/** Generate a CSRF token using Web Crypto. */
export async function generateToken() {
    const bytes = crypto.getRandomValues(new Uint8Array(32));
    return Array.from(bytes)
        .map((b) => b.toString(16).padStart(2, '0'))
        .join('');
}
/** Validate a submitted CSRF token against the stored value using constant-time comparison. */
export function validateToken(token, storedToken) {
    if (token.length !== storedToken.length)
        return false;
    const a = new TextEncoder().encode(token);
    const b = new TextEncoder().encode(storedToken);
    let diff = 0;
    for (let i = 0; i < a.length; i++) {
        diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
    }
    return diff === 0;
}
//# sourceMappingURL=csrf.js.map