@tdxvolt/volt-client-grpc 0.20.7 → 0.20.10

package/lib/index.cjs

@@ -15,6 +15,7 @@ var fs = require('fs');
 var path = require('path');
 var jwt = require('jsonwebtoken');
 var crypto = require('crypto');
+var voltUtility = require('@tdxvolt/volt-utility');
 
 function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
 
@@ -135,12 +136,14 @@ function createClient(
   address,
   credentials,
   noSerialise,
-  voltId,
-  serviceId
+  voltId = "",
+  serviceId = ""
 ) {
   let grpcCredentials;
   if (credentials) {
-    const relaying = !!credentials.config?.volt?.relay && !Array.isArray(credentials.config?.volt?.relay);
+    const relaying =
+      !!credentials.config?.volt?.relay &&
+      !Array.isArray(credentials.config?.volt?.relay);
     const ca = relaying
       ? credentials.config?.volt?.relay?.ca_pem
       : credentials.cache.ca;
@@ -1426,10 +1429,13 @@ message DIDRegistryUpdate {
 }
 
 message VerifiablePresentation {
-  // The credential JSON.
+  // DEPRECATED - use 'credential'
   string credential_json = 1;
 
-  // A signature of the credential JSON. The signature should usually be that of the credential subject.
+  // Array of credential JSON.
+  repeated string credential = 3;
+
+  // A signature of the credential JSON. The signature should be that of the credential holder over the concatenation of the contents of the \`credential\` array.
   string signature = 2;
 }
 
@@ -1593,7 +1599,7 @@ message ParseCredentialResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 
   // The parsed credential details.
-  VerifiableCredential verifiable_credential = 2;
+  repeated VerifiableCredential verifiable_credential = 2;
 }
 
 message ResolveDIDRequest {
@@ -1723,6 +1729,7 @@ enum SyncState {
   SYNC_STATE_SYNCING = 1;
   SYNC_STATE_DONE = 2;
   SYNC_STATE_UPDATE = 3;
+  SYNC_STATE_AWARENESS = 4;
 }
 
 message SyncDocumentStart {
@@ -1791,7 +1798,8 @@ message GetDocumentJSONResponse {
     // The current JSON snapshot of the document
     string json = 2;
   }
-}`;
+}
+`;
 const terminal_api = `syntax = "proto3";
 
 package tdx.volt_api.volt.v1;
@@ -2507,6 +2515,9 @@ message SessionCredential {
 
   // More type-specific data stored with the credential.
   string extra_2 = 16;
+
+  // The verification status of the credential.
+  string status = 17;
 }
 
 message Session {
@@ -2530,7 +2541,6 @@ message Session {
 
   SessionStatus status = 10;
 }
-
 `;
 const volt_api = `syntax = "proto3";
 
@@ -2541,7 +2551,7 @@ import "tdx/volt_api/volt/v1/remote.proto";
 import "tdx/volt_api/volt/v1/ssi.proto";
 import "tdx/volt_api/volt/v1/volt.proto";
 
-// The top-level volt management service. 
+// The top-level volt management service.
 // With the exception of \`Authenticate\`, all RPCs on this service must submit either a valid client certificate signed by the volt CA, or a signed JWT.
 // A client certificate can be obtained from the \`Authenticate\` method.
 // All methods include a \`tdx.volt_api.volt.v1.Status\` in the response. If the status contains a non-OK error code the client should assume the remainder of the message is invalid, unless otherwise indicated in the response documentation.
@@ -2732,7 +2742,7 @@ message AuthenticateResponse {
   // This should be persisted by the client, and submitted with all subsequent API calls as part of the call metadata.
   string session_id = 2;
 
-  // The identity id assigned to this authentication.
+  // The 'primary' session identity assigned to this authentication. This will be the DID in DID-based sessions, otherwise it will be the first email-based credential found, if any, otherwise it will be the public key fingerprint.
   string identity_did = 3;
 
   // A certificate issued by the volt CA, binding the request public key to the identity.
@@ -2788,6 +2798,9 @@ message CanAccessResourceResponse {
 
   // The policy decision for this access request.
   PolicyDecision decision = 6;
+
+  // The session that the access relates to.
+  string session_id = 7;
 }
 
 message  CheckCompatibilityRequest {
@@ -2901,9 +2914,19 @@ message ConnectResource {
   Resource resource = 2;
 }
 
+enum ConnectAuthRequestType {
+    CONNECT_AUTH_REQUEST_TYPE_UNKNOWN = 0;
+    CONNECT_AUTH_REQUEST_TYPE_NEW_SESSION = 1;
+    CONNECT_AUTH_REQUEST_TYPE_UPDATE_SESSION = 2;
+    CONNECT_AUTH_REQUEST_TYPE_DELETE_SESSION = 3;
+    CONNECT_AUTH_REQUEST_TYPE_SIGN_REQUEST = 4;
+}
+
 message ConnectAuthRequest {
   Session session = 1;
 
+  ConnectAuthRequestType request_type = 2;
+
   string context = 5;
 
   string challenge = 6;
@@ -3123,6 +3146,9 @@ message GetIdentityResponse {
 message GetOneTimeTokenRequest {
   // Optional token TTL, in seconds. Default is 10 seconds.
   int32 ttl = 1;
+
+  // Optional token context.
+  string context = 2;
 }
 
 message GetOneTimeTokenResponse {
@@ -3185,6 +3211,9 @@ message GetResourceResponse {
 message GetResourcesRequest {
   repeated string id = 1;
 
+  // Wildcards permitted.
+  repeated string alias = 16;
+
   // Wildcards permitted.
   repeated string name = 2;
 
@@ -3313,6 +3342,8 @@ message GetSessionsRequest {
   string identity_name = 3;
 
   SessionStatus status = 4;
+
+  string identity_email_id = 5;
 }
 
 message GetSessionsResponse {
@@ -4827,8 +4858,6 @@ class VoltConnection extends EventEmitter__default["default"] {
 
 const { publicKeyToPem: publicKeyToPem$1, removeCarriageReturn, signBase64 } = js.voltUtils;
 
-const { filter, pick } = lodash__default["default"];
-
 const log$2 = debug__default["default"]("volt-client-grpc:volt-client-internal");
 
 function issueAuthenticate(authenticateRequest, ttl) {
@@ -4842,13 +4871,18 @@ function issueAuthenticate(authenticateRequest, ttl) {
         return Promise.reject(new Error(authenticateResponse.status.message));
       } else {
         switch (authenticateResponse.decision) {
-          case "POLICY_DECISION_PERMIT": {
+          case "POLICY_DECISION_PERMIT":
+          case "POLICY_DECISION_PROMPT":
+          case "POLICY_DECISION_PENDING": {
             //
-            // The request status is permit => cache the bind response info.
+            // The request status is not deny => cache the bind response info.
             //
+            log$2("decision is %s", authenticateResponse.decision);
 
             // This is the certificate assigned to us by the volt.
-            this._credential.cache.cert = authenticateResponse.cert;
+            if (authenticateResponse.cert) {
+              this._credential.cache.cert = authenticateResponse.cert;
+            }
 
             // This is the signing CA used by the volt.
             this._credential.cache.ca = authenticateResponse.chain;
@@ -4862,12 +4896,20 @@ function issueAuthenticate(authenticateRequest, ttl) {
                 authenticateResponse.identity_did;
             }
 
+            // Maintain a unique list of verifiable credentials.
+            const uniqueVCs = new Map();
             this._credential.cache.vc = this._credential.cache.vc || [];
+            for (const existingVC of this._credential.cache.vc) {
+              uniqueVCs.set(existingVC.id, existingVC);
+            }
+
             for (const credential of authenticateResponse.credential) {
               const vc = JSON.parse(credential);
-              this._credential.cache.vc.push(vc);
+              uniqueVCs.set(vc.id, vc);
             }
 
+            this._credential.cache.vc = Array.from(uniqueVCs.values());
+
             this._credential.saveCache();
             break;
           }
@@ -4875,25 +4917,6 @@ function issueAuthenticate(authenticateRequest, ttl) {
             log$2(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
             break;
           }
-          case "POLICY_DECISION_PROMPT":
-          case "POLICY_DECISION_PENDING": {
-            log$2("access pending approval - waiting...");
-
-            // This is the signing CA used by the volt.
-            this._credential.cache.ca = authenticateResponse.chain;
-
-            // The session id is assigned by the volt.
-            this._credential.cache.session_id = authenticateResponse.session_id;
-
-            if (!this._credential.cache.identity_did) {
-              // Identity DID has been assigned by the volt.
-              this._credential.cache.identity_did =
-                authenticateResponse.identity_did;
-            }
-
-            this._credential.saveCache();
-            break;
-          }
           default:
             log$2(
               "ignoring unknown bind descision %s",
@@ -4907,16 +4930,12 @@ function issueAuthenticate(authenticateRequest, ttl) {
     });
 }
 
-function findDIDDocumentService(document, serviceType) {
-  if (!document.service) {
-    return [];
-  }
-
-  const matches = filter(document.service, (svc) => svc.type === serviceType);
-  return matches;
-}
-
-async function authenticateInternal(noDID = false, ownDID = false, exchangeToken = "") {
+async function authenticateInternal(
+  noDID = false,
+  ownDID = false,
+  exchangeToken = "",
+  waitForPermit = true
+) {
   try {
     if (!this._credential.cache.ca) {
       this._credential.cache.ca = this._voltConfig.ca_pem;
@@ -4947,6 +4966,27 @@ async function authenticateInternal(noDID = false, ownDID = false, exchangeToken
       host: this._credential.cache.bindIp
     };
 
+    if (this._credential.cache.vc?.length > 0) {
+      const presentation = {
+        credential: []
+      };
+
+      let presentationData = "";
+      for (let credential of this._credential.cache.vc) {
+        const vc = JSON.stringify(credential, null, 2);
+        log$2(vc);
+        presentation.credential.push(vc);
+        presentationData += vc;
+      }
+
+      presentation.signature = signBase64(
+        this._credential.cache.key,
+        presentationData
+      );
+
+      authenticateRequest.verifiable_presentation = [presentation];
+    }
+
     if (exchangeToken) {
       log$2("setting request exchange token");
       authenticateRequest.exchange_token = exchangeToken;
@@ -4958,9 +4998,7 @@ async function authenticateInternal(noDID = false, ownDID = false, exchangeToken
       log$2("setting request challenge code");
       authenticateRequest.challenge = this._credential.cache.challenge_code;
     } else {
-      log$2(
-        "no challenge code in request"
-      );
+      log$2("no challenge code in request");
     }
 
     if (noDID) {
@@ -5038,8 +5076,8 @@ async function authenticateInternal(noDID = false, ownDID = false, exchangeToken
       );
       log$2("authenticate decision: %s", decision);
     } while (
-      decision === "POLICY_DECISION_PROMPT" ||
-      decision === "POLICY_DECISION_PENDING"
+      decision === "POLICY_DECISION_PENDING" ||
+      (waitForPermit && decision === "POLICY_DECISION_PROMPT")
     );
 
     return decision === "POLICY_DECISION_PERMIT";
@@ -5154,7 +5192,11 @@ function getVoltAPIClientInternal() {
     const serviceAddress = this.isRelayed
       ? this._voltConfig.relay.address
       : this._voltConfig.address;
-    log$2("creating cached VoltAPI service client on %s", serviceAddress);
+    log$2(
+      "creating cached VoltAPI service client on %s for %j",
+      serviceAddress,
+      this._voltConfig
+    );
 
     const serviceDescriptors = getBuiltInServiceDescriptors();
 
@@ -5163,9 +5205,7 @@ function getVoltAPIClientInternal() {
       serviceDescriptors,
       serviceAddress,
       this._credential,
-      this.isRelayed,
-      this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
-      this._voltConfig?.relay?.cloud ? this._voltConfig.id : ""
+      this.isRelayed
     );
   }
 
@@ -5250,211 +5290,6 @@ function streamingCallInternal(methodType, method, request, service) {
   return call;
 }
 
-async function fetchVoltConfig(discovery_url) {
-  try {
-    const response = await fetch(discovery_url);
-
-    if (!response.ok) {
-      log$2("fetchVoltConfig - error [%s]", response.status);
-      return null;
-    }
-
-    const fullVoltConfig = await response.json();
-
-    if (!fullVoltConfig || typeof fullVoltConfig !== "object") {
-      log$2("fetchVoltConfig - invalid config resolved from: %s", discovery_url);
-      return null;
-    }
-
-    const voltConfig = pick(
-      fullVoltConfig,
-      "id",
-      "display_name",
-      "public_key",
-      "fingerprint",
-      "address",
-      "http_address",
-      "ca_pem",
-      "relay"
-    );
-
-    log$2("fetchVoltConfig from %s", discovery_url);
-
-    return voltConfig;
-  } catch (err) {
-    log$2("fetchVoltConfig - %s error [%s]", discovery_url, err.message);
-    return null;
-  }
-}
-
-async function fetchVoltConfigFromDIDInternal(volt_did, registryUrl) {
-  try {
-    const didResolution = getDIDResolutionURL(volt_did, registryUrl);
-    if (!didResolution) {
-      throw new Error(`Invalid Volt DID: ${volt_did}`);
-    }
-
-    const response = await fetch(didResolution);
-
-    if (!response.ok) {
-      throw new Error(`HTTP error, status: ${response.status}`);
-    }
-
-    const didDocument = await response.json();
-    const voltConfigServices = findDIDDocumentService(
-      didDocument,
-      constants.didServiceType.voltConfig
-    );
-    if (voltConfigServices.length !== 1) {
-      log$2(
-        "Unexpected number of Volt configuration endpoints found in DID document for %s, services found: %d",
-        volt_did,
-        voltConfigServices.length
-      );
-    }
-
-    log$2("resolved DID from %s", didResolution);
-
-    const serviceEndpoint = voltConfigServices[0].serviceEndpoint;
-    const voltConfig = await fetchVoltConfig.call(this, serviceEndpoint);
-    if (!voltConfig) {
-      throw new Error(`failed to resolve Volt config from ${serviceEndpoint}`);
-    }
-
-    return voltConfig;
-  } catch (err) {
-    throw new Error(
-      `Failure fetching Volt config from DID document ${volt_did}: ${err.message}`
-    );
-  }
-}
-
-async function fetchVoltConfigFromDID(volt_did, registryListIn) {
-  let registryList;
-  if (!registryListIn) {
-    //  If no registry list is provided, use the default registry list.
-    registryList = constants.defaultRegistryList;
-  } else {
-    // If a registry list is provided, merge it with the default registry list.
-    registryList = Array.from(
-      new Set(registryListIn.concat(constants.defaultRegistryList))
-    );
-  }
-
-  let voltConfig;
-  for (let registryUrl of registryList) {
-    try {
-      voltConfig = await fetchVoltConfigFromDIDInternal.call(
-        this,
-        volt_did,
-        registryUrl
-      );
-
-      // If we've found a config, break out of the loop.
-      break;
-    } catch (err) {
-      log$2("unable to fetch Volt config from %s: %s", registryUrl, err.message);
-    }
-  }
-
-  if (!voltConfig) {
-    log$2("failed to fetch Volt config for %s from any registry", volt_did);
-  }
-
-  return voltConfig;
-}
-
-async function resolveVoltConfig(cfg, didRegistryList) {
-  // Start by resolving the relay if one is specified.
-  let relay = cfg?.relay?.http_address || cfg?.relay;
-  if (relay) {
-    relay = await resolveVoltConfig.call(this, relay, didRegistryList);
-  }
-
-  let voltDID = "";
-  let voltHttpAddress = "";
-
-  if (typeof cfg === "string") {
-    // If the configuration is a string, determine if it is a DID or HTTP address.
-    if (cfg.indexOf("did:") === 0) {
-      voltDID = cfg;
-    } else {
-      voltHttpAddress = cfg;
-    }
-    cfg = {};
-  } else if (typeof cfg === "object") {
-    voltDID = cfg.id;
-    voltHttpAddress = cfg.http_address;
-  } else {
-    throw new Error("configuration is missing the 'volt' object");
-  }
-
-  let resolvedConfig;
-
-  if (relay) {
-    if (!voltDID) {
-      throw new Error("relay specified but no Volt DID provided");
-    }
-
-    // Build the sub-domain URL for the Volt discovery service by inserting the volt DID into the relay URL.
-    const relayURL = relay.http_address;
-    const relayParts = relayURL.split("://");
-    const subdomain = voltDID.substring(constants.voltDIDPrefix.length);
-    voltHttpAddress = `${relayParts[0]}://${subdomain}.${relayParts[1]}`;
-  } else if (voltDID) {
-    resolvedConfig = await fetchVoltConfigFromDID.call(
-      this,
-      voltDID,
-      didRegistryList
-    );
-  }
-
-  if (!resolvedConfig && voltHttpAddress) {
-    try {
-      resolvedConfig = await fetchVoltConfig.call(
-        this,
-        `${voltHttpAddress}/discover`
-      );
-
-      // Update the http address in the resolved config to the one we used to
-      // fetch it, since we may have used the relay rather than local address.
-      resolvedConfig.http_address = voltHttpAddress;
-    } catch (err) {
-      log$2(
-        "failed to resolve Volt configuration %s [%s]",
-        voltHttpAddress,
-        err.message
-      );
-    }
-  }
-
-  if (!resolvedConfig) {
-    if (cfg.address && cfg.ca_pem) {
-      log$2(
-        "unable to resolve %s / %s, using existing configuration",
-        voltDID,
-        voltHttpAddress
-      );
-    } else {
-      throw new Error(
-        `failed to resolve Volt ${voltDID} / ${voltHttpAddress} and no existing configuration`
-      );
-    }
-  } else {
-    log$2("resolved config from: %s", voltDID || voltHttpAddress);
-    log$2(JSON.stringify(resolvedConfig, null, 2));
-
-    cfg = {
-      ...cfg,
-      ...resolvedConfig
-    };
-  }
-
-  cfg.relay = relay;
-
-  return cfg;
-}
-
 /* eslint-disable no-underscore-dangle */
 
 const {
@@ -5710,9 +5545,16 @@ class VoltClient extends EventEmitter__default["default"] {
    * @param {boolean} [options.noDID] - whether to create a key-based authentication session
    * instead of a DID-based authentication session.
    * @param {string} [options.exchangeToken] - optional token to exchange in return for an authenticated session.
+   * @param {boolean} [options.waitForAuth] - whether to block and poll on 'prompt' authenticate decisions. Default is true.
    */
   async initialise(config, options = {}) {
-    const { ownDID, noDID, didRegistryList, exchangeToken, extraConfig } = options;
+    log("initialise ", config, options);
+
+    const { ownDID, noDID, didRegistryList, exchangeToken, extraConfig } =
+      options;
+    const waitForAuth =
+      options.waitForAuth === undefined ? true : !!options.waitForAuth;
+
     try {
       if (!config) {
         throw new Error(
@@ -5759,14 +5601,15 @@ class VoltClient extends EventEmitter__default["default"] {
         throw new Error("client_name property required in config");
       }
 
-      this._config.volt = await resolveVoltConfig.call(
-        this,
+      this._config.volt = await voltUtility.resolveVoltConfig(
         this._config.volt,
         didRegistryList
       );
 
       this._voltConfig = this._config.volt;
 
+      log("config is ", this._voltConfig);
+
       if (!this._voltConfig.id || typeof this._voltConfig.id !== "string") {
         throw new Error("'id' property is missing in Volt configuration");
       }
@@ -5798,7 +5641,13 @@ class VoltClient extends EventEmitter__default["default"] {
       } else {
         // No certificate present in the cache yet => we need to authenticate.
         try {
-          isBound = await authenticateInternal.call(this, noDID, ownDID, exchangeToken);
+          isBound = await authenticateInternal.call(
+            this,
+            noDID,
+            ownDID,
+            exchangeToken,
+            waitForAuth
+          );
         } catch (bindErr) {
           if (bindErr.message === "invalid arguments") {
             // This is usually the result of a missing challenge signature or credential.
@@ -6235,6 +6084,21 @@ class VoltClient extends EventEmitter__default["default"] {
     return call.start(grpcClient, request);
   }
 
+  /**
+   * TerminalAPI
+   */
+  CommandStream(request, service) {
+    const grpcClient = this.getVoltAPIClient();
+
+    const commandStreamCall = new GRPCCall(
+      this,
+      "CommandStream",
+      "METHOD_TYPE_BIDI",
+      service
+    );
+    return commandStreamCall.start(grpcClient, request);
+  }
+
   /**
    * WireAPI
    */

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.20.7",
+  "version": "0.20.10",
   "description": "tdx Volt library for nodejs clients",
   "type": "module",
   "exports": {
@@ -33,7 +33,8 @@
   "author": "toby.ealden@gmail.com",
   "license": "ISC",
   "dependencies": {
-    "@tdxvolt/volt-client-web": "^0.20.7",
+    "@tdxvolt/volt-client-web": "^0.20.10",
+    "@tdxvolt/volt-utility": "^0.20.10",
     "debug": "^4.1.1",
     "ip": "^1.1.5",
     "jsonwebtoken": "^8.5.1",
@@ -42,4 +43,4 @@
     "protobufjs": "^7.4.0",
     "uuid": "^8.1.0"
   }
-}
+}

package/src/grpc-utils.js

@@ -15,12 +15,14 @@ export function createClient(
   address,
   credentials,
   noSerialise,
-  voltId,
-  serviceId
+  voltId = "",
+  serviceId = ""
 ) {
   let grpcCredentials;
   if (credentials) {
-    const relaying = !!credentials.config?.volt?.relay && !Array.isArray(credentials.config?.volt?.relay);
+    const relaying =
+      !!credentials.config?.volt?.relay &&
+      !Array.isArray(credentials.config?.volt?.relay);
     const ca = relaying
       ? credentials.config?.volt?.relay?.ca_pem
       : credentials.cache.ca;

package/src/volt-client-internal.js

@@ -4,7 +4,6 @@ import debug from "debug";
 import ip from "ip";
 import lodash from "lodash";
 import { v4 as generateId } from "uuid";
-import { constants } from "./constants.js";
 import GRPCCall from "./grpc-call.js";
 import { createClient as createGrpcClient } from "./grpc-utils.js";
 import {
@@ -12,7 +11,6 @@ import {
   getServiceDescriptors
 } from "./proto-utils.js";
 import RpcInvocation from "./rpc-invocation.js";
-import * as voltUtils from "./utils.js";
 import VoltConnection from "./volt-connection.js";
 
 const { publicKeyToPem, removeCarriageReturn, signBase64 } = voltClientUtils;
@@ -32,13 +30,18 @@ function issueAuthenticate(authenticateRequest, ttl) {
         return Promise.reject(new Error(authenticateResponse.status.message));
       } else {
         switch (authenticateResponse.decision) {
-          case "POLICY_DECISION_PERMIT": {
+          case "POLICY_DECISION_PERMIT":
+          case "POLICY_DECISION_PROMPT":
+          case "POLICY_DECISION_PENDING": {
             //
-            // The request status is permit => cache the bind response info.
+            // The request status is not deny => cache the bind response info.
             //
+            log("decision is %s", authenticateResponse.decision);
 
             // This is the certificate assigned to us by the volt.
-            this._credential.cache.cert = authenticateResponse.cert;
+            if (authenticateResponse.cert) {
+              this._credential.cache.cert = authenticateResponse.cert;
+            }
 
             // This is the signing CA used by the volt.
             this._credential.cache.ca = authenticateResponse.chain;
@@ -52,12 +55,20 @@ function issueAuthenticate(authenticateRequest, ttl) {
                 authenticateResponse.identity_did;
             }
 
+            // Maintain a unique list of verifiable credentials.
+            const uniqueVCs = new Map();
             this._credential.cache.vc = this._credential.cache.vc || [];
+            for (const existingVC of this._credential.cache.vc) {
+              uniqueVCs.set(existingVC.id, existingVC);
+            }
+
             for (const credential of authenticateResponse.credential) {
               const vc = JSON.parse(credential);
-              this._credential.cache.vc.push(vc);
+              uniqueVCs.set(vc.id, vc);
             }
 
+            this._credential.cache.vc = Array.from(uniqueVCs.values());
+
             this._credential.saveCache();
             break;
           }
@@ -65,25 +76,6 @@ function issueAuthenticate(authenticateRequest, ttl) {
             log(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
             break;
           }
-          case "POLICY_DECISION_PROMPT":
-          case "POLICY_DECISION_PENDING": {
-            log("access pending approval - waiting...");
-
-            // This is the signing CA used by the volt.
-            this._credential.cache.ca = authenticateResponse.chain;
-
-            // The session id is assigned by the volt.
-            this._credential.cache.session_id = authenticateResponse.session_id;
-
-            if (!this._credential.cache.identity_did) {
-              // Identity DID has been assigned by the volt.
-              this._credential.cache.identity_did =
-                authenticateResponse.identity_did;
-            }
-
-            this._credential.saveCache();
-            break;
-          }
           default:
             log(
               "ignoring unknown bind descision %s",
@@ -97,16 +89,12 @@ function issueAuthenticate(authenticateRequest, ttl) {
     });
 }
 
-function findDIDDocumentService(document, serviceType) {
-  if (!document.service) {
-    return [];
-  }
-
-  const matches = filter(document.service, (svc) => svc.type === serviceType);
-  return matches;
-}
-
-export async function authenticateInternal(noDID = false, ownDID = false, exchangeToken = "") {
+export async function authenticateInternal(
+  noDID = false,
+  ownDID = false,
+  exchangeToken = "",
+  waitForPermit = true
+) {
   try {
     if (!this._credential.cache.ca) {
       this._credential.cache.ca = this._voltConfig.ca_pem;
@@ -137,6 +125,27 @@ export async function authenticateInternal(noDID = false, ownDID = false, exchan
       host: this._credential.cache.bindIp
     };
 
+    if (this._credential.cache.vc?.length > 0) {
+      const presentation = {
+        credential: []
+      };
+
+      let presentationData = "";
+      for (let credential of this._credential.cache.vc) {
+        const vc = JSON.stringify(credential, null, 2);
+        log(vc);
+        presentation.credential.push(vc);
+        presentationData += vc;
+      }
+
+      presentation.signature = signBase64(
+        this._credential.cache.key,
+        presentationData
+      );
+
+      authenticateRequest.verifiable_presentation = [presentation];
+    }
+
     if (exchangeToken) {
       log("setting request exchange token");
       authenticateRequest.exchange_token = exchangeToken;
@@ -148,9 +157,7 @@ export async function authenticateInternal(noDID = false, ownDID = false, exchan
       log("setting request challenge code");
       authenticateRequest.challenge = this._credential.cache.challenge_code;
     } else {
-      log(
-        "no challenge code in request"
-      );
+      log("no challenge code in request");
     }
 
     if (noDID) {
@@ -228,8 +235,8 @@ export async function authenticateInternal(noDID = false, ownDID = false, exchan
       );
       log("authenticate decision: %s", decision);
     } while (
-      decision === "POLICY_DECISION_PROMPT" ||
-      decision === "POLICY_DECISION_PENDING"
+      decision === "POLICY_DECISION_PENDING" ||
+      (waitForPermit && decision === "POLICY_DECISION_PROMPT")
     );
 
     return decision === "POLICY_DECISION_PERMIT";
@@ -344,7 +351,11 @@ export function getVoltAPIClientInternal() {
     const serviceAddress = this.isRelayed
       ? this._voltConfig.relay.address
       : this._voltConfig.address;
-    log("creating cached VoltAPI service client on %s", serviceAddress);
+    log(
+      "creating cached VoltAPI service client on %s for %j",
+      serviceAddress,
+      this._voltConfig
+    );
 
     const serviceDescriptors = getBuiltInServiceDescriptors();
 
@@ -353,9 +364,7 @@ export function getVoltAPIClientInternal() {
       serviceDescriptors,
       serviceAddress,
       this._credential,
-      this.isRelayed,
-      this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
-      this._voltConfig?.relay?.cloud ? this._voltConfig.id : ""
+      this.isRelayed
     );
   }
 
@@ -439,208 +448,3 @@ export function streamingCallInternal(methodType, method, request, service) {
 
   return call;
 }
-
-export async function fetchVoltConfig(discovery_url) {
-  try {
-    const response = await fetch(discovery_url);
-
-    if (!response.ok) {
-      log("fetchVoltConfig - error [%s]", response.status);
-      return null;
-    }
-
-    const fullVoltConfig = await response.json();
-
-    if (!fullVoltConfig || typeof fullVoltConfig !== "object") {
-      log("fetchVoltConfig - invalid config resolved from: %s", discovery_url);
-      return null;
-    }
-
-    const voltConfig = pick(
-      fullVoltConfig,
-      "id",
-      "display_name",
-      "public_key",
-      "fingerprint",
-      "address",
-      "http_address",
-      "ca_pem",
-      "relay"
-    );
-
-    log("fetchVoltConfig from %s", discovery_url);
-
-    return voltConfig;
-  } catch (err) {
-    log("fetchVoltConfig - %s error [%s]", discovery_url, err.message);
-    return null;
-  }
-}
-
-async function fetchVoltConfigFromDIDInternal(volt_did, registryUrl) {
-  try {
-    const didResolution = voltUtils.getDIDResolutionURL(volt_did, registryUrl);
-    if (!didResolution) {
-      throw new Error(`Invalid Volt DID: ${volt_did}`);
-    }
-
-    const response = await fetch(didResolution);
-
-    if (!response.ok) {
-      throw new Error(`HTTP error, status: ${response.status}`);
-    }
-
-    const didDocument = await response.json();
-    const voltConfigServices = findDIDDocumentService(
-      didDocument,
-      constants.didServiceType.voltConfig
-    );
-    if (voltConfigServices.length !== 1) {
-      log(
-        "Unexpected number of Volt configuration endpoints found in DID document for %s, services found: %d",
-        volt_did,
-        voltConfigServices.length
-      );
-    }
-
-    log("resolved DID from %s", didResolution);
-
-    const serviceEndpoint = voltConfigServices[0].serviceEndpoint;
-    const voltConfig = await fetchVoltConfig.call(this, serviceEndpoint);
-    if (!voltConfig) {
-      throw new Error(`failed to resolve Volt config from ${serviceEndpoint}`);
-    }
-
-    return voltConfig;
-  } catch (err) {
-    throw new Error(
-      `Failure fetching Volt config from DID document ${volt_did}: ${err.message}`
-    );
-  }
-}
-
-export async function fetchVoltConfigFromDID(volt_did, registryListIn) {
-  let registryList;
-  if (!registryListIn) {
-    //  If no registry list is provided, use the default registry list.
-    registryList = constants.defaultRegistryList;
-  } else {
-    // If a registry list is provided, merge it with the default registry list.
-    registryList = Array.from(
-      new Set(registryListIn.concat(constants.defaultRegistryList))
-    );
-  }
-
-  let voltConfig;
-  for (let registryUrl of registryList) {
-    try {
-      voltConfig = await fetchVoltConfigFromDIDInternal.call(
-        this,
-        volt_did,
-        registryUrl
-      );
-
-      // If we've found a config, break out of the loop.
-      break;
-    } catch (err) {
-      log("unable to fetch Volt config from %s: %s", registryUrl, err.message);
-    }
-  }
-
-  if (!voltConfig) {
-    log("failed to fetch Volt config for %s from any registry", volt_did);
-  }
-
-  return voltConfig;
-}
-
-export async function resolveVoltConfig(cfg, didRegistryList) {
-  // Start by resolving the relay if one is specified.
-  let relay = cfg?.relay?.http_address || cfg?.relay;
-  if (relay) {
-    relay = await resolveVoltConfig.call(this, relay, didRegistryList);
-  }
-
-  let voltDID = "";
-  let voltHttpAddress = "";
-
-  if (typeof cfg === "string") {
-    // If the configuration is a string, determine if it is a DID or HTTP address.
-    if (cfg.indexOf("did:") === 0) {
-      voltDID = cfg;
-    } else {
-      voltHttpAddress = cfg;
-    }
-    cfg = {};
-  } else if (typeof cfg === "object") {
-    voltDID = cfg.id;
-    voltHttpAddress = cfg.http_address;
-  } else {
-    throw new Error("configuration is missing the 'volt' object");
-  }
-
-  let resolvedConfig;
-
-  if (relay) {
-    if (!voltDID) {
-      throw new Error("relay specified but no Volt DID provided");
-    }
-
-    // Build the sub-domain URL for the Volt discovery service by inserting the volt DID into the relay URL.
-    const relayURL = relay.http_address;
-    const relayParts = relayURL.split("://");
-    const subdomain = voltDID.substring(constants.voltDIDPrefix.length);
-    voltHttpAddress = `${relayParts[0]}://${subdomain}.${relayParts[1]}`;
-  } else if (voltDID) {
-    resolvedConfig = await fetchVoltConfigFromDID.call(
-      this,
-      voltDID,
-      didRegistryList
-    );
-  }
-
-  if (!resolvedConfig && voltHttpAddress) {
-    try {
-      resolvedConfig = await fetchVoltConfig.call(
-        this,
-        `${voltHttpAddress}/discover`
-      );
-
-      // Update the http address in the resolved config to the one we used to
-      // fetch it, since we may have used the relay rather than local address.
-      resolvedConfig.http_address = voltHttpAddress;
-    } catch (err) {
-      log(
-        "failed to resolve Volt configuration %s [%s]",
-        voltHttpAddress,
-        err.message
-      );
-    }
-  }
-
-  if (!resolvedConfig) {
-    if (cfg.address && cfg.ca_pem) {
-      log(
-        "unable to resolve %s / %s, using existing configuration",
-        voltDID,
-        voltHttpAddress
-      );
-    } else {
-      throw new Error(
-        `failed to resolve Volt ${voltDID} / ${voltHttpAddress} and no existing configuration`
-      );
-    }
-  } else {
-    log("resolved config from: %s", voltDID || voltHttpAddress);
-    log(JSON.stringify(resolvedConfig, null, 2));
-
-    cfg = {
-      ...cfg,
-      ...resolvedConfig
-    };
-  }
-
-  cfg.relay = relay;
-
-  return cfg;
-}

package/src/volt-client.js

@@ -7,11 +7,11 @@ import {
   authenticateInternal,
   connectInternal,
   getVoltAPIClientInternal,
-  resolveVoltConfig,
   streamingCallInternal,
   unaryCallInternal
 } from "./volt-client-internal.js";
 import { VoltCredential } from "./volt-credential.js";
+import { resolveVoltConfig } from "@tdxvolt/volt-utility";
 
 const { readFile } = fs.promises;
 const log = debug("volt-client-grpc:volt-client");
@@ -85,9 +85,16 @@ export class VoltClient extends EventEmitter {
    * @param {boolean} [options.noDID] - whether to create a key-based authentication session
    * instead of a DID-based authentication session.
    * @param {string} [options.exchangeToken] - optional token to exchange in return for an authenticated session.
+   * @param {boolean} [options.waitForAuth] - whether to block and poll on 'prompt' authenticate decisions. Default is true.
    */
   async initialise(config, options = {}) {
-    const { ownDID, noDID, didRegistryList, exchangeToken, extraConfig } = options;
+    log("initialise ", config, options);
+
+    const { ownDID, noDID, didRegistryList, exchangeToken, extraConfig } =
+      options;
+    const waitForAuth =
+      options.waitForAuth === undefined ? true : !!options.waitForAuth;
+
     try {
       if (!config) {
         throw new Error(
@@ -134,14 +141,15 @@ export class VoltClient extends EventEmitter {
         throw new Error("client_name property required in config");
       }
 
-      this._config.volt = await resolveVoltConfig.call(
-        this,
+      this._config.volt = await resolveVoltConfig(
         this._config.volt,
         didRegistryList
       );
 
       this._voltConfig = this._config.volt;
 
+      log("config is ", this._voltConfig);
+
       if (!this._voltConfig.id || typeof this._voltConfig.id !== "string") {
         throw new Error("'id' property is missing in Volt configuration");
       }
@@ -173,7 +181,13 @@ export class VoltClient extends EventEmitter {
       } else {
         // No certificate present in the cache yet => we need to authenticate.
         try {
-          isBound = await authenticateInternal.call(this, noDID, ownDID, exchangeToken);
+          isBound = await authenticateInternal.call(
+            this,
+            noDID,
+            ownDID,
+            exchangeToken,
+            waitForAuth
+          );
         } catch (bindErr) {
           if (bindErr.message === "invalid arguments") {
             // This is usually the result of a missing challenge signature or credential.
@@ -612,6 +626,21 @@ export class VoltClient extends EventEmitter {
     return call.start(grpcClient, request);
   }
 
+  /**
+   * TerminalAPI
+   */
+  CommandStream(request, service) {
+    const grpcClient = this.getVoltAPIClient();
+
+    const commandStreamCall = new GRPCCall(
+      this,
+      "CommandStream",
+      "METHOD_TYPE_BIDI",
+      service
+    );
+    return commandStreamCall.start(grpcClient, request);
+  }
+
   /**
    * WireAPI
    */

package/src/volt-proto-literals.js

@@ -881,10 +881,13 @@ message DIDRegistryUpdate {
 }
 
 message VerifiablePresentation {
-  // The credential JSON.
+  // DEPRECATED - use 'credential'
   string credential_json = 1;
 
-  // A signature of the credential JSON. The signature should usually be that of the credential subject.
+  // Array of credential JSON.
+  repeated string credential = 3;
+
+  // A signature of the credential JSON. The signature should be that of the credential holder over the concatenation of the contents of the \`credential\` array.
   string signature = 2;
 }
 
@@ -1048,7 +1051,7 @@ message ParseCredentialResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 
   // The parsed credential details.
-  VerifiableCredential verifiable_credential = 2;
+  repeated VerifiableCredential verifiable_credential = 2;
 }
 
 message ResolveDIDRequest {
@@ -1178,6 +1181,7 @@ enum SyncState {
   SYNC_STATE_SYNCING = 1;
   SYNC_STATE_DONE = 2;
   SYNC_STATE_UPDATE = 3;
+  SYNC_STATE_AWARENESS = 4;
 }
 
 message SyncDocumentStart {
@@ -1246,7 +1250,8 @@ message GetDocumentJSONResponse {
     // The current JSON snapshot of the document
     string json = 2;
   }
-}`;
+}
+`;
 export const terminal_api = `syntax = "proto3";
 
 package tdx.volt_api.volt.v1;
@@ -1962,6 +1967,9 @@ message SessionCredential {
 
   // More type-specific data stored with the credential.
   string extra_2 = 16;
+
+  // The verification status of the credential.
+  string status = 17;
 }
 
 message Session {
@@ -1985,7 +1993,6 @@ message Session {
 
   SessionStatus status = 10;
 }
-
 `;
 export const volt_api = `syntax = "proto3";
 
@@ -1996,7 +2003,7 @@ import "tdx/volt_api/volt/v1/remote.proto";
 import "tdx/volt_api/volt/v1/ssi.proto";
 import "tdx/volt_api/volt/v1/volt.proto";
 
-// The top-level volt management service. 
+// The top-level volt management service.
 // With the exception of \`Authenticate\`, all RPCs on this service must submit either a valid client certificate signed by the volt CA, or a signed JWT.
 // A client certificate can be obtained from the \`Authenticate\` method.
 // All methods include a \`tdx.volt_api.volt.v1.Status\` in the response. If the status contains a non-OK error code the client should assume the remainder of the message is invalid, unless otherwise indicated in the response documentation.
@@ -2187,7 +2194,7 @@ message AuthenticateResponse {
   // This should be persisted by the client, and submitted with all subsequent API calls as part of the call metadata.
   string session_id = 2;
 
-  // The identity id assigned to this authentication.
+  // The 'primary' session identity assigned to this authentication. This will be the DID in DID-based sessions, otherwise it will be the first email-based credential found, if any, otherwise it will be the public key fingerprint.
   string identity_did = 3;
 
   // A certificate issued by the volt CA, binding the request public key to the identity.
@@ -2243,6 +2250,9 @@ message CanAccessResourceResponse {
 
   // The policy decision for this access request.
   PolicyDecision decision = 6;
+
+  // The session that the access relates to.
+  string session_id = 7;
 }
 
 message  CheckCompatibilityRequest {
@@ -2356,9 +2366,19 @@ message ConnectResource {
   Resource resource = 2;
 }
 
+enum ConnectAuthRequestType {
+    CONNECT_AUTH_REQUEST_TYPE_UNKNOWN = 0;
+    CONNECT_AUTH_REQUEST_TYPE_NEW_SESSION = 1;
+    CONNECT_AUTH_REQUEST_TYPE_UPDATE_SESSION = 2;
+    CONNECT_AUTH_REQUEST_TYPE_DELETE_SESSION = 3;
+    CONNECT_AUTH_REQUEST_TYPE_SIGN_REQUEST = 4;
+}
+
 message ConnectAuthRequest {
   Session session = 1;
 
+  ConnectAuthRequestType request_type = 2;
+
   string context = 5;
 
   string challenge = 6;
@@ -2578,6 +2598,9 @@ message GetIdentityResponse {
 message GetOneTimeTokenRequest {
   // Optional token TTL, in seconds. Default is 10 seconds.
   int32 ttl = 1;
+
+  // Optional token context.
+  string context = 2;
 }
 
 message GetOneTimeTokenResponse {
@@ -2640,6 +2663,9 @@ message GetResourceResponse {
 message GetResourcesRequest {
   repeated string id = 1;
 
+  // Wildcards permitted.
+  repeated string alias = 16;
+
   // Wildcards permitted.
   repeated string name = 2;
 
@@ -2768,6 +2794,8 @@ message GetSessionsRequest {
   string identity_name = 3;
 
   SessionStatus status = 4;
+
+  string identity_email_id = 5;
 }
 
 message GetSessionsResponse {