/**
 * Constant-time string comparison via byte equality.
 *
 * Avoids `crypto.timingSafeEqual` (Node-only) — Workers runtime has no such
 * symbol exposed reliably. Hand-rolled XOR-OR loop is constant-time for equal-
 * length strings; short-circuits only on length mismatch (length is not secret).
 */
export function constantTimeEqual(a: string, b: string): boolean {
  if (a.length !== b.length) return false;
  let mismatch = 0;
  for (let i = 0; i < a.length; i++) {
    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
  }
  return mismatch === 0;
}