chore: bring the token-list enrichment tooling into script/lib (closes #495)

The two node programs and the data file from f7a2437 regenerate the name and
url of each token in src/shared/tokenList.js. They are now CommonJS under
script/lib/, find their files from their own location, and read
ethereum-lists at a pinned commit. The apply step also rewrites an entry that
already has a name and url, so it runs on the current list; on the committed
data it leaves the list unchanged. make enrich-tokens and make
apply-enrichment run them, and README.md names both targets. The data file
carries the MUSD token's on-chain name, so script/check-censored allows that
one literal there too.

Model: opus-5-5

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist icons clean dev
+.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist icons enrich-tokens apply-enrichment clean dev
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -111,6 +111,17 @@ vendor-blocklist:
 icons:
 	@node script/lib/icons.js
 
+# Fetch a name and a website for every token in src/shared/tokenList.js into
+# script/lib/token-enrichment.json. Run deliberately, land the diff: the names
+# come from live data, so a later run can return different ones.
+enrich-tokens:
+	@node script/lib/enrich-tokens.js
+
+# Write the names and websites in script/lib/token-enrichment.json into
+# src/shared/tokenList.js. Commit the result with the data file.
+apply-enrichment:
+	@node script/lib/apply-enrichment.js
+
 clean:
 	@rm -rf dist/ release/
 

README.md

@@ -324,6 +324,17 @@ The Makefile shims to those. It also carries a few targets that have no
   that already holds the drawn image, the same IHDR and every pixel, is left
   untouched. Commit the files with the drawing: `make check` fails while their
   image differs from what it draws
+- `make enrich-tokens` — fetch the name of each token in
+  `src/shared/tokenList.js` from CoinGecko's coin list and its website from the
+  `ethereum-lists/tokens` repository, at a pinned commit, into
+  `script/lib/token-enrichment.json`, by running `script/lib/enrich-tokens.js`.
+  CoinGecko's list is live and has no fixed version, so a later run can return
+  different names
+- `make apply-enrichment` — write the names and URLs in
+  `script/lib/token-enrichment.json` into `src/shared/tokenList.js`, by running
+  `script/lib/apply-enrichment.js`, taking a URL from the table of project
+  websites in that script only where the fetched data has none. Neither target
+  changes which tokens are on the list, and no build or `make check` runs either
 - `make clean` — remove `dist/` and `release/`
 - `make dev` — run the build `make build` runs, without the checks that follow
   it, then run it again after every change to a file under `src/`, `manifest/`
@@ -335,19 +346,6 @@ The Makefile shims to those. It also carries a few targets that have no
   change anywhere else, `package.json` and `build.js` included, starts no build,
   and a directory created while it runs is not watched; restart it after either
 
-Two node programs regenerate the `name` and `url` of each token in
-`src/shared/tokenList.js`. They are run by hand, never by a build or by
-`make check`, and they do not change which tokens are on the list:
-
-- `node script/lib/enrich-tokens.js` — fetch each token's name from CoinGecko's
-  coin list and its website from the `ethereum-lists/tokens` repository, at a
-  pinned commit, into `script/lib/token-enrichment.json`. CoinGecko's list is
-  live and has no fixed version, so a later run can return different names
-- `node script/lib/apply-enrichment.js` — write the names and URLs in
-  `script/lib/token-enrichment.json` into `src/shared/tokenList.js`, taking a
-  URL from the table of project websites in the script where the fetched data
-  has none
-
 ## End-to-End Tests
 
 There are two suites, one per browser, and they share no code. Chrome runs on

TODO.md

@@ -2,10 +2,9 @@
 
 - `git pull` `next` and cut a branch from it — one branch per issue, named
   `issue-<N>-<slug>`. Never branch from `main`.
-- Do the work as one commit whose title ends with ` (closes #N)`, with the
-  `TODO.md` update in that same commit.
-- Move Next Step to the top of Completed Steps; move the top item of Future
-  Steps into Next Step.
+- Do the work as one commit whose title ends with ` (closes #N)`.
+- Add no entry to Completed Steps. What landed is recorded on the tracker and in
+  `git log`, where each commit title names the issue it closes.
 - Run `make fmt`, then `make check`. A feature branch may be red; `next` and
   `main` may not.
 - Rebase onto current `next` immediately before pushing — other branches land on

script/lib/apply-enrichment.js

@@ -3,10 +3,8 @@
 // src/shared/tokenList.js: the name and url an entry already has are replaced,
 // and an entry without them gets them after its decimals. Where the fetched
 // data has no URL for a token, EXTRA_URLS below supplies one if it lists the
-// token. An entry the data does not mention is left as it is. Run by hand; no
-// build runs it.
-//
-// Usage: node script/lib/apply-enrichment.js
+// token. An entry the data does not mention is left as it is. Run by
+// `make apply-enrichment`; no build runs it.
 
 "use strict";
 
@@ -19,8 +17,9 @@ const enrichment = JSON.parse(
     fs.readFileSync(path.join(__dirname, "token-enrichment.json"), "utf8"),
 );
 
-// Well-known URLs for major tokens not in ethereum-lists.
-// These are official project websites verified from public sources.
+// Project websites by token address. A token gets its URL here only where the
+// fetched data has none; an address the data has a URL for, or that is not on
+// the token list, is never used.
 const EXTRA_URLS = {
     "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2": "https://weth.io",
     "0xdAC17F958D2ee523a2206206994597C13D831ec7": "https://tether.to",

script/lib/enrich-tokens.js

@@ -1,9 +1,7 @@
 // Fetches a name and a website for every token in src/shared/tokenList.js and
 // writes them, keyed by address, to script/lib/token-enrichment.json, which
-// script/lib/apply-enrichment.js then writes into tokenList.js. Run by hand;
-// no build runs it and nothing here is shipped.
-//
-// Usage: node script/lib/enrich-tokens.js
+// script/lib/apply-enrichment.js then writes into tokenList.js. Run by
+// `make enrich-tokens`; no build runs it and nothing here is shipped.
 //
 // Names come from CoinGecko's coin list, one request for every coin, matched on
 // the token's Ethereum contract address. A token CoinGecko does not list gets