python-rac 0.2.0__py3-none-any.whl

pyrac/protocol/v851_client.py

@@ -0,0 +1,3453 @@
+"""Direct 8.5.1 RAC protocol over asyncio sockets.
+
+Read and verified schedule/profile ACL write operations are implemented from
+sanitized captures. Authentication and other mutations remain deliberately unsupported.
+"""
+import asyncio
+import io
+import math
+import struct
+import uuid
+# The 8.5.1 endpoint reuses these verified primitive and record layouts from
+# the 1C 8.3.11 codec. Keep protocol-specific messages in this module.
+from ..v8311 import (
+    date_from_int64, pack_varint_base128, read_bool, read_bytes, read_cluster,
+    read_double, read_infobase, read_infobase_short, read_int32, read_int64,
+    read_port_ranges, read_server, read_session, read_string, read_uint16,
+    read_uuid, unpack_varint_base128, unpack_varint_base64,
+    varint_prefixed_data_base64, write_bool, write_int32, write_int64,
+    write_uint16,
+)
+from .v851 import (CONNECT_ACK, ENDPOINT_OPEN_ACK, HELLO, SERVICE_NAME,
+                   SERVICE_VERSION, decode_frame)
+
+
+def frame(packet_type, body):
+    if type(packet_type) is not int or not 0 <= packet_type <= 255:
+        raise ValueError('Invalid frame type')
+    if not isinstance(body, bytes):
+        raise ValueError('Invalid frame body')
+    if len(body) > 4_000_000:
+        raise ValueError('Invalid frame length')
+    return bytes([packet_type]) + pack_varint_base128(len(body)) + body
+
+
+class EndpointVersionRejected(ValueError):
+    """RAS explicitly rejected opening the 16.0 administration endpoint."""
+
+
+class V851Client:
+    def __init__(self, host, port=1545, timeout=5.0):
+        self.host, self.port, self.timeout = host, port, timeout
+        self.reader = self.writer = None
+        self._request_lock = asyncio.Lock()
+        self._request_unusable = False
+        self._closing = False
+
+    async def __aenter__(self):
+        try:
+            async with asyncio.timeout(self.timeout):
+                return await self._open_endpoint()
+        except BaseException:
+            if self.writer is not None:
+                try:
+                    self.writer.close()
+                except Exception:
+                    # A failed close must not hide the handshake failure.
+                    pass
+                try:
+                    async with asyncio.timeout(self.timeout):
+                        await self.writer.wait_closed()
+                except Exception:
+                    # A failed cleanup must not hide the handshake failure.
+                    pass
+            raise
+
+    async def _open_endpoint(self):
+        self.reader, self.writer = await asyncio.wait_for(asyncio.open_connection(self.host, self.port), self.timeout)
+        self.writer.write(HELLO + bytes.fromhex('0116010f636f6e6e6563742e74696d656f757404000007d0'))
+        await asyncio.wait_for(self.writer.drain(), self.timeout)
+        kind, body = await self.read_frame()
+        if (kind, body) != decode_frame(CONNECT_ACK):
+            raise ValueError('Invalid CONNECT_ACK')
+        self.writer.write(frame(11, bytes.fromhex('1876382e736572766963652e41646d696e2e436c75737465720431362e3080')))
+        await asyncio.wait_for(self.writer.drain(), self.timeout)
+        kind, body = await self.read_frame()
+        if kind == 15:
+            # Only a complete failure for the endpoint actually requested permits fallback.
+            # Never use remote failure text (which may contain private data) in exceptions.
+            try:
+                failure = io.BytesIO(body)
+                service = await read_bytes(failure)
+                version = await read_bytes(failure)
+                endpoint_id = await unpack_varint_base128(failure)
+                await read_bytes(failure)  # opaque cause; never surface server text
+                await read_bytes(failure)  # opaque message
+                if (service != SERVICE_NAME or version != SERVICE_VERSION
+                        or endpoint_id != 1 or failure.read()):
+                    raise ValueError('Invalid endpoint failure')
+            except (ValueError, UnicodeError) as exc:
+                raise ValueError('Invalid endpoint failure') from None
+            raise EndpointVersionRejected('RAS rejected the 16.0 administration endpoint')
+        if (kind, body) != decode_frame(ENDPOINT_OPEN_ACK):
+            raise ValueError('Invalid ENDPOINT_OPEN_ACK')
+        return self
+
+    async def __aexit__(self, exc_type, exc_value, traceback):
+        shutdown_errors = []
+        self._closing = True
+        try:
+            async with asyncio.timeout(self.timeout):
+                async with self._request_lock:
+                    await self._close_within_deadline(exc_type, shutdown_errors)
+        except TimeoutError:
+            if self.writer is not None:
+                try:
+                    self.writer.close()
+                except Exception:
+                    # A failed forced close must not conceal a request or shutdown failure.
+                    pass
+            if exc_type is None:
+                if shutdown_errors:
+                    raise shutdown_errors[0] from None
+                raise
+        except asyncio.CancelledError:
+            if self.writer is not None:
+                try:
+                    self.writer.close()
+                except Exception:
+                    # Cancellation must not be replaced by a cleanup failure.
+                    pass
+            raise
+
+    async def _close_within_deadline(self, exc_type, shutdown_errors):
+        if self.writer:
+            goodbye_error = None
+            try:
+                self.writer.write(bytes.fromhex('0d0101'))
+                await asyncio.wait_for(self.writer.drain(), self.timeout)
+            except Exception as error:
+                goodbye_error = error
+                shutdown_errors.append(error)
+            finally:
+                close_error = None
+                try:
+                    self.writer.close()
+                except Exception as error:
+                    close_error = error
+                try:
+                    async with asyncio.timeout(self.timeout):
+                        await self.writer.wait_closed()
+                except Exception:
+                    if exc_type is None and goodbye_error is None and close_error is None:
+                        raise
+                if exc_type is None and goodbye_error is None and close_error is not None:
+                    raise close_error
+            if exc_type is None and goodbye_error is not None:
+                raise goodbye_error
+
+    async def read_frame(self):
+        async with asyncio.timeout(self.timeout):
+            return await self._read_frame_unbounded()
+
+    async def _read_frame_unbounded(self):
+        kind = (await self.reader.readexactly(1))[0]
+        length = 0
+        for shift in (0, 7, 14, 21):
+            byte = (await self.reader.readexactly(1))[0]
+            length |= (byte & 0x7f) << shift
+            if length > 4_000_000:
+                raise ValueError('Invalid frame length')
+            if not byte & 0x80:
+                if shift and byte == 0:
+                    raise ValueError('Invalid frame length')
+                break
+        else:
+            raise ValueError('Invalid frame length')
+        body = await self.reader.readexactly(length)
+        return kind, body
+
+    async def request(self, message_type, value=b''):
+        if type(message_type) is not int or not 0 <= message_type <= 255:
+            raise ValueError('Invalid RAC message type')
+        if not isinstance(value, bytes):
+            raise ValueError('Invalid RAC request payload')
+        if len(value) > 4_000_000 - 5:
+            raise ValueError('Invalid frame length')
+        return await self._exchange(self._request_within_deadline, message_type, value)
+
+    async def _exchange(self, operation, *args):
+        if self._closing:
+            raise ConnectionError('RAC connection is closing')
+        if self._request_unusable:
+            raise ConnectionError('RAC connection unusable after interrupted request')
+        async with asyncio.timeout(self.timeout):
+            async with self._request_lock:
+                if self._closing:
+                    raise ConnectionError('RAC connection is closing')
+                if self._request_unusable:
+                    raise ConnectionError('RAC connection unusable after interrupted request')
+                try:
+                    return await operation(*args)
+                except BaseException:
+                    # The peer may still send this reply. Never assign it to a later request.
+                    self._request_unusable = True
+                    if self.writer is not None:
+                        try:
+                            self.writer.close()
+                        except Exception:
+                            pass
+                    raise
+
+    async def _request_within_deadline(self, message_type, value):
+        self.writer.write(frame(14, b'\x01\x00\x00\x01' + bytes([message_type]) + value))
+        await asyncio.wait_for(self.writer.drain(), self.timeout)
+        kind, body = await self.read_frame()
+        if kind != 14 or len(body) < 5 or body[:4] != b'\x01\x00\x00\x01':
+            raise ValueError('Unexpected RAC response')
+        if body[4] == 0xff:
+            raise ValueError('RAC endpoint rejected request')
+        return body[4], io.BytesIO(body[5:])
+
+    async def _parse_cluster(self, payload, *, list_record=False):
+        cluster = await read_cluster(payload)
+        cluster['cluster'] = str(cluster['cluster'])
+        if read_int32(payload) != 1:
+            raise ValueError('Unexpected cluster audit marker')
+        audit = payload.read(1)
+        if audit not in (b'\x00', b'\x01'):
+            raise ValueError('Unexpected cluster audit flag')
+        cluster['allow-access-right-audit-events-recording'] = audit[0]
+        cluster['ping-period'] = read_int32(payload)
+        cluster['ping-timeout'] = read_int32(payload)
+        cluster['restart-schedule'] = await read_string(payload)
+        if not list_record and cluster['restart-schedule'] == '' and payload.read(1):
+            # The empty string is followed by an extra zero in the captured
+            # 8.5.1 response; the next string carries the actual schedule.
+            payload.seek(-1, io.SEEK_CUR)
+            cluster['restart-schedule'] = await read_string(payload)
+        return cluster
+
+    async def cluster_info(self, cluster_id):
+        ident = uuid.UUID(str(cluster_id))
+        message_type, payload = await self.request(13, ident.bytes)
+        if message_type != 14:
+            raise ValueError('Unexpected cluster info response')
+        cluster = await self._parse_cluster(payload)
+        if cluster['cluster'] != str(ident):
+            raise ValueError('Unexpected cluster info identity')
+        if payload.read() not in (b'', b'\x00'):
+            raise ValueError('Unexpected trailing response data')
+        return cluster
+
+    async def authenticate_cluster(self, cluster_id, cluster_os_user=None):
+        ident = uuid.UUID(str(cluster_id))
+        if cluster_os_user is not None and (not isinstance(cluster_os_user, str)
+                or not cluster_os_user or '\x00' in cluster_os_user
+                or len(cluster_os_user.encode('utf-8')) > 1024):
+            raise ValueError('Invalid cluster administrator name')
+        await self._exchange(self._authenticate_cluster_within_deadline, ident, cluster_os_user)
+
+    async def _authenticate_cluster_within_deadline(self, cluster_id, cluster_os_user=None):
+        if cluster_os_user is None:
+            auth = b'\x00\x00'
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            auth = varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00'
+        self.writer.write(frame(14, b'\x01\x00\x00\x01\x09' + uuid.UUID(str(cluster_id)).bytes + auth))
+        await asyncio.wait_for(self.writer.drain(), self.timeout)
+        kind, body = await self.read_frame()
+        if (kind, body) != (14, b'\x01\x00\x00\x00'):
+            raise ValueError('Unexpected cluster auth response')
+
+    async def _parse_server(self, payload):
+        server = await read_server(payload)
+        server['server'] = str(server.pop('working_server_id'))
+        server['service-principal-name'] = await read_string(payload)
+        server['restart-schedule'] = await read_string(payload)
+        return server
+
+    async def list_servers(self, cluster_id, *, cluster_os_user=None, cluster_password=None):
+        ident = uuid.UUID(str(cluster_id)).bytes
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, ident + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, ident
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        message_type, payload = await self.request(22, ident)
+        if message_type != 23:
+            raise ValueError('Unexpected servers response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 1000:
+            raise ValueError('Invalid server count')
+        rows = [await self._parse_server(payload) for _ in range(count)]
+        if len({row['server'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate server identifier')
+        if payload.read() != b'\x00':
+            raise ValueError('Unexpected server list terminator')
+        return rows
+
+    async def get_server(self, cluster_id, server_id, *, cluster_os_user=None,
+                         cluster_password=None):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        ident = cluster.bytes + server.bytes
+        message_type, payload = await self.request(24, ident)
+        if message_type != 25:
+            raise ValueError('Unexpected server info response')
+        row = await self._parse_server(payload)
+        if row['server'] != str(server):
+            raise ValueError('Unexpected server info identity')
+        remaining = payload.read()
+        if remaining not in (b'', b'\x00'):
+            if row['restart-schedule'] != '':
+                raise ValueError('Unexpected trailing server info data')
+            extra = io.BytesIO(remaining)
+            row['restart-schedule'] = await read_string(extra)
+            if extra.read():
+                raise ValueError('Unexpected trailing server info data')
+        return row
+
+    async def list_processes(self, cluster_id, server_id=None, *, cluster_os_user=None,
+                             cluster_password=None):
+        ident = uuid.UUID(str(cluster_id)).bytes
+        server = uuid.UUID(str(server_id)).bytes if server_id is not None else b''
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, ident + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, ident + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        if server_id is None:
+            request_type, expected_type = 29, 30
+            value = ident
+        else:
+            request_type, expected_type = 33, 34
+            value = ident + server
+        message_type, payload = await self.request(request_type, value)
+        if message_type != expected_type:
+            raise ValueError('Unexpected process response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid process count')
+        rows = [await self._parse_process(payload) for _ in range(count)]
+        if len({row['process'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate process identifier')
+        remaining = payload.read()
+        if remaining != (b'\x00' if count == 0 else b''):
+            raise ValueError('Unexpected process list trailing data')
+        return rows
+
+    async def _parse_process(self, payload):
+        process = str(read_uuid(payload))
+        # Observed contiguous counters: five doubles, one opaque eight-byte
+        # metric, then capacity/connections and the host name.
+        metrics = [read_double(payload) for _ in range(5)]
+        if not all(math.isfinite(metric) for metric in metrics):
+            raise ValueError('Invalid process metric')
+        opaque_metric = payload.read(8)
+        if len(opaque_metric) != 8:
+            raise ValueError('Truncated process metrics')
+        capacity = read_int32(payload)
+        connections = read_int32(payload)
+        host = await read_string(payload)
+        flags = payload.read(2)
+        if len(flags) != 2:
+            raise ValueError('Truncated process flags')
+        if flags not in (b'\x01\x00', b'\x01\x01'):
+            raise ValueError('Unsupported process flags')
+        if flags == b'\x01\x01':
+            # Populated 8.5.1 records on dev-area-06 carry additional service
+            # metadata between the two flags and the usual process port.
+            # Its strings are structural only; never expose their contents.
+            if payload.read(1) != b'\x00':
+                raise ValueError('Unsupported process metadata marker')
+            length = await unpack_varint_base64(payload)
+            if length is None or length > 1024 or len(payload.read(length)) != length:
+                raise ValueError('Invalid process metadata length')
+            if payload.read(1) != b'\x01':
+                raise ValueError('Unsupported process metadata flag')
+            for _ in range(3):
+                read_int32(payload)
+            if payload.read(1) != b'\x00':
+                raise ValueError('Unsupported process metadata separator')
+            for _ in range(2):
+                length = await unpack_varint_base64(payload)
+                if length is None or length > 1024 or len(payload.read(length)) != length:
+                    raise ValueError('Invalid process metadata length')
+            read_int32(payload)
+            for _ in range(2):
+                length = await unpack_varint_base64(payload)
+                if length is None or length > 1024 or len(payload.read(length)) != length:
+                    raise ValueError('Invalid process metadata length')
+        port = read_uint16(payload)
+        memory_size = read_int64(payload)
+        pid = await read_string(payload)
+        memory_excess_time = read_int32(payload)
+        selection_size = read_int32(payload)
+        try:
+            started_at = date_from_int64(read_int64(payload))
+        except (OverflowError, OSError, ValueError):
+            raise ValueError('Unsupported process record date or layout') from None
+        status = payload.read(8)
+        if len(status) != 8:
+            raise ValueError('Truncated process status')
+        reserve = payload.read(1)
+        if reserve not in (b'\x00', b'\x01'):
+            raise ValueError('Invalid process reserve flag')
+        return {'process': process, 'host': host, 'port': port,
+                'reserve': reserve == b'\x01',
+                'pid': pid, 'capacity': capacity, 'connections': connections,
+                'memory-size': memory_size, 'memory-excess-time': memory_excess_time,
+                'selection-size': selection_size, 'started-at': started_at.isoformat() if started_at else None,
+                'raw-flags': flags.hex(), 'raw-status': status.hex(),
+                'metrics': metrics, 'opaque-metric': opaque_metric.hex()}
+
+    async def turn_off_process(self, cluster_id, process_id):
+        """Research-only primitive; not exposed by RacClient without guarded read-back."""
+        cluster, process = uuid.UUID(str(cluster_id)), uuid.UUID(str(process_id))
+        await self.authenticate_cluster(cluster)
+        await self._send_auth(165, cluster.bytes + process.bytes)
+
+    async def get_process(self, cluster_id, process_id, *, cluster_os_user=None,
+                          cluster_password=None):
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(process_id))
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(31, cluster.bytes + ident.bytes)
+        if kind != 32:
+            raise ValueError('Unexpected process info response')
+        row = await self._parse_process(payload)
+        if row['process'] != str(ident) or payload.read() not in (b'', b'\x00'):
+            raise ValueError('Unexpected process info data')
+        return row
+
+    async def _parse_connection(self, payload):
+        ident = str(read_uuid(payload))
+        application = await read_string(payload)
+        blocked = read_int32(payload)
+        connected = date_from_int64(read_int64(payload))
+        connection_number = read_int32(payload)
+        host = await read_string(payload)
+        infobase = str(read_uuid(payload))
+        process = str(read_uuid(payload))
+        session_number = read_int32(payload)
+        return {'connection': ident, 'application': application,
+                'blocked-by-ls': blocked, 'connected-at': connected.isoformat() if connected else None,
+                'conn-id': connection_number, 'host': host,
+                'infobase': infobase, 'process': process, 'session-number': session_number}
+
+    async def list_connections(self, cluster_id, infobase_id=None, *, cluster_os_user=None,
+                               cluster_password=None):
+        value = uuid.UUID(str(cluster_id)).bytes
+        infobase = uuid.UUID(str(infobase_id)).bytes if infobase_id is not None else b''
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, value + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, value
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        if infobase_id is None:
+            request_type = 50
+        else:
+            request_type = 52
+            value += infobase
+        kind, payload = await self.request(request_type, value)
+        if kind != request_type + 1:
+            raise ValueError('Unexpected connection list response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid connection count')
+        rows = [await self._parse_connection(payload) for _ in range(count)]
+        if len({row['connection'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate connection identifier')
+        if infobase_id is not None and any(
+                row.get('infobase') != str(uuid.UUID(bytes=infobase)) for row in rows):
+            raise ValueError('Unexpected connection infobase')
+        if payload.read() not in (b'', b'\x00'):
+            raise ValueError('Unexpected connection list tail')
+        return rows
+
+    async def get_connection(self, cluster_id, connection_id, *, cluster_os_user=None,
+                             cluster_password=None):
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(connection_id))
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(54, cluster.bytes + ident.bytes)
+        if kind != 55:
+            raise ValueError('Unexpected connection info response')
+        row = await self._parse_connection(payload)
+        if row['connection'] != str(ident) or payload.read() not in (b'', b'\x00'):
+            raise ValueError('Unexpected connection info tail')
+        return row
+
+    async def _parse_locks(self, payload):
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 100000:
+            raise ValueError('Invalid lock count')
+        rows = []
+        for _ in range(count):
+            connection = str(read_uuid(payload))
+            description = await read_string(payload)
+            locked_at = date_from_int64(read_int64(payload))
+            obj = str(read_uuid(payload))
+            sid = str(read_uuid(payload))
+            rows.append({'connection': connection, 'lock-descr': description,
+                         'locked-at': locked_at.isoformat() if locked_at else None,
+                         'object': obj, 'sid': sid})
+        if payload.read() not in (b'', b'\x00'):
+            raise ValueError('Unexpected lock response tail')
+        return rows
+
+    async def list_locks(self, cluster_id, infobase_id=None, connection_id=None, session_id=None,
+                         *, cluster_os_user=None, cluster_password=None):
+        filters = (infobase_id, connection_id, session_id)
+        if sum(value is not None for value in filters) > 1:
+            raise ValueError('Select at most one lock filter')
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        infobase = uuid.UUID(str(infobase_id)).bytes if infobase_id is not None else b''
+        connection = uuid.UUID(str(connection_id)).bytes if connection_id is not None else b''
+        if session_id is not None:
+            uuid.UUID(str(session_id))
+        if cluster_password is not None:
+            if connection_id is not None or session_id is not None:
+                raise ValueError('Unverified password-authenticated lock filter')
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        if connection_id is not None:
+            request_type = 76
+            value = cluster + connection
+        elif session_id is not None:
+            # 8.5.1 rac accepts --session but sends the cluster-wide lock request.
+            request_type = 72
+            value = cluster
+        elif infobase_id is not None:
+            request_type = 74
+            value = cluster + infobase
+        else:
+            request_type = 72
+            value = cluster
+        kind, payload = await self.request(request_type, value)
+        if kind != request_type + 1:
+            raise ValueError('Unexpected lock response')
+        rows = await self._parse_locks(payload)
+        if connection_id is not None and any(
+                row['connection'] != str(uuid.UUID(str(connection_id))) for row in rows):
+            raise ValueError('Unexpected lock connection')
+        return rows
+
+    async def _parse_rule(self, payload):
+        ident = str(read_uuid(payload))
+        object_type = await read_string(payload)
+        infobase_name = await read_string(payload)
+        rule_type = read_int32(payload)
+        application_ext = await read_string(payload)
+        priority = read_int32(payload)
+        if rule_type not in (0, 1, 2):
+            raise ValueError('Invalid assignment rule type')
+        return {'rule': ident, 'object-type': object_type,
+                'infobase-name': infobase_name, 'raw-rule-type': rule_type,
+                'rule-type': {0: 'never', 1: 'auto', 2: 'always'}[rule_type],
+                'application-ext': application_ext, 'priority': priority}
+
+    async def insert_rule(self, cluster_id, server_id, position, *, object_type='',
+                          infobase_name='', rule_type='auto', application_ext='', priority=0,
+                          cluster_os_user=None):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if type(position) is not int or not 0 <= position < 2**31:
+            raise ValueError('Invalid rule position')
+        if type(priority) is not int or not -(2**31) <= priority < 2**31:
+            raise ValueError('Invalid rule priority')
+        if rule_type not in ('never', 'auto', 'always'):
+            raise ValueError('Invalid rule type')
+        for value in (object_type, infobase_name, application_ext):
+            if not isinstance(value, str) or '\x00' in value or len(value.encode('utf-8')) > 1024:
+                raise ValueError('Invalid rule field')
+        text = lambda value: varint_prefixed_data_base64(value.encode('utf-8'))
+        value = (cluster.bytes + server.bytes + uuid.UUID(int=0).bytes
+                 + text(object_type) + text(infobase_name)
+                 + write_int32(('never', 'auto', 'always').index(rule_type))
+                 + text(application_ext) + write_int32(priority)
+                 + write_int32(position))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(82, value)
+        if kind != 83:
+            raise ValueError('Unexpected assignment rule insert response')
+        ident = read_uuid(payload)
+        if ident.int == 0 or payload.read():
+            raise ValueError('Unexpected assignment rule insert data')
+        return ident
+
+    async def update_rule(self, cluster_id, server_id, position, row, *, cluster_os_user=None):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        rule = uuid.UUID(row['rule'])
+        if type(position) is not int or not 0 <= position < 2**31:
+            raise ValueError('Invalid rule position')
+        if type(row['priority']) is not int or not -(2**31) <= row['priority'] < 2**31:
+            raise ValueError('Invalid rule priority')
+        if row['rule-type'] not in ('never', 'auto', 'always') or row['raw-rule-type'] != {
+                'never': 0, 'auto': 1, 'always': 2}[row['rule-type']]:
+            raise ValueError('Invalid rule type')
+        for key in ('object-type', 'infobase-name', 'application-ext'):
+            value = row[key]
+            if not isinstance(value, str) or '\x00' in value or len(value.encode('utf-8')) > 1024:
+                raise ValueError('Invalid rule field')
+        text = lambda key: varint_prefixed_data_base64(row[key].encode('utf-8'))
+        value = (cluster.bytes + server.bytes + rule.bytes
+                 + text('object-type') + text('infobase-name')
+                 + write_int32(row['raw-rule-type']) + text('application-ext')
+                 + write_int32(row['priority']) + write_int32(position))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(82, value)
+        if kind != 83 or read_uuid(payload) != rule or payload.read():
+            raise ValueError('Unexpected assignment rule update response')
+        return rule
+
+    async def apply_rules(self, cluster_id, *, full=True, cluster_os_user=None):
+        if type(full) is not bool:
+            raise ValueError('Invalid assignment rule apply mode')
+        cluster = uuid.UUID(str(cluster_id))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(81, cluster.bytes + write_int32(int(full)))
+
+    async def remove_rule(self, cluster_id, server_id, rule_id, *, cluster_os_user=None):
+        cluster, server, rule = (uuid.UUID(str(value)) for value in
+                                 (cluster_id, server_id, rule_id))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(84, cluster.bytes + server.bytes + rule.bytes)
+
+    async def list_rules(self, cluster_id, server_id, *, cluster_os_user=None):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        server = uuid.UUID(str(server_id)).bytes
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(85, cluster + server)
+        if kind != 86:
+            raise ValueError('Unexpected assignment rules response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid assignment rules count')
+        rows = [await self._parse_rule(payload) for _ in range(count)]
+        if len({row['rule'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate assignment rule identifier')
+        if payload.read():
+            raise ValueError('Unexpected assignment rules tail')
+        return rows
+
+    async def get_rule(self, cluster_id, server_id, rule_id, *, cluster_os_user=None):
+        cluster, server, ident = (uuid.UUID(str(item)) for item in (cluster_id, server_id, rule_id))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(87, cluster.bytes + server.bytes + ident.bytes)
+        if kind != 88:
+            raise ValueError('Unexpected assignment rule info response')
+        row = await self._parse_rule(payload)
+        if row['rule'] != str(ident) or payload.read():
+            raise ValueError('Unexpected assignment rule info data')
+        return row
+
+    async def list_binary_storages(self, cluster_id, infobase_id, *, cluster_os_user=None):
+        cluster = uuid.UUID(str(cluster_id))
+        infobase = uuid.UUID(str(infobase_id))
+        if cluster_os_user is not None and (not isinstance(cluster_os_user, str)
+                or not cluster_os_user or '\x00' in cluster_os_user
+                or len(cluster_os_user.encode('utf-8')) > 1024):
+            raise ValueError('Invalid cluster administrator name')
+        auth = (b'\x00\x00' if cluster_os_user is None else
+                varint_prefixed_data_base64(cluster_os_user.encode('utf-8')) + b'\x00')
+        await self._send_auth(9, cluster.bytes + auth)
+        await self._send_auth(10, cluster.bytes + auth)
+        kind, payload = await self.request(153, cluster.bytes + infobase.bytes)
+        if kind != 160:
+            raise ValueError('Unexpected binary storage list response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid binary storage count')
+        if count:
+            raise ValueError('Unsupported populated binary storage response format')
+        if payload.read():
+            raise ValueError('Unexpected binary storage tail')
+        return []
+
+    async def create_infobase(self, cluster_id, *, name, db_name, db_server, db_user, locale,
+                              create_database, descr='', scheduled_jobs_denied=False,
+                              license_distribution='deny', date_offset=0, security_level=0):
+        if type(security_level) is not int or security_level not in (0, 1):
+            raise ValueError('Invalid security_level')
+        if type(date_offset) is not int or date_offset not in (0, 2000):
+            raise ValueError('Invalid date_offset')
+        if license_distribution not in ('allow', 'deny') or type(license_distribution) is not str:
+            raise ValueError('Invalid license_distribution')
+        if type(scheduled_jobs_denied) is not bool:
+            raise ValueError('Invalid scheduled_jobs_denied')
+        if type(create_database) is not bool:
+            raise ValueError('Explicit boolean create_database policy required')
+        for label, value in (('name', name), ('db_name', db_name), ('db_server', db_server),
+                             ('db_user', db_user), ('locale', locale)):
+            if (not isinstance(value, str) or not value or '\x00' in value
+                    or len(value.encode('utf-8')) > 255):
+                raise ValueError('Invalid infobase ' + label)
+        if not isinstance(descr, str) or '\x00' in descr or len(descr.encode('utf-8')) > 1024:
+            raise ValueError('Invalid infobase description')
+        cluster = uuid.UUID(str(cluster_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        text = lambda value: varint_prefixed_data_base64(value.encode('utf-8'))
+        # Verified 8.5.1 PostgreSQL record: nil infobase ID, zero-valued
+        # optional fields, and the trailing explicit database-creation flag.
+        record = (uuid.UUID(int=0).bytes + write_int32(date_offset) + text('PostgreSQL')
+                  + text(db_name) + b'\x00' + text(db_server) + text(db_user)
+                  + b'\x00' * 8 + text('') + text('') + b'\x00' * 8
+                  + text(descr) + text(locale) + text(name) + text('')
+                  + write_bool(scheduled_jobs_denied) + write_int32(security_level) + b'\x00'
+                  + write_int32(1 if license_distribution == 'allow' else 0)
+                  + text('') + b'\x00' + text('') + text('') + b'\x00'
+                  + b'\x00' * 16 + (b'\x01' if create_database else b'\x00'))
+        kind, payload = await self.request(37, cluster.bytes + record)
+        if kind != 38 or len(payload.getvalue()) != 16:
+            raise ValueError('Unexpected infobase create response')
+        result = uuid.UUID(bytes=payload.read(16))
+        if result.int == 0:
+            raise ValueError('Unexpected infobase create response')
+        return result
+
+    async def drop_infobase(self, cluster_id, infobase_id, *, drop_database,
+                            clear_database=False, cluster_os_user=None):
+        if type(drop_database) is not bool or type(clear_database) is not bool:
+            raise ValueError('Explicit boolean drop_database/clear_database policy required')
+        if drop_database and clear_database:
+            raise ValueError('Conflicting infobase database policy')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        if cluster_os_user is None:
+            auth = cluster.bytes + b'\x00\x00'
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode()) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            auth = (cluster.bytes + varint_prefixed_data_base64(cluster_os_user.encode())
+                    + b'\x00')
+        await self._send_auth(9, auth)
+        await self._send_auth(10, auth)
+        await self._exchange(self._send_ack_within_deadline, 41,
+                             cluster.bytes + ident.bytes + b'\x00\x00\x00'
+                             + bytes([2 if clear_database else int(drop_database)]),
+                             'Unexpected infobase drop response')
+
+    async def _send_ack_within_deadline(self, message_type, value, error):
+        self.writer.write(frame(14, b'\x01\x00\x00\x01' + bytes([message_type]) + value))
+        await self.writer.drain()
+        if await self.read_frame() != (14, b'\x01\x00\x00\x00'):
+            raise ValueError(error)
+
+    async def _send_infobase_update(self, cluster, updated):
+        """Share one deadline across a verified full-record update and its ACK."""
+        await self._exchange(self._send_ack_within_deadline, 40, cluster.bytes + updated,
+                             'Unexpected infobase update response')
+
+    async def update_infobase_safe_mode_security_profile(self, cluster_id, infobase_id, name):
+        if (not isinstance(name, str) or '\x00' in name or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        extension = reader.read()
+        if (row['infobase'] != ident or len(extension) != 13
+                or extension[0] not in (0, 1) or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        fields = io.BytesIO(raw)
+        fields.read(16 + 4)
+        for _ in range(5):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(2):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(4):
+            await read_bytes(fields)
+        fields.read(1 + 4 + 1 + 4)
+        await read_bytes(fields)
+        fields.read(1)
+        await read_bytes(fields)
+        offset = fields.tell()
+        old = varint_prefixed_data_base64(row['safe_mode_securirty_profile'].encode('utf-8'))
+        if raw[offset:offset + len(old)] != old:
+            raise ValueError('Unexpected safe mode security profile field')
+        updated = (raw[:offset] + varint_prefixed_data_base64(name.encode('utf-8'))
+                   + raw[offset + len(old):])
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_security_profile(self, cluster_id, infobase_id, name):
+        if (not isinstance(name, str) or '\x00' in name or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        extension = reader.read()
+        if (row['infobase'] != ident or len(extension) != 13
+                or extension[0] not in (0, 1) or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        fields = io.BytesIO(raw)
+        fields.read(16 + 4)
+        for _ in range(5):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(2):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(4):
+            await read_bytes(fields)
+        fields.read(1 + 4 + 1 + 4)
+        await read_bytes(fields)
+        fields.read(1)
+        offset = fields.tell()
+        old = varint_prefixed_data_base64(row['securirty_profile'].encode('utf-8'))
+        if raw[offset:offset + len(old)] != old:
+            raise ValueError('Unexpected security profile field')
+        updated = (raw[:offset] + varint_prefixed_data_base64(name.encode('utf-8'))
+                   + raw[offset + len(old):])
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_maximum_scheduled_jobs_start_shift(self, cluster_id, infobase_id, shift):
+        if type(shift) is not int or not 0 <= shift <= 255:
+            raise ValueError('Invalid maximum scheduled jobs start shift')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        extension = reader.read()
+        if (row['infobase'] != ident or len(extension) != 13
+                or extension[0] not in (0, 1) or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        updated = raw[:-1] + bytes((shift,))
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_minimum_scheduled_jobs_start_period(self, cluster_id, infobase_id, period):
+        if type(period) is not int or not 0 <= period <= 0xffffffff:
+            raise ValueError('Invalid minimum scheduled jobs start period')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        extension = reader.read()
+        if (row['infobase'] != ident or len(extension) != 13
+                or extension[0] not in (0, 1)
+                or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        updated = raw[:-5] + period.to_bytes(4, 'little') + raw[-1:]
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_configuration_unload_delay(self, cluster_id, infobase_id, delay):
+        if type(delay) is not int or not 0 <= delay <= 0xffffffff:
+            raise ValueError('Invalid configuration unload delay')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        extension = reader.read()
+        if (row['infobase'] != ident or len(extension) != 13
+                or extension[0] not in (0, 1)
+                or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        updated = raw[:-9] + delay.to_bytes(4, 'little') + raw[-5:]
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_disable_local_speech_to_text(self, cluster_id, infobase_id, disabled):
+        if type(disabled) is not bool:
+            raise ValueError('Disable local speech to text must be boolean')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        extension = reader.read()
+        if (row['infobase'] != ident or len(extension) != 13
+                or extension[0] not in (0, 1) or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        updated = raw[:-13] + write_bool(disabled) + raw[-12:]
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_external_session_manager_required(self, cluster_id, infobase_id, required):
+        if type(required) is not bool:
+            raise ValueError('External session manager required must be boolean')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        extension = reader.read()
+        if (row['infobase'] != ident or len(extension) != 13
+                or extension[0] not in (0, 1) or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        fields = io.BytesIO(raw)
+        fields.read(16 + 4)
+        for _ in range(5):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(2):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(4):
+            await read_bytes(fields)
+        fields.read(1 + 4 + 1 + 4)
+        await read_bytes(fields)
+        offset = fields.tell()
+        if raw[offset:offset + 1] != write_bool(row['external_session_manager_required']):
+            raise ValueError('Unexpected external session manager required field')
+        updated = raw[:offset] + write_bool(required) + raw[offset + 1:]
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_reserve_working_processes(self, cluster_id, infobase_id, reserve):
+        if type(reserve) is not bool:
+            raise ValueError('Reserve working processes must be boolean')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        extension = reader.read()
+        if (row['infobase'] != ident or len(extension) != 13
+                or extension[0] not in (0, 1) or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        fields = io.BytesIO(raw)
+        fields.read(16 + 4)
+        for _ in range(5):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(2):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(4):
+            await read_bytes(fields)
+        fields.read(1 + 4 + 1 + 4)
+        for _ in range(3):
+            await read_bytes(fields)
+        fields.read(1)
+        offset = fields.tell()
+        if raw[offset:offset + 1] != write_bool(row['reserve_working_processes']):
+            raise ValueError('Unexpected reserve working processes field')
+        updated = raw[:offset] + write_bool(reserve) + raw[offset + 1:]
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_denied_message(self, cluster_id, infobase_id, message):
+        if not isinstance(message, str) or '\x00' in message:
+            raise ValueError('Invalid denied message')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        extension = reader.read()
+        if (row['infobase'] != ident or len(extension) != 13
+                or extension[0] not in (0, 1) or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        fields = io.BytesIO(raw)
+        fields.read(16 + 4)
+        for _ in range(5):
+            await read_bytes(fields)
+        fields.read(8)
+        offset = fields.tell()
+        old = varint_prefixed_data_base64(row['denied_message'].encode())
+        if raw[offset:offset + len(old)] != old:
+            raise ValueError('Unexpected denied message field')
+        updated = (raw[:offset] + varint_prefixed_data_base64(message.encode())
+                   + raw[offset + len(old):])
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_license_distribution(self, cluster_id, infobase_id, distribution):
+        if distribution not in ('allow', 'deny'):
+            raise ValueError('Invalid license distribution')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        extension = reader.read()
+        if (row['infobase'] != ident or len(extension) != 13
+                or extension[0] not in (0, 1) or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        fields = io.BytesIO(raw)
+        fields.read(16 + 4)
+        for _ in range(5):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(2):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(4):
+            await read_bytes(fields)
+        fields.read(1 + 4 + 1)
+        offset = fields.tell()
+        if raw[offset:offset + 4] != write_int32(row['license_distribution']):
+            raise ValueError('Unexpected license distribution field')
+        updated = (raw[:offset] + write_int32(1 if distribution == 'allow' else 0)
+                   + raw[offset + 4:])
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_sessions_deny(self, cluster_id, infobase_id, denied):
+        if type(denied) is not bool:
+            raise ValueError('Sessions deny must be boolean')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        extension = reader.read()
+        if (row['infobase'] != ident or len(extension) != 13
+                or extension[0] not in (0, 1) or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        fields = io.BytesIO(raw)
+        fields.read(16 + 4)
+        for _ in range(5):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(2):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(4):
+            await read_bytes(fields)
+        fields.read(1 + 4)
+        offset = fields.tell()
+        if raw[offset:offset + 1] != write_bool(row['sessions_denied']):
+            raise ValueError('Unexpected sessions deny field')
+        updated = raw[:offset] + write_bool(denied) + raw[offset + 1:]
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_scheduled_jobs_deny(self, cluster_id, infobase_id, denied):
+        if type(denied) is not bool:
+            raise ValueError('Scheduled jobs deny must be boolean')
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        extension = reader.read()
+        if (row['infobase'] != ident or len(extension) != 13
+                or extension[0] not in (0, 1) or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        fields = io.BytesIO(raw)
+        fields.read(16 + 4)
+        for _ in range(5):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(2):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(4):
+            await read_bytes(fields)
+        offset = fields.tell()
+        if raw[offset:offset + 1] != write_bool(row['scheduled_jobs_denied']):
+            raise ValueError('Unexpected scheduled jobs deny field')
+        updated = raw[:offset] + write_bool(denied) + raw[offset + 1:]
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_description(self, cluster_id, infobase_id, description):
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        if (not isinstance(description, str) or '\x00' in description
+                or len(description.encode('utf-8')) > 1024):
+            raise ValueError('Invalid infobase description')
+        await self._send_auth(9, cluster.bytes + b'\x00\x00')
+        await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response before update')
+        raw = payload.getvalue()
+        reader = io.BytesIO(raw)
+        row = await read_infobase(reader)
+        if row['infobase'] != ident:
+            raise ValueError('Unexpected infobase info identifier before update')
+        extension = reader.read()
+        if (len(extension) != 13 or extension[0] not in (0, 1)
+                or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension before update')
+        fields = io.BytesIO(raw)
+        fields.read(16 + 4)
+        for _ in range(5):
+            await read_bytes(fields)
+        fields.read(8)
+        for _ in range(2):
+            await read_bytes(fields)
+        fields.read(8)
+        start = fields.tell()
+        original = varint_prefixed_data_base64(row['descr'].encode('utf-8'))
+        if raw[start:start + len(original)] != original:
+            raise ValueError('Unexpected infobase description field')
+        updated = (raw[:start] + varint_prefixed_data_base64(description.encode('utf-8'))
+                   + raw[start + len(original):])
+        await self._send_infobase_update(cluster, updated)
+
+    async def update_infobase_summary_description(self, cluster_id, infobase_id, description,
+                                                  *, cluster_os_user=None):
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        if (not isinstance(description, str) or '\x00' in description
+                or len(description.encode('utf-8')) > 1024):
+            raise ValueError('Invalid infobase summary description')
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            await self.authenticate_cluster(cluster, cluster_os_user)
+        value = (cluster.bytes + ident.bytes
+                 + varint_prefixed_data_base64(description.encode('utf-8')) + b'\x00')
+        await self._exchange(self._send_ack_within_deadline, 39, value,
+                             'Unexpected infobase summary update response')
+
+    async def list_infobases(self, cluster_id, *, cluster_os_user=None, cluster_password=None):
+        ident = uuid.UUID(str(cluster_id)).bytes
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, ident
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, ident
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        message_type, payload = await self.request(42, ident)
+        if message_type != 43:
+            raise ValueError('Unexpected infobases response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid infobase count')
+        rows = []
+        seen = set()
+        for _ in range(count):
+            row = await read_infobase_short(payload)
+            row['infobase'] = str(row['infobase'])
+            if row['infobase'] in seen:
+                raise ValueError('Unexpected duplicate infobase identifier')
+            seen.add(row['infobase'])
+            rows.append(row)
+        if payload.read(1):
+            raise ValueError('Unexpected trailing infobase data')
+        return rows
+
+    async def get_infobase_info(self, cluster_id, infobase_id, *, cluster_os_user=None):
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        if cluster_os_user is None:
+            await self._send_auth(9, cluster.bytes + b'\x00\x00')
+            await self._send_auth(10, cluster.bytes + b'\x00\x00')
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode()) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            auth = cluster.bytes + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00'
+            await self._send_auth(9, auth)
+            await self._send_auth(10, auth)
+        kind, payload = await self.request(48, cluster.bytes + ident.bytes)
+        if kind != 49:
+            raise ValueError('Unexpected infobase info response')
+        row = await read_infobase(payload)
+        if row['infobase'] != ident:
+            raise ValueError('Unexpected infobase info identifier')
+        extension = payload.read()
+        if (len(extension) != 13 or extension[0] not in (0, 1)
+                or extension[1:4] != b'\x00' * 3):
+            raise ValueError('Unexpected infobase info extension')
+        row['disable_local_speech_to_text'] = bool(extension[0])
+        row['configuration_unload_delay_by_working_process_without_active_users'] = int.from_bytes(
+            extension[4:8], 'little')
+        row['minimum_scheduled_jobs_start_period_without_active_users'] = int.from_bytes(
+            extension[8:12], 'little')
+        row['maximum_scheduled_jobs_start_shift_without_active_users'] = extension[12]
+        for sensitive in ('db_password', 'permission_code', 'denied_parameter',
+                          'external_connection_string'):
+            row.pop(sensitive, None)  # Do not return credentials or access parameters.
+        row['infobase'] = str(ident)
+        return row
+
+    async def get_infobase_summary(self, cluster_id, infobase_id, *, cluster_os_user=None,
+                                   cluster_password=None):
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(infobase_id))
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(46, cluster.bytes + ident.bytes)
+        if kind != 47:
+            raise ValueError('Unexpected infobase summary info response')
+        row = await read_infobase_short(payload)
+        if row['infobase'] != ident or payload.read():
+            raise ValueError('Unexpected infobase summary info data')
+        row['infobase'] = str(ident)
+        return row
+
+    async def update_cluster_kill_by_memory_with_dump(self, cluster_id, enabled, *, agent_os_user=None):
+        if type(enabled) is not bool:
+            raise ValueError('Invalid kill by memory dump flag')
+        ident = uuid.UUID(str(cluster_id)).bytes
+        kind, original = await self.request(13, ident)
+        if kind != 14:
+            raise ValueError('Unexpected cluster info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_cluster(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != ident:
+            raise ValueError('Unknown cluster fields; refusing update')
+        reader.seek(0)
+        read_uuid(reader)
+        read_int32(reader)
+        await read_string(reader)  # host
+        read_int32(reader)
+        read_uint16(reader)
+        read_int32(reader)
+        read_int32(reader)
+        await read_string(reader)  # name
+        for _ in range(4):
+            read_int32(reader)  # security, fault, balancing, errors
+        read_bool(reader)  # kill problem processes
+        offset = reader.tell()
+        value = raw[:offset] + bytes([int(enabled)]) + raw[offset+1:]
+        auth = (b'\x00\x00' if agent_os_user is None else
+                varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00')
+        await self._send_auth(8, auth)
+        kind, payload = await self.request(15, value)
+        if kind != 16 or payload.read() != ident:
+            raise ValueError('Unexpected cluster update response')
+
+    async def update_cluster_kill_problem_processes(self, cluster_id, enabled, *, agent_os_user=None):
+        if type(enabled) is not bool:
+            raise ValueError('Invalid kill problem processes flag')
+        ident = uuid.UUID(str(cluster_id)).bytes
+        kind, original = await self.request(13, ident)
+        if kind != 14:
+            raise ValueError('Unexpected cluster info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_cluster(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != ident:
+            raise ValueError('Unknown cluster fields; refusing update')
+        reader.seek(0)
+        read_uuid(reader)
+        read_int32(reader)
+        await read_string(reader)  # host
+        read_int32(reader)
+        read_uint16(reader)
+        read_int32(reader)
+        read_int32(reader)
+        await read_string(reader)  # name
+        for _ in range(4):
+            read_int32(reader)  # security, fault, balancing, errors
+        offset = reader.tell()
+        value = raw[:offset] + bytes([int(enabled)]) + raw[offset+1:]
+        auth = (b'\x00\x00' if agent_os_user is None else
+                varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00')
+        await self._send_auth(8, auth)
+        kind, payload = await self.request(15, value)
+        if kind != 16 or payload.read() != ident:
+            raise ValueError('Unexpected cluster update response')
+
+    async def update_cluster_load_balancing_mode(self, cluster_id, mode, *, agent_os_user=None):
+        if mode not in ('performance', 'memory'):
+            raise ValueError('Invalid cluster load balancing mode')
+        ident = uuid.UUID(str(cluster_id)).bytes
+        kind, original = await self.request(13, ident)
+        if kind != 14:
+            raise ValueError('Unexpected cluster info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_cluster(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != ident:
+            raise ValueError('Unknown cluster fields; refusing update')
+        reader.seek(0)
+        read_uuid(reader)
+        read_int32(reader)
+        await read_string(reader)  # host
+        read_int32(reader)
+        read_uint16(reader)
+        read_int32(reader)
+        read_int32(reader)
+        await read_string(reader)  # name
+        read_int32(reader)  # security level
+        read_int32(reader)  # fault tolerance level
+        offset = reader.tell()
+        value = raw[:offset] + write_int32(int(mode == 'memory')) + raw[offset+4:]
+        auth = (b'\x00\x00' if agent_os_user is None else
+                varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00')
+        await self._send_auth(8, auth)
+        kind, payload = await self.request(15, value)
+        if kind != 16 or payload.read() != ident:
+            raise ValueError('Unexpected cluster update response')
+
+    async def remove_cluster(self, cluster_id, cluster_os_user=None):
+        ident = uuid.UUID(str(cluster_id)).bytes
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            await self.authenticate_cluster(cluster_id, cluster_os_user=cluster_os_user)
+        await self._exchange(self._send_ack_within_deadline, 17, ident,
+                             'Unexpected cluster remove response')
+
+    async def insert_cluster(self, host, port, name='', *, expiration_timeout=60, security_level=0,
+                             session_fault_tolerance_level=0, load_balancing_mode='performance',
+                             kill_problem_processes=True, kill_by_memory_with_dump=False,
+                             restart_schedule='', ping_period=0, ping_timeout=0, agent_os_user=None,
+                             audit=False):
+        if type(audit) is not bool:
+            raise ValueError('Invalid cluster audit flag')
+        value = (bytes(16) + write_int32(expiration_timeout)
+                 + varint_prefixed_data_base64(host.encode('utf-8'))
+                 + write_int32(0) + write_uint16(port)
+                 + write_int32(0) * 2
+                 + varint_prefixed_data_base64(name.encode('utf-8'))
+                 + write_int32(security_level)
+                 + write_int32(session_fault_tolerance_level)
+                 + write_int32(0 if load_balancing_mode == 'performance' else 1)
+                 + write_int32(0) + (b'\x01' if kill_problem_processes else b'\x00')
+                 + (b'\x01' if kill_by_memory_with_dump else b'\x00')
+                 + write_int32(0) + bytes([audit])
+                 + write_int32(ping_period) + write_int32(ping_timeout)
+                 + varint_prefixed_data_base64(restart_schedule.encode('utf-8')))
+        auth = (b'\x00\x00' if agent_os_user is None else
+                varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00')
+        await self._send_auth(8, auth)
+        kind, payload = await self.request(15, value)
+        ident = payload.read()
+        if kind != 16 or len(ident) != 16 or ident == bytes(16):
+            raise ValueError('Unexpected cluster insert response')
+        return uuid.UUID(bytes=ident)
+
+    async def update_cluster_audit(self, cluster_id, enabled, *, agent_os_user=None):
+        ident = uuid.UUID(str(cluster_id)).bytes
+        kind, original = await self.request(13, ident)
+        if kind != 14:
+            raise ValueError('Unexpected cluster info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_cluster(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != ident:
+            raise ValueError('Unknown cluster fields; refusing update')
+        reader.seek(0)
+        await read_cluster(reader)
+        if read_int32(reader) != 1:
+            raise ValueError('Unexpected cluster audit marker')
+        offset = reader.tell()
+        if raw[offset:offset + 1] not in (b'\x00', b'\x01'):
+            raise ValueError('Unexpected cluster audit flag')
+        auth = (b'\x00\x00' if agent_os_user is None else
+                varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00')
+        await self._send_auth(8, auth)
+        kind, payload = await self.request(15, raw[:offset] + bytes([enabled]) + raw[offset + 1:])
+        if kind != 16 or payload.read() != ident:
+            raise ValueError('Unexpected cluster update response')
+
+    async def update_cluster_ping(self, cluster_id, period, timeout, *, agent_os_user=None):
+        ident = uuid.UUID(str(cluster_id)).bytes
+        kind, original = await self.request(13, ident)
+        if kind != 14:
+            raise ValueError('Unexpected cluster info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_cluster(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != ident:
+            raise ValueError('Unknown cluster fields; refusing update')
+        reader.seek(0)
+        await read_cluster(reader)
+        if read_int32(reader) != 1:
+            raise ValueError('Unexpected cluster audit marker')
+        if reader.read(1) not in (b'\x00', b'\x01'):
+            raise ValueError('Unexpected cluster audit flag')
+        offset = reader.tell()
+        value = (raw[:offset] + write_int32(period) + write_int32(timeout)
+                 + raw[offset+8:])
+        auth = (b'\x00\x00' if agent_os_user is None else
+                varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00')
+        await self._send_auth(8, auth)
+        kind, payload = await self.request(15, value)
+        if kind != 16 or payload.read() != ident:
+            raise ValueError('Unexpected cluster update response')
+
+    async def update_cluster_session_fault_tolerance_level(self, cluster_id, level, *, agent_os_user=None):
+        ident = uuid.UUID(str(cluster_id)).bytes
+        kind, original = await self.request(13, ident)
+        if kind != 14:
+            raise ValueError('Unexpected cluster info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_cluster(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != ident:
+            raise ValueError('Unknown cluster fields; refusing update')
+        reader.seek(0)
+        read_uuid(reader)
+        read_int32(reader)
+        await read_string(reader)  # host
+        read_int32(reader)
+        read_uint16(reader)
+        read_int32(reader)
+        read_int32(reader)
+        await read_string(reader)  # name
+        read_int32(reader)  # security level
+        offset = reader.tell()
+        value = raw[:offset] + write_int32(level) + raw[offset+4:]
+        auth = (b'\x00\x00' if agent_os_user is None else
+                varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00')
+        await self._send_auth(8, auth)
+        kind, payload = await self.request(15, value)
+        if kind != 16 or payload.read() != ident:
+            raise ValueError('Unexpected cluster update response')
+
+    async def update_cluster_security_level(self, cluster_id, level, *, agent_os_user=None):
+        ident = uuid.UUID(str(cluster_id)).bytes
+        kind, original = await self.request(13, ident)
+        if kind != 14:
+            raise ValueError('Unexpected cluster info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_cluster(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != ident:
+            raise ValueError('Unknown cluster fields; refusing update')
+        reader.seek(0)
+        read_uuid(reader)
+        read_int32(reader)
+        await read_string(reader)  # host
+        read_int32(reader)
+        read_uint16(reader)
+        read_int32(reader)
+        read_int32(reader)
+        await read_string(reader)  # name
+        offset = reader.tell()
+        value = raw[:offset] + write_int32(level) + raw[offset+4:]
+        auth = (b'\x00\x00' if agent_os_user is None else
+                varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00')
+        await self._send_auth(8, auth)
+        kind, payload = await self.request(15, value)
+        if kind != 16 or payload.read() != ident:
+            raise ValueError('Unexpected cluster update response')
+
+    async def update_cluster_expiration_timeout(self, cluster_id, seconds, *, agent_os_user=None):
+        ident = uuid.UUID(str(cluster_id)).bytes
+        kind, original = await self.request(13, ident)
+        if kind != 14:
+            raise ValueError('Unexpected cluster info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_cluster(reader)
+        if reader.read() not in (b'', b'\x00'):
+            raise ValueError('Unknown cluster fields; refusing update')
+        if raw[:16] != ident:
+            raise ValueError('Unexpected cluster identifier')
+        value = raw[:16] + write_int32(seconds) + raw[20:]
+        auth = (b'\x00\x00' if agent_os_user is None else
+                varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00')
+        await self._send_auth(8, auth)
+        kind, payload = await self.request(15, value)
+        if kind != 16 or payload.read() != ident:
+            raise ValueError('Unexpected cluster update response')
+
+    async def update_cluster_name(self, cluster_id, name, *, agent_os_user=None):
+        ident = uuid.UUID(str(cluster_id)).bytes
+        kind, original = await self.request(13, ident)
+        if kind != 14:
+            raise ValueError('Unexpected cluster info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_cluster(reader)
+        if reader.read() not in (b'', b'\x00'):
+            raise ValueError('Unknown cluster fields; refusing update')
+        reader.seek(16)
+        read_int32(reader)  # expiration timeout
+        await read_string(reader)  # host
+        read_int32(reader)  # lifetime limit
+        read_uint16(reader)  # port
+        read_int32(reader)  # max memory size
+        read_int32(reader)  # max memory time limit
+        start = reader.tell()
+        await read_string(reader)  # old name
+        end = reader.tell()
+        value = raw[:start] + varint_prefixed_data_base64(name.encode('utf-8')) + raw[end:]
+        auth = (b'\x00\x00' if agent_os_user is None else
+                varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00')
+        await self._send_auth(8, auth)
+        kind, payload = await self.request(15, value)
+        if kind != 16 or payload.read() != ident:
+            raise ValueError('Unexpected cluster update response')
+
+    async def update_cluster_schedule(self, cluster_id, schedule, *, agent_os_user=None):
+        ident = uuid.UUID(str(cluster_id)).bytes
+        kind, original = await self.request(13, ident)
+        if kind != 14:
+            raise ValueError('Unexpected cluster info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_cluster(reader)
+        if reader.read() not in (b'', b'\x00'):
+            raise ValueError('Unknown cluster fields; refusing update')
+        auth = (b'\x00\x00' if agent_os_user is None else
+                varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00')
+        await self._send_auth(8, auth)
+        reader.seek(0)
+        await read_cluster(reader)
+        if read_int32(reader) != 1 or reader.read(1) not in (b'\x00', b'\x01'):
+            raise ValueError('Unexpected cluster audit fields')
+        read_int32(reader)  # ping period
+        read_int32(reader)  # ping timeout
+        start = reader.tell()
+        old_schedule = await read_string(reader)
+        remaining = reader.read()
+        if remaining not in (b'', b'\x00'):
+            extra = io.BytesIO(remaining)
+            await read_string(extra)
+            if extra.read():
+                raise ValueError('Unknown cluster tail; refusing update')
+        value = raw[:start] + b'\x00' + varint_prefixed_data_base64(schedule.encode())
+        kind, payload = await self.request(15, value)
+        if kind != 16 or payload.read() != ident:
+            raise ValueError('Unexpected cluster update response')
+
+    async def _send_auth(self, message_type, data):
+        if type(message_type) is not int or not 0 <= message_type <= 255:
+            raise ValueError('Invalid RAC message type')
+        if not isinstance(data, bytes):
+            raise ValueError('Invalid RAC request payload')
+        if len(data) > 4_000_000 - 5:
+            raise ValueError('Invalid frame length')
+        await self._exchange(self._send_auth_within_deadline, message_type, data)
+
+    async def _send_auth_within_deadline(self, message_type, data):
+        self.writer.write(frame(14, b'\x01\x00\x00\x01' + bytes([message_type]) + data))
+        await asyncio.wait_for(self.writer.drain(), self.timeout)
+        if await self.read_frame() != (14, b'\x01\x00\x00\x00'):
+            raise ValueError('Authentication rejected')
+
+    async def update_server_port_ranges(self, cluster_id, server_id, ranges):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        server = uuid.UUID(str(server_id)).bytes
+        await self.authenticate_cluster(cluster_id)
+        kind, original = await self.request(24, cluster + server)
+        if kind != 25:
+            raise ValueError('Unexpected server info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_server(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != server:
+            raise ValueError('Unknown server fields; refusing update')
+        reader.seek(16)
+        await read_string(reader)  # host
+        read_uint16(reader)
+        await read_string(reader)  # name
+        read_bool(reader)
+        read_int64(reader)
+        read_int64(reader)
+        read_int32(reader)
+        read_int64(reader)
+        read_int32(reader)
+        read_uint16(reader)
+        read_bool(reader)
+        start = reader.tell()
+        await read_port_ranges(reader)
+        end = reader.tell()
+        encoded = pack_varint_base128(len(ranges))
+        encoded += b''.join(write_uint16(maximum) + write_uint16(minimum)
+                            for minimum, maximum in ranges)
+        value = cluster + raw[:start] + encoded + raw[end:] + b'\x00'
+        kind, payload = await self.request(26, value)
+        if kind != 27 or payload.read() != server:
+            raise ValueError('Unexpected server update response')
+
+    async def update_server_dedicate_managers(self, cluster_id, server_id, choice):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        server = uuid.UUID(str(server_id)).bytes
+        await self.authenticate_cluster(cluster_id)
+        kind, original = await self.request(24, cluster + server)
+        if kind != 25:
+            raise ValueError('Unexpected server info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_server(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != server:
+            raise ValueError('Unknown server fields; refusing update')
+        reader.seek(16)
+        await read_string(reader)  # host
+        read_uint16(reader)
+        await read_string(reader)  # name
+        read_bool(reader)
+        read_int64(reader)
+        read_int64(reader)
+        read_int32(reader)
+        read_int64(reader)
+        read_int32(reader)
+        read_uint16(reader)
+        offset = reader.tell()
+        value = (cluster + raw[:offset] + (b'\x01' if choice == 'all' else b'\x00')
+                 + raw[offset+1:] + b'\x00')
+        kind, payload = await self.request(26, value)
+        if kind != 27 or payload.read() != server:
+            raise ValueError('Unexpected server update response')
+
+    async def update_server_temporary_allowed_total_memory_time_limit(self, cluster_id, server_id, limit):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        server = uuid.UUID(str(server_id)).bytes
+        await self.authenticate_cluster(cluster_id)
+        kind, original = await self.request(24, cluster + server)
+        if kind != 25:
+            raise ValueError('Unexpected server info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_server(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != server:
+            raise ValueError('Unknown server fields; refusing update')
+        reader.seek(16)
+        await read_string(reader)  # host
+        read_uint16(reader)
+        await read_string(reader)  # name
+        read_bool(reader)
+        read_int64(reader)
+        read_int64(reader)
+        read_int32(reader)
+        read_int64(reader)
+        read_int32(reader)
+        read_uint16(reader)
+        read_bool(reader)
+        await read_port_ranges(reader)
+        read_int64(reader)  # critical processes total memory
+        read_int64(reader)  # temporary allowed processes total memory
+        offset = reader.tell()
+        value = (cluster + raw[:offset] + write_int64(limit)
+                 + raw[offset+8:] + b'\x00')
+        kind, payload = await self.request(26, value)
+        if kind != 27 or payload.read() != server:
+            raise ValueError('Unexpected server update response')
+
+    async def update_server_temporary_allowed_total_memory(self, cluster_id, server_id, limit):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        server = uuid.UUID(str(server_id)).bytes
+        await self.authenticate_cluster(cluster_id)
+        kind, original = await self.request(24, cluster + server)
+        if kind != 25:
+            raise ValueError('Unexpected server info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_server(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != server:
+            raise ValueError('Unknown server fields; refusing update')
+        reader.seek(16)
+        await read_string(reader)  # host
+        read_uint16(reader)
+        await read_string(reader)  # name
+        read_bool(reader)
+        read_int64(reader)
+        read_int64(reader)
+        read_int32(reader)
+        read_int64(reader)
+        read_int32(reader)
+        read_uint16(reader)
+        read_bool(reader)
+        await read_port_ranges(reader)
+        read_int64(reader)  # critical processes total memory
+        offset = reader.tell()
+        value = (cluster + raw[:offset] + write_int64(limit)
+                 + raw[offset+8:] + b'\x00')
+        kind, payload = await self.request(26, value)
+        if kind != 27 or payload.read() != server:
+            raise ValueError('Unexpected server update response')
+
+    async def update_server_critical_total_memory(self, cluster_id, server_id, limit):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        server = uuid.UUID(str(server_id)).bytes
+        await self.authenticate_cluster(cluster_id)
+        kind, original = await self.request(24, cluster + server)
+        if kind != 25:
+            raise ValueError('Unexpected server info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_server(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != server:
+            raise ValueError('Unknown server fields; refusing update')
+        reader.seek(0)
+        await read_server(reader)
+        reader.seek(16)
+        await read_string(reader)  # host
+        read_uint16(reader)
+        await read_string(reader)  # name
+        read_bool(reader)
+        read_int64(reader)
+        read_int64(reader)
+        read_int32(reader)
+        read_int64(reader)
+        read_int32(reader)
+        read_uint16(reader)
+        read_bool(reader)
+        await read_port_ranges(reader)
+        offset = reader.tell()
+        value = (cluster + raw[:offset] + write_int64(limit)
+                 + raw[offset+8:] + b'\x00')
+        kind, payload = await self.request(26, value)
+        if kind != 27 or payload.read() != server:
+            raise ValueError('Unexpected server update response')
+
+    async def update_server_service_principal_name(self, cluster_id, server_id, name):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        server = uuid.UUID(str(server_id)).bytes
+        await self.authenticate_cluster(cluster_id)
+        kind, original = await self.request(24, cluster + server)
+        if kind != 25:
+            raise ValueError('Unexpected server info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_server(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != server:
+            raise ValueError('Unknown server fields; refusing update')
+        reader.seek(0)
+        await read_server(reader)
+        start = reader.tell()
+        await read_string(reader)
+        end = reader.tell()
+        value = (cluster + raw[:start] + varint_prefixed_data_base64(name.encode())
+                 + raw[end:] + b'\x00')
+        kind, payload = await self.request(26, value)
+        if kind != 27 or payload.read() != server:
+            raise ValueError('Unexpected server update response')
+
+    async def update_server_safe_call_memory_limit(self, cluster_id, server_id, limit):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        server = uuid.UUID(str(server_id)).bytes
+        await self.authenticate_cluster(cluster_id)
+        kind, original = await self.request(24, cluster + server)
+        if kind != 25:
+            raise ValueError('Unexpected server info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_server(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != server:
+            raise ValueError('Unknown server fields; refusing update')
+        reader.seek(16)
+        await read_string(reader)  # host
+        read_uint16(reader)
+        await read_string(reader)  # name
+        read_bool(reader)
+        read_int64(reader)  # safe working process memory limit
+        offset = reader.tell()
+        value = (cluster + raw[:offset] + write_int64(limit)
+                 + raw[offset+8:] + b'\x00')
+        kind, payload = await self.request(26, value)
+        if kind != 27 or payload.read() != server:
+            raise ValueError('Unexpected server update response')
+
+    async def update_server_connections_limit(self, cluster_id, server_id, limit):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        server = uuid.UUID(str(server_id)).bytes
+        await self.authenticate_cluster(cluster_id)
+        kind, original = await self.request(24, cluster + server)
+        if kind != 25:
+            raise ValueError('Unexpected server info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_server(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != server:
+            raise ValueError('Unknown server fields; refusing update')
+        reader.seek(16)
+        await read_string(reader)  # host
+        read_uint16(reader)
+        await read_string(reader)  # name
+        read_bool(reader)
+        read_int64(reader)
+        read_int64(reader)
+        read_int32(reader)  # infobases per process
+        read_int64(reader)  # working process memory limit
+        offset = reader.tell()
+        value = (cluster + raw[:offset] + write_int32(limit)
+                 + raw[offset+4:] + b'\x00')
+        kind, payload = await self.request(26, value)
+        if kind != 27 or payload.read() != server:
+            raise ValueError('Unexpected server update response')
+
+    async def update_server_infobases_limit(self, cluster_id, server_id, limit):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        server = uuid.UUID(str(server_id)).bytes
+        await self.authenticate_cluster(cluster_id)
+        kind, original = await self.request(24, cluster + server)
+        if kind != 25:
+            raise ValueError('Unexpected server info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_server(reader)
+        if reader.read() not in (b'', b'\x00') or raw[:16] != server:
+            raise ValueError('Unknown server fields; refusing update')
+        reader.seek(16)
+        await read_string(reader)  # host
+        read_uint16(reader)
+        await read_string(reader)  # name
+        read_bool(reader)
+        read_int64(reader)  # safe working processes memory limit
+        read_int64(reader)  # safe call memory limit
+        offset = reader.tell()
+        value = (cluster + raw[:offset] + write_int32(limit)
+                 + raw[offset+4:] + b'\x00')
+        kind, payload = await self.request(26, value)
+        if kind != 27 or payload.read() != server:
+            raise ValueError('Unexpected server update response')
+
+    async def update_server_schedule(self, cluster_id, server_id, schedule):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        server = uuid.UUID(str(server_id)).bytes
+        await self.authenticate_cluster(cluster_id)
+        kind, original = await self.request(24, cluster + server)
+        if kind != 25:
+            raise ValueError('Unexpected server info response')
+        raw = original.getvalue()
+        reader = io.BytesIO(raw)
+        await self._parse_server(reader)
+        remaining = reader.read()
+        if remaining not in (b'', b'\x00'):
+            extra = io.BytesIO(remaining)
+            await read_string(extra)
+            if extra.read():
+                raise ValueError('Unknown server fields; refusing update')
+        reader.seek(0)
+        await read_server(reader)
+        await read_string(reader)
+        start = reader.tell()
+        old_schedule = await read_string(reader)
+        remaining = reader.read()
+        if remaining not in (b'', b'\x00'):
+            extra = io.BytesIO(remaining)
+            await read_string(extra)
+            if extra.read():
+                raise ValueError('Unknown server tail; refusing update')
+        value = cluster + raw[:start] + b'\x00' + varint_prefixed_data_base64(schedule.encode()) + b'\x00'
+        kind, payload = await self.request(26, value)
+        if kind != 27 or payload.read() != server:
+            raise ValueError('Unexpected server update response')
+
+    async def _parse_admins(self, payload):
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 1000:
+            raise ValueError('Invalid administrator count')
+        rows = []
+        names, os_users = set(), set()
+        for _ in range(count):
+            name = await read_string(payload)
+            description = await read_string(payload)
+            # The Java 10.0 decoder places an opaque password field here.
+            # Consume it, but never expose its contents in results or errors.
+            await read_bytes(payload)
+            password_auth = payload.read(1)
+            os_auth = payload.read(1)
+            if password_auth not in (b'\x00', b'\x01') or os_auth not in (b'\x00', b'\x01'):
+                raise ValueError('Invalid administrator authentication flags')
+            os_user = await read_string(payload)
+            if name in names or os_user and os_user in os_users:
+                raise ValueError('Unexpected duplicate administrator identity')
+            names.add(name)
+            if os_user:
+                os_users.add(os_user)
+            rows.append({'name': name, 'descr': description,
+                         'password-auth-allowed': password_auth == b'\x01',
+                         'os-auth-allowed': os_auth == b'\x01', 'os-user': os_user})
+        if payload.read():
+            raise ValueError('Unexpected administrator response tail')
+        return rows
+
+    async def list_agent_admins(self, agent_os_user=None, *, agent_password=None):
+        if agent_password is not None:
+            if (not isinstance(agent_os_user, str) or not agent_os_user
+                    or '\x00' in agent_os_user or len(agent_os_user.encode('utf-8')) > 1024
+                    or not isinstance(agent_password, str) or not agent_password
+                    or '\x00' in agent_password or len(agent_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid agent administrator credentials')
+            auth = (varint_prefixed_data_base64(agent_os_user.encode())
+                    + varint_prefixed_data_base64(agent_password.encode()))
+        elif agent_os_user is None:
+            auth = b'\x00\x00'
+        else:
+            if (not isinstance(agent_os_user, str) or not agent_os_user
+                    or '\x00' in agent_os_user or len(agent_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid agent administrator name')
+            auth = varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00'
+        await self._send_auth(8, auth)
+        kind, payload = await self.request(0)
+        if kind != 1:
+            raise ValueError('Unexpected agent admin response')
+        return await self._parse_admins(payload)
+
+    async def _send_admin_mutation(self, opcode, record, error):
+        await self._exchange(self._send_ack_within_deadline, opcode, record, error)
+
+    async def register_agent_admin(self, name, os_user, descr='', agent_os_user=None):
+        if agent_os_user is None:
+            auth = b'\x00\x00'
+        else:
+            auth = varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00'
+        await self._send_auth(8, auth)
+        record = (varint_prefixed_data_base64(name.encode())
+                  + varint_prefixed_data_base64(descr.encode())
+                  + b'\x00\x01\x01'
+                  + varint_prefixed_data_base64(os_user.encode()))
+        await self._send_admin_mutation(4, record, 'Unexpected agent administrator registration response')
+
+    async def remove_agent_admin(self, name, agent_os_user):
+        await self._send_auth(8, varint_prefixed_data_base64(agent_os_user.encode()) + b'\x00')
+        await self._send_admin_mutation(6, varint_prefixed_data_base64(name.encode()),
+                                        'Unexpected agent administrator removal response')
+
+    async def list_cluster_admins(self, cluster_id, cluster_os_user=None, *, cluster_password=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(2, cluster.bytes)
+        if kind != 3:
+            raise ValueError('Unexpected cluster admin response')
+        return await self._parse_admins(payload)
+
+    async def register_cluster_admin(self, cluster_id, name, os_user, descr='', cluster_os_user=None):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            await self._send_auth(9, cluster + varint_prefixed_data_base64(
+                cluster_os_user.encode()) + b'\x00')
+        record = (cluster + varint_prefixed_data_base64(name.encode())
+                  + varint_prefixed_data_base64(descr.encode())
+                  + b'\x00\x01\x01'
+                  + varint_prefixed_data_base64(os_user.encode()))
+        await self._send_admin_mutation(5, record, 'Unexpected cluster administrator registration response')
+
+    async def remove_cluster_admin(self, cluster_id, name, cluster_os_user):
+        cluster = uuid.UUID(str(cluster_id)).bytes
+        await self._send_auth(9, cluster + varint_prefixed_data_base64(
+            cluster_os_user.encode()) + b'\x00')
+        await self._send_admin_mutation(7, cluster + varint_prefixed_data_base64(name.encode()),
+                                        'Unexpected cluster administrator removal response')
+
+    async def list_empty_only(self, cluster_id, request_id, response_id, operation, infobase_id=None):
+        await self.authenticate_cluster(cluster_id)
+        value = uuid.UUID(str(cluster_id)).bytes
+        if infobase_id is not None:
+            value += uuid.UUID(str(infobase_id)).bytes
+        kind, payload = await self.request(request_id, value)
+        if kind != response_id:
+            raise ValueError('Unexpected ' + operation + ' response')
+        count = await unpack_varint_base128(payload)
+        if count != 0 or payload.read():
+            raise ValueError('Nonempty ' + operation + ' records not decoded')
+        return []
+
+    async def list_sessions(self, cluster_id, infobase_id=None, *, cluster_os_user=None,
+                            cluster_password=None):
+        cluster = uuid.UUID(str(cluster_id))
+        infobase = uuid.UUID(str(infobase_id)).bytes if infobase_id is not None else b''
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        if infobase_id is None:
+            request_type, value = 65, cluster.bytes
+        else:
+            request_type = 67
+            value = cluster.bytes + infobase
+        kind, payload = await self.request(request_type, value)
+        if kind != request_type + 1:
+            raise ValueError('Unexpected session list response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid session count')
+        rows = [await self._parse_session(payload) for _ in range(count)]
+        if len({row['session_id'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate session identifier')
+        if infobase_id is not None and any(
+                row.get('infobase_id') != str(uuid.UUID(bytes=infobase)) for row in rows):
+            raise ValueError('Unexpected session infobase')
+        if payload.read():
+            raise ValueError('Unexpected session list tail')
+        return rows
+
+    async def _parse_session(self, payload):
+        try:
+            row = await read_session(payload)
+        except (EOFError, ValueError, TypeError, UnicodeError, OverflowError, IndexError,
+                struct.error):
+            raise ValueError('Invalid session data') from None
+        for key in ('session_id', 'connection_id', 'infobase_id', 'process_id'):
+            row[key] = str(row[key])
+        return row
+
+    async def get_session(self, cluster_id, session_id, *, cluster_os_user=None,
+                          cluster_password=None):
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(session_id))
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(69, cluster.bytes + ident.bytes)
+        if kind != 70:
+            raise ValueError('Unexpected session info response')
+        row = await self._parse_session(payload)
+        if row['session_id'] != str(ident) or payload.read():
+            raise ValueError('Unexpected session info data')
+        return row
+
+    async def _parse_profile(self, payload):
+        name = await read_string(payload)
+        descr = await read_string(payload)
+        if not name:
+            raise ValueError('Invalid security profile name')
+        flags = payload.read(10)
+        if len(flags) != 10 or any(flag not in (0, 1) for flag in flags):
+            raise ValueError('Invalid security profile flags')
+        row = {'name': name, 'descr': descr}
+        for key, flag in zip(('directory', 'com', 'addin', 'app', 'inet',
+                              'config', 'priv', 'raw-external-module-access',
+                              'crypto', 'right-extension'), flags):
+            row[key] = bool(flag)
+        row['right-extension-definition-roles'] = await read_string(payload)
+        all_modules = payload.read(1)
+        if all_modules not in (b'\x00', b'\x01'):
+            raise ValueError('Invalid all-modules-extension flag')
+        row['all-modules-extension'] = all_modules == b'\x01'
+        for key in ('modules-available-for-extension',
+                    'modules-not-available-for-extension', 'privileged-mode-roles'):
+            row[key] = await read_string(payload)
+        return row
+
+    async def list_profiles(self, cluster_id, *, cluster_os_user=None, cluster_password=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(89, cluster.bytes)
+        if kind != 90:
+            raise ValueError('Unexpected profile response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid profile count')
+        rows = [await self._parse_profile(payload) for _ in range(count)]
+        if len({row['name'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate profile name')
+        if payload.read():
+            raise ValueError('Unexpected profile response tail')
+        return rows
+
+    async def update_profile(self, cluster_id, row, *, cluster_os_user=None):
+        name = row.get('name') if isinstance(row, dict) else None
+        if (not isinstance(name, str) or not name.strip()
+                or '\x00' in name or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        flags = ('directory', 'com', 'addin', 'app', 'inet', 'config', 'priv',
+                 'raw-external-module-access', 'crypto', 'right-extension')
+        strings = ('descr', 'right-extension-definition-roles',
+                   'modules-available-for-extension',
+                   'modules-not-available-for-extension', 'privileged-mode-roles')
+        if set(row) - {'name', *flags, *strings, 'all-modules-extension'}:
+            raise ValueError('Unknown security profile field')
+        if any(type(row.get(key, False)) is not bool for key in (*flags, 'all-modules-extension')):
+            raise ValueError('Invalid security profile flag')
+        if any(not isinstance(row.get(key, ''), str) or '\x00' in row.get(key, '')
+               or len(row.get(key, '').encode('utf-8')) > 1024 for key in strings):
+            raise ValueError('Invalid security profile string')
+        def text(key):
+            return varint_prefixed_data_base64(row.get(key, '').encode('utf-8'))
+        value = (uuid.UUID(str(cluster_id)).bytes + text('name') + text('descr')
+                 + bytes(int(row.get(key, False)) for key in flags)
+                 + text('right-extension-definition-roles')
+                 + bytes([int(row.get('all-modules-extension', False))])
+                 + text('modules-available-for-extension')
+                 + text('modules-not-available-for-extension')
+                 + text('privileged-mode-roles'))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(91, value)
+
+    async def remove_profile(self, cluster_id, profile_name, *, cluster_os_user=None):
+        uuid.UUID(str(cluster_id))
+        if (not isinstance(profile_name, str) or not profile_name.strip()
+                or '\x00' in profile_name or len(profile_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        value = (uuid.UUID(str(cluster_id)).bytes
+                 + varint_prefixed_data_base64(profile_name.encode('utf-8')))
+        await self._send_auth(92, value)
+
+    async def update_profile_directory(self, cluster_id, row, *, cluster_os_user=None):
+        if not isinstance(row, dict) or set(row) != {
+                'profile', 'alias', 'physicalPath', 'allowedRead', 'allowedWrite', 'descr'}:
+            raise ValueError('Invalid profile directory record')
+        for key in ('profile', 'alias', 'physicalPath', 'descr'):
+            value = row[key]
+            if (not isinstance(value, str) or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024
+                    or key in ('profile', 'alias') and not value.strip()):
+                raise ValueError('Invalid profile directory field: ' + key)
+        if any(type(row[key]) is not bool for key in ('allowedRead', 'allowedWrite')):
+            raise ValueError('Invalid profile directory access flags')
+        def text(key):
+            return varint_prefixed_data_base64(row[key].encode('utf-8'))
+        value = (uuid.UUID(str(cluster_id)).bytes + text('profile') + text('alias')
+                 + text('physicalPath')
+                 + bytes([int(row['allowedRead']), int(row['allowedWrite'])]) + text('descr'))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(95, value)
+
+    async def remove_profile_directory(self, cluster_id, profile_name, alias, *, cluster_os_user=None):
+        uuid.UUID(str(cluster_id))
+        for value in (profile_name, alias):
+            if (not isinstance(value, str) or not value.strip()
+                    or '\x00' in value or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile or directory alias')
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        value = (uuid.UUID(str(cluster_id)).bytes
+                 + varint_prefixed_data_base64(profile_name.encode('utf-8'))
+                 + varint_prefixed_data_base64(alias.encode('utf-8')))
+        await self._send_auth(96, value)
+
+    async def list_profile_directories(self, cluster_id, profile_name, *, cluster_os_user=None,
+                                       cluster_password=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if (not isinstance(profile_name, str) or not profile_name or '\x00' in profile_name
+                or len(profile_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        value = (cluster.bytes + varint_prefixed_data_base64(profile_name.encode('utf-8')))
+        kind, payload = await self.request(93, value)
+        if kind != 94:
+            raise ValueError('Unexpected profile directory response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid profile directory count')
+        rows = []
+        for _ in range(count):
+            profile = await read_string(payload)
+            alias = await read_string(payload)
+            path = await read_string(payload)
+            flags = payload.read(2)
+            if profile != profile_name or not alias or len(flags) != 2 or any(x not in (0, 1) for x in flags):
+                raise ValueError('Invalid profile directory record')
+            descr = await read_string(payload)
+            rows.append({'profile': profile, 'alias': alias, 'physicalPath': path,
+                         'allowedRead': bool(flags[0]), 'allowedWrite': bool(flags[1]),
+                         'descr': descr})
+        if len({row['alias'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate profile directory alias')
+        if payload.read():
+            raise ValueError('Unexpected profile directory tail')
+        return rows
+
+    async def _authenticate_profile_acl_read(self, cluster, cluster_os_user, cluster_password):
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+
+    async def list_profile_com_classes(self, cluster_id, profile_name, *, cluster_os_user=None,
+                                       cluster_password=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if (not isinstance(profile_name, str) or not profile_name or '\x00' in profile_name
+                or len(profile_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        await self._authenticate_profile_acl_read(cluster, cluster_os_user, cluster_password)
+        value = cluster.bytes + varint_prefixed_data_base64(profile_name.encode('utf-8'))
+        kind, payload = await self.request(97, value)
+        if kind != 98:
+            raise ValueError('Unexpected profile COM response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid profile COM count')
+        rows = []
+        for _ in range(count):
+            profile = await read_string(payload)
+            name = await read_string(payload)
+            filename = await read_string(payload)
+            ident = await read_string(payload)
+            host = await read_string(payload)
+            descr = await read_string(payload)
+            if profile != profile_name or not name:
+                raise ValueError('Invalid profile COM record')
+            rows.append({'profile': profile, 'name': name, 'fileName': filename,
+                         'id': ident, 'host': host, 'descr': descr})
+        if len({row['name'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate profile COM name')
+        if payload.read():
+            raise ValueError('Unexpected profile COM tail')
+        return rows
+
+    async def update_profile_com_class(self, cluster_id, row, *, cluster_os_user=None):
+        keys = ('profile', 'name', 'fileName', 'id', 'host', 'descr')
+        if not isinstance(row, dict) or set(row) != set(keys):
+            raise ValueError('Invalid profile COM record')
+        for key in keys:
+            value = row[key]
+            if (not isinstance(value, str) or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024
+                    or key in ('profile', 'name') and not value.strip()):
+                raise ValueError('Invalid profile COM field: ' + key)
+        def text(key):
+            return varint_prefixed_data_base64(row[key].encode('utf-8'))
+        value = uuid.UUID(str(cluster_id)).bytes + b''.join(text(key) for key in keys)
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(99, value)
+
+    async def remove_profile_com_class(self, cluster_id, profile_name, class_name, *,
+                                       cluster_os_user=None):
+        uuid.UUID(str(cluster_id))
+        for value in (profile_name, class_name):
+            if (not isinstance(value, str) or not value.strip()
+                    or '\x00' in value or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile or COM class name')
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        value = (uuid.UUID(str(cluster_id)).bytes
+                 + varint_prefixed_data_base64(profile_name.encode('utf-8'))
+                 + varint_prefixed_data_base64(class_name.encode('utf-8')))
+        await self._send_auth(100, value)
+
+    async def list_profile_addins(self, cluster_id, profile_name, *, cluster_os_user=None,
+                                  cluster_password=None):
+        return await self._list_profile_hash_acl(cluster_id, profile_name, 101, 'addin',
+                                                 cluster_os_user=cluster_os_user,
+                                                 cluster_password=cluster_password)
+
+    async def update_profile_addin(self, cluster_id, row, *, cluster_os_user=None):
+        if not isinstance(row, dict) or set(row) != {'profile', 'name', 'hash', 'descr'}:
+            raise ValueError('Invalid profile addin record')
+        for key in ('profile', 'name', 'hash', 'descr'):
+            value = row[key]
+            if (not isinstance(value, str) or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024
+                    or key in ('profile', 'name') and not value.strip()):
+                raise ValueError('Invalid profile addin field: ' + key)
+        def text(key):
+            return varint_prefixed_data_base64(row[key].encode('utf-8'))
+        value = (uuid.UUID(str(cluster_id)).bytes + text('profile') + text('name')
+                 + text('hash') + text('descr'))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(103, value)
+
+    async def remove_profile_addin(self, cluster_id, profile_name, addin_name, *,
+                                   cluster_os_user=None):
+        uuid.UUID(str(cluster_id))
+        for value in (profile_name, addin_name):
+            if (not isinstance(value, str) or not value.strip()
+                    or '\x00' in value or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile or addin name')
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        value = (uuid.UUID(str(cluster_id)).bytes
+                 + varint_prefixed_data_base64(profile_name.encode('utf-8'))
+                 + varint_prefixed_data_base64(addin_name.encode('utf-8')))
+        await self._send_auth(104, value)
+
+    async def list_profile_modules(self, cluster_id, profile_name, *, cluster_os_user=None,
+                                   cluster_password=None):
+        return await self._list_profile_hash_acl(cluster_id, profile_name, 105, 'module',
+                                                 cluster_os_user=cluster_os_user,
+                                                 cluster_password=cluster_password)
+
+    async def update_profile_module(self, cluster_id, row, *, cluster_os_user=None):
+        if not isinstance(row, dict) or set(row) != {'profile', 'name', 'hash', 'descr'}:
+            raise ValueError('Invalid profile module record')
+        for key in ('profile', 'name', 'hash', 'descr'):
+            value = row[key]
+            if (not isinstance(value, str) or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024
+                    or key in ('profile', 'name') and not value.strip()):
+                raise ValueError('Invalid profile module field: ' + key)
+        def text(key):
+            return varint_prefixed_data_base64(row[key].encode('utf-8'))
+        value = (uuid.UUID(str(cluster_id)).bytes + text('profile') + text('name')
+                 + text('hash') + text('descr'))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(107, value)
+
+    async def remove_profile_module(self, cluster_id, profile_name, module_name, *,
+                                    cluster_os_user=None):
+        uuid.UUID(str(cluster_id))
+        for value in (profile_name, module_name):
+            if (not isinstance(value, str) or not value.strip()
+                    or '\x00' in value or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile or module name')
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        value = (uuid.UUID(str(cluster_id)).bytes
+                 + varint_prefixed_data_base64(profile_name.encode('utf-8'))
+                 + varint_prefixed_data_base64(module_name.encode('utf-8')))
+        await self._send_auth(108, value)
+
+    async def _list_profile_hash_acl(self, cluster_id, profile_name, request_type, acl_type,
+                                     *, cluster_os_user=None, cluster_password=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if (not isinstance(profile_name, str) or not profile_name or '\x00' in profile_name
+                or len(profile_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        await self._authenticate_profile_acl_read(cluster, cluster_os_user, cluster_password)
+        value = cluster.bytes + varint_prefixed_data_base64(profile_name.encode('utf-8'))
+        kind, payload = await self.request(request_type, value)
+        if kind != request_type + 1:
+            raise ValueError('Unexpected profile ' + acl_type + ' response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid profile ' + acl_type + ' count')
+        rows = []
+        for _ in range(count):
+            profile = await read_string(payload)
+            name = await read_string(payload)
+            hash_value = await read_string(payload)
+            descr = await read_string(payload)
+            if profile != profile_name or not name:
+                raise ValueError('Invalid profile ' + acl_type + ' record')
+            rows.append({'profile': profile, 'name': name, 'hash': hash_value,
+                         'descr': descr})
+        if len({row['name'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate profile ' + acl_type + ' name')
+        if payload.read():
+            raise ValueError('Unexpected profile ' + acl_type + ' tail')
+        return rows
+
+    async def list_profile_apps(self, cluster_id, profile_name, *, cluster_os_user=None,
+                                cluster_password=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if (not isinstance(profile_name, str) or not profile_name or '\x00' in profile_name
+                or len(profile_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        await self._authenticate_profile_acl_read(cluster, cluster_os_user, cluster_password)
+        value = cluster.bytes + varint_prefixed_data_base64(profile_name.encode('utf-8'))
+        kind, payload = await self.request(109, value)
+        if kind != 110:
+            raise ValueError('Unexpected profile app response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid profile app count')
+        rows = []
+        for _ in range(count):
+            profile = await read_string(payload)
+            name = await read_string(payload)
+            wild = await read_string(payload)
+            descr = await read_string(payload)
+            if profile != profile_name or not name:
+                raise ValueError('Invalid profile app record')
+            rows.append({'profile': profile, 'name': name, 'wild': wild,
+                         'descr': descr})
+        if len({row['name'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate profile app name')
+        if payload.read():
+            raise ValueError('Unexpected profile app tail')
+        return rows
+
+    async def update_profile_app(self, cluster_id, row, *, cluster_os_user=None):
+        if not isinstance(row, dict) or set(row) != {'profile', 'name', 'wild', 'descr'}:
+            raise ValueError('Invalid profile application record')
+        for key in ('profile', 'name', 'wild', 'descr'):
+            value = row[key]
+            if (not isinstance(value, str) or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024
+                    or key in ('profile', 'name') and not value.strip()):
+                raise ValueError('Invalid profile application field: ' + key)
+        def text(key):
+            return varint_prefixed_data_base64(row[key].encode('utf-8'))
+        value = (uuid.UUID(str(cluster_id)).bytes + text('profile') + text('name')
+                 + text('wild') + text('descr'))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(111, value)
+
+    async def remove_profile_app(self, cluster_id, profile_name, app_name, *,
+                                 cluster_os_user=None):
+        uuid.UUID(str(cluster_id))
+        for value in (profile_name, app_name):
+            if (not isinstance(value, str) or not value.strip()
+                    or '\x00' in value or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile or application name')
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        value = (uuid.UUID(str(cluster_id)).bytes
+                 + varint_prefixed_data_base64(profile_name.encode('utf-8'))
+                 + varint_prefixed_data_base64(app_name.encode('utf-8')))
+        await self._send_auth(112, value)
+
+    async def update_profile_inet(self, cluster_id, row, *, cluster_os_user=None):
+        if not isinstance(row, dict) or set(row) != {
+                'profile', 'name', 'url', 'port', 'protocol', 'descr'}:
+            raise ValueError('Invalid profile inet record')
+        for key in ('profile', 'name', 'url', 'protocol', 'descr'):
+            value = row[key]
+            if (not isinstance(value, str) or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024
+                    or key in ('profile', 'name') and not value.strip()):
+                raise ValueError('Invalid profile inet field: ' + key)
+        port = row['port']
+        if type(port) is not int or not 0 <= port <= 65535:
+            raise ValueError('Invalid profile inet port')
+        def text(key):
+            return varint_prefixed_data_base64(row[key].encode('utf-8'))
+        value = (uuid.UUID(str(cluster_id)).bytes + text('profile') + text('name')
+                 + text('url') + write_int32(port) + text('protocol') + text('descr'))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(115, value)
+
+    async def remove_profile_inet(self, cluster_id, profile_name, inet_name, *,
+                                  cluster_os_user=None):
+        uuid.UUID(str(cluster_id))
+        for value in (profile_name, inet_name):
+            if (not isinstance(value, str) or not value.strip()
+                    or '\x00' in value or len(value.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile or inet resource name')
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        value = (uuid.UUID(str(cluster_id)).bytes
+                 + varint_prefixed_data_base64(profile_name.encode('utf-8'))
+                 + varint_prefixed_data_base64(inet_name.encode('utf-8')))
+        await self._send_auth(116, value)
+
+    async def list_profile_inet(self, cluster_id, profile_name, *, cluster_os_user=None,
+                                cluster_password=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if (not isinstance(profile_name, str) or not profile_name or '\x00' in profile_name
+                or len(profile_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid security profile name')
+        await self._authenticate_profile_acl_read(cluster, cluster_os_user, cluster_password)
+        value = cluster.bytes + varint_prefixed_data_base64(profile_name.encode('utf-8'))
+        kind, payload = await self.request(113, value)
+        if kind != 114:
+            raise ValueError('Unexpected profile inet response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid profile inet count')
+
+        async def exact_string():
+            length = await unpack_varint_base64(payload)
+            if length is None or length > 65536:
+                raise ValueError('Invalid profile inet string length')
+            data = payload.read(length)
+            if len(data) != length:
+                raise ValueError('Truncated profile inet string')
+            return data.decode('utf-8')
+
+        rows = []
+        for _ in range(count):
+            profile = await exact_string()
+            name = await exact_string()
+            url = await exact_string()
+            port = read_int32(payload)
+            protocol = await exact_string()
+            descr = await exact_string()
+            if profile != profile_name or not name or not 0 <= port <= 65535:
+                raise ValueError('Invalid profile inet record')
+            rows.append({'profile': profile, 'name': name, 'url': url,
+                         'port': port, 'protocol': protocol, 'descr': descr})
+        if len({row['name'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate profile inet name')
+        if payload.read():
+            raise ValueError('Unexpected profile inet tail')
+        return rows
+
+    async def _parse_service_setting(self, payload):
+        row = {'setting': str(read_uuid(payload)),
+               'service-name': await read_string(payload),
+               'infobase-name': await read_string(payload),
+               'service-data-dir': await read_string(payload)}
+        active = payload.read(1)
+        if active not in (b'\x00', b'\x01'):
+            raise ValueError('Invalid service setting active flag')
+        row['active'] = active == b'\x01'
+        terminator = payload.read(1)
+        if terminator != b'\x00':
+            raise ValueError('Invalid service setting terminator')
+        return row
+
+    async def insert_service_setting(self, cluster_id, server_id, service_name,
+                                     infobase_name='', service_data_dir='', *, cluster_os_user=None):
+        for key, value in (('service name', service_name), ('infobase name', infobase_name),
+                           ('service data dir', service_data_dir)):
+            if (not isinstance(value, str) or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024
+                    or key == 'service name' and not value.strip()):
+                raise ValueError('Invalid ' + key)
+        def text(value):
+            return varint_prefixed_data_base64(value.encode('utf-8'))
+        value = (uuid.UUID(str(cluster_id)).bytes + uuid.UUID(str(server_id)).bytes
+                 + uuid.UUID(int=0).bytes + text(service_name) + text(infobase_name)
+                 + text(service_data_dir) + b'\x00\x00')
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(141, value)
+        if kind != 142:
+            raise ValueError('Unexpected service setting insert response')
+        ident = read_uuid(payload)
+        if payload.read():
+            raise ValueError('Unexpected service setting insert tail')
+        return ident
+
+    async def update_service_setting(self, cluster_id, server_id, row, *, cluster_os_user=None):
+        if not isinstance(row, dict) or set(row) != {
+                'setting', 'service-name', 'infobase-name', 'service-data-dir', 'active'}:
+            raise ValueError('Invalid service setting record')
+        for key in ('service-name', 'infobase-name', 'service-data-dir'):
+            value = row[key]
+            if (not isinstance(value, str) or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024
+                    or key == 'service-name' and not value.strip()):
+                raise ValueError('Invalid ' + key)
+        if type(row['active']) is not bool:
+            raise ValueError('Invalid service setting active flag')
+        def text(key):
+            return varint_prefixed_data_base64(row[key].encode('utf-8'))
+        value = (uuid.UUID(str(cluster_id)).bytes + uuid.UUID(str(server_id)).bytes
+                 + uuid.UUID(row['setting']).bytes + text('service-name')
+                 + text('infobase-name') + text('service-data-dir')
+                 + bytes([int(row['active']), 0]))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(141, value)
+        if kind != 142 or read_uuid(payload) != uuid.UUID(row['setting']) or payload.read():
+            raise ValueError('Unexpected service setting update response')
+
+    async def remove_service_setting(self, cluster_id, server_id, setting_id, *, cluster_os_user=None):
+        cluster, server, setting = (uuid.UUID(str(value)) for value in
+                                    (cluster_id, server_id, setting_id))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(143, cluster.bytes + server.bytes + setting.bytes)
+
+    async def apply_service_settings(self, cluster_id, server_id, *, cluster_os_user=None):
+        cluster, server = uuid.UUID(str(cluster_id)), uuid.UUID(str(server_id))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(144, cluster.bytes + server.bytes)
+
+    async def list_service_settings(self, cluster_id, server_id, *, cluster_os_user=None):
+        value = uuid.UUID(str(cluster_id)).bytes + uuid.UUID(str(server_id)).bytes
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(139, value)
+        if kind != 140:
+            raise ValueError('Unexpected service setting list response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid service setting count')
+        rows = [await self._parse_service_setting(payload) for _ in range(count)]
+        if len({row['setting'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate service setting identifier')
+        if payload.read():
+            raise ValueError('Unexpected service setting list tail')
+        return rows
+
+    async def get_service_setting(self, cluster_id, server_id, setting_id, *, cluster_os_user=None):
+        ident = uuid.UUID(str(setting_id))
+        value = (uuid.UUID(str(cluster_id)).bytes + uuid.UUID(str(server_id)).bytes
+                 + ident.bytes)
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(137, value)
+        if kind != 138:
+            raise ValueError('Unexpected service setting info response')
+        row = await self._parse_service_setting(payload)
+        if row['setting'] != str(ident) or payload.read():
+            raise ValueError('Unexpected service setting info data')
+        return row
+
+    async def list_service_data_dirs_for_transfer(self, cluster_id, server_id, service_name='',
+                                                  *, cluster_os_user=None):
+        if (not isinstance(service_name, str) or '\x00' in service_name
+                or len(service_name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid service name')
+        value = (uuid.UUID(str(cluster_id)).bytes + uuid.UUID(str(server_id)).bytes
+                 + varint_prefixed_data_base64(service_name.encode('utf-8')))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(145, value)
+        if kind != 146:
+            raise ValueError('Unexpected service transfer directories response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid service transfer directory count')
+        rows = []
+        for _ in range(count):
+            try:
+                service = await read_string(payload)
+                infobase = await read_string(payload)
+                source = await read_string(payload)
+                destination = await read_string(payload)
+            except (ValueError, UnicodeError):
+                raise ValueError('Invalid service transfer directory record') from None
+            if not service or not source or not destination:
+                raise ValueError('Invalid service transfer directory record')
+            if service_name and service != service_name:
+                raise ValueError('Unexpected service transfer directory name')
+            rows.append({'service-name': service, 'infobase-name': infobase,
+                         'from-dir': source, 'to-dir': destination})
+        if payload.read():
+            raise ValueError('Unexpected service transfer directory tail')
+        return rows
+
+    async def _parse_counter(self, payload):
+        result = {'name': await read_string(payload),
+                  'collection-time': read_int64(payload)}
+        group_filter = payload.read(2)
+        if len(group_filter) != 2 or group_filter[0] not in (0, 1) or group_filter[1] not in (0, 1, 2):
+            raise ValueError('Invalid counter group or filter type')
+        result['raw-group'], result['raw-filter-type'] = group_filter
+        result['group'] = ('users', 'data-separation')[group_filter[0]]
+        result['filter-type'] = ('all-selected', 'all-but-selected', 'all')[group_filter[1]]
+        result['filter'] = await read_string(payload)
+        fields = ('duration', 'cpu-time', 'memory', 'read', 'write',
+                  'duration-dbms', 'dbms-bytes', 'service', 'call',
+                  'number-of-active-sessions', 'number-of-sessions')
+        for field in fields:
+            flag = payload.read(1)
+            if flag not in (b'\x00', b'\x01'):
+                raise ValueError('Invalid or truncated counter flag')
+            result[field] = flag == b'\x01'
+        result['descr'] = await read_string(payload)
+        return result
+
+    async def update_counter(self, cluster_id, row, *, cluster_os_user=None):
+        flags = ('duration', 'cpu-time', 'memory', 'read', 'write',
+                 'duration-dbms', 'dbms-bytes', 'service', 'call',
+                 'number-of-active-sessions', 'number-of-sessions')
+        keys = {'name', 'collection-time', 'group', 'filter-type', 'filter', 'descr', *flags}
+        if not isinstance(row, dict) or set(row) != keys:
+            raise ValueError('Invalid counter record')
+        for key in ('name', 'filter', 'descr'):
+            value = row[key]
+            if (not isinstance(value, str) or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024
+                    or key == 'name' and not value.strip()):
+                raise ValueError('Invalid counter ' + key)
+        period = row['collection-time']
+        if type(period) is not int or not 0 <= period < 2**63:
+            raise ValueError('Invalid collection time')
+        if row['group'] not in ('users', 'data-separation') or row['filter-type'] not in (
+                'all-selected', 'all-but-selected', 'all'):
+            raise ValueError('Invalid counter group or filter type')
+        if any(type(row[key]) is not bool for key in flags):
+            raise ValueError('Invalid counter flags')
+        def text(key):
+            return varint_prefixed_data_base64(row[key].encode('utf-8'))
+        value = (uuid.UUID(str(cluster_id)).bytes + text('name') + write_int64(period)
+                 + bytes((('users', 'data-separation').index(row['group']),
+                          ('all-selected', 'all-but-selected', 'all').index(row['filter-type'])))
+                 + text('filter') + bytes(int(row[key]) for key in flags) + text('descr'))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(122, value)
+
+    async def remove_counter(self, cluster_id, name, *, cluster_os_user=None):
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid counter name')
+        value = (uuid.UUID(str(cluster_id)).bytes
+                 + varint_prefixed_data_base64(name.encode('utf-8')))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(123, value)
+
+    async def clear_counter(self, cluster_id, name, object_filter='', *, cluster_os_user=None):
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid counter name')
+        if (not isinstance(object_filter, str) or '\x00' in object_filter
+                or len(object_filter.encode('utf-8')) > 4096):
+            raise ValueError('Invalid counter object filter')
+        value = (uuid.UUID(str(cluster_id)).bytes
+                 + varint_prefixed_data_base64(name.encode('utf-8'))
+                 + varint_prefixed_data_base64(object_filter.encode('utf-8')))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(132, value)
+
+    async def list_counters(self, cluster_id, *, cluster_os_user=None, cluster_password=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(118, cluster.bytes)
+        if kind != 119:
+            raise ValueError('Unexpected counter list response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid counter count')
+        rows = [await self._parse_counter(payload) for _ in range(count)]
+        if len({row['name'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate counter name')
+        if payload.read():
+            raise ValueError('Unexpected counter list tail')
+        return rows
+
+    async def get_counter(self, cluster_id, name, *, cluster_os_user=None):
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid counter name')
+        cluster = uuid.UUID(str(cluster_id))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        value = cluster.bytes + varint_prefixed_data_base64(name.encode('utf-8'))
+        kind, payload = await self.request(120, value)
+        if kind != 121:
+            raise ValueError('Unexpected counter info response')
+        result = await self._parse_counter(payload)
+        if result['name'] != name or payload.read():
+            raise ValueError('Unexpected counter info data')
+        return result
+
+    async def _parse_limit(self, payload):
+        name = await read_string(payload)
+        counter = await read_string(payload)
+        action = payload.read(1)
+        if len(action) != 1 or action[0] not in range(4):
+            raise ValueError('Invalid limit action')
+        fields = ('duration', 'cpu-time', 'duration-dbms', 'duration-service',
+                  'memory', 'read', 'write', 'dbms-bytes', 'calls',
+                  'active-sessions', 'sessions')
+        result = {'name': name, 'counter': counter, 'raw-action': action[0],
+                  'action': ('none', 'set-low-priority-thread',
+                             'interrupt-current-call', 'interrupt-session')[action[0]]}
+        for field in fields:
+            result[field] = read_int64(payload)
+        result['error-message'] = await read_string(payload)
+        result['descr'] = await read_string(payload)
+        return result
+
+    async def list_counter_values(self, cluster_id, counter, object_filter='', *, cluster_os_user=None):
+        return await self._counter_values(cluster_id, 130, 131, 'counter values', counter, object_filter,
+                                          cluster_os_user=cluster_os_user)
+
+    async def list_accumulated_counter_values(self, cluster_id, counter, object_filter='', *, cluster_os_user=None):
+        return await self._counter_values(cluster_id, 133, 134, 'accumulated counter values', counter, object_filter,
+                                          cluster_os_user=cluster_os_user)
+
+    async def _parse_counter_value(self, payload):
+        # Derived from the Java 10.0 parseCounterValue(version >= 8) layout.
+        result = {'object': await read_string(payload)}
+        fields = ('collection-time', 'duration', 'cpu-time', 'duration-dbms',
+                  'duration-service', 'memory', 'read', 'write', 'dbms-bytes',
+                  'calls', 'active-sessions', 'sessions', 'time')
+        for field in fields:
+            result[field] = read_int64(payload)
+        return result
+
+    async def _counter_values(self, cluster_id, request_type, response_type, operation, name, object_filter,
+                              *, cluster_os_user=None):
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid ' + operation + ' name')
+        if not isinstance(object_filter, str) or '\x00' in object_filter or len(object_filter.encode()) > 4096:
+            raise ValueError('Invalid ' + operation + ' filter')
+        cluster = uuid.UUID(str(cluster_id))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        value = (cluster.bytes + varint_prefixed_data_base64(name.encode())
+                 + varint_prefixed_data_base64(object_filter.encode()))
+        kind, payload = await self.request(request_type, value)
+        if kind != response_type:
+            raise ValueError('Unexpected ' + operation + ' response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid ' + operation + ' count')
+        try:
+            rows = [await self._parse_counter_value(payload) for _ in range(count)]
+        except (EOFError, ValueError, TypeError, UnicodeError, OverflowError, IndexError,
+                struct.error):
+            raise ValueError('Invalid ' + operation + ' data') from None
+        if payload.read():
+            raise ValueError('Unexpected ' + operation + ' tail')
+        return rows
+
+    async def update_limit(self, cluster_id, row, *, cluster_os_user=None):
+        fields = ('duration', 'cpu-time', 'duration-dbms', 'duration-service',
+                  'memory', 'read', 'write', 'dbms-bytes', 'calls',
+                  'active-sessions', 'sessions')
+        actions = ('none', 'set-low-priority-thread', 'interrupt-current-call',
+                   'interrupt-session')
+        if not isinstance(row, dict) or set(row) != {
+                'name', 'counter', 'action', 'error-message', 'descr', *fields}:
+            raise ValueError('Invalid limit record')
+        for key in ('name', 'counter', 'error-message', 'descr'):
+            value = row[key]
+            if (not isinstance(value, str) or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024
+                    or key == 'name' and not value.strip()):
+                raise ValueError('Invalid limit ' + key)
+        if row['action'] not in actions:
+            raise ValueError('Invalid limit action')
+        if any(type(row[key]) is not int or not 0 <= row[key] < 2**63 for key in fields):
+            raise ValueError('Invalid limit threshold')
+        def text(key):
+            return varint_prefixed_data_base64(row[key].encode('utf-8'))
+        value = (uuid.UUID(str(cluster_id)).bytes + text('name') + text('counter')
+                 + bytes([actions.index(row['action'])])
+                 + b''.join(write_int64(row[key]) for key in fields)
+                 + text('error-message') + text('descr'))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(128, value)
+
+    async def remove_limit(self, cluster_id, name, *, cluster_os_user=None):
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid limit name')
+        value = (uuid.UUID(str(cluster_id)).bytes
+                 + varint_prefixed_data_base64(name.encode('utf-8')))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster_id)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        await self._send_auth(129, value)
+
+    async def list_limits(self, cluster_id, *, cluster_os_user=None, cluster_password=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(124, cluster.bytes)
+        if kind != 125:
+            raise ValueError('Unexpected limit list response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 10000:
+            raise ValueError('Invalid limit count')
+        rows = [await self._parse_limit(payload) for _ in range(count)]
+        if len({row['name'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate limit name')
+        if payload.read():
+            raise ValueError('Unexpected limit list tail')
+        return rows
+
+    async def get_limit(self, cluster_id, name, *, cluster_os_user=None):
+        if (not isinstance(name, str) or not name.strip() or '\x00' in name
+                or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid limit name')
+        cluster = uuid.UUID(str(cluster_id))
+        if cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, uuid.UUID(str(cluster_id)).bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        value = cluster.bytes + varint_prefixed_data_base64(name.encode('utf-8'))
+        kind, payload = await self.request(126, value)
+        if kind != 127:
+            raise ValueError('Unexpected limit info response')
+        result = await self._parse_limit(payload)
+        if result['name'] != name or payload.read():
+            raise ValueError('Unexpected limit info data')
+        return result
+
+    async def agent_version(self):
+        kind, payload = await self.request(135)
+        if kind != 136:
+            raise ValueError('Unexpected agent version response')
+        version = await read_string(payload)
+        if payload.read():
+            raise ValueError('Unexpected agent version tail')
+        return version
+
+    async def _parse_manager(self, payload):
+        ident = str(read_uuid(payload))
+        description = await read_string(payload)
+        host = await read_string(payload)
+        using = read_int32(payload)
+        if using not in (0, 1):
+            raise ValueError('Unknown manager mode')
+        port = read_uint16(payload)
+        pid = await read_string(payload)
+        return {'manager': ident, 'descr': description, 'host': host,
+                'using': 'main' if using == 1 else 'normal', 'port': port, 'pid': pid}
+
+    async def list_managers(self, cluster_id, *, cluster_os_user=None, cluster_password=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(18, cluster.bytes)
+        if kind != 19:
+            raise ValueError('Unexpected manager response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 1000:
+            raise ValueError('Invalid manager count')
+        rows = [await self._parse_manager(payload) for _ in range(count)]
+        if len({row['manager'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate manager identifier')
+        if payload.read():
+            raise ValueError('Unexpected manager tail')
+        return rows
+
+    async def get_manager(self, cluster_id, manager_id, *, cluster_os_user=None,
+                          cluster_password=None):
+        cluster, ident = uuid.UUID(str(cluster_id)), uuid.UUID(str(manager_id))
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(20, cluster.bytes + ident.bytes)
+        if kind != 21:
+            raise ValueError('Unexpected manager info response')
+        row = await self._parse_manager(payload)
+        if row['manager'] != str(ident) or payload.read():
+            raise ValueError('Unexpected manager info data')
+        return row
+
+    async def list_services(self, cluster_id, *, cluster_os_user=None, cluster_password=None):
+        cluster = uuid.UUID(str(cluster_id))
+        if cluster_password is not None:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024
+                    or not isinstance(cluster_password, str) or not cluster_password
+                    or '\x00' in cluster_password or len(cluster_password.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator credentials')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode())
+                                  + varint_prefixed_data_base64(cluster_password.encode()))
+        elif cluster_os_user is None:
+            await self.authenticate_cluster(cluster)
+        else:
+            if (not isinstance(cluster_os_user, str) or not cluster_os_user
+                    or '\x00' in cluster_os_user or len(cluster_os_user.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator name')
+            await self._send_auth(9, cluster.bytes
+                                  + varint_prefixed_data_base64(cluster_os_user.encode()) + b'\x00')
+        kind, payload = await self.request(35, cluster.bytes)
+        if kind != 36:
+            raise ValueError('Unexpected service response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 1000:
+            raise ValueError('Invalid service count')
+        rows = []
+        for _ in range(count):
+            name = await read_string(payload)
+            description = await read_string(payload)
+            main_only = read_int32(payload)
+            if main_only not in (0, 1):
+                raise ValueError('Unknown service main-only flag')
+            has_manager = payload.read(1)
+            if has_manager not in (b'\x00', b'\x01'):
+                raise ValueError('Unknown service manager flag')
+            manager = str(read_uuid(payload)) if has_manager == b'\x01' else None
+            rows.append({'name': name, 'descr': description, 'main-only': main_only,
+                         'manager': manager})
+        if len({row['name'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate service name')
+        if payload.read():
+            raise ValueError('Unexpected service tail')
+        return rows
+
+    async def list_clusters(self):
+        message_type, payload = await self.request(11)
+        if message_type != 12:
+            raise ValueError('Unexpected cluster response')
+        count = await unpack_varint_base128(payload)
+        if count is None or count > 1000:
+            raise ValueError('Invalid cluster count')
+        rows = []
+        for _ in range(count):
+            rows.append(await self._parse_cluster(payload, list_record=True))
+        if len({row['cluster'] for row in rows}) != count:
+            raise ValueError('Unexpected duplicate cluster identifier')
+        if payload.read() not in (b'', b'\x00'):
+            raise ValueError('Unexpected trailing response data')
+        return rows