@tdxvolt/volt-client-grpc 0.18.3 → 0.18.5

package/src/volt-proto-literals.js

@@ -0,0 +1,2985 @@
+/**
+ * This file is generated by the 'generate-proto-assets.js' script.
+ * Do not modify this file directly.
+ */
+
+export const sqlite = `syntax = "proto3";
+
+package tdx.volt_api.data.v1;
+
+// Just reflect SQLite types for now.
+enum DataType {
+  DATA_TYPE_UNKNOWN = 0;
+  DATA_TYPE_TEXT = 1;
+  DATA_TYPE_INTEGER = 2;
+  DATA_TYPE_REAL = 3;
+  DATA_TYPE_BLOB = 4;
+  DATA_TYPE_NULL = 5;
+}
+
+message Column {
+  string name = 1;
+  string description = 2;
+  DataType type = 3;
+}
+
+message Schema {
+  string name = 1;
+  string description = 2;
+  repeated Column column = 3;
+}
+
+message Variant {
+  oneof data {
+    string text = 1;
+    int64 integer = 2;
+    double real = 3;
+    bytes blob = 4;
+    bool null = 5;
+  }
+}
+
+message RowHeader {
+  repeated Column column = 1;
+}
+
+message VariantRow {
+  repeated Variant column = 1;
+}
+`;
+export const sqlite_database_api = `syntax = "proto3";
+
+package tdx.volt_api.data.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+import "tdx/volt_api/data/v1/sqlite.proto";
+import "tdx/volt_api/volt/v1/volt.proto";
+
+// The Sqlite Database API exposes functions that enable clients to manipulate data in a given Volt database.
+// Use the Sqlite Server API to create the database resource.
+service SqliteDatabaseAPI {
+  // Execute multiple SQL statements in a single transaction via a single RPC.
+  rpc BulkUpdate(SqlBulkUpdateRequest) returns (SqlBulkUpdateResponse);
+
+  // Execute a single SQL statement. Any valid SQL is accepted. In order to execute non-SELECT statements, the caller must have the "write" permission.
+  rpc Execute(stream SqlExecuteRequest) returns (stream SqlExecuteResponse);
+
+  // Import CSV data into a table.
+  // The import handler will inspect the incoming CSV data, infer the columns and data types required, and create and populate the SQL table.
+  // The CSV must contain a header row containing the column names and at least one row of data so that the types can be inferred.
+  // The importer assumes all data in any given CSV file relates to a single table.
+  // The data can either be streamed in chunks or retrieved from an existing resource.
+  // If the data is streamed in chunks, the client must call the Close() method on the stream to indicate that it has finished.
+  rpc ImportCSV(stream SqlImportCSVRequest) returns (stream SqlImportCSVResponse);
+}
+
+message SqlBulkUpdateRequest {
+  // The id of the database to update.
+  string database_id = 1;
+
+  // The SQL statements to execute. The statements will be executed within a transaction and will be committed if all statements succeed.
+  // Bear in mind the maximum size limit of a single message is 64MB, and around 1MB seems to be optimal in terms of performance.
+  repeated string statement = 2;
+}
+
+message SqlBulkUpdateResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message SqlExecuteStart {
+  // The id of the database to execute on.
+  string database_id = 1;
+
+  // Set to start a transaction. If not set, each statement will be executed in its own transaction.
+  bool transaction = 2;
+
+  // The SQL statement to execute.
+  string statement = 3;
+
+  // This can be used to limit the number of rows returned by \`SELECT\` statements to avoid overloading a client. It is similar to using 'LIMIT/OFFSET' clauses on the 'SELECT' statement, but this method is easier to manage and the entire result set will be prepared on the Volt, and the client can then page through it by sending successive messages.
+  uint32 page_size = 4;
+
+  // Set to indicate that the query will be cancelled if the client disconnects.
+  // This is useful for long running queries, where it might be desirable for the client to be able to cancel the request before all the data is received. However this requires a worker thread to be allocated to the query until it completes, which may affect performance and limit the number of concurrent queries that can be executed due to file handle limitations.
+  // Only applicable to \`SELECT\` statements, ignored otherwise.
+  bool can_cancel = 5;
+
+  //The values to set for each parameter defined in a database view.
+  //This field is only relevant to 'query' databases, i.e. those with kind \`tdx:sqlite-view\`.
+  //The values in the map should be keyed by parameter name.
+  // A query may have no parameters defined, in which case leave this field empty.
+  map<string, tdx.volt_api.volt.v1.AttributeValue> parameter = 6;
+}
+
+// Intentionally empty.
+message SqlExecuteNext {
+}
+
+// Ends the call.
+message SqlExecuteEnd {
+  // Set to commit the transaction. If not set, the transaction will be rolled back.
+  bool commit_transaction = 1;
+}
+
+message SqlExecuteRequest {
+  oneof payload {
+    // Initialise the request with the database id and whether to execute within a transaction.
+    // Also includes the SQL statement to execute.
+    SqlExecuteStart start = 2;
+
+    // To retrieve subsequent pages, send a \`next\` request.
+    SqlExecuteNext next = 3;
+
+    // To end the call, send an \`end\` request. Only really necessary for transaction-based calls, otherwise clients can just close the stream.
+    SqlExecuteEnd end = 4;
+  }
+}
+
+// One of the following fields will be present in any given message.
+message SqlExecuteResponse {
+  oneof payload {
+    // A status will be sent on error.
+    tdx.volt_api.volt.v1.Status status = 1;
+
+    // The initial response for SELECT statements will be a header containing the column names and types.
+    RowHeader header = 2;
+
+    // Each row in the result set will be sent as a VariantRow.
+    VariantRow row = 3;
+
+    // NYI - For INSERT/UPDATE statements the number of affected rows will be sent.
+    uint32 affected_rows = 4;
+  }
+}
+
+message SqlImportCSVConfiguration {
+  // The target database resource id, which must already exist, and the authenticated account must have write access to the resource.
+  string database_id = 1;
+
+  // The target table name.
+  string table_name = 2;
+
+  // Not yet implemented - flag indicating that data is to be inserted into an existing table.
+  bool create_table = 3;
+
+  // Optional - when not sending the data via this RPC, this should contain the id of a resource that contains the CSV data. If set, the authenticated account must have read access to the resource.
+  string source_resource_id = 4;
+
+  // Optional - the interval to receive progress updates, in number of rows. E.g. set to 1000 to receive progress updates every 1000 rows. Set to 0 to disable progress updates.
+  uint32 progress_interval = 5;
+
+  // The number of rows scanned to infer the schema. Set to 0 to scan the entire file.
+  uint32 schema_scan_limit = 6;
+}
+
+// Each message must contain one and only one of the following fields.
+message SqlImportCSVRequest {
+  oneof payload {
+    // The initial request must contain the configuration parameters for the import.
+    SqlImportCSVConfiguration configuration = 1;
+
+    // Set to indicate that the upload is complete.
+    bool upload_complete = 2;
+
+    // Subsequent requests may contain the data to be imported, unless importing from an existing resource that contains the CSV data. It is recommended that the block size is less than 1MB.
+    bytes block = 3;
+
+    // Set to abort the import.
+    bool abort = 4;
+  }
+}
+
+message SqlImportCSVResponse {
+  // The status will contain any error info.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The number of rows processed - this will be sent after every \`progress_interval\` rows.
+  int64 row_count = 2;
+
+  // The total number of rows to be imported.
+  int64 total_rows = 3;
+}
+`;
+export const sqlite_server_api = `syntax = "proto3";
+
+package tdx.volt_api.data.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+import "tdx/volt_api/volt/v1/volt.proto";
+
+// The Sqlite Server API provides database management functions.
+// Use the VoltAPI DeleteResource function to delete a database.
+service SqliteServerAPI {
+  // Create a new database resource.
+  rpc CreateDatabase(CreateDatabaseRequest) returns (CreateDatabaseResponse);
+}
+
+message CreateDatabaseRequest {
+  // The name of the database to create.
+  string name = 1;
+
+  // Optional - the id of the folder resource in which to create the database. If omitted, the callers home folder is used.
+  string create_in_parent_id = 2;
+
+  // Set to encrypt the database. The encryption key will be generated by the server, the internal Volt server uses the root volt key.
+  bool encrypted = 3;
+
+  // Set to audit all SELECT database operations.
+  bool read_audit = 4;
+
+  // Set to audit all INSERT, UPDATE, and DELETE database operations.
+  bool write_audit = 5;
+
+  // The discovery mode of the underlying Volt resource.
+  tdx.volt_api.volt.v1.DiscoveryMode discoverable = 6;
+
+  // Alias(es) that can be used to refer to the database rather than the id.
+  // Each alias must be unique to the Volt, this is enforced by the API.
+  // No format restrictions are currently applied to alias, but this may change in future, for the time being it makes sense to stick to alphanumeric characters and '_' or '-'.
+  repeated string alias = 7;
+
+  // Optional description of the database.
+  string description = 8;
+}
+
+message CreateDatabaseResponse {
+  // Any error message will be returned here.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The new database resource on success.
+  tdx.volt_api.volt.v1.Resource resource = 2;
+}
+
+`;
+export const proxy_api = `syntax = "proto3";
+
+package tdx.volt_api.relay.v1;
+
+// Placeholder API for the proxy.
+// Methods are injected into this service at runtime
+// when a remote volt connects via the RelayAPI.
+service ProxyAPI {
+}`;
+export const relay_api = `syntax = "proto3";
+
+package tdx.volt_api.relay.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+import "tdx/volt_api/volt/v1/remote.proto";
+import "tdx/volt_api/volt/v1/volt.proto";
+
+service RelayAPI {
+  // Retrieve the list of Volts available on the Relay Volt.
+  rpc GetVoltEndpoint(GetVoltEndpointRequest) returns (GetVoltEndpointResponse);
+
+  // This is the actual tunnel stream.
+  // Note although this API semantically describes the tunnel stream, it isn't actually implemented anywhere. It is used by client libraries to easily serialise tunnel payloads.
+  rpc Tunnel(stream tdx.volt_api.volt.v1.RemoteRequest) returns (stream tdx.volt_api.volt.v1.RemoteResponse);
+
+  // This is the tunnel stream for cloud-based tunnels.
+  rpc CloudTunnel(stream TunnelRequest) returns (stream TunnelResponse);
+}
+
+message GetVoltEndpointRequest {
+  // Optional - if omitted a list of all volts known to the authenticated
+  // account will be returned.
+  oneof filter {
+    // Filter on the owning identity.
+    string owner_id = 2;
+    // Filter on volt id.
+    string volt_id = 1;
+  }
+}
+
+message GetVoltEndpointResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  repeated tdx.volt_api.volt.v1.VoltEndpoint endpoint = 2;
+}
+
+message TunnelStart {
+  uint32 preferred_port = 1;
+  string address = 2;
+  string public_key = 3;
+  string fingerprint = 4;
+  string ca_pem = 5;
+  string volt_version = 6;
+}
+
+message TunnelServiceControl {
+  string resource_id = 1;
+  string service_name = 2;
+  tdx.volt_api.volt.v1.ServiceDescription service_description = 3;
+}
+
+message TunnelControl {
+  oneof msg {
+    TunnelStart start = 2;
+    TunnelServiceControl add_service = 3;
+    TunnelServiceControl remove_service = 4;
+  }
+}
+
+message TunnelRequest {
+  oneof payload {
+    tdx.volt_api.volt.v1.RemotePing ping = 1;
+    TunnelControl control = 2;
+    tdx.volt_api.volt.v1.MethodPayload method_payload = 3;
+    tdx.volt_api.volt.v1.MethodEnd method_end = 4;
+    tdx.volt_api.volt.v1.HttpResponse http_response = 5;
+  }
+}
+
+message TunnelResponse {
+  oneof payload {
+    tdx.volt_api.volt.v1.RemotePing ping = 1;
+    tdx.volt_api.volt.v1.MethodInvoke method_invoke = 2;
+    tdx.volt_api.volt.v1.MethodPayload method_payload = 3;
+    tdx.volt_api.volt.v1.MethodEnd method_end = 4;
+    tdx.volt_api.volt.v1.HttpRequest http_request = 5;
+  }
+}
+`;
+export const sync = `syntax = "proto3";
+
+package tdx.volt_api.sync.v1;
+
+// Wraps arbitrary protobuf messages, with an index into the \`ProtobufSyncConfigurationHeader\` to indicate the specific message type this message wraps.
+message ProtobufSyncWrapper {
+  oneof header_lookup {
+    // The index number of the header for this message type in the Volt logger configuration file.
+    uint32 header_index = 1;
+
+    // The name of the header for this message type, will be used to lookup against the \`id\` field in \`ProtobufSyncConfiguration\`.
+    // This will incur an overhead in terms of the packet size, but might be preferrable if volume is low or managing the header index is difficult.
+    string header_id = 2;
+  }
+
+  // The message payload, in serialised protobuf binary format.
+  // n.b. the serialisation should **not** be length-prefixed.
+  bytes payload = 3;
+}
+
+// Describes a single message type.
+// A set of one or more of these messages is specified in \`ProtobufSyncConfigurationHeader\`.
+message ProtobufSyncConfiguration {
+  // Optional id to associate with this configuration.
+  // This can be used in the \`header_id\` field of \`ProtobufSyncWrapper\` above to reference the configuration.
+  // If omitted the numerical index of the configuration in \`ProtobufSyncConfigurationHeader\` will be used instead.
+  string id = 1;
+
+  // The actual protobuf definition text.
+  // Copy and paste the source protobuf definition from the \`.proto\` file.
+  // Only simple protobuf structures are currently supported, e.g. no imports from other packages etc.
+  string message_proto = 2;
+
+  // The name of the message within \`message_proto\` above that represents the data to be sync'd, e.g. \`TCPDumpPacket\`.
+  string message_name = 3;
+
+  // The name of the table within the target database into which the message data for this type should be written.
+  string table_name = 4;
+}
+
+// This message is written at the beginning of every file to be ingested using the \`protoDbSync\` utility.
+// It contains a \`header\` entry for each message type that may appear in the file.
+// If the \`volt logger\` command is used, it will create this header automatically based on the configuration it's given.
+message ProtobufSyncConfigurationHeader {
+  // This should ideally be a persistent UUID, at minimum it must be unique within the set of types of file any given instance of \`protoDbSync\` is processing in a given folder.
+  // It is used to match up orphaned or split packets that might occur when receiving data from a wire, for example, if a log file is rotated midway through a packet arriving on the wire.
+  // This id should persist for the life time of the set of data it describes, i.e. if a wire publication is stopped and restarted at some later point, the same id should be used if possible.
+  string id = 1;
+
+  // The set of possible configurations that can appear in any given protobuf sync data file.
+  // A serialised instance of this message must appear at the top of each data file.
+  // Each subsequent serialised message in the data file must be an instance of \`ProtobufSyncWrapper\`, and the \`header_lookup\` field refers to an entry in this list.
+  repeated ProtobufSyncConfiguration configuration = 2;
+
+  // Optional maximum size of the serialised messages, this doesn't need to be exact and the default is 64K if omitted.
+  int32 maximum_message_size = 3;
+}`;
+export const discovery_api = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+import "tdx/volt_api/volt/v1/volt.proto";
+
+// The public Volt discovery service. 
+// This is exposed by the Volt battery over an INSECURE grpc channel.
+// This insecurity is ameliorated by the fact that discovered Volts return signatures of their challenge code and owner credential.
+// Note that only Volts that have explicitly set 'discoverable' in the Volt settings will be discovered.
+service DiscoveryAPI {
+  rpc Discover(DiscoverRequest) returns (DiscoverResponse) {};
+}
+
+message DiscoverRequest {
+  // Set to require that only Volts that expose a Relay be included in the response.
+  bool require_relay = 1;
+}
+
+message SignedEndpoint {
+  // The discovered Volt endpoint information.
+  tdx.volt_api.volt.v1.VoltEndpoint endpoint = 1;
+
+  // The discovered Volt's challenge code, signed by the Volt private key and base64 encoded.
+  // If a client knows the Volt challenge code by some out-of-band means, it can use the Volt public key (contained in the endpoint information above) to determine that the discovered Volt also knows the same challenge code.
+  string challenge_signature = 2;
+}
+
+message DiscoverResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // A list of endpoints that match the request criteria.
+  repeated SignedEndpoint endpoint = 2;
+}
+`;
+export const file = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+message File {
+  string file_path = 1;
+  string absolute_path = 2;
+  string file_name = 3;
+  string extension = 4;
+  uint64 size = 5;
+  string media_type = 6;
+  bool is_directory = 7;
+  uint64 modified = 8;
+
+  string resource_id = 100;
+  string owner_resource_id = 101;
+}`;
+export const file_api = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+import "tdx/volt_api/volt/v1/file.proto";
+
+// The File API exposes basic file management functions.
+service FileAPI {
+
+  // Download from file resource.
+  rpc DownloadFile(DownloadFileRequest) returns (stream DownloadFileResponse);
+
+  // Get file resource metadata.
+  rpc GetFile(GetFileRequest) returns (GetFileResponse);
+
+  // Get the content of a file.
+  // Note this rpc will fail if the size of the file content is greater than 64MB, in which case use DownloadFile instead.
+  rpc GetFileContent(GetFileContentRequest) returns (GetFileContentResponse);
+
+  // Get the file resource metadata of all descendants of a given file resource. 
+  rpc GetFileDescendants(GetFileDescendantsRequest) returns (GetFileDescendantsResponse);
+
+  // Set the content of a file.
+  // Note this rpc will fail if the size of the file content is greater than 64MB, in which case use UploadFile instead.
+  rpc SetFileContent(SetFileContentRequest) returns (SetFileContentResponse);
+
+  // Upload data to a file resource.
+  rpc UploadFile(stream UploadFileRequest) returns (stream UploadFileResponse);
+}
+
+message DownloadFileRequest {
+  // The id of the resource to download.
+  string resource_id = 1;
+
+  // This is required for linked folders, and represents the relative path to the source file from the base folder.
+  string file_path = 2;
+}
+
+// The response stream will contain one or more of the following messages.
+// Each response message will contain one of the following fields.
+message DownloadFileResponse {
+  oneof payload {
+    // A chunk of file data.
+    bytes block = 1;
+
+    // A status will be sent when the file is completely downloaded, or if an error occurs.
+    tdx.volt_api.volt.v1.Status status = 2;
+  }
+}
+
+message GetFileRequest {
+  // The resource id of the base folder.
+  string resource_id = 1;
+
+  // Optional - the path to the file, relative to the base folder. Required for linked folders.
+  string file_path = 2;
+}
+
+message GetFileResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The file metadata.
+  File file = 2;
+}
+
+message GetFileContentRequest {
+  // The resource id of the base folder.
+  string resource_id = 1;
+
+  // Optional - the path to the file, relative to the base folder. Required for linked folders.
+  string file_path = 2;
+}
+
+message GetFileContentResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The file content.
+  bytes content = 2;
+}
+
+message GetFileDescendantsRequest {
+  // The resource id of the base folder.
+  string resource_id = 1;
+
+  // For linked files, this is the relative path to the 'parent' file from the base folder.
+  string file_path = 2;
+
+  // Optional - only match descendants of the given kind.
+  string extension = 3;
+
+  // Optional - can be used to determine if a resource is a descendant.
+  string descendant_id = 5;
+}
+
+message GetFileDescendantsResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The list of descendants.
+  repeated File descendant = 2;
+}
+
+message SetFileContentRequest {
+  // The resource id of the base folder.
+  string resource_id = 1;
+
+  // Optional - the path to the file, relative to the base folder. Required for linked folders.
+  string file_path = 2;
+
+  // Optional store name to use.
+  // If specified, this will be used to extract the extension to set as a resource 'kind', e.g. tdx:ext:json.
+  // If not specified, the extension will be taken from the name of the target resource.
+  string store_name = 3;
+
+  bytes content = 4;
+}
+
+message SetFileContentResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message UploadFileStart {
+  // The resource to upload to, required.
+  string resource_id = 1;
+
+  // Optional store name to use.
+  // If specified, this will be used to extract the extension to set as a resource 'kind', e.g. tdx:ext:json.
+  // If not specified, the extension will be taken from the name of the target resource.
+  string store_name = 2;
+
+  // Optionally set streaming mode.
+  // When in streaming mode, data is written directly to the resource.
+  // Otherwise, data is written to a temporary file and then copied over once the upload completes successfully.
+  bool streaming_mode = 3;
+
+  // Optional, truncates the file prior to beginning the upload. This is only really relevant if 'streaming_mode' is set.
+  bool truncate = 4;
+
+  // Optional, buffer will flush after each write.
+  bool eager_flush = 5;
+}
+
+// One of the following fields must be present.
+message UploadFileRequest {
+  oneof payload {
+    // Describes the file upload, should only be sent as first message.
+    UploadFileStart start = 1;
+
+    // The next block of data.
+    bytes block = 2;
+  }
+}
+
+message UploadFileResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // Reserved for internal use.
+  bool back_off = 2;
+}
+
+`;
+export const remote = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+message HttpInvoke {
+  string host = 1;
+  int32 port = 2;
+  string method = 3;
+  string url = 4;
+  string version = 5;
+  map <string, string> headers = 6;
+  bytes body = 7;
+}
+
+message HttpPayload {
+  bytes chunk = 1;
+  oneof end_ {
+    bool end = 2;
+  }
+  oneof error_ {
+    int32 error = 3;
+  }
+}
+
+message HttpRequest {
+  uint64 id = 1;
+  oneof payload {
+    HttpInvoke http_invoke = 2;
+    HttpPayload http_payload = 3;
+  }
+}
+
+message HttpResponse {
+  uint64 id = 1;
+  HttpPayload http_payload = 7;
+}
+
+enum MethodType {
+  METHOD_TYPE_UNKNOWN = 0;
+  METHOD_TYPE_UNARY = 1;
+  METHOD_TYPE_CLIENT_STREAM = 2;
+  METHOD_TYPE_SERVER_STREAM = 3;
+  METHOD_TYPE_BIDI = 4;
+}
+
+message MethodInvoke {
+  uint64 id = 1;
+  string service_id = 2;
+  string method_name = 3;
+  MethodType method_type = 4;
+  oneof invoke_request {
+    bytes request = 6;
+    string json_request = 7;
+  }
+}
+
+message MethodPayload {
+  uint64 id = 1;
+  oneof method_payload {
+    bytes payload = 2;
+    string json_payload = 3;
+  }
+}
+
+message MethodEnd {
+  uint64 id = 1;
+  bool ended = 4;
+  string error = 5;
+  int32 error_code = 6;
+}
+
+message RemotePing {
+  uint64 timestamp = 1;
+}
+
+message RemoteRequest {
+  oneof payload {
+    RemotePing ping = 1;
+    MethodPayload method_payload = 3;
+    MethodEnd method_end = 4;
+    HttpResponse http_response = 5;
+  }
+}
+
+message RemoteResponse {
+  oneof payload {
+    RemotePing ping = 1;
+    MethodInvoke method_invoke = 2;
+    MethodPayload method_payload = 3;
+    MethodEnd method_end = 4;
+    HttpRequest http_request = 5;
+  }
+}
+`;
+export const spark_api = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+
+// The Spark API allows clients to start and communicate with Spark VMs.
+service SparkAPI {
+  // Start or connect to a spark VM and establish a long-lived communication channel.
+  rpc Spark(stream SparkRequest) returns (stream SparkResponse);
+
+  // Get details of running spark VMs.
+  rpc GetSpark(GetSparkRequest) returns (GetSparkResponse);
+}
+
+// Start a resource-hosted spark.
+// Provenance is determined from the resource owner.
+message StartSparkResource {
+  // The id of the resource containing the VM byte code.
+  string resource_id = 1;
+
+  // JSON-encoded payload to parameterise the spark.
+  string payload = 2;
+
+  // Envelope signature.
+  string signature = 3;
+}
+
+// Start a spark from byte code included in the payload, along with issuer/developer claims and signature.
+message StartSparkAdhoc {
+  // Ad-hoc byte code of VM to run.
+  bytes byte_code = 1;
+
+  // Verifiable credentials associated with this spark.
+  repeated string credential = 2;
+
+  // Envelope signature.
+  string signature = 3;
+
+  // JSON-encoded payload to parameterise the spark.
+  string payload = 4;
+}
+
+// Send commands and payloads to communicate with a running spark.
+message SparkCommand {
+  // Optional id to associate with this command.
+  // If this is omitted, an id will be assigned and returned in the command acknowledgement.
+  string command_id = 1;
+
+  // The command to send to the spark.
+  string command = 2;
+
+  // The command payload.
+  string payload = 3;
+
+  // Command verifiable credential.
+  string credential = 4;
+
+  // Command signature.
+  string signature = 5;
+}
+
+// The request must contain one of the messages indicated below.
+message SparkRequest {
+  oneof payload {
+    StartSparkResource start_resource = 1;
+    StartSparkAdhoc start_adhoc = 2;
+    SparkCommand command = 3;
+  }
+}
+
+// Receive events and payload from a running spark.
+message SparkData {
+  // The command id to which this data corresponds.
+  string command_id = 1;
+
+  oneof payload {
+    // Acknowledges receipt of a spark command.
+    bool acknowledge = 2;
+
+    // Indicates the command has completed.
+    bool ended = 3;
+
+    // Will contain error details on command failure.
+    string error = 4;
+
+    // Data emitted by a command, usually in stringified JSON format.
+    string data = 5;
+  }
+}
+
+// Details of a spark instance.
+message SparkInstance {
+  // The UUID assigned to the spark instance.
+  string spark_id = 1;
+}
+
+// The response will contain one of the messages indicated below.
+message SparkResponse {
+  oneof payload {
+    // Details of any error that occurred on the call.
+    tdx.volt_api.volt.v1.Status status = 1;
+
+    // Details of the spark instance, sent in response to a start command.
+    SparkInstance spark_instance = 2;
+
+    // Payload data emitted by the spark.
+    SparkData spark_data = 3;
+  }
+}
+
+message GetSparkRequest {
+  string spark_id = 1;
+}
+
+// One of the following fields will be present in the response.
+message GetSparkResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+`;
+export const ssi = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+message DIDRegistryUpdate {
+  // The id of the update.
+  // Reserved for internal use.
+  uint64 id = 1;
+
+  // The id of the identity.
+  string did = 2;
+
+  // The type of update, either "add", "update" or "delete".
+  string operation = 3;
+
+  // The DID document contained in the update.
+  string document = 4;
+
+  // The hash of DID document.
+  // This is for internal use in comparisons.
+  string hash = 5;
+
+  // The signature of the update.
+  string update_signature = 6;
+
+  // The timestamp of this update.
+  uint64 timestamp = 7;
+
+  // The vector clocks for this DID.
+  // The vector clocks are a map of the peer ID to the id of the last update received for this DID.
+  map<string, uint64> vector_clock = 8;
+
+  // The id of the Volt that first created this DID.
+  string origin_volt = 9;
+
+  // Optional description of this document, this is not part of the DID document or signature.
+  string description = 10;
+}
+
+message VerifiablePresentation {
+  // The credential JSON.
+  string credential_json = 1;
+
+  // A signature of the credential JSON. The signature should usually be that of the credential subject.
+  string signature = 2;
+}
+
+message VerifiableCredential {
+  // The credential id. Leave empty when creating a new credential.
+  string id = 1;
+
+  // The credential status, either "pending", "verified", or "revoked".
+  string status = 2;
+
+  // The credential types.
+  repeated string type = 3;
+
+  // The DID of the issuer.
+  string issuer_id = 4;
+
+  // The JSON of the credential subject.
+  string subject_json = 5;
+
+  // The full JSON of the credential.
+  string json = 6;
+}
+`;
+export const ssi_api = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+import "tdx/volt_api/volt/v1/ssi.proto";
+
+service SsiAPI {
+  // Delete a DID document or all DID documents originating from a given Volt.
+  // Requires \`volt:delete-did\` API privilege.
+  rpc DeleteDID(DeleteDIDRequest) returns (DeleteDIDResponse);
+
+  // Get all updates to the DID registry since the specified timestamp.
+  // Internal use only.
+  rpc GetDIDRegistryUpdates(GetDIDRegistryUpdatesRequest) returns (GetDIDRegistryUpdatesResponse);
+
+  // Import a verifiable credential.
+  rpc ImportCredential(ImportCredentialRequest) returns (ImportCredentialResponse);
+
+  // Parse a verifiable credential from a URL or a verifiable presentation.
+  rpc ParseCredential(ParseCredentialRequest) returns (ParseCredentialResponse);
+
+  // Resolve a DID to a DID document.
+  rpc ResolveDID(ResolveDIDRequest) returns (ResolveDIDResponse);
+
+  // Register a DID document.
+  // This is intended for use by the DID registry when synchronising with other registries.
+  // To register a new DID document, it is recommended to use the VoltAPI Authenticate method.
+  rpc RegisterDIDDocument(RegisterDIDDocumentRequest) returns (RegisterDIDDocumentResponse);
+
+  // Save a verifiable credential.
+  rpc SaveCredential(SaveCredentialRequest) returns (SaveCredentialResponse);
+
+  // Search the DID registry.
+  rpc SearchDIDRegistry(SearchDIDRegistryRequest) returns (SearchDIDRegistryResponse);
+}
+
+message DeleteDIDRequest {
+  // Specify an individual DID as the target of the delete operation, or a Volt to delete all DIDs owned by that Volt.
+  oneof target {
+    // The id of the identity to delete.
+    string did = 1;
+
+    // Force delete of all DIDs owned by the specified Volt.
+    string origin_volt = 2;
+  }
+
+  // Optional passphrase of the DID controller key. Required if the key is encrypted.
+  string key_passphrase = 3;
+}
+
+message DeleteDIDResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message GetDIDRegistryUpdatesRequest {
+  // The id of the last update received.
+  // All updates since this id will be returned, limited to the maximum number of updates specified in the request.
+  // To fully synchronise, clients should continue calling this method until the response contains no updates.
+  // If this is the first call, then this should be set to 0.
+  uint64 since_id = 1;
+
+  // The maximum number of updates to return, defaults to 1000.
+  uint32 max_updates = 2;
+
+  // Filter by origin volt.
+  string origin_volt = 3;
+}
+
+message GetDIDRegistryUpdatesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updates.
+  repeated DIDRegistryUpdate update = 2;
+}
+
+message ImportCredentialRequest {
+  // Optional id of existing credential to import into. If not specified, a new credential will be created.
+  string id = 1;
+
+  // The JSON representation of the credential.
+  string json = 2;
+
+  // Optional id of the folder resource to save the credential in. This is ignored if the id field is specified.
+  string create_in_parent_id = 3;
+
+  // Optional description of the credential.
+  string description = 4;
+}
+
+message ImportCredentialResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The id assigned to the credential.
+  string id = 2;
+}
+
+message ParseCredentialRequest {
+  // Details of the credential to parse.
+  oneof credential {
+    // A presentation of the verifiable credential.
+    // The presentation doesn't need to be signed, but if it is, the signature will be verified using the public key provided in the request.
+    VerifiablePresentation verifiable_presentation = 1;
+
+    // A URL to a verifiable credential.
+    // Not yet implemented.
+    string url = 2;
+  }
+
+  // Optional public key to use to verify the presentation signature.
+  string presentation_public_key = 3;
+}
+
+message ParseCredentialResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The parsed credential details.
+  VerifiableCredential verifiable_credential = 2;
+}
+
+message ResolveDIDRequest {
+  // The DID to resolve.
+  string did = 1;
+
+  // Set to search all known registries rather than just the local registry.
+  bool include_registries = 2;
+}
+
+message ResolveDIDResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The JSON representation of the DID document.
+  string did_document = 2;
+
+  // The signature used to save this version of the DID document.
+  string update_signature = 3;
+
+  // The DID of the Volt that saved this version of the DID document.
+  string origin_volt = 4;
+
+  // Optional description associated with the DID document.
+  string description = 5;
+}
+
+message RegisterDIDDocumentRequest {
+  bool create = 1;
+
+  // The DID document to save.
+  DIDRegistryUpdate did_update = 2;
+
+  // When updating an existing DID document, it is necessary to include a signature of the document JSON, signed by the DID document's current owner.
+  string update_signature = 3;
+}
+
+message RegisterDIDDocumentResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  DIDRegistryUpdate did_document = 2;
+}
+
+message SaveCredentialRequest {
+  // A human-readable description of the credential.
+  string description = 1;
+
+  // Details of the credential to save.
+  VerifiableCredential verifiable_credential = 2;
+
+  // Optional id of the folder resource to save the credential in.
+  string create_in_parent_id = 3;
+}
+
+message SaveCredentialResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The id assigned to the credential.
+  string id = 2;
+
+  // The JSON representation of the credential.
+  string json = 3;
+}
+
+message SearchDIDRegistryRequest {
+  oneof filter {
+    // Filter by DID itself. This is a prefix match, so searching for 'did:volt:123' will match 'did:volt:1234'. You can also exclude the 'did:volt:' prefix.
+    string did_filter = 1;
+
+    // Filter by the (optional) description attached to the DID document. This will match any DID document whose description contains the specified string, for example 'John' will match 'John Smith', 'Elton John' and 'Jasper Johns-Frederick'.
+    string description_filter = 2;
+
+    // Filter by the origin Volt. This will match any DID document whose origin Volt matches exactly the given DID.
+    string origin_filter = 3;
+  }
+
+  // The page number to retrieve, defaults to 1.
+  uint32 page_number = 4;
+
+  // The number of results per page, defaults to 100.
+  uint32 page_size = 5;
+}
+
+message SearchDIDRegistryResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The DID documents that matched the search criteria.
+  repeated DIDRegistryUpdate did_document = 2;
+}
+`;
+export const status = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+message Status {
+  // A simple error code that can be easily handled by the client.
+  // Mirrors the grpc StatusCode enum, 0 => OK
+  int32 code = 1;
+
+  // A developer-facing human-readable error message in English. It should both explain the error and offer an actionable resolution to it.
+  string message = 2;
+
+  // Long form error description.
+  string description = 3;
+}
+`;
+export const terminal_api = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+
+service TerminalAPI {
+  rpc CommandStream(stream CommandStreamRequest) returns (stream CommandStreamResponse);
+}
+
+message TerminalSize {
+  int32 rows = 1;
+  int32 cols = 2;
+}
+
+message Control {
+  string command = 1;
+  repeated string arg = 2;
+  string stop = 3;
+  string pause = 4;
+  string resume = 5;
+  string reset = 6;
+  TerminalSize terminal_size = 7;
+  int32 interrupt = 8;
+}
+
+message Input {
+  bytes data = 1;
+}
+
+message CommandStreamRequest {
+  oneof payload {
+    Control control = 1;
+    Input input = 2;
+  }
+}
+
+message CommandStreamResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  bytes data = 2;
+}
+
+`;
+export const volt = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+enum DiscoveryMode {
+  DISCOVERY_MODE_UNKNOWN = 0;
+
+  // Only local identities with explicit policy PERMIT can discover.
+  DISCOVERY_MODE_TRUSTED = 1;
+
+  // Any bound local identity can discover.
+  DISCOVERY_MODE_PUBLIC = 2;
+
+  // Only identities with explicit policy PERMIT can discover, and the service will be available to local and non-local (Relayed) clients.
+  DISCOVERY_MODE_TRUSTED_GLOBAL = 3;
+
+  // Any bound identity can discover, and the service will be available to local and non-local (Relayed) clients.
+  DISCOVERY_MODE_PUBLIC_GLOBAL = 4;
+}
+
+enum OnlineStatus {
+  ONLINE_STATUS_UNKNOWN = 0;
+  ONLINE_STATUS_ONLINE = 1;
+  ONLINE_STATUS_OFFLINE = 2;
+}
+
+// Not used ATM.
+enum ResourceStatus {
+  RESOURCE_STATUS_UNKNOWN = 0;
+  RESOURCE_STATUS_LIVE = 1;
+  RESOURCE_STATUS_INACTIVE = 2;
+  RESOURCE_STATUS_DELETED = 999;
+}
+
+// Not used ATM.
+enum ShareMode {
+  SHARE_MODE_UNKNOWN = 0;
+  SHARE_MODE_TRUSTED = 1;
+  SHARE_MODE_PUBLIC_READ = 2;
+}
+
+// @todo currently this must align with AuthorisationDecision enum in policy library, but some of the values are irrelevant outside of the public API so we need a public-facing enum and some translation.
+enum PolicyDecision {
+  POLICY_DECISION_UNKNOWN = 0;
+  POLICY_DECISION_PROMPT = 1;
+  POLICY_DECISION_PERMIT = 2;
+  POLICY_DECISION_DENY = 3;
+  POLICY_DECISION_INDETERMINATE = 4;
+  POLICY_DECISION_NOT_APPLICABLE = 5;
+  POLICY_DECISION_APPLICABLE = 6;
+  POLICY_DECISION_PENDING = 7;
+}
+
+// Attribute data types.
+enum AttributeDataType {
+  ATTRIBUTE_DATA_TYPE_UNKNOWN = 0;
+  ATTRIBUTE_DATA_TYPE_STRING = 1;
+  ATTRIBUTE_DATA_TYPE_INTEGER = 2;
+  ATTRIBUTE_DATA_TYPE_REAL = 3;
+  ATTRIBUTE_DATA_TYPE_BOOLEAN = 4;
+  ATTRIBUTE_DATA_TYPE_BYTES = 5;
+
+  ATTRIBUTE_DATA_TYPE_IDENTITY = 100;
+  ATTRIBUTE_DATA_TYPE_RESOURCE = 101;
+}
+
+// Represents an outbound connection from a Volt to a remote service that will act as a proxy for that Volt.
+// This enables Volts to bypass firewall and NATs.
+// Example - connection from a Volt to a Relay Volt running on the public internet, such as tdxvolt.com
+message ProxyConnection {
+  // Unique connection id.
+  string id = 1;
+
+  // A human-readable name for the connection.
+  string name = 2;
+
+  // The remote address of the proxy service.
+  string address = 3;
+
+  // The certificate authority of the proxy service.
+  string ca_pem = 4;
+
+  // Indicates this connection is enabled.
+  bool enabled = 5;
+
+  // Indicates this connection is currently in use.
+  bool connected = 6;
+
+  // Indicates that this connection will handle HTTP proxying as well as GRPC.
+  bool enable_http_proxy = 8;
+
+  // Set to indicate the Volt API itself is not automatically exposed to the connection.
+  bool disable_volt_api = 9;
+
+  // Optional challenge that can be presented in the authentication request.
+  string challenge = 10;
+
+  // The id of the target Volt that this connection is bound to.
+  string target_id = 11;
+
+  // Indicates that this connection hosts a DID registry that we should synchronise with.
+  bool sync_did_registry = 12;
+
+  // The id of the last DID registry operation that was synchronised.
+  uint64 did_registry_sync_id = 13;
+
+  // Indicates that this connection hosts a DID registry that we should synchronise with.
+  bool sync_vc_registry = 14;
+
+  // The timestamp of the last VC registry operation that was synchronised.
+  uint64 vc_registry_sync_timestamp = 15;
+
+  string session_id = 16;
+
+  string certificate = 17;
+}
+
+enum SecureMode {
+  SECURE_MODE_UNKNOWN = 0;
+  SECURE_MODE_INSECURE = 1;
+  SECURE_MODE_TLS = 2;
+}
+
+// Encapsulates the various Volt parameters that are configurable by the Volt owner.
+message VoltParameters {
+  string id = 1;
+
+  // The name of the Volt.
+  string name = 2;
+
+  // Human-readable description of the Volt.
+  string description = 3;
+
+  // The database driver in use.
+  string db_driver = 4;
+
+  // The local file path location of the Volt storage.
+  string location = 5;
+
+  // The key strategy in use, this determines how the root key is stored.
+  string key_strategy = 6;
+
+  // The identifier for the key, the semantics depend on the key strategy in use.
+  string key_id = 7;
+
+  // The Volt certificate authority.
+  string ca_pem = 8;
+
+  // The Volt API server certificate.
+  string cert_pem = 9;
+
+  // Optional hostname of the Volt if using DNS or a static IP address, e.g. tdxvolt.com
+  string fixed_host = 10;
+
+  // Port to use for hosting the Volt management service.
+  int32 grpc_port = 11;
+
+  // Port to use for hosting the Volt grpc service.
+  int32 http_port = 12;
+
+  // The Volt http server key file path.
+  string http_key_path = 13;
+
+  // The Volt http server certificate file path.
+  string http_cert_path = 14;
+
+  // The Volt http server certificate authority chain file path.
+  string http_ca_path = 15;
+
+  // Indicates the Volt will be discoverable by clients using the discovery api.
+  bool discoverable = 16;
+
+  // Optional challenge code that can be used aid in the process of authenticating clients.
+  string authenticate_challenge = 18;
+
+  // Indicates that clients must present the correct challenge code in order to be able to authenticate.
+  bool require_authenticate_challenge = 19;
+
+  // Internal use only.
+  bool confirm_stop = 20;
+
+  // Internal use only.
+  bool auto_start = 21;
+
+  // Internal use only.
+  bool enable_messaging = 22;
+
+  // Set to indicate this Volt acts as a Relay.
+  // This means this Volt can act as a proxy for other Volts (or in fact any client) that connect to it.
+  bool has_relay = 23;
+
+  // Set to run the Relay open to any client, i.e. clients can utilise the Relay without first authenticating.
+  bool relay_open = 24;
+
+  // Determines if the Volt HTTP server is enabled.
+  bool enable_http_server = 25;
+
+  // Determines whether the HTTP server employs TLS.
+  bool http_server_secure = 26;
+
+  // Determines whether the HTTP server supports forwarding.
+  bool enable_http_forwarding = 27;
+
+  // Determines if the Volt REST API is exposed via the HTTP server.
+  bool enable_http_api = 28;
+
+  // Determines if the Volt Websocket API is exposed via the HTTP server.
+  bool enable_websocket_api = 29;
+
+  // The hostname:port at which the Volt API is currently running.
+  string address = 30;
+
+  // Set to indicate the Volt file store is encrypted.
+  bool encrypt_file_store = 31;
+
+  // This is a unique connection id.
+  // Indicates that these parameters refer to a connection to a remote Volt rather than a local Volt.
+  string connection_id = 32;
+
+  // The certificate authority of the Relay if this is a remote connection via a Relay.
+  string relay_ca_pem = 33;
+
+  // Optional override of the http address, rather than using the default of fixed_host:http_port.
+  // This is useful if the Volt is behind a firewall or NAT, and the http server is listening on a different port
+  // from 80 or 443 but this is hidden by the proxy. For example, if the \`fixed_host\` is \`coreid.com\` and http server is
+  // listening on 2115, but the proxy is forwarding 443 to 2115, then the http_address_override would be set to
+  // \`https://coreid.com\`.
+  string http_address_override = 34;
+
+  // An optional alias that can be used to refer to the Volt rather than the \`id\` field.
+  // This alias must be unique within the scope of the Battery in which the Volt is stored.
+  string alias = 35;
+
+  // The runtime version this Volt is running.
+  Version version = 36;
+
+  // If set, indicates that any client that provides the correct challenge during authentication will automatically be approved to access the Volt.
+  bool approve_on_challenge = 37;
+
+  // If set, indicates that any client that proves ownership of a DID known to the Volt will automatically be approved to access the Volt.
+  bool approve_on_did = 38;
+
+  // If set, indicates that clients can register DIDs with this Volt.
+  bool enable_did_registry = 39;
+
+  // Zero or more URLs of trusted peer DID registries.
+  repeated string did_registry = 40;
+
+  // If set, enables outbound SMTP.
+  bool enable_outbound_smtp = 41;
+
+  // The SMTP host to use for sending emails.
+  string outbound_smtp_host = 42;
+
+  // The SMTP port to use for sending emails.
+  uint32 outbound_smtp_port = 43;
+
+  // The SMTP username to use for sending emails.
+  string outbound_smtp_user = 44;
+
+  // The SMTP password to use for sending emails.
+  string outbound_smtp_password = 45;
+
+  // If set, enables sessions that authenticate using credentials rather than a DID to create resources in the 'anonymous' system folder.
+  bool enable_anonymous_create = 46;
+
+  // The decision to apply to all authentication requests that do not match any other policy.
+  // The default is PROMPT.
+  PolicyDecision catch_all_auth_decision = 47;
+
+  // If set, enables caching of policy decisions.
+  bool enable_policy_cache = 48;
+
+  // If set, enables the terminal API.
+  bool enable_terminal = 49;
+
+  // The time at which the Volt was started.
+  uint64 start_time = 50;
+}
+
+message VoltEndpoint {
+  // The globally unique Volt id.
+  string id = 1;
+
+  // Human-readable name of the Volt.
+  string display_name = 3;
+
+  // The actual host/ip the volt is physically running on (might be a local ip if behind firewall).
+  string local_address = 4;
+
+  // The address of the endpoint HTTP server.
+  string http_address = 5;
+
+  // The global (Relay) address of the volt. Any given volt may be advertising on more than one Relay instance. The value given here will depend on the Relay instance that handled the endpoint query response.
+  string relay_address = 6;
+
+  // The root certificate of the Relay instance referred to in \`relay_address\`.
+  string relay_ca_pem = 7;
+
+  // The self-signed certificate used by the volt to sign client certificates.
+  string ca_pem = 8;
+
+  // The Volt public key in PEM format.
+  string public_key = 9;
+
+  // The base58 fingerprint of the Volt public key.
+  string fingerprint = 10;
+
+  // The online status of the Volt.
+  OnlineStatus online_status = 11;
+
+  // Indicates that this Volt acts as a Relay.
+  bool has_relay = 12;
+
+  // The API version supported by the endpoint.
+  Version api_version = 13;
+
+  // Optional description of the endpoint.
+  string description = 14;
+
+  // The list of DID registries that this Volt trusts.
+  repeated string did_registry = 15;
+}
+
+// Internal use only.
+message MethodDescription {
+  string path = 1;
+  bool client_streaming = 2;
+  bool server_streaming = 3;
+}
+
+// Describes a single protobuf file for use in ServiceDescription.
+message ProtoFile {
+  // The path name of the proto file, relative to the 'root' of the namespace, e.g. "tdx/volt_api/volt/v1/volt.proto".
+  string file_path = 1;
+
+  // The actual protobuf file contents.
+  string protobuf = 2;
+
+  // Optional - the service(s) contained in this protobuf file, if omitted here they will be loaded dynamically from the protobuf.
+  repeated string service_name = 3;
+}
+
+enum ServiceHostType {
+  SERVICE_HOST_TYPE_UNKNOWN = 0;
+  // A built-in service hosted by the Volt.
+  SERVICE_HOST_TYPE_BUILTIN = 1;
+  // A service hosted by a grpc server other than the Volt.
+  SERVICE_HOST_TYPE_SERVER = 2;
+  // A service hosted by a Volt client via a relay connection, i.e. the service is not exposed by a server as such, rather a Volt client implements the service and a Volt acts as a proxy, calling back to the client to implement the methods.
+  SERVICE_HOST_TYPE_RELAYED = 3;
+}
+
+// Describes a Volt service.
+message ServiceDescription {
+  // The configuration used by the host of this service.
+  ServiceHostType host_type = 1;
+
+  // The identity of the client that is exposing the service.
+  // For example, if a third party is exposing a database service via a Volt, it will first authenticate and obtain a client DID and credentials in order to be able to create service resource(s).
+  // Any resources that are owned by this client will be marked as online if the client itself is online, i.e. has a live connection to the Volt.
+  // This will be empty if the service is a built-in Volt service.
+  string host_client_id = 2;
+
+  // The id of the resource that holds the protobuf definition for this resource.
+  // For example, if a third party is exposing a database service via a Volt, it will create a service resource that holds details of the protobuf methods exposed by the service.
+  // For built-in services, i.e. those hosted by the Volt, this will set to the Volt id.
+  string host_service_id = 3;
+
+  // The address of the grpc server hosting this service.
+  // Only relevant to grpc-hosted services.
+  string host_address = 4;
+
+  // The certificate authority (chain) that signed the service server certificate.
+  // This is only relevant to grpc-hosted services.
+  string host_ca_pem = 5;
+
+  // The public key of the service host, which is used to encrypt payloads.
+  // This may change as the service comes and goes online.
+  string host_public_key = 6;
+
+  // The connection id currently used to host this service.
+  string host_connection_id = 8;
+
+  // Internal use only.
+  string host_session_id = 9;
+
+  // The discovery mode.
+  DiscoveryMode discoverable = 10;
+
+  // The ping timestamp of the server hosting this service.
+  int64 ping_timestamp = 11;
+
+  // The protobuf definitions of the APIs exposed by this service.
+  repeated ProtoFile proto_file = 12;
+
+  // The fully qualified names of the protobuf services, for example tdx.volt_api.webcam.v1.WebcamControlAPI.
+  repeated string service_api = 13;
+
+  // Internal use only.
+  repeated MethodDescription method = 100;
+}
+
+// Attribute value will be one of the following fields, depending on the data type.
+message AttributeValue {
+  oneof value {
+    string string = 1;
+    int64 integer = 2;
+    double real = 3;
+    bool boolean = 4;
+    bytes bytes = 5;
+  }
+}
+
+// A resource attribute enables storing arbitrary data associated with a resource.
+message ResourceAttribute {
+  uint32 id = 1;
+
+  string attribute_id = 2;
+
+  string resource_id = 3;
+
+  AttributeDataType data_type = 4;
+
+  repeated AttributeValue value = 5;
+}
+
+// Using \`major\` and \`minor\` here upsets the GNU C Library, so we add a \`version_\` prefix.
+message Version {
+  uint32 version_major = 1;
+  uint32 version_minor = 2;
+  uint32 version_patch = 3;
+}
+
+// The core Resource metadata schema.
+message Resource {
+  // The globally unique resource id.
+  string id = 1;
+
+  // Optional description.
+  string description = 2;
+
+  // Human-readable resource name.
+  string name = 4;
+
+  // Not in use.
+  ShareMode share_mode = 5;
+
+  // The id of the Volt that hosts this resource.
+  string volt_id = 7;
+
+  // Optional description of any services exposed by this resource.
+  ServiceDescription service_description = 8;
+
+  // Attributes assigned to the resource.
+  repeated ResourceAttribute attribute = 9;
+
+  // The version of the platform.
+  Version platform_version = 10;
+
+  // The resource version.
+  uint64 version = 11;
+
+  // The identity of the resource owner.
+  string owner = 101;
+
+  // Creation timestamp, milliseconds since epoch.
+  uint64 created = 105;
+
+  // Last modification timestamp, milliseconds since epoch.
+  uint64 modified = 106;
+
+  // Not in use.
+  ResourceStatus status = 108;
+
+  // The taxonomy of the resource.
+  repeated string kind = 110;
+
+  // The online status.
+  // For most kinds of resource this indicates that the server hosting the resource is online, the exception being identity resources, in which case the status reflects whether or not the identity has a live connection.
+  // All built-in resources are hosted by the Volt itself and are therefore always online when the Volt is running.
+  // Resources hosted by external servers are online if the server itself is online and has registered the resource as online using \`setServiceStatus\`.
+  OnlineStatus online_status = 111;
+
+  // The size of the resource store in bytes.
+  uint64 size = 113;
+
+  // The path to the resource store.
+  string store = 114;
+
+  // Alias(es) that can be used to refer to the resource rather than the id.
+  // Each alias must be unique to the Volt, this is enforced by the API.
+  // No format restrictions are currently applied to alias, but this may change in future, for the time being it makes sense to stick to alphanumeric characters and '_' or '-'.
+  repeated string alias = 115;
+
+  // The hash of the resource content contained in the store.
+  string content_hash = 116;
+
+  // Not yet supported.
+  repeated Resource child = 200;
+}
+
+message IdentityAlias {
+  // The alias id.
+  uint32 id = 1;
+
+  // The corresponding identity id.
+  string identity_did = 2;
+
+  // The actual alias, e.g. a common name or key fingerprint.
+  string alias = 3;
+
+  // This will only be populated if alias_type == tdx:public-key
+  string public_key = 4;
+
+  // This will only be populated if alias_type == tdx:public-key, and the key is stored in the Volt.
+  string private_key = 5;
+
+  // The alias type, for example public key, email, phone number etc.
+  string alias_type = 6;
+
+  // The identity that issued this alias.
+  string issuer_id = 7;
+
+  // Indicates if this alias has an authenticate policy decision assigned.
+  PolicyDecision authenticate = 8;
+
+  // Optional description of this alias.
+  string description = 9;
+}
+
+// A Volt identity encompasses a Resource and a set of identity aliases.
+message Identity {
+  Resource resource = 1;
+
+  repeated IdentityAlias alias = 2;
+}
+
+message Access {
+  string id = 1;
+
+  // The resource being accessed.
+  string resource_id = 2;
+
+  // A human-readable short identifier of the resource.
+  string resource_name = 3;
+
+  // The identity that owns the resource.
+  string resource_owner = 4;
+
+  // The kind of resource.
+  repeated string resource_kind = 5;
+
+  oneof subject {
+    // The identity attempting access.
+    string identity_did = 6;
+
+    // The JSON path array for looking up verifiable credentials.
+    string credential_lookup = 7;
+  }
+
+  // A human-readable short identifier of the subject.
+  string identity_name = 8;
+
+  // The kind of identity.
+  repeated string identity_kind = 9;
+
+  // Requested access.
+  string access = 10;
+
+  // Optional extra data.
+  string extra = 11;
+
+  // Assigned decision.
+  PolicyDecision decision = 12;
+
+  bool recursive = 13;
+
+  // Time at which the request was made.
+  int64 request_time = 14;
+
+  // Time at which the decision was taken.
+  int64 decision_time = 15;
+
+  // Counter of number times this access was requested.
+  uint32 request_count = 16;
+}
+
+enum SessionStatus {
+  SESSION_STATUS_UNKNOWN = 0;
+  SESSION_STATUS_PENDING = 1;
+  SESSION_STATUS_LIVE = 2;
+  SESSION_STATUS_EXPIRED = 3;
+  SESSION_STATUS_REVOKED = 4;
+  SESSION_STATUS_REJECTED = 5;
+}
+
+message SessionCredential {
+  // The alias id.
+  uint32 id = 1;
+
+  // The corresponding session id.
+  string session_id = 2;
+
+  // The credential type, for example public key, verifiable credential, challenge etc.
+  string credential_type = 4;
+
+  // Optional description of this credential.
+  string description = 5;
+
+  // The id of the verifiable credential, if the credential type is volt:vc-claim.
+  string vc_id = 6;
+
+  // The verifiable credential in JSON format, if the credential type is volt:vc-claim.
+  string vc_json = 7;
+
+  // The subject id extracted from the \`vc_json\` field.
+  string vc_subject_id = 8;
+
+  // The issuer id extracted from the \`vc_json\` field.
+  string vc_issuer_id = 9;
+
+  // The comma-separated type(s) extracted from the \`vc_json\` field.
+  string vc_type = 10;
+
+  // The challenge string, if the credential type is volt:challenge.
+  string challenge = 11;
+
+  // The key fingerprint, if the credential type is volt:public-key.
+  string key_fingerprint = 12;
+
+  // The PEM-encoded public key, if the credential type is volt:public-key.
+  string public_key = 13;
+
+  // Optional PEM-encoded private key, if the credential type is volt:public-key. Only used for ephemeral REST-base sessions created dynamically after OTP authentication.
+  string private_key = 14;
+
+  // Type-specific extra data stored with the credential.
+  string extra = 15;
+
+  // More type-specific data stored with the credential.
+  string extra_2 = 16;
+}
+
+message Session {
+  string id = 1;
+
+  string identity_did = 2;
+
+  string identity_name = 3;
+
+  string ip = 4;
+
+  uint64 created = 5;
+
+  uint64 modified = 6;
+
+  uint64 expires = 7;
+
+  repeated SessionCredential credential = 8;
+
+  string origin = 9;
+
+  SessionStatus status = 10;
+}
+
+`;
+export const volt_api = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+import "tdx/volt_api/volt/v1/remote.proto";
+import "tdx/volt_api/volt/v1/ssi.proto";
+import "tdx/volt_api/volt/v1/volt.proto";
+
+// The top-level volt management service. 
+// With the exception of \`Authenticate\`, all RPCs on this service must submit either a valid client certificate signed by the volt CA, or a signed JWT.
+// A client certificate can be obtained from the \`Authenticate\` method.
+// All methods include a \`tdx.volt_api.volt.v1.Status\` in the response. If the status contains a non-OK error code the client should assume the remainder of the message is invalid, unless otherwise indicated in the response documentation.
+service VoltAPI {
+  // Issues a request to authenticate on the volt.
+  // All clients must successfully authenticate in order to gain any kind of access.
+  // A client certificate is optional for this RPC, if omitted a JWT must be provided in the call metadata.
+  // If the client plans to register one or more services with the Volt, it should use the 'host' field of the request so that the returned certificate has the appropriate SAN extension in place. Note that if the client IP address changes it will be necessary to re-authenticate the client and obtain a new certificate.
+  // If the authenticate decision is 'permit', the response contains various details that should be persisted by the client, including the unique identifier assigned by the Volt and a signed client certificate along with the Volt CA certificate.
+  rpc Authenticate(AuthenticateRequest) returns (AuthenticateResponse);
+
+  // Determine if an identity can perform a specific action on a resource.
+  // Third party services can use this to interrogate the Volt policy and determine if a client has permission to perform a certain action on a resource.
+  rpc CanAccessResource(CanAccessResourceRequest) returns (CanAccessResourceResponse);
+
+  rpc CheckCompatibility(CheckCompatibilityRequest) returns (CheckCompatibilityResponse);
+
+  // Creates a long-lived, bi-directional connection to the Volt.
+  // The connection stream serves several purposes, including remote invocations via a Relay, Volt event notifications, pings and service registration management.
+  // A connection stream is required in order for a client to be able to register services with the Volt.
+  // When the stream is closed, any services registered on it will be set to offline.
+  rpc Connect(stream ConnectRequest) returns (stream ConnectResponse);
+
+  // Copy a resource from one folder to another.
+  // The resource metadata, attributes and store are copied.
+  // The shares attributed to the resource are **not** currently copied.
+  // n.b. Copy resources between Volts is not supported by this API. This is achieved by creating an API instance for the source and target Volts, getting the resource from the source and creating it on the target.
+  rpc CopyResource(CopyResourceRequest) returns (CopyResourceResponse);
+
+  // Remove a custom access rule, such as a file share.
+  rpc DeleteAccess(DeleteAccessRequest) returns (DeleteAccessResponse);
+
+  // Delete a resource from this volt.
+  rpc DeleteResource(DeleteResourceRequest) returns (DeleteResourceResponse);
+
+  // Discover services running on this volt.
+  // Lookup is done via the exposed serviceAPI, e.g. tdx.volt_api.data.v1.SqliteServerAPI.
+  rpc DiscoverServices(DiscoverServicesRequest) returns (DiscoverServicesResponse);
+
+  // Get access rule details.
+  // Only rules in which the authenticated identity participates will be retrieved, in addition to any rules that target a resource that is owned by the authenticated identity.
+  // If the authenticated identity is the Volt root, all rules will be retrieved that match the criteria.
+  rpc GetAccess(GetAccessRequest) returns (GetAccessResponse);
+
+  // Retrieve identities matching the given criteria.
+  // Only identities that the authenticated identity has read access to will be retrieved.
+  rpc GetIdentities(GetIdentitiesRequest) returns (GetIdentitiesResponse);
+
+  // Get details of a specific identity.
+  // The identity will only be retrieved if the authenticated identity has read access to it.
+  rpc GetIdentity(GetIdentityRequest) returns (GetIdentityResponse);
+
+  // Gets a one-time token that can be used as a temporary authentication token, for example create an file download link that expires after a certain time.
+  rpc GetOneTimeToken(GetOneTimeTokenRequest) returns (GetOneTimeTokenResponse);
+
+  // Retrieve the Volt parameters.
+  // This is a privileged API call and requires Volt root access.
+  rpc GetParameters(GetParametersRequest) returns (GetParametersResponse);
+
+  // Retrieve the active Volt policy.
+  // This is a privileged API call and requires Volt root access.
+  rpc GetPolicy(GetPolicyRequest) returns (GetPolicyResponse);
+
+  // Get resource from this volt.
+  rpc GetResource(GetResourceRequest) returns (GetResourceResponse);
+
+  // Get resources from this volt.
+  rpc GetResources(GetResourcesRequest) returns (GetResourcesResponse);
+
+  // Get ancestors of a resource.
+  rpc GetResourceAncestors(GetResourceAncestorsRequest) returns (GetResourceAncestorsResponse);
+
+  // Get descendants of a resource.
+  rpc GetResourceDescendants(GetResourceDescendantsRequest) returns (GetResourceDescendantsResponse);
+
+  // Get sessions.
+  rpc GetSessions(GetSessionsRequest) returns (GetSessionsResponse);
+
+  // Invoke a method.
+  // This is primarily for use by Relay connections when proxying invocations.
+  rpc Invoke(stream InvokeRequest) returns (stream InvokeResponse);
+
+  // Move a resource from one folder to another.
+  rpc MoveResource(MoveResourceRequest) returns (MoveResourceResponse);
+
+  // Request access to a resource.
+  // The subject of the access is assumed to be the identity of the currently authenticated peer.
+  rpc RequestAccess(RequestAccessRequest) returns (RequestAccessResponse);
+
+  // Create or update an access rule.
+  rpc SaveAccess(SaveAccessRequest) returns (SaveAccessResponse);
+
+  // Create or update a static file HTTP server.
+  rpc SaveHttpFileServer(SaveResourceRequest) returns (SaveResourceResponse);
+
+  // Create or update an HTTP REST API server.
+  rpc SaveHttpApiServer(SaveResourceRequest) returns (SaveResourceResponse);
+
+  // Create or update an identity.
+  rpc SaveIdentity(SaveIdentityRequest) returns (SaveIdentityResponse);
+
+  // Create or update a mirrored link resource.
+  rpc SaveMirroredLink(SaveResourceRequest) returns (SaveResourceResponse);
+
+  // Update Volt parameters.
+  // This is a privileged call that requires Volt root access.
+  rpc SaveParameters(SaveParametersRequest) returns (SaveParametersResponse);
+
+  // Create or update resource in this volt.
+  rpc SaveResource(SaveResourceRequest) returns (SaveResourceResponse);
+
+  // Create or update a symbolic link resource.
+  rpc SaveSymbolicLink(SaveResourceRequest) returns (SaveResourceResponse);
+
+  // Save a session.
+  rpc SaveSession(SaveSessionRequest) returns (SaveSessionResponse);
+
+  // Set Volt access request decision.
+  // This is a privileged call that requires Volt root access.
+  rpc SetAccessRequestDecision(SetAccessRequestDecisionRequest) returns (SetAccessRequestDecisionResponse);
+
+  rpc SetPolicy(SetPolicyRequest) returns (SetPolicyResponse);
+
+  // Set the status of a Volt service.
+  rpc SetServiceStatus(SetServiceStatusRequest) returns (SetServiceStatusResponse);
+
+  // Used to shutdown remote Volts.
+  // This is a privileged call that requires Volt root access.
+  rpc Shutdown(ShutdownRequest) returns (ShutdownResponse);
+
+  // Sign or verify an arbitrary message using the Volt key.
+  rpc SignVerify(SignVerifyRequest) returns (SignVerifyResponse);
+}
+
+// Describes a request to authenticate on a Volt.
+// Present one of the \`public_key\`, \`did_public_key\`, \`did\`, or \`did_document\` fields.
+message AuthenticateRequest {
+
+  oneof client_identifier {
+    // The client public key in PEM format. The Volt will create a session that is bound to this public key.
+    string public_key = 1;
+
+    // The client public key - must be in PEM format. If the client DID is lost or unknown for some reason, providing the public key here will allow the Volt to match it with the previously registered DID.
+    // Note this is only valid when a DID has previously been registered using this public key.
+    string did_public_key = 2;
+
+    // An existing DID owned by the client.
+    // The JWT presented with the authenticate call must be signed by the private key corresponding to this DID.
+    string did = 3;
+
+    // If the client doesn't have an existing DID, a DID document can be provided here.
+    // The Volt will register the DID on behalf of the client.
+    // The JWT presented with the authenticate call must be signed by the private key corresponding to this document.
+    string did_document = 4;
+  }
+
+  // A base64-encoded signature of the DID document, only required if \`did_document\` is provided above.
+  string did_document_signature = 5;
+
+  // A human-readable name of the entity requesting to authenticate.
+  string client_name = 6;
+
+  // The volt challenge code, signed by the private key component of the \`public_key\` field above, and base64 encoded.
+  // This is optional.
+  string challenge = 7;
+
+  // The host name to add as a SAN to the issued certificate.
+  // This is optional, if you don't intend to host services with the certificate this can be omitted.
+  string host = 8;
+
+  // Optional verifiable credentials describing the client.
+  repeated VerifiablePresentation verifiable_presentation = 9;
+
+  // Reserved for internal use.
+  bool purge_aliases = 10;
+
+  // Optional additional name to differentiate between multiple sessions for a given client.
+  string session_name = 11;
+}
+
+message AuthenticateResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The unique session identifier assigned to this authentication.
+  // This should be persisted by the client, and submitted with all subsequent API calls as part of the call metadata.
+  string session_id = 2;
+
+  // The identity id assigned to this authentication.
+  string identity_did = 3;
+
+  // A certificate issued by the volt CA, binding the request public key to the identity.
+  // Only valid for PERMIT authenticate decisions.
+  string cert = 4;
+
+  // The volt CA chain. This is used by the client in subsequent API calls to secure the connection.
+  string chain = 5;
+
+  // The authenticate decision.
+  PolicyDecision decision = 6;
+
+  // Reserved for internal use.
+  int64 request_time = 7;
+
+  // Reserved for internal use.
+  int64 decision_time = 8;
+}
+
+message CanAccessResourceRequest {
+  oneof subject {
+    // The subject of the access request.
+    // This is optional, and if omitted will default to the authenticated account.
+    string token = 1;
+
+    // The subject of the access request.
+    // This is optional, and if omitted will default to the authenticated account.
+    string cert = 2;
+  }
+
+  // The resource in question.
+  string resource_id = 3;
+
+  // The type of access that is required.
+  string access = 4;
+}
+
+message CanAccessResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The identity subject that the access relates to.
+  string identity_did = 2;
+
+  // The resource the access relates to.
+  string resource_id = 4;
+
+  // The access type.
+  string access = 5;
+
+  // The policy decision for this access request.
+  PolicyDecision decision = 6;
+}
+
+message  CheckCompatibilityRequest {
+  // The client platform API version.
+  Version version = 1;
+}
+
+message CheckCompatibilityResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The target Volt API version.
+  Version version = 2;
+}
+
+// All fields in this message are optional, send an empty message if necessary.
+message ConnectHello {
+  // Optionally specify the grpc server address of the client. Only used if the client is a Volt (or service).
+  string address = 1;
+
+  // Set to automatically make **all** services owned by the calling identity online.
+  bool online_services = 3;
+
+  // Set to receive notification of resource events.
+  bool subscribe_resource_events = 4;
+
+  // Set this if you are connecting to a relay, i.e. the Volt you are sending to this message is a relay.
+  // This indicates that you are happy to receive method invocations from clients of the Relay.
+  // This will usually be set to the \`id\` of your Volt, but in theory any client could receive remote invocation requests in this way.
+  string relay_id = 5;
+
+  // A friendly name to present to Relay clients.
+  string relay_name = 6;
+
+  string relay_description = 7;
+
+  // The certificate authority to present to Relay clients.
+  string relay_ca_pem = 8;
+
+  // Set to indicate the connection is discoverable to other Relay clients.
+  bool relay_discoverable = 9;
+
+  // Optionally specify the address of the HTTP server to use for HTTP proxying. If set, a relay will forward HTTP requests to this address from the subdomain that matches the client's DID.
+  string relay_http_address = 10;
+
+  // Set to receive notification of authentication requests.
+  bool subscribe_auth_requests = 11;
+
+  // Set to indicate the connection will accept method invocation requests.
+  bool accept_invocation = 12;
+
+  // Set to subscribe to DID registry updates from the peer.
+  bool subscribe_did_registry_updates = 13;
+
+  // The interval at which the client will send ping requests to the target.
+  uint32 ping_interval = 14;
+
+  // The current time on the client.
+  uint64 timestamp = 15;
+
+  // Optionally specify the DID registries supported.
+  repeated string did_registry = 16;
+}
+
+message ConnectAcknowledge {
+  // A unique identifier for this connection.
+  string connection_id = 1;
+
+  // The current time on the Volt.
+  uint64 timestamp = 2;
+
+  // The interval at which the target will send ping requests to the client.
+  uint32 ping_interval = 3;
+}
+
+// A connection ping message - intentionally empty.
+message ConnectPing {
+}
+
+message ConnectGoodbye {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // Set if the connection was ended gracefully, as opposed to errored.
+  bool ended = 2;
+}
+
+message ConnectRelay {
+  // Indicates the Relay connection status.
+  bool connected = 1;
+}
+
+enum ConnectResourceEvent {
+  CONNECT_RESOURCE_EVENT_UNKNOWN = 0;
+  CONNECT_RESOURCE_EVENT_CREATE = 1;
+  CONNECT_RESOURCE_EVENT_UPDATE = 2;
+  CONNECT_RESOURCE_EVENT_DELETE = 3;
+  CONNECT_RESOURCE_EVENT_CREATE_CHILD = 4;
+  CONNECT_RESOURCE_EVENT_DELETE_CHILD = 5;
+  CONNECT_RESOURCE_EVENT_DATABASE_WRITE = 6;
+}
+
+message ConnectResource {
+  // The type of resource event that has occurred.
+  ConnectResourceEvent event = 1;
+
+  // Details of the resource.
+  Resource resource = 2;
+}
+
+message ConnectAuthRequest {
+  Session session = 1;
+
+  string context = 5;
+
+  string challenge = 6;
+
+  uint64 timestamp = 7;
+}
+
+message ConnectDIDRegistryUpdate {
+  DIDRegistryUpdate update = 1;
+}
+
+message ConnectEvent {
+  oneof event {
+    // An authentication request event.
+    ConnectAuthRequest connect_auth_request = 1;
+
+    // A resource event notification, such as updated or deleted.
+    ConnectResource connect_resource = 2;
+
+    // A DID registry entry update.
+    ConnectDIDRegistryUpdate did_registry_update = 3;
+  }
+}
+
+// One of the following payloads will be present in a given ConnectRequest message.
+message ConnectRequest {
+  oneof payload {
+    // A ConnectHello message is the first message a client sends to the target upon successfully starting the call.
+    ConnectHello hello = 1;
+
+    // Indicates the client is closing the connection.
+    ConnectGoodbye goodbye = 2;
+
+    // Clients should periodically send ping requests to the target to confirm the stream is still live.
+    ConnectPing ping = 4;
+
+    // Send invocation responses back to the caller.
+    // n.b. The 'request' and 'response' semantics are inverted with remote invocations because the Relayed connection is established by a request **from** the 'target' Volt to the Relay. Hence any invocation on behalf of a client of the Relay involves sending a **response** back down the Relay connection to the 'target' Volt.
+    InvokeResponse invoke_response = 5;
+
+    // Send HTTP response back to the originating request.
+    // n.b. The 'request' and 'response' semantics are inverted with HTTP proxying for the same reason as \`invoke_response\` above.
+    HttpResponse http_response = 6;
+  }
+}
+
+// One of the following payloads will be present in a given ConnectResponse message.
+message ConnectResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  oneof payload {
+    // Server response to initial handshake.
+    ConnectAcknowledge acknowledge = 2;
+
+    // Indicates the server is ending the connection.
+    ConnectGoodbye goodbye = 3;
+
+    // Notifies clients of various events on the Volt.
+    ConnectEvent evt = 4;
+
+    // Periodic ping response.
+    ConnectPing ping = 6;
+
+    // Send an invocation request to a remote target.
+    // n.b. The 'request' and 'response' semantics are inverted for remote invocations because the Relayed connection is established by a request **from** the 'target' Volt to the Relay. Hence any invocation on behalf of a client of the Relay involves sending a **response** back down the Relay connection to the 'target' Volt.
+    InvokeRequest invoke_request = 7;
+
+    // Send an HTTP request to a remote target.
+    // n.b. The 'request' and 'response' semantics are inverted for HTTP requests for the same reason as \`invoke_request\` above.
+    HttpRequest http_request = 8;
+  }
+}
+
+enum CopyResourceMode {
+  COPY_RESOURCE_MODE_UNKNOWN = 0;
+  COPY_RESOURCE_MODE_COPY = 1;
+  COPY_RESOURCE_MODE_LINK = 2;
+}
+
+message CopyResourceRequest {
+  // The id of the resource to copy.
+  string resource_id = 1;
+
+  // The id of the resource to receive the new copy.
+  string to_resource_id = 2;
+
+  // The copy mode to use.
+  CopyResourceMode mode = 3;
+
+  // Indicates if all descendants of the resource should be copied too. Only relevant for COPY_RESOURCE_MODE_COPY mode.
+  bool recursive = 4;
+
+  // The parent resource to link from, only relevant for COPY_RESOURCE_MODE_LINK mode.
+  string from_resource_id = 5;
+}
+
+message CopyResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message DeleteAccessRequest {
+  // The id of the access rule to delete.
+  string id = 1;
+}
+
+message DeleteAccessResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message DeleteResourceRequest {
+  // The resource to delete.
+  string resource_id = 1;
+
+  // Set to indicate all descendant resources should also be deleted.
+  // If this is not set and the resource has descendants, the call will fail.
+  bool recursive = 2;
+
+  // Set to attempt to unlink the resource from this parent resource, rather than completely delete it.
+  // The resource will be removed as a descendant from the \`parent_id\` resource. If the resource is has more than one parent, it will not be removed from those other parents.
+  // Note that if the resource's only parent is \`parent_id\` it will be removed from that parent and deleted as normal.
+  string parent_id = 3;
+}
+
+message DeleteResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message DiscoverServicesRequest {
+  // List the service APIs that should be discovered.
+  // The response will include services that match **any of** the terms given.
+  // Use of '*' to indicate wildcards is supported.
+  repeated string service_api = 1;
+
+  // Set to indicate that offline services should be included in the response.
+  bool include_offline = 2;
+
+  // Set to include the service attributes in the response.
+  bool include_attributes = 3;
+
+  // Set to include the service protobuf in the response.
+  bool include_protobuf = 4;
+}
+
+message DiscoverServicesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The services that were discovered.
+  repeated Resource resource = 2;
+}
+
+message GetAccessRequest {
+  // The resource id that is the target of the access rule. If omitted, all resources will be considered.
+  string resource_id = 1;
+
+  // The identity id that is the subject of the access rule. If omitted, all identities will be considered.
+  string identity_did = 2;
+
+  // The type of access to retrieve, if omitted all access will be considered.
+  string access = 4;
+
+  // The type of decision, if omitted all decisions will be considered.
+  PolicyDecision decision = 5;
+}
+
+message GetAccessResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The access rules that match the criteria.
+  repeated Access access = 2;
+}
+
+message GetIdentitiesRequest {
+  // Optional name of the identity.
+  // Use '*' to perform a wildcard search.
+  // If omitted all identities will be retrieved.
+  string name = 1;
+
+  // The identity alias criteria, if omitted all identities will be considered.
+  IdentityAlias alias = 2;
+}
+
+message GetIdentitiesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The identity list that matched the criteria.
+  repeated Identity identity = 2;
+}
+
+// One of \`identity_did\` or \`fingerprint\` must be populated.
+message GetIdentityRequest {
+  oneof lookup {
+    // The id of the identity to retrieve.
+    string identity_did = 1;
+    // The public key fingerprint of the identity to retrieve.
+    string fingerprint = 2;
+  }
+}
+
+message GetIdentityResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The identity details.
+  Identity identity = 2;
+}
+
+message GetOneTimeTokenRequest {
+  // Optional token TTL, in seconds. Default is 10 seconds.
+  int32 ttl = 1;
+}
+
+message GetOneTimeTokenResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The one-time token.
+  string token = 2;
+}
+
+// This an empty message.
+message GetParametersRequest {
+}
+
+message GetParametersResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The retrieved Volt parameters.
+  VoltParameters parameters = 2;
+}
+
+// This an empty message.
+message GetPolicyRequest {
+  // Set to only retrieve the custom policy document.
+  bool custom_policy = 1;
+}
+
+message GetPolicyResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The live policy in JSON format.
+  string policy = 2;
+}
+
+message GetResourceRequest {
+  // The id of the resource to retrieve.
+  string resource_id = 1;
+
+  // Set to include the resource attributes in the response.
+  bool include_attributes = 2;
+
+  // Set to include service description protobuf in the response, if applicable.
+  bool include_protobuf = 3;
+}
+
+message GetResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The retrieved resource metadata.
+  Resource resource = 2;
+}
+
+// By default, the lookup is performed by combining the criteria below in the form:
+// (id = id[0] or id = id[1]) and (name = name[0] or name = name[1]) etc...
+// To combine using 'or' rather than 'and', set the \`combine_terms_exclusive\` flag.
+// Also see note below regarding attributes.
+message GetResourcesRequest {
+  repeated string id = 1;
+
+  // Wildcards permitted.
+  repeated string name = 2;
+
+  // Wildcards permitted.
+  repeated string description = 3;
+
+  // Wildcards permitted.
+  repeated string kind = 4;
+
+  repeated string parent_id = 5;
+
+  // Wildcards permitted.
+  repeated string service_api = 6;
+
+  repeated string owner = 7;
+
+  repeated string store = 8;
+
+  // Indicates that the above terms should be combined using 'or' rather than 'and' (the default).
+  bool combine_terms_exclusive = 9;
+
+  // Attributes to search by.
+  repeated ResourceAttributeQuery attribute = 10;
+
+  // If set, will return resources where *any of* the attribute queries apply, otherwise will only return resources where *all of* the attribute queries apply.
+  bool any_of = 11;
+
+  // Set to include the resource attributes in the response.
+  bool include_attributes = 12;
+
+  // Set to include service description protobuf in the response where applicable.
+  bool include_protobuf = 13;
+
+  // Only retrieve resources that have been modified after the given timestamp. Default is 0, which means all resources will be returned.
+  uint64 modified_since = 14;
+
+  // Limit the number of resources returned. Default is 0, which means all resources will be returned.
+  uint32 limit = 15;
+}
+
+message GetResourcesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The list of resources that match the lookup.
+  repeated Resource resource = 2;
+}
+
+message GetResourceAncestorsRequest {
+  // The resource id whose ancestors will be retrieved.
+  string resource_id = 1;
+
+  // Optional - if set the resource_id resource will be included in the set of resources returned.
+  bool include_resource_id = 2;
+
+  // Optional - restrict the depth search, e.g. for immediate parents depth = 1
+  int32 depth = 3;
+
+  // Optional - only match ancestors of the given kind.
+  string ancestor_kind = 4;
+
+  // Optional - can be used to determine if a resource is an ancestor.
+  string ancestor_id = 5;
+
+  // Set to include the service attributes in the response.
+  bool include_attributes = 6;
+
+  // Set to include the service protobuf in the response.
+  bool include_protobuf = 7;
+}
+
+message GetResourceAncestorsResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The retrieved ancestors.
+  repeated Resource ancestor = 2;
+}
+
+message GetResourceDescendantsRequest {
+  // The resource id whose descendants will be retrieved.
+  string resource_id = 1;
+
+  // Optional - if set, the fully populated \`resource_id\` resource (i.e. the parent) will be included in the set of resources returned.
+  bool include_resource_id = 2;
+
+  // Optional - restrict the depth search, e.g. for immediate children depth = 1
+  int32 depth = 3;
+
+  // Optional - only match descendants of the given kind.
+  // If multiple kinds are given, resources matching **any of** the kinds will be included.
+  repeated string descendant_kind = 4;
+
+  // Optional - can be used to determine if a resource is a descendant.
+  string descendant_id = 5;
+
+  // Optional - restrict to descendants of a given parent, for use in multi-parent hierarchies.
+  string parent_id = 6;
+
+  // Restrict to a specific named resource.
+  string name = 7;
+
+  // Only retrieve resources that have been modified after the given timestamp. Default is 0, which means all resources will be returned.
+  uint64 modified_since = 8;
+
+  // Set to include the service attributes in the response.
+  bool include_attributes = 9;
+
+  // Set to include the service protobuf in the response.
+  bool include_protobuf = 10;
+}
+
+message GetResourceDescendantsResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The retrieved descendants.
+  repeated Resource descendant = 2;
+}
+
+message GetSessionsRequest {
+  string id = 1;
+
+  string identity_did = 2;
+
+  string identity_name = 3;
+
+  SessionStatus status = 4;
+}
+
+message GetSessionsResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  repeated Session session = 2;
+}
+
+message InvokeRequestKeyExchange {
+  bytes nonce = 1;
+
+  bytes encryption_key = 2;
+
+  bytes signature = 3;
+}
+
+message InvokeRequest {
+  // Client-assigned identifier for the request. Will be used to match responses and any subsequent requests.
+  uint64 invoke_id = 1;
+
+  // Optional client token to use for the invocation. This is for use by the websocket proxy and is only necessary on the first request of the rpc.
+  string token = 2;
+
+  // The DID of the target at each hop of the path to the service.
+  // This is used by Relays to route the request.
+  repeated string target_did = 4;
+
+  // The initialisation vector for the request payload encryption. This should be a random 16 byte value, that is different for each request.
+  bytes iv = 5;
+
+  // One of the following payloads will be present in a given InvokeRequest message.
+  oneof request_payload {
+    // A serialised and encrypted instance of \`RemoteResponse\` in pure binary format.
+    bytes payload = 6;
+
+    // A serialised and encrypted instance of \`RemoteResponse\` as serialised JSON.
+    bytes json_payload = 7;
+  }
+
+  // Indicates the client has ended the invocation.
+  bool client_end = 8;
+
+  // Reserved for internal use.
+  uint32 hop_index = 9;
+
+  // Reserved for internal use.
+  string target_service_id = 10;
+}
+
+message InvokeResponse {
+  // The invocation id to match the originating request.
+  uint64 invoke_id = 1;
+
+  InvokeRequestKeyExchange key_exchange = 2;
+
+  // The initialisation vector for the response payload encryption. This will be a random 16 byte value, that is different for each response.
+  bytes iv = 4;
+
+  // One of the following payloads will be present in a given InvokeResponse message.
+  oneof response_payload {
+    // A serialised and encrypted instance of \`RemoteRequest\` in pure binary format.
+    bytes payload = 5;
+
+    // A serialised and encrypted instance of \`RemoteRequest\` as serialised JSON.
+    bytes json_payload = 6;
+
+    // Details of any error that occurred on the call.
+    tdx.volt_api.volt.v1.Status status = 7;
+  }
+
+  // Indicates the server has ended the invocation.
+  bool server_end = 8;
+}
+
+message MoveResourceRequest {
+  // The id of the resource to move.
+  string resource_id = 1;
+
+  // The resource the parent folder to move the resource from.
+  string from_resource_id = 2;
+
+  // The target folder to move the resource into.
+  string to_resource_id = 3;
+}
+
+message MoveResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message RequestAccessRequest {
+  // The target resource id.
+  string resource_id = 1;
+
+  // The type of access requested.
+  string access = 3;
+}
+
+message RequestAccessResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The resource being accessed.
+  string resource_id = 2;
+
+  // The identity attempting access.
+  string identity_did = 3;
+
+  // Requested access.
+  string access = 5;
+
+  // Assigned decision.
+  PolicyDecision decision = 6;
+
+  // Time at which the request was made.
+  int64 request_time = 7;
+
+  // Time at which the decision was taken.
+  int64 decision_time = 8;
+
+  // Counter of number times this access was requested.
+  int32 request_count = 9;
+}
+
+message ResourceAttributeQuery {
+  string attribute_id = 1;
+  AttributeDataType data_type = 2;
+  AttributeValue value = 3;
+}
+
+message SaveAccessRequest {
+  // Omit \`id\` if creating new access.
+  Access access = 1;
+}
+
+message SaveAccessResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message SaveIdentityRequest {
+  // Details of the identity to save.
+  Identity identity = 1;
+
+  // Set to indicate this is a new identity.
+  bool create = 2;
+
+  // The list of aliases that should be removed.
+  // For example, this allows a simple form of key rotation whereby an existing public key alias is replaced by a new one while still maintaining the same root identity id.
+  repeated IdentityAlias delete_alias = 3;
+
+  // Reserved for system use.
+  string create_in_parent_id = 4;
+
+  // Set to indicate the identity aliases should be purged before saving the identity.
+  // If the \`identity\` field contains aliases they will be saved after the purge.
+  // If the \`identity\` field does not contain aliases this effectively deletes all aliases for this identity.
+  // This allows you to selectively update aliases if required, i.e. don't set this flag and include a single alias in the update.
+  bool purge_aliases = 5;
+
+  string did_document = 6;
+
+  // The signature of the identity did document, if present.
+  string did_update_signature = 7;
+}
+
+message SaveIdentityResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated identity details.
+  Identity identity = 2;
+}
+
+message SaveParametersRequest {
+  // The updated parameters.
+  VoltParameters parameters = 1;
+
+  // The current root key passphrase. Only necessary if changes are being made to the Volt key.
+  string key_passphrase = 2;
+
+  // The new root key passphrase. Only necessary if changes are being made to the Volt key.
+  string new_key_passphrase = 3;
+}
+
+message SaveParametersResponse {
+  // Details of any errors that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated Volt parameters.
+  VoltParameters parameters = 2;
+
+  // If set, the client will need to reconnect (usually because the key has changed).
+  bool reconnect = 3;
+}
+
+message SaveResourceRequest {
+  // Details of the resource to save.
+  Resource resource = 1;
+
+  // Set to indicate this is a new resource.
+  bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  // If the \`resource\` field contains attributes they will be saved after the purge.
+  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
+  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
+  bool purge_attributes = 4;
+}
+
+message SaveResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
+  Resource resource = 2;
+}
+
+message SaveSessionRequest {
+  Session session = 1;
+}
+
+message SaveSessionResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  Session session = 2;
+}
+
+message SetPolicyRequest {
+  string custom_policy = 1;
+}
+
+message SetPolicyResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message SetServiceStatusRequest {
+  // The service description details.
+  Resource service = 2;
+}
+
+message SetServiceStatusResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated service resource details.
+  Resource resource = 2;
+}
+
+message SetAccessRequestDecisionRequest {
+  // The id of the access request.
+  string id = 1;
+
+  // The decision to save against the access request.
+  PolicyDecision decision = 2;
+}
+
+message SetAccessRequestDecisionResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+// This message is emtpy.
+message ShutdownRequest {
+}
+
+message ShutdownResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message SignVerifyRequest {
+  // Set to indicate this is a request to verify rather than sign.
+  bool verify = 1;
+
+  // Set to indicate the signature should be base64 encoded in the response.
+  // Only valid when signing.
+  bool encode = 2;
+
+  // The message to sign.
+  // Only valid when signing.
+  string message = 3;
+
+  oneof digest {
+    // The digest in raw binary form.
+    // Only valid if verifying.
+    bytes digest_raw = 4;
+
+    // The digest encoded using base64.
+    // Only valid if verifying.
+    string digest_encoded = 5;
+  }
+}
+
+// Note that if verification was successful the response will be empty (there is no error and no digest is returned).
+message SignVerifyResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  oneof payload {
+    // The signature in raw binary form.
+    bytes digest = 2;
+
+    // The signature encoded using base64.
+    string digest_encoded = 3;
+  }
+}
+`;
+export const wire_api = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+
+// The Wire API allows clients to subscribe and publish to Volt wire resources.
+service WireAPI {
+  // Establishes a client-streaming call to the wire resource.
+  rpc PublishWire(stream PublishWireRequest) returns (stream PublishWireResponse);
+
+  // Establishes a bi-directional streaming call to the wire resource.
+  // Although we're only really interested in receiving data from the wire, a bi-directional stream is required so that we can gracefully stop the subscription.
+  rpc SubscribeWire(stream SubscribeWireRequest) returns (stream SubscribeWireResponse);
+}
+
+// Because the publish RPC is streaming, the policy will not be checked until the first message arrives. This can mean that the \`PublishWire\` call appears to succeed but then fails after the first attempt to publish a message.
+// To avoid this, clients can immediately send a message with the \`wire_id\` set and no \`chunk\` set. This will establish that the correct permissions are in place and fail fast if not.
+message PublishWireRequest {
+  // Only necessary in the first payload.
+  string wire_id = 1;
+
+  // The chunk of data to publish.
+  bytes chunk = 2;
+
+  // Whether to persist the chunk.
+  // This is only valid if the wire is configured to persist messages, i.e. the \`volt:wire-persist\` attribute is true.
+  bool do_not_persist = 3;
+}
+
+message PublishWireResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+// The request must include one of the following fields.
+message SubscribeWireRequest {
+  oneof payload {
+    // The wire id, only required for the first message.
+    string wire_id = 1;
+    // Request to stop the subscription.
+    bool stop = 2;
+  }
+}
+
+// One of the following fields will be present in the response.
+message SubscribeWireResponse {
+  oneof payload {
+    // Details of any error that occured on the call.
+    tdx.volt_api.volt.v1.Status status = 1;
+
+    // Data received from the wire.
+    bytes chunk = 2;
+  }
+}
+
+`;
+export const voltProtos = [sqlite, sqlite_database_api, sqlite_server_api, proxy_api, relay_api, sync, discovery_api, file, file_api, remote, spark_api, ssi, ssi_api, status, terminal_api, volt, volt_api, wire_api];