docs: add cross-browser WebCrypto compatibility audit (closes #12)

[JohnOluB]

Closes #12.

Adds docs/COMPAT.md — the full cross-browser compatibility audit for all Stellar flows in the Wraith Protocol demo.

What's in the report

• Full test matrix — all 6 Stellar flows × 7 browser targets (Chrome, Edge, Firefox, macOS Safari 17/18, iOS Safari 17/18)
• Support tier recommendation — Tier 1: Chrome/Edge/Firefox | Tier 2: macOS Safari | Tier 3 (best-effort): iOS Safari
• 6 specific compatibility checks with per-browser tables:
  • crypto.subtle availability & secure context requirement
  • deriveBits HKDF length bug (iOS Safari 17)
  • BigInt safety (✅ all targets safe)
  • structuredClone / COOP+COEP for Worker transfers
  • Uint8Array.prototype.toBase64 — missing in all Safari & Firefox < 128 (critical, polyfill included)
  • Freighter extension availability

Critical finding

Uint8Array.prototype.toBase64 is not implemented in any Safari version and was only added in Firefox 128. The report includes a ready-to-use polyfill for src/polyfills.ts.

Follow-up issues to file

ID	Issue	Priority
FUI-1	HTTPS for local dev (Safari crypto.subtle)	Medium
FUI-2	COOP/COEP headers for SharedArrayBuffer	Medium
FUI-3	"Use Chrome/Firefox" banner for missing Freighter	High
FUI-4	Graceful read-only mode on iOS	High
FUI-5	Audit SDK deriveBits length alignment	High
FUI-6	Add Uint8Array.toBase64 polyfill to entry point	Critical

Testing

This is a docs/audit PR — no code changes. Once FUI-1 (HTTPS dev server) and FUI-6 (polyfill) are implemented, a live retest on BrowserStack or iOS Simulator should be run to validate.

[vercel]

@OLUWAJONJAY is attempting to deploy a commit to the truthixify's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@JohnOluB Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[truthixify]

The docs/COMPAT.md audit is exactly what #12 asked for: full test matrix across 7 browser targets, tier recommendation (Tier 1 / 2 / 3), and follow-up issue suggestions. Strong piece of work.

One blocker: the PR also adds a 23,954-line package-lock.json. This repo uses pnpm with pnpm-lock.yaml, so the npm lockfile shouldn't be committed. Could you remove it?

rm package-lock.json
echo "package-lock.json" >> .gitignore  # if not already
git add -u .gitignore
git commit --amend  # or new commit
git push --force-with-lease

Once the lockfile is gone I will merge. Thanks @JohnOluB.

[JohnOluB]

So sorry about that
I'm gonna remove it

[JohnOluB]

The docs/COMPAT.md audit is exactly what #12 asked for: full test matrix across 7 browser targets, tier recommendation (Tier 1 / 2 / 3), and follow-up issue suggestions. Strong piece of work.

One blocker: the PR also adds a 23,954-line package-lock.json. This repo uses pnpm with pnpm-lock.yaml, so the npm lockfile shouldn't be committed. Could you remove it?

rm package-lock.json
echo "package-lock.json" >> .gitignore  # if not already
git add -u .gitignore
git commit --amend  # or new commit
git push --force-with-lease

Once the lockfile is gone I will merge. Thanks @JohnOluB.

The lockfile is gone @truthixify

[truthixify]

Lockfile dropped and .gitignore patched. Diff is just docs/COMPAT.md now. Merging. Thanks @JohnOluB.