@tdxvolt/volt-client-grpc 0.20.16 → 0.20.18

package/lib/index.cjs

@@ -980,6 +980,84 @@ message DiscoverResponse {
   // A list of endpoints that match the request criteria.
   repeated SignedEndpoint endpoint = 2;
 }
+`;
+const drive_api = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+import "tdx/volt_api/volt/v1/volt.proto";
+
+// The Drive API allows clients to create and manage Volt Drive resources.
+service DriveAPI {
+  // Create or update a drive connection resource.
+  // This is a privileged API call and requires volt:api-call / volt:save-drive permission.
+  rpc SaveDrive(SaveDriveRequest) returns (SaveDriveResponse);
+}
+
+message SaveDriveRequest {
+  // Details of the drive to save.
+  Resource resource = 1;
+
+  // Set to indicate this is a new drive.
+  bool create = 2;
+
+  // The id of the folder resource in which a new drive should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  // If the \`resource\` field contains attributes they will be saved after the purge.
+  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
+  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
+  bool purge_attributes = 4;
+
+  // The id of the synapse resource that stores the drive data.
+  string source_synapse_id = 5;
+
+  // The local path of the folder to sync.
+  string target_folder = 6;
+
+  // The comma-separated include patterns.
+  string include = 7;
+
+  // The comma-separated exclude patterns.
+  string exclude = 8;
+
+  // The DID of the identity that should be used to authenticate with the remote Volt. If omitted, the authenticated identity will be used.
+  // The identity must have a private key stored in the Volt key store.
+  string identity_did = 9;
+
+  // The DID of the remote Volt.
+  string remote_volt_identity = 10;
+
+  // Optional address of the remote Volt. Either this or the relay address must be provided.
+  string remote_volt_address = 11;
+
+  // Optional HTTP address of the remote Volt.
+  string remote_volt_http_address = 12;
+
+  // Optional CA of the remote Volt. Either this or the relay CA must be provided.
+  string remote_volt_ca = 13;
+
+  // Optional address of the relay. Either this or the remote Volt address must be provided.
+  string relay_address = 14;
+
+  // Optional CA of the relay. Either this or the remote Volt CA must be provided.
+  string relay_ca = 15;
+
+  // Optional challenge of the relay.
+  string relay_challenge = 16;
+}
+
+message SaveDriveResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated drive resource.
+  Resource resource = 2;
+}
+
 `;
 const file = `syntax = "proto3";
 
@@ -1371,6 +1449,8 @@ service SsiAPI {
   rpc RegisterDIDDocument(RegisterDIDDocumentRequest) returns (RegisterDIDDocumentResponse);
 
   // Save a verifiable credential.
+  // If the credential is to be issued by the Volt, this is a privileged API call and requires volt:api-call / volt:save-verifiable-credential permission.
+  // If the credential is to be issued by an identity other than the Volt root, the authenticated session must have the associated identity id (or be the Volt root).
   rpc SaveCredential(SaveCredentialRequest) returns (SaveCredentialResponse);
 
   // Search the DID registry.
@@ -1597,8 +1677,8 @@ const sync_api = `syntax = "proto3";
 
 package tdx.volt_api.volt.v1;
 
+import "tdx/volt_api/volt/v1/volt.proto";
 import "tdx/volt_api/volt/v1/status.proto";
-import "tdx/volt_api/volt/v1/volt_api.proto";
 
 // The Sync API allows clients to collaboratively read and write JSON data to a shared resource.
 service SyncAPI {
@@ -1606,12 +1686,18 @@ service SyncAPI {
   // A synapse connection defines a bi-directional syncronisation between two Volt synapses. The connection is created as a child of the local synapse resource, and a symbolic link is also placed in the system-wide 'connection' folder.
   // The remote Volt is identified by its DID or address. If a relay address is provided, the connection will be established via the relay.
   // The authenticated account must have \`volt:resource-create\` access to the local synapse resource.
-  rpc CreateSynapseConnection(SaveResourceRequest) returns (SaveResourceResponse);
-
+  rpc CreateSynapseConnection(CreateSynapseConnectionRequest) returns (CreateSynapseConnectionResponse);
+  
   // Delete a document from the synapse.
   rpc DeleteSynapseDocumentMetadata(DeleteSynapseDocumentMetadataRequest) returns (DeleteSynapseDocumentMetadataResponse);
 
-  // Set the metadata for a synapse document.
+  // Create or update a synapse resource.
+  rpc SaveSynapse(SaveSynapseRequest) returns (SaveSynapseResponse);
+
+  // Create or update a sync database resource.
+  rpc SaveSyncDatabase(SaveSyncDatabaseRequest) returns (SaveSyncDatabaseResponse);
+
+    // Set the metadata for a synapse document.
   rpc SetSynapseDocumentMetadata(SetSynapseDocumentMetadataRequest) returns (SetSynapseDocumentMetadataResponse);
 
   // Bidirectional streaming RPC for real-time document synchronization
@@ -1624,6 +1710,60 @@ service SyncAPI {
   rpc WriteSynapsePath(WriteSynapsePathRequest) returns (WriteSynapsePathResponse);
 }
 
+message CreateSynapseConnectionRequest {
+  // Details of the synapse connection to create.
+  Resource resource = 1;
+
+  // Set to indicate this is a new synapse connection.
+  bool create = 2;
+
+  // The id of the folder resource in which a new synapse connection should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  // If the \`resource\` field contains attributes they will be saved after the purge.
+  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
+  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
+  bool purge_attributes = 4;
+
+  // The id of the synapse on the local Volt.
+  string local_synapse_id = 5;
+
+  // The id of the synapse on the remote Volt.
+  string remote_synapse_id = 6;
+
+  // The DID of the remote Volt.
+  string remote_volt_identity = 7;
+
+  // The address of the remote Volt.
+  string remote_volt_address = 8;
+
+  // The HTTP address of the remote Volt.
+  string remote_volt_http_address = 9;
+
+  // The CA of the remote Volt.
+  string remote_volt_ca = 10;
+
+  // Optional DID of the account to use when connecting to the remote Volt. If omitted, the local Volt DID will be used.
+  // The identity must have a private key stored in the Volt key store.
+  string remote_identity = 11;
+
+  // Optional address of the relay to use when connecting to the remote Volt.
+  string relay_address = 12;
+
+  // Optional CA of the relay.
+  string relay_ca = 13;
+
+  // Optional challenge of the relay.
+  string relay_challenge = 14;
+}
+
+message CreateSynapseConnectionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  Resource resource = 2;
+}
+
 message DeleteSynapseDocumentMetadataRequest {
   // DEPRECATED: Use synapse_id instead.
   string database_id = 1;
@@ -1639,6 +1779,79 @@ message DeleteSynapseDocumentMetadataResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 }
 
+message SaveSyncDatabaseRequest {
+  // Details of the database to save.
+  Resource resource = 1;
+
+  // Set to indicate this is a new database.
+  bool create = 2;
+
+  // The id of the folder resource in which a new database should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  // If the \`resource\` field contains attributes they will be saved after the purge.
+  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
+  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
+  bool purge_attributes = 4;
+
+  // Set to encrypt the database.
+  bool encrypted = 5;
+
+  // Set to audit all SELECT database operations.
+  bool read_audit = 6;
+
+  // Set to audit all INSERT, UPDATE, and DELETE database operations.
+  bool write_audit = 7;
+
+  // By default, yjs updates are periodically compressed and stored as snapshots. Set this flag to disable snapshots. This will reduce the size of the database and improve performance, but will also reduce the ability to rollback to a previous state.
+  bool no_snapshots = 8;
+}
+
+message SaveSyncDatabaseResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  Resource resource = 2;
+}
+
+message SaveSynapseRequest {
+  // Details of the synapse to save.
+  Resource resource = 1;
+
+  // Set to indicate this is a new synapse.
+  bool create = 2;
+
+  // The id of the folder resource in which a new synapse should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  // If the \`resource\` field contains attributes they will be saved after the purge.
+  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
+  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
+  bool purge_attributes = 4;
+
+  // Set to encrypt the synapse.
+  bool encrypted = 5;
+
+  // Set to audit all SELECT synapse operations.
+  bool read_audit = 6;
+
+  // Set to audit all INSERT, UPDATE, and DELETE synapse operations.
+  bool write_audit = 7;
+
+  // By default, yjs updates are periodically compressed and stored as snapshots. Set this flag to disable snapshots. This will reduce the size of the synapse and improve performance, but will also reduce the ability to rollback to a previous state.
+  bool no_snapshots = 8;
+}
+
+message SaveSynapseResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated synapse resource.
+  Resource resource = 2;
+}
+
 message SynapseDocumentMetadata {
   // The name of the top-level shared type in the document.
   string name = 1;
@@ -2578,6 +2791,7 @@ import "tdx/volt_api/volt/v1/volt.proto";
 // All methods include a \`tdx.volt_api.volt.v1.Status\` in the response. If the status contains a non-OK error code the client should assume the remainder of the message is invalid, unless otherwise indicated in the response documentation.
 service VoltAPI {
   // Add a relay connection resource to this volt.
+  // This is a privileged API call and requires volt:api-call / volt:add-relay permission.
   rpc AddRelay(SaveResourceRequest) returns (SaveResourceResponse);
 
   // Issues a request to authenticate on the volt.
@@ -2606,6 +2820,7 @@ service VoltAPI {
   rpc CopyResource(CopyResourceRequest) returns (CopyResourceResponse);
 
   // Remove a custom access rule, such as a file share.
+  // This is a privileged API call and requires volt:api-call / volt:delete-access permission. Resource owners have this privilege by default.
   rpc DeleteAccess(DeleteAccessRequest) returns (DeleteAccessResponse);
 
   // Delete a resource from this volt.
@@ -2632,11 +2847,11 @@ service VoltAPI {
   rpc GetOneTimeToken(GetOneTimeTokenRequest) returns (GetOneTimeTokenResponse);
 
   // Retrieve the Volt parameters.
-  // This is a privileged API call and requires Volt root access.
+  // This is a privileged API call and requires volt:api-call / volt:get-parameters permission.
   rpc GetParameters(GetParametersRequest) returns (GetParametersResponse);
 
   // Retrieve the active Volt policy.
-  // This is a privileged API call and requires Volt root access.
+  // This is a privileged API call and requires volt:api-call / volt:get-policy permission.
   rpc GetPolicy(GetPolicyRequest) returns (GetPolicyResponse);
 
   // Get resource from this volt.
@@ -2666,15 +2881,18 @@ service VoltAPI {
   rpc RequestAccess(RequestAccessRequest) returns (RequestAccessResponse);
 
   // Create or update an access rule.
+  // This is a privileged API call and requires volt:api-call / volt:save-access permission. Resource owners have this privilege by default.
   rpc SaveAccess(SaveAccessRequest) returns (SaveAccessResponse);
 
   // Create or update a static file HTTP server.
+  // This is a privileged API call and requires volt:api-call / volt:save-http-file-server permission.
   rpc SaveHttpFileServer(SaveHttpFileServerRequest) returns (SaveHttpFileServerResponse);
 
   // Create or update an HTTP forwarder resource.
   rpc SaveHttpForwarder(SaveHttpForwarderRequest) returns (SaveHttpForwarderResponse);
 
   // Create or update an HTTP REST API server.
+  // This is a privileged API call and requires volt:api-call / volt:save-http-rest-api-server permission.
   rpc SaveHttpRestApiServer(SaveHttpRestApiServerRequest) returns (SaveHttpRestApiServerResponse);
 
   // Create or update an HTTP REST API node.
@@ -2687,44 +2905,41 @@ service VoltAPI {
   rpc SaveDatabase(SaveDatabaseRequest) returns (SaveDatabaseResponse);
 
   // Create or update a mirrored link resource.
+  // This is a privileged API call and requires volt:api-call / volt:save-mirrored-link permission.
   rpc SaveMirroredLink(SaveResourceRequest) returns (SaveResourceResponse);
 
-  // Create or update a sync database resource.
-  rpc SaveSyncDatabase(SaveSyncDatabaseRequest) returns (SaveSyncDatabaseResponse);
-
-  // Create or update a synapse resource.
-  rpc SaveSynapse(SaveSynapseRequest) returns (SaveSynapseResponse);
-
-  // Create a synapse connection resource.
-  rpc CreateSynapseConnection(CreateSynapseConnectionRequest) returns (CreateSynapseConnectionResponse);
-
   // Update Volt parameters.
-  // This is a privileged call that requires Volt root access.
+  // This is a privileged API call and requires volt:api-call / volt:save-parameters permission.
   rpc SaveParameters(SaveParametersRequest) returns (SaveParametersResponse);
 
   // Create or update resource in this volt.
   rpc SaveResource(SaveResourceRequest) returns (SaveResourceResponse);
 
   // Create or update a symbolic link resource.
+  // This is a privileged API call and requires volt:api-call / volt:save-symbolic-link permission.ß
   rpc SaveSymbolicLink(SaveResourceRequest) returns (SaveResourceResponse);
 
   // Save a session.
+  // Requires \`volt:session-write\` permission. Authenticated sessions have this privilege by default.
   rpc SaveSession(SaveSessionRequest) returns (SaveSessionResponse);
 
   // Set Volt access request decision.
-  // This is a privileged call that requires Volt root access.
+  // This is a privileged API call and requires volt:api-call / volt:set-access-request-decision permission.
   rpc SetAccessRequestDecision(SetAccessRequestDecisionRequest) returns (SetAccessRequestDecisionResponse);
 
+  // Set Volt policy.
+  // This is a privileged API call and requires volt:api-call / volt:set-policy permission.
   rpc SetPolicy(SetPolicyRequest) returns (SetPolicyResponse);
 
   // Set the status of a Volt service.
   rpc SetServiceStatus(SetServiceStatusRequest) returns (SetServiceStatusResponse);
 
   // Used to shutdown remote Volts.
-  // This is a privileged call that requires Volt root access.
+  // This is a privileged API call and requires volt:api-call / volt:shutdown permission.
   rpc Shutdown(ShutdownRequest) returns (ShutdownResponse);
 
   // Sign or verify an arbitrary message using the Volt key.
+  // For signing using an \`identity_did\` other than the authenticated account, the authenticated session must have \`volt:sign\` permission for the given \`identity_did\`.
   rpc SignVerify(SignVerifyRequest) returns (SignVerifyResponse);
 }
 
@@ -3615,49 +3830,37 @@ message SaveResourceResponse {
 }
 
 message SaveDatabaseRequest {
+  // Details of the database to save.
   Resource resource = 1;
-  bool create = 2;
-  string create_in_parent_id = 3;
-  bool purge_attributes = 4;
-  bool encrypted = 5;
-  bool read_audit = 6;
-  bool write_audit = 7;
-}
-
-message SaveDatabaseResponse {
-  tdx.volt_api.volt.v1.Status status = 1;
-  Resource resource = 2;
-}
 
-message SaveSyncDatabaseRequest {
-  Resource resource = 1;
+  // Set to indicate this is a new database.
   bool create = 2;
-  string create_in_parent_id = 3;
-  bool purge_attributes = 4;
-  bool encrypted = 5;
-  bool read_audit = 6;
-  bool write_audit = 7;
-  bool no_snapshots = 8;
-}
 
-message SaveSyncDatabaseResponse {
-  tdx.volt_api.volt.v1.Status status = 1;
-  Resource resource = 2;
-}
-
-message SaveSynapseRequest {
-  Resource resource = 1;
-  bool create = 2;
+  // The id of the folder resource in which a new database should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  // If the \`resource\` field contains attributes they will be saved after the purge.
+  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
+  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
   bool purge_attributes = 4;
+
+  // Set to encrypt the database.
   bool encrypted = 5;
+
+  // Set to audit all SELECT database operations.
   bool read_audit = 6;
+
+  // Set to audit all INSERT, UPDATE, and DELETE database operations.
   bool write_audit = 7;
-  bool no_snapshots = 8;
 }
 
-message SaveSynapseResponse {
+message SaveDatabaseResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated database resource.
   Resource resource = 2;
 }
 
@@ -3729,28 +3932,6 @@ message SaveHttpRestApiNodeResponse {
   Resource resource = 2;
 }
 
-message CreateSynapseConnectionRequest {
-  Resource resource = 1;
-  bool create = 2;
-  string create_in_parent_id = 3;
-  bool purge_attributes = 4;
-  string local_synapse_id = 5;
-  string remote_synapse_id = 6;
-  string remote_volt_identity = 7;
-  string remote_volt_address = 8;
-  string remote_volt_http_address = 9;
-  string remote_volt_ca = 10;
-  string remote_identity = 11;
-  string relay_address = 12;
-  string relay_ca = 13;
-  string relay_challenge = 14;
-}
-
-message CreateSynapseConnectionResponse {
-  tdx.volt_api.volt.v1.Status status = 1;
-  Resource resource = 2;
-}
-
 message SaveSessionRequest {
   Session session = 1;
 }
@@ -3939,7 +4120,7 @@ message SubscribeWireResponse {
 }
 
 `;
-const voltProtos = [sqlite, sqlite_database_api, sqlite_server_api, proto_db_sync, proxy_api, relay_api, discovery_api, file, file_api, remote, ssi, ssi_api, status, sync_api, terminal_api, volt, volt_api, wire_api];
+const voltProtos = [sqlite, sqlite_database_api, sqlite_server_api, proto_db_sync, proxy_api, relay_api, discovery_api, drive_api, file, file_api, remote, ssi, ssi_api, status, sync_api, terminal_api, volt, volt_api, wire_api];
 
 debug__default["default"]("volt-client-grpc:proto-utils");
 
@@ -4395,9 +4576,10 @@ class GRPCCall extends EventEmitter__default["default"] {
         } else if (parsedResponse.payload) {
           // Interpret a non-empty status message as an error.
           if (parsedResponse.payload?.status?.message) {
+            const { message, description, code } = parsedResponse.payload.status;
             this.emit(
               "error",
-              new Error(parsedResponse.payload.status.message)
+              new js.VoltClientError(message, { description, code })
             );
           } else {
             this.emit("data", parsedResponse.payload);
@@ -6391,6 +6573,13 @@ class VoltClient extends EventEmitter__default["default"] {
     return subscribeCall.start(grpcClient, request);
   }
 
+  /**
+   * DriveAPI
+   */
+  SaveDrive(request) {
+    return unaryCallInternal.call(this, "SaveDrive", request);
+  }
+
   /**
    * SyncAPI
    */
@@ -6404,9 +6593,13 @@ class VoltClient extends EventEmitter__default["default"] {
     );
     return syncDocumentCall.start(grpcClient, request);
   }
-  
+
   DeleteSynapseDocumentMetadata(request) {
-    return unaryCallInternal.call(this, "DeleteSynapseDocumentMetadata", request);
+    return unaryCallInternal.call(
+      this,
+      "DeleteSynapseDocumentMetadata",
+      request
+    );
   }
 
   SetSynapseDocumentMetadata(request) {
@@ -6417,8 +6610,8 @@ class VoltClient extends EventEmitter__default["default"] {
     const grpcClient = this.getVoltAPIClient();
 
     const watchPathCall = new GRPCCall(
-      this, 
-      "WatchSynapsePath", 
+      this,
+      "WatchSynapsePath",
       "METHOD_TYPE_BIDI"
     );
     return watchPathCall.start(grpcClient, request);

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.20.16",
+  "version": "0.20.18",
   "description": "tdx Volt library for nodejs clients",
   "type": "module",
   "exports": {
@@ -33,8 +33,8 @@
   "author": "toby.ealden@gmail.com",
   "license": "ISC",
   "dependencies": {
-    "@tdxvolt/volt-client-web": "^0.20.16",
-    "@tdxvolt/volt-utility": "^0.20.10",
+    "@tdxvolt/volt-client-web": "^0.20.18",
+    "@tdxvolt/volt-utility": "^0.20.18",
     "debug": "^4.1.1",
     "ip": "^1.1.5",
     "jsonwebtoken": "^8.5.1",

package/src/grpc-call.js

@@ -1,5 +1,8 @@
 /* eslint-disable no-underscore-dangle */
-import { voltUtils as voltClientUtils } from "@tdxvolt/volt-client-web/js";
+import {
+  VoltClientError,
+  voltUtils as voltClientUtils
+} from "@tdxvolt/volt-client-web/js";
 import debug from "debug";
 import EventEmitter from "events";
 
@@ -396,9 +399,10 @@ export default class GRPCCall extends EventEmitter {
         } else if (parsedResponse.payload) {
           // Interpret a non-empty status message as an error.
           if (parsedResponse.payload?.status?.message) {
+            const { message, description, code } = parsedResponse.payload.status;
             this.emit(
               "error",
-              new Error(parsedResponse.payload.status.message)
+              new VoltClientError(message, { description, code })
             );
           } else {
             this.emit("data", parsedResponse.payload);

package/src/volt-client.js

@@ -725,6 +725,13 @@ export class VoltClient extends EventEmitter {
     return subscribeCall.start(grpcClient, request);
   }
 
+  /**
+   * DriveAPI
+   */
+  SaveDrive(request) {
+    return unaryCallInternal.call(this, "SaveDrive", request);
+  }
+
   /**
    * SyncAPI
    */
@@ -738,9 +745,13 @@ export class VoltClient extends EventEmitter {
     );
     return syncDocumentCall.start(grpcClient, request);
   }
-  
+
   DeleteSynapseDocumentMetadata(request) {
-    return unaryCallInternal.call(this, "DeleteSynapseDocumentMetadata", request);
+    return unaryCallInternal.call(
+      this,
+      "DeleteSynapseDocumentMetadata",
+      request
+    );
   }
 
   SetSynapseDocumentMetadata(request) {
@@ -751,8 +762,8 @@ export class VoltClient extends EventEmitter {
     const grpcClient = this.getVoltAPIClient();
 
     const watchPathCall = new GRPCCall(
-      this, 
-      "WatchSynapsePath", 
+      this,
+      "WatchSynapsePath",
       "METHOD_TYPE_BIDI"
     );
     return watchPathCall.start(grpcClient, request);

package/src/volt-proto-literals.js

@@ -432,6 +432,84 @@ message DiscoverResponse {
   // A list of endpoints that match the request criteria.
   repeated SignedEndpoint endpoint = 2;
 }
+`;
+export const drive_api = `syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/status.proto";
+import "tdx/volt_api/volt/v1/volt.proto";
+
+// The Drive API allows clients to create and manage Volt Drive resources.
+service DriveAPI {
+  // Create or update a drive connection resource.
+  // This is a privileged API call and requires volt:api-call / volt:save-drive permission.
+  rpc SaveDrive(SaveDriveRequest) returns (SaveDriveResponse);
+}
+
+message SaveDriveRequest {
+  // Details of the drive to save.
+  Resource resource = 1;
+
+  // Set to indicate this is a new drive.
+  bool create = 2;
+
+  // The id of the folder resource in which a new drive should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  // If the \`resource\` field contains attributes they will be saved after the purge.
+  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
+  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
+  bool purge_attributes = 4;
+
+  // The id of the synapse resource that stores the drive data.
+  string source_synapse_id = 5;
+
+  // The local path of the folder to sync.
+  string target_folder = 6;
+
+  // The comma-separated include patterns.
+  string include = 7;
+
+  // The comma-separated exclude patterns.
+  string exclude = 8;
+
+  // The DID of the identity that should be used to authenticate with the remote Volt. If omitted, the authenticated identity will be used.
+  // The identity must have a private key stored in the Volt key store.
+  string identity_did = 9;
+
+  // The DID of the remote Volt.
+  string remote_volt_identity = 10;
+
+  // Optional address of the remote Volt. Either this or the relay address must be provided.
+  string remote_volt_address = 11;
+
+  // Optional HTTP address of the remote Volt.
+  string remote_volt_http_address = 12;
+
+  // Optional CA of the remote Volt. Either this or the relay CA must be provided.
+  string remote_volt_ca = 13;
+
+  // Optional address of the relay. Either this or the remote Volt address must be provided.
+  string relay_address = 14;
+
+  // Optional CA of the relay. Either this or the remote Volt CA must be provided.
+  string relay_ca = 15;
+
+  // Optional challenge of the relay.
+  string relay_challenge = 16;
+}
+
+message SaveDriveResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated drive resource.
+  Resource resource = 2;
+}
+
 `;
 export const file = `syntax = "proto3";
 
@@ -823,6 +901,8 @@ service SsiAPI {
   rpc RegisterDIDDocument(RegisterDIDDocumentRequest) returns (RegisterDIDDocumentResponse);
 
   // Save a verifiable credential.
+  // If the credential is to be issued by the Volt, this is a privileged API call and requires volt:api-call / volt:save-verifiable-credential permission.
+  // If the credential is to be issued by an identity other than the Volt root, the authenticated session must have the associated identity id (or be the Volt root).
   rpc SaveCredential(SaveCredentialRequest) returns (SaveCredentialResponse);
 
   // Search the DID registry.
@@ -1049,8 +1129,8 @@ export const sync_api = `syntax = "proto3";
 
 package tdx.volt_api.volt.v1;
 
+import "tdx/volt_api/volt/v1/volt.proto";
 import "tdx/volt_api/volt/v1/status.proto";
-import "tdx/volt_api/volt/v1/volt_api.proto";
 
 // The Sync API allows clients to collaboratively read and write JSON data to a shared resource.
 service SyncAPI {
@@ -1058,12 +1138,18 @@ service SyncAPI {
   // A synapse connection defines a bi-directional syncronisation between two Volt synapses. The connection is created as a child of the local synapse resource, and a symbolic link is also placed in the system-wide 'connection' folder.
   // The remote Volt is identified by its DID or address. If a relay address is provided, the connection will be established via the relay.
   // The authenticated account must have \`volt:resource-create\` access to the local synapse resource.
-  rpc CreateSynapseConnection(SaveResourceRequest) returns (SaveResourceResponse);
-
+  rpc CreateSynapseConnection(CreateSynapseConnectionRequest) returns (CreateSynapseConnectionResponse);
+  
   // Delete a document from the synapse.
   rpc DeleteSynapseDocumentMetadata(DeleteSynapseDocumentMetadataRequest) returns (DeleteSynapseDocumentMetadataResponse);
 
-  // Set the metadata for a synapse document.
+  // Create or update a synapse resource.
+  rpc SaveSynapse(SaveSynapseRequest) returns (SaveSynapseResponse);
+
+  // Create or update a sync database resource.
+  rpc SaveSyncDatabase(SaveSyncDatabaseRequest) returns (SaveSyncDatabaseResponse);
+
+    // Set the metadata for a synapse document.
   rpc SetSynapseDocumentMetadata(SetSynapseDocumentMetadataRequest) returns (SetSynapseDocumentMetadataResponse);
 
   // Bidirectional streaming RPC for real-time document synchronization
@@ -1076,6 +1162,60 @@ service SyncAPI {
   rpc WriteSynapsePath(WriteSynapsePathRequest) returns (WriteSynapsePathResponse);
 }
 
+message CreateSynapseConnectionRequest {
+  // Details of the synapse connection to create.
+  Resource resource = 1;
+
+  // Set to indicate this is a new synapse connection.
+  bool create = 2;
+
+  // The id of the folder resource in which a new synapse connection should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  // If the \`resource\` field contains attributes they will be saved after the purge.
+  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
+  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
+  bool purge_attributes = 4;
+
+  // The id of the synapse on the local Volt.
+  string local_synapse_id = 5;
+
+  // The id of the synapse on the remote Volt.
+  string remote_synapse_id = 6;
+
+  // The DID of the remote Volt.
+  string remote_volt_identity = 7;
+
+  // The address of the remote Volt.
+  string remote_volt_address = 8;
+
+  // The HTTP address of the remote Volt.
+  string remote_volt_http_address = 9;
+
+  // The CA of the remote Volt.
+  string remote_volt_ca = 10;
+
+  // Optional DID of the account to use when connecting to the remote Volt. If omitted, the local Volt DID will be used.
+  // The identity must have a private key stored in the Volt key store.
+  string remote_identity = 11;
+
+  // Optional address of the relay to use when connecting to the remote Volt.
+  string relay_address = 12;
+
+  // Optional CA of the relay.
+  string relay_ca = 13;
+
+  // Optional challenge of the relay.
+  string relay_challenge = 14;
+}
+
+message CreateSynapseConnectionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  Resource resource = 2;
+}
+
 message DeleteSynapseDocumentMetadataRequest {
   // DEPRECATED: Use synapse_id instead.
   string database_id = 1;
@@ -1091,6 +1231,79 @@ message DeleteSynapseDocumentMetadataResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 }
 
+message SaveSyncDatabaseRequest {
+  // Details of the database to save.
+  Resource resource = 1;
+
+  // Set to indicate this is a new database.
+  bool create = 2;
+
+  // The id of the folder resource in which a new database should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  // If the \`resource\` field contains attributes they will be saved after the purge.
+  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
+  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
+  bool purge_attributes = 4;
+
+  // Set to encrypt the database.
+  bool encrypted = 5;
+
+  // Set to audit all SELECT database operations.
+  bool read_audit = 6;
+
+  // Set to audit all INSERT, UPDATE, and DELETE database operations.
+  bool write_audit = 7;
+
+  // By default, yjs updates are periodically compressed and stored as snapshots. Set this flag to disable snapshots. This will reduce the size of the database and improve performance, but will also reduce the ability to rollback to a previous state.
+  bool no_snapshots = 8;
+}
+
+message SaveSyncDatabaseResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  Resource resource = 2;
+}
+
+message SaveSynapseRequest {
+  // Details of the synapse to save.
+  Resource resource = 1;
+
+  // Set to indicate this is a new synapse.
+  bool create = 2;
+
+  // The id of the folder resource in which a new synapse should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  // If the \`resource\` field contains attributes they will be saved after the purge.
+  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
+  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
+  bool purge_attributes = 4;
+
+  // Set to encrypt the synapse.
+  bool encrypted = 5;
+
+  // Set to audit all SELECT synapse operations.
+  bool read_audit = 6;
+
+  // Set to audit all INSERT, UPDATE, and DELETE synapse operations.
+  bool write_audit = 7;
+
+  // By default, yjs updates are periodically compressed and stored as snapshots. Set this flag to disable snapshots. This will reduce the size of the synapse and improve performance, but will also reduce the ability to rollback to a previous state.
+  bool no_snapshots = 8;
+}
+
+message SaveSynapseResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated synapse resource.
+  Resource resource = 2;
+}
+
 message SynapseDocumentMetadata {
   // The name of the top-level shared type in the document.
   string name = 1;
@@ -2030,6 +2243,7 @@ import "tdx/volt_api/volt/v1/volt.proto";
 // All methods include a \`tdx.volt_api.volt.v1.Status\` in the response. If the status contains a non-OK error code the client should assume the remainder of the message is invalid, unless otherwise indicated in the response documentation.
 service VoltAPI {
   // Add a relay connection resource to this volt.
+  // This is a privileged API call and requires volt:api-call / volt:add-relay permission.
   rpc AddRelay(SaveResourceRequest) returns (SaveResourceResponse);
 
   // Issues a request to authenticate on the volt.
@@ -2058,6 +2272,7 @@ service VoltAPI {
   rpc CopyResource(CopyResourceRequest) returns (CopyResourceResponse);
 
   // Remove a custom access rule, such as a file share.
+  // This is a privileged API call and requires volt:api-call / volt:delete-access permission. Resource owners have this privilege by default.
   rpc DeleteAccess(DeleteAccessRequest) returns (DeleteAccessResponse);
 
   // Delete a resource from this volt.
@@ -2084,11 +2299,11 @@ service VoltAPI {
   rpc GetOneTimeToken(GetOneTimeTokenRequest) returns (GetOneTimeTokenResponse);
 
   // Retrieve the Volt parameters.
-  // This is a privileged API call and requires Volt root access.
+  // This is a privileged API call and requires volt:api-call / volt:get-parameters permission.
   rpc GetParameters(GetParametersRequest) returns (GetParametersResponse);
 
   // Retrieve the active Volt policy.
-  // This is a privileged API call and requires Volt root access.
+  // This is a privileged API call and requires volt:api-call / volt:get-policy permission.
   rpc GetPolicy(GetPolicyRequest) returns (GetPolicyResponse);
 
   // Get resource from this volt.
@@ -2118,15 +2333,18 @@ service VoltAPI {
   rpc RequestAccess(RequestAccessRequest) returns (RequestAccessResponse);
 
   // Create or update an access rule.
+  // This is a privileged API call and requires volt:api-call / volt:save-access permission. Resource owners have this privilege by default.
   rpc SaveAccess(SaveAccessRequest) returns (SaveAccessResponse);
 
   // Create or update a static file HTTP server.
+  // This is a privileged API call and requires volt:api-call / volt:save-http-file-server permission.
   rpc SaveHttpFileServer(SaveHttpFileServerRequest) returns (SaveHttpFileServerResponse);
 
   // Create or update an HTTP forwarder resource.
   rpc SaveHttpForwarder(SaveHttpForwarderRequest) returns (SaveHttpForwarderResponse);
 
   // Create or update an HTTP REST API server.
+  // This is a privileged API call and requires volt:api-call / volt:save-http-rest-api-server permission.
   rpc SaveHttpRestApiServer(SaveHttpRestApiServerRequest) returns (SaveHttpRestApiServerResponse);
 
   // Create or update an HTTP REST API node.
@@ -2139,44 +2357,41 @@ service VoltAPI {
   rpc SaveDatabase(SaveDatabaseRequest) returns (SaveDatabaseResponse);
 
   // Create or update a mirrored link resource.
+  // This is a privileged API call and requires volt:api-call / volt:save-mirrored-link permission.
   rpc SaveMirroredLink(SaveResourceRequest) returns (SaveResourceResponse);
 
-  // Create or update a sync database resource.
-  rpc SaveSyncDatabase(SaveSyncDatabaseRequest) returns (SaveSyncDatabaseResponse);
-
-  // Create or update a synapse resource.
-  rpc SaveSynapse(SaveSynapseRequest) returns (SaveSynapseResponse);
-
-  // Create a synapse connection resource.
-  rpc CreateSynapseConnection(CreateSynapseConnectionRequest) returns (CreateSynapseConnectionResponse);
-
   // Update Volt parameters.
-  // This is a privileged call that requires Volt root access.
+  // This is a privileged API call and requires volt:api-call / volt:save-parameters permission.
   rpc SaveParameters(SaveParametersRequest) returns (SaveParametersResponse);
 
   // Create or update resource in this volt.
   rpc SaveResource(SaveResourceRequest) returns (SaveResourceResponse);
 
   // Create or update a symbolic link resource.
+  // This is a privileged API call and requires volt:api-call / volt:save-symbolic-link permission.ß
   rpc SaveSymbolicLink(SaveResourceRequest) returns (SaveResourceResponse);
 
   // Save a session.
+  // Requires \`volt:session-write\` permission. Authenticated sessions have this privilege by default.
   rpc SaveSession(SaveSessionRequest) returns (SaveSessionResponse);
 
   // Set Volt access request decision.
-  // This is a privileged call that requires Volt root access.
+  // This is a privileged API call and requires volt:api-call / volt:set-access-request-decision permission.
   rpc SetAccessRequestDecision(SetAccessRequestDecisionRequest) returns (SetAccessRequestDecisionResponse);
 
+  // Set Volt policy.
+  // This is a privileged API call and requires volt:api-call / volt:set-policy permission.
   rpc SetPolicy(SetPolicyRequest) returns (SetPolicyResponse);
 
   // Set the status of a Volt service.
   rpc SetServiceStatus(SetServiceStatusRequest) returns (SetServiceStatusResponse);
 
   // Used to shutdown remote Volts.
-  // This is a privileged call that requires Volt root access.
+  // This is a privileged API call and requires volt:api-call / volt:shutdown permission.
   rpc Shutdown(ShutdownRequest) returns (ShutdownResponse);
 
   // Sign or verify an arbitrary message using the Volt key.
+  // For signing using an \`identity_did\` other than the authenticated account, the authenticated session must have \`volt:sign\` permission for the given \`identity_did\`.
   rpc SignVerify(SignVerifyRequest) returns (SignVerifyResponse);
 }
 
@@ -3067,49 +3282,37 @@ message SaveResourceResponse {
 }
 
 message SaveDatabaseRequest {
+  // Details of the database to save.
   Resource resource = 1;
-  bool create = 2;
-  string create_in_parent_id = 3;
-  bool purge_attributes = 4;
-  bool encrypted = 5;
-  bool read_audit = 6;
-  bool write_audit = 7;
-}
 
-message SaveDatabaseResponse {
-  tdx.volt_api.volt.v1.Status status = 1;
-  Resource resource = 2;
-}
-
-message SaveSyncDatabaseRequest {
-  Resource resource = 1;
+  // Set to indicate this is a new database.
   bool create = 2;
-  string create_in_parent_id = 3;
-  bool purge_attributes = 4;
-  bool encrypted = 5;
-  bool read_audit = 6;
-  bool write_audit = 7;
-  bool no_snapshots = 8;
-}
-
-message SaveSyncDatabaseResponse {
-  tdx.volt_api.volt.v1.Status status = 1;
-  Resource resource = 2;
-}
 
-message SaveSynapseRequest {
-  Resource resource = 1;
-  bool create = 2;
+  // The id of the folder resource in which a new database should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  // If the \`resource\` field contains attributes they will be saved after the purge.
+  // If the \`resource\` field does not contain attributes this effectively deletes all attributes for this resource.
+  // This allows you to selectively update attributes if required, i.e. don't set this flag and include a single attribute in the update.
   bool purge_attributes = 4;
+
+  // Set to encrypt the database.
   bool encrypted = 5;
+
+  // Set to audit all SELECT database operations.
   bool read_audit = 6;
+
+  // Set to audit all INSERT, UPDATE, and DELETE database operations.
   bool write_audit = 7;
-  bool no_snapshots = 8;
 }
 
-message SaveSynapseResponse {
+message SaveDatabaseResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated database resource.
   Resource resource = 2;
 }
 
@@ -3181,28 +3384,6 @@ message SaveHttpRestApiNodeResponse {
   Resource resource = 2;
 }
 
-message CreateSynapseConnectionRequest {
-  Resource resource = 1;
-  bool create = 2;
-  string create_in_parent_id = 3;
-  bool purge_attributes = 4;
-  string local_synapse_id = 5;
-  string remote_synapse_id = 6;
-  string remote_volt_identity = 7;
-  string remote_volt_address = 8;
-  string remote_volt_http_address = 9;
-  string remote_volt_ca = 10;
-  string remote_identity = 11;
-  string relay_address = 12;
-  string relay_ca = 13;
-  string relay_challenge = 14;
-}
-
-message CreateSynapseConnectionResponse {
-  tdx.volt_api.volt.v1.Status status = 1;
-  Resource resource = 2;
-}
-
 message SaveSessionRequest {
   Session session = 1;
 }
@@ -3391,4 +3572,4 @@ message SubscribeWireResponse {
 }
 
 `;
-export const voltProtos = [sqlite, sqlite_database_api, sqlite_server_api, proto_db_sync, proxy_api, relay_api, discovery_api, file, file_api, remote, ssi, ssi_api, status, sync_api, terminal_api, volt, volt_api, wire_api];
+export const voltProtos = [sqlite, sqlite_database_api, sqlite_server_api, proto_db_sync, proxy_api, relay_api, discovery_api, drive_api, file, file_api, remote, ssi, ssi_api, status, sync_api, terminal_api, volt, volt_api, wire_api];