chore: bring the token-list enrichment tooling into script/lib (closes #495)

The two node programs and the data file from f7a2437 regenerate the name and
url of each token in src/shared/tokenList.js. They are now CommonJS under
script/lib/, find their files from their own location, and read
ethereum-lists at a pinned commit. The apply step also rewrites an entry that
already has a name and url, so it runs on the current list; on the committed
data it leaves the list unchanged. The data file carries the MUSD token's
on-chain name, so script/check-censored allows that one literal there too.
README.md names both programs in its Entrypoints section.

Model: opus-5-5

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist icons enrich-tokens apply-enrichment clean dev
+.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist icons clean dev
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -111,17 +111,6 @@ vendor-blocklist:
 icons:
 	@node script/lib/icons.js
 
-# Fetch a name and a website for every token in src/shared/tokenList.js into
-# script/lib/token-enrichment.json. Run deliberately, land the diff: the names
-# come from live data, so a later run can return different ones.
-enrich-tokens:
-	@node script/lib/enrich-tokens.js
-
-# Write the names and websites in script/lib/token-enrichment.json into
-# src/shared/tokenList.js. Commit the result with the data file.
-apply-enrichment:
-	@node script/lib/apply-enrichment.js
-
 clean:
 	@rm -rf dist/ release/
 

README.md

@@ -324,17 +324,6 @@ The Makefile shims to those. It also carries a few targets that have no
   that already holds the drawn image, the same IHDR and every pixel, is left
   untouched. Commit the files with the drawing: `make check` fails while their
   image differs from what it draws
-- `make enrich-tokens` — fetch the name of each token in
-  `src/shared/tokenList.js` from CoinGecko's coin list and its website from the
-  `ethereum-lists/tokens` repository, at a pinned commit, into
-  `script/lib/token-enrichment.json`, by running `script/lib/enrich-tokens.js`.
-  CoinGecko's list is live and has no fixed version, so a later run can return
-  different names
-- `make apply-enrichment` — write the names and URLs in
-  `script/lib/token-enrichment.json` into `src/shared/tokenList.js`, by running
-  `script/lib/apply-enrichment.js`, taking a URL from the table of project
-  websites in that script only where the fetched data has none. Neither target
-  changes which tokens are on the list, and no build or `make check` runs either
 - `make clean` — remove `dist/` and `release/`
 - `make dev` — run the build `make build` runs, without the checks that follow
   it, then run it again after every change to a file under `src/`, `manifest/`
@@ -346,6 +335,19 @@ The Makefile shims to those. It also carries a few targets that have no
   change anywhere else, `package.json` and `build.js` included, starts no build,
   and a directory created while it runs is not watched; restart it after either
 
+Two node programs regenerate the `name` and `url` of each token in
+`src/shared/tokenList.js`. They are run by hand, never by a build or by
+`make check`, and they do not change which tokens are on the list:
+
+- `node script/lib/enrich-tokens.js` — fetch each token's name from CoinGecko's
+  coin list and its website from the `ethereum-lists/tokens` repository, at a
+  pinned commit, into `script/lib/token-enrichment.json`. CoinGecko's list is
+  live and has no fixed version, so a later run can return different names
+- `node script/lib/apply-enrichment.js` — write the names and URLs in
+  `script/lib/token-enrichment.json` into `src/shared/tokenList.js`, taking a
+  URL from the table of project websites in the script where the fetched data
+  has none
+
 ## End-to-End Tests
 
 There are two suites, one per browser, and they share no code. Chrome runs on

TODO.md

@@ -2,9 +2,10 @@
 
 - `git pull` `next` and cut a branch from it — one branch per issue, named
   `issue-<N>-<slug>`. Never branch from `main`.
-- Do the work as one commit whose title ends with ` (closes #N)`.
-- Add no entry to Completed Steps. What landed is recorded on the tracker and in
-  `git log`, where each commit title names the issue it closes.
+- Do the work as one commit whose title ends with ` (closes #N)`, with the
+  `TODO.md` update in that same commit.
+- Move Next Step to the top of Completed Steps; move the top item of Future
+  Steps into Next Step.
 - Run `make fmt`, then `make check`. A feature branch may be red; `next` and
   `main` may not.
 - Rebase onto current `next` immediately before pushing — other branches land on

script/lib/apply-enrichment.js

@@ -3,8 +3,10 @@
 // src/shared/tokenList.js: the name and url an entry already has are replaced,
 // and an entry without them gets them after its decimals. Where the fetched
 // data has no URL for a token, EXTRA_URLS below supplies one if it lists the
-// token. An entry the data does not mention is left as it is. Run by
-// `make apply-enrichment`; no build runs it.
+// token. An entry the data does not mention is left as it is. Run by hand; no
+// build runs it.
+//
+// Usage: node script/lib/apply-enrichment.js
 
 "use strict";
 
@@ -17,9 +19,8 @@ const enrichment = JSON.parse(
     fs.readFileSync(path.join(__dirname, "token-enrichment.json"), "utf8"),
 );
 
-// Project websites by token address. A token gets its URL here only where the
-// fetched data has none; an address the data has a URL for, or that is not on
-// the token list, is never used.
+// Well-known URLs for major tokens not in ethereum-lists.
+// These are official project websites verified from public sources.
 const EXTRA_URLS = {
     "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2": "https://weth.io",
     "0xdAC17F958D2ee523a2206206994597C13D831ec7": "https://tether.to",

script/lib/enrich-tokens.js

@@ -1,7 +1,9 @@
 // Fetches a name and a website for every token in src/shared/tokenList.js and
 // writes them, keyed by address, to script/lib/token-enrichment.json, which
-// script/lib/apply-enrichment.js then writes into tokenList.js. Run by
-// `make enrich-tokens`; no build runs it and nothing here is shipped.
+// script/lib/apply-enrichment.js then writes into tokenList.js. Run by hand;
+// no build runs it and nothing here is shipped.
+//
+// Usage: node script/lib/enrich-tokens.js
 //
 // Names come from CoinGecko's coin list, one request for every coin, matched on
 // the token's Ethereum contract address. A token CoinGecko does not list gets