@envseal/core 0.1.0

package/dist/sinks/keychain.js

@@ -0,0 +1,333 @@
+import { spawn } from 'node:child_process';
+import { mkdirSync, writeFileSync, readFileSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { asSecret } from '@envseal/protocol';
+import { unsafeSecretToUtf8 } from './dotenv.js';
+function execCommand(file, args, input, env) {
+    return new Promise((resolve, reject) => {
+        let stdout = '';
+        let stderr = '';
+        const proc = spawn(file, args, {
+            shell: false,
+            stdio: [input ? 'pipe' : 'ignore', 'pipe', 'pipe'],
+            ...(env ? { env } : {}),
+        });
+        if (proc.stdout) {
+            proc.stdout.on('data', (chunk) => {
+                stdout += chunk.toString();
+            });
+        }
+        if (proc.stderr) {
+            proc.stderr.on('data', (chunk) => {
+                stderr += chunk.toString();
+            });
+        }
+        proc.on('close', (code) => {
+            if (code === 0) {
+                resolve(stdout);
+            }
+            else {
+                // Callers distinguish "item absent" (a documented exit code per tool)
+                // from real failures, so the code rides on the error itself.
+                const err = new Error(`${file} exited with code ${code}: ${stderr}`);
+                err.exitCode = code ?? undefined;
+                reject(err);
+            }
+        });
+        proc.on('error', (err) => {
+            reject(err);
+        });
+        if (input && proc.stdin) {
+            proc.stdin.write(input);
+            proc.stdin.end();
+        }
+    });
+}
+function exitCodeOf(error) {
+    return error?.exitCode;
+}
+async function checkCommandAvailable(cmd) {
+    try {
+        const isWin = process.platform === 'win32';
+        const checkCmd = isWin ? 'where' : 'which';
+        await execCommand(checkCmd, [cmd]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// macOS `security` reports errSecItemNotFound as exit 44; secret-tool exits 1
+// when lookup/clear finds nothing. Both mean ABSENCE, which read()/remove()
+// must report as null/false rather than a thrown failure.
+const MACOS_ITEM_NOT_FOUND = 44;
+const SECRET_TOOL_NOT_FOUND = 1;
+/**
+ * The account name write() filed this key under. mac/linux scope entries by
+ * `<projectId>:<key>`; the Windows blob path below stays keyed by <KEY> alone,
+ * matching what write() has always written there.
+ */
+function accountFor(paths, key) {
+    const projectId = paths.root.split(/[\\/]/).pop() ?? 'unknown';
+    return `${projectId}:${key}`;
+}
+/** The directory holding the DPAPI blobs, exactly where write() puts them. */
+function windowsCredsDir() {
+    return join(homedir(), 'AppData', 'Local', 'envseal', 'creds');
+}
+/**
+ * Windows pipe transports are codepage-bound: node writes UTF-8 into the
+ * child's stdin, but PowerShell 5.1 decodes it with the console's OEM
+ * codepage ([Console]::InputEncoding), and re-encodes stdout the same way.
+ * ASCII survives every codepage; anything else mojibakes — and the mangled
+ * text then gets DPAPI-encrypted, i.e. corrupted at rest.
+ *
+ * Fix: carry the value across BOTH pipes as lowercase hex of its UTF-8
+ * bytes — pure ASCII, immune to codepages — with this marker so read() can
+ * tell the new format from blobs written by the pre-hex code (whose
+ * plaintext is the raw legacy value, ASCII in practice). A legacy blob that
+ * happens to start with the marker AND continues as valid even-length hex
+ * would misdecode; that collision requires a plaintext engineered to look
+ * like our transport and is handled by re-setting the key.
+ */
+const WIN_HEX_PREFIX = 'ENVSEALHEX1:';
+/**
+ * Editors and shells export a PSModulePath that leads with PowerShell 7 module
+ * dirs; those shadow 5.1's Security module (duplicate type data) and
+ * ConvertTo-SecureString silently vanishes. Dropping the variable makes 5.1
+ * rebuild its own defaults.
+ *
+ * Every CASING must go: some launchers (pnpm on Windows among them) rewrite
+ * the name as PSMODULEPATH, and an exact-case destructure then leaves the
+ * uppercased twin behind — the child inherits the poisoned path anyway.
+ */
+function childEnvWithoutPSModulePath() {
+    const childEnv = {};
+    for (const [name, value] of Object.entries(process.env)) {
+        if (/^psmodulepath$/i.test(name))
+            continue;
+        childEnv[name] = value;
+    }
+    return childEnv;
+}
+class KeychainSink {
+    id = 'keychain';
+    async available() {
+        if (process.platform === 'darwin') {
+            return checkCommandAvailable('security');
+        }
+        else if (process.platform === 'win32') {
+            return true;
+        }
+        else {
+            return checkCommandAvailable('secret-tool');
+        }
+    }
+    async read(paths, key) {
+        if (process.platform === 'darwin') {
+            try {
+                const stdout = await execCommand('security', [
+                    'find-generic-password',
+                    '-s',
+                    'envseal',
+                    '-a',
+                    accountFor(paths, key),
+                    '-w',
+                ]);
+                // security prints the password followed by one newline.
+                return asSecret(Buffer.from(stdout.replace(/\n$/, ''), 'utf8'));
+            }
+            catch (error) {
+                if (exitCodeOf(error) === MACOS_ITEM_NOT_FOUND)
+                    return null;
+                throw error;
+            }
+        }
+        if (process.platform === 'win32') {
+            return this.readWindows(key);
+        }
+        try {
+            const stdout = await execCommand('secret-tool', [
+                'lookup',
+                'service',
+                'envseal',
+                'account',
+                accountFor(paths, key),
+            ]);
+            // secret-tool exits 0 with empty output when the lookup misses.
+            if (stdout.length === 0)
+                return null;
+            return asSecret(Buffer.from(stdout.replace(/\n$/, ''), 'utf8'));
+        }
+        catch (error) {
+            if (exitCodeOf(error) === SECRET_TOOL_NOT_FOUND)
+                return null;
+            throw error;
+        }
+    }
+    /**
+     * Decrypt the DPAPI blob write() left at creds\<KEY>. Absent file means the
+     * value is not stored (null); anything present-but-unreadable is a loud
+     * error, never a silent null — a corrupt blob pretending to be "absent"
+     * would send ensure() back to the prompt instead of telling the user their
+     * credential store needs attention.
+     */
+    async readWindows(key) {
+        const dir = windowsCredsDir();
+        const blobPath = join(dir, key);
+        let blob;
+        try {
+            blob = readFileSync(blobPath, 'utf8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return null;
+            throw error;
+        }
+        // A 0-byte file is exactly the silent-write failure the write path guards
+        // against; refuse it before the hex check can pass on empty input.
+        if (blob.trim().length === 0) {
+            throw new Error(`Keychain blob for ${key} is empty (${blobPath})`);
+        }
+        // ConvertFrom-SecureString emits hex digits only; anything else is not a
+        // blob this sink wrote.
+        if (!/^[0-9a-f]+$/i.test(blob.trim())) {
+            throw new Error(`Keychain blob for ${key} is not a hex DPAPI blob (${blobPath})`);
+        }
+        // The decrypt snippet goes through a temp script file, never argv, where it
+        // would be visible to any process listing.
+        const escapedPath = blobPath.replace(/\\/g, '\\\\');
+        const scriptPath = join(dir, `${key}.read.ps1`);
+        const script = [
+            "$ErrorActionPreference = 'Stop'",
+            `$blob = Get-Content -Raw '${escapedPath}'`,
+            '$secure = ConvertTo-SecureString -String $blob',
+            '$ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)',
+            'try {',
+            '  $plain = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr)',
+            '} finally {',
+            '  [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr)',
+            '}',
+            '[Console]::Out.Write($plain)',
+            '',
+        ].join('\n');
+        writeFileSync(scriptPath, script);
+        // Same scrub write() does: a PSModulePath inherited from an editor leads
+        // with PowerShell 7 module dirs and breaks the Security module under 5.1.
+        const childEnv = childEnvWithoutPSModulePath();
+        try {
+            const stdout = await execCommand('powershell', ['-NoProfile', '-File', scriptPath], undefined, childEnv);
+            // The decrypted payload is hex (new format) or the legacy plaintext;
+            // [Console]::Out.Write emits it verbatim, and trimming would corrupt a
+            // legacy value that genuinely ends in whitespace.
+            if (stdout.startsWith(WIN_HEX_PREFIX) &&
+                /^[0-9a-f]*$/.test(stdout.slice(WIN_HEX_PREFIX.length)) &&
+                (stdout.length - WIN_HEX_PREFIX.length) % 2 === 0) {
+                return asSecret(Buffer.from(stdout.slice(WIN_HEX_PREFIX.length), 'hex'));
+            }
+            return asSecret(Buffer.from(stdout, 'utf8'));
+        }
+        finally {
+            try {
+                unlinkSync(scriptPath);
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+    async write(_paths, key, value) {
+        const account = accountFor(_paths, key);
+        const valueStr = unsafeSecretToUtf8(value);
+        if (process.platform === 'darwin') {
+            await execCommand('security', [
+                'add-generic-password',
+                '-U',
+                '-s',
+                'envseal',
+                '-a',
+                account,
+                '-w',
+                valueStr,
+            ]);
+        }
+        else if (process.platform === 'win32') {
+            const dir = windowsCredsDir();
+            mkdirSync(dir, { recursive: true });
+            const escapedPath = join(dir, key).replace(/\\/g, '\\\\');
+            // @($input), not [System.Console]::In: the PowerShell console host reads
+            // an empty string from a spawned pipe's stdin. The empty checks exit 1 so
+            // that can never again become a silent 0-byte blob. The payload is the
+            // hex transport (see WIN_HEX_PREFIX) so the OEM codepage cannot touch it.
+            const script = [
+                "$ErrorActionPreference = 'Stop'",
+                '$value = @($input) -join "`n"',
+                'if (-not $value) { exit 1 }',
+                '$secure = ConvertTo-SecureString -String $value -AsPlainText -Force',
+                '$encrypted = ConvertFrom-SecureString -SecureString $secure',
+                'if (-not $encrypted) { exit 1 }',
+                `[System.IO.File]::WriteAllText('${escapedPath}', $encrypted)`,
+            ].join('\n');
+            const scriptPath = join(dir, `${key}.ps1`);
+            writeFileSync(scriptPath, script);
+            const childEnv = childEnvWithoutPSModulePath();
+            const payload = WIN_HEX_PREFIX + Buffer.from(valueStr, 'utf8').toString('hex');
+            try {
+                await execCommand('powershell', ['-NoProfile', '-File', scriptPath], payload, childEnv);
+            }
+            finally {
+                try {
+                    unlinkSync(scriptPath);
+                }
+                catch {
+                    // ignore
+                }
+            }
+        }
+        else {
+            await execCommand('secret-tool', ['store', '--label=envseal', 'service', 'envseal', 'account', account], valueStr);
+        }
+    }
+    async remove(paths, key) {
+        if (process.platform === 'darwin') {
+            try {
+                await execCommand('security', [
+                    'delete-generic-password',
+                    '-s',
+                    'envseal',
+                    '-a',
+                    accountFor(paths, key),
+                ]);
+                return true;
+            }
+            catch (error) {
+                if (exitCodeOf(error) === MACOS_ITEM_NOT_FOUND)
+                    return false;
+                throw error;
+            }
+        }
+        if (process.platform === 'win32') {
+            try {
+                unlinkSync(join(windowsCredsDir(), key));
+                return true;
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    return false;
+                throw error;
+            }
+        }
+        try {
+            await execCommand('secret-tool', ['clear', 'service', 'envseal', 'account', accountFor(paths, key)]);
+            return true;
+        }
+        catch (error) {
+            if (exitCodeOf(error) === SECRET_TOOL_NOT_FOUND)
+                return false;
+            throw error;
+        }
+    }
+}
+export const keychainSink = new KeychainSink();
+//# sourceMappingURL=keychain.js.map

package/dist/sinks/onepassword.d.ts

@@ -0,0 +1,58 @@
+import type { SecretValue } from '@envseal/protocol';
+import type { ProjectPaths } from '../paths.js';
+import { CliSinkBase } from './cli-sink-base.js';
+/**
+ * The 1Password CLI adapter. Talks to `op` under whatever non-interactive
+ * credential the environment carries — a service account token or Connect
+ * host/token pair, which `op whoami` validates without ever triggering the
+ * interactive unlock a signed-in desktop account would need.
+ *
+ * One item per credential in the dedicated vault: title `<projectId>:<KEY>`,
+ * field `credential` carrying the value (CONCEALED, so 1Password treats it
+ * as a secret), field `envseal-key` recording the raw key so items remain
+ * attributable even after a project directory is renamed. The value reaches
+ * `op item create` inside the item template on stdin (the positional `-`
+ * form): op has no --fields-file, and field=value argv pairs land in process
+ * listings, while stdin also beats a temp template file by keeping secret
+ * bytes off disk entirely.
+ */
+export declare class OnePasswordSink extends CliSinkBase {
+    readonly id = "onepassword";
+    protected readonly requiredCommands: string[];
+    /**
+     * Result of this instance's first `op whoami`, remembered for the
+     * instance's lifetime: a credential validated at first use is trusted for
+     * the session, and every operation skips the extra probe from then on. An
+     * auth failure after that point surfaces through the operation's own error
+     * mapping instead.
+     */
+    private whoamiOk;
+    protected unavailableReason(): string;
+    /**
+     * Binary presence is not enough: op with no usable credential answers every
+     * real command with an auth error. `op whoami` is the cheapest command that
+     * tells the two states apart, and it only reports — it never prompts.
+     */
+    available(_paths: ProjectPaths): Promise<boolean>;
+    /**
+     * The same probe at operation time: a session that expired (or a binary
+     * that vanished) between available() and now must surface as
+     * SEP_SINK_UNAVAILABLE — which names the fix — rather than as a cryptic
+     * auth failure from deep inside `op item get`.
+     */
+    protected requirePrerequisites(): Promise<void>;
+    private whoamiSucceeds;
+    read(paths: ProjectPaths, key: string): Promise<SecretValue | null>;
+    write(paths: ProjectPaths, key: string, value: SecretValue): Promise<void>;
+    /**
+     * A first write on a fresh deployment has no vault yet. Restricted
+     * credentials cannot help here — service accounts and Connect tokens may
+     * only touch vaults granted to them, not mint new ones — so a failed
+     * creation stays loud with the provider's stderr in the details: the fix
+     * (pre-provision the vault and grant the credential) belongs to a human.
+     */
+    private ensureVault;
+    remove(paths: ProjectPaths, key: string): Promise<boolean>;
+}
+export declare const onepasswordSink: OnePasswordSink;
+//# sourceMappingURL=onepassword.d.ts.map

package/dist/sinks/onepassword.js

@@ -0,0 +1,183 @@
+import { asSecret, SepError } from '@envseal/protocol';
+import { CliCommandFailure, CliSinkBase, commandExists, execCli } from './cli-sink-base.js';
+import { unsafeSecretToUtf8 } from './dotenv.js';
+// One dedicated vault holds every envseal item, so the project-scoped titles
+// below never collide with anything a user keeps in their personal vaults,
+// and a cleanup sweep has an exact boundary.
+const VAULT = 'envseal';
+// Login is the one category every account and Connect deployment accepts;
+// the field labels do the real naming work.
+const CATEGORY = 'login';
+const CREDENTIAL_FIELD = 'credential';
+const KEY_FIELD = 'envseal-key';
+/**
+ * op ships no documented exit code for "absent" (unlike security's err 44),
+ * so absence rides the provider's own error strings — the same route every
+ * serious op wrapper takes. Every fragment stays anchored to an item/vault
+ * noun so network noise like "host not found" can never pass for a missing
+ * item:
+ *
+ *   `"t" isn't an item in the envseal vault.` / `"v" isn't a vault in this account.`
+ */
+const OP_ABSENCE_RE = /\bisn't an item\b|\bisn't a vault\b|\bno item found\b|\bno vault found\b|\b(?:item|vault)\b[^\n]{0,80}\bnot found\b/i;
+function readsAsAbsent(error) {
+    return error instanceof CliCommandFailure && OP_ABSENCE_RE.test(error.stderr);
+}
+/** The title write() files this key under — per-project, like the keychain sink's account name. */
+function itemTitleFor(paths, key) {
+    const projectId = paths.root.split(/[\\/]/).pop() ?? 'unknown';
+    return `${projectId}:${key}`;
+}
+/**
+ * The 1Password CLI adapter. Talks to `op` under whatever non-interactive
+ * credential the environment carries — a service account token or Connect
+ * host/token pair, which `op whoami` validates without ever triggering the
+ * interactive unlock a signed-in desktop account would need.
+ *
+ * One item per credential in the dedicated vault: title `<projectId>:<KEY>`,
+ * field `credential` carrying the value (CONCEALED, so 1Password treats it
+ * as a secret), field `envseal-key` recording the raw key so items remain
+ * attributable even after a project directory is renamed. The value reaches
+ * `op item create` inside the item template on stdin (the positional `-`
+ * form): op has no --fields-file, and field=value argv pairs land in process
+ * listings, while stdin also beats a temp template file by keeping secret
+ * bytes off disk entirely.
+ */
+export class OnePasswordSink extends CliSinkBase {
+    id = 'onepassword';
+    requiredCommands = ['op'];
+    /**
+     * Result of this instance's first `op whoami`, remembered for the
+     * instance's lifetime: a credential validated at first use is trusted for
+     * the session, and every operation skips the extra probe from then on. An
+     * auth failure after that point surfaces through the operation's own error
+     * mapping instead.
+     */
+    whoamiOk = null;
+    unavailableReason() {
+        return 'the op CLI is not installed or no non-interactive 1Password credential is configured (OP_SERVICE_ACCOUNT_TOKEN or OP_CONNECT_HOST/OP_CONNECT_TOKEN)';
+    }
+    /**
+     * Binary presence is not enough: op with no usable credential answers every
+     * real command with an auth error. `op whoami` is the cheapest command that
+     * tells the two states apart, and it only reports — it never prompts.
+     */
+    async available(_paths) {
+        if (!(await commandExists('op')))
+            return false;
+        return this.whoamiSucceeds();
+    }
+    /**
+     * The same probe at operation time: a session that expired (or a binary
+     * that vanished) between available() and now must surface as
+     * SEP_SINK_UNAVAILABLE — which names the fix — rather than as a cryptic
+     * auth failure from deep inside `op item get`.
+     */
+    async requirePrerequisites() {
+        await super.requirePrerequisites();
+        if (!(await this.whoamiSucceeds())) {
+            // The base keeps its unavailableError() private; restate its shape.
+            throw new SepError({
+                code: 'SEP_SINK_UNAVAILABLE',
+                userMessage: `The ${this.id} sink is not available — ${this.unavailableReason()}.`,
+            });
+        }
+    }
+    whoamiSucceeds() {
+        if (this.whoamiOk !== null)
+            return Promise.resolve(this.whoamiOk);
+        return execCli('op', ['whoami']).then(() => (this.whoamiOk = true), () => (this.whoamiOk = false));
+    }
+    async read(paths, key) {
+        await this.requirePrerequisites();
+        try {
+            const { stdout } = await execCli('op', [
+                'item',
+                'get',
+                itemTitleFor(paths, key),
+                '--vault',
+                VAULT,
+                '--fields',
+                CREDENTIAL_FIELD,
+            ]);
+            // A single --fields selector prints the bare value plus exactly one
+            // trailing newline; trimming more would corrupt a value that genuinely
+            // ends in whitespace.
+            return asSecret(Buffer.from(stdout.replace(/\r?\n$/, ''), 'utf8'));
+        }
+        catch (error) {
+            if (readsAsAbsent(error))
+                return null;
+            throw this.sinkFailure('read', error, key);
+        }
+    }
+    async write(paths, key, value) {
+        await this.requirePrerequisites();
+        await this.ensureVault(key);
+        const title = itemTitleFor(paths, key);
+        // Replace = delete-then-create inside one logical write. A missing item
+        // is the ordinary first-write case, not an error; anything else (an
+        // ambiguous title, an unreachable server) stays loud, because stacking a
+        // second item onto a store we do not understand only compounds the damage.
+        try {
+            await execCli('op', ['item', 'delete', title, '--vault', VAULT]);
+        }
+        catch (error) {
+            if (!readsAsAbsent(error))
+                throw this.sinkFailure('write', error, key);
+        }
+        // Template on stdin (positional `-`) — template and stdin are mutually
+        // exclusive, so no --template flag rides along.
+        const template = JSON.stringify({
+            title,
+            category: CATEGORY,
+            fields: [
+                { label: CREDENTIAL_FIELD, type: 'CONCEALED', value: unsafeSecretToUtf8(value) },
+                { label: KEY_FIELD, type: 'STRING', value: key },
+            ],
+        });
+        try {
+            await execCli('op', ['item', 'create', '--vault', VAULT, '-'], { input: template });
+        }
+        catch (error) {
+            throw this.sinkFailure('write', error, key);
+        }
+    }
+    /**
+     * A first write on a fresh deployment has no vault yet. Restricted
+     * credentials cannot help here — service accounts and Connect tokens may
+     * only touch vaults granted to them, not mint new ones — so a failed
+     * creation stays loud with the provider's stderr in the details: the fix
+     * (pre-provision the vault and grant the credential) belongs to a human.
+     */
+    async ensureVault(key) {
+        try {
+            await execCli('op', ['vault', 'get', VAULT]);
+            return;
+        }
+        catch (error) {
+            if (!readsAsAbsent(error))
+                throw this.sinkFailure('write', error, key);
+        }
+        try {
+            await execCli('op', ['vault', 'create', VAULT]);
+        }
+        catch (error) {
+            throw this.sinkFailure('write', error, key);
+        }
+    }
+    async remove(paths, key) {
+        await this.requirePrerequisites();
+        try {
+            await execCli('op', ['item', 'delete', itemTitleFor(paths, key), '--vault', VAULT]);
+            return true;
+        }
+        catch (error) {
+            if (readsAsAbsent(error))
+                return false;
+            throw this.sinkFailure('remove', error, key);
+        }
+    }
+}
+export const onepasswordSink = new OnePasswordSink();
+//# sourceMappingURL=onepassword.js.map

package/dist/sinks/registry.d.ts

@@ -0,0 +1,4 @@
+import type { Sink } from './types.js';
+export declare function getSink(id: string): Sink;
+export declare function allSinks(): Sink[];
+//# sourceMappingURL=registry.d.ts.map

package/dist/sinks/registry.js

@@ -0,0 +1,63 @@
+import { SepError } from '@envseal/protocol';
+import { DotenvSink } from './dotenv.js';
+import { keychainSink } from './keychain.js';
+import { vaultSink } from './vault.js';
+import { onepasswordSink } from './onepassword.js';
+import { dopplerSink } from './doppler.js';
+import { sopsSink } from './sops.js';
+/**
+ * Placeholder for sinks with no adapter module at all. The CLI-backed stubs
+ * (vault, onepassword, doppler, sops) refuse because their provider
+ * prerequisite is missing; this one refuses because nobody has written the
+ * sink yet.
+ */
+class UnimplementedSink {
+    id;
+    constructor(id) {
+        this.id = id;
+    }
+    async available() {
+        return false;
+    }
+    async read() {
+        throw new SepError({
+            code: 'SEP_SINK_UNAVAILABLE',
+            userMessage: `The ${this.id} sink adapter is not implemented yet.`,
+        });
+    }
+    async write() {
+        throw new SepError({
+            code: 'SEP_SINK_UNAVAILABLE',
+            userMessage: `The ${this.id} sink adapter is not implemented yet.`,
+        });
+    }
+    async remove() {
+        throw new SepError({
+            code: 'SEP_SINK_UNAVAILABLE',
+            userMessage: `The ${this.id} sink adapter is not implemented yet.`,
+        });
+    }
+}
+const sinks = new Map([
+    ['dotenv', new DotenvSink()],
+    ['keychain', keychainSink],
+    ['sops', sopsSink],
+    ['onepassword', onepasswordSink],
+    ['doppler', dopplerSink],
+    ['vault', vaultSink],
+    ['external', new UnimplementedSink('external')],
+]);
+export function getSink(id) {
+    const sink = sinks.get(id);
+    if (!sink) {
+        throw new SepError({
+            code: 'SEP_SINK_UNAVAILABLE',
+            userMessage: `Unknown sink: ${id}`,
+        });
+    }
+    return sink;
+}
+export function allSinks() {
+    return Array.from(sinks.values());
+}
+//# sourceMappingURL=registry.js.map