@tdxvolt/volt-client-grpc 0.20.27 → 0.20.31

package/lib/index.cjs

@@ -763,6 +763,7 @@ service SqliteServerAPI {
   rpc CreateDatabase(CreateDatabaseRequest) returns (CreateDatabaseResponse);
 
   // Create or update a data view resource.
+  //Note that when creating a data view, the authenticated account must have access to the source database resource. For 'read-only' views that are \`SELECT\` only, this requires \`volt:database-read\` access to the source database. Any non-\`SELECT\` views require \`volt:database-write\` access to the source database.
   rpc SaveDataView(SaveDataViewRequest) returns (SaveDataViewResponse);
 }
 
@@ -1541,6 +1542,10 @@ message DeleteDIDRequest {
 
   // Optional passphrase of the DID controller key. Required if the key is encrypted.
   string key_passphrase = 3;
+
+  // When true and \`did\` is set, hard-delete the DID from the local registry without requiring controller keys or signatures, and without synchronising with other registries. Ignored when \`origin_volt\`.
+  // Requires \`volt:delete-did\` API privilege.
+  bool force = 4;
 }
 
 message DeleteDIDResponse {
@@ -1779,6 +1784,15 @@ service SyncAPI {
 
   // Revert a document in a sync database to a stored version.
   rpc RevertSyncDocumentVersion(RevertSyncDocumentVersionRequest) returns (RevertSyncDocumentVersionResponse);
+
+  // Check whether a content-addressed blob exists in a synapse.
+  rpc HasSynapseBlob(HasSynapseBlobRequest) returns (HasSynapseBlobResponse);
+
+  // Upload a content-addressed blob. The first message must be \`start\` with the expected sha256 (base64url) hash and size; subsequent messages carry payload chunks. Idempotent if the hash is already stored. The server verifies the received bytes match \`hash\` before committing.
+  rpc PutSynapseBlob(stream PutSynapseBlobRequest) returns (stream PutSynapseBlobResponse);
+
+  // Download a content-addressed blob by hash.
+  rpc GetSynapseBlob(GetSynapseBlobRequest) returns (stream GetSynapseBlobResponse);
 }
 
 message CreateSynapseConnectionRequest {
@@ -1946,36 +1960,31 @@ message SynapseDocumentMetadata {
   // The name of the top-level shared type in the document.
   string name = 1;
 
-  // The type of the shared type, e.g. "map", "array" or "text".
+  // The type of the document root. Yjs shared types are "map", "array" or "text". The "blob" type means the payload is a content-addressed object in the synapse blob store (PutSynapseBlob / GetSynapseBlob). There is no Yjs shared type for a blob document. A blob document's schema must be a single entry of type "blob"; it cannot be mixed with map, array, or text roots. The server writes \`__hash\` when the document is bound to a stored blob (see SetSynapseDocumentMetadata.blob_hash).
   string type = 2;
 
-  // The JSON schema that describes the data that is stored in this shared type.
+  // The JSON schema that describes the data stored in this shared type.
   string json_schema = 3;
 }
 
 message SetSynapseDocumentMetadataRequest {
-  // DEPRECATED: Use synapse_id instead.
-  string database_id = 1;
-
   // The id of the synapse that contains the document.
   string synapse_id = 5;
 
   // The id of the document to set the metadata for.
   string document_id = 2;
 
-  // The metadata to set for the document.
+  // The metadata to set for the document. Each entry names a top-level shared type (map/array/text). For a blob document this must contain exactly one entry with type "blob".
   repeated SynapseDocumentMetadata metadata = 3;
 
   // Any additional application-specific JSON to attach to the document.
   string json = 4;
 
-  // Set to true when the caller intends to write the document's content
-  // separately, after this metadata call (a metadata-first create). The sync
-  // server uses this to defer __hash bootstrapping until the content actually
-  // arrives, so the hash is not computed over an empty document. Leave false
-  // (the default) for empty documents or content-first flows where the content
-  // is already present.
-  bool content_pending = 6;
+  // Set to true when the document content is already present (content-first) or the document is intentionally empty, so the server bootstraps \`__hash\` immediately. Leave false (the default) when content will be written after this call.
+  bool content_ready = 6;
+
+  // For blob documents, the content hash to bind. The server verifies the blob is stored (or the hash is sha256 of empty bytes) and writes \`__hash\`. Omit for a metadata-first create. Must not be set for map/array/text documents; the server computes those hashes from Yjs content.
+  string blob_hash = 7;
 }
 
 message SetSynapseDocumentMetadataResponse {
@@ -2208,6 +2217,64 @@ message RevertSyncDocumentVersionResponse {
   string version_id = 2;
 }
 
+message HasSynapseBlobRequest {
+  // The id of the synapse that stores the blob.
+  string synapse_id = 1;
+
+  // sha256 of the raw file bytes, encoded as unpadded base64url (same family
+  // as VoltDrive content hashes).
+  string hash = 2;
+}
+
+message HasSynapseBlobResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // True if a blob with this hash is already stored.
+  bool exists = 2;
+}
+
+message PutSynapseBlobStart {
+  string synapse_id = 1;
+
+  // Expected sha256 (base64url) of the concatenated payload bytes.
+  string hash = 2;
+
+  // Total payload size in bytes. Zero means no blob row (empty file).
+  uint64 size = 3;
+}
+
+message PutSynapseBlobRequest {
+  oneof payload {
+    // Must be sent as the first message.
+    PutSynapseBlobStart start = 1;
+
+    // The next chunk of blob data.
+    bytes block = 2;
+  }
+}
+
+message PutSynapseBlobResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // Number of payload blocks received. Zero until the stream finishes.
+  uint32 ack = 2;
+
+  // True if the hash was already present (put is a no-op).
+  bool exists = 3;
+}
+
+message GetSynapseBlobRequest {
+  string synapse_id = 1;
+  string hash = 2;
+}
+
+message GetSynapseBlobResponse {
+  oneof payload {
+    bytes block = 1;
+    tdx.volt_api.volt.v1.Status status = 2;
+  }
+}
+
 `;
 const terminal_api = `syntax = "proto3";
 
@@ -4108,41 +4175,41 @@ message SaveDatabaseResponse {
 }
 
 message SaveHttpForwarderRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The domain to forward requests to.
   string domain = 5;
+
+  // The host to forward requests to.
   string host = 6;
+
+  // The port to forward requests to.
   int32 port = 7;
+
+  // Set to indicate that the host header should reflect the proxy domain rather than the target host.
   bool forward_host = 8;
 
-  // Optional path prefix (e.g. "/myapp") for path-based forwarding. May be used
-  // on its own (path forwarding on the Volt's own host) or together with
-  // \`domain\` (sub-domain + path, e.g. sub.acme.com/myapp). At least one of
-  // \`domain\` or \`path\` must be set.
+  // Optional path prefix (e.g. "/myapp") for path-based forwarding. May be used on its own (path forwarding on the Volt's own host) or together with \`domain\` (sub-domain + path, e.g. sub.acme.com/myapp). At least one of \`domain\` or \`path\` must be set.
   string path = 9;
 
-  // When a \`path\` prefix is configured, controls whether that prefix is removed
-  // from the request path before forwarding (standard reverse-proxy behaviour).
-  // Defaults to true when unset: the target then receives the request at its
-  // own root (e.g. "/drive/assets/x.js" -> "/assets/x.js"), which suits plain
-  // static file servers and root-mounted backends. Set to false for targets
-  // that are themselves configured under the same sub-path and expect to
-  // receive the prefix. The \`X-Forwarded-Prefix\` header is always sent.
-  optional bool strip_path = 10;
-
-  // When true, incoming requests to this forwarder must carry a valid
-  // authenticated session (established via the OIDC sign-in flow) and pass the
-  // policy check before being proxied to the target. Unauthenticated requests
-  // are redirected to the configured OpenID Provider. The session is never
-  // exposed to the target (the session cookie is stripped before forwarding).
+  // When a \`path\` prefix is configured, keep that prefix on the request path when forwarding. The default (false) is standard reverse-proxy behaviour: the prefix is stripped so the target receives the request at its own root (e.g. "/drive/assets/x.js" -> "/assets/x.js"), which suits plain static file servers and root-mounted backends. Set to true for targets that are themselves configured under the same sub-path and expect to receive the prefix. The \`X-Forwarded-Prefix\` header is always sent.
+  bool keep_path = 10;
+
+  // When true, incoming HTTP requests to this forwarder must carry a valid authenticated session (established via the OIDC sign-in flow) and pass the policy check before being proxied, except for the public-path and manifest exceptions on \`auth_public_paths\`. Unauthenticated top-level document navigations are redirected to the configured OpenID Provider; other unauthenticated requests receive 401. An authenticated session that fails the policy check receives 403. The Volt session cookie is stripped from the HTTP hop to the target. WebSocket and SSE upgrades are not gated.
   bool auth_enabled = 11;
 
-  // OpenID Provider issuer URL used for discovery
-  // (\`<issuer>/.well-known/openid-configuration\`). May be a Volt acting as an
-  // OpenID Provider, or any external OIDC provider. Required when
-  // \`auth_enabled\` is set.
+  // OpenID Provider issuer URL used for discovery (\`<issuer>/.well-known/openid-configuration\`). May be a Volt acting as an OpenID Provider, or any external OIDC provider. Required when \`auth_enabled\` is set.
   string oidc_issuer = 12;
 
   // OAuth 2.0 client identifier registered with the OpenID Provider.
@@ -4154,36 +4221,45 @@ message SaveHttpForwarderRequest {
   // Space separated OAuth scopes. Defaults to "openid email" when empty.
   string oidc_scopes = 15;
 
-  // Optional override for the reserved callback path on the app host. Defaults
-  // to "/__volt-auth/oidc/callback".
+  // Optional override for the reserved callback path on the app host. Defaults to "/__volt-auth/oidc/callback".
   string oidc_redirect_path = 16;
 
-  // Email verification mode for OIDC-gated sign-in when the OpenID Provider is
-  // a Volt: "link" (default) or "code".
+  // Email verification mode for OIDC-gated sign-in when the OpenID Provider is a Volt: "code" (default) or "link".
   string email_verification_mode = 17;
+
+  // Effective-path patterns that may be fetched without a session (GET/HEAD). A trailing \`/*\` matches descendants on segment boundaries (e.g. \`/icon/*\`). Used for PWA icons and similar public chrome; the manifest itself is allowed via \`Sec-Fetch-Dest: manifest\` and does not need to be listed.
+  repeated string auth_public_paths = 18;
 }
 
 message SaveHttpForwarderResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveOidcClientRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
 
-  // Human-friendly name for the client (also used as resource name when the
-  // resource name is empty).
+  // Human-friendly name for the client (also used as resource name when the resource name is empty).
   string client_name = 5;
 
   // OAuth 2.0 client_id. Required.
   string client_id = 6;
 
-  // OAuth 2.0 client_secret. Stored encrypted and redacted on read. Only
-  // (re)written when non-empty so updates can omit it to keep the existing
-  // secret.
+  // OAuth 2.0 client_secret. Stored encrypted and redacted on read. Only (re)written when non-empty so updates can omit it to keep the existing secret.
   string client_secret = 7;
 
   // Comma- or space-separated list of allowed redirect URIs.
@@ -4191,69 +4267,150 @@ message SaveOidcClientRequest {
 }
 
 message SaveOidcClientResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpFileServerRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The path to serve files from.
   string path = 5;
+
+  // The host to serve files from.
   string host = 6;
+
+  // The port to serve files from.
   int32 port = 7;
+
+  // Set to indicate the server is enabled.
   bool enabled = 8;
+
+  // The cache timeout in seconds.
   int32 cache_timeout = 9;
+
+  // Set to indicate the catch all is enabled.
   bool catch_all_enabled = 10;
+
+  // The catch all path, e.g. '/'.
   string catch_all = 11;
+
+  // Set to indicate the dynamic index is enabled, which will return a dynamic index page for the path if it exists.
   bool dynamic_index_enabled = 12;
 }
 
 message SaveHttpFileServerResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpRestApiServerRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The host to serve the API from.
   string host = 5;
+
+  // The port to serve the API from.
   int32 port = 6;
+
+  // Set to indicate the server is enabled.
   bool enabled = 7;
+
+  // Set to indicate the CORS is enabled.
   bool cors_enabled = 8;
+
+  // Set to indicate the API is a literal.
   bool is_literal = 9;
+
+  // The literal JSON to serve the API from.
   string literal_json = 10;
+
+  // The database ID to serve the API from.
   string database_id = 11;
+
+  // The SQL to execute for this node.
   string sql = 12;
+
+  // The parameters to inject into the SQL.
   repeated string parameter = 13;
 }
 
 message SaveHttpRestApiServerResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpRestApiNodeRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // Set to indicate the node is a literal.
   bool is_literal = 5;
+
+  // The literal JSON to serve the node from.
   string literal_json = 6;
+
+  // The database ID to serve the node from.
   string database_id = 7;
+
+  // The SQL to execute for this node.
   string sql = 8;
+
+  // The parameters to inject into the SQL.
   repeated string parameter = 9;
 }
 
 message SaveHttpRestApiNodeResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveSessionRequest {
+  // Details of the session to save.
   Session session = 1;
 }
 
@@ -4261,6 +4418,7 @@ message SaveSessionResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
 
+  // The updated session.
   Session session = 2;
 }
 
@@ -6970,6 +7128,32 @@ class VoltClient extends EventEmitter__default["default"] {
   WriteSynapsePath(request) {
     return unaryCallInternal.call(this, "WriteSynapsePath", request);
   }
+
+  HasSynapseBlob(request) {
+    return unaryCallInternal.call(this, "HasSynapseBlob", request);
+  }
+
+  PutSynapseBlob(request) {
+    const grpcClient = this.getVoltAPIClient();
+
+    const putBlobCall = new GRPCCall(
+      this,
+      "PutSynapseBlob",
+      "METHOD_TYPE_BIDI"
+    );
+    return putBlobCall.start(grpcClient, request);
+  }
+
+  GetSynapseBlob(request) {
+    const grpcClient = this.getVoltAPIClient();
+
+    const getBlobCall = new GRPCCall(
+      this,
+      "GetSynapseBlob",
+      "METHOD_TYPE_SERVER_STREAM"
+    );
+    return getBlobCall.start(grpcClient, request);
+  }
 }
 
 Object.defineProperty(exports, 'SyncProvider', {

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.20.27",
+  "version": "0.20.31",
   "description": "tdx Volt library for nodejs clients",
   "type": "module",
   "exports": {
@@ -33,8 +33,8 @@
   "author": "toby.ealden@gmail.com",
   "license": "ISC",
   "dependencies": {
-    "@tdxvolt/volt-client-web": "^0.20.27",
-    "@tdxvolt/volt-utility": "^0.20.27",
+    "@tdxvolt/volt-client-web": "^0.20.31",
+    "@tdxvolt/volt-utility": "^0.20.31",
     "debug": "^4.1.1",
     "ip": "^1.1.5",
     "jsonwebtoken": "^8.5.1",

package/src/volt-client.js

@@ -788,4 +788,30 @@ export class VoltClient extends EventEmitter {
   WriteSynapsePath(request) {
     return unaryCallInternal.call(this, "WriteSynapsePath", request);
   }
+
+  HasSynapseBlob(request) {
+    return unaryCallInternal.call(this, "HasSynapseBlob", request);
+  }
+
+  PutSynapseBlob(request) {
+    const grpcClient = this.getVoltAPIClient();
+
+    const putBlobCall = new GRPCCall(
+      this,
+      "PutSynapseBlob",
+      "METHOD_TYPE_BIDI"
+    );
+    return putBlobCall.start(grpcClient, request);
+  }
+
+  GetSynapseBlob(request) {
+    const grpcClient = this.getVoltAPIClient();
+
+    const getBlobCall = new GRPCCall(
+      this,
+      "GetSynapseBlob",
+      "METHOD_TYPE_SERVER_STREAM"
+    );
+    return getBlobCall.start(grpcClient, request);
+  }
 }

package/src/volt-proto-literals.js

@@ -215,6 +215,7 @@ service SqliteServerAPI {
   rpc CreateDatabase(CreateDatabaseRequest) returns (CreateDatabaseResponse);
 
   // Create or update a data view resource.
+  //Note that when creating a data view, the authenticated account must have access to the source database resource. For 'read-only' views that are \`SELECT\` only, this requires \`volt:database-read\` access to the source database. Any non-\`SELECT\` views require \`volt:database-write\` access to the source database.
   rpc SaveDataView(SaveDataViewRequest) returns (SaveDataViewResponse);
 }
 
@@ -993,6 +994,10 @@ message DeleteDIDRequest {
 
   // Optional passphrase of the DID controller key. Required if the key is encrypted.
   string key_passphrase = 3;
+
+  // When true and \`did\` is set, hard-delete the DID from the local registry without requiring controller keys or signatures, and without synchronising with other registries. Ignored when \`origin_volt\`.
+  // Requires \`volt:delete-did\` API privilege.
+  bool force = 4;
 }
 
 message DeleteDIDResponse {
@@ -1231,6 +1236,15 @@ service SyncAPI {
 
   // Revert a document in a sync database to a stored version.
   rpc RevertSyncDocumentVersion(RevertSyncDocumentVersionRequest) returns (RevertSyncDocumentVersionResponse);
+
+  // Check whether a content-addressed blob exists in a synapse.
+  rpc HasSynapseBlob(HasSynapseBlobRequest) returns (HasSynapseBlobResponse);
+
+  // Upload a content-addressed blob. The first message must be \`start\` with the expected sha256 (base64url) hash and size; subsequent messages carry payload chunks. Idempotent if the hash is already stored. The server verifies the received bytes match \`hash\` before committing.
+  rpc PutSynapseBlob(stream PutSynapseBlobRequest) returns (stream PutSynapseBlobResponse);
+
+  // Download a content-addressed blob by hash.
+  rpc GetSynapseBlob(GetSynapseBlobRequest) returns (stream GetSynapseBlobResponse);
 }
 
 message CreateSynapseConnectionRequest {
@@ -1398,36 +1412,31 @@ message SynapseDocumentMetadata {
   // The name of the top-level shared type in the document.
   string name = 1;
 
-  // The type of the shared type, e.g. "map", "array" or "text".
+  // The type of the document root. Yjs shared types are "map", "array" or "text". The "blob" type means the payload is a content-addressed object in the synapse blob store (PutSynapseBlob / GetSynapseBlob). There is no Yjs shared type for a blob document. A blob document's schema must be a single entry of type "blob"; it cannot be mixed with map, array, or text roots. The server writes \`__hash\` when the document is bound to a stored blob (see SetSynapseDocumentMetadata.blob_hash).
   string type = 2;
 
-  // The JSON schema that describes the data that is stored in this shared type.
+  // The JSON schema that describes the data stored in this shared type.
   string json_schema = 3;
 }
 
 message SetSynapseDocumentMetadataRequest {
-  // DEPRECATED: Use synapse_id instead.
-  string database_id = 1;
-
   // The id of the synapse that contains the document.
   string synapse_id = 5;
 
   // The id of the document to set the metadata for.
   string document_id = 2;
 
-  // The metadata to set for the document.
+  // The metadata to set for the document. Each entry names a top-level shared type (map/array/text). For a blob document this must contain exactly one entry with type "blob".
   repeated SynapseDocumentMetadata metadata = 3;
 
   // Any additional application-specific JSON to attach to the document.
   string json = 4;
 
-  // Set to true when the caller intends to write the document's content
-  // separately, after this metadata call (a metadata-first create). The sync
-  // server uses this to defer __hash bootstrapping until the content actually
-  // arrives, so the hash is not computed over an empty document. Leave false
-  // (the default) for empty documents or content-first flows where the content
-  // is already present.
-  bool content_pending = 6;
+  // Set to true when the document content is already present (content-first) or the document is intentionally empty, so the server bootstraps \`__hash\` immediately. Leave false (the default) when content will be written after this call.
+  bool content_ready = 6;
+
+  // For blob documents, the content hash to bind. The server verifies the blob is stored (or the hash is sha256 of empty bytes) and writes \`__hash\`. Omit for a metadata-first create. Must not be set for map/array/text documents; the server computes those hashes from Yjs content.
+  string blob_hash = 7;
 }
 
 message SetSynapseDocumentMetadataResponse {
@@ -1660,6 +1669,64 @@ message RevertSyncDocumentVersionResponse {
   string version_id = 2;
 }
 
+message HasSynapseBlobRequest {
+  // The id of the synapse that stores the blob.
+  string synapse_id = 1;
+
+  // sha256 of the raw file bytes, encoded as unpadded base64url (same family
+  // as VoltDrive content hashes).
+  string hash = 2;
+}
+
+message HasSynapseBlobResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // True if a blob with this hash is already stored.
+  bool exists = 2;
+}
+
+message PutSynapseBlobStart {
+  string synapse_id = 1;
+
+  // Expected sha256 (base64url) of the concatenated payload bytes.
+  string hash = 2;
+
+  // Total payload size in bytes. Zero means no blob row (empty file).
+  uint64 size = 3;
+}
+
+message PutSynapseBlobRequest {
+  oneof payload {
+    // Must be sent as the first message.
+    PutSynapseBlobStart start = 1;
+
+    // The next chunk of blob data.
+    bytes block = 2;
+  }
+}
+
+message PutSynapseBlobResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // Number of payload blocks received. Zero until the stream finishes.
+  uint32 ack = 2;
+
+  // True if the hash was already present (put is a no-op).
+  bool exists = 3;
+}
+
+message GetSynapseBlobRequest {
+  string synapse_id = 1;
+  string hash = 2;
+}
+
+message GetSynapseBlobResponse {
+  oneof payload {
+    bytes block = 1;
+    tdx.volt_api.volt.v1.Status status = 2;
+  }
+}
+
 `;
 export const terminal_api = `syntax = "proto3";
 
@@ -3560,41 +3627,41 @@ message SaveDatabaseResponse {
 }
 
 message SaveHttpForwarderRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The domain to forward requests to.
   string domain = 5;
+
+  // The host to forward requests to.
   string host = 6;
+
+  // The port to forward requests to.
   int32 port = 7;
+
+  // Set to indicate that the host header should reflect the proxy domain rather than the target host.
   bool forward_host = 8;
 
-  // Optional path prefix (e.g. "/myapp") for path-based forwarding. May be used
-  // on its own (path forwarding on the Volt's own host) or together with
-  // \`domain\` (sub-domain + path, e.g. sub.acme.com/myapp). At least one of
-  // \`domain\` or \`path\` must be set.
+  // Optional path prefix (e.g. "/myapp") for path-based forwarding. May be used on its own (path forwarding on the Volt's own host) or together with \`domain\` (sub-domain + path, e.g. sub.acme.com/myapp). At least one of \`domain\` or \`path\` must be set.
   string path = 9;
 
-  // When a \`path\` prefix is configured, controls whether that prefix is removed
-  // from the request path before forwarding (standard reverse-proxy behaviour).
-  // Defaults to true when unset: the target then receives the request at its
-  // own root (e.g. "/drive/assets/x.js" -> "/assets/x.js"), which suits plain
-  // static file servers and root-mounted backends. Set to false for targets
-  // that are themselves configured under the same sub-path and expect to
-  // receive the prefix. The \`X-Forwarded-Prefix\` header is always sent.
-  optional bool strip_path = 10;
-
-  // When true, incoming requests to this forwarder must carry a valid
-  // authenticated session (established via the OIDC sign-in flow) and pass the
-  // policy check before being proxied to the target. Unauthenticated requests
-  // are redirected to the configured OpenID Provider. The session is never
-  // exposed to the target (the session cookie is stripped before forwarding).
+  // When a \`path\` prefix is configured, keep that prefix on the request path when forwarding. The default (false) is standard reverse-proxy behaviour: the prefix is stripped so the target receives the request at its own root (e.g. "/drive/assets/x.js" -> "/assets/x.js"), which suits plain static file servers and root-mounted backends. Set to true for targets that are themselves configured under the same sub-path and expect to receive the prefix. The \`X-Forwarded-Prefix\` header is always sent.
+  bool keep_path = 10;
+
+  // When true, incoming HTTP requests to this forwarder must carry a valid authenticated session (established via the OIDC sign-in flow) and pass the policy check before being proxied, except for the public-path and manifest exceptions on \`auth_public_paths\`. Unauthenticated top-level document navigations are redirected to the configured OpenID Provider; other unauthenticated requests receive 401. An authenticated session that fails the policy check receives 403. The Volt session cookie is stripped from the HTTP hop to the target. WebSocket and SSE upgrades are not gated.
   bool auth_enabled = 11;
 
-  // OpenID Provider issuer URL used for discovery
-  // (\`<issuer>/.well-known/openid-configuration\`). May be a Volt acting as an
-  // OpenID Provider, or any external OIDC provider. Required when
-  // \`auth_enabled\` is set.
+  // OpenID Provider issuer URL used for discovery (\`<issuer>/.well-known/openid-configuration\`). May be a Volt acting as an OpenID Provider, or any external OIDC provider. Required when \`auth_enabled\` is set.
   string oidc_issuer = 12;
 
   // OAuth 2.0 client identifier registered with the OpenID Provider.
@@ -3606,36 +3673,45 @@ message SaveHttpForwarderRequest {
   // Space separated OAuth scopes. Defaults to "openid email" when empty.
   string oidc_scopes = 15;
 
-  // Optional override for the reserved callback path on the app host. Defaults
-  // to "/__volt-auth/oidc/callback".
+  // Optional override for the reserved callback path on the app host. Defaults to "/__volt-auth/oidc/callback".
   string oidc_redirect_path = 16;
 
-  // Email verification mode for OIDC-gated sign-in when the OpenID Provider is
-  // a Volt: "link" (default) or "code".
+  // Email verification mode for OIDC-gated sign-in when the OpenID Provider is a Volt: "code" (default) or "link".
   string email_verification_mode = 17;
+
+  // Effective-path patterns that may be fetched without a session (GET/HEAD). A trailing \`/*\` matches descendants on segment boundaries (e.g. \`/icon/*\`). Used for PWA icons and similar public chrome; the manifest itself is allowed via \`Sec-Fetch-Dest: manifest\` and does not need to be listed.
+  repeated string auth_public_paths = 18;
 }
 
 message SaveHttpForwarderResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveOidcClientRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
 
-  // Human-friendly name for the client (also used as resource name when the
-  // resource name is empty).
+  // Human-friendly name for the client (also used as resource name when the resource name is empty).
   string client_name = 5;
 
   // OAuth 2.0 client_id. Required.
   string client_id = 6;
 
-  // OAuth 2.0 client_secret. Stored encrypted and redacted on read. Only
-  // (re)written when non-empty so updates can omit it to keep the existing
-  // secret.
+  // OAuth 2.0 client_secret. Stored encrypted and redacted on read. Only (re)written when non-empty so updates can omit it to keep the existing secret.
   string client_secret = 7;
 
   // Comma- or space-separated list of allowed redirect URIs.
@@ -3643,69 +3719,150 @@ message SaveOidcClientRequest {
 }
 
 message SaveOidcClientResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpFileServerRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The path to serve files from.
   string path = 5;
+
+  // The host to serve files from.
   string host = 6;
+
+  // The port to serve files from.
   int32 port = 7;
+
+  // Set to indicate the server is enabled.
   bool enabled = 8;
+
+  // The cache timeout in seconds.
   int32 cache_timeout = 9;
+
+  // Set to indicate the catch all is enabled.
   bool catch_all_enabled = 10;
+
+  // The catch all path, e.g. '/'.
   string catch_all = 11;
+
+  // Set to indicate the dynamic index is enabled, which will return a dynamic index page for the path if it exists.
   bool dynamic_index_enabled = 12;
 }
 
 message SaveHttpFileServerResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpRestApiServerRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The host to serve the API from.
   string host = 5;
+
+  // The port to serve the API from.
   int32 port = 6;
+
+  // Set to indicate the server is enabled.
   bool enabled = 7;
+
+  // Set to indicate the CORS is enabled.
   bool cors_enabled = 8;
+
+  // Set to indicate the API is a literal.
   bool is_literal = 9;
+
+  // The literal JSON to serve the API from.
   string literal_json = 10;
+
+  // The database ID to serve the API from.
   string database_id = 11;
+
+  // The SQL to execute for this node.
   string sql = 12;
+
+  // The parameters to inject into the SQL.
   repeated string parameter = 13;
 }
 
 message SaveHttpRestApiServerResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpRestApiNodeRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // Set to indicate the node is a literal.
   bool is_literal = 5;
+
+  // The literal JSON to serve the node from.
   string literal_json = 6;
+
+  // The database ID to serve the node from.
   string database_id = 7;
+
+  // The SQL to execute for this node.
   string sql = 8;
+
+  // The parameters to inject into the SQL.
   repeated string parameter = 9;
 }
 
 message SaveHttpRestApiNodeResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveSessionRequest {
+  // Details of the session to save.
   Session session = 1;
 }
 
@@ -3713,6 +3870,7 @@ message SaveSessionResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
 
+  // The updated session.
   Session session = 2;
 }