@paparats/shared 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ilya Bazylchuk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,15 @@
+# @paparats/shared
+
+Shared utilities for [Paparats MCP](https://github.com/IBazylchuk/paparats-mcp): path validation, gitignore filtering, exclude patterns.
+
+## Install
+
+```bash
+npm install @paparats/shared
+```
+
+## Usage
+
+```ts
+import { validateIndexingPaths, createGitignoreFilter, normalizeExcludePatterns } from '@paparats/shared';
+```

package/dist/exclude-patterns.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Normalize exclude patterns: bare dir names become glob patterns to ignore entire dirs.
+ * Patterns with / or ** are left unchanged.
+ */
+export declare function normalizeExcludePatterns(patterns: string[]): string[];
+//# sourceMappingURL=exclude-patterns.d.ts.map

package/dist/exclude-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclude-patterns.d.ts","sourceRoot":"","sources":["../src/exclude-patterns.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAKrE"}

package/dist/exclude-patterns.js

@@ -0,0 +1,12 @@
+/**
+ * Normalize exclude patterns: bare dir names become glob patterns to ignore entire dirs.
+ * Patterns with / or ** are left unchanged.
+ */
+export function normalizeExcludePatterns(patterns) {
+    return patterns.map((p) => {
+        if (p.includes('/') || p.includes('**'))
+            return p;
+        return `**/${p.replace(/^\//, '')}/**`;
+    });
+}
+//# sourceMappingURL=exclude-patterns.js.map

package/dist/exclude-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclude-patterns.js","sourceRoot":"","sources":["../src/exclude-patterns.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAkB;IACzD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/gitignore.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Create a filter that returns true if the absolute path should be ignored by .gitignore.
+ * Returns null if .gitignore doesn't exist. Paths must be relative to projectDir for matching.
+ */
+export declare function createGitignoreFilter(projectDir: string): ((absPath: string) => boolean) | null;
+/**
+ * Filter file list by .gitignore. Returns files unchanged if .gitignore doesn't exist.
+ */
+export declare function filterFilesByGitignore(files: string[], projectDir: string): string[];
+//# sourceMappingURL=gitignore.d.ts.map

package/dist/gitignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.d.ts","sourceRoot":"","sources":["../src/gitignore.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAwB/F;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAIpF"}

package/dist/gitignore.js

@@ -0,0 +1,39 @@
+import fs from 'fs';
+import path from 'path';
+import ignore from 'ignore';
+const GITIGNORE = '.gitignore';
+/**
+ * Create a filter that returns true if the absolute path should be ignored by .gitignore.
+ * Returns null if .gitignore doesn't exist. Paths must be relative to projectDir for matching.
+ */
+export function createGitignoreFilter(projectDir) {
+    const gitignorePath = path.join(projectDir, GITIGNORE);
+    if (!fs.existsSync(gitignorePath))
+        return null;
+    let content;
+    try {
+        content = fs.readFileSync(gitignorePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    // CJS package; Node16 resolution types don't match. Runtime works.
+    const ig = ignore().add(content);
+    return (absPath) => {
+        const rel = path.relative(projectDir, absPath);
+        if (rel.startsWith('..') || path.isAbsolute(rel))
+            return false;
+        const normalized = rel.split(path.sep).join('/');
+        return ig.ignores(normalized);
+    };
+}
+/**
+ * Filter file list by .gitignore. Returns files unchanged if .gitignore doesn't exist.
+ */
+export function filterFilesByGitignore(files, projectDir) {
+    const filter = createGitignoreFilter(projectDir);
+    if (!filter)
+        return files;
+    return files.filter((f) => !filter(f));
+}
+//# sourceMappingURL=gitignore.js.map

package/dist/gitignore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.js","sourceRoot":"","sources":["../src/gitignore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,SAAS,GAAG,YAAY,CAAC;AAE/B;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,MAAM,EAAE,GACN,MAGD,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAW,EAAE;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAe,EAAE,UAAkB;IACxE,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/gitignore.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gitignore.test.d.ts.map

package/dist/gitignore.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.test.d.ts","sourceRoot":"","sources":["../src/gitignore.test.ts"],"names":[],"mappings":""}

package/dist/gitignore.test.js

@@ -0,0 +1,67 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { createGitignoreFilter, filterFilesByGitignore } from './gitignore.js';
+function createTempDir() {
+    const tmpDir = path.join(os.tmpdir(), `paparats-gitignore-test-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    fs.mkdirSync(tmpDir, { recursive: true });
+    return tmpDir;
+}
+describe('createGitignoreFilter', () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = createTempDir();
+    });
+    afterEach(() => {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it('returns null when .gitignore does not exist', () => {
+        expect(createGitignoreFilter(tmpDir)).toBeNull();
+    });
+    it('ignores files matching .gitignore patterns', () => {
+        fs.writeFileSync(path.join(tmpDir, '.gitignore'), 'node_modules\n*.log\n');
+        const filter = createGitignoreFilter(tmpDir);
+        expect(filter).not.toBeNull();
+        const ig = filter;
+        expect(ig(path.join(tmpDir, 'node_modules', 'pkg', 'index.js'))).toBe(true);
+        expect(ig(path.join(tmpDir, 'foo.log'))).toBe(true);
+        expect(ig(path.join(tmpDir, 'src', 'index.ts'))).toBe(false);
+    });
+    it('respects negation patterns', () => {
+        fs.writeFileSync(path.join(tmpDir, '.gitignore'), '*.log\n!important.log\n');
+        const filter = createGitignoreFilter(tmpDir);
+        expect(filter).not.toBeNull();
+        const ig = filter;
+        expect(ig(path.join(tmpDir, 'foo.log'))).toBe(true);
+        expect(ig(path.join(tmpDir, 'important.log'))).toBe(false);
+    });
+    it('ignores directory when pattern ends with slash', () => {
+        fs.writeFileSync(path.join(tmpDir, '.gitignore'), 'build/\n');
+        const filter = createGitignoreFilter(tmpDir);
+        expect(filter).not.toBeNull();
+        const ig = filter;
+        expect(ig(path.join(tmpDir, 'build', 'output.js'))).toBe(true);
+    });
+});
+describe('filterFilesByGitignore', () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = createTempDir();
+    });
+    afterEach(() => {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it('returns files unchanged when .gitignore does not exist', () => {
+        const files = [path.join(tmpDir, 'src', 'a.ts'), path.join(tmpDir, 'src', 'b.ts')];
+        expect(filterFilesByGitignore(files, tmpDir)).toEqual(files);
+    });
+    it('filters out gitignored files', () => {
+        fs.writeFileSync(path.join(tmpDir, '.gitignore'), 'secrets/\n');
+        const files = [path.join(tmpDir, 'src', 'index.ts'), path.join(tmpDir, 'secrets', 'key.ts')];
+        const result = filterFilesByGitignore(files, tmpDir);
+        expect(result).toHaveLength(1);
+        expect(result[0]).toContain('src/index.ts');
+    });
+});
+//# sourceMappingURL=gitignore.test.js.map

package/dist/gitignore.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.test.js","sourceRoot":"","sources":["../src/gitignore.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,SAAS,aAAa;IACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CACtB,EAAE,CAAC,MAAM,EAAE,EACX,2BAA2B,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAC/E,CAAC;IACF,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,aAAa,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAO,CAAC;QACnB,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAO,CAAC;QACnB,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAO,CAAC;QACnB,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,aAAa,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACnF,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { validateIndexingPaths } from './path-validation.js';
+export { normalizeExcludePatterns } from './exclude-patterns.js';
+export { createGitignoreFilter, filterFilesByGitignore } from './gitignore.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { validateIndexingPaths } from './path-validation.js';
+export { normalizeExcludePatterns } from './exclude-patterns.js';
+export { createGitignoreFilter, filterFilesByGitignore } from './gitignore.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/path-validation.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Validate indexing paths: no absolute paths, no path traversal.
+ * Ensures all paths stay within the project directory to prevent
+ * reading sensitive files from outside the project (e.g. via malicious .paparats.yml).
+ */
+export declare function validateIndexingPaths(paths: string[], projectDir: string): void;
+//# sourceMappingURL=path-validation.d.ts.map

package/dist/path-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-validation.d.ts","sourceRoot":"","sources":["../src/path-validation.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAY/E"}

package/dist/path-validation.js

@@ -0,0 +1,20 @@
+import path from 'path';
+/**
+ * Validate indexing paths: no absolute paths, no path traversal.
+ * Ensures all paths stay within the project directory to prevent
+ * reading sensitive files from outside the project (e.g. via malicious .paparats.yml).
+ */
+export function validateIndexingPaths(paths, projectDir) {
+    const resolvedProject = path.resolve(projectDir);
+    for (const p of paths) {
+        if (path.isAbsolute(p)) {
+            throw new Error(`Absolute paths not allowed in indexing.paths: ${p}`);
+        }
+        const fullPath = path.resolve(projectDir, p);
+        const relative = path.relative(resolvedProject, fullPath);
+        if (relative.startsWith('..') || path.isAbsolute(relative)) {
+            throw new Error(`Path must be inside project directory: ${p}`);
+        }
+    }
+}
+//# sourceMappingURL=path-validation.js.map

package/dist/path-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-validation.js","sourceRoot":"","sources":["../src/path-validation.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAe,EAAE,UAAkB;IACvE,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/path-validation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=path-validation.test.d.ts.map

package/dist/path-validation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-validation.test.d.ts","sourceRoot":"","sources":["../src/path-validation.test.ts"],"names":[],"mappings":""}

package/dist/path-validation.test.js

@@ -0,0 +1,20 @@
+import { describe, it, expect } from 'vitest';
+import path from 'path';
+import { validateIndexingPaths } from './path-validation.js';
+describe('validateIndexingPaths', () => {
+    const projectDir = path.resolve('/some/project');
+    it('accepts valid relative paths', () => {
+        expect(() => validateIndexingPaths(['./', 'src', 'lib/'], projectDir)).not.toThrow();
+    });
+    it('rejects absolute paths', () => {
+        const absolutePath = path.sep === '\\' ? 'C:\\tmp' : '/tmp';
+        expect(() => validateIndexingPaths([absolutePath], projectDir)).toThrow('Absolute paths not allowed in indexing.paths');
+    });
+    it('rejects path traversal', () => {
+        expect(() => validateIndexingPaths(['../../etc'], projectDir)).toThrow('Path must be inside project directory');
+    });
+    it('rejects path traversal with single parent', () => {
+        expect(() => validateIndexingPaths(['../'], projectDir)).toThrow('Path must be inside project directory');
+    });
+});
+//# sourceMappingURL=path-validation.test.js.map

package/dist/path-validation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-validation.test.js","sourceRoot":"","sources":["../src/path-validation.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAEjD,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CACrE,8CAA8C,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CACpE,uCAAuC,CACxC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAC9D,uCAAuC,CACxC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@paparats/shared",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Shared utilities for Paparats MCP (path validation, gitignore filtering, exclude patterns)",
+  "license": "MIT",
+  "author": "Ilya Bazylchuk",
+  "homepage": "https://github.com/IBazylchuk/paparats-mcp#readme",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "gitignore",
+    "path-validation",
+    "exclude-patterns",
+    "file-filtering"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/IBazylchuk/paparats-mcp.git",
+    "directory": "packages/shared"
+  },
+  "bugs": {
+    "url": "https://github.com/IBazylchuk/paparats-mcp/issues"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build && npm run test"
+  },
+  "dependencies": {
+    "ignore": "^5.3.2"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0",
+    "vitest": "^4.0.18"
+  }
+}