python-rac 0.2.0__py3-none-any.whl

pyrac/client.py

@@ -0,0 +1,2382 @@
+"""Versioned Python RAC library: 1C 8.3.11 (10.0) and 8.5.1 (16.0)."""
+import ast
+import asyncio
+import contextlib
+import io
+import re
+import time
+import uuid
+from argparse import Namespace
+from . import v8311
+from .protocol.v851_client import V851Client, EndpointVersionRejected
+
+
+class RacError(Exception):
+    pass
+
+
+class RacTransportError(RacError):
+    pass
+
+
+class UnsupportedFeatureError(RacError):
+    pass
+
+
+def parse_records(text):
+    """Parse historical rac text output for downstream compatibility only."""
+    rows, current = [], {}
+    for line in text.splitlines():
+        if not line.strip():
+            if current:
+                rows.append(current)
+                current = {}
+            continue
+        if ':' not in line:
+            raise RacError('Malformed rac output')
+        key, value = (part.strip() for part in line.split(':', 1))
+        if not re.fullmatch(r'[a-z][a-z0-9-]*', key):
+            raise RacError('Malformed rac output key')
+        if value.startswith('"') and value.endswith('"'):
+            value = value[1:-1].replace('""', '"')
+        current[key] = value
+    if current:
+        rows.append(current)
+    return rows
+
+
+class RacClient:
+    def __init__(self, host='localhost', port=1545, protocol='16.0', timeout=10.0,
+                 cluster_user=None, cluster_password=None, agent_user=None, agent_password=None):
+        if protocol not in ('10.0', '16.0', 'auto'):
+            raise ValueError('Select protocol auto, 10.0 or 16.0')
+        if type(port) is not int or not 1 <= port <= 65535:
+            raise ValueError('Invalid RAS port')
+        if protocol in ('16.0', 'auto'):
+            for name, password in ((cluster_user, cluster_password), (agent_user, agent_password)):
+                if password is not None and (not isinstance(name, str) or not name
+                        or not isinstance(password, str) or not password
+                        or '\x00' in password or len(password.encode('utf-8')) > 1024):
+                    raise ValueError('Invalid administrator credentials')
+        if protocol in ('16.0', 'auto'):
+            for label, name in (('agent', agent_user), ('cluster', cluster_user)):
+                if name is not None and (not isinstance(name, str) or not name
+                        or '\x00' in name or len(name.encode('utf-8')) > 1024):
+                    raise ValueError('Invalid ' + label + ' administrator name')
+        self.host, self.port, self.protocol, self.timeout = host, port, protocol, timeout
+        self._selected_protocol = protocol
+        self.cluster_user, self.cluster_password = cluster_user, cluster_password
+        self.agent_user, self.agent_password = agent_user, agent_password
+        self._native = None
+
+    async def __aenter__(self):
+        if self._selected_protocol == 'auto':
+            self.protocol = 'auto'
+        if self.protocol in ('16.0', 'auto'):
+            native = V851Client(self.host, self.port, self.timeout)
+            try:
+                await native.__aenter__()
+            except EndpointVersionRejected:
+                if self.protocol != 'auto':
+                    raise
+                self.protocol = '10.0'
+            else:
+                self._native = native
+                self.protocol = '16.0'
+        return self
+
+    async def __aexit__(self, *args):
+        if self._native is not None:
+            try:
+                await self._native.__aexit__(*args)
+            finally:
+                self._native = None
+        if self._selected_protocol == 'auto':
+            self.protocol = 'auto'
+        return False
+
+    def _direct(self, *, allow_password=False):
+        if not allow_password and (self.cluster_password is not None or self.agent_password is not None):
+            raise UnsupportedFeatureError('Password authentication is only available for administrator list probes')
+        if self._native is None:
+            raise RacTransportError('16.0 client must be used inside async with')
+        return self._native
+
+    async def _v8311(self, command, subcommand, cluster=None, subcommand2=None):
+        args = Namespace(ras_host=self.host, ras_port=self.port, command=command,
+                         subcommand1=subcommand, subcommand2=subcommand2,
+                         cluster=str(cluster) if cluster else None,
+                         cluster_user=self.cluster_user, cluster_pwd=self.cluster_password,
+                         agent_user=self.agent_user, agent_pwd=self.agent_password)
+        stream = io.StringIO()
+        try:
+            with contextlib.redirect_stdout(stream):
+                async with asyncio.timeout(self.timeout):
+                    await v8311.ras_command(args)
+        except Exception as exc:
+            raise RacTransportError('1C 8.3.11 RAC request failed') from exc
+        try:
+            tree = ast.parse(stream.getvalue(), mode='eval')
+            class UUIDLiteral(ast.NodeTransformer):
+                def visit_Call(self, node):
+                    if (not isinstance(node.func, ast.Name) or node.func.id != 'UUID'
+                            or len(node.args) != 1 or node.keywords):
+                        raise ValueError('Unexpected 1C 8.3.11 object')
+                    return ast.copy_location(ast.Constant(value=str(uuid.UUID(ast.literal_eval(node.args[0])))), node)
+            return ast.literal_eval(UUIDLiteral().visit(tree))
+        except (ValueError, SyntaxError, TypeError) as exc:
+            raise RacError('Unexpected 1C 8.3.11 response') from exc
+
+    async def agent_version(self):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 agent version is not exposed')
+        return await self._direct().agent_version()
+
+    async def list_cluster_admins(self, cluster_id):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            return await self._v8311('cluster', 'admin', cluster, subcommand2='list')
+        if self.cluster_password is not None:
+            if self.agent_password is not None:
+                raise UnsupportedFeatureError('Use one password scope per probe')
+            return await self._direct(allow_password=True).list_cluster_admins(
+                cluster, cluster_os_user=self.cluster_user, cluster_password=self.cluster_password)
+        return await self._direct().list_cluster_admins(cluster, cluster_os_user=self.cluster_user)
+
+    async def register_cluster_admin(self, cluster_id, name, os_user, *, descr=''):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Cluster administrator registration requires protocol 16.0')
+        for label, value in (('name', name), ('OS user', os_user), ('description', descr)):
+            if (not isinstance(value, str) or (label != 'description' and not value)
+                    or '\x00' in value or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator ' + label)
+        before = await self.list_cluster_admins(cluster)
+        if any(row['name'] == name or row.get('os-user') == os_user for row in before):
+            raise ValueError('Cluster administrator name or OS user already registered')
+        if self.cluster_user:
+            await self._direct().register_cluster_admin(cluster, name, os_user, descr,
+                                                        cluster_os_user=self.cluster_user)
+            after = await self.list_cluster_admins(cluster)
+        else:
+            await self._direct().register_cluster_admin(cluster, name, os_user, descr)
+            after = await self._direct().list_cluster_admins(cluster, cluster_os_user=name)
+        expected = {'name': name, 'descr': descr, 'password-auth-allowed': True,
+                    'os-auth-allowed': True, 'os-user': os_user}
+        if after != before + [expected]:
+            raise RacError('Cluster administrators did not match after registration')
+        return expected
+
+    async def remove_cluster_admin(self, cluster_id, name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Cluster administrator removal requires protocol 16.0')
+        if (not isinstance(name, str) or not name or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid cluster administrator name')
+        if not self.cluster_user:
+            raise ValueError('Removing an administrator requires an authenticated administrator')
+        before = await self.list_cluster_admins(cluster)
+        if len([row for row in before if row['name'] == name]) != 1:
+            raise ValueError('Cluster administrator not found or not unique')
+        if name == self.cluster_user and len(before) != 1:
+            raise ValueError('Cannot verify removal of current administrator while others remain')
+        await self._direct().remove_cluster_admin(cluster, name, self.cluster_user)
+        if name == self.cluster_user:
+            after = await self._direct().list_cluster_admins(cluster)
+        else:
+            after = await self.list_cluster_admins(cluster)
+        if after != [row for row in before if row['name'] != name]:
+            raise RacError('Cluster administrators did not match after removal')
+        return after
+
+    async def list_agent_admins(self):
+        if self.protocol == '10.0':
+            return await self._v8311('agent', 'admin', subcommand2='list')
+        if self.agent_password is not None:
+            if self.cluster_password is not None:
+                raise UnsupportedFeatureError('Use one password scope per probe')
+            return await self._direct(allow_password=True).list_agent_admins(
+                agent_os_user=self.agent_user, agent_password=self.agent_password)
+        return await self._direct().list_agent_admins(agent_os_user=self.agent_user)
+
+    async def register_agent_admin(self, name, os_user, *, descr=''):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Agent administrator registration requires protocol 16.0')
+        for label, value in (('name', name), ('OS user', os_user), ('description', descr)):
+            if (not isinstance(value, str) or (label != 'description' and not value)
+                    or '\x00' in value or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid agent administrator ' + label)
+        before = await self.list_agent_admins()
+        if any(row['name'] == name or row.get('os-user') == os_user for row in before):
+            raise ValueError('Agent administrator name or OS user already registered')
+        if self.agent_user:
+            await self._direct().register_agent_admin(name, os_user, descr,
+                                                      agent_os_user=self.agent_user)
+            after = await self.list_agent_admins()
+        else:
+            await self._direct().register_agent_admin(name, os_user, descr)
+            after = await self._direct().list_agent_admins(agent_os_user=name)
+        expected = {'name': name, 'descr': descr, 'password-auth-allowed': True,
+                    'os-auth-allowed': True, 'os-user': os_user}
+        if after != before + [expected]:
+            raise RacError('Agent administrators did not match after registration')
+        return expected
+
+    async def remove_agent_admin(self, name):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Agent administrator removal requires protocol 16.0')
+        if (not isinstance(name, str) or not name or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid agent administrator name')
+        if not self.agent_user:
+            raise ValueError('Removing an administrator requires an authenticated administrator')
+        before = await self.list_agent_admins()
+        if len([row for row in before if row['name'] == name]) != 1:
+            raise ValueError('Agent administrator not found or not unique')
+        if name == self.agent_user and len(before) != 1:
+            raise ValueError('Cannot verify removal of current administrator while others remain')
+        await self._direct().remove_agent_admin(name, self.agent_user)
+        if name == self.agent_user:
+            after = await self._direct().list_agent_admins()
+        else:
+            after = await self.list_agent_admins()
+        if after != [row for row in before if row['name'] != name]:
+            raise RacError('Agent administrators did not match after removal')
+        return after
+
+    async def list_sessions(self, cluster_id, infobase_id=None):
+        cluster = uuid.UUID(str(cluster_id))
+        infobase = uuid.UUID(str(infobase_id)) if infobase_id is not None else None
+        if self.protocol == '10.0':
+            if infobase is not None:
+                raise UnsupportedFeatureError('1C 8.3.11 filtered sessions not exposed')
+            return await self._v8311('session', 'list', cluster)
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_sessions(
+                cluster, infobase, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_sessions(cluster, infobase, cluster_os_user=self.cluster_user)
+        return await self._direct().list_sessions(cluster, infobase)
+
+    async def get_session(self, cluster_id, session_id):
+        cluster, session = uuid.UUID(str(cluster_id)), uuid.UUID(str(session_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 session info not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).get_session(
+                cluster, session, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().get_session(cluster, session, cluster_os_user=self.cluster_user)
+        return await self._direct().get_session(cluster, session)
+
+    async def list_profiles(self, cluster_id):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 profiles not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_profiles(
+                cluster, cluster_os_user=self.cluster_user, cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_profiles(cluster, cluster_os_user=self.cluster_user)
+        return await self._direct().list_profiles(cluster)
+
+    async def update_profile(self, cluster_id, name, *, descr=None, config=None, priv=None,
+                             full_privileged_mode=None, crypto=None,
+                             right_extension=None, all_modules_extension=None,
+                             right_extension_definition_roles=None, privileged_mode_roles=None,
+                             modules_available_for_extension=None,
+                             modules_not_available_for_extension=None, directory_access=None,
+                             com_access=None, addin_access=None, module_access=None,
+                             app_access=None, inet_access=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile update requires protocol 16.0')
+        if (not isinstance(name, str) or not name.strip()
+                or '\x00' in name or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        if descr is not None and (not isinstance(descr, str) or '\x00' in descr
+                                  or len(descr.encode('utf-8')) > 1024):
+            raise ValueError('Invalid profile description')
+        if config is not None and type(config) is not bool:
+            raise ValueError('Invalid config flag')
+        if priv is not None and full_privileged_mode is not None:
+            raise ValueError('Ambiguous privileged mode aliases')
+        if full_privileged_mode is not None:
+            if type(full_privileged_mode) is not bool:
+                raise ValueError('Invalid full-privileged-mode flag')
+            priv = full_privileged_mode
+        if priv is not None and type(priv) is not bool:
+            raise ValueError('Invalid priv flag')
+        if crypto is not None and type(crypto) is not bool:
+            raise ValueError('Invalid crypto flag')
+        if directory_access is not None and type(directory_access) is not bool:
+            raise ValueError('Invalid directory access flag')
+        if com_access is not None and type(com_access) is not bool:
+            raise ValueError('Invalid com access flag')
+        if addin_access is not None and type(addin_access) is not bool:
+            raise ValueError('Invalid addin access flag')
+        if module_access is not None and type(module_access) is not bool:
+            raise ValueError('Invalid module access flag')
+        if app_access is not None and type(app_access) is not bool:
+            raise ValueError('Invalid app access flag')
+        if inet_access is not None and type(inet_access) is not bool:
+            raise ValueError('Invalid inet access flag')
+        if right_extension is not None and type(right_extension) is not bool:
+            raise ValueError('Invalid right-extension flag')
+        if all_modules_extension is not None and type(all_modules_extension) is not bool:
+            raise ValueError('Invalid all-modules-extension flag')
+        if (right_extension_definition_roles is not None and
+                (not isinstance(right_extension_definition_roles, str)
+                 or '\x00' in right_extension_definition_roles
+                 or len(right_extension_definition_roles.encode('utf-8')) > 1024)):
+            raise ValueError('Invalid right-extension-definition-roles')
+        if (privileged_mode_roles is not None and
+                (not isinstance(privileged_mode_roles, str)
+                 or '\x00' in privileged_mode_roles
+                 or len(privileged_mode_roles.encode('utf-8')) > 1024)):
+            raise ValueError('Invalid privileged-mode-roles')
+        if (modules_available_for_extension is not None and
+                (not isinstance(modules_available_for_extension, str)
+                 or '\x00' in modules_available_for_extension
+                 or len(modules_available_for_extension.encode('utf-8')) > 1024)):
+            raise ValueError('Invalid modules-available-for-extension')
+        if (modules_not_available_for_extension is not None and
+                (not isinstance(modules_not_available_for_extension, str)
+                 or '\x00' in modules_not_available_for_extension
+                 or len(modules_not_available_for_extension.encode('utf-8')) > 1024)):
+            raise ValueError('Invalid modules-not-available-for-extension')
+        has_fields = any(value is not None for value in (
+            descr, config, priv, crypto, right_extension, all_modules_extension,
+            right_extension_definition_roles, privileged_mode_roles,
+            modules_available_for_extension, modules_not_available_for_extension,
+            directory_access, com_access, addin_access, module_access, app_access,
+            inet_access))
+        before = await self.list_profiles(cluster)
+        matches = [row for row in before if row['name'] == name]
+        if len(matches) > 1:
+            raise ValueError('Security profile not unique')
+        if matches:
+            if not has_fields:
+                raise ValueError('Specify a profile field to update')
+            expected = dict(matches[0])
+        else:
+            # The 16.0 profile update request also creates. Match the locally
+            # observed default record so full read-back catches silent failures.
+            expected = {'name': name, 'descr': '',
+                        **{key: False for key in ('directory', 'com', 'addin', 'app', 'inet',
+                                                  'config', 'priv', 'raw-external-module-access',
+                                                  'crypto', 'right-extension', 'all-modules-extension')},
+                        **{key: '' for key in ('right-extension-definition-roles',
+                                               'modules-available-for-extension',
+                                               'modules-not-available-for-extension',
+                                               'privileged-mode-roles')}}
+        if descr is not None:
+            expected['descr'] = descr
+        if config is not None:
+            expected['config'] = config
+        if priv is not None:
+            expected['priv'] = priv
+        if crypto is not None:
+            expected['crypto'] = crypto
+        if directory_access is not None:
+            expected['directory'] = directory_access
+        if com_access is not None:
+            expected['com'] = com_access
+        if addin_access is not None:
+            expected['addin'] = addin_access
+        if module_access is not None:
+            expected['raw-external-module-access'] = module_access
+        if app_access is not None:
+            expected['app'] = app_access
+        if inet_access is not None:
+            expected['inet'] = inet_access
+        if right_extension is not None:
+            expected['right-extension'] = right_extension
+        if all_modules_extension is not None:
+            expected['all-modules-extension'] = all_modules_extension
+        if right_extension_definition_roles is not None:
+            expected['right-extension-definition-roles'] = right_extension_definition_roles
+        if privileged_mode_roles is not None:
+            expected['privileged-mode-roles'] = privileged_mode_roles
+        if modules_available_for_extension is not None:
+            expected['modules-available-for-extension'] = modules_available_for_extension
+        if modules_not_available_for_extension is not None:
+            expected['modules-not-available-for-extension'] = modules_not_available_for_extension
+        if self.cluster_user:
+            await self._direct().update_profile(cluster, expected, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().update_profile(cluster, expected)
+        after = await self.list_profiles(cluster)
+        current = [row for row in after if row['name'] == name]
+        if current != [expected]:
+            raise RacError('Security profile did not match after update')
+        expected_list = [expected if row['name'] == name else row for row in before]
+        if not matches:
+            expected_list.append(expected)
+        if after != expected_list:
+            raise RacError('Security profile list did not match after update')
+        return current[0]
+
+    async def remove_profile(self, cluster_id, profile_name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile removal requires protocol 16.0')
+        if (not isinstance(profile_name, str) or not profile_name.strip()
+                or '\x00' in profile_name or len(profile_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        before = await self.list_profiles(cluster)
+        matches = [row for row in before if row['name'] == profile_name]
+        if len(matches) != 1:
+            raise ValueError('Security profile not found or not unique')
+        if self.cluster_user:
+            await self._direct().remove_profile(cluster, profile_name, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().remove_profile(cluster, profile_name)
+        after = await self.list_profiles(cluster)
+        if after != [row for row in before if row['name'] != profile_name]:
+            raise RacError('Security profile list did not match after removal')
+
+    async def update_profile_directory(self, cluster_id, profile_name, alias, *, physical_path=None,
+                                       allowed_read=None, allowed_write=None, descr=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile directory update requires protocol 16.0')
+        for value in (profile_name, alias):
+            if (not isinstance(value, str) or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile or directory alias')
+        for key, value in (('physicalPath', physical_path), ('descr', descr)):
+            if (value is not None and (not isinstance(value, str) or '\x00' in value
+                                       or len(value.encode('utf-8')) > 1024)):
+                raise ValueError('Invalid directory ' + key)
+        for key, value in (('allowedRead', allowed_read), ('allowedWrite', allowed_write)):
+            if value is not None and type(value) is not bool:
+                raise ValueError('Invalid directory ' + key)
+        before = await self.list_profile_directories(cluster, profile_name)
+        matches = [row for row in before if row['alias'] == alias]
+        if len(matches) > 1:
+            raise ValueError('Profile directory not unique')
+        expected = dict(matches[0]) if matches else {
+            'profile': profile_name, 'alias': alias, 'physicalPath': '',
+            'allowedRead': False, 'allowedWrite': False, 'descr': ''}
+        for key, value in (('physicalPath', physical_path), ('allowedRead', allowed_read),
+                           ('allowedWrite', allowed_write), ('descr', descr)):
+            if value is not None:
+                expected[key] = value
+        if self.cluster_user:
+            await self._direct().update_profile_directory(cluster, expected,
+                                                          cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().update_profile_directory(cluster, expected)
+        after = await self.list_profile_directories(cluster, profile_name)
+        current = [row for row in after if row['alias'] == alias]
+        if current != [expected]:
+            raise RacError('Profile directory did not match after update')
+        expected_list = [expected if row['alias'] == alias else row for row in before]
+        if not matches:
+            expected_list.append(expected)
+        if after != expected_list:
+            raise RacError('Profile directory list did not match after update')
+        return current[0]
+
+    async def remove_profile_directory(self, cluster_id, profile_name, alias):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile directory removal requires protocol 16.0')
+        if (not isinstance(profile_name, str) or not isinstance(alias, str)
+                or not profile_name.strip() or not alias.strip()
+                or '\x00' in profile_name or '\x00' in alias
+                or len(profile_name.encode('utf-8')) > 1024
+                or len(alias.encode('utf-8')) > 1024):
+            raise ValueError('Invalid profile or directory alias')
+        before = await self.list_profile_directories(cluster, profile_name)
+        matches = [row for row in before if row['alias'] == alias]
+        if len(matches) != 1:
+            raise ValueError('Profile directory not found or not unique')
+        if self.cluster_user:
+            await self._direct().remove_profile_directory(cluster, profile_name, alias,
+                                                          cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().remove_profile_directory(cluster, profile_name, alias)
+        after = await self.list_profile_directories(cluster, profile_name)
+        if after != [row for row in before if row['alias'] != alias]:
+            raise RacError('Profile directory list did not match after removal')
+
+    async def list_profile_directories(self, cluster_id, profile_name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 profile directories not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_profile_directories(
+                cluster, profile_name, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_profile_directories(
+                cluster, profile_name, cluster_os_user=self.cluster_user)
+        return await self._direct().list_profile_directories(cluster, profile_name)
+
+    async def list_profile_com_classes(self, cluster_id, profile_name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 profile COM ACL not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_profile_com_classes(
+                cluster, profile_name, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_profile_com_classes(
+                cluster, profile_name, cluster_os_user=self.cluster_user)
+        return await self._direct().list_profile_com_classes(cluster, profile_name)
+
+    async def update_profile_com_class(self, cluster_id, profile_name, class_name, *, file_name=None,
+                                       class_id=None, host=None, descr=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile COM update requires protocol 16.0')
+        for value in (profile_name, class_name):
+            if (not isinstance(value, str) or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile or COM class name')
+        for key, value in (('fileName', file_name), ('id', class_id), ('host', host), ('descr', descr)):
+            if (value is not None and (not isinstance(value, str) or '\x00' in value
+                                       or len(value.encode('utf-8')) > 1024)):
+                raise ValueError('Invalid COM ' + key)
+        before = await self.list_profile_com_classes(cluster, profile_name)
+        matches = [row for row in before if row['name'] == class_name]
+        if len(matches) > 1:
+            raise ValueError('Profile COM class not unique')
+        expected = dict(matches[0]) if matches else {
+            'profile': profile_name, 'name': class_name,
+            'fileName': '', 'id': '', 'host': '', 'descr': ''}
+        for key, value in (('fileName', file_name), ('id', class_id), ('host', host), ('descr', descr)):
+            if value is not None:
+                expected[key] = value
+        if self.cluster_user:
+            await self._direct().update_profile_com_class(cluster, expected,
+                                                          cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().update_profile_com_class(cluster, expected)
+        after = await self.list_profile_com_classes(cluster, profile_name)
+        current = [row for row in after if row['name'] == class_name]
+        if current != [expected]:
+            raise RacError('Profile COM class did not match after update')
+        expected_list = [expected if row['name'] == class_name else row for row in before]
+        if not matches:
+            expected_list.append(expected)
+        if after != expected_list:
+            raise RacError('Profile COM class list did not match after update')
+        return current[0]
+
+    async def remove_profile_com_class(self, cluster_id, profile_name, class_name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile COM removal requires protocol 16.0')
+        if (not isinstance(profile_name, str) or not isinstance(class_name, str)
+                or not profile_name.strip() or not class_name.strip()
+                or '\x00' in profile_name or '\x00' in class_name
+                or len(profile_name.encode('utf-8')) > 1024
+                or len(class_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid profile or COM class name')
+        before = await self.list_profile_com_classes(cluster, profile_name)
+        matches = [row for row in before if row['name'] == class_name]
+        if len(matches) != 1:
+            raise ValueError('Profile COM class not found or not unique')
+        if self.cluster_user:
+            await self._direct().remove_profile_com_class(
+                cluster, profile_name, class_name, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().remove_profile_com_class(cluster, profile_name, class_name)
+        after = await self.list_profile_com_classes(cluster, profile_name)
+        if after != [row for row in before if row['name'] != class_name]:
+            raise RacError('Profile COM class list did not match after removal')
+
+    async def list_profile_addins(self, cluster_id, profile_name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 profile addin ACL not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_profile_addins(
+                cluster, profile_name, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_profile_addins(
+                cluster, profile_name, cluster_os_user=self.cluster_user)
+        return await self._direct().list_profile_addins(cluster, profile_name)
+
+    async def update_profile_addin(self, cluster_id, profile_name, addin_name, *, hash_value=None,
+                                   descr=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile addin update requires protocol 16.0')
+        for value in (profile_name, addin_name):
+            if (not isinstance(value, str) or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile or addin name')
+        for key, value in (('hash', hash_value), ('descr', descr)):
+            if (value is not None and (not isinstance(value, str) or '\x00' in value
+                                       or len(value.encode('utf-8')) > 1024)):
+                raise ValueError('Invalid addin ' + key)
+        before = await self.list_profile_addins(cluster, profile_name)
+        matches = [row for row in before if row['name'] == addin_name]
+        if len(matches) > 1:
+            raise ValueError('Profile addin not unique')
+        expected = dict(matches[0]) if matches else {
+            'profile': profile_name, 'name': addin_name, 'hash': '', 'descr': ''}
+        if hash_value is not None:
+            expected['hash'] = hash_value
+        if descr is not None:
+            expected['descr'] = descr
+        if self.cluster_user:
+            await self._direct().update_profile_addin(cluster, expected,
+                                                      cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().update_profile_addin(cluster, expected)
+        after = await self.list_profile_addins(cluster, profile_name)
+        current = [row for row in after if row['name'] == addin_name]
+        if current != [expected]:
+            raise RacError('Profile addin did not match after update')
+        expected_list = [expected if row['name'] == addin_name else row for row in before]
+        if not matches:
+            expected_list.append(expected)
+        if after != expected_list:
+            raise RacError('Profile addin list did not match after update')
+        return current[0]
+
+    async def remove_profile_addin(self, cluster_id, profile_name, addin_name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile addin removal requires protocol 16.0')
+        if (not isinstance(profile_name, str) or not isinstance(addin_name, str)
+                or not profile_name.strip() or not addin_name.strip()
+                or '\x00' in profile_name or '\x00' in addin_name
+                or len(profile_name.encode('utf-8')) > 1024
+                or len(addin_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid profile or addin name')
+        before = await self.list_profile_addins(cluster, profile_name)
+        matches = [row for row in before if row['name'] == addin_name]
+        if len(matches) != 1:
+            raise ValueError('Profile addin not found or not unique')
+        if self.cluster_user:
+            await self._direct().remove_profile_addin(
+                cluster, profile_name, addin_name, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().remove_profile_addin(cluster, profile_name, addin_name)
+        after = await self.list_profile_addins(cluster, profile_name)
+        if after != [row for row in before if row['name'] != addin_name]:
+            raise RacError('Profile addin list did not match after removal')
+
+    async def list_profile_modules(self, cluster_id, profile_name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 profile module ACL not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_profile_modules(
+                cluster, profile_name, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_profile_modules(
+                cluster, profile_name, cluster_os_user=self.cluster_user)
+        return await self._direct().list_profile_modules(cluster, profile_name)
+
+    async def update_profile_module(self, cluster_id, profile_name, module_name, *, hash_value=None,
+                                    descr=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile module update requires protocol 16.0')
+        for value in (profile_name, module_name):
+            if (not isinstance(value, str) or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile or module name')
+        for key, value in (('hash', hash_value), ('descr', descr)):
+            if (value is not None and (not isinstance(value, str) or '\x00' in value
+                                       or len(value.encode('utf-8')) > 1024)):
+                raise ValueError('Invalid module ' + key)
+        before = await self.list_profile_modules(cluster, profile_name)
+        matches = [row for row in before if row['name'] == module_name]
+        if len(matches) > 1:
+            raise ValueError('Profile module not unique')
+        expected = dict(matches[0]) if matches else {
+            'profile': profile_name, 'name': module_name, 'hash': '', 'descr': ''}
+        if hash_value is not None:
+            expected['hash'] = hash_value
+        if descr is not None:
+            expected['descr'] = descr
+        if self.cluster_user:
+            await self._direct().update_profile_module(cluster, expected,
+                                                       cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().update_profile_module(cluster, expected)
+        after = await self.list_profile_modules(cluster, profile_name)
+        current = [row for row in after if row['name'] == module_name]
+        if current != [expected]:
+            raise RacError('Profile module did not match after update')
+        expected_list = [expected if row['name'] == module_name else row for row in before]
+        if not matches:
+            expected_list.append(expected)
+        if after != expected_list:
+            raise RacError('Profile module list did not match after update')
+        return current[0]
+
+    async def remove_profile_module(self, cluster_id, profile_name, module_name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile module removal requires protocol 16.0')
+        if (not isinstance(profile_name, str) or not isinstance(module_name, str)
+                or not profile_name.strip() or not module_name.strip()
+                or '\x00' in profile_name or '\x00' in module_name
+                or len(profile_name.encode('utf-8')) > 1024
+                or len(module_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid profile or module name')
+        before = await self.list_profile_modules(cluster, profile_name)
+        matches = [row for row in before if row['name'] == module_name]
+        if len(matches) != 1:
+            raise ValueError('Profile module not found or not unique')
+        if self.cluster_user:
+            await self._direct().remove_profile_module(
+                cluster, profile_name, module_name, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().remove_profile_module(cluster, profile_name, module_name)
+        after = await self.list_profile_modules(cluster, profile_name)
+        if after != [row for row in before if row['name'] != module_name]:
+            raise RacError('Profile module list did not match after removal')
+
+    async def list_profile_apps(self, cluster_id, profile_name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 profile app ACL not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_profile_apps(
+                cluster, profile_name, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_profile_apps(
+                cluster, profile_name, cluster_os_user=self.cluster_user)
+        return await self._direct().list_profile_apps(cluster, profile_name)
+
+    async def update_profile_app(self, cluster_id, profile_name, app_name, *, wild=None, descr=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile application update requires protocol 16.0')
+        for value in (profile_name, app_name):
+            if (not isinstance(value, str) or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile or application name')
+        for key, value in (('wild', wild), ('descr', descr)):
+            if (value is not None and (not isinstance(value, str) or '\x00' in value
+                                       or len(value.encode('utf-8')) > 1024)):
+                raise ValueError('Invalid application ' + key)
+        before = await self.list_profile_apps(cluster, profile_name)
+        matches = [row for row in before if row['name'] == app_name]
+        if len(matches) > 1:
+            raise ValueError('Profile application not unique')
+        expected = dict(matches[0]) if matches else {
+            'profile': profile_name, 'name': app_name, 'wild': '', 'descr': ''}
+        if wild is not None:
+            expected['wild'] = wild
+        if descr is not None:
+            expected['descr'] = descr
+        if self.cluster_user:
+            await self._direct().update_profile_app(cluster, expected,
+                                                    cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().update_profile_app(cluster, expected)
+        after = await self.list_profile_apps(cluster, profile_name)
+        current = [row for row in after if row['name'] == app_name]
+        if current != [expected]:
+            raise RacError('Profile application did not match after update')
+        expected_list = [expected if row['name'] == app_name else row for row in before]
+        if not matches:
+            expected_list.append(expected)
+        if after != expected_list:
+            raise RacError('Profile application list did not match after update')
+        return current[0]
+
+    async def remove_profile_app(self, cluster_id, profile_name, app_name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile app removal requires protocol 16.0')
+        if (not isinstance(profile_name, str) or not isinstance(app_name, str)
+                or not profile_name.strip() or not app_name.strip()
+                or '\x00' in profile_name or '\x00' in app_name
+                or len(profile_name.encode('utf-8')) > 1024
+                or len(app_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid profile or application name')
+        before = await self.list_profile_apps(cluster, profile_name)
+        matches = [row for row in before if row['name'] == app_name]
+        if len(matches) != 1:
+            raise ValueError('Profile application not found or not unique')
+        if self.cluster_user:
+            await self._direct().remove_profile_app(
+                cluster, profile_name, app_name, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().remove_profile_app(cluster, profile_name, app_name)
+        after = await self.list_profile_apps(cluster, profile_name)
+        if after != [row for row in before if row['name'] != app_name]:
+            raise RacError('Profile application list did not match after removal')
+
+    async def update_profile_inet(self, cluster_id, profile_name, inet_name, *, url=None,
+                                  port=None, protocol=None, descr=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile inet update requires protocol 16.0')
+        for value in (profile_name, inet_name):
+            if (not isinstance(value, str) or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile or inet name')
+        for key, value in (('url', url), ('protocol', protocol), ('descr', descr)):
+            if (value is not None and (not isinstance(value, str) or '\x00' in value
+                                       or len(value.encode('utf-8')) > 1024)):
+                raise ValueError('Invalid inet ' + key)
+        if port is not None and (type(port) is not int or not 0 <= port <= 65535):
+            raise ValueError('Invalid inet port')
+        before = await self.list_profile_inet(cluster, profile_name)
+        matches = [row for row in before if row['name'] == inet_name]
+        if len(matches) > 1:
+            raise ValueError('Profile inet not unique')
+        expected = dict(matches[0]) if matches else {
+            'profile': profile_name, 'name': inet_name,
+            'url': '', 'port': 0, 'protocol': '', 'descr': ''}
+        for key, value in (('url', url), ('port', port), ('protocol', protocol), ('descr', descr)):
+            if value is not None:
+                expected[key] = value
+        if self.cluster_user:
+            await self._direct().update_profile_inet(cluster, expected,
+                                                     cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().update_profile_inet(cluster, expected)
+        after = await self.list_profile_inet(cluster, profile_name)
+        current = [row for row in after if row['name'] == inet_name]
+        if current != [expected]:
+            raise RacError('Profile inet did not match after update')
+        expected_list = [expected if row['name'] == inet_name else row for row in before]
+        if not matches:
+            expected_list.append(expected)
+        if after != expected_list:
+            raise RacError('Profile inet list did not match after update')
+        return current[0]
+
+    async def remove_profile_inet(self, cluster_id, profile_name, inet_name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Profile inet removal requires protocol 16.0')
+        if (not isinstance(profile_name, str) or not isinstance(inet_name, str)
+                or not profile_name.strip() or not inet_name.strip()
+                or '\x00' in profile_name or '\x00' in inet_name
+                or len(profile_name.encode('utf-8')) > 1024
+                or len(inet_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid profile or inet resource name')
+        before = await self.list_profile_inet(cluster, profile_name)
+        matches = [row for row in before if row['name'] == inet_name]
+        if len(matches) != 1:
+            raise ValueError('Profile inet resource not found or not unique')
+        if self.cluster_user:
+            await self._direct().remove_profile_inet(
+                cluster, profile_name, inet_name, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().remove_profile_inet(cluster, profile_name, inet_name)
+        after = await self.list_profile_inet(cluster, profile_name)
+        if after != [row for row in before if row['name'] != inet_name]:
+            raise RacError('Profile inet resource list did not match after removal')
+
+    async def list_profile_inet(self, cluster_id, profile_name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 profile inet ACL not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_profile_inet(
+                cluster, profile_name, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_profile_inet(
+                cluster, profile_name, cluster_os_user=self.cluster_user)
+        return await self._direct().list_profile_inet(cluster, profile_name)
+
+    async def insert_service_setting(self, cluster_id, server_id, service_name, *,
+                                     infobase_name='', service_data_dir=''):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Service setting insert requires protocol 16.0')
+        for key, value in (('service name', service_name), ('infobase name', infobase_name),
+                           ('service data dir', service_data_dir)):
+            if (not isinstance(value, str) or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024
+                    or key == 'service name' and not value.strip()):
+                raise ValueError('Invalid ' + key)
+        before = await self.list_service_settings(cluster, server)
+        if any(row['service-name'] == service_name and row['infobase-name'] == infobase_name
+               for row in before):
+            raise ValueError('Service setting already exists for service and infobase')
+        if self.cluster_user:
+            created_id = await self._direct().insert_service_setting(
+                cluster, server, service_name, infobase_name, service_data_dir,
+                cluster_os_user=self.cluster_user)
+        else:
+            created_id = await self._direct().insert_service_setting(
+                cluster, server, service_name, infobase_name, service_data_dir)
+        after = await self.list_service_settings(cluster, server)
+        existing_ids = {row['setting'] for row in before}
+        new = [row for row in after if row['setting'] not in existing_ids]
+        # RAS normalizes directory paths; compare the actual row with the requested
+        # path after trimming only the trailing slash introduced by RAS.
+        if (len(new) != 1 or len(after) != len(before) + 1
+                or [row for row in after if row['setting'] in existing_ids] != before
+                or new[0]['setting'] != str(created_id)
+                or new[0]['service-name'] != service_name
+                or new[0]['infobase-name'] != infobase_name
+                or new[0]['service-data-dir'].rstrip('/') != service_data_dir.rstrip('/')
+                or new[0]['active'] is not False):
+            raise RacError('Service setting did not match after insert')
+        return new[0]
+
+    async def update_service_setting(self, cluster_id, server_id, setting_id, service_data_dir):
+        cluster, server, setting = (uuid.UUID(str(value)) for value in
+                                    (cluster_id, server_id, setting_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Service setting update requires protocol 16.0')
+        if (not isinstance(service_data_dir, str) or '\x00' in service_data_dir
+                or len(service_data_dir.encode('utf-8')) > 1024):
+            raise ValueError('Invalid service data dir')
+        before = await self.list_service_settings(cluster, server)
+        matches = [row for row in before if row['setting'] == str(setting)]
+        if len(matches) != 1:
+            raise ValueError('Service setting not found or not unique')
+        desired = {**matches[0], 'service-data-dir': service_data_dir}
+        if self.cluster_user:
+            await self._direct().update_service_setting(cluster, server, desired,
+                                                        cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().update_service_setting(cluster, server, desired)
+        after = await self.list_service_settings(cluster, server)
+        expected = {**matches[0], 'service-data-dir': service_data_dir.rstrip('/') + '/'}
+        expected_list = [expected if row['setting'] == str(setting) else row
+                         for row in before]
+        if after != expected_list:
+            raise RacError('Service setting did not match after update')
+        return expected
+
+    async def remove_service_setting(self, cluster_id, server_id, setting_id):
+        cluster, server, setting = (uuid.UUID(str(value)) for value in
+                                    (cluster_id, server_id, setting_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Service setting remove requires protocol 16.0')
+        before = await self.list_service_settings(cluster, server)
+        matches = [row for row in before if row['setting'] == str(setting)]
+        if len(matches) != 1:
+            raise ValueError('Service setting not found or not unique')
+        if self.cluster_user:
+            await self._direct().remove_service_setting(cluster, server, setting,
+                                                        cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().remove_service_setting(cluster, server, setting)
+        after = await self.list_service_settings(cluster, server)
+        if after != [row for row in before if row['setting'] != str(setting)]:
+            raise RacError('Service setting did not match after remove')
+
+    async def apply_service_settings(self, cluster_id, server_id):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Service setting apply requires protocol 16.0')
+        before = await self.list_service_settings(cluster, server)
+        if not any(not row['active'] for row in before):
+            raise ValueError('No pending service settings to apply')
+        if self.cluster_user:
+            await self._direct().apply_service_settings(cluster, server,
+                                                       cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().apply_service_settings(cluster, server)
+        after = await self.list_service_settings(cluster, server)
+        if after != [{**row, 'active': True} for row in before]:
+            raise RacError('Service settings did not match after apply')
+        return after
+
+    async def list_service_settings(self, cluster_id, server_id):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 service settings not exposed')
+        if self.cluster_user:
+            return await self._direct().list_service_settings(cluster, server, cluster_os_user=self.cluster_user)
+        return await self._direct().list_service_settings(cluster, server)
+
+    async def get_service_setting(self, cluster_id, server_id, setting_id):
+        cluster, server, setting = (uuid.UUID(str(value)) for value in
+                                    (cluster_id, server_id, setting_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 service setting info not exposed')
+        if self.cluster_user:
+            return await self._direct().get_service_setting(cluster, server, setting,
+                                                            cluster_os_user=self.cluster_user)
+        return await self._direct().get_service_setting(cluster, server, setting)
+
+    async def list_service_data_dirs_for_transfer(self, cluster_id, server_id, service_name=''):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 service transfer directories not exposed')
+        if self.cluster_user:
+            return await self._direct().list_service_data_dirs_for_transfer(
+                cluster, server, service_name, cluster_os_user=self.cluster_user)
+        return await self._direct().list_service_data_dirs_for_transfer(cluster, server, service_name)
+
+    async def update_counter(self, cluster_id, name, *, collection_time=None, group=None,
+                             filter_type=None, filter=None, descr=None, **flags):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Counter update requires protocol 16.0')
+        flag_names = ('duration', 'cpu_time', 'memory', 'read', 'write',
+                      'duration_dbms', 'dbms_bytes', 'service', 'call',
+                      'number_of_active_sessions', 'number_of_sessions')
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid counter name')
+        if collection_time is not None and (type(collection_time) is not int
+                                            or not 0 <= collection_time < 2**63):
+            raise ValueError('Invalid collection time')
+        if group is not None and group not in ('users', 'data-separation'):
+            raise ValueError('Invalid group')
+        if filter_type is not None and filter_type not in ('all-selected', 'all-but-selected', 'all'):
+            raise ValueError('Invalid filter type')
+        for key, value in (('filter', filter), ('descr', descr)):
+            if value is not None and (not isinstance(value, str) or '\x00' in value
+                                      or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid ' + key)
+        if any(key not in flag_names or type(value) is not bool for key, value in flags.items()):
+            raise ValueError('Invalid counter flag')
+        before = await self.list_counters(cluster)
+        matches = [row for row in before if row['name'] == name]
+        if len(matches) > 1:
+            raise ValueError('Counter not unique')
+        if matches:
+            expected = {key: value for key, value in matches[0].items()
+                        if key not in ('raw-group', 'raw-filter-type')}
+            if all(value is None for value in (collection_time, group, filter_type, filter, descr)) and not flags:
+                raise ValueError('Specify a counter field to update')
+        else:
+            if collection_time is None or group is None or filter_type is None or filter is None:
+                raise ValueError('Counter creation requires collection time, group, filter type and filter')
+            expected = {'name': name, 'collection-time': collection_time,
+                        'group': group, 'filter-type': filter_type, 'filter': filter,
+                        'descr': '', **{key.replace('_', '-'): False for key in flag_names}}
+        for key, value in (('collection-time', collection_time), ('group', group),
+                           ('filter-type', filter_type), ('filter', filter), ('descr', descr)):
+            if value is not None:
+                expected[key] = value
+        expected.update({key.replace('_', '-'): value for key, value in flags.items()})
+        if self.cluster_user:
+            await self._direct().update_counter(cluster, expected, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().update_counter(cluster, expected)
+        after = await self.list_counters(cluster)
+        current = [row for row in after if row['name'] == name]
+        if len(current) != 1 or any(current[0].get(key) != value for key, value in expected.items()):
+            raise RacError('Counter did not match after update')
+        expected_list = [dict(row) for row in before]
+        if matches:
+            expected_list[before.index(matches[0])] = current[0]
+        else:
+            expected_list.append(current[0])
+        if after != expected_list:
+            raise RacError('Counter list did not match after update')
+        return current[0]
+
+    async def remove_counter(self, cluster_id, name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Counter removal requires protocol 16.0')
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid counter name')
+        before = await self.list_counters(cluster)
+        matches = [row for row in before if row['name'] == name]
+        if len(matches) != 1:
+            raise ValueError('Counter not found or not unique')
+        if self.cluster_user:
+            await self._direct().remove_counter(cluster, name, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().remove_counter(cluster, name)
+        after = await self.list_counters(cluster)
+        if after != [row for row in before if row['name'] != name]:
+            raise RacError('Counter list did not match after removal')
+
+    async def clear_counter(self, cluster_id, name, object_filter=''):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Counter clear requires protocol 16.0')
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid counter name')
+        if (not isinstance(object_filter, str) or '\x00' in object_filter
+                or len(object_filter.encode('utf-8')) > 4096):
+            raise ValueError('Invalid counter object filter')
+        before = await self.list_counters(cluster)
+        matches = [row for row in before if row['name'] == name]
+        if len(matches) != 1:
+            raise ValueError('Counter not found or not unique')
+        if self.cluster_user:
+            await self._direct().clear_counter(cluster, name, object_filter,
+                                               cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().clear_counter(cluster, name, object_filter)
+        after = await self.list_counters(cluster)
+        if after != before:
+            raise RacError('Counter configuration changed after clear')
+        # Readings are not guaranteed to exist and the populated 16.0 values
+        # decoder is not live-verified; do not claim clearing them via read-back.
+        return matches[0]
+
+    async def list_counters(self, cluster_id):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 counters not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_counters(
+                cluster, cluster_os_user=self.cluster_user, cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_counters(cluster, cluster_os_user=self.cluster_user)
+        return await self._direct().list_counters(cluster)
+
+    async def get_counter(self, cluster_id, name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 counter info not exposed')
+        if self.cluster_user:
+            return await self._direct().get_counter(cluster, name, cluster_os_user=self.cluster_user)
+        return await self._direct().get_counter(cluster, name)
+
+    async def list_counter_values(self, cluster_id, counter, object_filter=''):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 counter values not exposed')
+        if self.cluster_user:
+            return await self._direct().list_counter_values(
+                cluster, counter, object_filter, cluster_os_user=self.cluster_user)
+        return await self._direct().list_counter_values(cluster, counter, object_filter)
+
+    async def list_accumulated_counter_values(self, cluster_id, counter, object_filter=''):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 accumulated counter values not exposed')
+        if self.cluster_user:
+            return await self._direct().list_accumulated_counter_values(
+                cluster, counter, object_filter, cluster_os_user=self.cluster_user)
+        return await self._direct().list_accumulated_counter_values(cluster, counter, object_filter)
+
+    async def update_limit(self, cluster_id, name, *, action=None, counter=None,
+                           error_message=None, descr=None, **thresholds):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Limit update requires protocol 16.0')
+        actions = ('none', 'set-low-priority-thread', 'interrupt-current-call',
+                   'interrupt-session')
+        names = ('duration', 'cpu_time', 'duration_dbms', 'duration_service',
+                 'memory', 'read', 'write', 'dbms_bytes', 'calls',
+                 'active_sessions', 'sessions')
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid limit name')
+        if action is not None and action not in actions:
+            raise ValueError('Invalid limit action')
+        for key, value in (('counter', counter), ('error-message', error_message), ('descr', descr)):
+            if value is not None and (not isinstance(value, str) or '\x00' in value
+                                      or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid limit ' + key)
+        if any(key not in names or type(value) is not int or not 0 <= value < 2**63
+               for key, value in thresholds.items()):
+            raise ValueError('Invalid limit threshold')
+        before = await self.list_limits(cluster)
+        matches = [row for row in before if row['name'] == name]
+        if len(matches) > 1:
+            raise ValueError('Limit not unique')
+        if matches:
+            if all(value is None for value in (action, counter, error_message, descr)) and not thresholds:
+                raise ValueError('Specify a limit field to update')
+            expected = {key: value for key, value in matches[0].items() if key != 'raw-action'}
+        else:
+            if action is None or counter is None:
+                raise ValueError('Limit creation requires action and counter')
+            expected = {'name': name, 'action': action, 'counter': counter,
+                        'error-message': '', 'descr': '',
+                        **{key.replace('_', '-'): 0 for key in names}}
+        for key, value in (('action', action), ('counter', counter),
+                           ('error-message', error_message), ('descr', descr)):
+            if value is not None:
+                expected[key] = value
+        expected.update({key.replace('_', '-'): value for key, value in thresholds.items()})
+        if self.cluster_user:
+            await self._direct().update_limit(cluster, expected, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().update_limit(cluster, expected)
+        after = await self.list_limits(cluster)
+        current = [row for row in after if row['name'] == name]
+        if len(current) != 1 or any(current[0].get(key) != value for key, value in expected.items()):
+            raise RacError('Limit did not match after update')
+        expected_list = [dict(row) for row in before]
+        if matches:
+            expected_list[before.index(matches[0])] = current[0]
+        else:
+            expected_list.append(current[0])
+        if after != expected_list:
+            raise RacError('Limit list did not match after update')
+        return current[0]
+
+    async def remove_limit(self, cluster_id, name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Limit removal requires protocol 16.0')
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid limit name')
+        before = await self.list_limits(cluster)
+        matches = [row for row in before if row['name'] == name]
+        if len(matches) != 1:
+            raise ValueError('Limit not found or not unique')
+        if self.cluster_user:
+            await self._direct().remove_limit(cluster, name, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().remove_limit(cluster, name)
+        after = await self.list_limits(cluster)
+        if after != [row for row in before if row['name'] != name]:
+            raise RacError('Limit list did not match after removal')
+
+    async def list_limits(self, cluster_id):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 limits not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_limits(
+                cluster, cluster_os_user=self.cluster_user, cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_limits(cluster, cluster_os_user=self.cluster_user)
+        return await self._direct().list_limits(cluster)
+
+    async def get_limit(self, cluster_id, name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 limit info not exposed')
+        if self.cluster_user:
+            return await self._direct().get_limit(cluster, name, cluster_os_user=self.cluster_user)
+        return await self._direct().get_limit(cluster, name)
+
+    async def list_managers(self, cluster_id):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 manager list is not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_managers(
+                cluster, cluster_os_user=self.cluster_user, cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_managers(cluster, cluster_os_user=self.cluster_user)
+        return await self._direct().list_managers(cluster)
+
+    async def get_manager(self, cluster_id, manager_id):
+        cluster = uuid.UUID(str(cluster_id))
+        manager = uuid.UUID(str(manager_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 manager info is not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).get_manager(
+                cluster, manager, cluster_os_user=self.cluster_user, cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().get_manager(cluster, manager, cluster_os_user=self.cluster_user)
+        return await self._direct().get_manager(cluster, manager)
+
+    async def list_services(self, cluster_id):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 service list is not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_services(
+                cluster, cluster_os_user=self.cluster_user, cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_services(cluster, cluster_os_user=self.cluster_user)
+        return await self._direct().list_services(cluster)
+
+    async def list_clusters(self):
+        if self.protocol == '10.0':
+            return await self._v8311('cluster', 'list')
+        return await self._direct().list_clusters()
+
+    async def get_cluster(self, cluster_id):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            rows = await self._v8311('cluster', 'info', cluster)
+            return rows[0]
+        return await self._direct().cluster_info(cluster)
+
+    async def list_servers(self, cluster_id):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 server list is not exposed by the existing client')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_servers(
+                cluster, cluster_os_user=self.cluster_user, cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_servers(cluster, cluster_os_user=self.cluster_user)
+        return await self._direct().list_servers(cluster)
+
+    async def get_server(self, cluster_id, server_id):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 server info is not exposed by the library')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).get_server(
+                cluster, server, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().get_server(cluster, server, cluster_os_user=self.cluster_user)
+        return await self._direct().get_server(cluster, server)
+
+    async def list_processes(self, cluster_id, server_id=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 process decoding is not implemented')
+        server = uuid.UUID(str(server_id)) if server_id is not None else None
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_processes(
+                cluster, server, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_processes(cluster, server, cluster_os_user=self.cluster_user)
+        return await self._direct().list_processes(cluster, server)
+
+    async def turn_off_process(self, cluster_id, process_id, *, verify_timeout=10.0,
+                               poll_interval=0.2):
+        """Request shutdown of an existing process and verify its disappearance.
+
+        A server ACK alone may also acknowledge an absent target. A timeout
+        means the result is unknown; it must not be reported as success.
+        """
+        cluster, process = uuid.UUID(str(cluster_id)), uuid.UUID(str(process_id))
+        if self.protocol != '16.0':
+            raise UnsupportedFeatureError('Process turn-off requires protocol 16.0')
+        for value in (verify_timeout, poll_interval):
+            if type(value) not in (int, float) or not 0 <= value <= 60:
+                raise ValueError('Invalid process verification budget')
+        direct = self._direct()
+        if self.cluster_user:
+            raise UnsupportedFeatureError('OS-authenticated process turn-off is not verified')
+        before = await self.list_processes(cluster)
+        if sum(row['process'] == str(process) for row in before) != 1:
+            raise ValueError('Process not found or not unique')
+        await direct.turn_off_process(cluster, process)
+        deadline = time.monotonic() + verify_timeout
+        while True:
+            after = await self.list_processes(cluster)
+            if all(row['process'] != str(process) for row in after):
+                return after
+            if time.monotonic() >= deadline:
+                raise RacError('Process turn-off not verified before timeout')
+            await asyncio.sleep(min(poll_interval, max(0, deadline - time.monotonic())))
+
+    async def get_process(self, cluster_id, process_id):
+        cluster, process = uuid.UUID(str(cluster_id)), uuid.UUID(str(process_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 process info is not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).get_process(
+                cluster, process, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().get_process(cluster, process, cluster_os_user=self.cluster_user)
+        return await self._direct().get_process(cluster, process)
+
+    async def list_connections(self, cluster_id, infobase_id=None, *, process_id=None):
+        cluster = uuid.UUID(str(cluster_id))
+        infobase = uuid.UUID(str(infobase_id)) if infobase_id is not None else None
+        process = uuid.UUID(str(process_id)) if process_id is not None else None
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 connections not exposed')
+        if self.cluster_password is not None:
+            rows = await self._direct(allow_password=True).list_connections(
+                cluster, infobase, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        elif self.cluster_user:
+            rows = await self._direct().list_connections(cluster, infobase, cluster_os_user=self.cluster_user)
+        else:
+            rows = await self._direct().list_connections(cluster, infobase)
+        # No verified 16.0 process-scoped request without an infobase ID.
+        # Filter the decoded cluster/infobase list locally rather than guess a wire ID.
+        if process is None:
+            return rows
+        matching = []
+        for row in rows:
+            try:
+                if uuid.UUID(str(row['process'])) == process:
+                    matching.append(row)
+            except (KeyError, TypeError, ValueError):
+                continue
+        return matching
+
+    async def get_connection(self, cluster_id, connection_id):
+        cluster, connection = uuid.UUID(str(cluster_id)), uuid.UUID(str(connection_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 connection info not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).get_connection(
+                cluster, connection, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().get_connection(cluster, connection, cluster_os_user=self.cluster_user)
+        return await self._direct().get_connection(cluster, connection)
+
+    async def list_locks(self, cluster_id, *, infobase_id=None, connection_id=None, session_id=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 locks not exposed')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_locks(
+                cluster, infobase_id, connection_id, session_id,
+                cluster_os_user=self.cluster_user, cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_locks(cluster, infobase_id, connection_id, session_id,
+                                                   cluster_os_user=self.cluster_user)
+        return await self._direct().list_locks(cluster, infobase_id, connection_id, session_id)
+
+    async def insert_rule(self, cluster_id, server_id, position, *, object_type='',
+                          infobase_name='', rule_type='auto', application_ext='', priority=0):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Assignment rule insert requires protocol 16.0')
+        if type(position) is not int or not 0 <= position < 2**31:
+            raise ValueError('Invalid rule position')
+        if type(priority) is not int or not -(2**31) <= priority < 2**31:
+            raise ValueError('Invalid rule priority')
+        if rule_type not in ('never', 'auto', 'always'):
+            raise ValueError('Invalid rule type')
+        for value in (object_type, infobase_name, application_ext):
+            if not isinstance(value, str) or '\x00' in value or len(value.encode('utf-8')) > 1024:
+                raise ValueError('Invalid rule field')
+        before = await self.list_rules(cluster, server)
+        if position > len(before):
+            raise ValueError('Rule position outside current list')
+        if self.cluster_user:
+            ident = await self._direct().insert_rule(
+                cluster, server, position, object_type=object_type, infobase_name=infobase_name,
+                rule_type=rule_type, application_ext=application_ext, priority=priority,
+                cluster_os_user=self.cluster_user)
+        else:
+            ident = await self._direct().insert_rule(
+                cluster, server, position, object_type=object_type, infobase_name=infobase_name,
+                rule_type=rule_type, application_ext=application_ext, priority=priority)
+        after = await self.list_rules(cluster, server)
+        expected = {'rule': str(ident), 'object-type': object_type,
+                    'infobase-name': infobase_name,
+                    'raw-rule-type': {'never': 0, 'auto': 1, 'always': 2}[rule_type],
+                    'rule-type': rule_type, 'application-ext': application_ext,
+                    'priority': priority}
+        if (len(after) != len(before) + 1 or after[position] != expected
+                or after[:position] + after[position+1:] != before):
+            raise RacError('Assignment rule did not match after insert')
+        return expected
+
+    async def update_rule(self, cluster_id, server_id, rule_id, position, *,
+                          object_type=None, infobase_name=None, rule_type=None,
+                          application_ext=None, priority=None):
+        cluster, server, rule = (uuid.UUID(str(value)) for value in
+                                 (cluster_id, server_id, rule_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Assignment rule update requires protocol 16.0')
+        if type(position) is not int or not 0 <= position < 2**31:
+            raise ValueError('Invalid rule position')
+        if priority is not None and (type(priority) is not int or not -(2**31) <= priority < 2**31):
+            raise ValueError('Invalid rule priority')
+        if rule_type is not None and rule_type not in ('never', 'auto', 'always'):
+            raise ValueError('Invalid rule type')
+        for value in (object_type, infobase_name, application_ext):
+            if value is not None and (not isinstance(value, str) or '\x00' in value
+                                      or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid rule field')
+        before = await self.list_rules(cluster, server)
+        matches = [row for row in before if row['rule'] == str(rule)]
+        if len(matches) != 1 or position >= len(before):
+            raise ValueError('Assignment rule not found, not unique or invalid position')
+        desired = dict(matches[0])
+        for key, value in (('object-type', object_type), ('infobase-name', infobase_name),
+                           ('rule-type', rule_type), ('application-ext', application_ext),
+                           ('priority', priority)):
+            if value is not None:
+                desired[key] = value
+        desired['raw-rule-type'] = {'never': 0, 'auto': 1, 'always': 2}[desired['rule-type']]
+        if self.cluster_user:
+            await self._direct().update_rule(cluster, server, position, desired,
+                                             cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().update_rule(cluster, server, position, desired)
+        after = await self.list_rules(cluster, server)
+        remaining = [row for row in before if row['rule'] != str(rule)]
+        if (len(after) != len(before) or after[position] != desired
+                or after[:position] + after[position+1:] != remaining):
+            raise RacError('Assignment rule did not match after update')
+        return desired
+
+    async def apply_rules(self, cluster_id, *, full=True):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Assignment rule apply requires protocol 16.0')
+        if type(full) is not bool:
+            raise ValueError('Invalid assignment rule apply mode')
+        servers = await self.list_servers(cluster)
+        before = {row['server']: await self.list_rules(cluster, row['server']) for row in servers}
+        if not any(before.values()):
+            raise ValueError('No assignment rules to apply')
+        if self.cluster_user:
+            await self._direct().apply_rules(cluster, full=full, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().apply_rules(cluster, full=full)
+        after = {row['server']: await self.list_rules(cluster, row['server']) for row in servers}
+        if after != before:
+            raise RacError('Assignment rules changed after apply')
+        # The active allocation policy is not exposed by list/info: this checks
+        # the acknowledgement and unchanged rules, not effective placement.
+        return after
+
+    async def remove_rule(self, cluster_id, server_id, rule_id):
+        cluster, server, rule = (uuid.UUID(str(value)) for value in
+                                 (cluster_id, server_id, rule_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Assignment rule remove requires protocol 16.0')
+        before = await self.list_rules(cluster, server)
+        matches = [row for row in before if row['rule'] == str(rule)]
+        if len(matches) != 1:
+            raise ValueError('Assignment rule not found or not unique')
+        if self.cluster_user:
+            await self._direct().remove_rule(cluster, server, rule, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().remove_rule(cluster, server, rule)
+        after = await self.list_rules(cluster, server)
+        remaining = [row for row in before if row['rule'] != str(rule)]
+        if after != remaining:
+            raise RacError('Assignment rule did not match after remove')
+
+    async def list_rules(self, cluster_id, server_id):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 assignment rules not exposed')
+        if self.cluster_user:
+            return await self._direct().list_rules(cluster, server, cluster_os_user=self.cluster_user)
+        return await self._direct().list_rules(cluster, server)
+
+    async def get_rule(self, cluster_id, server_id, rule_id):
+        cluster, server, rule = (uuid.UUID(str(item)) for item in (cluster_id, server_id, rule_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 assignment rule info not exposed')
+        if self.cluster_user:
+            return await self._direct().get_rule(cluster, server, rule, cluster_os_user=self.cluster_user)
+        return await self._direct().get_rule(cluster, server, rule)
+
+    async def list_binary_storages(self, cluster_id, infobase_id):
+        cluster = uuid.UUID(str(cluster_id))
+        infobase = uuid.UUID(str(infobase_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Binary data storage list requires protocol 16.0')
+        direct = self._direct()  # Reject unverified password authentication before wire I/O.
+        if self.cluster_user:
+            return await direct.list_binary_storages(
+                cluster, infobase, cluster_os_user=self.cluster_user)
+        return await direct.list_binary_storages(cluster, infobase)
+
+    async def create_infobase(self, cluster_id, *, name, db_name, db_server, db_user, locale,
+                              create_database, descr='', scheduled_jobs_denied=False,
+                              license_distribution='deny', date_offset=0, security_level=0):
+        if type(security_level) is not int or security_level not in (0, 1):
+            raise ValueError('Invalid security_level')
+        if type(date_offset) is not int or date_offset not in (0, 2000):
+            raise ValueError('Invalid date_offset')
+        if license_distribution not in ('allow', 'deny') or type(license_distribution) is not str:
+            raise ValueError('Invalid license_distribution')
+        if type(scheduled_jobs_denied) is not bool:
+            raise ValueError('Invalid scheduled_jobs_denied')
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Infobase create requires protocol 16.0')
+        if type(create_database) is not bool:
+            raise ValueError('Explicit boolean create_database policy required')
+        for label, value in (('name', name), ('db_name', db_name), ('db_server', db_server),
+                             ('db_user', db_user), ('locale', locale)):
+            if (not isinstance(value, str) or not value or '\x00' in value
+                    or len(value.encode('utf-8')) > 255):
+                raise ValueError('Invalid infobase ' + label)
+        if not isinstance(descr, str) or '\x00' in descr or len(descr.encode('utf-8')) > 1024:
+            raise ValueError('Invalid infobase description')
+        cluster = uuid.UUID(str(cluster_id))
+        direct = self._direct()
+        before = await self.list_infobases(cluster)
+        if any(row['name'] == name for row in before):
+            raise ValueError('Infobase name already exists')
+        create_options = {}
+        if scheduled_jobs_denied:
+            create_options['scheduled_jobs_denied'] = True
+        if license_distribution != 'deny':
+            create_options['license_distribution'] = license_distribution
+        if date_offset:
+            create_options['date_offset'] = date_offset
+        if security_level:
+            create_options['security_level'] = security_level
+        ident = await direct.create_infobase(cluster, name=name, db_name=db_name,
+            db_server=db_server, db_user=db_user, locale=locale,
+            create_database=create_database, descr=descr, **create_options)
+        after = await self.list_infobases(cluster)
+        expected = {'infobase': str(ident), 'name': name, 'descr': descr}
+        if after != before + [expected]:
+            raise RacError('Infobase list did not match after create')
+        full = await self.get_infobase_info(cluster, ident)
+        verified = (('infobase', str(ident)), ('name', name), ('descr', descr),
+                    ('db_name', db_name), ('db_server_name', db_server),
+                    ('db_user', db_user), ('dbms', 'PostgreSQL'), ('locale', locale))
+        if (any(full.get(key) != value for key, value in verified)
+                or full.get('scheduled_jobs_denied') is not scheduled_jobs_denied
+                or full.get('license_distribution') != {'allow': 1, 'deny': 0}[license_distribution]
+                or full.get('date_offset') != date_offset
+                or full.get('security_level') != security_level):
+            raise RacError('Infobase info did not match after create')
+        return full
+
+    async def drop_infobase(self, cluster_id, infobase_id, *, drop_database,
+                            clear_database=False):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Infobase drop requires protocol 16.0')
+        if type(drop_database) is not bool or type(clear_database) is not bool:
+            raise ValueError('Explicit boolean drop_database/clear_database policy required')
+        if drop_database and clear_database:
+            raise ValueError('Conflicting infobase database policy')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before = await self.list_infobases(cluster)
+        matches = [row for row in before if row['infobase'] == str(ident)]
+        if len(matches) != 1:
+            raise ValueError('Infobase not found or not unique')
+        drop_options = {'clear_database': True} if clear_database else {}
+        if self.cluster_user:
+            await direct.drop_infobase(cluster, ident, drop_database=drop_database,
+                                       cluster_os_user=self.cluster_user, **drop_options)
+        else:
+            await direct.drop_infobase(cluster, ident, drop_database=drop_database,
+                                       **drop_options)
+        after = await self.list_infobases(cluster)
+        if after != [row for row in before if row['infobase'] != str(ident)]:
+            raise RacError('Infobase list did not match after drop')
+        return after
+
+    async def update_infobase_safe_mode_security_profile(self, cluster_id, infobase_id, name):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Infobase safe mode security profile update requires protocol 16.0')
+        if (not isinstance(name, str) or '\x00' in name or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        if len([row for row in before_list if row['infobase'] == str(ident)]) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_safe_mode_security_profile(cluster, ident, name)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        if after != before | {'safe_mode_securirty_profile': name} or after_list != before_list:
+            raise RacError('Infobase safe mode security profile did not match after update')
+        return after
+
+    async def update_infobase_security_profile(self, cluster_id, infobase_id, name):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Infobase security profile update requires protocol 16.0')
+        if (not isinstance(name, str) or '\x00' in name or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        if len([row for row in before_list if row['infobase'] == str(ident)]) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_security_profile(cluster, ident, name)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        if after != before | {'securirty_profile': name} or after_list != before_list:
+            raise RacError('Infobase security profile did not match after update')
+        return after
+
+    async def update_infobase_maximum_scheduled_jobs_start_shift(self, cluster_id, infobase_id, shift):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Maximum scheduled jobs shift update requires protocol 16.0')
+        if type(shift) is not int or not 0 <= shift <= 255:
+            raise ValueError('Invalid maximum scheduled jobs start shift')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        if len([row for row in before_list if row['infobase'] == str(ident)]) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_maximum_scheduled_jobs_start_shift(cluster, ident, shift)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        key = 'maximum_scheduled_jobs_start_shift_without_active_users'
+        if after != before | {key: shift} or after_list != before_list:
+            raise RacError('Maximum scheduled jobs shift did not match after update')
+        return after
+
+    async def update_infobase_minimum_scheduled_jobs_start_period(self, cluster_id, infobase_id, period):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Minimum scheduled jobs period update requires protocol 16.0')
+        if type(period) is not int or not 0 <= period <= 0xffffffff:
+            raise ValueError('Invalid minimum scheduled jobs start period')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        if len([row for row in before_list if row['infobase'] == str(ident)]) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_minimum_scheduled_jobs_start_period(cluster, ident, period)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        key = 'minimum_scheduled_jobs_start_period_without_active_users'
+        if after != before | {key: period} or after_list != before_list:
+            raise RacError('Minimum scheduled jobs period did not match after update')
+        return after
+
+    async def update_infobase_configuration_unload_delay(self, cluster_id, infobase_id, delay):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Configuration unload delay update requires protocol 16.0')
+        if type(delay) is not int or not 0 <= delay <= 0xffffffff:
+            raise ValueError('Invalid configuration unload delay')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        if len([row for row in before_list if row['infobase'] == str(ident)]) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_configuration_unload_delay(cluster, ident, delay)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        key = 'configuration_unload_delay_by_working_process_without_active_users'
+        if after != before | {key: delay} or after_list != before_list:
+            raise RacError('Configuration unload delay did not match after update')
+        return after
+
+    async def update_infobase_disable_local_speech_to_text(self, cluster_id, infobase_id, disabled):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Local speech-to-text update requires protocol 16.0')
+        if type(disabled) is not bool:
+            raise ValueError('Disable local speech to text must be boolean')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        if len([row for row in before_list if row['infobase'] == str(ident)]) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_disable_local_speech_to_text(cluster, ident, disabled)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        if after != before | {'disable_local_speech_to_text': disabled} or after_list != before_list:
+            raise RacError('Local speech-to-text flag did not match after update')
+        return after
+
+    async def update_infobase_external_session_manager_required(self, cluster_id, infobase_id, required):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('External session manager update requires protocol 16.0')
+        if type(required) is not bool:
+            raise ValueError('External session manager required must be boolean')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        if len([row for row in before_list if row['infobase'] == str(ident)]) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_external_session_manager_required(cluster, ident, required)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        if after != before | {'external_session_manager_required': required} or after_list != before_list:
+            raise RacError('External session manager required did not match after update')
+        return after
+
+    async def update_infobase_reserve_working_processes(self, cluster_id, infobase_id, reserve):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Infobase reserve working processes update requires protocol 16.0')
+        if type(reserve) is not bool:
+            raise ValueError('Reserve working processes must be boolean')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        if len([row for row in before_list if row['infobase'] == str(ident)]) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_reserve_working_processes(cluster, ident, reserve)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        if after != before | {'reserve_working_processes': reserve} or after_list != before_list:
+            raise RacError('Infobase reserve working processes did not match after update')
+        return after
+
+    async def update_infobase_denied_message(self, cluster_id, infobase_id, message):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Infobase denied message update requires protocol 16.0')
+        if not isinstance(message, str) or '\x00' in message:
+            raise ValueError('Invalid denied message')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        if len([row for row in before_list if row['infobase'] == str(ident)]) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_denied_message(cluster, ident, message)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        if after != before | {'denied_message': message} or after_list != before_list:
+            raise RacError('Infobase denied message did not match after update')
+        return after
+
+    async def update_infobase_license_distribution(self, cluster_id, infobase_id, distribution):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Infobase license distribution update requires protocol 16.0')
+        if distribution not in ('allow', 'deny'):
+            raise ValueError('Invalid license distribution')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        if len([row for row in before_list if row['infobase'] == str(ident)]) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_license_distribution(cluster, ident, distribution)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        expected = 1 if distribution == 'allow' else 0
+        if after != before | {'license_distribution': expected} or after_list != before_list:
+            raise RacError('Infobase license distribution did not match after update')
+        return after
+
+    async def update_infobase_sessions_deny(self, cluster_id, infobase_id, denied):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Infobase sessions deny update requires protocol 16.0')
+        if type(denied) is not bool:
+            raise ValueError('Sessions deny must be boolean')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        if len([row for row in before_list if row['infobase'] == str(ident)]) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_sessions_deny(cluster, ident, denied)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        if after != before | {'sessions_denied': denied} or after_list != before_list:
+            raise RacError('Infobase sessions deny did not match after update')
+        return after
+
+    async def update_infobase_scheduled_jobs_deny(self, cluster_id, infobase_id, denied):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Infobase scheduled jobs update requires protocol 16.0')
+        if type(denied) is not bool:
+            raise ValueError('Scheduled jobs deny must be boolean')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        if len([row for row in before_list if row['infobase'] == str(ident)]) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_scheduled_jobs_deny(cluster, ident, denied)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        if after != before | {'scheduled_jobs_denied': denied} or after_list != before_list:
+            raise RacError('Infobase scheduled jobs deny did not match after update')
+        return after
+
+    async def update_infobase_description(self, cluster_id, infobase_id, description):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Infobase full update requires protocol 16.0')
+        if (not isinstance(description, str) or '\x00' in description
+                or len(description.encode('utf-8')) > 1024):
+            raise ValueError('Invalid infobase description')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        before_list = await self.list_infobases(cluster)
+        matches = [row for row in before_list if row['infobase'] == str(ident)]
+        if len(matches) != 1:
+            raise ValueError('Infobase not found or not unique')
+        before = await self.get_infobase_info(cluster, ident)
+        await direct.update_infobase_description(cluster, ident, description)
+        after = await self.get_infobase_info(cluster, ident)
+        after_list = await self.list_infobases(cluster)
+        expected_list = [row | {'descr': description} if row['infobase'] == str(ident) else row
+                         for row in before_list]
+        if after != before | {'descr': description} or after_list != expected_list:
+            raise RacError('Infobase information did not match after update')
+        return after
+
+    async def update_infobase_summary_description(self, cluster_id, infobase_id, description):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Infobase summary update requires protocol 16.0')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        if (not isinstance(description, str) or '\x00' in description
+                or len(description.encode('utf-8')) > 1024):
+            raise ValueError('Invalid infobase summary description')
+        direct = self._direct()
+        before = await self.list_infobases(cluster)
+        matches = [row for row in before if row['infobase'] == str(ident)]
+        if len(matches) != 1:
+            raise ValueError('Infobase not found or not unique')
+        if self.cluster_user:
+            await direct.update_infobase_summary_description(
+                cluster, ident, description, cluster_os_user=self.cluster_user)
+        else:
+            await direct.update_infobase_summary_description(cluster, ident, description)
+        after = await self.list_infobases(cluster)
+        expected = [row | {'descr': description} if row['infobase'] == str(ident) else row
+                    for row in before]
+        if after != expected:
+            raise RacError('Infobase summary description did not change as expected')
+        return next(row for row in after if row['infobase'] == str(ident))
+
+    async def list_infobases(self, cluster_id):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            return await self._v8311('infobase', 'summary', cluster, subcommand2='list')
+        if self.cluster_password is not None:
+            return await self._direct(allow_password=True).list_infobases(
+                cluster, cluster_os_user=self.cluster_user, cluster_password=self.cluster_password)
+        if self.cluster_user:
+            return await self._direct().list_infobases(cluster, cluster_os_user=self.cluster_user)
+        return await self._direct().list_infobases(cluster)
+
+    async def get_infobase_info(self, cluster_id, infobase_id=None, *, name=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if (infobase_id is None) == (name is None):
+            raise ValueError('Specify exactly one of infobase_id or name')
+        if name is not None and (not isinstance(name, str) or not name.strip() or '\x00' in name or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid infobase name')
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('Infobase full info requires protocol 16.0')
+        if name is not None:
+            matches = [row for row in await self.list_infobases(cluster) if row['name'] == name]
+            if len(matches) != 1:
+                raise ValueError('Infobase name is not unique or not found')
+            infobase_id = matches[0]['infobase']
+        ident = uuid.UUID(str(infobase_id))
+        direct = self._direct()
+        if self.cluster_user:
+            row = await direct.get_infobase_info(cluster, ident, cluster_os_user=self.cluster_user)
+        else:
+            row = await direct.get_infobase_info(cluster, ident)
+        if name is not None and (row['infobase'] != str(ident) or row['name'] != name):
+            raise ValueError('Infobase name changed during lookup')
+        return row
+
+    async def get_infobase_summary(self, cluster_id, infobase_id=None, *, name=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if (infobase_id is None) == (name is None):
+            raise ValueError('Specify exactly one of infobase_id or name')
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('1C 8.3.11 infobase summary info not exposed')
+        if name is not None:
+            if not isinstance(name, str) or not name.strip() or '\x00' in name or len(name.encode('utf-8')) > 1024:
+                raise ValueError('Invalid infobase name')
+            matches = [row for row in await self.list_infobases(cluster) if row['name'] == name]
+            if len(matches) != 1:
+                raise ValueError('Infobase name is not unique or not found')
+            infobase_id = matches[0]['infobase']
+        ident = uuid.UUID(str(infobase_id))
+        if self.cluster_password is not None:
+            row = await self._direct(allow_password=True).get_infobase_summary(
+                cluster, ident, cluster_os_user=self.cluster_user,
+                cluster_password=self.cluster_password)
+        elif self.cluster_user:
+            row = await self._direct().get_infobase_summary(
+                cluster, ident, cluster_os_user=self.cluster_user)
+        else:
+            row = await self._direct().get_infobase_summary(cluster, ident)
+        if name is not None and (row['infobase'] != str(ident) or row['name'] != name):
+            raise ValueError('Infobase name changed during lookup')
+        return row
+
+    @staticmethod
+    def _validate_schedule(schedule):
+        if not isinstance(schedule, str) or len(schedule) > 256 or not re.fullmatch(r'[0-9 ,/\-]*', schedule):
+            raise ValueError('Invalid restart schedule')
+
+    async def remove_cluster(self, cluster_id):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('cluster remove requires protocol 16.0')
+        before = await self.list_clusters()
+        matches = [row for row in before if row['cluster'] == str(cluster)]
+        if len(matches) != 1:
+            raise ValueError('Cluster not found or not unique')
+        if self.cluster_user:
+            await self._direct().remove_cluster(cluster, cluster_os_user=self.cluster_user)
+        else:
+            await self._direct().remove_cluster(cluster)
+        after = await self.list_clusters()
+        if after != [row for row in before if row['cluster'] != str(cluster)]:
+            raise RacError('Cluster list did not match after remove')
+        return after
+
+    async def insert_cluster(self, host, port, name='', *, expiration_timeout=60, security_level=0,
+                             session_fault_tolerance_level=0, load_balancing_mode='performance',
+                             kill_problem_processes=True, kill_by_memory_with_dump=False,
+                             restart_schedule='', ping_period=0, ping_timeout=0, audit=False):
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('cluster insert requires protocol 16.0')
+        if (not isinstance(host, str) or not host or '\x00' in host
+                or len(host.encode('utf-8')) > 255 or type(port) is not int or not 1 <= port <= 65535
+                or not isinstance(name, str) or '\x00' in name
+                or len(name.encode('utf-8')) > 256):
+            raise ValueError('Invalid cluster insert parameters')
+        if type(expiration_timeout) is not int or not 0 <= expiration_timeout < 2**31:
+            raise ValueError('Invalid cluster expiration timeout')
+        if type(security_level) is not int or not 0 <= security_level < 2**31:
+            raise ValueError('Invalid cluster security level')
+        if (type(session_fault_tolerance_level) is not int
+                or not 0 <= session_fault_tolerance_level < 2**31):
+            raise ValueError('Invalid cluster session fault tolerance level')
+        if load_balancing_mode not in ('performance', 'memory') or type(load_balancing_mode) is not str:
+            raise ValueError('Invalid cluster load balancing mode')
+        if type(kill_problem_processes) is not bool:
+            raise ValueError('Invalid cluster kill problem processes setting')
+        if type(kill_by_memory_with_dump) is not bool:
+            raise ValueError('Invalid cluster kill by memory with dump setting')
+        if type(audit) is not bool:
+            raise ValueError('Invalid cluster audit flag')
+        if (not isinstance(restart_schedule, str)
+                or (restart_schedule and (len(restart_schedule.encode('utf-8')) > 256
+                    or len(restart_schedule.split()) != 6
+                    or any(not part.isascii() or not part.isdecimal()
+                           for part in restart_schedule.split())))
+                or '\x00' in restart_schedule):
+            raise ValueError('Invalid cluster restart schedule')
+        if (type(ping_period) is not int or type(ping_timeout) is not int
+                or not ((ping_period == ping_timeout == 0)
+                        or (0 < ping_period < ping_timeout < 2**31))):
+            raise ValueError('Invalid cluster ping period/timeout pair')
+        before = await self.list_clusters()
+        direct_insert = self._direct().insert_cluster
+        async def insert(*args, **kwargs):
+            if self.agent_user:
+                kwargs['agent_os_user'] = self.agent_user
+            if audit:
+                kwargs['audit'] = audit
+            return await direct_insert(*args, **kwargs)
+        defaults = {'expiration_timeout': 60, 'security_level': 0,
+                    'session_fault_tolerance_level': 0, 'load_balancing_mode': 'performance',
+                    'kill_problem_processes': True, 'kill_by_memory_with_dump': False,
+                    'restart_schedule': '', 'ping_period': 0, 'ping_timeout': 0}
+        requested = {'expiration_timeout': expiration_timeout, 'security_level': security_level,
+                     'session_fault_tolerance_level': session_fault_tolerance_level,
+                     'load_balancing_mode': load_balancing_mode,
+                     'kill_problem_processes': kill_problem_processes,
+                     'kill_by_memory_with_dump': kill_by_memory_with_dump,
+                     'restart_schedule': restart_schedule, 'ping_period': ping_period,
+                     'ping_timeout': ping_timeout}
+        options = {key: value for key, value in requested.items() if value != defaults[key]}
+        ident = await insert(host, port, name, **options)
+        after = await self.list_clusters()
+        matches = [row for row in after if row['cluster'] == str(ident)]
+        if (len(after) != len(before) + 1 or len(matches) != 1
+                or [row for row in after if row['cluster'] != str(ident)] != before
+                or matches[0] != await self.get_cluster(ident)
+                or any(matches[0][key] != value for key, value in
+                       (('host', host), ('port', port), ('name', name),
+                        ('expiration-timeout', expiration_timeout), ('security-level', security_level),
+                        ('session-fault-tolerance-level', session_fault_tolerance_level),
+                        ('load-balancing-mode', load_balancing_mode),
+                        ('kill-problem-processes', int(kill_problem_processes)),
+                        ('kill-by-memory-with-dump', int(kill_by_memory_with_dump)),
+                        ('restart-schedule', restart_schedule),
+                        ('ping-period', ping_period), ('ping-timeout', ping_timeout)))
+                or matches[0].get('allow-access-right-audit-events-recording') != int(audit)):
+            raise RacError('Cluster did not match after insert')
+        return matches[0]
+
+    async def update_cluster_audit(self, cluster_id, enabled):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('cluster audit update requires protocol 16.0')
+        if type(enabled) is not bool:
+            raise ValueError('Invalid cluster audit flag')
+        before = await self.get_cluster(cluster)
+        if self.agent_user:
+            await self._direct().update_cluster_audit(cluster, enabled, agent_os_user=self.agent_user)
+        else:
+            await self._direct().update_cluster_audit(cluster, enabled)
+        result = await self.get_cluster(cluster)
+        if result != {**before, 'allow-access-right-audit-events-recording': int(enabled)}:
+            raise RacError('Cluster audit flag did not match after update')
+        return result
+
+    async def update_cluster_ping(self, cluster_id, period, timeout):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('cluster ping update requires protocol 16.0')
+        if (type(period) is not int or type(timeout) is not int or
+                not ((period == 0 and timeout == 0) or (0 < period < timeout <= 2_147_483_647))):
+            raise ValueError('Invalid cluster ping period/timeout pair')
+        before = await self.get_cluster(cluster)
+        if self.agent_user:
+            await self._direct().update_cluster_ping(cluster, period, timeout, agent_os_user=self.agent_user)
+        else:
+            await self._direct().update_cluster_ping(cluster, period, timeout)
+        result = await self.get_cluster(cluster)
+        if result != {**before, 'ping-period': period, 'ping-timeout': timeout}:
+            raise RacError('Cluster ping period/timeout did not match after update')
+        return result
+
+    async def update_cluster_kill_by_memory_with_dump(self, cluster_id, enabled):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('cluster kill by memory dump update requires protocol 16.0')
+        if type(enabled) is not bool:
+            raise ValueError('Invalid kill by memory dump flag')
+        before = await self.get_cluster(cluster)
+        if self.agent_user:
+            await self._direct().update_cluster_kill_by_memory_with_dump(cluster, enabled,
+                                                                          agent_os_user=self.agent_user)
+        else:
+            await self._direct().update_cluster_kill_by_memory_with_dump(cluster, enabled)
+        result = await self.get_cluster(cluster)
+        if result != {**before, 'kill-by-memory-with-dump': int(enabled)}:
+            raise RacError('Cluster kill by memory dump did not match after update')
+        return result
+
+    async def update_cluster_kill_problem_processes(self, cluster_id, enabled):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('cluster kill problem processes update requires protocol 16.0')
+        if type(enabled) is not bool:
+            raise ValueError('Invalid kill problem processes flag')
+        before = await self.get_cluster(cluster)
+        if self.agent_user:
+            await self._direct().update_cluster_kill_problem_processes(cluster, enabled,
+                                                                       agent_os_user=self.agent_user)
+        else:
+            await self._direct().update_cluster_kill_problem_processes(cluster, enabled)
+        result = await self.get_cluster(cluster)
+        if result != {**before, 'kill-problem-processes': int(enabled)}:
+            raise RacError('Cluster kill problem processes did not match after update')
+        return result
+
+    async def update_cluster_load_balancing_mode(self, cluster_id, mode):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('cluster load balancing update requires protocol 16.0')
+        if mode not in ('performance', 'memory'):
+            raise ValueError('Invalid cluster load balancing mode')
+        before = await self.get_cluster(cluster)
+        if self.agent_user:
+            await self._direct().update_cluster_load_balancing_mode(cluster, mode, agent_os_user=self.agent_user)
+        else:
+            await self._direct().update_cluster_load_balancing_mode(cluster, mode)
+        result = await self.get_cluster(cluster)
+        if result != {**before, 'load-balancing-mode': mode}:
+            raise RacError('Cluster load balancing mode did not match after update')
+        return result
+
+    async def update_cluster_session_fault_tolerance_level(self, cluster_id, level):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('cluster session fault tolerance update requires protocol 16.0')
+        if type(level) is not int or not 0 <= level <= 2_147_483_647:
+            raise ValueError('Invalid cluster session fault tolerance level')
+        before = await self.get_cluster(cluster)
+        if self.agent_user:
+            await self._direct().update_cluster_session_fault_tolerance_level(
+                cluster, level, agent_os_user=self.agent_user)
+        else:
+            await self._direct().update_cluster_session_fault_tolerance_level(cluster, level)
+        result = await self.get_cluster(cluster)
+        if result != {**before, 'session-fault-tolerance-level': level}:
+            raise RacError('Cluster session fault tolerance level did not match after update')
+        return result
+
+    async def update_cluster_security_level(self, cluster_id, level):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('cluster security level update requires protocol 16.0')
+        if type(level) is not int or not 0 <= level <= 2_147_483_647:
+            raise ValueError('Invalid cluster security level')
+        before = await self.get_cluster(cluster)
+        if self.agent_user:
+            await self._direct().update_cluster_security_level(cluster, level, agent_os_user=self.agent_user)
+        else:
+            await self._direct().update_cluster_security_level(cluster, level)
+        result = await self.get_cluster(cluster)
+        if result != {**before, 'security-level': level}:
+            raise RacError('Cluster security level did not match after update')
+        return result
+
+    async def update_cluster_expiration_timeout(self, cluster_id, seconds):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('cluster timeout update requires protocol 16.0')
+        if isinstance(seconds, bool) or not isinstance(seconds, int) or not 0 <= seconds <= 2_147_483_647:
+            raise ValueError('Invalid cluster expiration timeout')
+        before = await self.get_cluster(cluster)
+        if self.agent_user:
+            await self._direct().update_cluster_expiration_timeout(cluster, seconds,
+                                                                   agent_os_user=self.agent_user)
+        else:
+            await self._direct().update_cluster_expiration_timeout(cluster, seconds)
+        result = await self.get_cluster(cluster)
+        if result != {**before, 'expiration-timeout': seconds}:
+            raise RacError('Cluster expiration timeout did not match after update')
+        return result
+
+    async def update_cluster_name(self, cluster_id, name):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('cluster name update requires protocol 16.0')
+        if not isinstance(name, str) or (name and not name.strip()) or len(name.encode('utf-8')) > 256 or '\x00' in name:
+            raise ValueError('Invalid cluster name')
+        before = await self.get_cluster(cluster)
+        if self.agent_user:
+            await self._direct().update_cluster_name(cluster, name, agent_os_user=self.agent_user)
+        else:
+            await self._direct().update_cluster_name(cluster, name)
+        result = await self.get_cluster(cluster)
+        if result != {**before, 'name': name}:
+            raise RacError('Cluster name did not match after update')
+        return result
+
+    async def update_restart_schedule(self, cluster_id, schedule):
+        cluster = uuid.UUID(str(cluster_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('restart schedule requires protocol 16.0')
+        self._validate_schedule(schedule)
+        before = await self.get_cluster(cluster)
+        if self.agent_user:
+            await self._direct().update_cluster_schedule(cluster, schedule, agent_os_user=self.agent_user)
+        else:
+            await self._direct().update_cluster_schedule(cluster, schedule)
+        result = await self.get_cluster(cluster)
+        if result != {**before, 'restart-schedule': schedule}:
+            raise RacError('Restart schedule did not match after update')
+        return result
+
+    async def update_server_port_ranges(self, cluster_id, server_id, ranges):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('server port range update requires protocol 16.0')
+        if (type(ranges) is not list or not ranges or len(ranges) > 64
+                or any(type(pair) not in (tuple, list) or len(pair) != 2
+                       or any(type(port) is not int or not 1 <= port <= 65535 for port in pair)
+                       or pair[0] > pair[1] for pair in ranges)):
+            raise ValueError('Invalid server port ranges')
+        sorted_ranges = sorted(ranges)
+        if any(previous[1] >= following[0] for previous, following in zip(sorted_ranges, sorted_ranges[1:])):
+            raise ValueError('Overlapping server port ranges')
+        before = await self.get_server(cluster, server)
+        await self._direct().update_server_port_ranges(cluster, server, ranges)
+        result = await self.get_server(cluster, server)
+        if result != {**before, 'port_ranges': [tuple(pair) for pair in ranges]}:
+            raise RacError('Server port ranges did not match after update')
+        return result
+
+    async def update_server_dedicate_managers(self, cluster_id, server_id, choice):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('server dedicate managers update requires protocol 16.0')
+        if choice not in ('all', 'none') or type(choice) is not str:
+            raise ValueError('Invalid server dedicate managers choice')
+        before = await self.get_server(cluster, server)
+        await self._direct().update_server_dedicate_managers(cluster, server, choice)
+        result = await self.get_server(cluster, server)
+        if result != {**before, 'dedicated_managers': choice == 'all'}:
+            raise RacError('Server dedicate managers did not match after update')
+        return result
+
+    async def update_server_temporary_allowed_total_memory_time_limit(self, cluster_id, server_id, limit):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('server temporary memory time limit update requires protocol 16.0')
+        if type(limit) is not int or not 0 <= limit < 2**63:
+            raise ValueError('Invalid server temporary memory time limit')
+        before = await self.get_server(cluster, server)
+        await self._direct().update_server_temporary_allowed_total_memory_time_limit(cluster, server, limit)
+        result = await self.get_server(cluster, server)
+        if result != {**before, 'temporary_allowed_processes_total_memory_time_limit': limit}:
+            raise RacError('Server temporary memory time limit did not match after update')
+        return result
+
+    async def update_server_temporary_allowed_total_memory(self, cluster_id, server_id, limit):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('server temporary allowed total memory update requires protocol 16.0')
+        if type(limit) is not int or not 0 <= limit < 2**63:
+            raise ValueError('Invalid server temporary allowed total memory')
+        before = await self.get_server(cluster, server)
+        await self._direct().update_server_temporary_allowed_total_memory(cluster, server, limit)
+        result = await self.get_server(cluster, server)
+        if result != {**before, 'temporary_allowed_processes_total_memory': limit}:
+            raise RacError('Server temporary allowed total memory did not match after update')
+        return result
+
+    async def update_server_critical_total_memory(self, cluster_id, server_id, limit):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('server critical total memory update requires protocol 16.0')
+        if type(limit) is not int or not 0 <= limit < 2**63:
+            raise ValueError('Invalid server critical total memory')
+        before = await self.get_server(cluster, server)
+        await self._direct().update_server_critical_total_memory(cluster, server, limit)
+        result = await self.get_server(cluster, server)
+        if result != {**before, 'critical_processes_total_memory': limit}:
+            raise RacError('Server critical total memory did not match after update')
+        return result
+
+    async def update_server_service_principal_name(self, cluster_id, server_id, name):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('server SPN update requires protocol 16.0')
+        if not isinstance(name, str) or '\x00' in name or len(name.encode('utf-8')) > 256:
+            raise ValueError('Invalid server service principal name')
+        before = await self.get_server(cluster, server)
+        await self._direct().update_server_service_principal_name(cluster, server, name)
+        result = await self.get_server(cluster, server)
+        if result != {**before, 'service-principal-name': name}:
+            raise RacError('Server service principal name did not match after update')
+        return result
+
+    async def update_server_safe_call_memory_limit(self, cluster_id, server_id, limit):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('server safe call memory limit update requires protocol 16.0')
+        if type(limit) is not int or not 0 <= limit < 2**63:
+            raise ValueError('Invalid server safe call memory limit')
+        before = await self.get_server(cluster, server)
+        await self._direct().update_server_safe_call_memory_limit(cluster, server, limit)
+        result = await self.get_server(cluster, server)
+        if result != {**before, 'safe_call_memory_limit': limit}:
+            raise RacError('Server safe call memory limit did not match after update')
+        return result
+
+    async def update_server_connections_limit(self, cluster_id, server_id, limit):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('server connections limit update requires protocol 16.0')
+        if type(limit) is not int or not 0 <= limit <= 2_147_483_647:
+            raise ValueError('Invalid server connections limit')
+        before = await self.get_server(cluster, server)
+        await self._direct().update_server_connections_limit(cluster, server, limit)
+        result = await self.get_server(cluster, server)
+        if result != {**before, 'connections_per_working_process_limit': limit}:
+            raise RacError('Server connections limit did not match after update')
+        return result
+
+    async def update_server_infobases_limit(self, cluster_id, server_id, limit):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('server infobases limit update requires protocol 16.0')
+        if type(limit) is not int or not 0 <= limit <= 2_147_483_647:
+            raise ValueError('Invalid server infobases limit')
+        before = await self.get_server(cluster, server)
+        await self._direct().update_server_infobases_limit(cluster, server, limit)
+        result = await self.get_server(cluster, server)
+        if result != {**before, 'infobases_per_working_process_limit': limit}:
+            raise RacError('Server infobases limit did not match after update')
+        return result
+
+    async def update_server_restart_schedule(self, cluster_id, server_id, schedule):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if self.protocol == '10.0':
+            raise UnsupportedFeatureError('restart schedule requires protocol 16.0')
+        self._validate_schedule(schedule)
+        before = await self.get_server(cluster, server)
+        await self._direct().update_server_schedule(cluster, server, schedule)
+        result = await self.get_server(cluster, server)
+        if result != {**before, 'restart-schedule': schedule}:
+            raise RacError('Restart schedule did not match after server update')
+        return result