/**
 * Opaque sync HMAC secret value.
 *
 * Callers construct this at the API boundary. Domain sync code carries
 * the opaque object instead of a plain string, and accidental rendering
 * paths redact the value.
 */
import SyncError from "../../errors/SyncError.js";
const REDACTED_SECRET = '[REDACTED]';
const NODE_INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom');
export default class SyncSecret {
    #value;
    constructor(value) {
        if (typeof value !== 'string' || value.length === 0) {
            throw new SyncError('SyncSecret requires a non-empty string', {
                code: 'E_SYNC_SECRET_INVALID',
            });
        }
        this.#value = value;
        Object.freeze(this);
    }
    static fromString(value) {
        return new SyncSecret(value);
    }
    async hmac(crypto, algorithm, data) {
        return await crypto.hmac(algorithm, this.#value, data);
    }
    toString() {
        return REDACTED_SECRET;
    }
    toJSON() {
        return REDACTED_SECRET;
    }
    [NODE_INSPECT_CUSTOM]() {
        return REDACTED_SECRET;
    }
}
