Fix TypeScript errors after Deno upgrade to 2.5.2 (#1856)

* Fix TypeScript errors after Deno upgrade to 2.5.2

Deno 2.5.2 has stricter type checking for WebCrypto and Web APIs.
Uint8Array now has a buffer property typed as ArrayBufferLike
(ArrayBuffer | SharedArrayBuffer), but WebCrypto APIs require the
stricter BufferSource type with ArrayBuffer specifically.

Added explicit type casts to satisfy the stricter type requirements:
- crypto.subtle.sign/verify/digest/importKey now require BufferSource casts
- WebAuthn credential creation requires BufferSource casts for challenge and user.id
- Response constructor requires BodyInit cast for Uint8Array bodies

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* support multiple deno versions during transition

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: seefeldb

packages/charm/deno.json

@@ -1,7 +1,7 @@
 {
   "name": "@commontools/charm",
   "tasks": {
-    "test": "deno test --allow-env --allow-ffi --allow-read"
+    "test": "deno test --allow-env --allow-ffi --allow-read --allow-write"
   },
   "exports": {
     ".": "./src/index.ts",

packages/identity/src/ed25519/native.ts

@@ -59,7 +59,7 @@ export class NativeEd25519Signer<ID extends DIDKey> implements Signer<ID> {
         await globalThis.crypto.subtle.sign(
           ED25519_ALG,
           this.#keypair.privateKey,
-          payload,
+          payload as BufferSource,
         ),
       );
 
@@ -76,15 +76,15 @@ export class NativeEd25519Signer<ID extends DIDKey> implements Signer<ID> {
     const rawPublic = await ed25519.getPublicKeyAsync(rawPrivateKey);
     const privateKey = await globalThis.crypto.subtle.importKey(
       "pkcs8",
-      pkcs8Private,
+      pkcs8Private as BufferSource,
       ED25519_ALG,
       false,
       ["sign"],
     );
     // Set the public key to be extractable for DID generation.
     const publicKey = await globalThis.crypto.subtle.importKey(
       "raw",
-      rawPublic,
+      rawPublic as BufferSource,
       ED25519_ALG,
       true,
       [
@@ -135,8 +135,8 @@ export class NativeEd25519Verifier<ID extends DIDKey> implements Verifier<ID> {
       await globalThis.crypto.subtle.verify(
         ED25519_ALG,
         this.#publicKey,
-        signature,
-        payload,
+        signature as BufferSource,
+        payload as BufferSource,
       )
     ) {
       return { ok: {} };
@@ -159,7 +159,7 @@ export class NativeEd25519Verifier<ID extends DIDKey> implements Verifier<ID> {
     // Set the public key to be extractable for DID generation.
     const publicKey = await globalThis.crypto.subtle.importKey(
       "raw",
-      rawPublicKey,
+      rawPublicKey as BufferSource,
       ED25519_ALG,
       true,
       [

packages/identity/src/pass-key.ts

@@ -84,9 +84,13 @@ export class PassKey {
     };
 
     const publicKey: PublicKeyCredentialCreationOptions = {
-      challenge,
+      challenge: challenge as BufferSource,
       rp: { id: RP_ID(), name: RP },
-      user,
+      user: {
+        id: userId as BufferSource,
+        name,
+        displayName,
+      },
       attestation: "none", // default
       authenticatorSelection: {
         // "Resident Keys" have been renamed to "Discoverable Keys",
@@ -130,7 +134,7 @@ export class PassKey {
     const credential = (await navigator.credentials.get({
       publicKey: {
         allowCredentials,
-        challenge: random(32),
+        challenge: random(32) as BufferSource,
         rpId: RP_ID(),
         userVerification: userVerification ?? "preferred",
         extensions: { prf: { eval: { first: PRF_SALT } } },

packages/identity/src/utils.ts

@@ -26,5 +26,7 @@ export function once(
 const HASH_ALG = "SHA-256";
 // Hash input via SHA-256.
 export async function hash(input: Uint8Array): Promise<Uint8Array> {
-  return new Uint8Array(await globalThis.crypto.subtle.digest(HASH_ALG, input));
+  return new Uint8Array(
+    await globalThis.crypto.subtle.digest(HASH_ALG, input as BufferSource),
+  );
 }

packages/static/etag.ts

@@ -8,7 +8,7 @@
  * Returns a base64-encoded hash in quotes.
  */
 export async function generateETag(content: Uint8Array): Promise<string> {
-  const hash = await crypto.subtle.digest("SHA-256", content);
+  const hash = await crypto.subtle.digest("SHA-256", content as BufferSource);
   const base64 = btoa(String.fromCharCode(...new Uint8Array(hash)))
     .replace(/\+/g, "-")
     .replace(/\//g, "_")

packages/toolshed/routes/static/static.index.ts

@@ -43,7 +43,7 @@ router.get("/static/*", async (c) => {
   // Simple caching: always validate with ETag
   const cacheHeaders = createCacheHeaders(etag);
 
-  return new Response(buffer, {
+  return new Response(buffer as BodyInit, {
     status: 200,
     headers: {
       "Content-Type": mimeType,

tasks/check.sh

@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
 set -e
 
-DENO_VERSION_REQUIRED="2.4.5"
+DENO_VERSIONS_ALLOWED=("2.5.2" "2.4.5")
 # This is more portable than parsing `deno --version`
 DENO_VERSION=$(echo "console.log(Deno.version.deno)" | deno run -)
-if [ "$DENO_VERSION" != "$DENO_VERSION_REQUIRED" ]; then
-  echo "ERROR: Deno version is $DENO_VERSION, expected $DENO_VERSION_REQUIRED."
+if [[ ! " ${DENO_VERSIONS_ALLOWED[@]} " =~ " ${DENO_VERSION} " ]]; then
+  echo "ERROR: Deno version is $DENO_VERSION, expected one of: ${DENO_VERSIONS_ALLOWED[*]}."
   exit 1
 fi