Make Baseline Widely available the browser support policy (fix #502)

AGENTS.md

@@ -62,6 +62,7 @@ MozMEAO is taking this repo over. Before that work started there were 810 commit
 - **CI and CD both run on GitHub Actions.** `.github/workflows/ci.yml` runs lint, a production build (`npm run build`, not browser-tested; it also compiles the Stylus the unit tests import), the Vitest unit tests, and the Playwright end-to-end tests on every push to `main` and every pull request. The Playwright specs run twice: on recorded data in "End-to-end tests", which the `main` ruleset requires along with "Lint and test", and on live data in "Live data tests", which it doesn't. `ssdlc-actions.yml` (zizmor and Semgrep into code scanning) and `sbom.yml` (a CycloneDX SBOM per commit on `main` and per release) call Mozilla's shared reusable workflows in `mozilla/ssdlc-actions`, pinned by SHA; keep the pin in step with bedrock's. There is no `.circleci/`, `Dockerfile`, `docker-compose`, or `Jenkinsfile` — earlier automation was deliberately removed: CircleCI disabled 2018-02-22 (`433a465`), Docker/Dockerflow removed 2018-08-23 (`d3bb561`), `.github/dependabot.yml` deleted 2020-07-29 (`7c7006f`, "Disable non-security updates from Dependabot"). Dependabot came back in #453: `.github/dependabot.yml` groups updates, waits out a 7-day cooldown, and holds back the majors it lists, with reasons.
 - **The deploy is a static build on Google Cloud Storage** (confirmed by `x-goog-*` headers on the live site). `https://data.firefox.com/version.json` reports `1.2.1` / commit `f655559`, so **prod predates the Vite toolchain on `main`**; no Vite build has reached prod yet, though stage serves one from every push to `main`. `.github/workflows/deploy.yml` deploys `main` to stage and GitHub releases to prod, via Workload Identity (no secrets). The bucket is shared with the transposer's `datasets/`, nothing in the deploy deletes, and deep links only work because `index.html` is copied to each route path. `docs/architecture/deploy.md` records the buckets, CDN, access, and open questions — read it before changing anything about hosting or the workflow.
 - **Node 24.** `.nvmrc` holds `24` and `engines` requires `^24.15.0`. A plain `npm install` works with no flags.
+- **Supported browsers: Baseline Widely available.** Use a web platform feature in `src/` only if MDN or webstatus.dev marks it Baseline Widely available. `build.target` in `vite.config.mjs` is Vite's `'baseline-widely-available'`, which rewrites syntax but adds no polyfills. See "Supported browsers" in CONTRIBUTING.md.
 - **A fresh clone will not render styles until you compile Stylus.** `src/components/views/css/*` is gitignored and most views do a side-effect `import './css/Foo.css';` — run `npm run build:css` or the app, and Vitest, fail to resolve those imports. `npm start` compiles it for you.
 - Open issues date back to 2018, and many predate the toolchain replacement. Check an old issue against the current code before working on it.
 - Upstream data is **live and current** — transposer `dates` arrays are sorted newest-first and are updated weekly. The app is unmaintained; the data is not.

CONTRIBUTING.md

@@ -94,6 +94,23 @@ style is not enforced (there is no `quotes` rule) — single quotes by conventio
 directory is excluded via the config's own `ignores` array (flat config's replacement for
 `.eslintignore`, which no longer exists).
 
+## Supported browsers
+
+We support browsers that are [Baseline Widely available](https://web.dev/baseline): the versions
+of Chrome, Edge, Firefox, and Safari, on desktop and mobile, that support every feature that has
+worked in all of them for at least 30 months. The floor moves forward on its own. To see today's
+versions, run `npx browserslist "baseline widely available"`.
+
+Use a web platform feature only if MDN or [webstatus.dev](https://webstatus.dev) marks it Baseline
+Widely available. A feature marked Newly available works in the latest browsers but not yet in all
+the supported ones.
+
+`build.target` in `vite.config.mjs` is Vite's `'baseline-widely-available'`. Vite fixes the
+versions that means at each major release, so they lag behind the policy. That is the safe
+direction: Vite rewrites a little more syntax than it needs to. Vite adds no polyfills, so a
+built-in method outside the policy ships as-is and throws in older browsers. Test code under
+`tests/` runs in Node and Playwright's browsers, so the policy doesn't apply there.
+
 ## Styling: Stylus, outside webpack
 
 `src/components/views/styl/*.styl` compiles to `src/components/views/css/*.css` via the `stylus`

vite.config.mjs

@@ -9,6 +9,11 @@ export default defineConfig({
     },
     build: {
         outDir: 'build',
+        // Our browser support policy is Baseline Widely available. Vite fixes
+        // the versions this means at each major release, so they lag behind
+        // the policy, which is the safe direction. Vite only rewrites syntax
+        // and adds no polyfills. See "Supported browsers" in CONTRIBUTING.md.
+        target: 'baseline-widely-available',
     },
     test: {
         // Scope to the unit tests only - Vitest's default glob also matches