@esneiderbravo/speclaw 0.3.1 → 0.3.3

package/dist/modules/foundation/graph.js

@@ -0,0 +1,215 @@
+import { underPaths } from "./verify.js";
+/** Build the cross-file dependency graph, restricted to `paths` when given. */
+function buildGraph(db, paths) {
+    const rows = db
+        .prepare(`SELECT DISTINCT sf.path AS src, df.path AS dst
+       FROM edges e
+       JOIN files sf ON sf.id = e.src_file_id
+       JOIN nodes dn ON dn.id = e.dst_node_id
+       JOIN files df ON df.id = dn.file_id
+       WHERE e.dst_node_id IS NOT NULL AND sf.path <> df.path`)
+        .all();
+    const adj = new Map();
+    for (const { src, dst } of rows) {
+        if (!underPaths(src, paths) || !underPaths(dst, paths))
+            continue;
+        const list = adj.get(src);
+        if (list)
+            list.push(dst);
+        else
+            adj.set(src, [dst]);
+        if (!adj.has(dst))
+            adj.set(dst, []);
+    }
+    return adj;
+}
+/**
+ * Iterative Tarjan strongly-connected-components. Written with an explicit work
+ * stack so a deep import chain cannot overflow the call stack.
+ *
+ * @param adj - The directed graph.
+ * @returns The list of SCCs, each a list of node ids.
+ */
+export function tarjanSCC(adj) {
+    const index = new Map();
+    const low = new Map();
+    const onStack = new Set();
+    const stack = [];
+    const sccs = [];
+    let counter = 0;
+    for (const root of adj.keys()) {
+        if (index.has(root))
+            continue;
+        const work = [{ node: root, i: 0 }];
+        while (work.length > 0) {
+            const frame = work[work.length - 1];
+            const { node } = frame;
+            if (frame.i === 0) {
+                index.set(node, counter);
+                low.set(node, counter);
+                counter++;
+                stack.push(node);
+                onStack.add(node);
+            }
+            const neighbors = adj.get(node) ?? [];
+            if (frame.i < neighbors.length) {
+                const next = neighbors[frame.i];
+                frame.i++;
+                if (!index.has(next)) {
+                    work.push({ node: next, i: 0 });
+                }
+                else if (onStack.has(next)) {
+                    low.set(node, Math.min(low.get(node), index.get(next)));
+                }
+                continue;
+            }
+            // All neighbors visited: settle this node, propagating low-links up.
+            if (low.get(node) === index.get(node)) {
+                const scc = [];
+                for (;;) {
+                    const w = stack.pop();
+                    onStack.delete(w);
+                    scc.push(w);
+                    if (w === node)
+                        break;
+                }
+                sccs.push(scc);
+            }
+            work.pop();
+            const parent = work[work.length - 1];
+            if (parent)
+                low.set(parent.node, Math.min(low.get(parent.node), low.get(node)));
+        }
+    }
+    return sccs;
+}
+/**
+ * The shortest cycle passing through `start`, via BFS over the induced subgraph.
+ *
+ * @param start - The node to find a return path to.
+ * @param within - The set of nodes the search is restricted to (one SCC).
+ * @param adj - The full graph.
+ * @returns The cycle as an ordered node list `[start, …]`, or null if none.
+ */
+function shortestCycleThrough(start, within, adj) {
+    const parent = new Map();
+    const visited = new Set([start]);
+    let queue = [start];
+    while (queue.length > 0) {
+        const next = [];
+        for (const node of queue) {
+            for (const neighbor of adj.get(node) ?? []) {
+                if (!within.has(neighbor))
+                    continue;
+                if (neighbor === start) {
+                    // Reconstruct start → … → node, which closes back to start.
+                    const path = [node];
+                    let cur = node;
+                    while (cur !== start) {
+                        cur = parent.get(cur);
+                        path.push(cur);
+                    }
+                    path.reverse();
+                    return path;
+                }
+                if (!visited.has(neighbor)) {
+                    visited.add(neighbor);
+                    parent.set(neighbor, node);
+                    next.push(neighbor);
+                }
+            }
+        }
+        queue = next;
+    }
+    return null;
+}
+/** Findings for the `circular` rule: one minimal cycle per multi-node SCC. */
+function circularFindings(law, adj) {
+    const findings = [];
+    for (const scc of tarjanSCC(adj)) {
+        if (scc.length < 2)
+            continue;
+        const within = new Set(scc);
+        let best = null;
+        for (const node of scc) {
+            const cycle = shortestCycleThrough(node, within, adj);
+            if (cycle && (best === null || cycle.length < best.length))
+                best = cycle;
+        }
+        if (!best)
+            continue;
+        findings.push({
+            lawId: law.id,
+            severity: law.severity,
+            engine: "graph",
+            file: best[0],
+            message: law.prose,
+            detail: `cycle: ${[...best, best[0]].join(" → ")} (SCC size ${scc.length})`,
+        });
+    }
+    return findings;
+}
+/** Findings for the `reachable` rule: a `from` file transitively reaches a `to` file. */
+function reachableFindings(law, rule, adj) {
+    const fromRe = new RegExp(rule.from);
+    const toRe = new RegExp(rule.to);
+    const findings = [];
+    for (const src of adj.keys()) {
+        if (!fromRe.test(src))
+            continue;
+        const seen = new Set([src]);
+        let queue = [src];
+        let hit = null;
+        while (queue.length > 0 && !hit) {
+            const next = [];
+            for (const node of queue) {
+                for (const neighbor of adj.get(node) ?? []) {
+                    if (seen.has(neighbor))
+                        continue;
+                    if (toRe.test(neighbor)) {
+                        hit = neighbor;
+                        break;
+                    }
+                    seen.add(neighbor);
+                    next.push(neighbor);
+                }
+                if (hit)
+                    break;
+            }
+            queue = next;
+        }
+        if (hit) {
+            findings.push({
+                lawId: law.id,
+                severity: law.severity,
+                engine: "graph",
+                file: src,
+                message: law.prose,
+                detail: `transitively reaches ${hit}`,
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Evaluate one `graph` law: forbidden dependency cycles and/or forbidden
+ * transitive reachability, over the file-level import graph.
+ *
+ * @param db - An open connection to the project's index.
+ * @param law - The `graph` law to evaluate.
+ * @param paths - Optional project-relative paths restricting the graph.
+ * @returns The findings; `unresolved` is always 0 (cycles are read off the
+ *   resolved graph, so a graph law never reports an unknown here).
+ */
+export function runGraphLaw(db, law, paths) {
+    const rule = law.verification.rule;
+    const adj = buildGraph(db, paths);
+    const findings = [];
+    const wantReachable = rule.reachable === true && rule.from != null && rule.to != null;
+    const wantCircular = rule.circular === true || (!rule.circular && !wantReachable);
+    if (wantCircular)
+        findings.push(...circularFindings(law, adj));
+    if (wantReachable)
+        findings.push(...reachableFindings(law, rule, adj));
+    return { findings, unresolved: 0 };
+}

package/dist/modules/foundation/hooks.js

@@ -0,0 +1,165 @@
+import fs from "node:fs";
+import path from "node:path";
+import { agentById } from "../../shared/agents.js";
+import { sha256 } from "../../shared/install.js";
+import { globError, hasBackend } from "./laws.js";
+/** The speclaw hook object — its `{type, server}` pair is the merge identity. */
+const SPECLAW_HOOK = {
+    type: "mcp_tool",
+    server: "speclaw",
+    tool: "speclaw_check",
+    timeout: 5,
+};
+/** Tool-name matcher for the file-mutating tools the `path` backend can evaluate. */
+const MUTATION_MATCHER = "Write|Edit|MultiEdit|NotebookEdit";
+/** True when a hook object is one speclaw owns (safe to replace on merge). */
+function isSpeclawHook(h) {
+    const o = h;
+    return o?.type === "mcp_tool" && o?.server === "speclaw";
+}
+/**
+ * Compile a law manifest into the hook groups speclaw contributes, one per event
+ * the laws demand: `PreToolUse` when any `bloqueo` law exists, `PostToolUse` for
+ * `feedback`, `Stop` for `gate`, and `InstructionsLoaded` whenever any law exists
+ * (the context-coverage audit). A law whose scope contains a malformed glob is
+ * excluded and reported, so a bad pattern fails loudly at generation rather than
+ * silently matching nothing at runtime.
+ *
+ * @param manifest - The project's law manifest.
+ * @returns The per-event hook groups and the list of laws rejected for bad globs.
+ */
+export function compileHooks(manifest) {
+    const invalid = [];
+    const valid = [];
+    for (const law of manifest.laws) {
+        const bad = law.scope.map((p) => ({ p, e: globError(p) })).find((x) => x.e);
+        if (bad)
+            invalid.push({ lawId: law.id, pattern: bad.p, error: bad.e });
+        else
+            valid.push(law);
+    }
+    const byEvent = {};
+    const hasBloqueo = valid.some((l) => l.enforcement === "bloqueo" && hasBackend(l));
+    const hasFeedback = valid.some((l) => l.enforcement === "feedback" && hasBackend(l));
+    const hasGate = valid.some((l) => l.enforcement === "gate");
+    if (hasBloqueo)
+        byEvent.PreToolUse = [{ matcher: MUTATION_MATCHER, hooks: [{ ...SPECLAW_HOOK }] }];
+    if (hasFeedback)
+        byEvent.PostToolUse = [{ matcher: MUTATION_MATCHER, hooks: [{ ...SPECLAW_HOOK }] }];
+    if (hasGate)
+        byEvent.Stop = [{ hooks: [{ ...SPECLAW_HOOK }] }];
+    if (valid.length > 0)
+        byEvent.InstructionsLoaded = [{ hooks: [{ ...SPECLAW_HOOK }] }];
+    return { byEvent, invalid };
+}
+/**
+ * Merge speclaw's compiled hook groups into an existing `hooks` object by
+ * identity: for every event, drop the groups speclaw owns (a group whose hooks
+ * are all speclaw's) and re-add the freshly compiled ones, never touching a
+ * group with a foreign `server` or `type`. Idempotent, marker-free, and it
+ * cannot delete another tool's hooks.
+ *
+ * @param existing - The current `hooks` object from the agent's settings (any shape).
+ * @param compiled - speclaw's per-event hook groups from {@link compileHooks}.
+ * @returns A new `hooks` object with speclaw's entries reconciled in.
+ */
+export function mergeHooks(existing, compiled) {
+    const out = {};
+    const events = new Set([...Object.keys(existing ?? {}), ...Object.keys(compiled)]);
+    for (const event of events) {
+        const prior = Array.isArray(existing?.[event]) ? existing[event] : [];
+        // Keep foreign groups: drop speclaw hooks from each group, then any group left empty.
+        const kept = prior
+            .map((g) => ({ ...g, hooks: (g.hooks ?? []).filter((h) => !isSpeclawHook(h)) }))
+            .filter((g) => g.hooks.length > 0);
+        const mine = compiled[event] ?? [];
+        const merged = [...kept, ...mine];
+        if (merged.length > 0)
+            out[event] = merged;
+    }
+    return out;
+}
+/**
+ * Install (or refresh) speclaw's hooks into one agent's settings file, merging by
+ * identity and honoring the managed-file baseline: a settings file that diverged
+ * from what speclaw last wrote is backed up to `<file>.bak` first when `backup`
+ * is set, and always reported. The baseline sha of the written file is recorded.
+ *
+ * @param projectPath - Project root.
+ * @param agent - The agent whose `hooks` capability names the settings file and key.
+ * @param compiled - speclaw's compiled hook groups.
+ * @param report - Install report mutated in place.
+ * @param opts - Managed-file behavior: recorded baselines, backup, and a record sink.
+ */
+function installForAgent(projectPath, agent, compiled, report, opts) {
+    if (!agent.hooks)
+        return;
+    const settingsPath = path.join(projectPath, agent.hooks.file);
+    const rel = path.relative(projectPath, settingsPath);
+    let settings = {};
+    let current = null;
+    if (fs.existsSync(settingsPath)) {
+        current = fs.readFileSync(settingsPath, "utf8");
+        try {
+            settings = JSON.parse(current);
+        }
+        catch {
+            // A settings file we cannot parse is the user's — never clobber it silently.
+            report.skipped.push(`${settingsPath} (unparseable — left untouched)`);
+            return;
+        }
+    }
+    settings[agent.hooks.key] = mergeHooks(settings[agent.hooks.key], compiled);
+    const content = JSON.stringify(settings, null, 2) + "\n";
+    const newSha = sha256(content);
+    if (current !== null) {
+        if (sha256(current) === newSha) {
+            if (opts.record)
+                opts.record[rel] = newSha;
+            return; // already current — no drift
+        }
+        const baseline = opts.baselines?.[rel];
+        if (!baseline || sha256(current) !== baseline) {
+            if (opts.backup) {
+                fs.copyFileSync(settingsPath, settingsPath + ".bak");
+                report.backedUp.push(settingsPath);
+            }
+            report.refreshedDiverged.push(settingsPath);
+        }
+    }
+    fs.mkdirSync(path.dirname(settingsPath), { recursive: true });
+    fs.writeFileSync(settingsPath, content);
+    report.written.push(`${settingsPath} (speclaw hooks)`);
+    if (opts.record)
+        opts.record[rel] = newSha;
+}
+/**
+ * Compile the manifest and install speclaw's hooks into every hook-capable agent
+ * among those selected, skipping agents without a `hooks` capability (Cursor,
+ * Codex, Windsurf) by construction. A malformed glob excludes only that law and
+ * is surfaced in the result.
+ *
+ * @param projectPath - Project root.
+ * @param agentIds - Ids of the agents configured for this project.
+ * @param manifest - The project's law manifest.
+ * @param report - Install report mutated in place.
+ * @param opts - Managed-file behavior: recorded baselines, backup, and a record sink.
+ * @returns Which agents were hooked, which were skipped, and any rejected laws.
+ */
+export function installHooks(projectPath, agentIds, manifest, report, opts) {
+    const { byEvent, invalid } = compileHooks(manifest);
+    const hooked = [];
+    const unhooked = [];
+    for (const id of agentIds) {
+        const agent = agentById(id);
+        if (!agent)
+            continue;
+        if (!agent.hooks) {
+            unhooked.push(id);
+            continue;
+        }
+        installForAgent(projectPath, agent, byEvent, report, opts);
+        hooked.push(id);
+    }
+    return { hooked, unhooked, invalid };
+}

package/dist/modules/foundation/laws.js

@@ -0,0 +1,284 @@
+import fs from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { assetsDir } from "../../shared/paths.js";
+// The machine-readable law model and its manifest. This is the contract seam
+// (`.speclaw/laws-manifest.json`) between where laws come from and how they are
+// enforced: check-dispatcher owns the schema and the single `path` verification
+// backend; executable-laws extends the same model with `ast`/`deps`/`process`
+// backends by filling in more `verification.kind` cases — it never rewrites it.
+const ASSETS = assetsDir(import.meta.url);
+const depsRuleSchema = z.object({
+    name: z.string().optional(),
+    from: z.string(),
+    to: z.string(),
+    toNot: z.string().optional(),
+    type: z.enum(["forbidden", "required"]).optional(),
+    edgeKinds: z.array(z.string()).optional(),
+});
+const graphRuleSchema = z.object({
+    name: z.string().optional(),
+    circular: z.boolean().optional(),
+    reachable: z.boolean().optional(),
+    from: z.string().optional(),
+    to: z.string().optional(),
+});
+const verificationSchema = z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("path") }),
+    z.object({ kind: z.literal("deps"), rule: depsRuleSchema }),
+    z.object({ kind: z.literal("graph"), rule: graphRuleSchema }),
+    z.object({ kind: z.literal("ast") }),
+    z.object({ kind: z.literal("process") }),
+    z.object({ kind: z.literal("traceability") }),
+    z.object({ kind: z.literal("semantic") }),
+    z.object({ kind: z.literal("none") }),
+]);
+const lawSchema = z.object({
+    id: z.string().min(1),
+    title: z.string().min(1),
+    rationale: z.string().optional(),
+    severity: z.enum(["error", "warn", "info"]),
+    scope: z.array(z.string()),
+    prose: z.string().min(1),
+    verification: verificationSchema,
+    enforcement: z.enum(["bloqueo", "feedback", "gate"]),
+    source: z.object({ file: z.string(), line: z.number().optional() }),
+});
+// Reject a malformed `from`/`to` regex when the manifest is validated — naming
+// the law id, not a bare array index — rather than letting it explode at verify
+// time. Mirrors the generation-time treatment of malformed globs.
+const manifestSchema = z
+    .object({
+    version: z.number(),
+    laws: z.array(lawSchema),
+})
+    .superRefine((manifest, ctx) => {
+    manifest.laws.forEach((law, i) => {
+        const v = law.verification;
+        const patterns = [];
+        if (v.kind === "deps") {
+            patterns.push(["from", v.rule.from], ["to", v.rule.to], ["toNot", v.rule.toNot]);
+        }
+        else if (v.kind === "graph") {
+            patterns.push(["from", v.rule.from], ["to", v.rule.to]);
+        }
+        for (const [field, pattern] of patterns) {
+            if (pattern == null)
+                continue;
+            const err = regexError(pattern);
+            if (err) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path: ["laws", i, "verification", "rule", field],
+                    message: `${law.id}: verification.rule.${field} is not a valid regular expression (${err})`,
+                });
+            }
+        }
+    });
+});
+/** Backends evaluated on the action-time hot path (`speclaw_check`) — glob only. */
+export const IMPLEMENTED_BACKENDS = ["path"];
+/** Backends evaluated by the batch verifier (`law_verify`) — they read the index. */
+export const BATCH_BACKENDS = ["deps", "graph"];
+/** True when a law is evaluated on the action-time hot path (only `path` today). */
+export function hasBackend(law) {
+    return IMPLEMENTED_BACKENDS.includes(law.verification.kind);
+}
+/** True when a law is evaluated by the batch verifier (`deps`/`graph`). */
+export function hasBatchBackend(law) {
+    return BATCH_BACKENDS.includes(law.verification.kind);
+}
+/**
+ * Validate a regular expression without using it, so manifest generation and
+ * `doctor` can fail loudly on a malformed `from`/`to` pattern.
+ *
+ * @param pattern - A regular-expression source string.
+ * @returns An error message if the pattern does not compile, else null.
+ */
+export function regexError(pattern) {
+    try {
+        new RegExp(pattern);
+        return null;
+    }
+    catch (err) {
+        return err.message;
+    }
+}
+/** Absolute path to a project's compiled law manifest (under the gitignored `.speclaw/`). */
+export function manifestPath(projectPath) {
+    return path.join(projectPath, ".speclaw", "laws-manifest.json");
+}
+/**
+ * Read and validate a project's law manifest.
+ *
+ * @param projectPath - Project root to read from.
+ * @returns The parsed manifest, or null if it is missing or unparseable (the
+ *   caller fails open — a broken manifest never blocks the agent).
+ */
+export function readLawManifest(projectPath) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(manifestPath(projectPath), "utf8"));
+        return manifestSchema.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write a project's law manifest, validating every law first.
+ *
+ * @param projectPath - Project root to write into.
+ * @param manifest - The manifest to persist; each law is schema-validated.
+ * @throws If any law fails validation.
+ */
+export function writeLawManifest(projectPath, manifest) {
+    const validated = manifestSchema.parse(manifest);
+    const p = manifestPath(projectPath);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify(validated, null, 2) + "\n");
+}
+/**
+ * The starter law manifest shipped with speclaw, seeded from a speclaw-style
+ * project's own `path`-verifiable Project-specific laws. It is the source the
+ * MVP compiles into `.speclaw/laws-manifest.json`; once executable-laws lands,
+ * laws are authored in `docs/standards/*` and compiled here instead. Laws whose
+ * scope does not match a given repo are simply inert there.
+ *
+ * @returns The validated seed manifest read from the module's assets.
+ * @throws If the seed asset is missing or fails validation.
+ */
+export function seedManifest() {
+    const raw = JSON.parse(fs.readFileSync(path.join(ASSETS, "laws", "laws-manifest.json"), "utf8"));
+    return manifestSchema.parse(raw);
+}
+// ─── Glob matching (the `path` backend) ──────────────────────────────────────
+/**
+ * Validate a scope glob without compiling it for use, so generation can fail
+ * loudly on a malformed pattern (e.g. an unclosed `[`) rather than silently
+ * matching zero files at runtime.
+ *
+ * @param pattern - A single scope glob (a leading `!` negation is allowed).
+ * @returns An error message if the glob is malformed, else null.
+ */
+export function globError(pattern) {
+    try {
+        compileGlob(pattern);
+        return null;
+    }
+    catch (err) {
+        return err.message;
+    }
+}
+/** Regex-special characters that are literals in a glob and must be escaped. */
+const REGEX_SPECIALS = new Set([".", "+", "^", "$", "(", ")", "|", "\\"]);
+/**
+ * Compile a glob into an anchored regular expression matching a POSIX-style
+ * relative path. Supports `**` (any run of segments), `*`/`?` (within a
+ * segment), `{a,b}` alternation, and `[...]`/`[!...]` character classes.
+ *
+ * @param pattern - A single scope glob; a leading `!` is stripped by the caller.
+ * @returns A `RegExp` anchored to the whole path.
+ * @throws If the glob contains an unclosed `[` or `{`.
+ */
+export function compileGlob(pattern) {
+    let re = "";
+    let braceDepth = 0;
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (ch === "*") {
+            if (pattern[i + 1] === "*") {
+                // `**` (optionally followed by `/`) spans any number of segments.
+                i++;
+                if (pattern[i + 1] === "/")
+                    i++;
+                re += "(?:[^/]*(?:/|$))*";
+            }
+            else {
+                re += "[^/]*";
+            }
+        }
+        else if (ch === "?") {
+            re += "[^/]";
+        }
+        else if (ch === "{") {
+            braceDepth++;
+            re += "(?:";
+        }
+        else if (ch === "}") {
+            if (braceDepth === 0)
+                throw new Error(`unmatched '}' in glob: ${pattern}`);
+            braceDepth--;
+            re += ")";
+        }
+        else if (ch === "," && braceDepth > 0) {
+            re += "|";
+        }
+        else if (ch === "[") {
+            const close = pattern.indexOf("]", i + 1);
+            if (close === -1)
+                throw new Error(`unclosed '[' in glob: ${pattern}`);
+            let cls = pattern.slice(i + 1, close);
+            if (cls.startsWith("!"))
+                cls = "^" + cls.slice(1);
+            re += `[${cls}]`;
+            i = close;
+        }
+        else if (REGEX_SPECIALS.has(ch)) {
+            re += "\\" + ch;
+        }
+        else {
+            re += ch;
+        }
+    }
+    if (braceDepth !== 0)
+        throw new Error(`unclosed '{' in glob: ${pattern}`);
+    return new RegExp(`^${re}$`);
+}
+/**
+ * Compile a law's scope globs into regexes once, so runtime matching does no
+ * regex compilation on the critical path. Malformed globs are dropped (they are
+ * caught and reported at generation time).
+ *
+ * @param scope - The law's scope globs.
+ * @returns The compiled positive and negative matchers.
+ */
+export function compileScope(scope) {
+    const positives = [];
+    const negatives = [];
+    for (const g of scope) {
+        const negated = g.startsWith("!");
+        try {
+            (negated ? negatives : positives).push(compileGlob(negated ? g.slice(1) : g));
+        }
+        catch {
+            // Skip malformed globs — generation already flagged them.
+        }
+    }
+    return { matchAll: scope.length === 0, positives, negatives };
+}
+/**
+ * Test a target path against a pre-compiled scope. Positive globs are OR-ed; a
+ * `!`-prefixed glob excludes; an empty scope matches everything.
+ *
+ * @param compiled - The scope compiled by {@link compileScope}.
+ * @param target - A POSIX-style project-relative path (forward slashes).
+ * @returns True when the target is in scope.
+ */
+export function matchCompiled(compiled, target) {
+    const included = compiled.matchAll ||
+        compiled.positives.length === 0 ||
+        compiled.positives.some((r) => r.test(target));
+    return included && !compiled.negatives.some((r) => r.test(target));
+}
+/**
+ * Test whether a target path matches a law's scope, compiling on the spot.
+ * Convenience for non-hot paths (doctor, dry-run); the evaluator uses
+ * {@link compileScope} + {@link matchCompiled} to stay off the compiler.
+ *
+ * @param scope - The law's scope globs.
+ * @param target - A POSIX-style project-relative path (forward slashes).
+ * @returns True when the target is in scope. Malformed globs never match.
+ */
+export function matchesScope(scope, target) {
+    return matchCompiled(compileScope(scope), target);
+}