@knowttl/technitium-axi 0.0.0-stage → 0.1.1

package/dist/reads.js

@@ -0,0 +1,350 @@
+import { createHash } from 'node:crypto';
+import { ToolError } from './errors.js';
+import { readContracts } from './read-contracts.js';
+import { checkStatus, vendorRequest } from './vendor.js';
+import { validateNode } from './routing.js';
+const invalid = () => { throw new ToolError('UPSTREAM_INVALID', 'Unexpected server response fields or types', 'Check the selected server API version and operation', 1); };
+const usage = (message) => { throw new ToolError('USAGE', message, 'Run the selected command with --help'); };
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const sensitive = /password|secret|^token$|^privateKey$|^stackTrace$|^innerError/i;
+export function readInputs(contract, options) {
+    validateNode(contract.id, options['--node']);
+    const form = new URLSearchParams();
+    const headers = {};
+    for (const parameter of contract.parameters) {
+        const value = options[parameter.flag];
+        if (value === undefined) {
+            if (parameter.required)
+                usage(`Missing ${parameter.flag}`);
+            continue;
+        }
+        if (parameter.required && value === '')
+            usage(`Missing ${parameter.flag}`);
+        if (parameter.type === 'boolean' && !['true', 'false'].includes(value))
+            usage(`${parameter.flag} requires true or false`);
+        if (parameter.type === 'integer' && (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < (parameter.name === 'limit' ? 0 : 1) || Number(value) > 2147483647))
+            usage(`${parameter.flag} requires a bounded integer`);
+        if (parameter.values && !parameter.values.includes(value))
+            usage(`Invalid value for ${parameter.flag}`);
+        if (parameter.type === 'http-date' && (Number.isNaN(Date.parse(value)) || new Date(value).toUTCString() !== value))
+            usage(`${parameter.flag} requires an RFC 1123 GMT date`);
+        if (parameter.type === 'date' && (!/^\d{4}-\d\d-\d\dT/.test(value) || Number.isNaN(Date.parse(value))))
+            usage(`${parameter.flag} requires an ISO 8601 date time`);
+        if (parameter.type === 'zone-list' && value && value.split(',').some(zone => !/^(?=.{1,253}$)[\p{L}\p{N}_*-]+(?:\.[\p{L}\p{N}_*-]+)*\.?$/u.test(zone)))
+            usage(`${parameter.flag} requires comma-separated zone names`);
+        if (contract.id === 'OP-135' && parameter.name === 'fileName' && (/[\\/]/.test(value) || value === '.' || value === '..'))
+            usage('--file-name requires a log filename without a path');
+        if (/[\x00-\x1f\x7f]/.test(value) || value.length > 65536)
+            usage(`Invalid value for ${parameter.flag}`);
+        if (parameter.location === 'header')
+            headers[parameter.name] = value;
+        else
+            form.set(parameter.name, value);
+    }
+    return { form, headers };
+}
+// Fields the contract does not list are dropped; `omitted` collects them (indexes folded to []) so the caller can report incompleteness.
+function project(value, shape, nullable = false, path = 'response', omitted) {
+    if (typeof shape === 'string') {
+        if (shape === 'unknown')
+            return null;
+        if (shape === 'json')
+            return value;
+        if (shape === 'nullable') {
+            if (value !== null && typeof value !== 'string')
+                invalid();
+        }
+        else if (shape === 'nullable-number') {
+            if (value !== null && typeof value !== 'number')
+                invalid();
+        }
+        else if (shape === 'string-or-number') {
+            // Protocol and flags vary between numeric data and enum names across record families.
+            if (typeof value !== 'string' && typeof value !== 'number')
+                invalid();
+        }
+        else if (typeof value !== shape)
+            invalid();
+        return value;
+    }
+    if ('array' in shape) {
+        if (!Array.isArray(value))
+            return invalid();
+        const itemShape = shape.array;
+        return value.map(item => {
+            if (record(itemShape) && !('array' in itemShape)) {
+                if (!record(item))
+                    return invalid();
+                const identity = ['name', 'rowNumber', 'fileName', 'username', 'section', 'scope', 'keyTag'].find(key => Object.hasOwn(itemShape, key));
+                if (identity && !Object.hasOwn(item, identity))
+                    return invalid();
+            }
+            return project(item, itemShape, false, `${path}[]`, omitted);
+        });
+    }
+    if (value === null && nullable)
+        return null;
+    if (!record(value))
+        return invalid();
+    if (Object.hasOwn(shape, 'canView') && ['canView', 'canModify', 'canDelete'].some(key => !Object.hasOwn(value, key)))
+        invalid();
+    if (omitted) {
+        const dropped = Object.keys(value).filter(key => !Object.hasOwn(shape, key) && !sensitive.test(key));
+        if (dropped.length)
+            omitted[path] = new Set([...omitted[path] ?? [], ...dropped]);
+    }
+    return Object.fromEntries(Object.entries(shape).filter(([key]) => !sensitive.test(key) && Object.hasOwn(value, key))
+        .map(([key, field]) => [key, project(value[key], field, key === 'proxy', `${path}.${key}`, omitted)]));
+}
+const listKeys = {
+    'OP-020': 'zones', 'OP-021': 'catalogZoneNames', 'OP-037': 'dsRecords', 'OP-038': 'dnssecPrivateKeys',
+    'OP-050': 'records', 'OP-053': 'zones', 'OP-056': 'zones', 'OP-062': 'zones', 'OP-068': 'apps',
+    'OP-069': 'storeApps', 'OP-081': 'tsigKeyNames', 'OP-086': 'leases', 'OP-090': 'scopes',
+    'OP-098': 'sessions', 'OP-101': 'users', 'OP-106': 'groups', 'OP-111': 'permissions',
+    'OP-134': 'logFiles', 'OP-138': 'entries',
+};
+export async function readOperation(profile, command, token, options, full) {
+    const contract = readContracts.find(item => item.command === command);
+    const { form, headers } = readInputs(contract, options);
+    const listKey = listKeys[contract.id];
+    const listShape = listKey ? contract.response[listKey] : undefined;
+    const rowShape = listShape && typeof listShape === 'object' && 'array' in listShape ? listShape.array : undefined;
+    const fieldShape = rowShape && typeof rowShape === 'object' ? rowShape : contract.response;
+    const fields = options['--fields']?.split(',');
+    if (fields && (new Set(fields).size !== fields.length || fields.some(field => !Object.hasOwn(fieldShape, field) || sensitive.test(field))))
+        usage('Unknown or repeated output field');
+    const cap = (flag, fallback, maximum) => {
+        const raw = options[flag];
+        if (raw === undefined)
+            return fallback;
+        if (!/^[1-9]\d*$/.test(raw) || Number(raw) > maximum)
+            usage(`${flag} requires an integer from 1 to ${maximum}`);
+        return Number(raw);
+    };
+    const byteCap = cap('--max-bytes', 16 * 1024 * 1024, 64 * 1024 * 1024);
+    const requestCap = cap('--max-requests', 12, 100);
+    const pageCap = cap('--max-pages', 10, 100);
+    const elapsedCap = cap('--max-elapsed-ms', 30000, 120000);
+    const started = Date.now();
+    let requests = 0;
+    let bytesRead = 0;
+    const request = async () => {
+        let response;
+        for (let attempt = 0; attempt < 2; attempt++) {
+            if (++requests > requestCap || Date.now() - started >= elapsedCap)
+                throw new ToolError('READ_LIMIT', 'Read request or elapsed cap reached', 'Resume with narrower filters or a larger bounded cap', 1);
+            response = await vendorRequest(profile, contract.path, form.toString(), token, headers, { bytes: byteCap - bytesRead, elapsedMs: elapsedCap - (Date.now() - started) });
+            bytesRead += response.bytes.length;
+            if (![429, 502, 503, 504].includes(response.status) || profile.tokenKind === 'single-use' || attempt || requests === requestCap)
+                break;
+            // Never ignore server backoff. Retry only immediate transient reads; return longer guidance.
+            if (response.retryAfter && response.retryAfter !== '0')
+                break;
+        }
+        if (response.status !== 200) {
+            const code = response.status === 401 ? 'AUTH_REQUIRED' : response.status === 403 ? 'PERMISSION_DENIED'
+                : response.status === 404 ? 'UNSUPPORTED_OPERATION' : response.status === 429 ? 'RATE_LIMITED' : 'UPSTREAM_HTTP';
+            const backoff = response.retryAfter;
+            const hint = backoff && /^\d{1,9}$/.test(backoff) ? `Retry after ${backoff} seconds` : 'Check the selected server version, credential and permissions';
+            throw new ToolError(code, 'Server rejected the read', hint, 1);
+        }
+        return response;
+    };
+    const paged = ['OP-020', 'OP-138'].includes(contract.id);
+    const pageSizeField = contract.id === 'OP-020' ? 'zonesPerPage' : 'entriesPerPage';
+    if (paged) {
+        if (!form.has('pageNumber'))
+            form.set('pageNumber', '1');
+        if (!form.has(pageSizeField))
+            form.set(pageSizeField, '100');
+    }
+    const response = await request();
+    const metadata = { bytes: response.bytes.length, contentType: response.contentType,
+        sha256: createHash('sha256').update(response.bytes).digest('hex'),
+        ...(contract.id === 'OP-125' ? { lastModified: response.lastModified } : {}) };
+    if (contract.kind !== 'json') {
+        if (response.contentType === 'application/json' || /^\s*\{\s*"(?:status|errorMessage)"\s*:/.test(response.bytes.toString('utf8', 0, 64))) {
+            let value;
+            try {
+                value = JSON.parse(response.bytes.toString('utf8'));
+            }
+            catch {
+                invalid();
+            }
+            checkStatus(value);
+            invalid();
+        }
+        if (contract.id === 'OP-125' && (!response.lastModified || Number.isNaN(Date.parse(response.lastModified)) || new Date(response.lastModified).toUTCString() !== response.lastModified))
+            invalid();
+        const expected = contract.kind === 'zip' ? ['application/zip', 'application/octet-stream']
+            : contract.kind === 'csv' ? ['text/csv', 'text/plain', 'application/octet-stream'] : ['text/plain', 'application/octet-stream'];
+        if (!expected.includes(response.contentType))
+            invalid();
+        if (contract.kind === 'zip' && (!response.bytes.subarray(0, 2).equals(Buffer.from('PK')) || response.bytes.length < 22))
+            invalid();
+        return { bytes: response.bytes, projection: { status: 'ok', operation: contract.id, ...metadata,
+                ...(contract.kind === 'prometheus-text' ? { text: response.bytes.toString('utf8').slice(0, full ? 100000 : 1000),
+                    complete: response.bytes.length <= (full ? 100000 : 1000) } : {}) } };
+    }
+    const decode = (bytes) => {
+        let value;
+        try {
+            value = JSON.parse(bytes.toString('utf8'));
+        }
+        catch {
+            invalid();
+        }
+        checkStatus(value);
+        if (contract.id === 'OP-078') {
+            if (typeof value.server !== 'string')
+                return invalid();
+            return value;
+        }
+        if (!record(value.response))
+            return invalid();
+        const payload = value.response;
+        if (contract.id === 'OP-015' && (!record(payload.lifetimeCounters) || typeof payload.uptimeSeconds !== 'number'))
+            invalid();
+        if (contract.id === 'OP-075' && payload.config !== null && typeof payload.config !== 'string')
+            invalid();
+        const required = contract.id === 'OP-018' ? ({ TopClients: 'topClients', TopDomains: 'topDomains', TopBlockedDomains: 'topBlockedDomains' }[form.get('statsType')])
+            : listKeys[contract.id] ?? Object.keys(contract.response)[0];
+        if (required && !Object.hasOwn(payload, required))
+            invalid();
+        return payload;
+    };
+    if (response.contentType !== 'application/json')
+        invalid();
+    const payload = decode(response.bytes);
+    if (contract.id === 'OP-075')
+        return { bytes: response.bytes, projection: { status: 'ok', operation: contract.id, ...metadata } };
+    let pages = 1;
+    let complete = true;
+    let continuation;
+    let stoppedBy;
+    if (paged && listKey) {
+        const validPage = (value, page) => Array.isArray(value[listKey]) &&
+            (value.pageNumber === page || (contract.id === 'OP-020' && value.pageNumber === 0 &&
+                value.totalPages === 0 && value.totalZones === 0 && value[listKey].length === 0));
+        if (!validPage(payload, Number(form.get('pageNumber'))))
+            invalid();
+        const identity = (row) => {
+            if (!record(row) || (contract.id === 'OP-020' ? typeof row.name !== 'string' : !Number.isSafeInteger(row.rowNumber)))
+                return invalid();
+            return JSON.stringify(contract.id === 'OP-020' ? row.name : row.rowNumber);
+        };
+        const rows = [];
+        const seen = new Set();
+        for (const row of payload[listKey]) {
+            const key = identity(row);
+            if (!seen.has(key)) {
+                seen.add(key);
+                rows.push(row);
+            }
+        }
+        payload[listKey] = rows;
+        let page = Number(form.get('pageNumber'));
+        const hasNext = (value) => {
+            if (value.totalPages !== undefined && (!Number.isInteger(value.totalPages) || Number(value.totalPages) < 0))
+                invalid();
+            return value.totalPages === undefined ? value[listKey].length > 0 : page < Number(value.totalPages);
+        };
+        let last = payload;
+        while (hasNext(last)) {
+            continuation = page + 1;
+            complete = false;
+            if (!full || pages >= pageCap || requests >= requestCap || Date.now() - started >= elapsedCap || bytesRead >= byteCap)
+                break;
+            form.set('pageNumber', String(++page));
+            let next;
+            try {
+                next = await request();
+            }
+            catch (error) {
+                if (!(error instanceof ToolError) || !['RESPONSE_LIMIT', 'READ_LIMIT', 'READ_TIMEOUT'].includes(error.code))
+                    throw error;
+                stoppedBy = error.code;
+                break;
+            }
+            if (next.contentType !== 'application/json')
+                invalid();
+            last = decode(next.bytes);
+            if (!validPage(last, page))
+                invalid();
+            for (const row of last[listKey]) {
+                const key = identity(row);
+                if (!seen.has(key)) {
+                    seen.add(key);
+                    rows.push(row);
+                }
+            }
+            pages++;
+            complete = true;
+            continuation = undefined;
+        }
+        const total = payload[contract.id === 'OP-020' ? 'totalZones' : 'totalEntries'];
+        if (total !== undefined && (!Number.isSafeInteger(total) || Number(total) < 0))
+            invalid();
+        if (complete && total !== undefined && Number(options['--page-number'] ?? 1) === 1 && rows.length !== total) {
+            complete = false;
+            stoppedBy = 'PROVIDER_TOTAL_MISMATCH';
+        }
+    }
+    // DNSSEC properties and record-bearing reads must disclose omitted fields before claiming completeness.
+    const omitted = ['OP-038', 'OP-050', 'OP-053'].includes(contract.id) ? {} : undefined;
+    let projected = project(payload, contract.response, false, 'response', omitted);
+    const omittedFields = Object.fromEntries(Object.entries(omitted ?? {}).map(([path, keys]) => [path, [...keys].sort()]));
+    if (Object.keys(omittedFields).length)
+        complete = false;
+    if (fields && !(rowShape && typeof rowShape === 'object')) {
+        projected = Object.fromEntries(fields.filter(field => Object.hasOwn(projected, field)).map(field => [field, projected[field]]));
+    }
+    const bounds = {};
+    const truncations = {};
+    const bound = (value, path) => {
+        const limit = full ? 10000 : 100;
+        if (typeof value === 'string') {
+            const stringLimit = full ? 1000000 : 1000;
+            if (value.length > stringLimit) {
+                complete = false;
+                truncations[path] = { returned: stringLimit, available: value.length };
+            }
+            return value.slice(0, stringLimit);
+        }
+        if (Array.isArray(value)) {
+            if (value.length > limit) {
+                complete = false;
+                truncations[path] = { returned: limit, available: value.length };
+            }
+            return value.slice(0, limit).map((row, index) => bound(row, `${path}[${index}]`));
+        }
+        if (record(value))
+            return Object.fromEntries(Object.entries(value).map(([key, field]) => [key, bound(field, `${path}.${key}`)]));
+        return value;
+    };
+    for (const [key, value] of Object.entries(projected)) {
+        if (!Array.isArray(value))
+            continue;
+        const limit = full ? 10000 : 100;
+        let selected = value.slice(0, limit);
+        bounds[key] = { returned: selected.length, available: value.length, complete: value.length <= limit };
+        if (value.length > limit)
+            complete = false;
+        if (value.length > limit && paged && key === listKey)
+            continuation = Number(options['--page-number'] ?? 1);
+        if (fields && key === listKey && rowShape && typeof rowShape === 'object') {
+            selected = selected.map(row => Object.fromEntries(fields.filter(field => record(row) && Object.hasOwn(row, field)).map(field => [field, row[field]])));
+        }
+        else if (!full) {
+            selected = selected.map(row => record(row) ? Object.fromEntries(Object.entries(row).slice(0, 4)) : row);
+        }
+        projected[key] = selected;
+    }
+    projected = bound(projected, 'response');
+    return { bytes: response.bytes, projection: { status: 'ok', response: projected,
+            output: { complete, pages, requests, bytesRead, collections: bounds,
+                ...(Object.keys(truncations).length ? { truncations } : {}),
+                ...(Object.keys(omittedFields).length ? { omittedFields } : {}),
+                ...(stoppedBy ? { stoppedBy } : {}),
+                ...(continuation === undefined ? {} : { nextPage: continuation }) } } };
+}

package/dist/routing.js

@@ -0,0 +1,14 @@
+import { ToolError } from './errors.js';
+// DnsWebService.GetClusterNodeTypeForPath at vendor revision 0dd592aad21eced4221a9a46204cb1a299972ca0.
+const primary = new Set(['003', '008', '009', '010', '011', '013', '057', '058', '059', '060', '063', '064', '065', '066', '070', '071', '072', '073', '074', '076', '099', '102', '104', '105', '107', '109', '110', '115', '116', '117', '142']);
+const local = new Set(['001', '002', '005', '006', '007']);
+export function routing(id) {
+    const number = id.slice(3);
+    return { target: primary.has(number) ? 'primary via vendor proxy' : local.has(number) ? 'current node' : 'selected or named node via vendor proxy',
+        cluster: ['OP-017', 'OP-018'].includes(id) ? 'aggregate' : ['OP-082', 'OP-083'].includes(id) ? 'asynchronous relay' : 'unsupported',
+        ...(id === 'OP-080' ? { replication: 'Listeners and local settings stay local; cluster parameters propagate through the primary' } : {}) };
+}
+export function validateNode(id, node) {
+    if (node === 'cluster' && routing(id).cluster === 'unsupported')
+        throw new ToolError('USAGE', 'node=cluster is unsupported for this operation', 'Select a named node or omit node to use the configured server');
+}

package/dist/vendor.js

@@ -0,0 +1,126 @@
+import { request } from 'node:https';
+import { checkServerIdentity } from 'node:tls';
+import { ToolError } from './errors.js';
+import { PrivateFiles } from './private-file.js';
+export class Redactor {
+    values = new Set();
+    add(value) {
+        if (!value)
+            return;
+        for (const form of [value, JSON.stringify(value).slice(1, -1), encodeURIComponent(value), encodeURI(value), Buffer.from(value).toString('base64')])
+            this.values.add(form);
+    }
+    text(value) {
+        for (const secret of [...this.values].sort((a, b) => b.length - a.length))
+            value = value.replaceAll(secret, '[REDACTED]');
+        return value;
+    }
+}
+function responseInvalid() {
+    throw new ToolError('UPSTREAM_INVALID', 'Unexpected server response', 'Check the selected server API version and operation', 1);
+}
+function object(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+export async function vendorRequest(profile, path, body, token, headers, limits) {
+    const origin = new URL(profile.origin);
+    const ca = profile.caFile ? await new PrivateFiles().read(profile.caFile, false) : undefined;
+    return await new Promise((resolve, reject) => {
+        const call = request(origin, {
+            method: 'POST', path, ca, rejectUnauthorized: true,
+            ...(profile.tlsServerName ? { servername: profile.tlsServerName,
+                checkServerIdentity: (_hostname, certificate) => checkServerIdentity(profile.tlsServerName, certificate) } : {}),
+            headers: { 'content-type': 'application/x-www-form-urlencoded', 'content-length': Buffer.byteLength(body),
+                ...headers, ...(token ? { authorization: `Bearer ${token}` } : {}) },
+            signal: AbortSignal.timeout(Math.max(1, Math.min(10000, limits.elapsedMs))),
+        }, incoming => {
+            const chunks = [];
+            let size = 0;
+            incoming.on('data', (chunk) => {
+                size += chunk.length;
+                if (size > limits.bytes)
+                    incoming.destroy(new ToolError('RESPONSE_LIMIT', 'Response exceeded the byte cap', 'Use narrower filters or raise --max-bytes within its bound', 1));
+                else
+                    chunks.push(chunk);
+            });
+            incoming.once('error', reject);
+            incoming.once('end', () => {
+                if (!incoming.complete) {
+                    reject(new ToolError('TRANSFER_INCOMPLETE', 'Server response was interrupted', 'Retry the read; no result file was completed', 1));
+                    return;
+                }
+                resolve({ bytes: Buffer.concat(chunks), contentType: incoming.headers['content-type']?.split(';')[0]?.trim() ?? '',
+                    status: incoming.statusCode ?? 0, ...(incoming.headers['retry-after'] ? { retryAfter: incoming.headers['retry-after'] } : {}),
+                    ...(incoming.headers['last-modified'] ? { lastModified: incoming.headers['last-modified'] } : {}) });
+            });
+        });
+        call.once('error', reject);
+        call.end(body);
+    }).catch(error => {
+        if (error instanceof ToolError)
+            throw error;
+        if (error instanceof Error && error.name === 'AbortError')
+            throw new ToolError('READ_TIMEOUT', 'Read exceeded its elapsed time cap', 'Retry with narrower filters', 1);
+        throw new ToolError('TRANSPORT_FAILED', 'Verified HTTPS request failed', 'Check origin, caFile and tlsServerName; certificate verification is required', 1);
+    });
+}
+// Vendor refusal text is shown to the operator: strip control characters and bound the length.
+export function vendorMessage(value) {
+    return typeof value.errorMessage === 'string' ? value.errorMessage.replace(/[\x00-\x1f\x7f]+/g, ' ').trim().slice(0, 300) || undefined : undefined;
+}
+export function checkStatus(value) {
+    if (!object(value) || typeof value.status !== 'string')
+        responseInvalid();
+    if (value.status === 'invalid-token')
+        throw new ToolError('AUTH_REQUIRED', 'The selected credential has expired or is invalid', 'Supply a valid credential for the same profile', 1);
+    if (value.status === '2fa-required')
+        throw new ToolError('TWO_FACTOR_REQUIRED', 'The server requires a second authentication factor', 'Supply a previously authenticated credential', 1);
+    if (value.status === 'error')
+        throw new ToolError('UPSTREAM_ERROR', `Server reported an operation failure${vendorMessage(value) ? `: ${vendorMessage(value)}` : ''}`, 'Check the selected identity and operation permissions', 1);
+    if (value.status !== 'ok')
+        responseInvalid();
+}
+export async function vendorRead(profile, operation, token) {
+    const path = operation === 'status' ? '/api/status' : '/api/user/session/get';
+    const body = operation === 'status' ? '' : 'includeInfo=true';
+    const response = await vendorRequest(profile, path, body, token, {}, { bytes: 1024 * 1024, elapsedMs: 10000 });
+    if (response.status !== 200)
+        throw new ToolError(response.status === 401 ? 'AUTH_REQUIRED' : response.status === 403 ? 'PERMISSION_DENIED'
+            : response.status === 404 ? 'UNSUPPORTED_OPERATION' : response.status === 429 ? 'RATE_LIMITED' : 'UPSTREAM_HTTP', 'Server rejected the request', 'Check the selected profile and server permissions', 1);
+    if (response.contentType !== 'application/json')
+        responseInvalid();
+    const bytes = response.bytes;
+    let value;
+    try {
+        value = JSON.parse(bytes.toString('utf8'));
+    }
+    catch {
+        responseInvalid();
+    }
+    checkStatus(value);
+    if (operation === 'status') {
+        if (typeof value.server !== 'string' || typeof value.hasDefaultCredentials !== 'boolean' || typeof value.ssoEnabled !== 'boolean')
+            responseInvalid();
+        return { bytes, projection: { status: 'ok', server: value.server, hasDefaultCredentials: value.hasDefaultCredentials, ssoEnabled: value.ssoEnabled } };
+    }
+    if (typeof value.username !== 'string' || typeof value.token !== 'string' || !object(value.info) || typeof value.info.version !== 'string')
+        responseInvalid();
+    if ((profile.tokenKind === 'api' || value.tokenName !== undefined) && typeof value.tokenName !== 'string')
+        responseInvalid();
+    const permissions = value.info.permissions;
+    if (!object(permissions))
+        responseInvalid();
+    if (value.hasDnssecPrivateKeys !== undefined && typeof value.hasDnssecPrivateKeys !== 'boolean')
+        responseInvalid();
+    for (const permission of Object.values(permissions)) {
+        if (!object(permission) || Object.values(permission).some(flag => typeof flag !== 'boolean'))
+            responseInvalid();
+    }
+    return { bytes, projection: { status: 'ok', username: value.username,
+            ...(value.tokenName !== undefined ? { tokenName: value.tokenName } : {}),
+            ...(value.hasDnssecPrivateKeys !== undefined ? { hasDnssecPrivateKeys: value.hasDnssecPrivateKeys } : {}),
+            info: { version: value.info.version, permissions } }, secret: value.token };
+}
+export async function saveResult(path, bytes) {
+    await new PrivateFiles().write(path, bytes);
+}