rvlib-shipkit 0.22.2 → 0.23.0

package/src/rules/SK011-sibling-unit-ranges.ts

@@ -0,0 +1,77 @@
+// SK011 — a dependency range on a SIBLING release unit must be satisfied by
+// the version that sibling actually carries (build/shipkit.md, release units).
+//
+// The failure it exists for: one unit is edited and its dependents keep a
+// range that names a version nobody published, or an older one that lacks the
+// code they now call. Both are invisible until a consumer installs, which is
+// the worst place to find out. `shipkit bump` moves these ranges forward on
+// every bump, so a red here means someone hand-edited a range, or a bump was
+// interrupted.
+//
+// Local protocols (link:, file:) are SK006's story, not this rule's.
+import { existsSync, readFileSync } from 'fs'
+import { join } from 'path'
+import { resolveUnits } from '../release/units.ts'
+import type { Rule } from './rule.ts'
+
+type Pkg = {
+    dependencies?: Record<string, string>
+    peerDependencies?: Record<string, string>
+    optionalDependencies?: Record<string, string>
+    devDependencies?: Record<string, string>
+}
+
+const BLOCKS = ['dependencies', 'peerDependencies', 'optionalDependencies', 'devDependencies'] as const
+
+/** does `version` satisfy a caret/tilde/exact range? Deliberately small: the
+ *  ranges this repo writes are `^x.y.z`, `~x.y.z` or an exact pin, and a range
+ *  shape it cannot read is SKIPPED rather than guessed at. */
+export function satisfiesSimple(version: string, range: string): boolean | null {
+    const v = version.match(/^(\d+)\.(\d+)\.(\d+)/)
+    const r = range.trim().match(/^([\^~]?)(\d+)\.(\d+)\.(\d+)$/)
+    if (v == null || r == null) return null
+    const [, op, RA, RI, RP] = r as unknown as [string, string, string, string, string]
+    const [va, vi, vp] = [Number(v[1]), Number(v[2]), Number(v[3])]
+    const [ra, ri, rp] = [Number(RA), Number(RI), Number(RP)]
+    const atLeast = va > ra || (va === ra && (vi > ri || (vi === ri && vp >= rp)))
+    if (op === '^') {
+        // caret on 0.x pins the MINOR: ^0.1.4 accepts 0.1.9, never 0.2.0
+        if (ra === 0) return va === 0 && vi === ri && atLeast
+        return va === ra && atLeast
+    }
+    if (op === '~') return va === ra && vi === ri && atLeast
+    return va === ra && vi === ri && vp === rp
+}
+
+export const siblingUnitRanges: Rule = {
+    id: 'SK011',
+    blocking: true,
+    title: 'sibling unit ranges',
+    owner: 'build/shipkit.md',
+    lint: (t, env) => {
+        const { units } = resolveUnits(env.root, env.config)
+        const version = new Map(units.map((u) => [u.name, u.version]))
+        if (units.length < 2) return t.ok('one release unit — no sibling ranges to keep honest')
+        const bad: string[] = []
+        let checked = 0
+        for (const u of units) {
+            const p = join(u.dir, 'package.json')
+            if (!existsSync(p)) continue
+            let pkg: Pkg
+            try { pkg = JSON.parse(readFileSync(p, 'utf8')) as Pkg } catch { continue }
+            for (const block of BLOCKS)
+                for (const [dep, range] of Object.entries(pkg[block] ?? {})) {
+                    const actual = version.get(dep)
+                    if (actual == null) continue
+                    if (/^(link|file|portal|workspace):/.test(range)) continue
+                    const ok = satisfiesSimple(actual, range)
+                    if (ok == null) continue
+                    checked++
+                    if (!ok) bad.push(`${u.id}: ${block}.${dep} wants ${range}, ${dep} is ${actual}`)
+                }
+        }
+        if (bad.length > 0)
+            t.fail(`${bad.join(' · ')} — a range naming a version its sibling does not carry breaks at INSTALL, for a consumer. \`shipkit bump\` moves these forward, so fix the bump rather than the range`)
+        else t.ok(`${checked} sibling range(s) match the version each unit carries`)
+    },
+}

package/src/rules/rule-registry.ts

@@ -13,6 +13,7 @@ import { githubVisibility } from './SK007-github-visibility.ts'
 import { reviewerAgent } from './SK008-reviewer-agent.ts'
 import { commitAiTells } from './SK009-commit-ai-tells.ts'
 import { undeclaredReleaseUnit } from './SK010-undeclared-release-unit.ts'
+import { siblingUnitRanges } from './SK011-sibling-unit-ranges.ts'
 
 export const RULES: readonly Rule[] = [
     packageJsonShape,
@@ -25,6 +26,7 @@ export const RULES: readonly Rule[] = [
     reviewerAgent,
     commitAiTells,
     undeclaredReleaseUnit,
+    siblingUnitRanges,
 ]
 
 // THE id shape, one place: 2-4 uppercase letters + exactly 3 digits. `SK` is

package/src/serve/hub-app/cols-svc.ts

@@ -129,7 +129,7 @@ export class ColsSvc {
     async remark(body: Record<string, unknown>): Promise<void> {
         const text = this.remarkDraft.trim()
         if (text === '') return
-        // draft survives a failed send — his words are never erased
+        // draft survives a failed send, so nothing typed is ever erased
         const ok = await this.act('remark', { ...body, text })
         if (ok) runInAction(() => { this.remarkDraft = '' })
     }

package/src/serve/hub-app/hub-app.tsx

@@ -173,7 +173,7 @@ const Palette = observer(() => {
     )
 })
 
-// remark box on the ASSET view too — his words land in .rv-assets/notes.md
+// remark box on the ASSET view too: remarks land in .rv-assets/notes.md
 // and come back as `remarks` (exchange both ways, media included)
 const AssetRemarks = observer(() => {
     const m = app.media

package/src/serve/run-serve.ts

@@ -28,7 +28,7 @@ export function defaultHubPort(name: string): number {
 
 export async function resolveHubDeps(root: string, c: RepoConfig, io: ServeIo, o?: { port?: number }): Promise<HubDeps> {
     // the default wiki graph exists only when the repo HAS a wiki dir: a
-    // game repo's hub advertising a wiki route was startup noise (his catch
+    // game repo's hub advertising a wiki route was startup noise
     // 2026-08-05). A config-declared wikiGraph always mounts.
     const wikiGraph = c.serve?.wikiGraph != null
         ? { title: c.serve.wikiGraph.title ?? `${c.name} wiki`, load: c.serve.wikiGraph.load }
@@ -109,11 +109,13 @@ export async function runServe(root: string, io: ServeIo, o?: { port?: number })
     try {
         const hub = serveHub(deps)
         const base = `http://localhost:${hub.server.port}`
-        io.print(`ok: ${c.name} hub → ${base}`)
-        // the '/' tool IS the banner line above — printing it again was noise
-        for (const t of hub.tools) if (t.path !== '/') io.print(`ok: ${t.label} → ${base}${t.path}`)
+        // a banner, not a checklist: one clickable line, then what is inside,
+        // dimmed by indentation. Wire prefixes stay reserved for problems.
+        io.print(`${c.name} hub → ${base}`)
+        const routes = hub.tools.filter((t) => t.path !== '/').map((t) => `${t.label} ${t.path}`).join(' · ')
+        if (routes !== '') io.print(`  also: ${routes}`)
         // the off-machine door (phone, other machines) — publicHost is config
-        if (c.serve?.publicHost != null) io.print(`ok: public → http://${c.serve.publicHost}:${hub.server.port}/`)
+        if (c.serve?.publicHost != null) io.print(`  phone: http://${c.serve.publicHost}:${hub.server.port}/`)
         await new Promise(() => {}) // the hub owns the process — never resolve
         return 0
     } catch (e) {
@@ -126,8 +128,9 @@ export async function runServe(root: string, io: ServeIo, o?: { port?: number })
             if (owner?.hub === 'shipkit' && owner.name === c.name) {
                 // a re-run terminal stays as clickable as a first run — the
                 // owner's /hub.json tool list is the same source of truth
-                io.print(`ok: hub already served → http://localhost:${deps.port} (another window owns it)`)
-                for (const t of owner.tools ?? []) if (t.path !== '/') io.print(`ok: ${t.label} → http://localhost:${deps.port}${t.path}`)
+                io.print(`${c.name} hub → http://localhost:${deps.port} (already running in another window)`)
+                const routes = (owner.tools ?? []).filter((t) => t.path !== '/').map((t) => `${t.label} ${t.path}`).join(' · ')
+                if (routes !== '') io.print(`  also: ${routes}`)
                 return 0
             }
             io.printErr(`FAIL: port ${deps.port} is taken by ${owner?.name != null ? `repo '${owner.name}'` : 'another process'} — set serve: { port } in repo.config.ts to a free one`)

package/src/serve/serve-hub.ts

@@ -99,8 +99,8 @@ export function serveHub(d: HubDeps): Hub {
                     }
                     else if (path === '/api/act/post-feedback') appendPostFeedback(d.root, b.channel ?? '', b.file ?? '', b.text ?? '')
                     else if (path === '/api/act/remark') {
-                        // ONE remark verb, routed by collection — his words
-                        // land in the item's own truth file
+                        // ONE remark verb, routed by collection: a remark
+                        // lands in the item's own truth file
                         const text = (b.text ?? '').trim()
                         if (text === '') return new Response('empty remark', { status: 400 })
                         if (b.kind === 'ask') appendAskRemark(d.root, d.asksDir, b.file ?? '', text)

package/src/start-repo.ts

@@ -71,8 +71,8 @@ export async function startRepo(name: string, opts: StartOpts = {}): Promise<num
     // 0 → shipkit'd with the one command. init itself stays cwd-only, like
     // git init. A brand-new empty dir gets git + its remote all the same, and
     // is told what is next, because the shipkit scaffold needs a package.json.
-    // --skip means shipkit NEVER TOUCHES that repo (his job repo lives on
-    // this list), not just no CLAUDE.md. And the cd contract survives a
+    // --skip means shipkit NEVER TOUCHES a listed repo (a day-job checkout
+    // belongs on that list), not just no CLAUDE.md. And the cd contract survives a
     // failed adoption: the dir always prints, wiring trouble is a WARN.
     if (!(opts.skip ?? []).includes(name)) {
         // git BEFORE the shipkit scaffold, and whether or not the dir is a

package/src/ts/config.ts

@@ -0,0 +1,185 @@
+// shared config for every rvt tool. Convention: the repo uses absolute
+// import specifiers with explicit extensions — repo-root paths
+// ('src/foo/Bar.ts') in single-package repos; in multi-package repos, files
+// living inside a sub-package (own package.json with a name) are addressed by
+// package name instead ('rvlib-x/src/foo.ts'), so published source resolves
+// identically for npm consumers. Sub-packages are auto-discovered by walking
+// the roots. Config sources, in order:
+//   1. package.json "rvt" field: { roots?: string[], skip?: string[] }
+//      (roots entries may be top-level globs like "rv-*")
+//   2. tsconfig "paths" keys ("src/*" → root 'src') when roots are not set
+//   3. fallback: ['src', 'scripts']
+// skip entries are repo-relative dir prefixes; the defaults below always apply.
+import { existsSync, readdirSync, readFileSync, statSync } from 'fs'
+import { join } from 'path'
+
+export type RvtPackage = {
+   name: string // package.json "name" — the import root for files inside
+   dir: string // repo-relative posix dir of the package
+}
+
+export type RvtConfig = {
+   root: string // absolute repo root
+   roots: string[] // repo-relative dirs to crawl / allowed specifier roots
+   skip: string[] // repo-relative dir prefixes to never touch
+   packages: RvtPackage[] // discovered sub-packages, longest dir first
+}
+
+/** never source, at any depth */
+export const ALWAYS_SKIP = ['node_modules', '.git']
+/** build OUTPUT, and only where output lands: the repo root or a package root.
+ *  Matched at any depth these swallow real source, and a tree like
+ *  `wiki/build/<lib>/src` becomes invisible to every scan (field: a rename
+ *  that rewrote zero references and reported success) */
+export const ARTIFACT_SKIP = ['dist', 'build', 'cjs', 'out']
+export const DEFAULT_SKIP = [...ALWAYS_SKIP, ...ARTIFACT_SKIP]
+
+export function findRepoRoot(cwd: string = process.cwd()): string {
+   const p = Bun.spawnSync(['git', 'rev-parse', '--show-toplevel'], { cwd, stdout: 'pipe', stderr: 'ignore' })
+   const out = p.exitCode === 0 ? p.stdout.toString().trim() : ''
+   return out !== '' ? out : cwd
+}
+
+// tsconfig files are JSONC — strip comments + trailing commas, loosely
+function parseJsonc(text: string): unknown {
+   const noComments = text
+      .replace(/\/\*[\s\S]*?\*\//g, '')
+      .replace(/(^|[^:])\/\/[^\n]*/g, '$1') // keep 'http://...' intact
+   return JSON.parse(noComments.replace(/,\s*([}\]])/g, '$1'))
+}
+
+function rootsFromTsconfig(root: string): string[] {
+   for (const name of ['tsconfig.base.json', 'tsconfig.json']) {
+      const p = join(root, name)
+      if (!existsSync(p)) continue
+      try {
+         const cfg = parseJsonc(readFileSync(p, 'utf8')) as { compilerOptions?: { paths?: Record<string, unknown> } }
+         const keys = Object.keys(cfg.compilerOptions?.paths ?? {})
+         // "src/*" → 'src'; ignore package-fixup mappings like "some-dep"
+         const roots = keys.filter((k) => k.endsWith('/*')).map((k) => k.slice(0, -2)).filter((k) => !k.includes('/') && existsSync(join(root, k)))
+         if (roots.length > 0) return roots
+      } catch {
+         // unparseable tsconfig → fall through to the next source
+      }
+   }
+   return []
+}
+
+// "rv-*" style entries expand against top-level dirs; plain entries pass through
+function expandRootGlobs(root: string, roots: string[]): string[] {
+   const out: string[] = []
+   for (const r of roots) {
+      if (!r.includes('*')) {
+         out.push(r)
+         continue
+      }
+      const re = new RegExp(`^${r.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*')}$`)
+      for (const e of readdirSync(root)) {
+         // statSync try: a dangling top-level symlink must not crash every rvt command
+         let isDir = false
+         try {
+            isDir = statSync(join(root, e)).isDirectory()
+         } catch {}
+         if (re.test(e) && isDir) out.push(e)
+      }
+   }
+   return [...new Set(out)].sort()
+}
+
+// sub-package discovery: any dir under the roots with a named package.json is
+// its own import root (files inside address each other via the package name)
+function discoverPackages(root: string, roots: string[], skip: string[]): RvtPackage[] {
+   const found: RvtPackage[] = []
+   const cfg = { root, roots, skip, packages: [] }
+   const walk = (rel: string): void => {
+      const abs = join(root, rel)
+      let entries
+      try {
+         entries = readdirSync(abs, { withFileTypes: true })
+      } catch {
+         return
+      }
+      const pkgFile = join(abs, 'package.json')
+      if (existsSync(pkgFile)) {
+         try {
+            const name = (JSON.parse(readFileSync(pkgFile, 'utf8')) as { name?: string }).name
+            if (name != null && name !== '') found.push({ name, dir: rel })
+         } catch {
+            // unparseable sub-package manifest → not a package boundary
+         }
+      }
+      for (const e of entries) {
+         if (e.isDirectory() && !isSkipped(`${rel}/${e.name}`, cfg)) walk(`${rel}/${e.name}`)
+      }
+   }
+   for (const r of roots) if (existsSync(join(root, r))) walk(r)
+   // longest dir first: nested packages resolve to the innermost boundary
+   return found.sort((a, b) => b.dir.length - a.dir.length)
+}
+
+export function loadConfig(cwd: string = process.cwd()): RvtConfig {
+   const root = findRepoRoot(cwd)
+   let roots: string[] = []
+   let skip: string[] = []
+   const pkgPath = join(root, 'package.json')
+   if (existsSync(pkgPath)) {
+      try {
+         const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as { rvt?: { roots?: string[]; skip?: string[] } }
+         roots = pkg.rvt?.roots ?? []
+         skip = pkg.rvt?.skip ?? []
+      } catch {
+         // unparseable package.json → defaults
+      }
+   }
+   if (roots.length === 0) roots = rootsFromTsconfig(root)
+   if (roots.length === 0) roots = ['src', 'scripts'].filter((r) => existsSync(join(root, r)))
+   roots = expandRootGlobs(root, roots)
+   const mergedSkip = [...DEFAULT_SKIP, ...skip]
+   const packages = discoverPackages(root, roots, mergedSkip)
+   // a package named like a root (or another package) hijacks that specifier
+   // prefix — resolution would silently diverge from tsc/bun; be loud
+   const seen = new Set<string>(roots)
+   for (const p of packages) {
+      if (seen.has(p.name)) console.error(`rvt WARN: package name '${p.name}' (${p.dir}) collides with a root or another package — its specifiers may resolve wrong`)
+      seen.add(p.name)
+   }
+   return { root, roots, skip: mergedSkip, packages }
+}
+
+// innermost package containing a repo-relative path, or null
+export function packageFor(relPath: string, cfg: RvtConfig): RvtPackage | null {
+   const n = toPosix(relPath)
+   return cfg.packages.find((p) => n === p.dir || n.startsWith(`${p.dir}/`)) ?? null
+}
+
+// canonical specifier for a repo-relative file: package-name form when the
+// file lives inside a sub-package, repo-root form otherwise
+export function canonicalSpecifier(relPath: string, cfg: RvtConfig): string {
+   const pkg = packageFor(relPath, cfg)
+   return pkg == null ? toPosix(relPath) : `${pkg.name}${toPosix(relPath).slice(pkg.dir.length)}`
+}
+
+// resolve a package-name specifier ('rvlib-x/src/a.ts') back to a
+// repo-relative path, or null when no discovered package matches
+export function resolvePackageSpecifier(spec: string, cfg: RvtConfig): string | null {
+   const pkg = cfg.packages.find((p) => spec === p.name || spec.startsWith(`${p.name}/`))
+   return pkg == null ? null : `${pkg.dir}${spec.slice(pkg.name.length)}`
+}
+
+export const toPosix = (p: string): string => p.replace(/\\/g, '/')
+
+// entries with a slash ('src/legacy') match as repo-relative prefixes. A bare
+// name matches any segment when it is never source (node_modules, .git), and
+// only at a package boundary when it names build OUTPUT: `dist` under a
+// package root is output, `wiki/build/<lib>/src` is source.
+export function isSkipped(relPath: string, cfg: RvtConfig, packageDirs: readonly string[] = []): boolean {
+   const n = toPosix(relPath)
+   const segs = n.split('/')
+   return cfg.skip.some((s) => {
+      if (s.includes('/')) return n === s || n.startsWith(`${s}/`)
+      if (!ARTIFACT_SKIP.includes(s)) return segs.includes(s)
+      // output dir: at the repo root, or directly inside a known package
+      if (segs[0] === s) return true
+      return packageDirs.some((d) => n === `${d}/${s}` || n.startsWith(`${d}/${s}/`))
+   })
+}

package/src/ts/cycles.ts

@@ -0,0 +1,205 @@
+// zero-dep circular import detector. The repo uses absolute repo-root import
+// specifiers ('src/...') with explicit .ts extensions, so resolution is string
+// identity: crawl .ts/.tsx files, regex out the runtime import specifiers
+// (type-only imports don't count), build the graph, tarjan the SCCs, enumerate
+// elementary cycles. Runs on a bare checkout, no install needed.
+import { readdirSync, readFileSync } from 'fs'
+import { dirname, join } from 'path'
+import { isSkipped, loadConfig, resolvePackageSpecifier, toPosix, type RvtConfig } from 'rvlib-shipkit/src/ts/config.ts'
+import { templateLineMask } from 'rvlib-shipkit/src/ts/source-mask.ts'
+
+const CYCLE_CAP = 500 // bail loudly instead of exploding on a pathological graph
+
+function crawl(cfg: RvtConfig, dir: string, out: string[]): void {
+   let entries
+   try {
+      entries = readdirSync(join(cfg.root, dir), { withFileTypes: true })
+   } catch {
+      return
+   }
+   for (const entry of entries) {
+      const rel = `${dir}/${entry.name}`
+      if (entry.isDirectory()) {
+         if (!isSkipped(rel, cfg)) crawl(cfg, rel, out)
+      } else if (/\.tsx?$/.test(entry.name) && !entry.name.endsWith('.d.ts')) {
+         out.push(rel)
+      }
+   }
+}
+
+// strip comments (line comments only when preceded by whitespace, so
+// 'http://...' survives) and type-only import/export statements, then extract
+// the remaining runtime specifiers
+export function extractSpecs(content: string): string[] {
+   // template-literal content is text, a codegen emitting import lines inside
+   // a backtick block is not an import of this module. single-line templates
+   // strip in place, multiline ones blank via the shared mask (null mask =
+   // desynced walk, scan everything rather than eat code between backticks)
+   const rawLines = content.split('\n')
+   const mask = templateLineMask(rawLines)
+   const demasked = mask == null ? content : rawLines.map((l, i) => (mask[i] ? '' : l)).join('\n')
+   const cleaned = demasked
+      .replace(/\/\*[\s\S]*?\*\//g, '')
+      .replace(/(^|\s)\/\/[^\n]*/g, '$1')
+      .replace(/`(?:\\.|[^`\\\n])*`/g, '``')
+      .replace(/\b(?:import|export)\s+type\s[^'"]*?from\s*(['"])[^'"\n]*\1/g, '')
+   const specs: string[] = []
+   // import x from / export { x } from — skipped when every specifier is `type X` (erased at runtime)
+   for (const m of cleaned.matchAll(/\b(?:import|export)\s([^'";]*?)from\s*['"]([^'"\n]+)['"]/g)) {
+      const clause = (m[1] ?? '').trim()
+      if (/^\{[^{}]*\}$/.test(clause)) {
+         const items = clause.slice(1, -1).split(',').map((s) => s.trim()).filter((s) => s !== '')
+         if (items.length > 0 && items.every((s) => /^type\s/.test(s))) continue
+      }
+      if (m[2] != null) specs.push(m[2])
+   }
+   for (const re of [
+      /\bimport\s*['"]([^'"\n]+)['"]/g, // side-effect import
+      /\b(?:import|require)\s*\(\s*['"]([^'"\n]+)['"]\s*\)/g, // dynamic import / require
+   ]) {
+      for (const m of cleaned.matchAll(re)) {
+         if (m[1] != null) specs.push(m[1])
+      }
+   }
+   return specs
+}
+
+function resolveSpec(cfg: RvtConfig, fromFile: string, spec: string, fileSet: Set<string>): string | null {
+   let base: string
+   const viaPackage = resolvePackageSpecifier(spec, cfg)
+   if (spec.startsWith('./') || spec.startsWith('../')) {
+      base = toPosix(join(dirname(fromFile), spec))
+   } else if (viaPackage != null) {
+      base = viaPackage // package-name specifier → the sub-package's dir
+   } else if (cfg.roots.some((r) => spec.startsWith(`${r}/`))) {
+      base = spec
+   } else {
+      return null // third-party
+   }
+   for (const candidate of [base, base.replace(/\.js$/, '.ts'), `${base}.ts`, `${base}.tsx`, `${base}/index.ts`, `${base}/index.tsx`]) {
+      if (fileSet.has(candidate)) return candidate
+   }
+   return null
+}
+
+// tarjan strongly connected components, iterative to survive deep graphs
+function tarjanSCCs(nodes: string[], adj: Map<string, string[]>): string[][] {
+   const index = new Map<string, number>()
+   const low = new Map<string, number>()
+   const onStack = new Set<string>()
+   const stack: string[] = []
+   const sccs: string[][] = []
+   let counter = 0
+   for (const start of nodes) {
+      if (index.has(start)) continue
+      const work: [string, number][] = [[start, 0]]
+      while (work.length > 0) {
+         const frame = work[work.length - 1]!
+         const v = frame[0]
+         if (frame[1] === 0) {
+            index.set(v, counter)
+            low.set(v, counter)
+            counter++
+            stack.push(v)
+            onStack.add(v)
+         }
+         const neighbors = adj.get(v) ?? []
+         let recursed = false
+         while (frame[1] < neighbors.length) {
+            const w = neighbors[frame[1]]!
+            frame[1]++
+            if (!index.has(w)) {
+               work.push([w, 0])
+               recursed = true
+               break
+            } else if (onStack.has(w)) {
+               low.set(v, Math.min(low.get(v)!, index.get(w)!))
+            }
+         }
+         if (recursed) continue
+         if (low.get(v) === index.get(v)) {
+            const scc: string[] = []
+            while (true) {
+               const w = stack.pop()!
+               onStack.delete(w)
+               scc.push(w)
+               if (w === v) break
+            }
+            sccs.push(scc)
+         }
+         work.pop()
+         if (work.length > 0) {
+            const parent = work[work.length - 1]![0]
+            low.set(parent, Math.min(low.get(parent)!, low.get(v)!))
+         }
+      }
+   }
+   return sccs
+}
+
+// elementary cycles inside one SCC: dfs from each node, only through nodes ranked >= start
+function cyclesInSCC(scc: string[], adj: Map<string, string[]>): string[][] {
+   const rank = new Map(scc.map((n, i) => [n, i]))
+   const cycles: string[][] = []
+   for (const start of scc) {
+      const startRank = rank.get(start)!
+      const path: string[] = [start]
+      const onPath = new Set([start])
+      const dfs = (v: string): void => {
+         if (cycles.length >= CYCLE_CAP) return
+         for (const w of adj.get(v) ?? []) {
+            const r = rank.get(w)
+            if (r == null || r < startRank) continue
+            if (w === start) cycles.push([...path])
+            else if (!onPath.has(w)) {
+               path.push(w)
+               onPath.add(w)
+               dfs(w)
+               path.pop()
+               onPath.delete(w)
+            }
+         }
+      }
+      dfs(start)
+   }
+   return cycles
+}
+
+export function findCircularDependencies(cfg: RvtConfig = loadConfig()): string[][] {
+   const files: string[] = []
+   for (const root of cfg.roots) crawl(cfg, root, files)
+   files.sort()
+   const fileSet = new Set(files)
+   const adj = new Map<string, string[]>()
+   for (const file of files) {
+      const targets = new Set<string>()
+      for (const spec of extractSpecs(readFileSync(join(cfg.root, file), 'utf8'))) {
+         const target = resolveSpec(cfg, file, spec, fileSet)
+         if (target != null && target !== file) targets.add(target)
+      }
+      adj.set(file, [...targets].sort())
+   }
+   const cycles: string[][] = []
+   for (const scc of tarjanSCCs(files, adj)) {
+      if (scc.length < 2) continue
+      cycles.push(...cyclesInSCC(scc.sort(), adj))
+   }
+   if (cycles.length >= CYCLE_CAP) {
+      throw new Error(`cycle enumeration hit the cap (${CYCLE_CAP}); graph is pathologically cyclic`)
+   }
+   return cycles
+}
+
+// exit 0 when cycles <= max, 1 otherwise — the arg is a CI ratchet
+export function cyclesCli(argv: string[]): number {
+   const parsed = Number(argv[0] ?? '1')
+   const max = Number.isFinite(parsed) && parsed >= 0 ? parsed : 1 // 0 is a legit ratchet
+   const started = performance.now()
+   const cycles = findCircularDependencies()
+   cycles.forEach((cycle, ix) => {
+      console.log(`Cycle ${ix + 1}:`)
+      cycle.forEach((node, cix) => console.log(`  ${cix + 1}. ${node}`))
+   })
+   console.log(`${cycles.length} cycles found in ${Math.round(performance.now() - started)}ms (max allowed: ${max})`)
+   return cycles.length > max ? 1 : 0
+}