.Tunnel;
 
-    const tunnelResp = {
+    // Create a tunnel message containing the method call metadata and request payload.
+    const tunnelResp = voltGrpcClient.Tunnel.responseSerialize({
       method_payload: {
         payload: requestPayload
       }
-    };
+    });
 
-    const invokePayload = aesEncrypt$1(
-      this._encryptionKey,
-      iv,
-      tunnelMethod.responseSerialize(tunnelResp)
-    );
+    // Encrypt the payload using the shared key.
+    const iv = aesCreateKey().iv;
+    const invokePayload = aesEncrypt$1(this._encryptionKey, iv, tunnelResp);
 
+    // We then serialise the entire request using the original serialisation method for Invoke.
     payloadRequest = {
       iv,
       payload: invokePayload
     };
+
+    if (this._voltClient.isRelayed) {
+      // When tunnelling, we serialise the request using the original serialisation
+      // method for Invoke.
+      payloadRequest =
+        voltGrpcClient.Invoke.requestSerializeOriginal(payloadRequest);
+    }
   } else {
     payloadRequest = request;
   }
@@ -834,7 +867,14 @@ function _parseResponse(method, meta, response) {
     this._service?.service_description.host_type ===
     "SERVICE_HOST_TYPE_RELAYED";
 
-  if (this._voltClient.isVoltRelay || isServiceRelayed) {
+  const voltGrpcClient = this._voltClient.getVoltAPIClient();
+
+  if (this._voltClient.isRelayed || isServiceRelayed) {
+    if (this._voltClient.isRelayed) {
+      // Deserialise the incoming response using the original deserialisation method for Invoke.
+      response = voltGrpcClient.Invoke.responseDeserializeOriginal(response);
+    }
+
     if (response.key_exchange) {
       const encryptionKey = response.key_exchange.encryption_key;
       const nonce = response.key_exchange.nonce;
@@ -872,13 +912,24 @@ function _parseResponse(method, meta, response) {
         decryptedPayload = response.payload;
       }
 
-      const tunnelMethod = this._voltClient.getVoltAPIClient().Tunnel;
-      const responsePayload = tunnelMethod.requestDeserialize(decryptedPayload);
+      // Deserialise the decrypted payload using the Tunnel deserialisation method.
+      const responsePayload =
+        voltGrpcClient.Tunnel.requestDeserialize(decryptedPayload);
       if (responsePayload.payload === "method_payload") {
         try {
-          invokeResponse.payload = this._grpcClient[method].responseDeserialize(
-            responsePayload.method_payload.payload
-          );
+          // Deserialise the method payload.
+          if (this._voltClient.isRelayed) {
+            // Use the original deserialisation method for the target method.
+            invokeResponse.payload = this._grpcClient[
+              method
+            ].responseDeserializeOriginal(
+              responsePayload.method_payload.payload
+            );
+          } else {
+            invokeResponse.payload = this._grpcClient[
+              method
+            ].responseDeserialize(responsePayload.method_payload.payload);
+          }
         } catch (err) {
           log$4("failure deserialising payload for %s", this._methodName);
           throw new Error(
@@ -906,16 +957,6 @@ function _parseResponse(method, meta, response) {
       invokeResponse.methodId = response.invoke_id;
       log$4("started method %d for %s", invokeResponse.methodId, method);
     }
-  } else if (this._voltClient.isRemote && this._encryptionKey) {
-    const decryptedPayload = aesDecrypt$1(
-      this._encryptionKey,
-      meta.sharedKey.iv,
-      response
-    );
-    invokeResponse = {
-      payload:
-        this._grpcClient[method].responseDeserializeOriginal(decryptedPayload)
-    };
   } else {
     invokeResponse = { payload: response };
   }
@@ -955,7 +996,7 @@ class GRPCCall extends EventEmitter__default["default"] {
       "SERVICE_HOST_TYPE_RELAYED";
 
     let callClient;
-    if (this._voltClient.isVoltRelay || isServiceRelayed) {
+    if (this._voltClient.isRelayed || isServiceRelayed) {
       callClient = this._voltClient.getVoltAPIClient();
     } else {
       callClient = this._grpcClient;
@@ -1022,7 +1063,11 @@ class GRPCCall extends EventEmitter__default["default"] {
     });
 
     this._call.on("error", (err) => {
-      log$4("ERROR - intercepted stream error %s", err.message);
+      log$4(
+        "ERROR - intercepted stream error on %s: %s",
+        this._methodName,
+        err.message
+      );
       this.emit("error", err);
     });
 
@@ -1058,6 +1103,16 @@ class GRPCCall extends EventEmitter__default["default"] {
     }
   }
 
+  pause() {
+    log$4("pausing call %s", this._methodName);
+    return this._call?.pause();
+  }
+
+  resume() {
+    log$4("resuming call %s", this._methodName);
+    return this._call?.resume();
+  }
+
   get writable() {
     return this._call?.writable;
   }
@@ -1182,8 +1237,18 @@ function _doConnect(connectHello) {
         break;
       }
       case "invoke_request": {
-        log$3("received invoke request");
-        this.emit("invoke_request", response.invoke_request);
+        log$3("received invoke request %s", response.invoke_request.invoke_id);
+        // Pause the call while we process the invoke request to avoid getting
+        // CANCELLED errors from grpc - we should perhaps leave this to the
+        // client to manage as it may be overkill in some cases.
+        this.call.pause();
+        try {
+          this.emit("invoke_request", response.invoke_request);
+        } catch (err) {
+          log$3("error processing invoke request [%s]", err.message);
+        } finally {
+          this.call.resume();
+        }
         break;
       }
       case "evt": {
@@ -1255,6 +1320,10 @@ class VoltConnection extends EventEmitter__default["default"] {
     this._helloPayload = undefined;
   }
 
+  get connectionId() {
+    return this._connectionId;
+  }
+
   connect(helloPayload, throwOnFail) {
     this._helloPayload = helloPayload;
     if (throwOnFail) {
@@ -1286,23 +1355,26 @@ const {
   publicKeyToPem: publicKeyToPem$1,
   randomBytes,
   signBase64: signBase64$1,
-  stripPEMHeaders,
+  stripPemHeaders,
   x25519
 } = js.voltUtils;
 
-const log$2 = debug__default["default"]("rpc-invocation");
+const log$2 = debug__default["default"]("volt-client-grpc:rpc-invocation");
 
 class RpcInvocation extends EventEmitter__default["default"] {
   #voltClient = null;
   #voltConnection = null;
   #token = null;
+  #callerPublicKeyPem = null;
   #invokeId = null;
+  #serviceId = null;
   #payload = null;
   #isJSON = false;
   #methodDescriptor = null;
   #methodName = null;
   #derivedKey = null;
   #started = false;
+  #endEmitted = false;
 
   constructor(voltClient, voltConnection) {
     super();
@@ -1314,6 +1386,18 @@ class RpcInvocation extends EventEmitter__default["default"] {
     return this.#invokeId;
   }
 
+  get serviceId() {
+    return this.#serviceId;
+  }
+
+  get token() {
+    return this.#token;
+  }
+
+  get callerPublicKeyPem() {
+    return this.#callerPublicKeyPem;
+  }
+
   get payload() {
     if (!this.#payload) {
       return null;
@@ -1355,14 +1439,23 @@ class RpcInvocation extends EventEmitter__default["default"] {
     // The rpc implementation should do the verification using the Volt API (e.g. CanAccessResource).
     this.#token = jwt__default["default"].decode(token);
 
+    if (!this.#token) {
+      log$2("failed to decode token %s", token || "null");
+      return Promise.reject(new Error("failed to decode token"));
+    }
+
     // Store the JWT key id (kid) for use in the response.
-    const callerPublicKeyPem = formatPEM(this.#token.k, "PUBLIC KEY");
-    const callerKey = keyFromPem(callerPublicKeyPem, "", x25519).publicKey;
+    this.#callerPublicKeyPem = formatPEM(this.#token.k, "PUBLIC KEY");
+    const callerKey = keyFromPem(
+      this.#callerPublicKeyPem,
+      "",
+      x25519
+    ).publicKey;
 
     const ephemeralKeyPem = createEncryptionKey();
     const ephemeralKey = keyFromPem(ephemeralKeyPem, "", x25519);
     const ephemeralPublicKey = fromBase64(
-      stripPEMHeaders(publicKeyToPem$1(ephemeralKey.publicKey, x25519))
+      stripPemHeaders(publicKeyToPem$1(ephemeralKey.publicKey, x25519))
     );
 
     this.#derivedKey = deriveSharedKey(
@@ -1379,7 +1472,7 @@ class RpcInvocation extends EventEmitter__default["default"] {
     message.set(nonce, ephemeralPublicKey.length);
 
     const signature = signBase64$1(
-      this.#voltClient.credential.getKey().privateKey,
+      this.#voltClient.credential.cache.key,
       message
     );
 
@@ -1400,7 +1493,10 @@ class RpcInvocation extends EventEmitter__default["default"] {
   }
 
   initialise(invoke_request) {
-    this.#invokeId = invoke_request.invoke_id;
+    if (!this.#invokeId) {
+      this.#invokeId = invoke_request.invoke_id;
+      this.#serviceId = invoke_request.target_service_id;
+    }
 
     if (!this.#derivedKey) {
       // We don't have the derived key yet, so we need to perform the key exchange.
@@ -1422,8 +1518,7 @@ class RpcInvocation extends EventEmitter__default["default"] {
 
       if (invoke_request.payload) {
         let decryptedPayload;
-
-        if (encryptIV) {
+        if (encryptIV?.length) {
           // Decrypt the actual payload using the shared key and iv.
           decryptedPayload = aesDecrypt(
             this.#derivedKey,
@@ -1491,8 +1586,13 @@ class RpcInvocation extends EventEmitter__default["default"] {
             );
             this.emit("payload", this);
           } else if (wrappedPayload.method_end) {
-            // We don't need to do anything here, since we notify the client when we receive the client_end.
             log$2("method_end received");
+            if (!this.#endEmitted) {
+              this.#endEmitted = true;
+              this.emit("end", this);
+            } else {
+              log$2("method_end: end already emitted");
+            }
           }
         } catch (err) {
           log$2("JSON.parse failure parsing json_payload: %s", err.message);
@@ -1501,7 +1601,12 @@ class RpcInvocation extends EventEmitter__default["default"] {
 
         resolve();
       } else if (invoke_request.client_end) {
-        this.emit("end", this);
+        if (!this.#endEmitted) {
+          this.#endEmitted = true;
+          this.emit("end", this);
+        } else {
+          log$2("client_end: end already emitted");
+        }
       } else {
         // Do we need to support json_payload here?
         reject(new Error("No payload in invoke request"));
@@ -1751,7 +1856,7 @@ async function authenticateInternal(
 
     if (this._voltConfig.challenge_code) {
       authenticateRequest.challenge = signBase64(
-        keyPair.privateKey,
+        this._credential.cache.key,
         this._voltConfig.challenge_code
       );
     } else {
@@ -1781,16 +1886,18 @@ async function authenticateInternal(
         // This is because the DID document is signed and the signature
         // is over the entire document.
         const didDocument = {
-          "@context": "https://www.w3.org/ns/did/v1",
+          "@context": [
+            "https://www.w3.org/ns/did/v1",
+            "https://tdxvolt.com/ns/did/v1"
+          ],
           authentication: [`${did}#key-1`],
           controller: did,
-          description: this._config.client_name,
           id: did,
           verificationMethod: [
             {
               id: `${did}#key-1`,
               publicKeyPem: publicKeyPem,
-              type: "Ed25519VerificationKey2018"
+              type: "Ed25519Signature2018"
             }
           ]
         };
@@ -1801,7 +1908,7 @@ async function authenticateInternal(
         // Now sign the entire DID document, including the proof and set it in the
         // bind request. This is required by the Volt to verify that we have the private key for the DID.
         authenticateRequest.did_document_signature = signBase64(
-          keyPair.privateKey,
+          this._credential.cache.key,
           authenticateRequest.did_document
         );
 
@@ -1839,7 +1946,7 @@ async function authenticateInternal(
 
     return decision === "POLICY_DECISION_PERMIT";
   } catch (err) {
-    log$1("failure binding to Volt [%s]", err.message);
+    log$1("failure authenticating with Volt [%s]", err.message);
     throw err;
   }
 }
@@ -1855,15 +1962,7 @@ function connectInternal(helloPayload) {
       this._connected = false;
       this._session = null;
 
-      if (this._cachedClient) {
-        this._grpc.closeClient(this._cachedClient);
-        this._cachedClient = null;
-      }
-
-      if (this._cachedRemoteClient) {
-        this._grpc.closeClient(this._cachedRemoteClient);
-        this._cachedRemoteClient = null;
-      }
+      this.close();
     };
 
     this._voltConnection = new VoltConnection(this, this._grpc);
@@ -1952,7 +2051,7 @@ function connectInternal(helloPayload) {
 
 function getVoltAPIClientInternal() {
   if (!this._cachedClient) {
-    const serviceAddress = this.isRemote
+    const serviceAddress = this.isRelayed
       ? this._voltConfig.relay.address
       : this._voltConfig.address;
     log$1("creating cached VoltAPI service client on %s", serviceAddress);
@@ -1967,7 +2066,7 @@ function getVoltAPIClientInternal() {
       serviceDescriptors,
       serviceAddress,
       this._credential,
-      this.isRemote && !this.isVoltRelay,
+      this.isRelayed,
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : ""
     );
@@ -1978,7 +2077,7 @@ function getVoltAPIClientInternal() {
 
 function getAPIClientInternal(service) {
   if (!this._cachedService[service.id]) {
-    const serviceAddress = this.isRemote
+    const serviceAddress = this.isRelayed
       ? this._voltConfig.relay.address
       : service.service_description.host_address;
 
@@ -2001,7 +2100,7 @@ function getAPIClientInternal(service) {
       serviceDescriptors,
       serviceAddress,
       this._credential,
-      this.isRemote && !this.isVoltRelay,
+      this.isRelayed,
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : ""
     );
@@ -2096,9 +2195,9 @@ async function fetchVoltConfig(discovery_url) {
   }
 }
 
-async function fetchVoltConfigFromDID(volt_did) {
+async function fetchVoltConfigFromDIDInternal(volt_did, registryUrl) {
   try {
-    const didResolution = getDIDResolutionURL(volt_did);
+    const didResolution = getDIDResolutionURL(volt_did, registryUrl);
     if (!didResolution) {
       throw new Error(`Invalid Volt DID: ${volt_did}`);
     }
@@ -2117,6 +2216,8 @@ async function fetchVoltConfigFromDID(volt_did) {
       );
     }
 
+    log$1("resolved DID from %s", didResolution);
+
     const serviceEndpoint = voltConfigServices[0].serviceEndpoint;
     return await fetchVoltConfig.call(this, serviceEndpoint);
   } catch (err) {
@@ -2126,6 +2227,25 @@ async function fetchVoltConfigFromDID(volt_did) {
   }
 }
 
+async function fetchVoltConfigFromDID(
+  volt_did,
+  registryList = [constants.defaultDIDHostName]
+) {
+  for (let registryUrl of registryList) {
+    try {
+      return await fetchVoltConfigFromDIDInternal.call(
+        this,
+        volt_did,
+        registryUrl
+      );
+    } catch (err) {
+      log$1("Failed to fetch Volt config from %s: %s", registryUrl, err.message);
+    }
+  }
+
+  throw new Error("Failed to fetch Volt config from any registry");
+}
+
 const { readFile } = fs__default["default"].promises;
 const log = debug__default["default"]("volt-client-grpc:volt-client");
 
@@ -2141,7 +2261,6 @@ class VoltClient extends EventEmitter__default["default"] {
     }
     this._grpc = grpc;
     this._cachedClient = null;
-    this._cachedRemoteClient = null;
     this._session = null;
     this._config = null;
     this._voltConfig = null;
@@ -2166,12 +2285,36 @@ class VoltClient extends EventEmitter__default["default"] {
     return this._voltConfig;
   }
 
+  get connection() {
+    return this._voltConnection;
+  }
+
+  close() {
+    if (this._cachedClient) {
+      this._grpc.closeClient(this._cachedClient);
+      this._cachedClient = null;
+    }
+
+    for (let serviceKey in Object.keys(this._cachedService)) {
+      if (this._cachedService[serviceKey]) {
+        this._grpc.closeClient(this._cachedService[serviceKey]);
+      }
+    }
+
+    this._cachedService = {};
+  }
+
   /**
    * Initialises a binding and connection to the volt.
    * @param {string} [config] - the location of the Volt configuration file, or a configuration object
    * @param {object} [extras] - additional configuration properties
    */
-  async initialise(config, extras = {}) {
+  async initialise(
+    config,
+    extras = {},
+    ownDID = false,
+    didRegistryList = undefined
+  ) {
     try {
       if (!config) {
         throw new Error(
@@ -2236,7 +2379,15 @@ class VoltClient extends EventEmitter__default["default"] {
       }
 
       if (voltDID) {
-        const didConfig = await fetchVoltConfigFromDID.call(this, voltDID);
+        const didConfig = await fetchVoltConfigFromDID.call(
+          this,
+          voltDID,
+          didRegistryList
+        );
+
+        // Remove the relay list from the DID config, as it would overwrite the relay in the supplied config.
+        delete didConfig.relay;
+
         this._config = { ...this._config, volt: didConfig };
         log("resolved config from DID: %s", JSON.stringify(didConfig, null, 2));
       } else if (voltHttpAddress && !this._config?.volt?.id) {
@@ -2266,7 +2417,7 @@ class VoltClient extends EventEmitter__default["default"] {
 
       await this._credential.initialise();
 
-      if (!this.isRemote) {
+      if (!this.isRelayed) {
         // If we're not connecting via a Relay, we must have the address and CA.
         if (
           !this._voltConfig.address ||
@@ -2289,15 +2440,15 @@ class VoltClient extends EventEmitter__default["default"] {
       } else {
         // No certificate present in the cache yet => we need to authenticate.
         try {
-          isBound = await authenticateInternal.call(this);
+          isBound = await authenticateInternal.call(this, false, ownDID);
         } catch (bindErr) {
           if (bindErr.message === "invalid arguments") {
             // This is usually the result of a missing challenge signature or credential.
             log(
               "failure authenticating on Volt - did you supply a challenge code or verified credential?"
             );
-            throw bindErr;
           }
+          throw bindErr;
         }
       }
 
@@ -2306,7 +2457,7 @@ class VoltClient extends EventEmitter__default["default"] {
         throw new Error("Volt authentication failed");
       } else {
         // Perist the configuration.
-        this._config = this._credential.saveCache();
+        this._credential.saveCache();
       }
 
       return Promise.resolve(this._config);
@@ -2357,7 +2508,7 @@ class VoltClient extends EventEmitter__default["default"] {
       });
     }
 
-    if (this.isRemote) {
+    if (this.isRelayed) {
       if (!this._voltConfig?.relay?.address) {
         throw new Error(
           "Remote connection enabled but no Relay address - have you called start()?"
@@ -2384,14 +2535,10 @@ class VoltClient extends EventEmitter__default["default"] {
     }
   }
 
-  get isRemote() {
+  get isRelayed() {
     return !!(this._voltConfig?.relay && this._voltConfig.id);
   }
 
-  get isVoltRelay() {
-    return this.isRemote && !this._voltConfig?.relay.cloud;
-  }
-
   connect(helloPayload) {
     return connectInternal.call(this, helloPayload);
   }
@@ -2721,6 +2868,9 @@ class VoltClient extends EventEmitter__default["default"] {
    */
   SqlExecuteJSON(request) {
     return new Promise((resolve, reject) => {
+      if (!request.start) {
+        request = { start: request };
+      }
       const call = this.SqlExecute(request);
 
       let header;