@tdxvolt/volt-client-grpc 0.20.20 → 0.20.27

package/lib/index.cjs

@@ -756,11 +756,14 @@ package tdx.volt_api.data.v1;
 import "tdx/volt_api/volt/v1/status.proto";
 import "tdx/volt_api/volt/v1/volt.proto";
 
-// The Sqlite Server API provides database management functions.
-// Use the VoltAPI DeleteResource function to delete a database.
+// The Sqlite Server API provides database and view management functions.
+// Use the VoltAPI DeleteResource function to delete a database or data view.
 service SqliteServerAPI {
   // Create a new database resource.
   rpc CreateDatabase(CreateDatabaseRequest) returns (CreateDatabaseResponse);
+
+  // Create or update a data view resource.
+  rpc SaveDataView(SaveDataViewRequest) returns (SaveDataViewResponse);
 }
 
 message CreateDatabaseRequest {
@@ -799,6 +802,55 @@ message CreateDatabaseResponse {
   tdx.volt_api.volt.v1.Resource resource = 2;
 }
 
+message DataViewParameter {
+  // The parameter name referenced in the SQL template.
+  string name = 1;
+
+  // The parameter data type.
+  tdx.volt_api.volt.v1.AttributeDataType data_type = 2;
+
+  // Optional default value for the parameter.
+  tdx.volt_api.volt.v1.AttributeValue default_value = 3;
+
+  // Set when default_value should be applied.
+  bool include_default_value = 4;
+}
+
+message SaveDataViewRequest {
+  // Details of the data view to save.
+  tdx.volt_api.volt.v1.Resource resource = 1;
+
+  // Set to indicate this is a new data view.
+  bool create = 2;
+
+  // The id of the folder resource in which a new data view should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  bool purge_attributes = 4;
+
+  // The id of the source database on which this view is based.
+  // The authenticated account must have the relevant access to the source database, for example to create a 'SELECT' view the account must have 'volt:database-read' access to the source database. To create an 'INSERT' view the account must have 'volt:database-write' access to the source database.
+  string source_database_id = 5;
+
+  // The SQL template for the view.
+  string sql = 6;
+
+  // Set to allow sub-selects in the view SQL.
+  bool allow_sub_select = 7;
+
+  // Parameters defined for the view SQL template.
+  repeated DataViewParameter parameter = 8;
+}
+
+message SaveDataViewResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The saved data view resource.
+  tdx.volt_api.volt.v1.Resource resource = 2;
+}
 `;
 const proto_db_sync = `syntax = "proto3";
 
@@ -1570,6 +1622,13 @@ message ResolveDIDRequest {
 
   // Set to search all known registries rather than just the local registry.
   bool include_registries = 2;
+
+  // Per-DID document version. 0 = latest; 1..N = ordinal in the op log.
+  uint64 version = 3;
+
+  // Milliseconds since epoch. Resolves the document active at that time.
+  // Mutually exclusive with version.
+  uint64 at_timestamp = 4;
 }
 
 message ResolveDIDResponse {
@@ -1708,6 +1767,18 @@ service SyncAPI {
 
   // Write a single value to a given synapse JSON path.
   rpc WriteSynapsePath(WriteSynapsePathRequest) returns (WriteSynapsePathResponse);
+
+  // List stored versions of a document in a sync database.
+  rpc ListSyncDocumentVersions(ListSyncDocumentVersionsRequest) returns (ListSyncDocumentVersionsResponse);
+
+  // Get a stored version of a document in a sync database.
+  rpc GetSyncDocumentVersion(GetSyncDocumentVersionRequest) returns (GetSyncDocumentVersionResponse);
+
+  // Create a version checkpoint for a document in a sync database.
+  rpc CreateSyncDocumentVersion(CreateSyncDocumentVersionRequest) returns (CreateSyncDocumentVersionResponse);
+
+  // Revert a document in a sync database to a stored version.
+  rpc RevertSyncDocumentVersion(RevertSyncDocumentVersionRequest) returns (RevertSyncDocumentVersionResponse);
 }
 
 message CreateSynapseConnectionRequest {
@@ -1821,8 +1892,8 @@ message SaveSyncDatabaseRequest {
   // Set to audit all INSERT, UPDATE, and DELETE database operations.
   bool write_audit = 7;
 
-  // By default, yjs updates are periodically compressed and stored as snapshots. Set this flag to disable snapshots. This will reduce the size of the database and improve performance, but will also reduce the ability to rollback to a previous state.
-  bool no_snapshots = 8;
+  // By default, yjs updates are periodically compacted. Set this flag to disable compaction. This will reduce the size of the database but will remove the ability to version the documents in the database.
+  bool no_compaction = 8;
 
   // The number of updates to batch before flushing to the database. Defaults to 100.
   uint32 batch_size = 9;
@@ -1859,8 +1930,8 @@ message SaveSynapseRequest {
   // Set to audit all INSERT, UPDATE, and DELETE synapse operations.
   bool write_audit = 7;
 
-  // By default, yjs updates are periodically compressed and stored as snapshots. Set this flag to disable snapshots. This will reduce the size of the synapse and improve performance, but will also reduce the ability to rollback to a previous state.
-  bool no_snapshots = 8;
+  // By default, yjs updates are periodically compacted. Set this flag to disable compaction. This will reduce the size of the database but will remove the ability to version the documents in the database.
+  bool no_compaction = 8;
 }
 
 message SaveSynapseResponse {
@@ -1897,6 +1968,14 @@ message SetSynapseDocumentMetadataRequest {
 
   // Any additional application-specific JSON to attach to the document.
   string json = 4;
+
+  // Set to true when the caller intends to write the document's content
+  // separately, after this metadata call (a metadata-first create). The sync
+  // server uses this to defer __hash bootstrapping until the content actually
+  // arrives, so the hash is not computed over an empty document. Leave false
+  // (the default) for empty documents or content-first flows where the content
+  // is already present.
+  bool content_pending = 6;
 }
 
 message SetSynapseDocumentMetadataResponse {
@@ -2052,6 +2131,83 @@ message WriteSynapsePathResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 }
 
+message SyncDocumentVersionSummary {
+  // Globally unique version identifier (UUID).
+  string version_id = 1;
+
+  // Milliseconds since Unix epoch when the version was created.
+  uint64 timestamp = 2;
+
+  // Identity that created the version.
+  string identity = 3;
+
+  // Optional user-provided label.
+  string label = 4;
+
+  // Document hash (__hash) at the time of the version, when available.
+  string document_hash = 5;
+}
+
+message ListSyncDocumentVersionsRequest {
+  // The id of the sync database that contains the document.
+  string database_id = 1;
+
+  // The id of the document.
+  string document_id = 2;
+
+  // Maximum number of versions to return. Defaults to 50.
+  uint32 limit = 3;
+
+  // Number of versions to skip from the newest end.
+  uint32 offset = 4;
+}
+
+message ListSyncDocumentVersionsResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  repeated SyncDocumentVersionSummary versions = 2;
+}
+
+message GetSyncDocumentVersionRequest {
+  string database_id = 1;
+  string document_id = 2;
+  string version_id = 3;
+}
+
+message GetSyncDocumentVersionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  SyncDocumentVersionSummary info = 2;
+
+  // Full Yjs v2 document state at this version. Clients materialize locally.
+  bytes state_update = 3;
+}
+
+message CreateSyncDocumentVersionRequest {
+  string database_id = 1;
+  string document_id = 2;
+  string label = 3;
+}
+
+message CreateSyncDocumentVersionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  string version_id = 2;
+}
+
+message RevertSyncDocumentVersionRequest {
+  string database_id = 1;
+  string document_id = 2;
+  string version_id = 3;
+
+  // Optional label for the audit version created after revert.
+  string label = 4;
+}
+
+message RevertSyncDocumentVersionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // Version id of the audit checkpoint created after revert.
+  string version_id = 2;
+}
+
 `;
 const terminal_api = `syntax = "proto3";
 
@@ -2061,6 +2217,7 @@ import "tdx/volt_api/volt/v1/status.proto";
 
 service TerminalAPI {
   // Bidirectional streaming RPC for real-time terminal control and data exchange.
+  // Note that \`volt:command-invoke\` access is required to invoke this API. An optional allow-list of comma-separated commands can be specified in the \`extra\` string of the access policy.
   rpc CommandStream(stream CommandStreamRequest) returns (stream CommandStreamResponse);
 }
 
@@ -2237,6 +2394,15 @@ enum SecureMode {
   SECURE_MODE_TLS = 2;
 }
 
+// Per-method gRPC rate limit (unary: each RPC; client/bidi streams: first client message only).
+message GrpcRpcRateLimit {
+  // Full gRPC method path, e.g. "/tdx.volt_api.volt.v1.VoltAPI/SendEmail"
+  string method_full_name = 1;
+
+  // Maximum requests allowed per rolling 60-second window per identity. Zero disables this rule.
+  uint32 max_requests_per_minute = 2;
+}
+
 // Encapsulates the various Volt parameters that are configurable by the Volt owner.
 message VoltParameters {
   string id = 1;
@@ -2412,6 +2578,9 @@ message VoltParameters {
   // Number of gRPC event processing threads.
   // If unset or zero, the server default thread count is used.
   uint32 grpc_num_event_threads = 56;
+
+  // Optional per-method gRPC rate limits (see GrpcRpcRateLimit). Keyed by peer identity or fingerprint.
+  repeated GrpcRpcRateLimit grpc_rpc_rate_limit = 57;
 }
 
 message VoltEndpoint {
@@ -2704,7 +2873,18 @@ message Access {
   // Requested access.
   string access = 10;
 
-  // Optional extra data.
+  // Optional extra data that further constrains the access being granted. How this string is interpreted depends on the value of \`access\` above:
+  //
+  //  - \`volt:api-call\`: a single API method name. The access only applies when the invoked API method matches this value (policy attribute \`volt:action-api-call\`). Leave empty to allow all API methods.
+  //
+  //  - \`volt:command-invoke\` (CommandStream API): a comma-separated allow-list of commands. The access is permitted (or denied depending on the rule decision) when the invoked command matches any entry in the list (policy attribute \`volt:action-command\`). A trailing \`*\` acts as a prefix wildcard (e.g. \`/usr/bin/*\` allows any command beginning with \`/usr/bin/\`). Leave empty to allow all commands.
+  //    Example: "ls,git,/usr/bin/python3"
+  //
+  //  - Otherwise: a comma-separated list of \`[attributeId]|[value]\` pairs, each matched against the named resource attribute (trailing \`*\` acts as a prefix wildcard). The sync-database case below is a specialisation of this general form.
+  //
+  //  - Sync databases (\`volt:sync-database\` resources, e.g. with \`volt:database-read\` / \`volt:database-write\` access): a comma-separated list of \`[attributeId]|[value]\` pairs restricting the access to specific documents. Document ids use the \`volt:resource-sync-document-id\` attribute id, so each entry has the form \`volt:resource-sync-document-id|[documentId]\`. A trailing \`*\` on the value acts as a prefix wildcard. Leave empty to target all documents in the database.
+  //    Example: "volt:resource-sync-document-id|doc-123,volt:resource-sync-document-id|report-*"
+  //
   string extra = 11;
 
   // Assigned decision.
@@ -2802,6 +2982,27 @@ message Session {
 
   SessionStatus status = 10;
 }
+
+message Email {
+  // The email address to send to.
+  repeated string to = 1;
+
+  // The email address to send cc to.
+  repeated string cc = 2;
+
+  // The email address to send bcc to.
+  repeated string bcc = 3;
+
+  // The subject of the email.
+  string subject = 4;
+
+  // The body of the email.
+  string body = 5;
+
+  // The email address to send from.
+  string from = 6;
+}
+
 `;
 const volt_api = `syntax = "proto3";
 
@@ -2858,8 +3059,9 @@ service VoltAPI {
   rpc DiscoverServices(DiscoverServicesRequest) returns (DiscoverServicesResponse);
 
   // Get access rule details.
-  // Only rules in which the authenticated identity participates will be retrieved, in addition to any rules that target a resource that is owned by the authenticated identity.
   // If the authenticated identity is the Volt root, all rules will be retrieved that match the criteria.
+  // All rules for which the authenticated account has volt:api-call / volt:get-access permission to the rule resource will be retrieved.
+  // Otherwise, only rules in which the authenticated identity participates will be retrieved, in addition to any rules that target a resource that is owned by the authenticated identity.
   rpc GetAccess(GetAccessRequest) returns (GetAccessResponse);
 
   // Retrieve identities matching the given criteria.
@@ -2916,8 +3118,14 @@ service VoltAPI {
   rpc SaveHttpFileServer(SaveHttpFileServerRequest) returns (SaveHttpFileServerResponse);
 
   // Create or update an HTTP forwarder resource.
+  // This is a privileged API call and requires volt:api-call / volt:save-http-forwarder permission.
   rpc SaveHttpForwarder(SaveHttpForwarderRequest) returns (SaveHttpForwarderResponse);
 
+  // Create or update an OAuth/OIDC client registration (used when this Volt
+  // acts as an OpenID Provider). Clients are stored as \`volt:oidc-client\`
+  // resources.
+  rpc SaveOidcClient(SaveOidcClientRequest) returns (SaveOidcClientResponse);
+
   // Create or update an HTTP REST API server.
   // This is a privileged API call and requires volt:api-call / volt:save-http-rest-api-server permission.
   rpc SaveHttpRestApiServer(SaveHttpRestApiServerRequest) returns (SaveHttpRestApiServerResponse);
@@ -2950,6 +3158,10 @@ service VoltAPI {
   // Requires \`volt:session-write\` permission. Authenticated sessions have this privilege by default.
   rpc SaveSession(SaveSessionRequest) returns (SaveSessionResponse);
 
+  // Send an email.
+  // This is a privileged API call and requires volt:api-call / volt:send-email permission.
+  rpc SendEmail(SendEmailRequest) returns (SendEmailResponse);
+
   // Set Volt access request decision.
   // This is a privileged API call and requires volt:api-call / volt:set-access-request-decision permission.
   rpc SetAccessRequestDecision(SetAccessRequestDecisionRequest) returns (SetAccessRequestDecisionResponse);
@@ -3065,6 +3277,10 @@ message CanAccessResourceRequest {
 
   // The type of access that is required.
   string access = 4;
+
+  // Optional additional information about the access request.
+  // For volt:api-call, the extra data is the API method lookup, e.g. volt:get-access.
+  string extra = 5;
 }
 
 message CanAccessResourceResponse {
@@ -3900,6 +4116,51 @@ message SaveHttpForwarderRequest {
   string host = 6;
   int32 port = 7;
   bool forward_host = 8;
+
+  // Optional path prefix (e.g. "/myapp") for path-based forwarding. May be used
+  // on its own (path forwarding on the Volt's own host) or together with
+  // \`domain\` (sub-domain + path, e.g. sub.acme.com/myapp). At least one of
+  // \`domain\` or \`path\` must be set.
+  string path = 9;
+
+  // When a \`path\` prefix is configured, controls whether that prefix is removed
+  // from the request path before forwarding (standard reverse-proxy behaviour).
+  // Defaults to true when unset: the target then receives the request at its
+  // own root (e.g. "/drive/assets/x.js" -> "/assets/x.js"), which suits plain
+  // static file servers and root-mounted backends. Set to false for targets
+  // that are themselves configured under the same sub-path and expect to
+  // receive the prefix. The \`X-Forwarded-Prefix\` header is always sent.
+  optional bool strip_path = 10;
+
+  // When true, incoming requests to this forwarder must carry a valid
+  // authenticated session (established via the OIDC sign-in flow) and pass the
+  // policy check before being proxied to the target. Unauthenticated requests
+  // are redirected to the configured OpenID Provider. The session is never
+  // exposed to the target (the session cookie is stripped before forwarding).
+  bool auth_enabled = 11;
+
+  // OpenID Provider issuer URL used for discovery
+  // (\`<issuer>/.well-known/openid-configuration\`). May be a Volt acting as an
+  // OpenID Provider, or any external OIDC provider. Required when
+  // \`auth_enabled\` is set.
+  string oidc_issuer = 12;
+
+  // OAuth 2.0 client identifier registered with the OpenID Provider.
+  string oidc_client_id = 13;
+
+  // OAuth 2.0 client secret. Stored encrypted and redacted on read.
+  string oidc_client_secret = 14;
+
+  // Space separated OAuth scopes. Defaults to "openid email" when empty.
+  string oidc_scopes = 15;
+
+  // Optional override for the reserved callback path on the app host. Defaults
+  // to "/__volt-auth/oidc/callback".
+  string oidc_redirect_path = 16;
+
+  // Email verification mode for OIDC-gated sign-in when the OpenID Provider is
+  // a Volt: "link" (default) or "code".
+  string email_verification_mode = 17;
 }
 
 message SaveHttpForwarderResponse {
@@ -3907,6 +4168,33 @@ message SaveHttpForwarderResponse {
   Resource resource = 2;
 }
 
+message SaveOidcClientRequest {
+  Resource resource = 1;
+  bool create = 2;
+  string create_in_parent_id = 3;
+  bool purge_attributes = 4;
+
+  // Human-friendly name for the client (also used as resource name when the
+  // resource name is empty).
+  string client_name = 5;
+
+  // OAuth 2.0 client_id. Required.
+  string client_id = 6;
+
+  // OAuth 2.0 client_secret. Stored encrypted and redacted on read. Only
+  // (re)written when non-empty so updates can omit it to keep the existing
+  // secret.
+  string client_secret = 7;
+
+  // Comma- or space-separated list of allowed redirect URIs.
+  string redirect_uris = 8;
+}
+
+message SaveOidcClientResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  Resource resource = 2;
+}
+
 message SaveHttpFileServerRequest {
   Resource resource = 1;
   bool create = 2;
@@ -3919,6 +4207,7 @@ message SaveHttpFileServerRequest {
   int32 cache_timeout = 9;
   bool catch_all_enabled = 10;
   string catch_all = 11;
+  bool dynamic_index_enabled = 12;
 }
 
 message SaveHttpFileServerResponse {
@@ -3935,6 +4224,11 @@ message SaveHttpRestApiServerRequest {
   int32 port = 6;
   bool enabled = 7;
   bool cors_enabled = 8;
+  bool is_literal = 9;
+  string literal_json = 10;
+  string database_id = 11;
+  string sql = 12;
+  repeated string parameter = 13;
 }
 
 message SaveHttpRestApiServerResponse {
@@ -3970,6 +4264,29 @@ message SaveSessionResponse {
   Session session = 2;
 }
 
+message SendEmailRequest {
+  // The email to send.
+  Email email = 1;
+}
+
+message SendEmailResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message SetAccessRequestDecisionRequest {
+  // The id of the access request.
+  string id = 1;
+
+  // The decision to save against the access request.
+  PolicyDecision decision = 2;
+}
+
+message SetAccessRequestDecisionResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
 message SetPolicyRequest {
   // The id of the policy to set.
   // Should be either 00000000-0000-0000-0000-000000000000 or 00000000-0000-0000-0000-000000000001 for the first or last custom policy respectively.
@@ -3997,19 +4314,6 @@ message SetServiceStatusResponse {
   Resource resource = 2;
 }
 
-message SetAccessRequestDecisionRequest {
-  // The id of the access request.
-  string id = 1;
-
-  // The decision to save against the access request.
-  PolicyDecision decision = 2;
-}
-
-message SetAccessRequestDecisionResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
 // This message is emtpy.
 message ShutdownRequest {
 }
@@ -5762,7 +6066,10 @@ class VoltCredential {
       if (!this._voltPublicKey) {
         // Extract the public key from the Volt CA cert.
         const voltCA = new crypto__default["default"].X509Certificate(this._voltConfig.ca_pem);
-        this._voltPublicKey = voltCA.publicKey.export({ type: 'spki', format: 'pem' });
+        this._voltPublicKey = voltCA.publicKey.export({
+          type: "spki",
+          format: "pem"
+        });
       }
 
       const voltKey = keyFromPem(this._voltPublicKey).publicKey;
@@ -5874,7 +6181,7 @@ class VoltCredential {
   }
 
   saveCache() {
-    this._config = {...this._config, credential: { ...this._cryptoCache } };
+    this._config.credential = {...this._cryptoCache};
     const clone = { ...this._config };
     if (this._config.p) {
       // A passphrase option exists => encrypt the key before writing the cache file.
@@ -6348,6 +6655,10 @@ class VoltClient extends EventEmitter__default["default"] {
     return unaryCallInternal.call(this, "SaveSession", request);
   }
 
+  SendEmail(request) {
+    return unaryCallInternal.call(this, "SendEmail", request);
+  }
+
   SetAccessRequestDecision(request) {
     return unaryCallInternal.call(this, "SetAccessRequestDecision", request);
   }
@@ -6468,6 +6779,10 @@ class VoltClient extends EventEmitter__default["default"] {
     return unaryCallInternal.call(this, "CreateDatabase", request);
   }
 
+  SaveDataView(request) {
+    return unaryCallInternal.call(this, "SaveDataView", request);
+  }
+
   /**
    * SqliteDatabaseAPI
    */
@@ -6577,6 +6892,10 @@ class VoltClient extends EventEmitter__default["default"] {
     return publishCall.start(grpcClient, request);
   }
 
+  SaveWire(request) {
+    return unaryCallInternal.call(this, "SaveWire", request);
+  }
+
   SubscribeWire(request) {
     const grpcClient = this.getVoltAPIClient();
 

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.20.20",
+  "version": "0.20.27",
   "description": "tdx Volt library for nodejs clients",
   "type": "module",
   "exports": {
@@ -33,8 +33,8 @@
   "author": "toby.ealden@gmail.com",
   "license": "ISC",
   "dependencies": {
-    "@tdxvolt/volt-client-web": "^0.20.20",
-    "@tdxvolt/volt-utility": "^0.20.18",
+    "@tdxvolt/volt-client-web": "^0.20.27",
+    "@tdxvolt/volt-utility": "^0.20.27",
     "debug": "^4.1.1",
     "ip": "^1.1.5",
     "jsonwebtoken": "^8.5.1",

package/src/volt-client.js

@@ -471,6 +471,10 @@ export class VoltClient extends EventEmitter {
     return unaryCallInternal.call(this, "SaveSession", request);
   }
 
+  SendEmail(request) {
+    return unaryCallInternal.call(this, "SendEmail", request);
+  }
+
   SetAccessRequestDecision(request) {
     return unaryCallInternal.call(this, "SetAccessRequestDecision", request);
   }
@@ -593,6 +597,10 @@ export class VoltClient extends EventEmitter {
     return unaryCallInternal.call(this, "CreateDatabase", request);
   }
 
+  SaveDataView(request) {
+    return unaryCallInternal.call(this, "SaveDataView", request);
+  }
+
   /**
    * SqliteDatabaseAPI
    */
@@ -702,6 +710,10 @@ export class VoltClient extends EventEmitter {
     return publishCall.start(grpcClient, request);
   }
 
+  SaveWire(request) {
+    return unaryCallInternal.call(this, "SaveWire", request);
+  }
+
   SubscribeWire(request) {
     const grpcClient = this.getVoltAPIClient();
 

package/src/volt-credential.js

@@ -58,7 +58,10 @@ export class VoltCredential {
       if (!this._voltPublicKey) {
         // Extract the public key from the Volt CA cert.
         const voltCA = new crypto.X509Certificate(this._voltConfig.ca_pem);
-        this._voltPublicKey = voltCA.publicKey.export({ type: 'spki', format: 'pem' });
+        this._voltPublicKey = voltCA.publicKey.export({
+          type: "spki",
+          format: "pem"
+        });
       }
 
       const voltKey = keyFromPem(this._voltPublicKey).publicKey;
@@ -170,7 +173,7 @@ export class VoltCredential {
   }
 
   saveCache() {
-    this._config = {...this._config, credential: { ...this._cryptoCache } };
+    this._config.credential = {...this._cryptoCache};
     const clone = { ...this._config };
     if (this._config.p) {
       // A passphrase option exists => encrypt the key before writing the cache file.

package/src/volt-proto-literals.js

@@ -208,11 +208,14 @@ package tdx.volt_api.data.v1;
 import "tdx/volt_api/volt/v1/status.proto";
 import "tdx/volt_api/volt/v1/volt.proto";
 
-// The Sqlite Server API provides database management functions.
-// Use the VoltAPI DeleteResource function to delete a database.
+// The Sqlite Server API provides database and view management functions.
+// Use the VoltAPI DeleteResource function to delete a database or data view.
 service SqliteServerAPI {
   // Create a new database resource.
   rpc CreateDatabase(CreateDatabaseRequest) returns (CreateDatabaseResponse);
+
+  // Create or update a data view resource.
+  rpc SaveDataView(SaveDataViewRequest) returns (SaveDataViewResponse);
 }
 
 message CreateDatabaseRequest {
@@ -251,6 +254,55 @@ message CreateDatabaseResponse {
   tdx.volt_api.volt.v1.Resource resource = 2;
 }
 
+message DataViewParameter {
+  // The parameter name referenced in the SQL template.
+  string name = 1;
+
+  // The parameter data type.
+  tdx.volt_api.volt.v1.AttributeDataType data_type = 2;
+
+  // Optional default value for the parameter.
+  tdx.volt_api.volt.v1.AttributeValue default_value = 3;
+
+  // Set when default_value should be applied.
+  bool include_default_value = 4;
+}
+
+message SaveDataViewRequest {
+  // Details of the data view to save.
+  tdx.volt_api.volt.v1.Resource resource = 1;
+
+  // Set to indicate this is a new data view.
+  bool create = 2;
+
+  // The id of the folder resource in which a new data view should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  bool purge_attributes = 4;
+
+  // The id of the source database on which this view is based.
+  // The authenticated account must have the relevant access to the source database, for example to create a 'SELECT' view the account must have 'volt:database-read' access to the source database. To create an 'INSERT' view the account must have 'volt:database-write' access to the source database.
+  string source_database_id = 5;
+
+  // The SQL template for the view.
+  string sql = 6;
+
+  // Set to allow sub-selects in the view SQL.
+  bool allow_sub_select = 7;
+
+  // Parameters defined for the view SQL template.
+  repeated DataViewParameter parameter = 8;
+}
+
+message SaveDataViewResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The saved data view resource.
+  tdx.volt_api.volt.v1.Resource resource = 2;
+}
 `;
 export const proto_db_sync = `syntax = "proto3";
 
@@ -1022,6 +1074,13 @@ message ResolveDIDRequest {
 
   // Set to search all known registries rather than just the local registry.
   bool include_registries = 2;
+
+  // Per-DID document version. 0 = latest; 1..N = ordinal in the op log.
+  uint64 version = 3;
+
+  // Milliseconds since epoch. Resolves the document active at that time.
+  // Mutually exclusive with version.
+  uint64 at_timestamp = 4;
 }
 
 message ResolveDIDResponse {
@@ -1160,6 +1219,18 @@ service SyncAPI {
 
   // Write a single value to a given synapse JSON path.
   rpc WriteSynapsePath(WriteSynapsePathRequest) returns (WriteSynapsePathResponse);
+
+  // List stored versions of a document in a sync database.
+  rpc ListSyncDocumentVersions(ListSyncDocumentVersionsRequest) returns (ListSyncDocumentVersionsResponse);
+
+  // Get a stored version of a document in a sync database.
+  rpc GetSyncDocumentVersion(GetSyncDocumentVersionRequest) returns (GetSyncDocumentVersionResponse);
+
+  // Create a version checkpoint for a document in a sync database.
+  rpc CreateSyncDocumentVersion(CreateSyncDocumentVersionRequest) returns (CreateSyncDocumentVersionResponse);
+
+  // Revert a document in a sync database to a stored version.
+  rpc RevertSyncDocumentVersion(RevertSyncDocumentVersionRequest) returns (RevertSyncDocumentVersionResponse);
 }
 
 message CreateSynapseConnectionRequest {
@@ -1273,8 +1344,8 @@ message SaveSyncDatabaseRequest {
   // Set to audit all INSERT, UPDATE, and DELETE database operations.
   bool write_audit = 7;
 
-  // By default, yjs updates are periodically compressed and stored as snapshots. Set this flag to disable snapshots. This will reduce the size of the database and improve performance, but will also reduce the ability to rollback to a previous state.
-  bool no_snapshots = 8;
+  // By default, yjs updates are periodically compacted. Set this flag to disable compaction. This will reduce the size of the database but will remove the ability to version the documents in the database.
+  bool no_compaction = 8;
 
   // The number of updates to batch before flushing to the database. Defaults to 100.
   uint32 batch_size = 9;
@@ -1311,8 +1382,8 @@ message SaveSynapseRequest {
   // Set to audit all INSERT, UPDATE, and DELETE synapse operations.
   bool write_audit = 7;
 
-  // By default, yjs updates are periodically compressed and stored as snapshots. Set this flag to disable snapshots. This will reduce the size of the synapse and improve performance, but will also reduce the ability to rollback to a previous state.
-  bool no_snapshots = 8;
+  // By default, yjs updates are periodically compacted. Set this flag to disable compaction. This will reduce the size of the database but will remove the ability to version the documents in the database.
+  bool no_compaction = 8;
 }
 
 message SaveSynapseResponse {
@@ -1349,6 +1420,14 @@ message SetSynapseDocumentMetadataRequest {
 
   // Any additional application-specific JSON to attach to the document.
   string json = 4;
+
+  // Set to true when the caller intends to write the document's content
+  // separately, after this metadata call (a metadata-first create). The sync
+  // server uses this to defer __hash bootstrapping until the content actually
+  // arrives, so the hash is not computed over an empty document. Leave false
+  // (the default) for empty documents or content-first flows where the content
+  // is already present.
+  bool content_pending = 6;
 }
 
 message SetSynapseDocumentMetadataResponse {
@@ -1504,6 +1583,83 @@ message WriteSynapsePathResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 }
 
+message SyncDocumentVersionSummary {
+  // Globally unique version identifier (UUID).
+  string version_id = 1;
+
+  // Milliseconds since Unix epoch when the version was created.
+  uint64 timestamp = 2;
+
+  // Identity that created the version.
+  string identity = 3;
+
+  // Optional user-provided label.
+  string label = 4;
+
+  // Document hash (__hash) at the time of the version, when available.
+  string document_hash = 5;
+}
+
+message ListSyncDocumentVersionsRequest {
+  // The id of the sync database that contains the document.
+  string database_id = 1;
+
+  // The id of the document.
+  string document_id = 2;
+
+  // Maximum number of versions to return. Defaults to 50.
+  uint32 limit = 3;
+
+  // Number of versions to skip from the newest end.
+  uint32 offset = 4;
+}
+
+message ListSyncDocumentVersionsResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  repeated SyncDocumentVersionSummary versions = 2;
+}
+
+message GetSyncDocumentVersionRequest {
+  string database_id = 1;
+  string document_id = 2;
+  string version_id = 3;
+}
+
+message GetSyncDocumentVersionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  SyncDocumentVersionSummary info = 2;
+
+  // Full Yjs v2 document state at this version. Clients materialize locally.
+  bytes state_update = 3;
+}
+
+message CreateSyncDocumentVersionRequest {
+  string database_id = 1;
+  string document_id = 2;
+  string label = 3;
+}
+
+message CreateSyncDocumentVersionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  string version_id = 2;
+}
+
+message RevertSyncDocumentVersionRequest {
+  string database_id = 1;
+  string document_id = 2;
+  string version_id = 3;
+
+  // Optional label for the audit version created after revert.
+  string label = 4;
+}
+
+message RevertSyncDocumentVersionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // Version id of the audit checkpoint created after revert.
+  string version_id = 2;
+}
+
 `;
 export const terminal_api = `syntax = "proto3";
 
@@ -1513,6 +1669,7 @@ import "tdx/volt_api/volt/v1/status.proto";
 
 service TerminalAPI {
   // Bidirectional streaming RPC for real-time terminal control and data exchange.
+  // Note that \`volt:command-invoke\` access is required to invoke this API. An optional allow-list of comma-separated commands can be specified in the \`extra\` string of the access policy.
   rpc CommandStream(stream CommandStreamRequest) returns (stream CommandStreamResponse);
 }
 
@@ -1689,6 +1846,15 @@ enum SecureMode {
   SECURE_MODE_TLS = 2;
 }
 
+// Per-method gRPC rate limit (unary: each RPC; client/bidi streams: first client message only).
+message GrpcRpcRateLimit {
+  // Full gRPC method path, e.g. "/tdx.volt_api.volt.v1.VoltAPI/SendEmail"
+  string method_full_name = 1;
+
+  // Maximum requests allowed per rolling 60-second window per identity. Zero disables this rule.
+  uint32 max_requests_per_minute = 2;
+}
+
 // Encapsulates the various Volt parameters that are configurable by the Volt owner.
 message VoltParameters {
   string id = 1;
@@ -1864,6 +2030,9 @@ message VoltParameters {
   // Number of gRPC event processing threads.
   // If unset or zero, the server default thread count is used.
   uint32 grpc_num_event_threads = 56;
+
+  // Optional per-method gRPC rate limits (see GrpcRpcRateLimit). Keyed by peer identity or fingerprint.
+  repeated GrpcRpcRateLimit grpc_rpc_rate_limit = 57;
 }
 
 message VoltEndpoint {
@@ -2156,7 +2325,18 @@ message Access {
   // Requested access.
   string access = 10;
 
-  // Optional extra data.
+  // Optional extra data that further constrains the access being granted. How this string is interpreted depends on the value of \`access\` above:
+  //
+  //  - \`volt:api-call\`: a single API method name. The access only applies when the invoked API method matches this value (policy attribute \`volt:action-api-call\`). Leave empty to allow all API methods.
+  //
+  //  - \`volt:command-invoke\` (CommandStream API): a comma-separated allow-list of commands. The access is permitted (or denied depending on the rule decision) when the invoked command matches any entry in the list (policy attribute \`volt:action-command\`). A trailing \`*\` acts as a prefix wildcard (e.g. \`/usr/bin/*\` allows any command beginning with \`/usr/bin/\`). Leave empty to allow all commands.
+  //    Example: "ls,git,/usr/bin/python3"
+  //
+  //  - Otherwise: a comma-separated list of \`[attributeId]|[value]\` pairs, each matched against the named resource attribute (trailing \`*\` acts as a prefix wildcard). The sync-database case below is a specialisation of this general form.
+  //
+  //  - Sync databases (\`volt:sync-database\` resources, e.g. with \`volt:database-read\` / \`volt:database-write\` access): a comma-separated list of \`[attributeId]|[value]\` pairs restricting the access to specific documents. Document ids use the \`volt:resource-sync-document-id\` attribute id, so each entry has the form \`volt:resource-sync-document-id|[documentId]\`. A trailing \`*\` on the value acts as a prefix wildcard. Leave empty to target all documents in the database.
+  //    Example: "volt:resource-sync-document-id|doc-123,volt:resource-sync-document-id|report-*"
+  //
   string extra = 11;
 
   // Assigned decision.
@@ -2254,6 +2434,27 @@ message Session {
 
   SessionStatus status = 10;
 }
+
+message Email {
+  // The email address to send to.
+  repeated string to = 1;
+
+  // The email address to send cc to.
+  repeated string cc = 2;
+
+  // The email address to send bcc to.
+  repeated string bcc = 3;
+
+  // The subject of the email.
+  string subject = 4;
+
+  // The body of the email.
+  string body = 5;
+
+  // The email address to send from.
+  string from = 6;
+}
+
 `;
 export const volt_api = `syntax = "proto3";
 
@@ -2310,8 +2511,9 @@ service VoltAPI {
   rpc DiscoverServices(DiscoverServicesRequest) returns (DiscoverServicesResponse);
 
   // Get access rule details.
-  // Only rules in which the authenticated identity participates will be retrieved, in addition to any rules that target a resource that is owned by the authenticated identity.
   // If the authenticated identity is the Volt root, all rules will be retrieved that match the criteria.
+  // All rules for which the authenticated account has volt:api-call / volt:get-access permission to the rule resource will be retrieved.
+  // Otherwise, only rules in which the authenticated identity participates will be retrieved, in addition to any rules that target a resource that is owned by the authenticated identity.
   rpc GetAccess(GetAccessRequest) returns (GetAccessResponse);
 
   // Retrieve identities matching the given criteria.
@@ -2368,8 +2570,14 @@ service VoltAPI {
   rpc SaveHttpFileServer(SaveHttpFileServerRequest) returns (SaveHttpFileServerResponse);
 
   // Create or update an HTTP forwarder resource.
+  // This is a privileged API call and requires volt:api-call / volt:save-http-forwarder permission.
   rpc SaveHttpForwarder(SaveHttpForwarderRequest) returns (SaveHttpForwarderResponse);
 
+  // Create or update an OAuth/OIDC client registration (used when this Volt
+  // acts as an OpenID Provider). Clients are stored as \`volt:oidc-client\`
+  // resources.
+  rpc SaveOidcClient(SaveOidcClientRequest) returns (SaveOidcClientResponse);
+
   // Create or update an HTTP REST API server.
   // This is a privileged API call and requires volt:api-call / volt:save-http-rest-api-server permission.
   rpc SaveHttpRestApiServer(SaveHttpRestApiServerRequest) returns (SaveHttpRestApiServerResponse);
@@ -2402,6 +2610,10 @@ service VoltAPI {
   // Requires \`volt:session-write\` permission. Authenticated sessions have this privilege by default.
   rpc SaveSession(SaveSessionRequest) returns (SaveSessionResponse);
 
+  // Send an email.
+  // This is a privileged API call and requires volt:api-call / volt:send-email permission.
+  rpc SendEmail(SendEmailRequest) returns (SendEmailResponse);
+
   // Set Volt access request decision.
   // This is a privileged API call and requires volt:api-call / volt:set-access-request-decision permission.
   rpc SetAccessRequestDecision(SetAccessRequestDecisionRequest) returns (SetAccessRequestDecisionResponse);
@@ -2517,6 +2729,10 @@ message CanAccessResourceRequest {
 
   // The type of access that is required.
   string access = 4;
+
+  // Optional additional information about the access request.
+  // For volt:api-call, the extra data is the API method lookup, e.g. volt:get-access.
+  string extra = 5;
 }
 
 message CanAccessResourceResponse {
@@ -3352,6 +3568,51 @@ message SaveHttpForwarderRequest {
   string host = 6;
   int32 port = 7;
   bool forward_host = 8;
+
+  // Optional path prefix (e.g. "/myapp") for path-based forwarding. May be used
+  // on its own (path forwarding on the Volt's own host) or together with
+  // \`domain\` (sub-domain + path, e.g. sub.acme.com/myapp). At least one of
+  // \`domain\` or \`path\` must be set.
+  string path = 9;
+
+  // When a \`path\` prefix is configured, controls whether that prefix is removed
+  // from the request path before forwarding (standard reverse-proxy behaviour).
+  // Defaults to true when unset: the target then receives the request at its
+  // own root (e.g. "/drive/assets/x.js" -> "/assets/x.js"), which suits plain
+  // static file servers and root-mounted backends. Set to false for targets
+  // that are themselves configured under the same sub-path and expect to
+  // receive the prefix. The \`X-Forwarded-Prefix\` header is always sent.
+  optional bool strip_path = 10;
+
+  // When true, incoming requests to this forwarder must carry a valid
+  // authenticated session (established via the OIDC sign-in flow) and pass the
+  // policy check before being proxied to the target. Unauthenticated requests
+  // are redirected to the configured OpenID Provider. The session is never
+  // exposed to the target (the session cookie is stripped before forwarding).
+  bool auth_enabled = 11;
+
+  // OpenID Provider issuer URL used for discovery
+  // (\`<issuer>/.well-known/openid-configuration\`). May be a Volt acting as an
+  // OpenID Provider, or any external OIDC provider. Required when
+  // \`auth_enabled\` is set.
+  string oidc_issuer = 12;
+
+  // OAuth 2.0 client identifier registered with the OpenID Provider.
+  string oidc_client_id = 13;
+
+  // OAuth 2.0 client secret. Stored encrypted and redacted on read.
+  string oidc_client_secret = 14;
+
+  // Space separated OAuth scopes. Defaults to "openid email" when empty.
+  string oidc_scopes = 15;
+
+  // Optional override for the reserved callback path on the app host. Defaults
+  // to "/__volt-auth/oidc/callback".
+  string oidc_redirect_path = 16;
+
+  // Email verification mode for OIDC-gated sign-in when the OpenID Provider is
+  // a Volt: "link" (default) or "code".
+  string email_verification_mode = 17;
 }
 
 message SaveHttpForwarderResponse {
@@ -3359,6 +3620,33 @@ message SaveHttpForwarderResponse {
   Resource resource = 2;
 }
 
+message SaveOidcClientRequest {
+  Resource resource = 1;
+  bool create = 2;
+  string create_in_parent_id = 3;
+  bool purge_attributes = 4;
+
+  // Human-friendly name for the client (also used as resource name when the
+  // resource name is empty).
+  string client_name = 5;
+
+  // OAuth 2.0 client_id. Required.
+  string client_id = 6;
+
+  // OAuth 2.0 client_secret. Stored encrypted and redacted on read. Only
+  // (re)written when non-empty so updates can omit it to keep the existing
+  // secret.
+  string client_secret = 7;
+
+  // Comma- or space-separated list of allowed redirect URIs.
+  string redirect_uris = 8;
+}
+
+message SaveOidcClientResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  Resource resource = 2;
+}
+
 message SaveHttpFileServerRequest {
   Resource resource = 1;
   bool create = 2;
@@ -3371,6 +3659,7 @@ message SaveHttpFileServerRequest {
   int32 cache_timeout = 9;
   bool catch_all_enabled = 10;
   string catch_all = 11;
+  bool dynamic_index_enabled = 12;
 }
 
 message SaveHttpFileServerResponse {
@@ -3387,6 +3676,11 @@ message SaveHttpRestApiServerRequest {
   int32 port = 6;
   bool enabled = 7;
   bool cors_enabled = 8;
+  bool is_literal = 9;
+  string literal_json = 10;
+  string database_id = 11;
+  string sql = 12;
+  repeated string parameter = 13;
 }
 
 message SaveHttpRestApiServerResponse {
@@ -3422,6 +3716,29 @@ message SaveSessionResponse {
   Session session = 2;
 }
 
+message SendEmailRequest {
+  // The email to send.
+  Email email = 1;
+}
+
+message SendEmailResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message SetAccessRequestDecisionRequest {
+  // The id of the access request.
+  string id = 1;
+
+  // The decision to save against the access request.
+  PolicyDecision decision = 2;
+}
+
+message SetAccessRequestDecisionResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
 message SetPolicyRequest {
   // The id of the policy to set.
   // Should be either 00000000-0000-0000-0000-000000000000 or 00000000-0000-0000-0000-000000000001 for the first or last custom policy respectively.
@@ -3449,19 +3766,6 @@ message SetServiceStatusResponse {
   Resource resource = 2;
 }
 
-message SetAccessRequestDecisionRequest {
-  // The id of the access request.
-  string id = 1;
-
-  // The decision to save against the access request.
-  PolicyDecision decision = 2;
-}
-
-message SetAccessRequestDecisionResponse {
-  // Details of any error that occurred on the call.
-  tdx.volt_api.volt.v1.Status status = 1;
-}
-
 // This message is emtpy.
 message ShutdownRequest {
 }