# Tidying Rolldown Bundles

> Keep rolldown bundles lean by reporting collapsible deps, catalog drift, and fat external shims.

- Skill: `socketdev/tidying-rolldown-bundles` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add socketdev/tidying-rolldown-bundles`
- Raw SKILL.md: https://api.skillmd.com/api/skills/socketdev/tidying-rolldown-bundles/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: socketdev (https://skillmd.com/u/socketdev)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/socketdev/tidying-rolldown-bundles

---


# tidying-rolldown-bundles

The fleet's rolldown bundle repos (socket-lib's `external/` surface today) accrete
two kinds of dependency drift: lockfile transitives that pnpm can collapse, and the
slow risk that an `external/<dep>.js` re-export shim stops delegating to a shared
`*-pack` bundle and starts re-vendoring its own tree. This skill is the conservative,
no-prompt sweep that keeps both in check — the `tidying-*` family member for bundles.

## When to use

- **Periodic dependency hygiene** on bundle repos (run on a `/loop`).
- **Before a release** — confirm the lockfile is deduped and the bundle stays lean.
- **After a dependency bump** that may have introduced duplicate transitives.

## Run it

```bash
# Dry-run (default): report dedupe opportunities + override drift + fat shims.
node .claude/skills/fleet/tidying-rolldown-bundles/lib/tidy-rolldown-bundles.mts

# Act: also run `pnpm dedupe` for the repos with collapsible transitives.
node .claude/skills/fleet/tidying-rolldown-bundles/lib/tidy-rolldown-bundles.mts --fix

# One repo.
node .claude/skills/fleet/tidying-rolldown-bundles/lib/tidy-rolldown-bundles.mts --repo socket-lib
```

Reads the canonical roster from `cascading-fleet/lib/fleet-repos.txt`; resolves repos
under `$PROJECTS` (default `~/projects`). Repos without an `external/` dir or a
`scripts/bundle.mts` are skipped.

## Periodic, no-prompt operation

```
/loop 12h /fleet:tidying-rolldown-bundles --fix
```

The conservative contract makes an unattended `--fix` safe: its only mutation is
`pnpm dedupe`, whose effect is lockfile-only — the published artifact is unchanged.

## What it checks

1. **Dedupe-available** — `pnpm dedupe --check` reports collapsible transitives.
   Under `--fix`, runs `pnpm dedupe` (lockfile-only). **Re-run the bundle build after**
   to confirm the externals still load.
2. **Override-missing** — a Socket-published prefix (`@socketsecurity/*`,
   `@socketregistry/*`) is referenced but not routed through a `catalog:` override, so
   it can float to a duplicate version. Reported (not auto-fixed — the override block is
   fleet-canonical, sync-managed).
3. **Fat shim** — an `external/<dep>.js` exceeds the re-export-shim size cap, meaning it
   likely re-vendors its own tree instead of delegating to a shared `*-pack` bundle
   — the `*-pack.js` consolidation bundles are exempt. Reported for a human.

## Why external/ rarely needs hand-deduping

The fleet's `external/` bundles already dedupe by design: shared deps are consolidated
into mega-bundles (socket-lib's `npm-pack` / `external-pack`), and the per-dep files are
thin re-export shims — `module.exports = require('./npm-pack').semver`. So a shared dep
like `semver` exists once, not once per consumer. This sweep's job is to keep it that way
(catch a shim that regresses to fat) and to collapse the lockfile transitives that
accumulate around the bundle, not to re-architect the consolidation.

## Conservative contract

- **Never edits source, never removes a dependency, never rewrites the bundle.**
- The only mutation is `pnpm dedupe` (lockfile-only); override + fat-shim findings are
  reported for a human to act on.
- Dry-run by default; `--fix` opts into the dedupe.
- After any `--fix` dedupe, the operator (or the skill's caller) rebuilds the affected
  bundle to confirm the externals still load — a dedupe shifts resolved versions.