{"version":3,"sources":["../src/secret-compare.ts"],"sourcesContent":["/**\n * Compare a caller-supplied secret against the configured one without leaking\n * how much of it matched.\n *\n * `===` on strings stops at the first differing character, so the time it takes\n * to reject a guess grows with the length of the correct prefix. Over enough\n * requests that recovers a cron or workflow secret one character at a time. This\n * always inspects every position instead.\n *\n * Deliberately not node:crypto's `timingSafeEqual`: these callers are bundled\n * into the generated Nitro runtime, which also targets edge and browser-like\n * environments where importing node:crypto breaks the build.\n */\nexport function farmSecretsMatch(provided: string, expected: string): boolean {\n  if (typeof provided !== \"string\" || typeof expected !== \"string\") return false;\n  // An unset secret must never authorize a request, including an empty guess.\n  if (expected.length === 0) return false;\n\n  // Folding the lengths in rejects a wrong-length guess without an early return.\n  let mismatch = provided.length ^ expected.length;\n  const length = Math.max(provided.length, expected.length);\n  for (let index = 0; index < length; index += 1) {\n    const providedCode = index < provided.length ? provided.charCodeAt(index) : 0;\n    const expectedCode = index < expected.length ? expected.charCodeAt(index) : 0;\n    mismatch |= providedCode ^ expectedCode;\n  }\n\n  return mismatch === 0;\n}\n"],"mappings":";;;;;AAaO,SAAS,iBAAiB,UAAkB,UAA2B;AAC5E,MAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SAAU,QAAO;AAEzE,MAAI,SAAS,WAAW,EAAG,QAAO;AAGlC,MAAI,WAAW,SAAS,SAAS,SAAS;AAC1C,QAAM,SAAS,KAAK,IAAI,SAAS,QAAQ,SAAS,MAAM;AACxD,WAAS,QAAQ,GAAG,QAAQ,QAAQ,SAAS,GAAG;AAC9C,UAAM,eAAe,QAAQ,SAAS,SAAS,SAAS,WAAW,KAAK,IAAI;AAC5E,UAAM,eAAe,QAAQ,SAAS,SAAS,SAAS,WAAW,KAAK,IAAI;AAC5E,gBAAY,eAAe;AAAA,EAC7B;AAEA,SAAO,aAAa;AACtB;AAfgB;","names":[]}