@shawnstack/quickforge 1.7.7 → 1.7.8

package/server/lan-access-cutover.mjs

@@ -0,0 +1,306 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
+import { randomUUID } from 'node:crypto'
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import { getSqliteStorage } from './sqlite/database.mjs'
+import { createLanAccessRepository, lanAccessConfigDigest, normalizeLanAccessConfig } from './sqlite/lan-access-repository.mjs'
+import {
+  LAN_ACCESS_STORAGE_PHASES,
+  configureLanAccessService,
+  createDefaultLanAccessMirror,
+  drainLanAccessJsonMirror,
+  readLanAccessStorageState,
+  setLanAccessStoragePhase,
+} from './lan-access-service.mjs'
+import {
+  defaultLanAccessConfig,
+  ensureLanAccessJsonFile,
+  readLanAccessJsonFile,
+  writeLanAccessJsonFile,
+} from './lan-access-json-file.mjs'
+import { storageDir } from './storage.mjs'
+
+const DEFAULT_LOCK_TTL_MS = 60_000
+const DEFAULT_WAIT_TIMEOUT_MS = 65_000
+const maintenanceContext = new AsyncLocalStorage()
+let maintenanceCount = 0
+
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype
+}
+
+/**
+ * Validate and normalize the whole LAN access JSON config (`security/
+ * lan-access.json`) into a canonical config. Fails closed on: malformed config
+ * object, password hash/salt inconsistency, enabled-without-password, malformed
+ * `tokens` array. Expired tokens are pruned exactly like `pruneTokens` on the
+ * JSON side and the ≤100 cap keeps the newest entries. The count/digest are
+ * computed with the exact repository digest algorithm so the SQLite replace
+ * verification can compare digests 1:1.
+ */
+export function buildLanAccessJsonSnapshot(input, { now = () => new Date().toISOString() } = {}) {
+  if (!isPlainObject(input)) throw new TypeError('LAN access JSON config must be an object')
+  const config = normalizeLanAccessConfig(
+    input.updatedAt ? input : { ...input, updatedAt: now() },
+    { now },
+  )
+  return {
+    config,
+    tokenCount: config.tokens.length,
+    digest: lanAccessConfigDigest(config),
+    diagnostics: { source: 'security/lan-access.json' },
+  }
+}
+
+/**
+ * Default cutover JSON source reader. Missing files (ENOENT) and unreadable or
+ * corrupt JSON both fall back to the default disabled config — the same
+ * semantics lan-access-store applies to a missing file — so the server can
+ * continue and LAN access simply starts disabled (fail-closed). The fallback is
+ * materialized so repeated reads stay stable for the double-snapshot check.
+ */
+export async function readLanAccessJsonSource() {
+  await ensureLanAccessJsonFile()
+  try {
+    return await readLanAccessJsonFile()
+  } catch {
+    const fallback = defaultLanAccessConfig()
+    await writeLanAccessJsonFile(fallback)
+    return fallback
+  }
+}
+
+async function writeLanAccessCutoverBackup(snapshot, directory = path.join(storageDir, 'backups')) {
+  await fs.mkdir(directory, { recursive: true })
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-')
+  const finalPath = path.join(directory, `quickforge-lan-access-cutover-${stamp}.json`)
+  const temporaryPath = `${finalPath}.${process.pid}.${randomUUID()}.tmp`
+  const backup = {
+    app: 'quickforge',
+    version: 1,
+    exportedAt: new Date().toISOString(),
+    scope: 'lan-access',
+    includeSecrets: false,
+    lanAccess: { tokenCount: snapshot.tokenCount, digest: snapshot.digest },
+    data: {
+      lanAccess: snapshot.config,
+    },
+  }
+  try {
+    await fs.writeFile(temporaryPath, `${JSON.stringify(backup, null, 2)}\n`, 'utf8')
+    const verified = JSON.parse(await fs.readFile(temporaryPath, 'utf8'))
+    const verifiedSnapshot = buildLanAccessJsonSnapshot(verified.data?.lanAccess)
+    if (verified.lanAccess?.tokenCount !== snapshot.tokenCount || verified.lanAccess?.digest !== snapshot.digest
+      || verifiedSnapshot.tokenCount !== snapshot.tokenCount || verifiedSnapshot.digest !== snapshot.digest) {
+      throw new Error('LAN access cutover backup verification failed')
+    }
+    await fs.rename(temporaryPath, finalPath)
+    return finalPath
+  } catch (error) {
+    await fs.rm(temporaryPath, { force: true }).catch(() => {})
+    throw error
+  }
+}
+
+function ownerPid(row) {
+  const value = Number(row?.owner_pid)
+  return Number.isInteger(value) && value > 0 ? value : null
+}
+
+function pidAlive(pid) {
+  try { process.kill(pid, 0); return true } catch (error) { return error?.code === 'EPERM' }
+}
+
+export function acquireLanAccessMaintenanceLock(storage, options = {}) {
+  const nowMs = Number(options.now?.() ?? Date.now())
+  const acquiredAt = new Date(nowMs).toISOString()
+  const expiresAt = new Date(nowMs + (options.ttlMs ?? DEFAULT_LOCK_TTL_MS)).toISOString()
+  const identity = isPlainObject(options.owner)
+    ? { id: options.owner.id || `${options.owner.pid || process.pid}:${randomUUID()}`, pid: options.owner.pid || process.pid }
+    : { id: options.owner || `${process.pid}:${randomUUID()}`, pid: process.pid }
+  const isPidAlive = options.pidAlive || pidAlive
+  return storage.transaction((database) => {
+    const current = database.prepare('SELECT * FROM lan_access_maintenance_lock WHERE singleton = 1').get()
+    if (current && current.owner === identity.id) {
+      database.prepare(`UPDATE lan_access_maintenance_lock SET owner_pid = ?, operation = ?, heartbeat_at = ?, expires_at = ?
+        WHERE singleton = 1 AND owner = ? AND fencing = ?`)
+        .run(identity.pid, options.operation || current.operation, acquiredAt, expiresAt, identity.id, current.fencing)
+      return { owner: identity.id, ownerPid: identity.pid, fencing: Number(current.fencing), expiresAt }
+    }
+    if (current) {
+      const expired = Date.parse(current.expires_at) <= nowMs
+      const pid = ownerPid(current)
+      if (!expired || pid === null || isPidAlive(pid)) return null
+    }
+    const fencing = Number(current?.fencing || 0) + 1
+    database.prepare(`INSERT INTO lan_access_maintenance_lock
+      (singleton, owner, owner_pid, fencing, operation, acquired_at, heartbeat_at, expires_at)
+      VALUES (1, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(singleton) DO UPDATE SET owner=excluded.owner, owner_pid=excluded.owner_pid, fencing=excluded.fencing,
+      operation=excluded.operation, acquired_at=excluded.acquired_at, heartbeat_at=excluded.heartbeat_at, expires_at=excluded.expires_at`)
+      .run(identity.id, identity.pid, fencing, options.operation || 'lan-access-maintenance', acquiredAt, acquiredAt, expiresAt)
+    return { owner: identity.id, ownerPid: identity.pid, fencing, expiresAt }
+  }, { mode: 'immediate' })
+}
+
+export function renewLanAccessMaintenanceLock(storage, lease, options = {}) {
+  const nowMs = Number(options.now?.() ?? Date.now())
+  const heartbeatAt = new Date(nowMs).toISOString()
+  const expiresAt = new Date(nowMs + (options.ttlMs ?? DEFAULT_LOCK_TTL_MS)).toISOString()
+  const result = storage.prepare(`UPDATE lan_access_maintenance_lock SET heartbeat_at = ?, expires_at = ? WHERE singleton = 1 AND owner = ? AND fencing = ?`)
+    .run(heartbeatAt, expiresAt, lease.owner, lease.fencing)
+  lease.expiresAt = expiresAt
+  return Number(result.changes) === 1
+}
+
+export function releaseLanAccessMaintenanceLock(storage, lease) {
+  return Number(storage.prepare('DELETE FROM lan_access_maintenance_lock WHERE singleton = 1 AND owner = ? AND fencing = ?').run(lease.owner, lease.fencing).changes) === 1
+}
+
+async function waitForLanAccessLock(storage, options) {
+  const deadline = Date.now() + (options.waitTimeoutMs ?? DEFAULT_WAIT_TIMEOUT_MS)
+  while (Date.now() < deadline) {
+    const lease = acquireLanAccessMaintenanceLock(storage, options)
+    if (lease) return lease
+    await new Promise((resolve) => setTimeout(resolve, options.pollIntervalMs ?? 100))
+  }
+  throw new Error('Timed out waiting for LAN access maintenance lock')
+}
+
+export async function runLanAccessMaintenance(operation, options = {}) {
+  const existing = maintenanceContext.getStore()
+  if (existing) return operation(existing)
+  const storage = options.storage || getSqliteStorage()
+  const lease = await waitForLanAccessLock(storage, options)
+  const interval = options.heartbeatIntervalMs ?? Math.max(10, Math.floor((options.ttlMs ?? DEFAULT_LOCK_TTL_MS) / 3))
+  let rejectHeartbeat
+  let heartbeatError = null
+  const heartbeatFailure = new Promise((_, reject) => { rejectHeartbeat = reject })
+  const timer = setInterval(() => {
+    try {
+      if (!renewLanAccessMaintenanceLock(storage, lease, options)) throw new Error('LAN access maintenance lock fencing was lost')
+    } catch (error) {
+      heartbeatError = error
+      rejectHeartbeat(error)
+    }
+  }, interval)
+  timer.unref?.()
+  maintenanceCount += 1
+  try {
+    const context = { storage, lease }
+    const result = await Promise.race([maintenanceContext.run(context, () => Promise.resolve().then(() => operation(context))), heartbeatFailure])
+    if (heartbeatError) throw heartbeatError
+    return result
+  } finally {
+    clearInterval(timer)
+    releaseLanAccessMaintenanceLock(storage, lease)
+    maintenanceCount = Math.max(0, maintenanceCount - 1)
+  }
+}
+
+export function isLanAccessMaintenanceActive(storage) {
+  if (!storage) {
+    try { storage = getSqliteStorage() } catch { return false }
+  }
+  return maintenanceCount > 0 || Boolean(storage.prepare('SELECT 1 AS active FROM lan_access_maintenance_lock WHERE singleton = 1').get())
+}
+
+export function currentLanAccessMaintenanceContext() {
+  return maintenanceContext.getStore() || null
+}
+
+/**
+ * JSON → SQLite LAN access cutover. Phase machine:
+ * json_authoritative → cutover_running → sqlite_authoritative_json_pending →
+ * authoritative, backed by `lan_access_storage_state` and the independent
+ * `lan_access_maintenance_lock`. Runs a stable double snapshot (+ backup reread
+ * and a third stability read), then commits the SQLite replace and the pending
+ * phase in one transaction. Any failure before pending returns to
+ * json_authoritative; after pending the phase stays pending (fail-closed,
+ * recoverable on the next start by draining the mirror).
+ */
+export async function initializeLanAccessCutover(options = {}) {
+  const storage = options.storage || getSqliteStorage()
+  const repository = options.repository || createLanAccessRepository(storage)
+  configureLanAccessService({ repository, mirror: options.mirror || createDefaultLanAccessMirror() })
+  return runLanAccessMaintenance(async () => {
+    const current = readLanAccessStorageState()
+    if (current.phase === LAN_ACCESS_STORAGE_PHASES.JSON_PENDING) {
+      const integrity = repository.verifyIntegrity({ quickCheck: true })
+      if (!integrity.ok) throw new Error('LAN access state pending integrity verification failed')
+      const drained = await drainLanAccessJsonMirror()
+      if (drained.pending === 0) setLanAccessStoragePhase(LAN_ACCESS_STORAGE_PHASES.AUTHORITATIVE, { lanTokenCount: integrity.count, digest: integrity.digest, backupFile: current.backupFile })
+      return readLanAccessStorageState()
+    }
+    if (current.phase === LAN_ACCESS_STORAGE_PHASES.AUTHORITATIVE) {
+      const integrity = repository.verifyIntegrity({ quickCheck: true })
+      if (!integrity.ok) throw new Error('LAN access state authoritative integrity verification failed')
+      await drainLanAccessJsonMirror()
+      return readLanAccessStorageState()
+    }
+
+    if (current.phase === LAN_ACCESS_STORAGE_PHASES.CUTOVER_RUNNING && current.backupFile) {
+      setLanAccessStoragePhase(LAN_ACCESS_STORAGE_PHASES.JSON_AUTHORITATIVE, {
+        backupFile: current.backupFile,
+        diagnostic: { operation: 'cutover_recovery', recoveredFrom: LAN_ACCESS_STORAGE_PHASES.CUTOVER_RUNNING },
+      })
+    }
+
+    let backupFile = current.backupFile
+    try {
+      const readJson = options.readJson || readLanAccessJsonSource
+      const first = buildLanAccessJsonSnapshot(await readJson())
+      const second = buildLanAccessJsonSnapshot(await readJson())
+      if (first.tokenCount !== second.tokenCount || first.digest !== second.digest) {
+        throw new Error('LAN access JSON source changed during cutover double read')
+      }
+      if (!backupFile) backupFile = await writeLanAccessCutoverBackup(first, options.backupDirectory)
+      const third = buildLanAccessJsonSnapshot(await readJson())
+      if (first.tokenCount !== third.tokenCount || first.digest !== third.digest) {
+        throw new Error('LAN access JSON source changed before cutover commit')
+      }
+      setLanAccessStoragePhase(LAN_ACCESS_STORAGE_PHASES.CUTOVER_RUNNING, {
+        lanTokenCount: first.tokenCount,
+        digest: first.digest,
+        backupFile,
+        diagnostic: first.diagnostics,
+      })
+      const pendingValues = {
+        phase: LAN_ACCESS_STORAGE_PHASES.JSON_PENDING,
+        backupFile,
+        diagnostic: first.diagnostics,
+      }
+      repository.replaceAll(first.config, {
+        expectedCount: first.tokenCount,
+        expectedDigest: first.digest,
+        storageState: pendingValues,
+      })
+      const integrity = repository.verifyIntegrity({ quickCheck: true })
+      if (!integrity.ok || integrity.count !== first.tokenCount || integrity.digest !== first.digest) {
+        throw new Error('LAN access SQLite replace verification failed')
+      }
+      // Refresh the cached phase so the mirror drain runs in pending mode.
+      readLanAccessStorageState()
+      const drained = await drainLanAccessJsonMirror()
+      if (drained.pending === 0) {
+        setLanAccessStoragePhase(LAN_ACCESS_STORAGE_PHASES.AUTHORITATIVE, {
+          lanTokenCount: integrity.count,
+          digest: integrity.digest,
+          backupFile,
+          diagnostic: first.diagnostics,
+        })
+      }
+      return readLanAccessStorageState()
+    } catch (error) {
+      const state = readLanAccessStorageState()
+      if (![LAN_ACCESS_STORAGE_PHASES.JSON_PENDING, LAN_ACCESS_STORAGE_PHASES.AUTHORITATIVE].includes(state.phase)) {
+        setLanAccessStoragePhase(LAN_ACCESS_STORAGE_PHASES.JSON_AUTHORITATIVE, {
+          backupFile,
+          diagnostic: { operation: 'cutover', errorName: error?.name || 'Error', error: error?.message || String(error) },
+        })
+        return readLanAccessStorageState()
+      }
+      throw error
+    }
+  }, { ...options, storage, operation: 'lan-access-cutover' })
+}

package/server/lan-access-json-file.mjs

@@ -0,0 +1,75 @@
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import { ensureStorage, storageDir } from './storage.mjs'
+import { normalizeLanAccessConfig } from './sqlite/lan-access-repository.mjs'
+
+// F11 mirror file: `security/lan-access.json` stays as the best-effort JSON
+// mirror (and cutover source) once SQLite is authoritative. Writes use an
+// atomic tmp+rename and always normalize through the repository so the file
+// shape exactly matches what lan-access-store.mjs writes.
+export function lanAccessJsonPath() {
+  return path.join(storageDir, 'security', 'lan-access.json')
+}
+
+export function defaultLanAccessConfig() {
+  return {
+    enabled: false,
+    passwordHash: undefined,
+    passwordSalt: undefined,
+    passwordVersion: undefined,
+    authVersion: 1,
+    sessionTtlHours: 12,
+    updatedAt: new Date().toISOString(),
+    tokens: [],
+  }
+}
+
+export async function ensureLanAccessJsonFile() {
+  await ensureStorage()
+  await fs.mkdir(path.dirname(lanAccessJsonPath()), { recursive: true })
+  try {
+    await fs.access(lanAccessJsonPath())
+  } catch {
+    await fs.writeFile(lanAccessJsonPath(), `${JSON.stringify(normalizeLanAccessConfig(defaultLanAccessConfig()), null, 2)}\n`, 'utf8')
+  }
+}
+
+export async function readLanAccessJsonFile() {
+  await ensureLanAccessJsonFile()
+  try {
+    const raw = await fs.readFile(lanAccessJsonPath(), 'utf8')
+    const text = raw.trimStart()
+    const parsed = text ? JSON.parse(text) : {}
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {}
+  } catch (error) {
+    if (error?.code === 'ENOENT') return defaultLanAccessConfig()
+    throw error
+  }
+}
+
+export async function writeLanAccessJsonFile(config) {
+  await ensureLanAccessJsonFile()
+  const finalPath = lanAccessJsonPath()
+  const temporaryPath = `${finalPath}.${process.pid}.tmp`
+  try {
+    await fs.writeFile(temporaryPath, `${JSON.stringify(normalizeLanAccessConfig(config), null, 2)}\n`, 'utf8')
+    await fs.rename(temporaryPath, finalPath)
+  } catch (error) {
+    await fs.rm(temporaryPath, { force: true }).catch(() => {})
+    throw error
+  }
+}
+
+// Materialize one mirror entry into the whole-file JSON store. `delete` resets
+// the file to the default disabled config (the same fallback semantics the
+// store applies to a missing file).
+export async function materializeLanAccessJsonEntry(entry) {
+  if (!entry || typeof entry !== 'object') throw new Error('LAN access mirror entry is invalid')
+  if (entry.operation === 'delete') {
+    await writeLanAccessJsonFile(defaultLanAccessConfig())
+  } else if (entry.operation === 'upsert' && entry.config) {
+    await writeLanAccessJsonFile(entry.config)
+  } else {
+    throw new Error('LAN access mirror entry is invalid')
+  }
+}

package/server/lan-access-service.mjs

@@ -0,0 +1,155 @@
+import { createLanAccessRepository } from './sqlite/lan-access-repository.mjs'
+import { getSqliteStorage } from './sqlite/database.mjs'
+import { materializeLanAccessJsonEntry } from './lan-access-json-file.mjs'
+
+// F11 LAN access storage phases — the same state machine as F8 session state /
+// F10 share storage but in its own storage domain (`lan_access_storage_state`,
+// independent maintenance lock).
+export const LAN_ACCESS_STORAGE_PHASES = Object.freeze({
+  JSON_AUTHORITATIVE: 'json_authoritative',
+  CUTOVER_RUNNING: 'cutover_running',
+  JSON_PENDING: 'sqlite_authoritative_json_pending',
+  AUTHORITATIVE: 'authoritative',
+})
+
+let repositoryInstance = null
+let cachedPhase = LAN_ACCESS_STORAGE_PHASES.JSON_AUTHORITATIVE
+let mirrorAdapter = null
+let drainPromise = null
+let mirrorTimer = null
+const MIRROR_DRAIN_INTERVAL_MS = 1000
+
+function storage() {
+  return getSqliteStorage()
+}
+
+function repository() {
+  if (!repositoryInstance) repositoryInstance = createLanAccessRepository(storage())
+  return repositoryInstance
+}
+
+function sqliteReadable() {
+  return cachedPhase === LAN_ACCESS_STORAGE_PHASES.JSON_PENDING || cachedPhase === LAN_ACCESS_STORAGE_PHASES.AUTHORITATIVE
+}
+
+export function createDefaultLanAccessMirror() {
+  return {
+    async upsert(config) {
+      await materializeLanAccessJsonEntry({ operation: 'upsert', config })
+    },
+    async delete() {
+      await materializeLanAccessJsonEntry({ operation: 'delete' })
+    },
+  }
+}
+
+export function configureLanAccessService({ repository: configuredRepository, mirror, phase } = {}) {
+  if (configuredRepository !== undefined) repositoryInstance = configuredRepository
+  if (mirror !== undefined) mirrorAdapter = mirror
+  if (phase !== undefined) {
+    if (!Object.values(LAN_ACCESS_STORAGE_PHASES).includes(phase)) throw new TypeError(`Invalid LAN access storage phase: ${phase}`)
+    cachedPhase = phase
+  }
+}
+
+/**
+ * The active LAN access repository (lazily created from the SQLite storage
+ * handle). Only callable while the LAN access storage is SQLite-readable
+ * (pending or authoritative); JSON-authoritative phases keep the legacy JSON
+ * store path.
+ */
+export function getLanAccessRepository() {
+  return repository()
+}
+
+export function setLanAccessStoragePhase(phase, values = {}) {
+  if (!Object.values(LAN_ACCESS_STORAGE_PHASES).includes(phase)) throw new TypeError(`Invalid LAN access storage phase: ${phase}`)
+  const updatedAt = new Date().toISOString()
+  storage().prepare(`UPDATE lan_access_storage_state SET phase = ?, lan_token_count = ?, digest = ?, backup_file = ?, diagnostic_json = ?, updated_at = ? WHERE singleton = 1`)
+    .run(phase, values.lanTokenCount ?? null, values.digest ?? null, values.backupFile ?? null, values.diagnostic ? JSON.stringify(values.diagnostic) : null, updatedAt)
+  cachedPhase = phase
+  return readLanAccessStorageState()
+}
+
+export function readLanAccessStorageState() {
+  const row = storage().prepare('SELECT * FROM lan_access_storage_state WHERE singleton = 1').get()
+  if (!row) throw new Error('LAN access storage state is missing')
+  cachedPhase = row.phase
+  return {
+    phase: row.phase,
+    lanTokenCount: row.lan_token_count === null ? null : Number(row.lan_token_count),
+    digest: row.digest,
+    backupFile: row.backup_file,
+    diagnostic: row.diagnostic_json ? JSON.parse(row.diagnostic_json) : null,
+    updatedAt: row.updated_at,
+  }
+}
+
+export function initializeLanAccessService() {
+  return readLanAccessStorageState()
+}
+
+export function getLanAccessStoragePhase() {
+  return cachedPhase
+}
+
+export function isLanAccessStorageAuthoritative() {
+  return sqliteReadable()
+}
+
+function scheduleLanAccessJsonMirrorDrain() {
+  if (!sqliteReadable() || !mirrorAdapter || mirrorTimer) return
+  mirrorTimer = setTimeout(() => {
+    mirrorTimer = null
+    void drainLanAccessJsonMirror().then(({ pending }) => {
+      if (pending > 0) scheduleLanAccessJsonMirrorDrain()
+    }).catch(() => {
+      scheduleLanAccessJsonMirrorDrain()
+    })
+  }, MIRROR_DRAIN_INTERVAL_MS)
+  mirrorTimer.unref?.()
+}
+
+export function requestLanAccessJsonMirrorDrain() {
+  scheduleLanAccessJsonMirrorDrain()
+}
+
+export function stopLanAccessService() {
+  if (mirrorTimer) clearTimeout(mirrorTimer)
+  mirrorTimer = null
+}
+
+export async function drainLanAccessJsonMirror() {
+  if (!sqliteReadable() || !mirrorAdapter) return { pending: 0, drained: 0, failed: 0 }
+  if (drainPromise) return drainPromise
+  drainPromise = (async () => {
+    let drained = 0
+    let failed = 0
+    for (;;) {
+      const entries = repository().listMirrorQueue()
+      if (entries.length === 0) break
+      let progressed = false
+      for (const entry of entries) {
+        try {
+          if (entry.operation === 'upsert') await mirrorAdapter.upsert(entry.config)
+          else await mirrorAdapter.delete()
+          repository().acknowledgeMirror(entry)
+          drained += 1
+          progressed = true
+        } catch (error) {
+          repository().failMirror(entry, error)
+          failed += 1
+        }
+      }
+      if (!progressed) break
+    }
+    return { pending: repository().listMirrorQueue().length, drained, failed }
+  })().finally(() => {
+    drainPromise = null
+  })
+  return drainPromise
+}
+
+export function listLanAccessMirrorQueue() {
+  return repository().listMirrorQueue()
+}