[jerimin]

Problem

npm run build fails on a clean install with any TypeScript >= 5.7:

src/data/webAuthnRegister.ts(124,11): error TS2322: Type 'Uint8Array<ArrayBufferLike>' is not assignable to type 'BufferSource'.
  Type 'Uint8Array<ArrayBufferLike>' is not assignable to type 'ArrayBufferView<ArrayBuffer>'.
    Types of property 'buffer' are incompatible.
      Type 'ArrayBufferLike' is not assignable to type 'ArrayBuffer'.
        Type 'SharedArrayBuffer' is missing the following properties from type 'ArrayBuffer': resizable, resize, detached, transfer, transferToFixedLength

TypeScript 5.7 made Uint8Array generic over its backing buffer (Uint8Array<TArrayBuffer>).
base64url.parse() from rfc4648 is typed as Uint8Array<ArrayBufferLike>, and
ArrayBufferLike includes SharedArrayBuffer, so it no longer satisfies BufferSource
in the WebAuthn option types.

Because package.json declares "typescript": "^5.2.2", a fresh npm install resolves to
the latest 5.x and the build breaks. This affects anyone building the theme today, not just
those who deliberately upgraded.

Fix

Wrap each base64url.parse(...) result in new Uint8Array(...), which produces an array
backed by a plain ArrayBuffer.

Chosen over the alternatives deliberately:

• not as Uint8Array<ArrayBuffer> — the generic parameter doesn't exist before TS 5.7,
  so a cast would break older toolchains
• not pinning TypeScript in devDependencies — that just defers the problem and blocks
  consumers from upgrading

new Uint8Array(x) type-checks on both old and new TypeScript, needs no any, and the
runtime cost is a copy of a challenge/credential-id (tens of bytes, once per ceremony).

5 call sites across the two WebAuthn modules:

• webAuthnRegister.ts — challenge, user.id, and the excludeCredentials id
• webAuthnAuthenticate.ts — challenge and the allowCredentials id

Verification

Built from a clean checkout of this branch in CI with TypeScript 5.9.3 resolved by
npm install (no pin):

> tsc && vite build
vite v4.5.14 building for production...
7 modules transformed.
theme/keywind/login/resources/dist/index.css   17.33 kB
built in 1.07s

master fails the same job; this branch passes. No behavioural change to the WebAuthn flows
themselves — the values passed to navigator.credentials are byte-identical.