@tdxvolt/volt-client-grpc 0.20.21 → 0.20.29

package/lib/index.cjs

@@ -756,11 +756,15 @@ package tdx.volt_api.data.v1;
 import "tdx/volt_api/volt/v1/status.proto";
 import "tdx/volt_api/volt/v1/volt.proto";
 
-// The Sqlite Server API provides database management functions.
-// Use the VoltAPI DeleteResource function to delete a database.
+// The Sqlite Server API provides database and view management functions.
+// Use the VoltAPI DeleteResource function to delete a database or data view.
 service SqliteServerAPI {
   // Create a new database resource.
   rpc CreateDatabase(CreateDatabaseRequest) returns (CreateDatabaseResponse);
+
+  // Create or update a data view resource.
+  //Note that when creating a data view, the authenticated account must have access to the source database resource. For 'read-only' views that are \`SELECT\` only, this requires \`volt:database-read\` access to the source database. Any non-\`SELECT\` views require \`volt:database-write\` access to the source database.
+  rpc SaveDataView(SaveDataViewRequest) returns (SaveDataViewResponse);
 }
 
 message CreateDatabaseRequest {
@@ -799,6 +803,55 @@ message CreateDatabaseResponse {
   tdx.volt_api.volt.v1.Resource resource = 2;
 }
 
+message DataViewParameter {
+  // The parameter name referenced in the SQL template.
+  string name = 1;
+
+  // The parameter data type.
+  tdx.volt_api.volt.v1.AttributeDataType data_type = 2;
+
+  // Optional default value for the parameter.
+  tdx.volt_api.volt.v1.AttributeValue default_value = 3;
+
+  // Set when default_value should be applied.
+  bool include_default_value = 4;
+}
+
+message SaveDataViewRequest {
+  // Details of the data view to save.
+  tdx.volt_api.volt.v1.Resource resource = 1;
+
+  // Set to indicate this is a new data view.
+  bool create = 2;
+
+  // The id of the folder resource in which a new data view should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  bool purge_attributes = 4;
+
+  // The id of the source database on which this view is based.
+  // The authenticated account must have the relevant access to the source database, for example to create a 'SELECT' view the account must have 'volt:database-read' access to the source database. To create an 'INSERT' view the account must have 'volt:database-write' access to the source database.
+  string source_database_id = 5;
+
+  // The SQL template for the view.
+  string sql = 6;
+
+  // Set to allow sub-selects in the view SQL.
+  bool allow_sub_select = 7;
+
+  // Parameters defined for the view SQL template.
+  repeated DataViewParameter parameter = 8;
+}
+
+message SaveDataViewResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The saved data view resource.
+  tdx.volt_api.volt.v1.Resource resource = 2;
+}
 `;
 const proto_db_sync = `syntax = "proto3";
 
@@ -1489,6 +1542,10 @@ message DeleteDIDRequest {
 
   // Optional passphrase of the DID controller key. Required if the key is encrypted.
   string key_passphrase = 3;
+
+  // When true and \`did\` is set, hard-delete the DID from the local registry without requiring controller keys or signatures, and without synchronising with other registries. Ignored when \`origin_volt\`.
+  // Requires \`volt:delete-did\` API privilege.
+  bool force = 4;
 }
 
 message DeleteDIDResponse {
@@ -1570,6 +1627,13 @@ message ResolveDIDRequest {
 
   // Set to search all known registries rather than just the local registry.
   bool include_registries = 2;
+
+  // Per-DID document version. 0 = latest; 1..N = ordinal in the op log.
+  uint64 version = 3;
+
+  // Milliseconds since epoch. Resolves the document active at that time.
+  // Mutually exclusive with version.
+  uint64 at_timestamp = 4;
 }
 
 message ResolveDIDResponse {
@@ -1708,6 +1772,18 @@ service SyncAPI {
 
   // Write a single value to a given synapse JSON path.
   rpc WriteSynapsePath(WriteSynapsePathRequest) returns (WriteSynapsePathResponse);
+
+  // List stored versions of a document in a sync database.
+  rpc ListSyncDocumentVersions(ListSyncDocumentVersionsRequest) returns (ListSyncDocumentVersionsResponse);
+
+  // Get a stored version of a document in a sync database.
+  rpc GetSyncDocumentVersion(GetSyncDocumentVersionRequest) returns (GetSyncDocumentVersionResponse);
+
+  // Create a version checkpoint for a document in a sync database.
+  rpc CreateSyncDocumentVersion(CreateSyncDocumentVersionRequest) returns (CreateSyncDocumentVersionResponse);
+
+  // Revert a document in a sync database to a stored version.
+  rpc RevertSyncDocumentVersion(RevertSyncDocumentVersionRequest) returns (RevertSyncDocumentVersionResponse);
 }
 
 message CreateSynapseConnectionRequest {
@@ -1821,8 +1897,8 @@ message SaveSyncDatabaseRequest {
   // Set to audit all INSERT, UPDATE, and DELETE database operations.
   bool write_audit = 7;
 
-  // By default, yjs updates are periodically compressed and stored as snapshots. Set this flag to disable snapshots. This will reduce the size of the database and improve performance, but will also reduce the ability to rollback to a previous state.
-  bool no_snapshots = 8;
+  // By default, yjs updates are periodically compacted. Set this flag to disable compaction. This will reduce the size of the database but will remove the ability to version the documents in the database.
+  bool no_compaction = 8;
 
   // The number of updates to batch before flushing to the database. Defaults to 100.
   uint32 batch_size = 9;
@@ -1859,8 +1935,8 @@ message SaveSynapseRequest {
   // Set to audit all INSERT, UPDATE, and DELETE synapse operations.
   bool write_audit = 7;
 
-  // By default, yjs updates are periodically compressed and stored as snapshots. Set this flag to disable snapshots. This will reduce the size of the synapse and improve performance, but will also reduce the ability to rollback to a previous state.
-  bool no_snapshots = 8;
+  // By default, yjs updates are periodically compacted. Set this flag to disable compaction. This will reduce the size of the database but will remove the ability to version the documents in the database.
+  bool no_compaction = 8;
 }
 
 message SaveSynapseResponse {
@@ -1897,6 +1973,14 @@ message SetSynapseDocumentMetadataRequest {
 
   // Any additional application-specific JSON to attach to the document.
   string json = 4;
+
+  // Set to true when the caller intends to write the document's content
+  // separately, after this metadata call (a metadata-first create). The sync
+  // server uses this to defer __hash bootstrapping until the content actually
+  // arrives, so the hash is not computed over an empty document. Leave false
+  // (the default) for empty documents or content-first flows where the content
+  // is already present.
+  bool content_pending = 6;
 }
 
 message SetSynapseDocumentMetadataResponse {
@@ -2052,6 +2136,83 @@ message WriteSynapsePathResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 }
 
+message SyncDocumentVersionSummary {
+  // Globally unique version identifier (UUID).
+  string version_id = 1;
+
+  // Milliseconds since Unix epoch when the version was created.
+  uint64 timestamp = 2;
+
+  // Identity that created the version.
+  string identity = 3;
+
+  // Optional user-provided label.
+  string label = 4;
+
+  // Document hash (__hash) at the time of the version, when available.
+  string document_hash = 5;
+}
+
+message ListSyncDocumentVersionsRequest {
+  // The id of the sync database that contains the document.
+  string database_id = 1;
+
+  // The id of the document.
+  string document_id = 2;
+
+  // Maximum number of versions to return. Defaults to 50.
+  uint32 limit = 3;
+
+  // Number of versions to skip from the newest end.
+  uint32 offset = 4;
+}
+
+message ListSyncDocumentVersionsResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  repeated SyncDocumentVersionSummary versions = 2;
+}
+
+message GetSyncDocumentVersionRequest {
+  string database_id = 1;
+  string document_id = 2;
+  string version_id = 3;
+}
+
+message GetSyncDocumentVersionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  SyncDocumentVersionSummary info = 2;
+
+  // Full Yjs v2 document state at this version. Clients materialize locally.
+  bytes state_update = 3;
+}
+
+message CreateSyncDocumentVersionRequest {
+  string database_id = 1;
+  string document_id = 2;
+  string label = 3;
+}
+
+message CreateSyncDocumentVersionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  string version_id = 2;
+}
+
+message RevertSyncDocumentVersionRequest {
+  string database_id = 1;
+  string document_id = 2;
+  string version_id = 3;
+
+  // Optional label for the audit version created after revert.
+  string label = 4;
+}
+
+message RevertSyncDocumentVersionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // Version id of the audit checkpoint created after revert.
+  string version_id = 2;
+}
+
 `;
 const terminal_api = `syntax = "proto3";
 
@@ -2061,6 +2222,7 @@ import "tdx/volt_api/volt/v1/status.proto";
 
 service TerminalAPI {
   // Bidirectional streaming RPC for real-time terminal control and data exchange.
+  // Note that \`volt:command-invoke\` access is required to invoke this API. An optional allow-list of comma-separated commands can be specified in the \`extra\` string of the access policy.
   rpc CommandStream(stream CommandStreamRequest) returns (stream CommandStreamResponse);
 }
 
@@ -2716,7 +2878,18 @@ message Access {
   // Requested access.
   string access = 10;
 
-  // Optional extra data.
+  // Optional extra data that further constrains the access being granted. How this string is interpreted depends on the value of \`access\` above:
+  //
+  //  - \`volt:api-call\`: a single API method name. The access only applies when the invoked API method matches this value (policy attribute \`volt:action-api-call\`). Leave empty to allow all API methods.
+  //
+  //  - \`volt:command-invoke\` (CommandStream API): a comma-separated allow-list of commands. The access is permitted (or denied depending on the rule decision) when the invoked command matches any entry in the list (policy attribute \`volt:action-command\`). A trailing \`*\` acts as a prefix wildcard (e.g. \`/usr/bin/*\` allows any command beginning with \`/usr/bin/\`). Leave empty to allow all commands.
+  //    Example: "ls,git,/usr/bin/python3"
+  //
+  //  - Otherwise: a comma-separated list of \`[attributeId]|[value]\` pairs, each matched against the named resource attribute (trailing \`*\` acts as a prefix wildcard). The sync-database case below is a specialisation of this general form.
+  //
+  //  - Sync databases (\`volt:sync-database\` resources, e.g. with \`volt:database-read\` / \`volt:database-write\` access): a comma-separated list of \`[attributeId]|[value]\` pairs restricting the access to specific documents. Document ids use the \`volt:resource-sync-document-id\` attribute id, so each entry has the form \`volt:resource-sync-document-id|[documentId]\`. A trailing \`*\` on the value acts as a prefix wildcard. Leave empty to target all documents in the database.
+  //    Example: "volt:resource-sync-document-id|doc-123,volt:resource-sync-document-id|report-*"
+  //
   string extra = 11;
 
   // Assigned decision.
@@ -2891,8 +3064,9 @@ service VoltAPI {
   rpc DiscoverServices(DiscoverServicesRequest) returns (DiscoverServicesResponse);
 
   // Get access rule details.
-  // Only rules in which the authenticated identity participates will be retrieved, in addition to any rules that target a resource that is owned by the authenticated identity.
   // If the authenticated identity is the Volt root, all rules will be retrieved that match the criteria.
+  // All rules for which the authenticated account has volt:api-call / volt:get-access permission to the rule resource will be retrieved.
+  // Otherwise, only rules in which the authenticated identity participates will be retrieved, in addition to any rules that target a resource that is owned by the authenticated identity.
   rpc GetAccess(GetAccessRequest) returns (GetAccessResponse);
 
   // Retrieve identities matching the given criteria.
@@ -2949,8 +3123,14 @@ service VoltAPI {
   rpc SaveHttpFileServer(SaveHttpFileServerRequest) returns (SaveHttpFileServerResponse);
 
   // Create or update an HTTP forwarder resource.
+  // This is a privileged API call and requires volt:api-call / volt:save-http-forwarder permission.
   rpc SaveHttpForwarder(SaveHttpForwarderRequest) returns (SaveHttpForwarderResponse);
 
+  // Create or update an OAuth/OIDC client registration (used when this Volt
+  // acts as an OpenID Provider). Clients are stored as \`volt:oidc-client\`
+  // resources.
+  rpc SaveOidcClient(SaveOidcClientRequest) returns (SaveOidcClientResponse);
+
   // Create or update an HTTP REST API server.
   // This is a privileged API call and requires volt:api-call / volt:save-http-rest-api-server permission.
   rpc SaveHttpRestApiServer(SaveHttpRestApiServerRequest) returns (SaveHttpRestApiServerResponse);
@@ -3102,6 +3282,10 @@ message CanAccessResourceRequest {
 
   // The type of access that is required.
   string access = 4;
+
+  // Optional additional information about the access request.
+  // For volt:api-call, the extra data is the API method lookup, e.g. volt:get-access.
+  string extra = 5;
 }
 
 message CanAccessResourceResponse {
@@ -3929,74 +4113,242 @@ message SaveDatabaseResponse {
 }
 
 message SaveHttpForwarderRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The domain to forward requests to.
   string domain = 5;
+
+  // The host to forward requests to.
   string host = 6;
+
+  // The port to forward requests to.
   int32 port = 7;
+
+  // Set to indicate that the host header should reflect the proxy domain rather than the target host.
   bool forward_host = 8;
+
+  // Optional path prefix (e.g. "/myapp") for path-based forwarding. May be used on its own (path forwarding on the Volt's own host) or together with \`domain\` (sub-domain + path, e.g. sub.acme.com/myapp). At least one of \`domain\` or \`path\` must be set.
+  string path = 9;
+
+  // When a \`path\` prefix is configured, keep that prefix on the request path when forwarding. The default (false) is standard reverse-proxy behaviour: the prefix is stripped so the target receives the request at its own root (e.g. "/drive/assets/x.js" -> "/assets/x.js"), which suits plain static file servers and root-mounted backends. Set to true for targets that are themselves configured under the same sub-path and expect to receive the prefix. The \`X-Forwarded-Prefix\` header is always sent.
+  bool keep_path = 10;
+
+  // When true, incoming HTTP requests to this forwarder must carry a valid authenticated session (established via the OIDC sign-in flow) and pass the policy check before being proxied, except for the public-path and manifest exceptions on \`auth_public_paths\`. Unauthenticated top-level document navigations are redirected to the configured OpenID Provider; other unauthenticated requests receive 401. An authenticated session that fails the policy check receives 403. The Volt session cookie is stripped from the HTTP hop to the target. WebSocket and SSE upgrades are not gated.
+  bool auth_enabled = 11;
+
+  // OpenID Provider issuer URL used for discovery (\`<issuer>/.well-known/openid-configuration\`). May be a Volt acting as an OpenID Provider, or any external OIDC provider. Required when \`auth_enabled\` is set.
+  string oidc_issuer = 12;
+
+  // OAuth 2.0 client identifier registered with the OpenID Provider.
+  string oidc_client_id = 13;
+
+  // OAuth 2.0 client secret. Stored encrypted and redacted on read.
+  string oidc_client_secret = 14;
+
+  // Space separated OAuth scopes. Defaults to "openid email" when empty.
+  string oidc_scopes = 15;
+
+  // Optional override for the reserved callback path on the app host. Defaults to "/__volt-auth/oidc/callback".
+  string oidc_redirect_path = 16;
+
+  // Email verification mode for OIDC-gated sign-in when the OpenID Provider is a Volt: "code" (default) or "link".
+  string email_verification_mode = 17;
+
+  // Effective-path patterns that may be fetched without a session (GET/HEAD). A trailing \`/*\` matches descendants on segment boundaries (e.g. \`/icon/*\`). Used for PWA icons and similar public chrome; the manifest itself is allowed via \`Sec-Fetch-Dest: manifest\` and does not need to be listed.
+  repeated string auth_public_paths = 18;
 }
 
 message SaveHttpForwarderResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
+  Resource resource = 2;
+}
+
+message SaveOidcClientRequest {
+  // Details of the resource to save.
+  Resource resource = 1;
+
+  // Set to indicate this is a new resource.
+  bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  bool purge_attributes = 4;
+
+  // Human-friendly name for the client (also used as resource name when the resource name is empty).
+  string client_name = 5;
+
+  // OAuth 2.0 client_id. Required.
+  string client_id = 6;
+
+  // OAuth 2.0 client_secret. Stored encrypted and redacted on read. Only (re)written when non-empty so updates can omit it to keep the existing secret.
+  string client_secret = 7;
+
+  // Comma- or space-separated list of allowed redirect URIs.
+  string redirect_uris = 8;
+}
+
+message SaveOidcClientResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpFileServerRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The path to serve files from.
   string path = 5;
+
+  // The host to serve files from.
   string host = 6;
+
+  // The port to serve files from.
   int32 port = 7;
+
+  // Set to indicate the server is enabled.
   bool enabled = 8;
+
+  // The cache timeout in seconds.
   int32 cache_timeout = 9;
+
+  // Set to indicate the catch all is enabled.
   bool catch_all_enabled = 10;
+
+  // The catch all path, e.g. '/'.
   string catch_all = 11;
+
+  // Set to indicate the dynamic index is enabled, which will return a dynamic index page for the path if it exists.
+  bool dynamic_index_enabled = 12;
 }
 
 message SaveHttpFileServerResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpRestApiServerRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The host to serve the API from.
   string host = 5;
+
+  // The port to serve the API from.
   int32 port = 6;
+
+  // Set to indicate the server is enabled.
   bool enabled = 7;
+
+  // Set to indicate the CORS is enabled.
   bool cors_enabled = 8;
+
+  // Set to indicate the API is a literal.
+  bool is_literal = 9;
+
+  // The literal JSON to serve the API from.
+  string literal_json = 10;
+
+  // The database ID to serve the API from.
+  string database_id = 11;
+
+  // The SQL to execute for this node.
+  string sql = 12;
+
+  // The parameters to inject into the SQL.
+  repeated string parameter = 13;
 }
 
 message SaveHttpRestApiServerResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpRestApiNodeRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // Set to indicate the node is a literal.
   bool is_literal = 5;
+
+  // The literal JSON to serve the node from.
   string literal_json = 6;
+
+  // The database ID to serve the node from.
   string database_id = 7;
+
+  // The SQL to execute for this node.
   string sql = 8;
+
+  // The parameters to inject into the SQL.
   repeated string parameter = 9;
 }
 
 message SaveHttpRestApiNodeResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveSessionRequest {
+  // Details of the session to save.
   Session session = 1;
 }
 
@@ -4004,6 +4356,7 @@ message SaveSessionResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
 
+  // The updated session.
   Session session = 2;
 }
 
@@ -5809,7 +6162,10 @@ class VoltCredential {
       if (!this._voltPublicKey) {
         // Extract the public key from the Volt CA cert.
         const voltCA = new crypto__default["default"].X509Certificate(this._voltConfig.ca_pem);
-        this._voltPublicKey = voltCA.publicKey.export({ type: 'spki', format: 'pem' });
+        this._voltPublicKey = voltCA.publicKey.export({
+          type: "spki",
+          format: "pem"
+        });
       }
 
       const voltKey = keyFromPem(this._voltPublicKey).publicKey;
@@ -5921,7 +6277,7 @@ class VoltCredential {
   }
 
   saveCache() {
-    this._config = {...this._config, credential: { ...this._cryptoCache } };
+    this._config.credential = {...this._cryptoCache};
     const clone = { ...this._config };
     if (this._config.p) {
       // A passphrase option exists => encrypt the key before writing the cache file.
@@ -6519,6 +6875,10 @@ class VoltClient extends EventEmitter__default["default"] {
     return unaryCallInternal.call(this, "CreateDatabase", request);
   }
 
+  SaveDataView(request) {
+    return unaryCallInternal.call(this, "SaveDataView", request);
+  }
+
   /**
    * SqliteDatabaseAPI
    */
@@ -6628,6 +6988,10 @@ class VoltClient extends EventEmitter__default["default"] {
     return publishCall.start(grpcClient, request);
   }
 
+  SaveWire(request) {
+    return unaryCallInternal.call(this, "SaveWire", request);
+  }
+
   SubscribeWire(request) {
     const grpcClient = this.getVoltAPIClient();
 

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.20.21",
+  "version": "0.20.29",
   "description": "tdx Volt library for nodejs clients",
   "type": "module",
   "exports": {
@@ -33,8 +33,8 @@
   "author": "toby.ealden@gmail.com",
   "license": "ISC",
   "dependencies": {
-    "@tdxvolt/volt-client-web": "^0.20.21",
-    "@tdxvolt/volt-utility": "^0.20.21",
+    "@tdxvolt/volt-client-web": "^0.20.29",
+    "@tdxvolt/volt-utility": "^0.20.29",
     "debug": "^4.1.1",
     "ip": "^1.1.5",
     "jsonwebtoken": "^8.5.1",

package/src/volt-client.js

@@ -597,6 +597,10 @@ export class VoltClient extends EventEmitter {
     return unaryCallInternal.call(this, "CreateDatabase", request);
   }
 
+  SaveDataView(request) {
+    return unaryCallInternal.call(this, "SaveDataView", request);
+  }
+
   /**
    * SqliteDatabaseAPI
    */
@@ -706,6 +710,10 @@ export class VoltClient extends EventEmitter {
     return publishCall.start(grpcClient, request);
   }
 
+  SaveWire(request) {
+    return unaryCallInternal.call(this, "SaveWire", request);
+  }
+
   SubscribeWire(request) {
     const grpcClient = this.getVoltAPIClient();
 

package/src/volt-credential.js

@@ -58,7 +58,10 @@ export class VoltCredential {
       if (!this._voltPublicKey) {
         // Extract the public key from the Volt CA cert.
         const voltCA = new crypto.X509Certificate(this._voltConfig.ca_pem);
-        this._voltPublicKey = voltCA.publicKey.export({ type: 'spki', format: 'pem' });
+        this._voltPublicKey = voltCA.publicKey.export({
+          type: "spki",
+          format: "pem"
+        });
       }
 
       const voltKey = keyFromPem(this._voltPublicKey).publicKey;
@@ -170,7 +173,7 @@ export class VoltCredential {
   }
 
   saveCache() {
-    this._config = {...this._config, credential: { ...this._cryptoCache } };
+    this._config.credential = {...this._cryptoCache};
     const clone = { ...this._config };
     if (this._config.p) {
       // A passphrase option exists => encrypt the key before writing the cache file.

package/src/volt-proto-literals.js

@@ -208,11 +208,15 @@ package tdx.volt_api.data.v1;
 import "tdx/volt_api/volt/v1/status.proto";
 import "tdx/volt_api/volt/v1/volt.proto";
 
-// The Sqlite Server API provides database management functions.
-// Use the VoltAPI DeleteResource function to delete a database.
+// The Sqlite Server API provides database and view management functions.
+// Use the VoltAPI DeleteResource function to delete a database or data view.
 service SqliteServerAPI {
   // Create a new database resource.
   rpc CreateDatabase(CreateDatabaseRequest) returns (CreateDatabaseResponse);
+
+  // Create or update a data view resource.
+  //Note that when creating a data view, the authenticated account must have access to the source database resource. For 'read-only' views that are \`SELECT\` only, this requires \`volt:database-read\` access to the source database. Any non-\`SELECT\` views require \`volt:database-write\` access to the source database.
+  rpc SaveDataView(SaveDataViewRequest) returns (SaveDataViewResponse);
 }
 
 message CreateDatabaseRequest {
@@ -251,6 +255,55 @@ message CreateDatabaseResponse {
   tdx.volt_api.volt.v1.Resource resource = 2;
 }
 
+message DataViewParameter {
+  // The parameter name referenced in the SQL template.
+  string name = 1;
+
+  // The parameter data type.
+  tdx.volt_api.volt.v1.AttributeDataType data_type = 2;
+
+  // Optional default value for the parameter.
+  tdx.volt_api.volt.v1.AttributeValue default_value = 3;
+
+  // Set when default_value should be applied.
+  bool include_default_value = 4;
+}
+
+message SaveDataViewRequest {
+  // Details of the data view to save.
+  tdx.volt_api.volt.v1.Resource resource = 1;
+
+  // Set to indicate this is a new data view.
+  bool create = 2;
+
+  // The id of the folder resource in which a new data view should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  bool purge_attributes = 4;
+
+  // The id of the source database on which this view is based.
+  // The authenticated account must have the relevant access to the source database, for example to create a 'SELECT' view the account must have 'volt:database-read' access to the source database. To create an 'INSERT' view the account must have 'volt:database-write' access to the source database.
+  string source_database_id = 5;
+
+  // The SQL template for the view.
+  string sql = 6;
+
+  // Set to allow sub-selects in the view SQL.
+  bool allow_sub_select = 7;
+
+  // Parameters defined for the view SQL template.
+  repeated DataViewParameter parameter = 8;
+}
+
+message SaveDataViewResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The saved data view resource.
+  tdx.volt_api.volt.v1.Resource resource = 2;
+}
 `;
 export const proto_db_sync = `syntax = "proto3";
 
@@ -941,6 +994,10 @@ message DeleteDIDRequest {
 
   // Optional passphrase of the DID controller key. Required if the key is encrypted.
   string key_passphrase = 3;
+
+  // When true and \`did\` is set, hard-delete the DID from the local registry without requiring controller keys or signatures, and without synchronising with other registries. Ignored when \`origin_volt\`.
+  // Requires \`volt:delete-did\` API privilege.
+  bool force = 4;
 }
 
 message DeleteDIDResponse {
@@ -1022,6 +1079,13 @@ message ResolveDIDRequest {
 
   // Set to search all known registries rather than just the local registry.
   bool include_registries = 2;
+
+  // Per-DID document version. 0 = latest; 1..N = ordinal in the op log.
+  uint64 version = 3;
+
+  // Milliseconds since epoch. Resolves the document active at that time.
+  // Mutually exclusive with version.
+  uint64 at_timestamp = 4;
 }
 
 message ResolveDIDResponse {
@@ -1160,6 +1224,18 @@ service SyncAPI {
 
   // Write a single value to a given synapse JSON path.
   rpc WriteSynapsePath(WriteSynapsePathRequest) returns (WriteSynapsePathResponse);
+
+  // List stored versions of a document in a sync database.
+  rpc ListSyncDocumentVersions(ListSyncDocumentVersionsRequest) returns (ListSyncDocumentVersionsResponse);
+
+  // Get a stored version of a document in a sync database.
+  rpc GetSyncDocumentVersion(GetSyncDocumentVersionRequest) returns (GetSyncDocumentVersionResponse);
+
+  // Create a version checkpoint for a document in a sync database.
+  rpc CreateSyncDocumentVersion(CreateSyncDocumentVersionRequest) returns (CreateSyncDocumentVersionResponse);
+
+  // Revert a document in a sync database to a stored version.
+  rpc RevertSyncDocumentVersion(RevertSyncDocumentVersionRequest) returns (RevertSyncDocumentVersionResponse);
 }
 
 message CreateSynapseConnectionRequest {
@@ -1273,8 +1349,8 @@ message SaveSyncDatabaseRequest {
   // Set to audit all INSERT, UPDATE, and DELETE database operations.
   bool write_audit = 7;
 
-  // By default, yjs updates are periodically compressed and stored as snapshots. Set this flag to disable snapshots. This will reduce the size of the database and improve performance, but will also reduce the ability to rollback to a previous state.
-  bool no_snapshots = 8;
+  // By default, yjs updates are periodically compacted. Set this flag to disable compaction. This will reduce the size of the database but will remove the ability to version the documents in the database.
+  bool no_compaction = 8;
 
   // The number of updates to batch before flushing to the database. Defaults to 100.
   uint32 batch_size = 9;
@@ -1311,8 +1387,8 @@ message SaveSynapseRequest {
   // Set to audit all INSERT, UPDATE, and DELETE synapse operations.
   bool write_audit = 7;
 
-  // By default, yjs updates are periodically compressed and stored as snapshots. Set this flag to disable snapshots. This will reduce the size of the synapse and improve performance, but will also reduce the ability to rollback to a previous state.
-  bool no_snapshots = 8;
+  // By default, yjs updates are periodically compacted. Set this flag to disable compaction. This will reduce the size of the database but will remove the ability to version the documents in the database.
+  bool no_compaction = 8;
 }
 
 message SaveSynapseResponse {
@@ -1349,6 +1425,14 @@ message SetSynapseDocumentMetadataRequest {
 
   // Any additional application-specific JSON to attach to the document.
   string json = 4;
+
+  // Set to true when the caller intends to write the document's content
+  // separately, after this metadata call (a metadata-first create). The sync
+  // server uses this to defer __hash bootstrapping until the content actually
+  // arrives, so the hash is not computed over an empty document. Leave false
+  // (the default) for empty documents or content-first flows where the content
+  // is already present.
+  bool content_pending = 6;
 }
 
 message SetSynapseDocumentMetadataResponse {
@@ -1504,6 +1588,83 @@ message WriteSynapsePathResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 }
 
+message SyncDocumentVersionSummary {
+  // Globally unique version identifier (UUID).
+  string version_id = 1;
+
+  // Milliseconds since Unix epoch when the version was created.
+  uint64 timestamp = 2;
+
+  // Identity that created the version.
+  string identity = 3;
+
+  // Optional user-provided label.
+  string label = 4;
+
+  // Document hash (__hash) at the time of the version, when available.
+  string document_hash = 5;
+}
+
+message ListSyncDocumentVersionsRequest {
+  // The id of the sync database that contains the document.
+  string database_id = 1;
+
+  // The id of the document.
+  string document_id = 2;
+
+  // Maximum number of versions to return. Defaults to 50.
+  uint32 limit = 3;
+
+  // Number of versions to skip from the newest end.
+  uint32 offset = 4;
+}
+
+message ListSyncDocumentVersionsResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  repeated SyncDocumentVersionSummary versions = 2;
+}
+
+message GetSyncDocumentVersionRequest {
+  string database_id = 1;
+  string document_id = 2;
+  string version_id = 3;
+}
+
+message GetSyncDocumentVersionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  SyncDocumentVersionSummary info = 2;
+
+  // Full Yjs v2 document state at this version. Clients materialize locally.
+  bytes state_update = 3;
+}
+
+message CreateSyncDocumentVersionRequest {
+  string database_id = 1;
+  string document_id = 2;
+  string label = 3;
+}
+
+message CreateSyncDocumentVersionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  string version_id = 2;
+}
+
+message RevertSyncDocumentVersionRequest {
+  string database_id = 1;
+  string document_id = 2;
+  string version_id = 3;
+
+  // Optional label for the audit version created after revert.
+  string label = 4;
+}
+
+message RevertSyncDocumentVersionResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // Version id of the audit checkpoint created after revert.
+  string version_id = 2;
+}
+
 `;
 export const terminal_api = `syntax = "proto3";
 
@@ -1513,6 +1674,7 @@ import "tdx/volt_api/volt/v1/status.proto";
 
 service TerminalAPI {
   // Bidirectional streaming RPC for real-time terminal control and data exchange.
+  // Note that \`volt:command-invoke\` access is required to invoke this API. An optional allow-list of comma-separated commands can be specified in the \`extra\` string of the access policy.
   rpc CommandStream(stream CommandStreamRequest) returns (stream CommandStreamResponse);
 }
 
@@ -2168,7 +2330,18 @@ message Access {
   // Requested access.
   string access = 10;
 
-  // Optional extra data.
+  // Optional extra data that further constrains the access being granted. How this string is interpreted depends on the value of \`access\` above:
+  //
+  //  - \`volt:api-call\`: a single API method name. The access only applies when the invoked API method matches this value (policy attribute \`volt:action-api-call\`). Leave empty to allow all API methods.
+  //
+  //  - \`volt:command-invoke\` (CommandStream API): a comma-separated allow-list of commands. The access is permitted (or denied depending on the rule decision) when the invoked command matches any entry in the list (policy attribute \`volt:action-command\`). A trailing \`*\` acts as a prefix wildcard (e.g. \`/usr/bin/*\` allows any command beginning with \`/usr/bin/\`). Leave empty to allow all commands.
+  //    Example: "ls,git,/usr/bin/python3"
+  //
+  //  - Otherwise: a comma-separated list of \`[attributeId]|[value]\` pairs, each matched against the named resource attribute (trailing \`*\` acts as a prefix wildcard). The sync-database case below is a specialisation of this general form.
+  //
+  //  - Sync databases (\`volt:sync-database\` resources, e.g. with \`volt:database-read\` / \`volt:database-write\` access): a comma-separated list of \`[attributeId]|[value]\` pairs restricting the access to specific documents. Document ids use the \`volt:resource-sync-document-id\` attribute id, so each entry has the form \`volt:resource-sync-document-id|[documentId]\`. A trailing \`*\` on the value acts as a prefix wildcard. Leave empty to target all documents in the database.
+  //    Example: "volt:resource-sync-document-id|doc-123,volt:resource-sync-document-id|report-*"
+  //
   string extra = 11;
 
   // Assigned decision.
@@ -2343,8 +2516,9 @@ service VoltAPI {
   rpc DiscoverServices(DiscoverServicesRequest) returns (DiscoverServicesResponse);
 
   // Get access rule details.
-  // Only rules in which the authenticated identity participates will be retrieved, in addition to any rules that target a resource that is owned by the authenticated identity.
   // If the authenticated identity is the Volt root, all rules will be retrieved that match the criteria.
+  // All rules for which the authenticated account has volt:api-call / volt:get-access permission to the rule resource will be retrieved.
+  // Otherwise, only rules in which the authenticated identity participates will be retrieved, in addition to any rules that target a resource that is owned by the authenticated identity.
   rpc GetAccess(GetAccessRequest) returns (GetAccessResponse);
 
   // Retrieve identities matching the given criteria.
@@ -2401,8 +2575,14 @@ service VoltAPI {
   rpc SaveHttpFileServer(SaveHttpFileServerRequest) returns (SaveHttpFileServerResponse);
 
   // Create or update an HTTP forwarder resource.
+  // This is a privileged API call and requires volt:api-call / volt:save-http-forwarder permission.
   rpc SaveHttpForwarder(SaveHttpForwarderRequest) returns (SaveHttpForwarderResponse);
 
+  // Create or update an OAuth/OIDC client registration (used when this Volt
+  // acts as an OpenID Provider). Clients are stored as \`volt:oidc-client\`
+  // resources.
+  rpc SaveOidcClient(SaveOidcClientRequest) returns (SaveOidcClientResponse);
+
   // Create or update an HTTP REST API server.
   // This is a privileged API call and requires volt:api-call / volt:save-http-rest-api-server permission.
   rpc SaveHttpRestApiServer(SaveHttpRestApiServerRequest) returns (SaveHttpRestApiServerResponse);
@@ -2554,6 +2734,10 @@ message CanAccessResourceRequest {
 
   // The type of access that is required.
   string access = 4;
+
+  // Optional additional information about the access request.
+  // For volt:api-call, the extra data is the API method lookup, e.g. volt:get-access.
+  string extra = 5;
 }
 
 message CanAccessResourceResponse {
@@ -3381,74 +3565,242 @@ message SaveDatabaseResponse {
 }
 
 message SaveHttpForwarderRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The domain to forward requests to.
   string domain = 5;
+
+  // The host to forward requests to.
   string host = 6;
+
+  // The port to forward requests to.
   int32 port = 7;
+
+  // Set to indicate that the host header should reflect the proxy domain rather than the target host.
   bool forward_host = 8;
+
+  // Optional path prefix (e.g. "/myapp") for path-based forwarding. May be used on its own (path forwarding on the Volt's own host) or together with \`domain\` (sub-domain + path, e.g. sub.acme.com/myapp). At least one of \`domain\` or \`path\` must be set.
+  string path = 9;
+
+  // When a \`path\` prefix is configured, keep that prefix on the request path when forwarding. The default (false) is standard reverse-proxy behaviour: the prefix is stripped so the target receives the request at its own root (e.g. "/drive/assets/x.js" -> "/assets/x.js"), which suits plain static file servers and root-mounted backends. Set to true for targets that are themselves configured under the same sub-path and expect to receive the prefix. The \`X-Forwarded-Prefix\` header is always sent.
+  bool keep_path = 10;
+
+  // When true, incoming HTTP requests to this forwarder must carry a valid authenticated session (established via the OIDC sign-in flow) and pass the policy check before being proxied, except for the public-path and manifest exceptions on \`auth_public_paths\`. Unauthenticated top-level document navigations are redirected to the configured OpenID Provider; other unauthenticated requests receive 401. An authenticated session that fails the policy check receives 403. The Volt session cookie is stripped from the HTTP hop to the target. WebSocket and SSE upgrades are not gated.
+  bool auth_enabled = 11;
+
+  // OpenID Provider issuer URL used for discovery (\`<issuer>/.well-known/openid-configuration\`). May be a Volt acting as an OpenID Provider, or any external OIDC provider. Required when \`auth_enabled\` is set.
+  string oidc_issuer = 12;
+
+  // OAuth 2.0 client identifier registered with the OpenID Provider.
+  string oidc_client_id = 13;
+
+  // OAuth 2.0 client secret. Stored encrypted and redacted on read.
+  string oidc_client_secret = 14;
+
+  // Space separated OAuth scopes. Defaults to "openid email" when empty.
+  string oidc_scopes = 15;
+
+  // Optional override for the reserved callback path on the app host. Defaults to "/__volt-auth/oidc/callback".
+  string oidc_redirect_path = 16;
+
+  // Email verification mode for OIDC-gated sign-in when the OpenID Provider is a Volt: "code" (default) or "link".
+  string email_verification_mode = 17;
+
+  // Effective-path patterns that may be fetched without a session (GET/HEAD). A trailing \`/*\` matches descendants on segment boundaries (e.g. \`/icon/*\`). Used for PWA icons and similar public chrome; the manifest itself is allowed via \`Sec-Fetch-Dest: manifest\` and does not need to be listed.
+  repeated string auth_public_paths = 18;
 }
 
 message SaveHttpForwarderResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
+  Resource resource = 2;
+}
+
+message SaveOidcClientRequest {
+  // Details of the resource to save.
+  Resource resource = 1;
+
+  // Set to indicate this is a new resource.
+  bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
+  string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
+  bool purge_attributes = 4;
+
+  // Human-friendly name for the client (also used as resource name when the resource name is empty).
+  string client_name = 5;
+
+  // OAuth 2.0 client_id. Required.
+  string client_id = 6;
+
+  // OAuth 2.0 client_secret. Stored encrypted and redacted on read. Only (re)written when non-empty so updates can omit it to keep the existing secret.
+  string client_secret = 7;
+
+  // Comma- or space-separated list of allowed redirect URIs.
+  string redirect_uris = 8;
+}
+
+message SaveOidcClientResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpFileServerRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The path to serve files from.
   string path = 5;
+
+  // The host to serve files from.
   string host = 6;
+
+  // The port to serve files from.
   int32 port = 7;
+
+  // Set to indicate the server is enabled.
   bool enabled = 8;
+
+  // The cache timeout in seconds.
   int32 cache_timeout = 9;
+
+  // Set to indicate the catch all is enabled.
   bool catch_all_enabled = 10;
+
+  // The catch all path, e.g. '/'.
   string catch_all = 11;
+
+  // Set to indicate the dynamic index is enabled, which will return a dynamic index page for the path if it exists.
+  bool dynamic_index_enabled = 12;
 }
 
 message SaveHttpFileServerResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpRestApiServerRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The host to serve the API from.
   string host = 5;
+
+  // The port to serve the API from.
   int32 port = 6;
+
+  // Set to indicate the server is enabled.
   bool enabled = 7;
+
+  // Set to indicate the CORS is enabled.
   bool cors_enabled = 8;
+
+  // Set to indicate the API is a literal.
+  bool is_literal = 9;
+
+  // The literal JSON to serve the API from.
+  string literal_json = 10;
+
+  // The database ID to serve the API from.
+  string database_id = 11;
+
+  // The SQL to execute for this node.
+  string sql = 12;
+
+  // The parameters to inject into the SQL.
+  repeated string parameter = 13;
 }
 
 message SaveHttpRestApiServerResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpRestApiNodeRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // Set to indicate the node is a literal.
   bool is_literal = 5;
+
+  // The literal JSON to serve the node from.
   string literal_json = 6;
+
+  // The database ID to serve the node from.
   string database_id = 7;
+
+  // The SQL to execute for this node.
   string sql = 8;
+
+  // The parameters to inject into the SQL.
   repeated string parameter = 9;
 }
 
 message SaveHttpRestApiNodeResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveSessionRequest {
+  // Details of the session to save.
   Session session = 1;
 }
 
@@ -3456,6 +3808,7 @@ message SaveSessionResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
 
+  // The updated session.
   Session session = 2;
 }