should we also change the key property on CipherParams to the same union type?

No, in an actual CipherParams instance (as you get by calling getDefaultParams) the key type is fixed, either a Buffer on node or a Wordarray in browsers. When creating a CipherParams (either using getDefaultParams or the short form cipher options) you can supply it as an arraybuffer, base64-encoded string etc. and it'll convert it as appropriate.

...Now I come to look for it, the typings are also missing Crypto.getDefaultParams. So that should probably be added too. And the typings for Crypto.generateRandomKey are wrong, it claims it'll return a string. Aaargh, I'll fix some of these. I should read through them start to finish at some point and see what other errors are in there..

@owenpearson I went ahead and fixed a whole bunch of type issues I spotted while doing the initial change, so this is now a somewhat bigger pr, so new deeper review needed - thanks