[plus] discord role verifier to grant RR plus

packages/domain/src/password.ts

@@ -12,9 +12,21 @@
 const ITERATIONS = 100_000
 
 const b64 = (bytes: Uint8Array): string => btoa(String.fromCharCode(...bytes))
-const fromB64 = (s: string): Uint8Array => Uint8Array.from(atob(s), (ch) => ch.charCodeAt(0))
+const fromB64 = (s: string): Uint8Array<ArrayBuffer> =>
+	Uint8Array.from(atob(s), (ch) => ch.charCodeAt(0))
 
-async function deriveBits(password: string, salt: Uint8Array): Promise<Uint8Array> {
+/**
+ * The salt is `Uint8Array<ArrayBuffer>` rather than a bare `Uint8Array` because the latter
+ * is `Uint8Array<ArrayBufferLike>`, which admits a `SharedArrayBuffer` — and the DOM lib's
+ * `BufferSource` does not. Both callers already produce a plain-ArrayBuffer view
+ * (`getRandomValues` and `fromB64`), so this only writes down what was always true; without
+ * it, any worker whose tsconfig includes the DOM lib (`www`, for its React client) fails to
+ * compile on the `deriveBits` call below.
+ */
+async function deriveBits(
+	password: string,
+	salt: Uint8Array<ArrayBuffer>
+): Promise<Uint8Array<ArrayBuffer>> {
 	const keyMaterial = await crypto.subtle.importKey(
 		'raw',
 		new TextEncoder().encode(password),