Address review round 3: homepage type check, preserve MPL notice

1. The homepage check coerced with String(), so ["https://example.com"] passed
   by array-to-string coercion. It now requires a string, then https, then a
   parseable URL. Verified against array, object, number, boolean, null and
   "https://" with no host; a valid string and an absent homepage still pass.

2. The updater stripped every upstream comment, including the Public Suffix
   List's MPL 2.0 notice, leaving the snapshot with no licence while the
   repository declares MIT. The notice is now carried into the generated file,
   read from upstream rather than hardcoded so a reworded notice still lands,
   and the updater refuses to write if it cannot find it. README records that
   the snapshot is MPL 2.0 and dev-only, outside the files allowlist, so the
   published package remains MIT.

Guards are now 34 must-fail plus 6 must-pass, all verified by mutation, and the
licence guard was verified by serving the updater a list with the notice removed.

Author: feruzm

README.md

@@ -80,6 +80,12 @@ function canonicalLink(entry, defaultScheme = DEFAULT_SCHEME) {
 good/bad overlap, public suffixes and `apps.json` placeholders. CI runs it on every pull
 request and again before publish. No dependencies to install.
 
+The public suffix check reads `scripts/public-suffix-list.txt`, a snapshot of the
+[Public Suffix List](https://publicsuffix.org/list/) refreshed by
+`node scripts/update-public-suffix-list.mjs`. That snapshot is MPL 2.0, carries its upstream
+notice, and is development tooling only: it is outside the `files` allowlist, so the npm
+package stays MIT.
+
 ### Adding or changing an app
 
 Open a pull request against `apps.json`. Entries are sorted by key. A `url_scheme` must be

scripts/public-suffix-list.txt

@@ -1,4 +1,9 @@
-# https://publicsuffix.org/list/public_suffix_list.dat, punycode normalised.
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# Generated from https://publicsuffix.org/list/public_suffix_list.dat, punycode normalised.
+# Licensed under MPL 2.0: https://mozilla.org/MPL/2.0/. Not part of the npm package.
 # Rule types are significant: '*.' is a wildcard, '!' is an exception.
 # Refresh with: node scripts/update-public-suffix-list.mjs
 !city.kawasaki.jp

scripts/update-public-suffix-list.mjs

@@ -14,8 +14,25 @@ if (!res.ok) throw new Error(`public suffix list fetch failed: ${res.status}`);
 
 const toPunycode = (domain) => new URL(`https://${domain}`).hostname;
 
+const lines = (await res.text()).split("\n");
+
+// The list is MPL 2.0 and this repository is MIT, so the upstream notice travels with the
+// snapshot. Taken from the file rather than hardcoded, so a reworded notice still lands.
+const notice = [];
+for (const line of lines) {
+  if (!line.trim()) {
+    if (notice.length) break;
+    continue;
+  }
+  if (!line.startsWith("//")) break;
+  notice.push(`#${line.slice(2)}`);
+}
+if (!notice.join(" ").includes("Mozilla Public")) {
+  throw new Error("upstream licence notice not found, refusing to write");
+}
+
 const rules = new Set();
-for (const line of (await res.text()).split("\n")) {
+for (const line of lines) {
   const s = line.trim();
   if (!s || s.startsWith("//")) continue;
 
@@ -28,9 +45,15 @@ if (rules.size < 5000) throw new Error(`only ${rules.size} rules parsed, refusin
 
 writeFileSync(
   new URL("./public-suffix-list.txt", import.meta.url),
-  "# https://publicsuffix.org/list/public_suffix_list.dat, punycode normalised.\n" +
-    "# Rule types are significant: '*.' is a wildcard, '!' is an exception.\n" +
-    "# Refresh with: node scripts/update-public-suffix-list.mjs\n" +
+  [
+    ...notice,
+    "#",
+    "# Generated from https://publicsuffix.org/list/public_suffix_list.dat, punycode normalised.",
+    "# Licensed under MPL 2.0: https://mozilla.org/MPL/2.0/. Not part of the npm package.",
+    "# Rule types are significant: '*.' is a wildcard, '!' is an exception.",
+    "# Refresh with: node scripts/update-public-suffix-list.mjs",
+  ].join("\n") +
+    "\n" +
     [...rules].sort().join("\n") +
     "\n"
 );

scripts/validate.mjs

@@ -148,8 +148,14 @@ if (apps) {
     if (typeof app?.name !== "string" || !app.name) fail("apps.json", `${id}: missing "name"`);
 
     // Common fields first: entries without a url_scheme still have a homepage.
-    if (app?.homepage !== undefined && !String(app.homepage).startsWith("https://")) {
-      fail("apps.json", `${id}: homepage must be https`);
+    if (app?.homepage !== undefined) {
+      if (typeof app.homepage !== "string") {
+        fail("apps.json", `${id}: homepage must be a string`);
+      } else if (!app.homepage.startsWith("https://")) {
+        fail("apps.json", `${id}: homepage must be https`);
+      } else if (!URL.canParse(app.homepage)) {
+        fail("apps.json", `${id}: homepage is not a valid URL: ${app.homepage}`);
+      }
     }
 
     // url_scheme is optional: publishing tools with no web home of their own omit it.