@tdxvolt/volt-client-grpc 0.18.9 → 0.19.0

package/lib/index.cjs

@@ -2,35 +2,36 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
+var voltClientWeb = require('@tdxvolt/volt-client-web');
+var uuid = require('uuid');
 var lodash = require('lodash');
 var ip = require('ip');
 var js = require('@tdxvolt/volt-client-web/js');
 var debug = require('debug');
-var EventEmitter = require('events');
-var fs = require('fs');
-var path = require('path');
-var bent = require('bent');
-var uuid = require('uuid');
 var Protobuf = require('protobufjs');
 var camelCase = require('lodash.camelcase');
 var descriptor = require('protobufjs/ext/descriptor/index.js');
+var EventEmitter = require('events');
+var fs = require('fs');
+var path = require('path');
 var jwt = require('jsonwebtoken');
+var crypto = require('crypto');
 
 function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
 
 var lodash__default = /*#__PURE__*/_interopDefaultLegacy(lodash);
 var ip__default = /*#__PURE__*/_interopDefaultLegacy(ip);
 var debug__default = /*#__PURE__*/_interopDefaultLegacy(debug);
-var EventEmitter__default = /*#__PURE__*/_interopDefaultLegacy(EventEmitter);
-var fs__default = /*#__PURE__*/_interopDefaultLegacy(fs);
-var path__default = /*#__PURE__*/_interopDefaultLegacy(path);
-var bent__default = /*#__PURE__*/_interopDefaultLegacy(bent);
 var Protobuf__default = /*#__PURE__*/_interopDefaultLegacy(Protobuf);
 var camelCase__default = /*#__PURE__*/_interopDefaultLegacy(camelCase);
 var descriptor__default = /*#__PURE__*/_interopDefaultLegacy(descriptor);
+var EventEmitter__default = /*#__PURE__*/_interopDefaultLegacy(EventEmitter);
+var fs__default = /*#__PURE__*/_interopDefaultLegacy(fs);
+var path__default = /*#__PURE__*/_interopDefaultLegacy(path);
 var jwt__default = /*#__PURE__*/_interopDefaultLegacy(jwt);
+var crypto__default = /*#__PURE__*/_interopDefaultLegacy(crypto);
 
-const constants = {
+const _constants = {
   authTokenName: "volt-token",
   defaultDIDHostName: "coreid.com",
   didServiceType: {
@@ -51,9 +52,18 @@ const constants = {
     terminalAPI: "tdx.volt_api.volt.v1.TerminalAPI",
     voltAPI: "tdx.volt_api.volt.v1.VoltAPI",
     wireAPI: "tdx.volt_api.volt.v1.WireAPI"
-  }
+  },
+  voltDIDPrefix: "did:volt:"
 };
 
+_constants.defaultRegistryList = [
+  _constants.defaultDIDHostName,
+  "https://tdxvolt.com",
+  "https://tdxid.com"
+];
+
+const constants = _constants;
+
 const createSecureContextOptions = (cryptoOptions) => {
   const tlsOptions = {
     cert: Buffer.from(cryptoOptions.cert),
@@ -353,842 +363,336 @@ var grpcUtils = /*#__PURE__*/Object.freeze({
   createServer: createServer
 });
 
-/* eslint-disable no-underscore-dangle */
-
-const {
-  aesCreateKey,
-  aesEncrypt: aesEncrypt$1,
-  aesDecrypt: aesDecrypt$1,
-  toBase64,
-  formatPEM: formatPEM$1,
-  keyFromPem: keyFromPem$2,
-  verify,
-  deriveSharedKey: deriveSharedKey$1,
-  x25519: x25519$1
-} = js.voltUtils;
-
-const invokeMethod = "Invoke";
-
-const log$5 = debug__default["default"]("volt-client-grpc:grpc-call");
-
-function _prepareInvokeRequest(
-  request,
-  method,
-  methodType = "METHOD_TYPE_UNARY"
-) {
-  const isServiceRelayed =
-    this._service?.service_description.host_type ===
-    "SERVICE_HOST_TYPE_RELAYED";
+/**
+ *
+ * This is copied from the proto-loader package file @grpc/proto-loader/build/src/index.js,
+ * simply in order to export the createPackageDefinition function, which we need to be
+ * able to dynamically load protobuf from strings stored in the Volt database rather than
+ * from files.
+ *
+ * There doesn't seem to be any plans to export this function from the package itself,
+ * see https://github.com/grpc/grpc-node/issues/550.
+ *
+ * This is deemed to be low-risk as the protobuf code is not expected to change often.
+ *
+ * Used by `getServiceDescriptors` in `proto-utils.js`.
+ *
+ */
 
-  const relaying = this._voltClient.isRelayed || isServiceRelayed;
+const IDEMPOTENCY_UNKNOWN = "IDEMPOTENCY_UNKNOWN";
 
-  let targetDID = [];
-  if (this._voltClient.isRelayed) {
-    targetDID.push(this._voltClient.voltConfig.id);
+const descriptorOptions = {
+  longs: String,
+  enums: String,
+  bytes: String,
+  defaults: true,
+  oneofs: true,
+  json: true
+};
+function joinName(baseName, name) {
+  if (baseName === "") {
+    return name;
+  } else {
+    return baseName + "." + name;
   }
-
-  if (isServiceRelayed) {
-    // Add another relay hop if the target service is relayed.
-    log$5("target service is relayed");
-    targetDID.push(this._service.service_description.host_client_id);
+}
+function isHandledReflectionObject(obj) {
+  return (
+    obj instanceof Protobuf__default["default"].Service ||
+    obj instanceof Protobuf__default["default"].Type ||
+    obj instanceof Protobuf__default["default"].Enum
+  );
+}
+function isNamespaceBase(obj) {
+  return obj instanceof Protobuf__default["default"].Namespace || obj instanceof Protobuf__default["default"].Root;
+}
+function getAllHandledReflectionObjects(obj, parentName) {
+  const objName = joinName(parentName, obj.name);
+  if (isHandledReflectionObject(obj)) {
+    return [[objName, obj]];
+  } else {
+    if (isNamespaceBase(obj) && typeof obj.nested !== "undefined") {
+      return Object.keys(obj.nested)
+        .map((name) => {
+          return getAllHandledReflectionObjects(obj.nested[name], objName);
+        })
+        .reduce(
+          (accumulator, currentValue) => accumulator.concat(currentValue),
+          []
+        );
+    }
   }
-
-  log$5("target is %j", targetDID);
-
-  // Use the service's host client id and public key if the service is relayed.
-  const methodToken = this._voltClient.credential.getIdentityMetadata(
-    this._voltClient.grpc,
-    this._service?.service_description.host_client_id ||
-      this._voltClient.voltConfig.id,
-    this._service?.service_description.host_public_key ||
-      this._voltClient.credential.voltPublicKey,
-    relaying
+  return [];
+}
+function createDeserializer(cls, options) {
+  return function deserialize(argBuf) {
+    return cls.toObject(cls.decode(argBuf), options);
+  };
+}
+function createSerializer(cls) {
+  return function serialize(arg) {
+    if (Array.isArray(arg)) {
+      throw new Error(
+        `Failed to serialize message: expected object with ${cls.name} structure, got array instead`
+      );
+    }
+    const message = cls.fromObject(arg);
+    return cls.encode(message).finish();
+  };
+}
+function mapMethodOptions(options) {
+  return (options || []).reduce(
+    (obj, item) => {
+      for (const [key, value] of Object.entries(item)) {
+        switch (key) {
+          case "uninterpreted_option":
+            obj.uninterpreted_option.push(item.uninterpreted_option);
+            break;
+          default:
+            obj[key] = value;
+        }
+      }
+      return obj;
+    },
+    {
+      deprecated: false,
+      idempotency_level: IDEMPOTENCY_UNKNOWN,
+      uninterpreted_option: []
+    }
   );
+}
+function createMethodDefinition(method, serviceName, options, fileDescriptors) {
+  /* This is only ever called after the corresponding root.resolveAll(), so we
+   * can assume that the resolved request and response types are non-null */
+  const requestType = method.resolvedRequestType;
+  const responseType = method.resolvedResponseType;
+  return {
+    path: "/" + serviceName + "/" + method.name,
+    requestStream: !!method.requestStream,
+    responseStream: !!method.responseStream,
+    requestSerialize: createSerializer(requestType),
+    requestDeserialize: createDeserializer(requestType, options),
+    responseSerialize: createSerializer(responseType),
+    responseDeserialize: createDeserializer(responseType, options),
+    // TODO(murgatroid99): Find a better way to handle this
+    originalName: camelCase__default["default"](method.name),
+    requestType: createMessageDefinition(requestType, fileDescriptors),
+    responseType: createMessageDefinition(responseType, fileDescriptors),
+    options: mapMethodOptions(method.parsedOptions)
+  };
+}
+function createServiceDefinition(service, name, options, fileDescriptors) {
+  const def = {};
+  for (const method of service.methodsArray) {
+    def[method.name] = createMethodDefinition(
+      method,
+      name,
+      options,
+      fileDescriptors
+    );
+  }
+  return def;
+}
+function createMessageDefinition(message, fileDescriptors) {
+  const messageDescriptor = message.toDescriptor("proto3");
+  return {
+    format: "Protocol Buffer 3 DescriptorProto",
+    type: messageDescriptor.$type.toObject(
+      messageDescriptor,
+      descriptorOptions
+    ),
+    fileDescriptorProtos: fileDescriptors
+  };
+}
+function createEnumDefinition(enumType, fileDescriptors) {
+  const enumDescriptor = enumType.toDescriptor("proto3");
+  return {
+    format: "Protocol Buffer 3 EnumDescriptorProto",
+    type: enumDescriptor.$type.toObject(enumDescriptor, descriptorOptions),
+    fileDescriptorProtos: fileDescriptors
+  };
+}
+/**
+ * function createDefinition(obj: Protobuf.Service, name: string, options:
+ * Options): ServiceDefinition; function createDefinition(obj: Protobuf.Type,
+ * name: string, options: Options): MessageTypeDefinition; function
+ * createDefinition(obj: Protobuf.Enum, name: string, options: Options):
+ * EnumTypeDefinition;
+ */
+function createDefinition(obj, name, options, fileDescriptors) {
+  if (obj instanceof Protobuf__default["default"].Service) {
+    return createServiceDefinition(obj, name, options, fileDescriptors);
+  } else if (obj instanceof Protobuf__default["default"].Type) {
+    return createMessageDefinition(obj, fileDescriptors);
+  } else if (obj instanceof Protobuf__default["default"].Enum) {
+    return createEnumDefinition(obj, fileDescriptors);
+  } else {
+    throw new Error("Type mismatch in reflection object handling");
+  }
+}
 
-  let invokeRequest;
-  let callMethod = method;
+function createPackageDefinition(root, options) {
+  const def = {};
+  root.resolveAll();
+  const descriptorList = root.toDescriptor("proto3").file;
+  const bufferList = descriptorList.map((value) =>
+    Buffer.from(descriptor__default["default"].FileDescriptorProto.encode(value).finish())
+  );
+  for (const [name, obj] of getAllHandledReflectionObjects(root, "")) {
+    def[name] = createDefinition(obj, name, options, bufferList);
+  }
+  return def;
+}
 
-  const voltGrpcClient = this._voltClient.getVoltAPIClient();
+/**
+ * This file is generated by the 'generate-proto-assets.js' script.
+ * Do not modify this file directly.
+ */
 
-  if (relaying) {
-    //
-    // If the volt connection is via a relay (or the target service is relayed),
-    // we wrap the rpc in a RemoteRequest message and send it via a call to Invoke().
-    //
+const sqlite = `syntax = "proto3";
 
-    // Replace the target method with a call to Invoke on the relay Volt.
-    callMethod = invokeMethod;
+package tdx.volt_api.data.v1;
 
-    // But first we need to perform a key exchange with the target service.
-    if (!this._encryptionKey) {
-      // We haven't exchanged keys yet, so queue the payload.
-      if (request) {
-        this._pendingRequests.push(request);
-      }
+// Just reflect SQLite types for now.
+enum DataType {
+  DATA_TYPE_UNKNOWN = 0;
+  DATA_TYPE_TEXT = 1;
+  DATA_TYPE_INTEGER = 2;
+  DATA_TYPE_REAL = 3;
+  DATA_TYPE_BLOB = 4;
+  DATA_TYPE_NULL = 5;
+}
 
-      if (this._keyExchangePending) {
-        // We've already sent the key exchange request, so do nothing.
-        log$5("key exchange pending, not sending payload");
-        return;
-      }
+message Column {
+  string name = 1;
+  string description = 2;
+  DataType type = 3;
+}
 
-      this._keyExchangePending = true;
+message Schema {
+  string name = 1;
+  string description = 2;
+  repeated Column column = 3;
+}
 
-      // Send the key exchange request.
-      invokeRequest = {
-        token: methodToken.token,
-        target_did: targetDID,
-        target_service_id: isServiceRelayed
-          ? this._service.service_description.host_service_id
-          : undefined
-      };
+message Variant {
+  oneof data {
+    string text = 1;
+    int64 integer = 2;
+    double real = 3;
+    bytes blob = 4;
+    bool null = 5;
+  }
+}
 
-      if (this._voltClient.isRelayed) {
-        // When tunnelling, we serialise the request using the original serialisation
-        // method for Invoke.
-        invokeRequest =
-          voltGrpcClient.Invoke.requestSerializeOriginal(invokeRequest);
-      }
+message RowHeader {
+  repeated Column column = 1;
+}
 
-      return {
-        request: invokeRequest,
-        method: callMethod,
-        methodName: method,
-        meta: methodToken
-      };
-    }
+message VariantRow {
+  repeated Variant column = 1;
+}
+`;
+const sqlite_database_api = `syntax = "proto3";
 
-    let requestPayload;
+package tdx.volt_api.data.v1;
 
-    // Serialise the rpc request using the original serialisation method.
-    if (request) {
-      if (this._voltClient.isRelayed) {
-        requestPayload =
-          this._grpcClient[method].requestSerializeOriginal(request);
-      } else {
-        requestPayload = this._grpcClient[method].requestSerialize(request);
-      }
-    } else if (request !== null) {
-      log$5("****************LOOKOUT****************** - empty request");
-    } else {
-      log$5("explicit empty request payload");
-    }
+import "tdx/volt_api/volt/v1/status.proto";
+import "tdx/volt_api/data/v1/sqlite.proto";
+import "tdx/volt_api/volt/v1/volt.proto";
 
-    // Create a tunnel message containing the method call metadata and request payload.
-    const tunnelResp = voltGrpcClient.Tunnel.responseSerialize({
-      method_invoke: {
-        method_name: this._grpcClient[method].path,
-        method_type: methodType,
-        request: requestPayload
-      }
-    });
+// The Sqlite Database API exposes functions that enable clients to manipulate data in a given Volt database.
+// Use the Sqlite Server API to create the database resource.
+service SqliteDatabaseAPI {
+  // Execute multiple SQL statements in a single transaction via a single RPC.
+  rpc BulkUpdate(SqlBulkUpdateRequest) returns (SqlBulkUpdateResponse);
 
-    // When sending via a relay we need to encrypt the payload.
-    const iv = aesCreateKey().iv;
-    const invokePayload = aesEncrypt$1(this._encryptionKey, iv, tunnelResp);
+  // Execute a single SQL statement. Any valid SQL is accepted. In order to execute non-SELECT statements, the caller must have the "write" permission.
+  rpc Execute(stream SqlExecuteRequest) returns (stream SqlExecuteResponse);
 
-    // Construct the Invoke request.
-    invokeRequest = {
-      iv,
-      payload: invokePayload
-    };
+  // Import CSV data into a table.
+  // The import handler will inspect the incoming CSV data, infer the columns and data types required, and create and populate the SQL table.
+  // The CSV must contain a header row containing the column names and at least one row of data so that the types can be inferred.
+  // The importer assumes all data in any given CSV file relates to a single table.
+  // The data can either be streamed in chunks or retrieved from an existing resource.
+  // If the data is streamed in chunks, the client must call the Close() method on the stream to indicate that it has finished.
+  rpc ImportCSV(stream SqlImportCSVRequest) returns (stream SqlImportCSVResponse);
+}
 
-    if (this._voltClient.isRelayed) {
-      // When tunnelling, we serialise the request using the original serialisation
-      // method for Invoke.
-      invokeRequest =
-        voltGrpcClient.Invoke.requestSerializeOriginal(invokeRequest);
-    }
-  } else {
-    invokeRequest = request;
-  }
+message SqlBulkUpdateRequest {
+  // The id of the database to update.
+  string database_id = 1;
 
-  return {
-    meta: methodToken,
-    method: callMethod,
-    methodName: method,
-    request: invokeRequest
-  };
+  // The SQL statements to execute. The statements will be executed within a transaction and will be committed if all statements succeed.
+  // Bear in mind the maximum size limit of a single message is 64MB, and around 1MB seems to be optimal in terms of performance.
+  repeated string statement = 2;
 }
 
-function _preparePayloadRequest(request, invokeInfo) {
-  let payloadRequest;
+message SqlBulkUpdateResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
 
-  const isServiceRelayed =
-    this._service?.service_description.host_type ===
-    "SERVICE_HOST_TYPE_RELAYED";
+message SqlExecuteStart {
+  // The id of the database to execute on.
+  string database_id = 1;
 
-  if (this._voltClient.isRelayed || isServiceRelayed) {
-    let requestPayload;
-    if (this._voltClient.isRelayed) {
-      // Serialise the rpc request using the original serialisation method.
-      requestPayload =
-        this._grpcClient[invokeInfo.methodName].requestSerializeOriginal(
-          request
-        );
-    } else {
-      requestPayload =
-        this._grpcClient[invokeInfo.methodName].requestSerialize(request);
-    }
+  // Set to start a transaction. If not set, each statement will be executed in its own transaction.
+  bool transaction = 2;
 
-    // Use the Tunnel method to serialise the relay request wrapper, this
-    const voltGrpcClient = this._voltClient.getVoltAPIClient();
+  // The SQL statement to execute.
+  string statement = 3;
 
-    // Create a tunnel message containing the method call metadata and request payload.
-    const tunnelResp = voltGrpcClient.Tunnel.responseSerialize({
-      method_payload: {
-        payload: requestPayload
-      }
-    });
+  // This can be used to limit the number of rows returned by \`SELECT\` statements to avoid overloading a client. It is similar to using 'LIMIT/OFFSET' clauses on the 'SELECT' statement, but this method is easier to manage and the entire result set will be prepared on the Volt, and the client can then page through it by sending successive messages.
+  uint32 page_size = 4;
 
-    // Encrypt the payload using the shared key.
-    const iv = aesCreateKey().iv;
-    const invokePayload = aesEncrypt$1(this._encryptionKey, iv, tunnelResp);
+  // Set to indicate that the query will be cancelled if the client disconnects.
+  // This is useful for long running queries, where it might be desirable for the client to be able to cancel the request before all the data is received. However this requires a worker thread to be allocated to the query until it completes, which may affect performance and limit the number of concurrent queries that can be executed due to file handle limitations.
+  // Only applicable to \`SELECT\` statements, ignored otherwise.
+  bool can_cancel = 5;
 
-    // We then serialise the entire request using the original serialisation method for Invoke.
-    payloadRequest = {
-      iv,
-      payload: invokePayload
-    };
+  //The values to set for each parameter defined in a database view.
+  //This field is only relevant to 'query' databases, i.e. those with kind \`tdx:sqlite-view\`.
+  //The values in the map should be keyed by parameter name.
+  // A query may have no parameters defined, in which case leave this field empty.
+  map<string, tdx.volt_api.volt.v1.AttributeValue> parameter = 6;
+}
 
-    if (this._voltClient.isRelayed) {
-      // When tunnelling, we serialise the request using the original serialisation
-      // method for Invoke.
-      payloadRequest =
-        voltGrpcClient.Invoke.requestSerializeOriginal(payloadRequest);
-    }
-  } else {
-    payloadRequest = request;
-  }
+// Intentionally empty.
+message SqlExecuteNext {
+}
 
-  return payloadRequest;
+// Ends the call.
+message SqlExecuteEnd {
+  // Set to commit the transaction. If not set, the transaction will be rolled back.
+  bool commit_transaction = 1;
 }
 
-function _parseResponse(method, meta, response) {
-  // log("parseResponse for %s", this._methodName);
-  let invokeResponse = {};
+message SqlExecuteRequest {
+  oneof payload {
+    // Initialise the request with the database id and whether to execute within a transaction.
+    // Also includes the SQL statement to execute.
+    SqlExecuteStart start = 2;
 
-  const isServiceRelayed =
-    this._service?.service_description.host_type ===
-    "SERVICE_HOST_TYPE_RELAYED";
+    // To retrieve subsequent pages, send a \`next\` request.
+    SqlExecuteNext next = 3;
 
-  const voltGrpcClient = this._voltClient.getVoltAPIClient();
+    // To end the call, send an \`end\` request. Only really necessary for transaction-based calls, otherwise clients can just close the stream.
+    SqlExecuteEnd end = 4;
+  }
+}
 
-  if (this._voltClient.isRelayed || isServiceRelayed) {
-    if (this._voltClient.isRelayed) {
-      // Deserialise the incoming response using the original deserialisation method for Invoke.
-      response = voltGrpcClient.Invoke.responseDeserializeOriginal(response);
-    }
+// One of the following fields will be present in any given message.
+message SqlExecuteResponse {
+  oneof payload {
+    // A status will be sent on error.
+    tdx.volt_api.volt.v1.Status status = 1;
 
-    if (response.key_exchange) {
-      const encryptionKey = response.key_exchange.encryption_key;
-      const nonce = response.key_exchange.nonce;
-      const signature = response.key_exchange.signature;
+    // The initial response for SELECT statements will be a header containing the column names and types.
+    RowHeader header = 2;
 
-      // The signed message is the encryption key and the nonce.
-      const message = new Uint8Array(encryptionKey.length + nonce.length);
-      message.set(encryptionKey);
-      message.set(nonce, encryptionKey.length);
-
-      // Check the signature using the target service public key.
-      const targetKey = keyFromPem$2(
-        this._service?.service_description?.host_public_key ||
-          this._voltClient.credential.voltPublicKey
-      ).publicKey;
-
-      if (!verify(targetKey, message, signature)) {
-        throw new Error("signature verification failed");
-      }
-
-      invokeResponse = {
-        key_exchange: {
-          encryption_key: formatPEM$1(toBase64(encryptionKey), "PUBLIC KEY")
-        }
-      };
-    } else if (response.payload) {
-      let decryptedPayload;
-      if (this._encryptionKey) {
-        decryptedPayload = aesDecrypt$1(
-          this._encryptionKey,
-          response.iv,
-          response.payload
-        );
-      } else {
-        decryptedPayload = response.payload;
-      }
-
-      // Deserialise the decrypted payload using the Tunnel deserialisation method.
-      const responsePayload =
-        voltGrpcClient.Tunnel.requestDeserialize(decryptedPayload);
-      if (responsePayload.payload === "method_payload") {
-        try {
-          // Deserialise the method payload.
-          if (this._voltClient.isRelayed) {
-            // Use the original deserialisation method for the target method.
-            invokeResponse.payload = this._grpcClient[
-              method
-            ].responseDeserializeOriginal(
-              responsePayload.method_payload.payload
-            );
-          } else {
-            invokeResponse.payload = this._grpcClient[
-              method
-            ].responseDeserialize(responsePayload.method_payload.payload);
-          }
-        } catch (err) {
-          log$5("failure deserialising payload for %s", this._methodName);
-          throw new Error(
-            "failure deserialising payload - check protobuf definition matches with data being sent"
-          );
-        }
-      } else if (responsePayload.payload === "method_end") {
-        invokeResponse = responsePayload.method_end;
-      } else {
-        log$5("unexpected tunnel payload type: %s", responsePayload.payload);
-      }
-    } else if (response.status?.message) {
-      // There's been an error in the tunnel.
-      log$5(
-        "Tunnel status received: %s, code %d, description: %s",
-        response.status.message,
-        response.status.code,
-        response.status.description || "n/a"
-      );
-      invokeResponse = {
-        ended: true,
-        error: `Error in tunnel: ${response.status.message}`
-      };
-    } else {
-      invokeResponse.methodId = response.invoke_id;
-      log$5("started method %d for %s", invokeResponse.methodId, method);
-    }
-  } else {
-    invokeResponse = { payload: response };
-  }
-
-  return invokeResponse;
-}
-
-class GRPCCall extends EventEmitter__default["default"] {
-  constructor(voltClient, methodName, methodType, service = undefined) {
-    super();
-    this._methodName = methodName;
-    this._methodType = methodType;
-    this._call = null;
-    this._voltClient = voltClient;
-    this._service = service;
-    this._keyExchangePending = false;
-    this._pendingRequests = [];
-    this._encryptionKey = null;
-    this._ended = false;
-  }
-
-  start(grpcClient, request, unary = false) {
-    this._grpcClient = grpcClient;
-
-    if (typeof this._grpcClient[this._methodName] !== "function") {
-      throw new Error(`method not found: '${this._methodName}'`);
-    }
-
-    this._initialRequest = _prepareInvokeRequest.call(
-      this,
-      request,
-      this._methodName,
-      this._methodType
-    );
-
-    const isServiceRelayed =
-      this._service?.service_description.host_type ===
-      "SERVICE_HOST_TYPE_RELAYED";
-
-    let callClient;
-    if (this._voltClient.isRelayed || isServiceRelayed) {
-      callClient = this._voltClient.getVoltAPIClient();
-    } else {
-      callClient = this._grpcClient;
-    }
-
-    this._call = callClient[this._initialRequest.method](
-      this._initialRequest?.meta?.metadata
-    );
-
-    this._call.on("data", (streamResponse) => {
-      if (this._ended) {
-        log$5("ignoring data after end on %s", this._methodName);
-        return;
-      }
-
-      try {
-        const parsedResponse = _parseResponse.call(
-          this,
-          this._methodName,
-          this._initialRequest.meta,
-          streamResponse
-        );
-        if (parsedResponse.key_exchange) {
-          const peerKey = keyFromPem$2(
-            parsedResponse.key_exchange.encryption_key
-          ).publicKey;
-
-          this._encryptionKey = deriveSharedKey$1(
-            this._initialRequest.meta.sharedKey.key,
-            peerKey,
-            x25519$1
-          );
-
-          // We've exchanged keys, so send any queued payloads on the next tick.
-          process.nextTick(() => {
-            this._pendingRequests.forEach((pendingRequest) => {
-              this.write(pendingRequest);
-            });
-            this._pendingRequests = [];
-          });
-        } else if (parsedResponse.payload) {
-          // Interpret a non-empty status message as an error.
-          if (parsedResponse.payload?.status?.message) {
-            this.emit(
-              "error",
-              new Error(parsedResponse.payload.status.message)
-            );
-          } else {
-            this.emit("data", parsedResponse.payload);
-          }
-        } else if (parsedResponse.ended) {
-          if (parsedResponse.error) {
-            this.emit("error", new Error(parsedResponse.error));
-          } else {
-            // Not sure this is necessary - we should receive "end" from grpc soon...
-            this.emit("end");
-          }
-        } else {
-          log$5("method id is %s", parsedResponse.methodId);
-        }
-      } catch (err) {
-        log$5(
-          "failure processing %s call response: %s",
-          this._methodName,
-          err.message
-        );
-        this.emit("error", err);
-      }
-    });
-
-    this._call.on("error", (err) => {
-      log$5(
-        "ERROR - intercepted stream error on %s: %s",
-        this._methodName,
-        err.message
-      );
-      this.emit("error", err);
-    });
-
-    this._call.on("finish", () => {
-      // The read side has ended (i.e. we called end()).
-      log$5("finished call %s", this._methodName);
-      this.emit("finish");
-    });
-
-    this._call.on("end", () => {
-      // The remote peer ended the stream.
-      log$5(
-        "ended call %s, method id: %s",
-        this._methodName,
-        this._initialRequest.methodId || "n/a - not tunnelling"
-      );
-      this.emit("end");
-    });
-
-    if (this._initialRequest.request) {
-      if (unary) {
-        this._call.end(this._initialRequest.request);
-      } else {
-        // Allow callee to attach event handlers before we actually send the initial payload.
-        process.nextTick(() => this._call.write(this._initialRequest.request));
-      }
-    }
-
-    return this;
-  }
-
-  end() {
-    if (this._call) {
-      this._ended = true;
-      return this._call.end();
-    } else {
-      throw new Error("call not initialised");
-    }
-  }
-
-  pause() {
-    log$5("pausing call %s", this._methodName);
-    return this._call?.pause();
-  }
-
-  resume() {
-    log$5("resuming call %s", this._methodName);
-    return this._call?.resume();
-  }
-
-  get writable() {
-    return this._call?.writable;
-  }
-
-  write(request) {
-    if (!this._call) {
-      log$5("ERROR - call not initialised");
-      throw new Error("call not initialised");
-    } else if (this._initialRequest && !this._keyExchangePending) {
-      const payloadRequest = _preparePayloadRequest.call(
-        this,
-        request,
-        this._initialRequest
-      );
-      return this._call.write(payloadRequest);
-    } else {
-      this._keyExchangePending = false;
-
-      this._initialRequest = _prepareInvokeRequest.call(
-        this,
-        request,
-        this._methodName,
-        this._methodType
-      );
-
-      return this._call.write(this._initialRequest.request);
-    }
-  }
-}
-
-/**
- *
- * This is copied from the proto-loader package file @grpc/proto-loader/build/src/index.js,
- * simply in order to export the createPackageDefinition function, which we need to be
- * able to dynamically load protobuf from strings stored in the Volt database rather than
- * from files.
- *
- * There doesn't seem to be any plans to export this function from the package itself,
- * see https://github.com/grpc/grpc-node/issues/550.
- *
- * This is deemed to be low-risk as the protobuf code is not expected to change often.
- *
- * Used by `getServiceDescriptors` in `proto-utils.js`.
- *
- */
-
-const IDEMPOTENCY_UNKNOWN = "IDEMPOTENCY_UNKNOWN";
-
-const descriptorOptions = {
-  longs: String,
-  enums: String,
-  bytes: String,
-  defaults: true,
-  oneofs: true,
-  json: true
-};
-function joinName(baseName, name) {
-  if (baseName === "") {
-    return name;
-  } else {
-    return baseName + "." + name;
-  }
-}
-function isHandledReflectionObject(obj) {
-  return (
-    obj instanceof Protobuf__default["default"].Service ||
-    obj instanceof Protobuf__default["default"].Type ||
-    obj instanceof Protobuf__default["default"].Enum
-  );
-}
-function isNamespaceBase(obj) {
-  return obj instanceof Protobuf__default["default"].Namespace || obj instanceof Protobuf__default["default"].Root;
-}
-function getAllHandledReflectionObjects(obj, parentName) {
-  const objName = joinName(parentName, obj.name);
-  if (isHandledReflectionObject(obj)) {
-    return [[objName, obj]];
-  } else {
-    if (isNamespaceBase(obj) && typeof obj.nested !== "undefined") {
-      return Object.keys(obj.nested)
-        .map((name) => {
-          return getAllHandledReflectionObjects(obj.nested[name], objName);
-        })
-        .reduce(
-          (accumulator, currentValue) => accumulator.concat(currentValue),
-          []
-        );
-    }
-  }
-  return [];
-}
-function createDeserializer(cls, options) {
-  return function deserialize(argBuf) {
-    return cls.toObject(cls.decode(argBuf), options);
-  };
-}
-function createSerializer(cls) {
-  return function serialize(arg) {
-    if (Array.isArray(arg)) {
-      throw new Error(
-        `Failed to serialize message: expected object with ${cls.name} structure, got array instead`
-      );
-    }
-    const message = cls.fromObject(arg);
-    return cls.encode(message).finish();
-  };
-}
-function mapMethodOptions(options) {
-  return (options || []).reduce(
-    (obj, item) => {
-      for (const [key, value] of Object.entries(item)) {
-        switch (key) {
-          case "uninterpreted_option":
-            obj.uninterpreted_option.push(item.uninterpreted_option);
-            break;
-          default:
-            obj[key] = value;
-        }
-      }
-      return obj;
-    },
-    {
-      deprecated: false,
-      idempotency_level: IDEMPOTENCY_UNKNOWN,
-      uninterpreted_option: []
-    }
-  );
-}
-function createMethodDefinition(method, serviceName, options, fileDescriptors) {
-  /* This is only ever called after the corresponding root.resolveAll(), so we
-   * can assume that the resolved request and response types are non-null */
-  const requestType = method.resolvedRequestType;
-  const responseType = method.resolvedResponseType;
-  return {
-    path: "/" + serviceName + "/" + method.name,
-    requestStream: !!method.requestStream,
-    responseStream: !!method.responseStream,
-    requestSerialize: createSerializer(requestType),
-    requestDeserialize: createDeserializer(requestType, options),
-    responseSerialize: createSerializer(responseType),
-    responseDeserialize: createDeserializer(responseType, options),
-    // TODO(murgatroid99): Find a better way to handle this
-    originalName: camelCase__default["default"](method.name),
-    requestType: createMessageDefinition(requestType, fileDescriptors),
-    responseType: createMessageDefinition(responseType, fileDescriptors),
-    options: mapMethodOptions(method.parsedOptions)
-  };
-}
-function createServiceDefinition(service, name, options, fileDescriptors) {
-  const def = {};
-  for (const method of service.methodsArray) {
-    def[method.name] = createMethodDefinition(
-      method,
-      name,
-      options,
-      fileDescriptors
-    );
-  }
-  return def;
-}
-function createMessageDefinition(message, fileDescriptors) {
-  const messageDescriptor = message.toDescriptor("proto3");
-  return {
-    format: "Protocol Buffer 3 DescriptorProto",
-    type: messageDescriptor.$type.toObject(
-      messageDescriptor,
-      descriptorOptions
-    ),
-    fileDescriptorProtos: fileDescriptors
-  };
-}
-function createEnumDefinition(enumType, fileDescriptors) {
-  const enumDescriptor = enumType.toDescriptor("proto3");
-  return {
-    format: "Protocol Buffer 3 EnumDescriptorProto",
-    type: enumDescriptor.$type.toObject(enumDescriptor, descriptorOptions),
-    fileDescriptorProtos: fileDescriptors
-  };
-}
-/**
- * function createDefinition(obj: Protobuf.Service, name: string, options:
- * Options): ServiceDefinition; function createDefinition(obj: Protobuf.Type,
- * name: string, options: Options): MessageTypeDefinition; function
- * createDefinition(obj: Protobuf.Enum, name: string, options: Options):
- * EnumTypeDefinition;
- */
-function createDefinition(obj, name, options, fileDescriptors) {
-  if (obj instanceof Protobuf__default["default"].Service) {
-    return createServiceDefinition(obj, name, options, fileDescriptors);
-  } else if (obj instanceof Protobuf__default["default"].Type) {
-    return createMessageDefinition(obj, fileDescriptors);
-  } else if (obj instanceof Protobuf__default["default"].Enum) {
-    return createEnumDefinition(obj, fileDescriptors);
-  } else {
-    throw new Error("Type mismatch in reflection object handling");
-  }
-}
-
-function createPackageDefinition(root, options) {
-  const def = {};
-  root.resolveAll();
-  const descriptorList = root.toDescriptor("proto3").file;
-  const bufferList = descriptorList.map((value) =>
-    Buffer.from(descriptor__default["default"].FileDescriptorProto.encode(value).finish())
-  );
-  for (const [name, obj] of getAllHandledReflectionObjects(root, "")) {
-    def[name] = createDefinition(obj, name, options, bufferList);
-  }
-  return def;
-}
-
-/**
- * This file is generated by the 'generate-proto-assets.js' script.
- * Do not modify this file directly.
- */
-
-const sqlite = `syntax = "proto3";
-
-package tdx.volt_api.data.v1;
-
-// Just reflect SQLite types for now.
-enum DataType {
-  DATA_TYPE_UNKNOWN = 0;
-  DATA_TYPE_TEXT = 1;
-  DATA_TYPE_INTEGER = 2;
-  DATA_TYPE_REAL = 3;
-  DATA_TYPE_BLOB = 4;
-  DATA_TYPE_NULL = 5;
-}
-
-message Column {
-  string name = 1;
-  string description = 2;
-  DataType type = 3;
-}
-
-message Schema {
-  string name = 1;
-  string description = 2;
-  repeated Column column = 3;
-}
-
-message Variant {
-  oneof data {
-    string text = 1;
-    int64 integer = 2;
-    double real = 3;
-    bytes blob = 4;
-    bool null = 5;
-  }
-}
-
-message RowHeader {
-  repeated Column column = 1;
-}
-
-message VariantRow {
-  repeated Variant column = 1;
-}
-`;
-const sqlite_database_api = `syntax = "proto3";
-
-package tdx.volt_api.data.v1;
-
-import "tdx/volt_api/volt/v1/status.proto";
-import "tdx/volt_api/data/v1/sqlite.proto";
-import "tdx/volt_api/volt/v1/volt.proto";
-
-// The Sqlite Database API exposes functions that enable clients to manipulate data in a given Volt database.
-// Use the Sqlite Server API to create the database resource.
-service SqliteDatabaseAPI {
-  // Execute multiple SQL statements in a single transaction via a single RPC.
-  rpc BulkUpdate(SqlBulkUpdateRequest) returns (SqlBulkUpdateResponse);
-
-  // Execute a single SQL statement. Any valid SQL is accepted. In order to execute non-SELECT statements, the caller must have the "write" permission.
-  rpc Execute(stream SqlExecuteRequest) returns (stream SqlExecuteResponse);
-
-  // Import CSV data into a table.
-  // The import handler will inspect the incoming CSV data, infer the columns and data types required, and create and populate the SQL table.
-  // The CSV must contain a header row containing the column names and at least one row of data so that the types can be inferred.
-  // The importer assumes all data in any given CSV file relates to a single table.
-  // The data can either be streamed in chunks or retrieved from an existing resource.
-  // If the data is streamed in chunks, the client must call the Close() method on the stream to indicate that it has finished.
-  rpc ImportCSV(stream SqlImportCSVRequest) returns (stream SqlImportCSVResponse);
-}
-
-message SqlBulkUpdateRequest {
-  // The id of the database to update.
-  string database_id = 1;
-
-  // The SQL statements to execute. The statements will be executed within a transaction and will be committed if all statements succeed.
-  // Bear in mind the maximum size limit of a single message is 64MB, and around 1MB seems to be optimal in terms of performance.
-  repeated string statement = 2;
-}
-
-message SqlBulkUpdateResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
-message SqlExecuteStart {
-  // The id of the database to execute on.
-  string database_id = 1;
-
-  // Set to start a transaction. If not set, each statement will be executed in its own transaction.
-  bool transaction = 2;
-
-  // The SQL statement to execute.
-  string statement = 3;
-
-  // This can be used to limit the number of rows returned by \`SELECT\` statements to avoid overloading a client. It is similar to using 'LIMIT/OFFSET' clauses on the 'SELECT' statement, but this method is easier to manage and the entire result set will be prepared on the Volt, and the client can then page through it by sending successive messages.
-  uint32 page_size = 4;
-
-  // Set to indicate that the query will be cancelled if the client disconnects.
-  // This is useful for long running queries, where it might be desirable for the client to be able to cancel the request before all the data is received. However this requires a worker thread to be allocated to the query until it completes, which may affect performance and limit the number of concurrent queries that can be executed due to file handle limitations.
-  // Only applicable to \`SELECT\` statements, ignored otherwise.
-  bool can_cancel = 5;
-
-  //The values to set for each parameter defined in a database view.
-  //This field is only relevant to 'query' databases, i.e. those with kind \`tdx:sqlite-view\`.
-  //The values in the map should be keyed by parameter name.
-  // A query may have no parameters defined, in which case leave this field empty.
-  map<string, tdx.volt_api.volt.v1.AttributeValue> parameter = 6;
-}
-
-// Intentionally empty.
-message SqlExecuteNext {
-}
-
-// Ends the call.
-message SqlExecuteEnd {
-  // Set to commit the transaction. If not set, the transaction will be rolled back.
-  bool commit_transaction = 1;
-}
-
-message SqlExecuteRequest {
-  oneof payload {
-    // Initialise the request with the database id and whether to execute within a transaction.
-    // Also includes the SQL statement to execute.
-    SqlExecuteStart start = 2;
-
-    // To retrieve subsequent pages, send a \`next\` request.
-    SqlExecuteNext next = 3;
-
-    // To end the call, send an \`end\` request. Only really necessary for transaction-based calls, otherwise clients can just close the stream.
-    SqlExecuteEnd end = 4;
-  }
-}
-
-// One of the following fields will be present in any given message.
-message SqlExecuteResponse {
-  oneof payload {
-    // A status will be sent on error.
-    tdx.volt_api.volt.v1.Status status = 1;
-
-    // The initial response for SELECT statements will be a header containing the column names and types.
-    RowHeader header = 2;
-
-    // Each row in the result set will be sent as a VariantRow.
-    VariantRow row = 3;
+    // Each row in the result set will be sent as a VariantRow.
+    VariantRow row = 3;
 
     // NYI - For INSERT/UPDATE statements the number of affected rows will be sent.
     uint32 affected_rows = 4;
@@ -3318,860 +2822,1367 @@ enum ConnectResourceEvent {
   CONNECT_RESOURCE_EVENT_DATABASE_WRITE = 6;
 }
 
-message ConnectResource {
-  // The type of resource event that has occurred.
-  ConnectResourceEvent event = 1;
+message ConnectResource {
+  // The type of resource event that has occurred.
+  ConnectResourceEvent event = 1;
+
+  // Details of the resource.
+  Resource resource = 2;
+}
+
+message ConnectAuthRequest {
+  Session session = 1;
+
+  string context = 5;
+
+  string challenge = 6;
+
+  uint64 timestamp = 7;
+}
+
+message ConnectDIDRegistryUpdate {
+  DIDRegistryUpdate update = 1;
+}
+
+message ConnectEvent {
+  oneof event {
+    // An authentication request event.
+    ConnectAuthRequest connect_auth_request = 1;
+
+    // A resource event notification, such as updated or deleted.
+    ConnectResource connect_resource = 2;
+
+    // A DID registry entry update.
+    ConnectDIDRegistryUpdate did_registry_update = 3;
+  }
+}
+
+// One of the following payloads will be present in a given ConnectRequest message.
+message ConnectRequest {
+  oneof payload {
+    // A ConnectHello message is the first message a client sends to the target upon successfully starting the call.
+    ConnectHello hello = 1;
+
+    // Indicates the client is closing the connection.
+    ConnectGoodbye goodbye = 2;
+
+    // Clients should periodically send ping requests to the target to confirm the stream is still live.
+    ConnectPing ping = 4;
+
+    // Send invocation responses back to the caller.
+    // n.b. The 'request' and 'response' semantics are inverted with remote invocations because the Relayed connection is established by a request **from** the 'target' Volt to the Relay. Hence any invocation on behalf of a client of the Relay involves sending a **response** back down the Relay connection to the 'target' Volt.
+    InvokeResponse invoke_response = 5;
+
+    // Send HTTP response back to the originating request.
+    // n.b. The 'request' and 'response' semantics are inverted with HTTP proxying for the same reason as \`invoke_response\` above.
+    HttpResponse http_response = 6;
+  }
+}
+
+// One of the following payloads will be present in a given ConnectResponse message.
+message ConnectResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  oneof payload {
+    // Server response to initial handshake.
+    ConnectAcknowledge acknowledge = 2;
+
+    // Indicates the server is ending the connection.
+    ConnectGoodbye goodbye = 3;
+
+    // Notifies clients of various events on the Volt.
+    ConnectEvent evt = 4;
+
+    // Periodic ping response.
+    ConnectPing ping = 6;
+
+    // Send an invocation request to a remote target.
+    // n.b. The 'request' and 'response' semantics are inverted for remote invocations because the Relayed connection is established by a request **from** the 'target' Volt to the Relay. Hence any invocation on behalf of a client of the Relay involves sending a **response** back down the Relay connection to the 'target' Volt.
+    InvokeRequest invoke_request = 7;
+
+    // Send an HTTP request to a remote target.
+    // n.b. The 'request' and 'response' semantics are inverted for HTTP requests for the same reason as \`invoke_request\` above.
+    HttpRequest http_request = 8;
+  }
+}
+
+enum CopyResourceMode {
+  COPY_RESOURCE_MODE_UNKNOWN = 0;
+  COPY_RESOURCE_MODE_COPY = 1;
+  COPY_RESOURCE_MODE_LINK = 2;
+}
+
+message CopyResourceRequest {
+  // The id of the resource to copy.
+  string resource_id = 1;
+
+  // The id of the resource to receive the new copy.
+  string to_resource_id = 2;
+
+  // The copy mode to use.
+  CopyResourceMode mode = 3;
+
+  // Indicates if all descendants of the resource should be copied too. Only relevant for COPY_RESOURCE_MODE_COPY mode.
+  bool recursive = 4;
+
+  // The parent resource to link from, only relevant for COPY_RESOURCE_MODE_LINK mode.
+  string from_resource_id = 5;
+}
+
+message CopyResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message DeleteAccessRequest {
+  // The id of the access rule to delete.
+  string id = 1;
+}
+
+message DeleteAccessResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message DeleteResourceRequest {
+  // The resource to delete.
+  string resource_id = 1;
+
+  // Set to indicate all descendant resources should also be deleted.
+  // If this is not set and the resource has descendants, the call will fail.
+  bool recursive = 2;
+
+  // Set to attempt to unlink the resource from this parent resource, rather than completely delete it.
+  // The resource will be removed as a descendant from the \`parent_id\` resource. If the resource is has more than one parent, it will not be removed from those other parents.
+  // Note that if the resource's only parent is \`parent_id\` it will be removed from that parent and deleted as normal.
+  string parent_id = 3;
+}
+
+message DeleteResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message DiscoverServicesRequest {
+  // List the service APIs that should be discovered.
+  // The response will include services that match **any of** the terms given.
+  // Use of '*' to indicate wildcards is supported.
+  repeated string service_api = 1;
+
+  // Set to indicate that offline services should be included in the response.
+  bool include_offline = 2;
+
+  // Set to include the service attributes in the response.
+  bool include_attributes = 3;
+
+  // Set to include the service protobuf in the response.
+  bool include_protobuf = 4;
+}
+
+message DiscoverServicesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The services that were discovered.
+  repeated Resource resource = 2;
+}
+
+message GetAccessRequest {
+  // The resource id that is the target of the access rule. If omitted, all resources will be considered.
+  string resource_id = 1;
+
+  // The identity id that is the subject of the access rule. If omitted, all identities will be considered.
+  string identity_did = 2;
+
+  // The type of access to retrieve, if omitted all access will be considered.
+  string access = 4;
+
+  // The type of decision, if omitted all decisions will be considered.
+  PolicyDecision decision = 5;
+}
+
+message GetAccessResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The access rules that match the criteria.
+  repeated Access access = 2;
+}
+
+message GetIdentitiesRequest {
+  // Optional name of the identity.
+  // Use '*' to perform a wildcard search.
+  // If omitted all identities will be retrieved.
+  string name = 1;
+
+  // The identity alias criteria, if omitted all identities will be considered.
+  IdentityAlias alias = 2;
+}
+
+message GetIdentitiesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The identity list that matched the criteria.
+  repeated Identity identity = 2;
+}
+
+// One of \`identity_did\` or \`fingerprint\` must be populated.
+message GetIdentityRequest {
+  oneof lookup {
+    // The id of the identity to retrieve.
+    string identity_did = 1;
+    // The public key fingerprint of the identity to retrieve.
+    string fingerprint = 2;
+  }
+}
+
+message GetIdentityResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The identity details.
+  Identity identity = 2;
+}
+
+message GetOneTimeTokenRequest {
+  // Optional token TTL, in seconds. Default is 10 seconds.
+  int32 ttl = 1;
+}
+
+message GetOneTimeTokenResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The one-time token.
+  string token = 2;
+}
+
+// This an empty message.
+message GetParametersRequest {
+}
+
+message GetParametersResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The retrieved Volt parameters.
+  VoltParameters parameters = 2;
+}
+
+// This an empty message.
+message GetPolicyRequest {
+  // Set to only retrieve the custom policy document.
+  bool custom_policy = 1;
+}
+
+message GetPolicyResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
 
-  // Details of the resource.
-  Resource resource = 2;
+  // The live policy in JSON format.
+  string policy = 2;
 }
 
-message ConnectAuthRequest {
-  Session session = 1;
-
-  string context = 5;
+message GetResourceRequest {
+  // The id of the resource to retrieve.
+  string resource_id = 1;
 
-  string challenge = 6;
+  // Set to include the resource attributes in the response.
+  bool include_attributes = 2;
 
-  uint64 timestamp = 7;
+  // Set to include service description protobuf in the response, if applicable.
+  bool include_protobuf = 3;
 }
 
-message ConnectDIDRegistryUpdate {
-  DIDRegistryUpdate update = 1;
+message GetResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The retrieved resource metadata.
+  Resource resource = 2;
 }
 
-message ConnectEvent {
-  oneof event {
-    // An authentication request event.
-    ConnectAuthRequest connect_auth_request = 1;
+// By default, the lookup is performed by combining the criteria below in the form:
+// (id = id[0] or id = id[1]) and (name = name[0] or name = name[1]) etc...
+// To combine using 'or' rather than 'and', set the \`combine_terms_exclusive\` flag.
+// Also see note below regarding attributes.
+message GetResourcesRequest {
+  repeated string id = 1;
 
-    // A resource event notification, such as updated or deleted.
-    ConnectResource connect_resource = 2;
+  // Wildcards permitted.
+  repeated string name = 2;
 
-    // A DID registry entry update.
-    ConnectDIDRegistryUpdate did_registry_update = 3;
-  }
-}
+  // Wildcards permitted.
+  repeated string description = 3;
 
-// One of the following payloads will be present in a given ConnectRequest message.
-message ConnectRequest {
-  oneof payload {
-    // A ConnectHello message is the first message a client sends to the target upon successfully starting the call.
-    ConnectHello hello = 1;
+  // Wildcards permitted.
+  repeated string kind = 4;
 
-    // Indicates the client is closing the connection.
-    ConnectGoodbye goodbye = 2;
+  repeated string parent_id = 5;
 
-    // Clients should periodically send ping requests to the target to confirm the stream is still live.
-    ConnectPing ping = 4;
+  // Wildcards permitted.
+  repeated string service_api = 6;
 
-    // Send invocation responses back to the caller.
-    // n.b. The 'request' and 'response' semantics are inverted with remote invocations because the Relayed connection is established by a request **from** the 'target' Volt to the Relay. Hence any invocation on behalf of a client of the Relay involves sending a **response** back down the Relay connection to the 'target' Volt.
-    InvokeResponse invoke_response = 5;
+  repeated string owner = 7;
 
-    // Send HTTP response back to the originating request.
-    // n.b. The 'request' and 'response' semantics are inverted with HTTP proxying for the same reason as \`invoke_response\` above.
-    HttpResponse http_response = 6;
-  }
-}
+  repeated string store = 8;
 
-// One of the following payloads will be present in a given ConnectResponse message.
-message ConnectResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+  // Indicates that the above terms should be combined using 'or' rather than 'and' (the default).
+  bool combine_terms_exclusive = 9;
 
-  oneof payload {
-    // Server response to initial handshake.
-    ConnectAcknowledge acknowledge = 2;
+  // Attributes to search by.
+  repeated ResourceAttributeQuery attribute = 10;
 
-    // Indicates the server is ending the connection.
-    ConnectGoodbye goodbye = 3;
+  // If set, will return resources where *any of* the attribute queries apply, otherwise will only return resources where *all of* the attribute queries apply.
+  bool any_of = 11;
 
-    // Notifies clients of various events on the Volt.
-    ConnectEvent evt = 4;
+  // Set to include the resource attributes in the response.
+  bool include_attributes = 12;
 
-    // Periodic ping response.
-    ConnectPing ping = 6;
+  // Set to include service description protobuf in the response where applicable.
+  bool include_protobuf = 13;
 
-    // Send an invocation request to a remote target.
-    // n.b. The 'request' and 'response' semantics are inverted for remote invocations because the Relayed connection is established by a request **from** the 'target' Volt to the Relay. Hence any invocation on behalf of a client of the Relay involves sending a **response** back down the Relay connection to the 'target' Volt.
-    InvokeRequest invoke_request = 7;
+  // Only retrieve resources that have been modified after the given timestamp. Default is 0, which means all resources will be returned.
+  uint64 modified_since = 14;
 
-    // Send an HTTP request to a remote target.
-    // n.b. The 'request' and 'response' semantics are inverted for HTTP requests for the same reason as \`invoke_request\` above.
-    HttpRequest http_request = 8;
-  }
+  // Limit the number of resources returned. Default is 0, which means all resources will be returned.
+  uint32 limit = 15;
 }
 
-enum CopyResourceMode {
-  COPY_RESOURCE_MODE_UNKNOWN = 0;
-  COPY_RESOURCE_MODE_COPY = 1;
-  COPY_RESOURCE_MODE_LINK = 2;
+message GetResourcesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The list of resources that match the lookup.
+  repeated Resource resource = 2;
 }
 
-message CopyResourceRequest {
-  // The id of the resource to copy.
+message GetResourceAncestorsRequest {
+  // The resource id whose ancestors will be retrieved.
   string resource_id = 1;
 
-  // The id of the resource to receive the new copy.
-  string to_resource_id = 2;
+  // Optional - if set the resource_id resource will be included in the set of resources returned.
+  bool include_resource_id = 2;
 
-  // The copy mode to use.
-  CopyResourceMode mode = 3;
+  // Optional - restrict the depth search, e.g. for immediate parents depth = 1
+  int32 depth = 3;
 
-  // Indicates if all descendants of the resource should be copied too. Only relevant for COPY_RESOURCE_MODE_COPY mode.
-  bool recursive = 4;
+  // Optional - only match ancestors of the given kind.
+  string ancestor_kind = 4;
 
-  // The parent resource to link from, only relevant for COPY_RESOURCE_MODE_LINK mode.
-  string from_resource_id = 5;
-}
+  // Optional - can be used to determine if a resource is an ancestor.
+  string ancestor_id = 5;
 
-message CopyResourceResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
+  // Set to include the service attributes in the response.
+  bool include_attributes = 6;
 
-message DeleteAccessRequest {
-  // The id of the access rule to delete.
-  string id = 1;
+  // Set to include the service protobuf in the response.
+  bool include_protobuf = 7;
 }
 
-message DeleteAccessResponse {
+message GetResourceAncestorsResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The retrieved ancestors.
+  repeated Resource ancestor = 2;
 }
 
-message DeleteResourceRequest {
-  // The resource to delete.
+message GetResourceDescendantsRequest {
+  // The resource id whose descendants will be retrieved.
   string resource_id = 1;
 
-  // Set to indicate all descendant resources should also be deleted.
-  // If this is not set and the resource has descendants, the call will fail.
-  bool recursive = 2;
+  // Optional - if set, the fully populated \`resource_id\` resource (i.e. the parent) will be included in the set of resources returned.
+  bool include_resource_id = 2;
 
-  // Set to attempt to unlink the resource from this parent resource, rather than completely delete it.
-  // The resource will be removed as a descendant from the \`parent_id\` resource. If the resource is has more than one parent, it will not be removed from those other parents.
-  // Note that if the resource's only parent is \`parent_id\` it will be removed from that parent and deleted as normal.
-  string parent_id = 3;
-}
+  // Optional - restrict the depth search, e.g. for immediate children depth = 1
+  int32 depth = 3;
 
-message DeleteResourceResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
+  // Optional - only match descendants of the given kind.
+  // If multiple kinds are given, resources matching **any of** the kinds will be included.
+  repeated string descendant_kind = 4;
 
-message DiscoverServicesRequest {
-  // List the service APIs that should be discovered.
-  // The response will include services that match **any of** the terms given.
-  // Use of '*' to indicate wildcards is supported.
-  repeated string service_api = 1;
+  // Optional - can be used to determine if a resource is a descendant.
+  string descendant_id = 5;
 
-  // Set to indicate that offline services should be included in the response.
-  bool include_offline = 2;
+  // Optional - restrict to descendants of a given parent, for use in multi-parent hierarchies.
+  string parent_id = 6;
+
+  // Restrict to a specific named resource.
+  string name = 7;
+
+  // Only retrieve resources that have been modified after the given timestamp. Default is 0, which means all resources will be returned.
+  uint64 modified_since = 8;
 
   // Set to include the service attributes in the response.
-  bool include_attributes = 3;
+  bool include_attributes = 9;
 
   // Set to include the service protobuf in the response.
-  bool include_protobuf = 4;
+  bool include_protobuf = 10;
 }
 
-message DiscoverServicesResponse {
+message GetResourceDescendantsResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
 
-  // The services that were discovered.
-  repeated Resource resource = 2;
+  // The retrieved descendants.
+  repeated Resource descendant = 2;
 }
 
-message GetAccessRequest {
-  // The resource id that is the target of the access rule. If omitted, all resources will be considered.
-  string resource_id = 1;
+message GetSessionsRequest {
+  string id = 1;
 
-  // The identity id that is the subject of the access rule. If omitted, all identities will be considered.
   string identity_did = 2;
 
-  // The type of access to retrieve, if omitted all access will be considered.
-  string access = 4;
+  string identity_name = 3;
 
-  // The type of decision, if omitted all decisions will be considered.
-  PolicyDecision decision = 5;
+  SessionStatus status = 4;
 }
 
-message GetAccessResponse {
+message GetSessionsResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
 
-  // The access rules that match the criteria.
-  repeated Access access = 2;
+  repeated Session session = 2;
 }
 
-message GetIdentitiesRequest {
-  // Optional name of the identity.
-  // Use '*' to perform a wildcard search.
-  // If omitted all identities will be retrieved.
-  string name = 1;
+message InvokeRequestKeyExchange {
+  bytes nonce = 1;
+
+  bytes encryption_key = 2;
+
+  bytes signature = 3;
+}
+
+message InvokeRequest {
+  // Client-assigned identifier for the request. Will be used to match responses and any subsequent requests.
+  uint64 invoke_id = 1;
+
+  // Optional client token to use for the invocation. This is for use by the websocket proxy and is only necessary on the first request of the rpc.
+  string token = 2;
+
+  // The DID of the target at each hop of the path to the service.
+  // This is used by Relays to route the request.
+  repeated string target_did = 4;
+
+  // The initialisation vector for the request payload encryption. This should be a random 16 byte value, that is different for each request.
+  bytes iv = 5;
+
+  // One of the following payloads will be present in a given InvokeRequest message.
+  oneof request_payload {
+    // A serialised and encrypted instance of \`RemoteResponse\` in pure binary format.
+    bytes payload = 6;
 
-  // The identity alias criteria, if omitted all identities will be considered.
-  IdentityAlias alias = 2;
-}
+    // A serialised and encrypted instance of \`RemoteResponse\` as serialised JSON.
+    bytes json_payload = 7;
+  }
 
-message GetIdentitiesResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+  // Indicates the client has ended the invocation.
+  bool client_end = 8;
 
-  // The identity list that matched the criteria.
-  repeated Identity identity = 2;
-}
+  // Reserved for internal use.
+  uint32 hop_index = 9;
 
-// One of \`identity_did\` or \`fingerprint\` must be populated.
-message GetIdentityRequest {
-  oneof lookup {
-    // The id of the identity to retrieve.
-    string identity_did = 1;
-    // The public key fingerprint of the identity to retrieve.
-    string fingerprint = 2;
-  }
+  // Reserved for internal use.
+  string target_service_id = 10;
 }
 
-message GetIdentityResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+message InvokeResponse {
+  // The invocation id to match the originating request.
+  uint64 invoke_id = 1;
 
-  // The identity details.
-  Identity identity = 2;
-}
+  // Key exchange details for the response payload encryption. Only necessary for the first response.
+  InvokeRequestKeyExchange key_exchange = 2;
 
-message GetOneTimeTokenRequest {
-  // Optional token TTL, in seconds. Default is 10 seconds.
-  int32 ttl = 1;
-}
+  // The initialisation vector for the response payload encryption. This will be a random 16 byte value, that is different for each response.
+  bytes iv = 4;
 
-message GetOneTimeTokenResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+  // One of the following payloads will be present in a given InvokeResponse message.
+  oneof response_payload {
+    // A serialised and encrypted instance of \`RemoteRequest\` in pure binary format.
+    bytes payload = 5;
 
-  // The one-time token.
-  string token = 2;
-}
+    // A serialised and encrypted instance of \`RemoteRequest\` as serialised JSON.
+    bytes json_payload = 6;
 
-// This an empty message.
-message GetParametersRequest {
+    // Details of any error that occurred on the call.
+    tdx.volt_api.volt.v1.Status status = 7;
+  }
+
+  // Indicates the server has ended the invocation.
+  bool server_end = 8;
 }
 
-message GetParametersResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+message MoveResourceRequest {
+  // The id of the resource to move.
+  string resource_id = 1;
 
-  // The retrieved Volt parameters.
-  VoltParameters parameters = 2;
-}
+  // The resource the parent folder to move the resource from.
+  string from_resource_id = 2;
 
-// This an empty message.
-message GetPolicyRequest {
-  // Set to only retrieve the custom policy document.
-  bool custom_policy = 1;
+  // The target folder to move the resource into.
+  string to_resource_id = 3;
 }
 
-message GetPolicyResponse {
+message MoveResourceResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
-
-  // The live policy in JSON format.
-  string policy = 2;
 }
 
-message GetResourceRequest {
-  // The id of the resource to retrieve.
+message RequestAccessRequest {
+  // The target resource id.
   string resource_id = 1;
 
-  // Set to include the resource attributes in the response.
-  bool include_attributes = 2;
-
-  // Set to include service description protobuf in the response, if applicable.
-  bool include_protobuf = 3;
+  // The type of access requested.
+  string access = 3;
 }
 
-message GetResourceResponse {
+message RequestAccessResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
 
-  // The retrieved resource metadata.
-  Resource resource = 2;
-}
+  // The resource being accessed.
+  string resource_id = 2;
 
-// By default, the lookup is performed by combining the criteria below in the form:
-// (id = id[0] or id = id[1]) and (name = name[0] or name = name[1]) etc...
-// To combine using 'or' rather than 'and', set the \`combine_terms_exclusive\` flag.
-// Also see note below regarding attributes.
-message GetResourcesRequest {
-  repeated string id = 1;
+  // The identity attempting access.
+  string identity_did = 3;
 
-  // Wildcards permitted.
-  repeated string name = 2;
+  // Requested access.
+  string access = 5;
 
-  // Wildcards permitted.
-  repeated string description = 3;
+  // Assigned decision.
+  PolicyDecision decision = 6;
 
-  // Wildcards permitted.
-  repeated string kind = 4;
+  // Time at which the request was made.
+  int64 request_time = 7;
 
-  repeated string parent_id = 5;
+  // Time at which the decision was taken.
+  int64 decision_time = 8;
 
-  // Wildcards permitted.
-  repeated string service_api = 6;
+  // Counter of number times this access was requested.
+  int32 request_count = 9;
+}
 
-  repeated string owner = 7;
+message ResourceAttributeQuery {
+  string attribute_id = 1;
+  AttributeDataType data_type = 2;
+  AttributeValue value = 3;
+}
 
-  repeated string store = 8;
+message SaveAccessRequest {
+  // Omit \`id\` if creating new access.
+  Access access = 1;
+}
 
-  // Indicates that the above terms should be combined using 'or' rather than 'and' (the default).
-  bool combine_terms_exclusive = 9;
+message SaveAccessResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
 
-  // Attributes to search by.
-  repeated ResourceAttributeQuery attribute = 10;
+message SaveIdentityRequest {
+  // Details of the identity to save.
+  Identity identity = 1;
 
-  // If set, will return resources where *any of* the attribute queries apply, otherwise will only return resources where *all of* the attribute queries apply.
-  bool any_of = 11;
+  // Set to indicate this is a new identity.
+  bool create = 2;
 
-  // Set to include the resource attributes in the response.
-  bool include_attributes = 12;
+  // The list of aliases that should be removed.
+  // For example, this allows a simple form of key rotation whereby an existing public key alias is replaced by a new one while still maintaining the same root identity id.
+  repeated IdentityAlias delete_alias = 3;
 
-  // Set to include service description protobuf in the response where applicable.
-  bool include_protobuf = 13;
+  // Reserved for system use.
+  string create_in_parent_id = 4;
 
-  // Only retrieve resources that have been modified after the given timestamp. Default is 0, which means all resources will be returned.
-  uint64 modified_since = 14;
+  // Set to indicate the identity aliases should be purged before saving the identity.
+  // If the \`identity\` field contains aliases they will be saved after the purge.
+  // If the \`identity\` field does not contain aliases this effectively deletes all aliases for this identity.
+  // This allows you to selectively update aliases if required, i.e. don't set this flag and include a single alias in the update.
+  bool purge_aliases = 5;
 
-  // Limit the number of resources returned. Default is 0, which means all resources will be returned.
-  uint32 limit = 15;
+  string did_document = 6;
+
+  // The signature of the identity did document, if present.
+  string did_update_signature = 7;
 }
 
-message GetResourcesResponse {
+message SaveIdentityResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
 
-  // The list of resources that match the lookup.
-  repeated Resource resource = 2;
+  // The updated identity details.
+  Identity identity = 2;
 }
 
-message GetResourceAncestorsRequest {
-  // The resource id whose ancestors will be retrieved.
-  string resource_id = 1;
-
-  // Optional - if set the resource_id resource will be included in the set of resources returned.
-  bool include_resource_id = 2;
+message SaveParametersRequest {
+  // The updated parameters.
+  VoltParameters parameters = 1;
 
-  // Optional - restrict the depth search, e.g. for immediate parents depth = 1
-  int32 depth = 3;
+  // The current root key passphrase. Only necessary if changes are being made to the Volt key.
+  string key_passphrase = 2;
 
-  // Optional - only match ancestors of the given kind.
-  string ancestor_kind = 4;
+  // The new root key passphrase. Only necessary if changes are being made to the Volt key.
+  string new_key_passphrase = 3;
+}
 
-  // Optional - can be used to determine if a resource is an ancestor.
-  string ancestor_id = 5;
+message SaveParametersResponse {
+  // Details of any errors that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
 
-  // Set to include the service attributes in the response.
-  bool include_attributes = 6;
+  // The updated Volt parameters.
+  VoltParameters parameters = 2;
 
-  // Set to include the service protobuf in the response.
-  bool include_protobuf = 7;
+  // If set, the client will need to reconnect (usually because the key has changed).
+  bool reconnect = 3;
 }
 
-message GetResourceAncestorsResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+message SaveResourceRequest {
+  // Details of the resource to save.
+  Resource resource = 1;
 
-  // The retrieved ancestors.
-  repeated Resource ancestor = 2;
-}
+  // Set to indicate this is a new resource.
+  bool create = 2;
 
-message GetResourceDescendantsRequest {
-  // The resource id whose descendants will be retrieved.
-  string resource_id = 1;
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
 
-  // Optional - if set, the fully populated \`resource_id\` resource (i.e. the parent) will be included in the set of resources returned.
-  bool include_resource_id = 2;
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  // If the \`resource\` field contains attributes they will be saved after the purge.
+  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
+  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
+  bool purge_attributes = 4;
+}
 
-  // Optional - restrict the depth search, e.g. for immediate children depth = 1
-  int32 depth = 3;
+message SaveResourceResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
 
-  // Optional - only match descendants of the given kind.
-  // If multiple kinds are given, resources matching **any of** the kinds will be included.
-  repeated string descendant_kind = 4;
+  // The updated resource.
+  Resource resource = 2;
+}
 
-  // Optional - can be used to determine if a resource is a descendant.
-  string descendant_id = 5;
+message SaveSessionRequest {
+  Session session = 1;
+}
 
-  // Optional - restrict to descendants of a given parent, for use in multi-parent hierarchies.
-  string parent_id = 6;
+message SaveSessionResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
 
-  // Restrict to a specific named resource.
-  string name = 7;
+  Session session = 2;
+}
 
-  // Only retrieve resources that have been modified after the given timestamp. Default is 0, which means all resources will be returned.
-  uint64 modified_since = 8;
+message SetPolicyRequest {
+  string custom_policy = 1;
+}
 
-  // Set to include the service attributes in the response.
-  bool include_attributes = 9;
+message SetPolicyResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
 
-  // Set to include the service protobuf in the response.
-  bool include_protobuf = 10;
+message SetServiceStatusRequest {
+  // The service description details.
+  Resource service = 2;
 }
 
-message GetResourceDescendantsResponse {
+message SetServiceStatusResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
 
-  // The retrieved descendants.
-  repeated Resource descendant = 2;
+  // The updated service resource details.
+  Resource resource = 2;
 }
 
-message GetSessionsRequest {
+message SetAccessRequestDecisionRequest {
+  // The id of the access request.
   string id = 1;
 
-  string identity_did = 2;
+  // The decision to save against the access request.
+  PolicyDecision decision = 2;
+}
 
-  string identity_name = 3;
+message SetAccessRequestDecisionResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
 
-  SessionStatus status = 4;
+// This message is emtpy.
+message ShutdownRequest {
 }
 
-message GetSessionsResponse {
+message ShutdownResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
-
-  repeated Session session = 2;
 }
 
-message InvokeRequestKeyExchange {
-  bytes nonce = 1;
+message SignVerifyRequest {
+  // Set to indicate this is a request to verify rather than sign.
+  bool verify = 1;
 
-  bytes encryption_key = 2;
+  // Set to indicate the signature should be base64 encoded in the response.
+  // Only valid when signing.
+  bool encode = 2;
 
-  bytes signature = 3;
-}
+  // The message to sign.
+  // Only valid when signing.
+  string message = 3;
 
-message InvokeRequest {
-  // Client-assigned identifier for the request. Will be used to match responses and any subsequent requests.
-  uint64 invoke_id = 1;
+  oneof digest {
+    // The digest in raw binary form.
+    // Only valid if verifying.
+    bytes digest_raw = 4;
 
-  // Optional client token to use for the invocation. This is for use by the websocket proxy and is only necessary on the first request of the rpc.
-  string token = 2;
+    // The digest encoded using base64.
+    // Only valid if verifying.
+    string digest_encoded = 5;
+  }
 
-  // The DID of the target at each hop of the path to the service.
-  // This is used by Relays to route the request.
-  repeated string target_did = 4;
+  // The DID of the identity used to sign or verify the message. If omitted, the authenticated identity will be used.
+  // When signing, the authenticated identity must have volt:sign permission for the given DID.
+  string identity_did = 6;
+}
 
-  // The initialisation vector for the request payload encryption. This should be a random 16 byte value, that is different for each request.
-  bytes iv = 5;
+// Note that if verification was successful the response will be empty (there is no error and no digest is returned).
+message SignVerifyResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
 
-  // One of the following payloads will be present in a given InvokeRequest message.
-  oneof request_payload {
-    // A serialised and encrypted instance of \`RemoteResponse\` in pure binary format.
-    bytes payload = 6;
+  oneof payload {
+    // The signature in raw binary form.
+    bytes digest = 2;
 
-    // A serialised and encrypted instance of \`RemoteResponse\` as serialised JSON.
-    bytes json_payload = 7;
+    // The signature encoded using base64.
+    string digest_encoded = 3;
   }
+}
+`;
+const wire_api = `syntax = "proto3";
 
-  // Indicates the client has ended the invocation.
-  bool client_end = 8;
+package tdx.volt_api.volt.v1;
 
-  // Reserved for internal use.
-  uint32 hop_index = 9;
+import "tdx/volt_api/volt/v1/status.proto";
 
-  // Reserved for internal use.
-  string target_service_id = 10;
+// The Wire API allows clients to subscribe and publish to Volt wire resources.
+service WireAPI {
+  // Establishes a client-streaming call to the wire resource.
+  rpc PublishWire(stream PublishWireRequest) returns (stream PublishWireResponse);
+
+  // Establishes a bi-directional streaming call to the wire resource.
+  // Although we're only really interested in receiving data from the wire, a bi-directional stream is required so that we can gracefully stop the subscription.
+  rpc SubscribeWire(stream SubscribeWireRequest) returns (stream SubscribeWireResponse);
 }
 
-message InvokeResponse {
-  // The invocation id to match the originating request.
-  uint64 invoke_id = 1;
+// Because the publish RPC is streaming, the policy will not be checked until the first message arrives. This can mean that the \`PublishWire\` call appears to succeed but then fails after the first attempt to publish a message.
+// To avoid this, clients can immediately send a message with the \`wire_id\` set and no \`chunk\` set. This will establish that the correct permissions are in place and fail fast if not.
+message PublishWireRequest {
+  // Only necessary in the first payload.
+  string wire_id = 1;
 
-  InvokeRequestKeyExchange key_exchange = 2;
+  // The chunk of data to publish.
+  bytes chunk = 2;
 
-  // The initialisation vector for the response payload encryption. This will be a random 16 byte value, that is different for each response.
-  bytes iv = 4;
+  // Whether to persist the chunk.
+  // This is only valid if the wire is configured to persist messages, i.e. the \`volt:wire-persist\` attribute is true.
+  bool do_not_persist = 3;
+}
 
-  // One of the following payloads will be present in a given InvokeResponse message.
-  oneof response_payload {
-    // A serialised and encrypted instance of \`RemoteRequest\` in pure binary format.
-    bytes payload = 5;
+message PublishWireResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
 
-    // A serialised and encrypted instance of \`RemoteRequest\` as serialised JSON.
-    bytes json_payload = 6;
+// The request must include one of the following fields.
+message SubscribeWireRequest {
+  oneof payload {
+    // The wire id, only required for the first message.
+    string wire_id = 1;
+    // Request to stop the subscription.
+    bool stop = 2;
+  }
+}
 
+// One of the following fields will be present in the response.
+message SubscribeWireResponse {
+  oneof payload {
     // Details of any error that occurred on the call.
-    tdx.volt_api.volt.v1.Status status = 7;
-  }
+    tdx.volt_api.volt.v1.Status status = 1;
 
-  // Indicates the server has ended the invocation.
-  bool server_end = 8;
+    // Data received from the wire.
+    bytes chunk = 2;
+  }
 }
 
-message MoveResourceRequest {
-  // The id of the resource to move.
-  string resource_id = 1;
+`;
+const voltProtos = [sqlite, sqlite_database_api, sqlite_server_api, proto_db_sync, proxy_api, relay_api, discovery_api, file, file_api, remote, spark_api, ssi, ssi_api, status, sync_api, terminal_api, volt, volt_api, wire_api];
 
-  // The resource the parent folder to move the resource from.
-  string from_resource_id = 2;
+debug__default["default"]("volt-client-grpc:proto-utils");
 
-  // The target folder to move the resource into.
-  string to_resource_id = 3;
-}
+const voltServices = [
+  constants.serviceType.voltAPI,
+  constants.serviceType.fileAPI,
+  constants.serviceType.sqliteDatabaseAPI,
+  constants.serviceType.sqliteServerAPI,
+  constants.serviceType.ssiAPI,
+  constants.serviceType.syncAPI,
+  constants.serviceType.relayAPI,
+  constants.serviceType.terminalAPI,
+  constants.serviceType.wireAPI
+];
 
-message MoveResourceResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+const defaultLoaderOptions = {
+  keepCase: true,
+  longs: String,
+  enums: String,
+  defaults: true,
+  oneofs: true
+};
+
+function getServiceDescriptors(service) {
+  let root = new Protobuf__default["default"].Root();
+  for (let protoFile of service.service_description.proto_file) {
+    Protobuf__default["default"].parse(protoFile.protobuf, root, defaultLoaderOptions);
+  }
+
+  // Create a package definition from the root object.
+  const packageDefinition = createPackageDefinition(root, defaultLoaderOptions);
+
+  // Merge the service API definitions into a single object.
+  let serviceDescriptors = {};
+  for (let api of service.service_description.service_api) {
+    const packageDescriptors = packageDefinition[api];
+    serviceDescriptors = { ...serviceDescriptors, ...packageDescriptors };
+  }
+
+  return serviceDescriptors;
 }
 
-message RequestAccessRequest {
-  // The target resource id.
-  string resource_id = 1;
+function getBuiltInServiceDescriptors() {
+  // Create a placeholder service object for the Volt API service.
+  const voltServicePlaceholder = {
+    service_description: {
+      proto_file: voltProtos.map((proto) => ({ protobuf: proto })),
+      service_api: voltServices
+    }
+  };
 
-  // The type of access requested.
-  string access = 3;
+  return getServiceDescriptors(voltServicePlaceholder);
 }
 
-message RequestAccessResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+var protoUtils = /*#__PURE__*/Object.freeze({
+  __proto__: null,
+  getBuiltInServiceDescriptors: getBuiltInServiceDescriptors,
+  getServiceDescriptors: getServiceDescriptors
+});
 
-  // The resource being accessed.
-  string resource_id = 2;
+/* eslint-disable no-underscore-dangle */
+
+const {
+  aesCreateKey,
+  aesEncrypt: aesEncrypt$1,
+  aesDecrypt: aesDecrypt$1,
+  toBase64,
+  formatPEM: formatPEM$1,
+  keyFromPem: keyFromPem$2,
+  verify,
+  deriveSharedKey: deriveSharedKey$1,
+  x25519: x25519$1
+} = js.voltUtils;
 
-  // The identity attempting access.
-  string identity_did = 3;
+const invokeMethod = "Invoke";
 
-  // Requested access.
-  string access = 5;
+const log$5 = debug__default["default"]("volt-client-grpc:grpc-call");
 
-  // Assigned decision.
-  PolicyDecision decision = 6;
+function _prepareInvokeRequest(
+  request,
+  method,
+  methodType = "METHOD_TYPE_UNARY"
+) {
+  const isServiceRelayed =
+    this._service?.service_description.host_type ===
+    "SERVICE_HOST_TYPE_RELAYED";
 
-  // Time at which the request was made.
-  int64 request_time = 7;
+  const relaying = this._voltClient.isRelayed || isServiceRelayed;
 
-  // Time at which the decision was taken.
-  int64 decision_time = 8;
+  let targetDID = [];
+  if (this._voltClient.isRelayed) {
+    targetDID.push(this._voltClient.voltConfig.id);
+  }
 
-  // Counter of number times this access was requested.
-  int32 request_count = 9;
-}
+  if (isServiceRelayed) {
+    // Add another relay hop if the target service is relayed.
+    log$5("target service is relayed");
+    targetDID.push(this._service.service_description.host_client_id);
+  }
 
-message ResourceAttributeQuery {
-  string attribute_id = 1;
-  AttributeDataType data_type = 2;
-  AttributeValue value = 3;
-}
+  log$5("target is %j", targetDID);
 
-message SaveAccessRequest {
-  // Omit \`id\` if creating new access.
-  Access access = 1;
-}
+  // Use the service's host client id and public key if the service is relayed.
+  const methodToken = this._voltClient.credential.getIdentityMetadata(
+    this._voltClient.grpc,
+    this._service?.service_description.host_client_id ||
+      this._voltClient.voltConfig.id,
+    this._service?.service_description.host_public_key ||
+      this._voltClient.credential.voltPublicKey,
+    relaying
+  );
 
-message SaveAccessResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
+  let invokeRequest;
+  let callMethod = method;
 
-message SaveIdentityRequest {
-  // Details of the identity to save.
-  Identity identity = 1;
+  const voltGrpcClient = this._voltClient.getVoltAPIClient();
 
-  // Set to indicate this is a new identity.
-  bool create = 2;
+  if (relaying) {
+    //
+    // If the volt connection is via a relay (or the target service is relayed),
+    // we wrap the rpc in a RemoteRequest message and send it via a call to Invoke().
+    //
 
-  // The list of aliases that should be removed.
-  // For example, this allows a simple form of key rotation whereby an existing public key alias is replaced by a new one while still maintaining the same root identity id.
-  repeated IdentityAlias delete_alias = 3;
+    // Replace the target method with a call to Invoke on the relay Volt.
+    callMethod = invokeMethod;
 
-  // Reserved for system use.
-  string create_in_parent_id = 4;
+    // But first we need to perform a key exchange with the target service.
+    if (!this._encryptionKey) {
+      // We haven't exchanged keys yet, so queue the payload.
+      if (request) {
+        this._pendingRequests.push(request);
+      }
 
-  // Set to indicate the identity aliases should be purged before saving the identity.
-  // If the \`identity\` field contains aliases they will be saved after the purge.
-  // If the \`identity\` field does not contain aliases this effectively deletes all aliases for this identity.
-  // This allows you to selectively update aliases if required, i.e. don't set this flag and include a single alias in the update.
-  bool purge_aliases = 5;
+      if (this._keyExchangePending) {
+        // We've already sent the key exchange request, so do nothing.
+        log$5("key exchange pending, not sending payload");
+        return;
+      }
 
-  string did_document = 6;
+      this._keyExchangePending = true;
 
-  // The signature of the identity did document, if present.
-  string did_update_signature = 7;
-}
+      // Send the key exchange request.
+      invokeRequest = {
+        token: methodToken.token,
+        target_did: targetDID,
+        target_service_id: isServiceRelayed
+          ? this._service.service_description.host_service_id
+          : undefined
+      };
 
-message SaveIdentityResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+      if (this._voltClient.isRelayed) {
+        // When tunnelling, we serialise the request using the original serialisation
+        // method for Invoke.
+        invokeRequest =
+          voltGrpcClient.Invoke.requestSerializeOriginal(invokeRequest);
+      }
 
-  // The updated identity details.
-  Identity identity = 2;
-}
+      return {
+        request: invokeRequest,
+        method: callMethod,
+        methodName: method,
+        meta: methodToken
+      };
+    }
 
-message SaveParametersRequest {
-  // The updated parameters.
-  VoltParameters parameters = 1;
+    let requestPayload;
 
-  // The current root key passphrase. Only necessary if changes are being made to the Volt key.
-  string key_passphrase = 2;
+    // Serialise the rpc request using the original serialisation method.
+    if (request) {
+      if (this._voltClient.isRelayed) {
+        requestPayload =
+          this._grpcClient[method].requestSerializeOriginal(request);
+      } else {
+        requestPayload = this._grpcClient[method].requestSerialize(request);
+      }
+    } else if (request !== null) {
+      log$5("****************LOOKOUT****************** - empty request");
+    } else {
+      log$5("explicit empty request payload");
+    }
 
-  // The new root key passphrase. Only necessary if changes are being made to the Volt key.
-  string new_key_passphrase = 3;
-}
+    // Create a tunnel message containing the method call metadata and request payload.
+    const tunnelResp = voltGrpcClient.Tunnel.responseSerialize({
+      method_invoke: {
+        method_name: this._grpcClient[method].path,
+        method_type: methodType,
+        request: requestPayload
+      }
+    });
 
-message SaveParametersResponse {
-  // Details of any errors that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+    // When sending via a relay we need to encrypt the payload.
+    const iv = aesCreateKey().iv;
+    const invokePayload = aesEncrypt$1(this._encryptionKey, iv, tunnelResp);
 
-  // The updated Volt parameters.
-  VoltParameters parameters = 2;
+    // Construct the Invoke request.
+    invokeRequest = {
+      iv,
+      payload: invokePayload
+    };
 
-  // If set, the client will need to reconnect (usually because the key has changed).
-  bool reconnect = 3;
-}
+    if (this._voltClient.isRelayed) {
+      // When tunnelling, we serialise the request using the original serialisation
+      // method for Invoke.
+      invokeRequest =
+        voltGrpcClient.Invoke.requestSerializeOriginal(invokeRequest);
+    }
+  } else {
+    invokeRequest = request;
+  }
 
-message SaveResourceRequest {
-  // Details of the resource to save.
-  Resource resource = 1;
+  return {
+    meta: methodToken,
+    method: callMethod,
+    methodName: method,
+    request: invokeRequest
+  };
+}
 
-  // Set to indicate this is a new resource.
-  bool create = 2;
+function _preparePayloadRequest(request, invokeInfo) {
+  let payloadRequest;
 
-  // The id of the folder resource in which a new resource should be created.
-  // If omitted, the home folder of the currently authenticated identity will be used.
-  string create_in_parent_id = 3;
+  const isServiceRelayed =
+    this._service?.service_description.host_type ===
+    "SERVICE_HOST_TYPE_RELAYED";
 
-  // Set to indicate the resource attributes should be purged before saving the resource.
-  // If the \`resource\` field contains attributes they will be saved after the purge.
-  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
-  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
-  bool purge_attributes = 4;
-}
+  if (this._voltClient.isRelayed || isServiceRelayed) {
+    let requestPayload;
+    if (this._voltClient.isRelayed) {
+      // Serialise the rpc request using the original serialisation method.
+      requestPayload =
+        this._grpcClient[invokeInfo.methodName].requestSerializeOriginal(
+          request
+        );
+    } else {
+      requestPayload =
+        this._grpcClient[invokeInfo.methodName].requestSerialize(request);
+    }
 
-message SaveResourceResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+    // Use the Tunnel method to serialise the relay request wrapper, this
+    const voltGrpcClient = this._voltClient.getVoltAPIClient();
 
-  // The updated resource.
-  Resource resource = 2;
-}
+    // Create a tunnel message containing the method call metadata and request payload.
+    const tunnelResp = voltGrpcClient.Tunnel.responseSerialize({
+      method_payload: {
+        payload: requestPayload
+      }
+    });
 
-message SaveSessionRequest {
-  Session session = 1;
-}
+    // Encrypt the payload using the shared key.
+    const iv = aesCreateKey().iv;
+    const invokePayload = aesEncrypt$1(this._encryptionKey, iv, tunnelResp);
 
-message SaveSessionResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+    // We then serialise the entire request using the original serialisation method for Invoke.
+    payloadRequest = {
+      iv,
+      payload: invokePayload
+    };
 
-  Session session = 2;
-}
+    if (this._voltClient.isRelayed) {
+      // When tunnelling, we serialise the request using the original serialisation
+      // method for Invoke.
+      payloadRequest =
+        voltGrpcClient.Invoke.requestSerializeOriginal(payloadRequest);
+    }
+  } else {
+    payloadRequest = request;
+  }
 
-message SetPolicyRequest {
-  string custom_policy = 1;
+  return payloadRequest;
 }
 
-message SetPolicyResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
+function _parseResponse(method, meta, response) {
+  // log("parseResponse for %s", this._methodName);
+  let invokeResponse = {};
 
-message SetServiceStatusRequest {
-  // The service description details.
-  Resource service = 2;
-}
+  const isServiceRelayed =
+    this._service?.service_description.host_type ===
+    "SERVICE_HOST_TYPE_RELAYED";
 
-message SetServiceStatusResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+  const voltGrpcClient = this._voltClient.getVoltAPIClient();
 
-  // The updated service resource details.
-  Resource resource = 2;
-}
+  if (this._voltClient.isRelayed || isServiceRelayed) {
+    if (this._voltClient.isRelayed) {
+      // Deserialise the incoming response using the original deserialisation method for Invoke.
+      response = voltGrpcClient.Invoke.responseDeserializeOriginal(response);
+    }
 
-message SetAccessRequestDecisionRequest {
-  // The id of the access request.
-  string id = 1;
+    if (response.key_exchange) {
+      const encryptionKey = response.key_exchange.encryption_key;
+      const nonce = response.key_exchange.nonce;
+      const signature = response.key_exchange.signature;
 
-  // The decision to save against the access request.
-  PolicyDecision decision = 2;
-}
+      // The signed message is the encryption key and the nonce.
+      const message = new Uint8Array(encryptionKey.length + nonce.length);
+      message.set(encryptionKey);
+      message.set(nonce, encryptionKey.length);
 
-message SetAccessRequestDecisionResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
+      // Check the signature using the target service public key.
+      const targetKey = keyFromPem$2(
+        this._service?.service_description?.host_public_key ||
+          this._voltClient.credential.voltPublicKey
+      ).publicKey;
 
-// This message is emtpy.
-message ShutdownRequest {
-}
+      if (!verify(targetKey, message, signature)) {
+        throw new Error("signature verification failed");
+      }
 
-message ShutdownResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
+      invokeResponse = {
+        key_exchange: {
+          encryption_key: formatPEM$1(toBase64(encryptionKey), "PUBLIC KEY")
+        }
+      };
+    } else if (response.payload) {
+      let decryptedPayload;
+      if (this._encryptionKey) {
+        decryptedPayload = aesDecrypt$1(
+          this._encryptionKey,
+          response.iv,
+          response.payload
+        );
+      } else {
+        decryptedPayload = response.payload;
+      }
 
-message SignVerifyRequest {
-  // Set to indicate this is a request to verify rather than sign.
-  bool verify = 1;
+      // Deserialise the decrypted payload using the Tunnel deserialisation method.
+      const responsePayload =
+        voltGrpcClient.Tunnel.requestDeserialize(decryptedPayload);
+      if (responsePayload.payload === "method_payload") {
+        try {
+          // Deserialise the method payload.
+          if (this._voltClient.isRelayed) {
+            // Use the original deserialisation method for the target method.
+            invokeResponse.payload = this._grpcClient[
+              method
+            ].responseDeserializeOriginal(
+              responsePayload.method_payload.payload
+            );
+          } else {
+            invokeResponse.payload = this._grpcClient[
+              method
+            ].responseDeserialize(responsePayload.method_payload.payload);
+          }
+        } catch (err) {
+          log$5("failure deserialising payload for %s", this._methodName);
+          throw new Error(
+            "failure deserialising payload - check protobuf definition matches with data being sent"
+          );
+        }
+      } else if (responsePayload.payload === "method_end") {
+        invokeResponse = responsePayload.method_end;
+      } else {
+        log$5("unexpected tunnel payload type: %s", responsePayload.payload);
+      }
+    } else if (response.status?.message) {
+      // There's been an error in the tunnel.
+      log$5(
+        "Tunnel status received: %s, code %d, description: %s",
+        response.status.message,
+        response.status.code,
+        response.status.description || "n/a"
+      );
+      invokeResponse = {
+        ended: true,
+        error: `Error in tunnel: ${response.status.message}`
+      };
+    } else {
+      invokeResponse.methodId = response.invoke_id;
+      log$5("started method %d for %s", invokeResponse.methodId, method);
+    }
+  } else {
+    invokeResponse = { payload: response };
+  }
 
-  // Set to indicate the signature should be base64 encoded in the response.
-  // Only valid when signing.
-  bool encode = 2;
+  return invokeResponse;
+}
 
-  // The message to sign.
-  // Only valid when signing.
-  string message = 3;
+class GRPCCall extends EventEmitter__default["default"] {
+  constructor(voltClient, methodName, methodType, service = undefined) {
+    super();
+    this._methodName = methodName;
+    this._methodType = methodType;
+    this._call = null;
+    this._voltClient = voltClient;
+    this._service = service;
+    this._keyExchangePending = false;
+    this._pendingRequests = [];
+    this._encryptionKey = null;
+    this._ended = false;
+  }
 
-  oneof digest {
-    // The digest in raw binary form.
-    // Only valid if verifying.
-    bytes digest_raw = 4;
+  start(grpcClient, request, unary = false) {
+    this._grpcClient = grpcClient;
 
-    // The digest encoded using base64.
-    // Only valid if verifying.
-    string digest_encoded = 5;
-  }
+    if (typeof this._grpcClient[this._methodName] !== "function") {
+      throw new Error(`method not found: '${this._methodName}'`);
+    }
 
-  // The DID of the identity used to sign or verify the message. If omitted, the authenticated identity will be used.
-  // When signing, the authenticated identity must have volt:sign permission for the given DID.
-  string identity_did = 6;
-}
+    this._initialRequest = _prepareInvokeRequest.call(
+      this,
+      request,
+      this._methodName,
+      this._methodType
+    );
 
-// Note that if verification was successful the response will be empty (there is no error and no digest is returned).
-message SignVerifyResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
+    const isServiceRelayed =
+      this._service?.service_description.host_type ===
+      "SERVICE_HOST_TYPE_RELAYED";
 
-  oneof payload {
-    // The signature in raw binary form.
-    bytes digest = 2;
+    let callClient;
+    if (this._voltClient.isRelayed || isServiceRelayed) {
+      callClient = this._voltClient.getVoltAPIClient();
+    } else {
+      callClient = this._grpcClient;
+    }
 
-    // The signature encoded using base64.
-    string digest_encoded = 3;
-  }
-}
-`;
-const wire_api = `syntax = "proto3";
+    this._call = callClient[this._initialRequest.method](
+      this._initialRequest?.meta?.metadata
+    );
 
-package tdx.volt_api.volt.v1;
+    this._call.on("data", (streamResponse) => {
+      if (this._ended) {
+        log$5("ignoring data after end on %s", this._methodName);
+        return;
+      }
 
-import "tdx/volt_api/volt/v1/status.proto";
+      try {
+        const parsedResponse = _parseResponse.call(
+          this,
+          this._methodName,
+          this._initialRequest.meta,
+          streamResponse
+        );
+        if (parsedResponse.key_exchange) {
+          const peerKey = keyFromPem$2(
+            parsedResponse.key_exchange.encryption_key
+          ).publicKey;
 
-// The Wire API allows clients to subscribe and publish to Volt wire resources.
-service WireAPI {
-  // Establishes a client-streaming call to the wire resource.
-  rpc PublishWire(stream PublishWireRequest) returns (stream PublishWireResponse);
+          this._encryptionKey = deriveSharedKey$1(
+            this._initialRequest.meta.sharedKey.key,
+            peerKey,
+            x25519$1
+          );
 
-  // Establishes a bi-directional streaming call to the wire resource.
-  // Although we're only really interested in receiving data from the wire, a bi-directional stream is required so that we can gracefully stop the subscription.
-  rpc SubscribeWire(stream SubscribeWireRequest) returns (stream SubscribeWireResponse);
-}
+          // We've exchanged keys, so send any queued payloads on the next tick.
+          process.nextTick(() => {
+            this._pendingRequests.forEach((pendingRequest) => {
+              this.write(pendingRequest);
+            });
+            this._pendingRequests = [];
+          });
+        } else if (parsedResponse.payload) {
+          // Interpret a non-empty status message as an error.
+          if (parsedResponse.payload?.status?.message) {
+            this.emit(
+              "error",
+              new Error(parsedResponse.payload.status.message)
+            );
+          } else {
+            this.emit("data", parsedResponse.payload);
+          }
+        } else if (parsedResponse.ended) {
+          if (parsedResponse.error) {
+            this.emit("error", new Error(parsedResponse.error));
+          } else {
+            // Not sure this is necessary - we should receive "end" from grpc soon...
+            this.emit("end");
+          }
+        } else {
+          log$5("method id is %s", parsedResponse.methodId);
+        }
+      } catch (err) {
+        log$5(
+          "failure processing %s call response: %s",
+          this._methodName,
+          err.message
+        );
+        this.emit("error", err);
+      }
+    });
 
-// Because the publish RPC is streaming, the policy will not be checked until the first message arrives. This can mean that the \`PublishWire\` call appears to succeed but then fails after the first attempt to publish a message.
-// To avoid this, clients can immediately send a message with the \`wire_id\` set and no \`chunk\` set. This will establish that the correct permissions are in place and fail fast if not.
-message PublishWireRequest {
-  // Only necessary in the first payload.
-  string wire_id = 1;
+    this._call.on("error", (err) => {
+      log$5(
+        "ERROR - intercepted stream error on %s: %s",
+        this._methodName,
+        err.message
+      );
+      this.emit("error", err);
+    });
 
-  // The chunk of data to publish.
-  bytes chunk = 2;
+    this._call.on("finish", () => {
+      // The read side has ended (i.e. we called end()).
+      log$5("finished call %s", this._methodName);
+      this.emit("finish");
+    });
 
-  // Whether to persist the chunk.
-  // This is only valid if the wire is configured to persist messages, i.e. the \`volt:wire-persist\` attribute is true.
-  bool do_not_persist = 3;
-}
+    this._call.on("end", () => {
+      // The remote peer ended the stream.
+      log$5(
+        "ended call %s, method id: %s",
+        this._methodName,
+        this._initialRequest.methodId || "n/a - not tunnelling"
+      );
+      this.emit("end");
+    });
 
-message PublishWireResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
+    if (this._initialRequest.request) {
+      if (unary) {
+        this._call.end(this._initialRequest.request);
+      } else {
+        // Allow callee to attach event handlers before we actually send the initial payload.
+        process.nextTick(() => this._call.write(this._initialRequest.request));
+      }
+    }
 
-// The request must include one of the following fields.
-message SubscribeWireRequest {
-  oneof payload {
-    // The wire id, only required for the first message.
-    string wire_id = 1;
-    // Request to stop the subscription.
-    bool stop = 2;
+    return this;
   }
-}
-
-// One of the following fields will be present in the response.
-message SubscribeWireResponse {
-  oneof payload {
-    // Details of any error that occurred on the call.
-    tdx.volt_api.volt.v1.Status status = 1;
 
-    // Data received from the wire.
-    bytes chunk = 2;
+  end() {
+    if (this._call) {
+      this._ended = true;
+      return this._call.end();
+    } else {
+      throw new Error("call not initialised");
+    }
   }
-}
-
-`;
-const voltProtos = [sqlite, sqlite_database_api, sqlite_server_api, proto_db_sync, proxy_api, relay_api, discovery_api, file, file_api, remote, spark_api, ssi, ssi_api, status, sync_api, terminal_api, volt, volt_api, wire_api];
-
-debug__default["default"]("volt-client-grpc:proto-utils");
-
-const voltServices = [
-  constants.serviceType.voltAPI,
-  constants.serviceType.fileAPI,
-  constants.serviceType.sqliteDatabaseAPI,
-  constants.serviceType.sqliteServerAPI,
-  constants.serviceType.ssiAPI,
-  constants.serviceType.syncAPI,
-  constants.serviceType.relayAPI,
-  constants.serviceType.terminalAPI,
-  constants.serviceType.wireAPI
-];
 
-const defaultLoaderOptions = {
-  keepCase: true,
-  longs: String,
-  enums: String,
-  defaults: true,
-  oneofs: true
-};
-
-function getServiceDescriptors(service) {
-  let root = new Protobuf__default["default"].Root();
-  for (let protoFile of service.service_description.proto_file) {
-    Protobuf__default["default"].parse(protoFile.protobuf, root, defaultLoaderOptions);
+  pause() {
+    log$5("pausing call %s", this._methodName);
+    return this._call?.pause();
   }
 
-  // Create a package definition from the root object.
-  const packageDefinition = createPackageDefinition(root, defaultLoaderOptions);
+  resume() {
+    log$5("resuming call %s", this._methodName);
+    return this._call?.resume();
+  }
 
-  // Merge the service API definitions into a single object.
-  let serviceDescriptors = {};
-  for (let api of service.service_description.service_api) {
-    const packageDescriptors = packageDefinition[api];
-    serviceDescriptors = { ...serviceDescriptors, ...packageDescriptors };
+  get writable() {
+    return this._call?.writable;
   }
 
-  return serviceDescriptors;
-}
+  write(request) {
+    if (!this._call) {
+      log$5("ERROR - call not initialised");
+      throw new Error("call not initialised");
+    } else if (this._initialRequest && !this._keyExchangePending) {
+      const payloadRequest = _preparePayloadRequest.call(
+        this,
+        request,
+        this._initialRequest
+      );
+      return this._call.write(payloadRequest);
+    } else {
+      this._keyExchangePending = false;
 
-function getBuiltInServiceDescriptors() {
-  // Create a placeholder service object for the Volt API service.
-  const voltServicePlaceholder = {
-    service_description: {
-      proto_file: voltProtos.map((proto) => ({ protobuf: proto })),
-      service_api: voltServices
-    }
-  };
+      this._initialRequest = _prepareInvokeRequest.call(
+        this,
+        request,
+        this._methodName,
+        this._methodType
+      );
 
-  return getServiceDescriptors(voltServicePlaceholder);
+      return this._call.write(this._initialRequest.request);
+    }
+  }
 }
 
-var protoUtils = /*#__PURE__*/Object.freeze({
-  __proto__: null,
-  getBuiltInServiceDescriptors: getBuiltInServiceDescriptors,
-  getServiceDescriptors: getServiceDescriptors
-});
-
 const {
   aesDecrypt,
   aesEncrypt,
@@ -4821,30 +4832,6 @@ async function authenticateInternal(
   ownDID = false
 ) {
   try {
-    // Check if we need to resolve a Relay volt.
-    if (
-      typeof this._voltConfig?.relay === "string" ||
-      this._voltConfig?.relay?.http_address
-    ) {
-      const relayURL =
-        this._voltConfig.relay?.http_address || this._voltConfig.relay;
-      log$2("attempting to retrieve Relay information from %s", relayURL);
-      this._voltConfig.relay = await fetchVoltConfig.call(
-        this,
-        `${relayURL}/discover`
-      );
-
-      if (this._voltConfig.relay.ca_pem) {
-        log$2(
-          "Auto-fetched Relay CA %s, remote address %s",
-          this._voltConfig.relay.ca_pem,
-          this._voltConfig.relay.address
-        );
-      } else {
-        throw new Error("Unable to fetch Relay CA - cannot securely connect.");
-      }
-    }
-
     if (!this._credential.cache.ca) {
       this._credential.cache.ca = this._voltConfig.ca_pem;
     }
@@ -4874,10 +4861,10 @@ async function authenticateInternal(
       host: this._credential.cache.bindIp
     };
 
-    if (this._voltConfig.challenge_code) {
+    if (this._credential.cache.challenge_code) {
       authenticateRequest.challenge = signBase64(
         this._credential.cache.key,
-        this._voltConfig.challenge_code
+        this._credential.cache.challenge_code
       );
     } else {
       log$2(
@@ -5174,11 +5161,18 @@ function streamingCallInternal(methodType, method, request, service) {
 
 async function fetchVoltConfig(discovery_url) {
   try {
-    const getJSON = bent__default["default"]("json");
-    const fullVoltConfig = await getJSON(discovery_url);
+    const response = await fetch(discovery_url);
+
+    if (!response.ok) {
+      log$2("fetchVoltConfig - error [%s]", response.status);
+      return null;
+    }
+
+    const fullVoltConfig = await response.json();
 
     if (!fullVoltConfig || typeof fullVoltConfig !== "object") {
-      throw new Error(`invalid config resolved from: ${discovery_url}`);
+      log$2("fetchVoltConfig - invalid config resolved from: %s", discovery_url);
+      return null;
     }
 
     const voltConfig = pick(
@@ -5190,16 +5184,15 @@ async function fetchVoltConfig(discovery_url) {
       "address",
       "http_address",
       "ca_pem",
-      "challenge_code",
-      "cloud",
       "relay"
     );
 
+    log$2("fetchVoltConfig from %s", discovery_url);
+
     return voltConfig;
   } catch (err) {
-    throw new Error(
-      `Failure loading config from ${discovery_url}: ${err.message}`
-    );
+    log$2("fetchVoltConfig - %s error [%s]", discovery_url, err.message);
+    return null;
   }
 }
 
@@ -5210,8 +5203,13 @@ async function fetchVoltConfigFromDIDInternal(volt_did, registryUrl) {
       throw new Error(`Invalid Volt DID: ${volt_did}`);
     }
 
-    const getJSON = bent__default["default"]("json");
-    const didDocument = await getJSON(didResolution);
+    const response = await fetch(didResolution);
+
+    if (!response.ok) {
+      throw new Error(`HTTP error, status: ${response.status}`);
+    }
+
+    const didDocument = await response.json();
     const voltConfigServices = findDIDDocumentService(
       didDocument,
       constants.didServiceType.voltConfig
@@ -5227,7 +5225,12 @@ async function fetchVoltConfigFromDIDInternal(volt_did, registryUrl) {
     log$2("resolved DID from %s", didResolution);
 
     const serviceEndpoint = voltConfigServices[0].serviceEndpoint;
-    return await fetchVoltConfig.call(this, serviceEndpoint);
+    const voltConfig = await fetchVoltConfig.call(this, serviceEndpoint);
+    if (!voltConfig) {
+      throw new Error(`failed to resolve Volt config from ${serviceEndpoint}`);
+    }
+
+    return voltConfig;
   } catch (err) {
     throw new Error(
       `Failure fetching Volt config from DID document ${volt_did}: ${err.message}`
@@ -5235,23 +5238,130 @@ async function fetchVoltConfigFromDIDInternal(volt_did, registryUrl) {
   }
 }
 
-async function fetchVoltConfigFromDID(
-  volt_did,
-  registryList = [constants.defaultDIDHostName]
-) {
+async function fetchVoltConfigFromDID(volt_did, registryListIn) {
+  let registryList;
+  if (!registryListIn) {
+    //  If no registry list is provided, use the default registry list.
+    registryList = constants.defaultRegistryList;
+  } else {
+    // If a registry list is provided, merge it with the default registry list.
+    registryList = Array.from(
+      new Set(registryListIn.concat(constants.defaultRegistryList))
+    );
+  }
+
+  let voltConfig;
   for (let registryUrl of registryList) {
     try {
-      return await fetchVoltConfigFromDIDInternal.call(
+      voltConfig = await fetchVoltConfigFromDIDInternal.call(
         this,
         volt_did,
         registryUrl
       );
+
+      // If we've found a config, break out of the loop.
+      break;
+    } catch (err) {
+      log$2("unable to fetch Volt config from %s: %s", registryUrl, err.message);
+    }
+  }
+
+  if (!voltConfig) {
+    log$2("failed to fetch Volt config for %s from any registry", volt_did);
+  }
+
+  return voltConfig;
+}
+
+async function resolveVoltConfig(cfg, didRegistryList) {
+  // Start by resolving the relay if one is specified.
+  let relay = cfg?.relay?.http_address || cfg?.relay;
+  if (relay) {
+    relay = await resolveVoltConfig.call(this, relay, didRegistryList);
+  }
+
+  let voltDID = "";
+  let voltHttpAddress = "";
+
+  if (typeof cfg === "string") {
+    // If the configuration is a string, determine if it is a DID or HTTP address.
+    if (cfg.indexOf("did:") === 0) {
+      voltDID = cfg;
+    } else {
+      voltHttpAddress = cfg;
+    }
+    cfg = {};
+  } else if (typeof cfg === "object") {
+    voltDID = cfg.id;
+    voltHttpAddress = cfg.http_address;
+  } else {
+    throw new Error("configuration is missing the 'volt' object");
+  }
+
+  let resolvedConfig;
+
+  if (relay) {
+    if (!voltDID) {
+      throw new Error("relay specified but no Volt DID provided");
+    }
+
+    // Build the sub-domain URL for the Volt discovery service by inserting the volt DID into the relay URL.
+    const relayURL = relay.http_address;
+    const relayParts = relayURL.split("://");
+    const subdomain = voltDID.substring(constants.voltDIDPrefix.length);
+    voltHttpAddress = `${relayParts[0]}://${subdomain}.${relayParts[1]}`;
+  } else if (voltDID) {
+    resolvedConfig = await fetchVoltConfigFromDID.call(
+      this,
+      voltDID,
+      didRegistryList
+    );
+  }
+
+  if (!resolvedConfig && voltHttpAddress) {
+    try {
+      resolvedConfig = await fetchVoltConfig.call(
+        this,
+        `${voltHttpAddress}/discover`
+      );
+
+      // Update the http address in the resolved config to the one we used to
+      // fetch it, since we may have used the relay rather than local address.
+      resolvedConfig.http_address = voltHttpAddress;
     } catch (err) {
-      log$2("Failed to fetch Volt config from %s: %s", registryUrl, err.message);
+      log$2(
+        "failed to resolve Volt configuration %s [%s]",
+        voltHttpAddress,
+        err.message
+      );
+    }
+  }
+
+  if (!resolvedConfig) {
+    if (cfg.address && cfg.ca_pem) {
+      log$2(
+        "unable to resolve %s / %s, using existing configuration",
+        voltDID,
+        voltHttpAddress
+      );
+    } else {
+      throw new Error(
+        `failed to resolve Volt ${voltDID} / ${voltHttpAddress} and no existing configuration`
+      );
     }
+  } else {
+    log$2("resolved config from: %s", voltDID || voltHttpAddress);
+    log$2(JSON.stringify(resolvedConfig, null, 2));
+
+    cfg = {
+      ...cfg,
+      ...resolvedConfig
+    };
   }
 
-  throw new Error(`Failed to fetch Volt config from any of these registries: ${registryList.join(", ")}`);
+  cfg.relay = relay;
+
+  return cfg;
 }
 
 /* eslint-disable no-underscore-dangle */
@@ -5306,6 +5416,11 @@ class VoltCredential {
 
       // Extract Volt public key.
       this._voltPublicKey = this._voltConfig.public_key;
+      if (!this._voltPublicKey) {
+        // Extract the public key from the Volt CA cert.
+        const voltCA = new crypto__default["default"].X509Certificate(this._voltConfig.ca_pem);
+        this._voltPublicKey = voltCA.publicKey.export({ type: 'spki', format: 'pem' });
+      }
 
       const voltKey = keyFromPem(this._voltPublicKey).publicKey;
       this._voltFingerprint = fingerprintFromPem(voltKey);
@@ -5491,19 +5606,22 @@ class VoltClient extends EventEmitter__default["default"] {
 
   /**
    * Initialises a binding and connection to the volt.
-   * @param {string} [config] - the location of the Volt configuration file, or a configuration object
-   * @param {object} [extras] - additional configuration properties
+   * @param {string | object} [config] - the location of the Volt configuration
+   * file, or a configuration object
+   * @param {object} [options] - initialisation options
+   * @param {string[]} [options.didRegistryList] - list of DID registry URLs to use for
+   * resolving DIDs
+   * @param {object} [options.extraConfig] - additional configuration to be merged with the
+   * configuration from the config file.
+   * @param {boolean} [options.ownDID] - whether the Volt should manage the DID - set to
+   * true  if you want to manage the DID yourself
    */
-  async initialise(
-    config,
-    extras = {},
-    ownDID = false,
-    didRegistryList = undefined
-  ) {
+  async initialise(config, options = {}) {
+    const { ownDID, didRegistryList, extraConfig } = options;
     try {
       if (!config) {
         throw new Error(
-          "configPath argument is required to be a non-empty string"
+          "config argument is required to be a non-empty string or JSON object"
         );
       }
 
@@ -5536,7 +5654,8 @@ class VoltClient extends EventEmitter__default["default"] {
         throw new Error("config argument is required to be an object");
       }
 
-      this._config = { ...extras, ...configJSON };
+      // Merge any extra configuration supplied, preferring that loaded from file.
+      this._config = { ...extraConfig, ...configJSON };
 
       if (
         !this._config.client_name ||
@@ -5545,52 +5664,13 @@ class VoltClient extends EventEmitter__default["default"] {
         throw new Error("client_name property required in config");
       }
 
-      let voltDID = "";
-      let voltHttpAddress = "";
-      if (typeof this._config.volt === "string") {
-        if (this._config.volt.indexOf("did:") === 0) {
-          voltDID = this._config.volt;
-        } else {
-          voltHttpAddress = this._config.volt;
-        }
-        delete this._config.volt;
-      } else if (typeof this._config.volt !== "object") {
-        throw new Error("configuration is missing the 'volt' object");
-      } else {
-        voltDID = this._config.volt.did;
-        voltHttpAddress = this._config.volt.http_address;
-      }
-
-      if (voltDID) {
-        const didConfig = await fetchVoltConfigFromDID.call(
-          this,
-          voltDID,
-          didRegistryList
-        );
-
-        // Remove the relay list from the DID config, as it would overwrite the relay in the supplied config.
-        delete didConfig.relay;
-
-        this._config = { ...this._config, volt: didConfig };
-        log("resolved config from DID: %s", JSON.stringify(didConfig, null, 2));
-      } else if (voltHttpAddress && !this._config?.volt?.id) {
-        const discoConfig = await fetchVoltConfig.call(
-          this,
-          `${voltHttpAddress}/discover`
-        );
-        this._config = {
-          ...this._config,
-          volt: { ...this._config.volt, ...discoConfig }
-        };
-      }
+      this._config.volt = await resolveVoltConfig.call(
+        this,
+        this._config.volt,
+        didRegistryList
+      );
 
       this._voltConfig = this._config.volt;
-      if (voltDID) {
-        this._voltConfig.did = voltDID;
-      }
-      if (voltHttpAddress) {
-        this._voltConfig.http_address = voltHttpAddress;
-      }
 
       if (!this._voltConfig.id || typeof this._voltConfig.id !== "string") {
         throw new Error("'id' property is missing in Volt configuration");
@@ -5645,13 +5725,14 @@ class VoltClient extends EventEmitter__default["default"] {
 
       return Promise.resolve(this._config);
     } catch (err) {
-      log("Failure starting Volt client [%s]", err.message);
+      log("failure starting Volt client [%s]", err.message);
       throw err;
     }
   }
 
-  initialiseAndConnect(configPath, helloPayload = undefined, extras = {}) {
-    return this.initialise(configPath, extras)
+  initialiseAndConnect(configPath, options) {
+    const helloPayload = options?.helloPayload;
+    return this.initialise(configPath, options)
       .then(() => {
         return connectInternal.call(this, helloPayload);
       })
@@ -6092,6 +6173,10 @@ class VoltClient extends EventEmitter__default["default"] {
   }
 }
 
+Object.defineProperty(exports, 'SyncProvider', {
+  enumerable: true,
+  get: function () { return voltClientWeb.SyncProvider; }
+});
 Object.defineProperty(exports, 'generateId', {
   enumerable: true,
   get: function () { return uuid.v4; }