/** Check a password against the HaveIBeenPwned Passwords API using k-anonymity. */
export async function checkBreached(password) {
    const encoder = new TextEncoder();
    const data = encoder.encode(password);
    const hashBuffer = await crypto.subtle.digest('SHA-1', data);
    const hashArray = Array.from(new Uint8Array(hashBuffer));
    const hashHex = hashArray
        .map((b) => b.toString(16).padStart(2, '0'))
        .join('')
        .toUpperCase();
    const prefix = hashHex.substring(0, 5);
    const suffix = hashHex.substring(5);
    try {
        const response = await fetch(`https://api.pwnedpasswords.com/range/${prefix}`, {
            headers: { 'User-Agent': 'ActuateCMS-PasswordCheck' },
            signal: AbortSignal.timeout(5000),
        });
        if (!response.ok)
            return false;
        const text = await response.text();
        return text.split('\n').some((line) => line.startsWith(suffix));
    }
    catch {
        return false;
    }
}
//# sourceMappingURL=breach-check.js.map