refactor(scripts): segregate repo-owned script dirs

.github/workflows/npm-publish-packages.yml

@@ -3,7 +3,7 @@ name: 📦 npm publish packages
 # Repo-owned (NOT cascaded): socket-registry publishes a FAMILY — the
 # `@socketregistry/*` override packages plus the registry package itself —
 # rather than the single subject `npm-publish.yml` handles. The family stager
-# is `scripts/npm/publish-npm-packages.mts`, and this workflow is the only
+# is `scripts/repo/npm/publish-npm-packages.mts`, and this workflow is the only
 # place it uploads from.
 #
 # Why a workflow at all: the fleet allows exactly ONE npm upload invocation,
@@ -136,4 +136,4 @@ jobs:
         env:
           DIST_TAG: ${{ inputs.dist-tag }}
           ONLY: ${{ inputs.only }}
-        run: node scripts/npm/publish-npm-packages.mts --force-publish --dist-tag "$DIST_TAG" ${ONLY:+--only "$ONLY"} ${{ inputs.publish != true && '--dry-run' || '' }}
+        run: node scripts/repo/npm/publish-npm-packages.mts --force-publish --dist-tag "$DIST_TAG" ${ONLY:+--only "$ONLY"} ${{ inputs.publish != true && '--dry-run' || '' }}

CLAUDE.md

@@ -137,4 +137,4 @@ Layout, commands, build, testing, vitest config, dependency policy, and the scra
 - 🚨 Coverage is mandatory and never decreases; every `c8 ignore` reason ends with a period. [`architecture`](docs/agents.md/repo/architecture.md)
 - 🚨 Never the split `@typescript-eslint/*` packages, and never swap tsgo for stock `tsc`. [`architecture`](docs/agents.md/repo/architecture.md)
 - 🚨 A ported `test/npm/*.test.mts` suite's provenance is its `file-fork` row in `lockstep.json`, never its prose header. [`npm-port-provenance`](docs/agents.md/repo/npm-port-provenance.md)
-- Override impact is rank × cut; a cut % without its gateways lies. (`scripts/npm/survey-override-deps.mts`) [`override-impact-analysis`](docs/agents.md/repo/override-impact-analysis.md)
+- Override impact is rank × cut; a cut % without its gateways lies. (`scripts/repo/npm/survey-override-deps.mts`) [`override-impact-analysis`](docs/agents.md/repo/override-impact-analysis.md)

docs/agents.md/repo/architecture.md

@@ -13,17 +13,17 @@ The CLAUDE.md `## 🏗️ Registry-Specific` section is the headline. This file
 
 ## Commands
 
-| Command                                  | Purpose                                                     |
-| ---------------------------------------- | ----------------------------------------------------------- |
-| `pnpm run build`                         | Build the registry (esbuild → CJS).                         |
-| `pnpm test`                              | Run vitest suite.                                           |
-| `pnpm run check`                         | Lint + type check together.                                 |
-| `pnpm run fix`                           | Auto-fix lint + format.                                     |
-| `pnpm run type`                          | Type check only (`tsgo`, no emit).                          |
-| `pnpm run update`                        | Refresh dependencies via taze.                              |
-| `pnpm run make-npm-override`             | Scaffold a new NPM package override under `/packages/npm/`. |
-| `pnpm run release-npm`                   | Publish NPM overrides.                                      |
-| `node scripts/npm/test-npm-packages.mts` | Long-running NPM-package test driver.                       |
+| Command                                       | Purpose                                                     |
+| --------------------------------------------- | ----------------------------------------------------------- |
+| `pnpm run build`                              | Build the registry (esbuild → CJS).                         |
+| `pnpm test`                                   | Run vitest suite.                                           |
+| `pnpm run check`                              | Lint + type check together.                                 |
+| `pnpm run fix`                                | Auto-fix lint + format.                                     |
+| `pnpm run type`                               | Type check only (`tsgo`, no emit).                          |
+| `pnpm run update`                             | Refresh dependencies via taze.                              |
+| `pnpm run make-npm-override`                  | Scaffold a new NPM package override under `/packages/npm/`. |
+| `pnpm run release-npm`                        | Publish NPM overrides.                                      |
+| `node scripts/repo/npm/test-npm-packages.mts` | Long-running NPM-package test driver.                       |
 
 ## Build system
 

docs/agents.md/repo/override-impact-analysis.md

@@ -51,7 +51,7 @@ that used different ones.
 
 ## Related
 
-- `scripts/npm/survey-override-deps.mts` — the offline-first survey of existing
+- `scripts/repo/npm/survey-override-deps.mts` — the offline-first survey of existing
   overrides and their remaining dependencies.
 - The fleet skill for cross-repo impact research (wheelhouse) wraps the
   reachability simulation described here.

package.json

@@ -19,43 +19,43 @@
     "linkDirectory": false
   },
   "scripts": {
-    "analyze-ci-failures": "node scripts/testing/analyze-ci-failures.mts",
+    "analyze-ci-failures": "node scripts/repo/testing/analyze-ci-failures.mts",
     "build": "node scripts/repo/build.mts",
     "check": "node scripts/fleet/check.mts",
-    "check-trusted": "node scripts/npm/check-trusted-packages.mts",
+    "check-trusted": "node scripts/repo/npm/check-trusted-packages.mts",
     "check:paths": "node scripts/fleet/check/paths-are-canonical.mts",
     "clean": "node scripts/fleet/clean.mts",
     "cover": "node scripts/fleet/cover.mts",
     "fix": "node scripts/fleet/fix.mts",
     "format": "node scripts/fleet/format.mts",
     "format:check": "node scripts/fleet/format.mts --check",
-    "generate-actions-allow-list": "node scripts/ci/generate-actions-allow-list.mts",
-    "generate-actions-tree": "node scripts/ci/show-actions-tree.mts",
-    "inline-action-shas": "node scripts/ci/inline-action-versions-as-shas.mts",
+    "generate-actions-allow-list": "node scripts/repo/ci/generate-actions-allow-list.mts",
+    "generate-actions-tree": "node scripts/repo/ci/show-actions-tree.mts",
+    "inline-action-shas": "node scripts/repo/ci/inline-action-versions-as-shas.mts",
     "lint": "node scripts/fleet/lint.mts",
     "lockstep": "node scripts/fleet/lockstep.mts",
     "lockstep:emit-schema": "node scripts/fleet/lockstep-emit-schema.mts",
-    "make-npm-override": "node scripts/npm/make-npm-override.mts",
-    "npm:configure-staged": "node scripts/npm/configure-staged-publishing.mts",
+    "make-npm-override": "node scripts/repo/npm/make-npm-override.mts",
+    "npm:configure-staged": "node scripts/repo/npm/configure-staged-publishing.mts",
     "npm:publish": "node scripts/fleet/publish-pipeline.mts",
-    "npm:wire-port": "node scripts/npm/wire-npm-port.mts",
-    "package-npm-access": "node scripts/npm/set-npm-package-access.mts",
-    "package-npm-publish": "node scripts/npm/publish-npm-packages.mts",
+    "npm:wire-port": "node scripts/repo/npm/wire-npm-port.mts",
+    "package-npm-access": "node scripts/repo/npm/set-npm-package-access.mts",
+    "package-npm-publish": "node scripts/repo/npm/publish-npm-packages.mts",
     "perf": "node scripts/repo/perf.mts",
     "security": "node scripts/fleet/security.mts",
     "setup": "node scripts/repo/setup.mts",
     "prepare": "node scripts/fleet/install-git-hooks.mts && node scripts/fleet/prepare.mts",
     "prepublishOnly": "echo 'ERROR: Use GitHub Actions workflow for publishing' && exit 1",
-    "release-npm": "node scripts/npm/release-npm-packages.mts",
+    "release-npm": "node scripts/repo/npm/release-npm-packages.mts",
     "test": "node scripts/fleet/test.mts",
     "test:fuzz": "node scripts/repo/fuzz.mts",
-    "test:npm": "node scripts/npm/run-vitest-npm.mts",
-    "test:npm:floor": "node scripts/npm/floor-node-smoke.mts",
+    "test:npm": "node scripts/repo/npm/run-vitest-npm.mts",
+    "test:npm:floor": "node scripts/repo/npm/floor-node-smoke.mts",
     "type": "node node_modules/typescript/bin/tsc --noEmit -p .config/fleet/tsconfig.check.json",
     "update": "node scripts/fleet/update.mts",
     "update:external-tools": "node scripts/repo/update-external-tools.mts",
-    "validate-ci": "node scripts/testing/reproduce-ci-locally.mts",
-    "validate-packages": "node scripts/testing/validate-package-tests.mts",
+    "validate-ci": "node scripts/repo/testing/reproduce-ci-locally.mts",
+    "validate-packages": "node scripts/repo/testing/validate-package-tests.mts",
     "setup-security-tools": "node .claude/hooks/fleet/setup-security-tools/install.mts",
     "ci:local": "node scripts/fleet/agent-ci-skip-locks.mts run --all --quiet --pause-on-failure --github-token",
     "weekly-update": "node scripts/fleet/weekly-update.mts",

perf/npm/json-stable-stringify.perf.mts

@@ -7,7 +7,7 @@ import { getDefaultLogger } from '@socketsecurity/lib/logger/default'
 import fastJsonStableStringify from 'fast-json-stable-stringify'
 import { Bench } from 'tinybench'
 
-import { PERF_NPM_FIXTURES_PATH } from '../../scripts/constants/paths.mts'
+import { PERF_NPM_FIXTURES_PATH } from '../../scripts/repo/constants/paths.mts'
 
 const logger = getDefaultLogger()
 

pnpm-workspace.yaml

@@ -230,7 +230,7 @@ minimumReleaseAgeExclude:
   # (a scope glob would blanket-bypass any future @typescript publish).
   # Socket-owned scopes — bypass the soak window because they ship
   # through Socket's own provenance + publish pipeline. Canonical
-  # list: scripts/constants/socket-scopes.mts SOCKET_PACKAGE_PATTERNS.
+  # list: scripts/fleet/constants/socket-scopes.mts SOCKET_PACKAGE_PATTERNS.
   # Mirrored in `.config/taze.config.mts` (same scopes, same reason)
   # and consumed by scripts/repo/update-external-tools.mts via
   # isSocketSourcedPackage / isSocketSourcedRepository.

scripts/repo/build.mts

@@ -11,7 +11,7 @@ import { isQuiet } from '@socketsecurity/lib-stable/argv/flag-predicates'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger/default'
 
 import { runCommand } from '../fleet/util/run-command.mts'
-import { REGISTRY_PKG_PATH } from '../constants/paths.mts'
+import { REGISTRY_PKG_PATH } from './constants/paths.mts'
 
 const logger = getDefaultLogger()
 

scripts/repo/check/floor-node-pin-matches-engines.mts

@@ -22,7 +22,7 @@ import semver from 'semver'
 
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger/default'
 
-import { FLOOR_NODE_VERSION } from '../../npm/floor-node-smoke.mts'
+import { FLOOR_NODE_VERSION } from '../npm/floor-node-smoke.mts'
 
 const logger = getDefaultLogger()
 
@@ -104,7 +104,7 @@ async function main(): Promise<number> {
         `${findings.length} override(s) out of lock-step with the floor-node pin (${FLOOR_NODE_VERSION}):`,
         ...findings.map(f => `  ${f}`),
         'Fix: move engines.node and FLOOR_NODE_VERSION together —',
-        '  scripts/npm/floor-node-smoke.mts (bump the pin + every sha256 from',
+        '  scripts/repo/npm/floor-node-smoke.mts (bump the pin + every sha256 from',
         '  https://nodejs.org/dist/v<version>/SHASUMS256.txt), or correct the',
         '  drifted engines range.',
       ].join('\n'),

scripts/ci/show-actions-tree.mts → scripts/repo/ci/show-actions-tree.mts

@@ -7,7 +7,7 @@ import { promises as fs } from 'node:fs'
 import path from 'node:path'
 import process from 'node:process'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger/default'
-import { REPO_ROOT } from '../fleet/paths.mts'
+import { REPO_ROOT } from '../../fleet/paths.mts'
 import {
   ROOT_DOT_GITHUB_ACTIONS_PATH,
   ROOT_DOT_GITHUB_WORKFLOWS_PATH,

scripts/maintenance/taze.mts → scripts/repo/maintenance/taze.mts

@@ -7,7 +7,7 @@ import { getDefaultLogger } from '@socketsecurity/lib-stable/logger/default'
 import { spawn } from '@socketsecurity/lib-stable/process/spawn/child'
 import process from 'node:process'
 
-import { REPO_ROOT } from '../fleet/paths.mts'
+import { REPO_ROOT } from '../../fleet/paths.mts'
 
 const logger = getDefaultLogger()
 

scripts/maintenance/update-empty-files.mts → scripts/repo/maintenance/update-empty-files.mts

@@ -16,7 +16,7 @@ const logger = getDefaultLogger()
 
 import { NPM_TEMPLATES_PATH, ROOT_PATH } from '../constants/paths.mts'
 import { getIgnoreGlobs } from '../constants/utils.mts'
-import { getModifiedFiles } from '../repo/util/git.mts'
+import { getModifiedFiles } from '../util/git.mts'
 
 const { values: cliArgs } = parseArgs<{
   force?: boolean | undefined

scripts/maintenance/update-licenses.mts → scripts/repo/maintenance/update-licenses.mts

@@ -22,7 +22,7 @@ async function main(): Promise<void> {
   const stream = globStreamLicenses(ROOT_PATH, {
     recursive: true,
     ignoreOriginals: true,
-    ignore: [LICENSE, 'scripts/templates', ...getIgnoreGlobs()],
+    ignore: [LICENSE, 'scripts/repo/templates', ...getIgnoreGlobs()],
   })
 
   // Update each LICENSE file with the root LICENSE content.

scripts/npm/check-trusted-packages-staged.mts → scripts/repo/npm/check-trusted-packages-staged.mts

@@ -34,7 +34,7 @@ import {
 } from '@socketsecurity/lib/npm/meta'
 
 import { NPM_PACKAGES_PATH } from '../constants/paths.mts'
-import { REPO_ROOT } from '../fleet/paths.mts'
+import { REPO_ROOT } from '../../fleet/paths.mts'
 
 import type {
   GetPackumentSlimOptions,
@@ -300,7 +300,7 @@ export async function loadStagedRoster(options?: {
         `Where: ${REGISTRY_MANIFEST_PATH}`,
         `Saw: ${errorMessage(e)}`,
         'Wanted: a readable manifest with an `npm` array of [purl, data] rows.',
-        'Fix: regenerate it with `node scripts/npm/update-manifest.mts`, or restore the file from git.',
+        'Fix: regenerate it with `node scripts/repo/npm/update-manifest.mts`, or restore the file from git.',
       ].join('\n'),
     )
   }

scripts/npm/configure-staged-publishing-browser.mts → scripts/repo/npm/configure-staged-publishing-browser.mts

@@ -52,12 +52,12 @@ import {
   DEFAULT_PROFILE_DIR,
   openNpmBrowserSession,
   optIntoChallengeCooldown,
-} from '../fleet/publish-infra/npm/browser-session.mts'
+} from '../../fleet/publish-infra/npm/browser-session.mts'
 
 export { DEFAULT_PROFILE_DIR }
-import { CHALLENGE_PROGRESS_INTERVAL_MS } from '../fleet/publish-infra/npm/challenge-gate.mts'
+import { CHALLENGE_PROGRESS_INTERVAL_MS } from '../../fleet/publish-infra/npm/challenge-gate.mts'
 
-import type { TrustedPublisherDesired } from '../fleet/publish-infra/npm/trusted-publisher-plan.mts'
+import type { TrustedPublisherDesired } from '../../fleet/publish-infra/npm/trusted-publisher-plan.mts'
 import {
   classifyAccessPageReadiness,
   formatBindingWriteFailure,

scripts/npm/configure-staged-publishing-controls-report.mts → scripts/repo/npm/configure-staged-publishing-controls-report.mts

@@ -99,6 +99,6 @@ export function formatUnresolvedActionControl(config: {
     `Where: ${cfg.url}`,
     `Saw: ${cfg.reason}.${inventory}`,
     `Wanted: a checkbox, radio pair, select, or role="switch" control this run can set "${cfg.request.name}" to ${cfg.request.checked} with.`,
-    `Fix: run \`pnpm run npm:configure-staged --dump-form ${cfg.packageName}\` in the signed-in Chrome window to print the form's redacted DOM, then add the shape it reports to the ladder in scripts/npm/configure-staged-publishing-controls.mts. Do not hand-edit the hidden input's value — a state no rendered control offers is a state npm may refuse while the run reports success.`,
+    `Fix: run \`pnpm run npm:configure-staged --dump-form ${cfg.packageName}\` in the signed-in Chrome window to print the form's redacted DOM, then add the shape it reports to the ladder in scripts/repo/npm/configure-staged-publishing-controls.mts. Do not hand-edit the hidden input's value — a state no rendered control offers is a state npm may refuse while the run reports success.`,
   ].join('\n')
 }

scripts/npm/configure-staged-publishing-form-dump.mts → scripts/repo/npm/configure-staged-publishing-form-dump.mts

@@ -24,7 +24,7 @@ import { getDefaultLogger } from '@socketsecurity/lib-stable/logger/default'
 
 import type { Page } from 'playwright-core'
 
-import { ensureFormOpen } from '../fleet/publish-infra/npm/trusted-publisher-page.mts'
+import { ensureFormOpen } from '../../fleet/publish-infra/npm/trusted-publisher-page.mts'
 
 import {
   openNpmSettingsSession,

scripts/npm/configure-staged-publishing-operator.mts → scripts/repo/npm/configure-staged-publishing-operator.mts

@@ -27,8 +27,8 @@ import { sleep } from '@socketsecurity/lib-stable/promises/timers'
 
 import type { Page } from 'playwright-core'
 
-import { optIntoChallengeCooldown } from '../fleet/publish-infra/npm/browser-session.mts'
-import { tickChallengeGate } from '../fleet/publish-infra/npm/challenge-gate.mts'
+import { optIntoChallengeCooldown } from '../../fleet/publish-infra/npm/browser-session.mts'
+import { tickChallengeGate } from '../../fleet/publish-infra/npm/challenge-gate.mts'
 import {
   buildOperatorOverlayInjectionScript,
   buildOperatorOverlayRemovalScript,

scripts/npm/configure-staged-publishing-payload.mts → scripts/repo/npm/configure-staged-publishing-payload.mts

@@ -20,7 +20,7 @@
  *   shape" back into "enter your authenticator code".
  */
 
-import { OIDC_PERMISSION_ACTIONS } from '../fleet/publish-infra/npm/access-context-schema.mts'
+import { OIDC_PERMISSION_ACTIONS } from '../../fleet/publish-infra/npm/access-context-schema.mts'
 
 /**
  * The action token npm uses for a staged publish in the trusted publisher's

scripts/npm/configure-staged-publishing-plan.mts → scripts/repo/npm/configure-staged-publishing-plan.mts

@@ -23,7 +23,7 @@ import {
   classifyStagedFetch,
   isCloudflareChallenge,
   looksLikeHtmlBody,
-} from '../fleet/publish-infra/npm/staged-browser-parse.mts'
+} from '../../fleet/publish-infra/npm/staged-browser-parse.mts'
 import {
   bindingMatchesTarget,
   decideStagedConfigurationState,
@@ -82,7 +82,7 @@ import {
   WAIT_FOR_OPERATOR_MS,
 } from './configure-staged-publishing-session.mts'
 
-import type { StagedFetchState } from '../fleet/publish-infra/npm/staged-browser-parse.mts'
+import type { StagedFetchState } from '../../fleet/publish-infra/npm/staged-browser-parse.mts'
 import type { StagedTrustReport } from './check-trusted-packages-staged.mts'
 import type { StagedConfigurationState } from './configure-staged-publishing-binding.mts'
 import type {

scripts/npm/configure-staged-publishing-session.mts → scripts/repo/npm/configure-staged-publishing-session.mts

@@ -50,7 +50,7 @@ import {
   MILLISECONDS_PER_SECOND,
 } from '@socketsecurity/lib-stable/constants/time'
 
-import { classifyStagedFetch } from '../fleet/publish-infra/npm/staged-browser-parse.mts'
+import { classifyStagedFetch } from '../../fleet/publish-infra/npm/staged-browser-parse.mts'
 import {
   hasHumanVerificationMarkers,
   hasSettingsPayloadMarkers,

scripts/npm/configure-staged-publishing-write.mts → scripts/repo/npm/configure-staged-publishing-write.mts

@@ -28,9 +28,9 @@ import { sleep } from '@socketsecurity/lib-stable/promises/timers'
 
 import type { Page } from 'playwright-core'
 
-import { ensureFormOpen } from '../fleet/publish-infra/npm/trusted-publisher-page.mts'
+import { ensureFormOpen } from '../../fleet/publish-infra/npm/trusted-publisher-page.mts'
 
-import type { TrustedPublisherDesired } from '../fleet/publish-infra/npm/trusted-publisher-plan.mts'
+import type { TrustedPublisherDesired } from '../../fleet/publish-infra/npm/trusted-publisher-plan.mts'
 import { formatUnresolvedActionControl } from './configure-staged-publishing-controls-report.mts'
 import {
   collectActionControlCandidates,
@@ -167,7 +167,7 @@ export async function setPublisherActionControl(
           `Where: ${cfg.url}`,
           `Saw: the ${plan.via}-matched role toggle still reports aria-checked=${JSON.stringify(after ?? '')} after the click.`,
           `Wanted: aria-checked to report ${cfg.checked}.`,
-          'Fix: open the page and click that control by hand to see what it does. If it needs a keypress or a nested element clicked, add that shape to the ladder in scripts/npm/configure-staged-publishing-controls.mts.',
+          'Fix: open the page and click that control by hand to see what it does. If it needs a keypress or a nested element clicked, add that shape to the ladder in scripts/repo/npm/configure-staged-publishing-controls.mts.',
         ].join('\n'),
       )
     }

scripts/npm/configure-staged-publishing.mts → scripts/repo/npm/configure-staged-publishing.mts

@@ -247,7 +247,7 @@ export async function dumpAccessPayload(
 function printHelp(): void {
   logger.log('')
   logger.log(
-    'Usage: node scripts/npm/configure-staged-publishing.mts [options]',
+    'Usage: node scripts/repo/npm/configure-staged-publishing.mts [options]',
   )
   logger.log('')
   logger.log(

scripts/npm/floor-node-smoke.mts → scripts/repo/npm/floor-node-smoke.mts

@@ -11,7 +11,7 @@
  *   The floor binary is a side install: it never touches PATH — the harness
  *   keeps running on the repo's own Node and spawns the floor binary
  *   explicitly, so the two runtimes can't be confused.
- *   Usage: node scripts/npm/floor-node-smoke.mts
+ *   Usage: node scripts/repo/npm/floor-node-smoke.mts
  *   Env: FLOOR_NODE_DIR overrides the install dir (default: RUNNER_TEMP,
  *   falling back to os.tmpdir()).
  */
@@ -61,7 +61,7 @@ const FLOOR_NODE_PLATFORMS: Record<string, { asset: string; sha256: string }> =
 
 const repoRoot = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
-  '../..',
+  '../../..',
 )
 const npmPackagesPath = path.join(repoRoot, 'packages/npm')