@gfargo/doorman 2.1.0

package/dist/src/index.d.mts

@@ -0,0 +1,23 @@
+declare const WORDPRESS_PATHS: string[];
+declare const PHP_CONTROL_PANEL_PATHS: string[];
+
+/**
+ * Creates a doorman function that checks if a request's pathname matches any of the provided paths.
+ *
+ * @param paths - An array of string paths to block. If a request's pathname starts with any of these paths, the doorman will block the request.
+ * @returns A function that takes a request object containing a nextUrl.pathname and returns a boolean indicating whether the request should be blocked.
+ *
+ * @example
+ * ```typescript
+ * const doorman = createDoorman(['/admin', '/private']);
+ * const isBlocked = doorman({ nextUrl: { pathname: '/admin/dashboard' } });
+ * // isBlocked will be true
+ * ```
+ */
+declare function createDoorman(paths: string[]): (request: {
+    nextUrl: {
+        pathname: string;
+    };
+}) => boolean;
+
+export { PHP_CONTROL_PANEL_PATHS, WORDPRESS_PATHS, createDoorman };

package/dist/src/index.d.ts

@@ -0,0 +1,23 @@
+declare const WORDPRESS_PATHS: string[];
+declare const PHP_CONTROL_PANEL_PATHS: string[];
+
+/**
+ * Creates a doorman function that checks if a request's pathname matches any of the provided paths.
+ *
+ * @param paths - An array of string paths to block. If a request's pathname starts with any of these paths, the doorman will block the request.
+ * @returns A function that takes a request object containing a nextUrl.pathname and returns a boolean indicating whether the request should be blocked.
+ *
+ * @example
+ * ```typescript
+ * const doorman = createDoorman(['/admin', '/private']);
+ * const isBlocked = doorman({ nextUrl: { pathname: '/admin/dashboard' } });
+ * // isBlocked will be true
+ * ```
+ */
+declare function createDoorman(paths: string[]): (request: {
+    nextUrl: {
+        pathname: string;
+    };
+}) => boolean;
+
+export { PHP_CONTROL_PANEL_PATHS, WORDPRESS_PATHS, createDoorman };

package/dist/src/index.js

@@ -0,0 +1 @@
+"use strict";var o=Object.defineProperty;var c=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var h=Object.prototype.hasOwnProperty;var l=(r,p)=>{for(var t in p)o(r,t,{get:p[t],enumerable:!0})},s=(r,p,t,n)=>{if(p&&typeof p=="object"||typeof p=="function")for(let e of m(p))!h.call(r,e)&&e!==t&&o(r,e,{get:()=>p[e],enumerable:!(n=c(p,e))||n.enumerable});return r};var x=r=>s(o({},"__esModule",{value:!0}),r);var w={};l(w,{PHP_CONTROL_PANEL_PATHS:()=>f,WORDPRESS_PATHS:()=>i,createDoorman:()=>a});module.exports=x(w);var i=["/wp-content/","/wp-admin/","/wp-includes/","/wp-json/","/wp-login.php","/xmlrpc.php"],f=["/ws.php","/xmrlpc.php","/makeasmtp.php","/text.php","/images/xmrlpc.php","/img/xmrlpc.php","/cgi-bin/xmrlpc.php","/css/xmrlpc.php","/alfa-rex2.php","/alfanew2.php"];function a(r){return p=>{let t=!1;for(let n of r)if(p.nextUrl.pathname.startsWith(n)){t=!0;break}return t}}0&&(module.exports={PHP_CONTROL_PANEL_PATHS,WORDPRESS_PATHS,createDoorman});

package/dist/src/index.mjs

@@ -0,0 +1 @@
+var o=["/wp-content/","/wp-admin/","/wp-includes/","/wp-json/","/wp-login.php","/xmlrpc.php"],a=["/ws.php","/xmrlpc.php","/makeasmtp.php","/text.php","/images/xmrlpc.php","/img/xmrlpc.php","/cgi-bin/xmrlpc.php","/css/xmrlpc.php","/alfa-rex2.php","/alfanew2.php"];function n(r){return t=>{let p=!1;for(let e of r)if(t.nextUrl.pathname.startsWith(e)){p=!0;break}return p}}export{a as PHP_CONTROL_PANEL_PATHS,o as WORDPRESS_PATHS,n as createDoorman};

package/package.json

@@ -0,0 +1,157 @@
+{
+  "name": "@gfargo/doorman",
+  "version": "2.1.0",
+  "description": "Manage firewall rules as code across multiple providers",
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "doorman": "./bin/run",
+    "vercel-doorman": "./bin/run-deprecated"
+  },
+  "directories": {
+    "lib": "src",
+    "bin": "bin"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "skills"
+  ],
+  "agents": {
+    "skills": [
+      {
+        "name": "doorman",
+        "path": "./skills/doorman"
+      }
+    ]
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/gfargo/doorman.git"
+  },
+  "scripts": {
+    "prebuild": "pnpm clean",
+    "build": "tsup-node",
+    "build:schema": "ts-node ./schema/generate-schema.ts; pnpm lint:fix; pnpm format:fix",
+    "build:watch": "tsup-node --watch",
+    "clean": "rimraf dist",
+    "commit": "cz",
+    "commitlint": "commitlint --edit",
+    "compile": "tsc",
+    "format": "prettier . --check",
+    "format:fix": "prettier . --write",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "start": "ts-node ./bin/run.ts",
+    "start:node": "node ./bin/run",
+    "test": "jest",
+    "test:watch": "jest --watchAll",
+    "test:coverage": "jest --coverage",
+    "test:ci": "jest --ci --coverage --watchAll=false",
+    "dev": "pnpm start",
+    "doorman": "pnpm start",
+    "prepare": "husky",
+    "release": "semantic-release",
+    "docs:dev": "echo 'Documentation server would start here'",
+    "validate:examples": "find examples -name '*.json' -exec pnpm start validate --config {} \\;",
+    "benchmark": "echo 'Performance benchmarks would run here'"
+  },
+  "keywords": [
+    "firewall",
+    "waf",
+    "IaC",
+    "security",
+    "vercel",
+    "cloudflare",
+    "cli"
+  ],
+  "author": "Griffen Fargo <ghfargo@gmail.com>",
+  "license": "MIT",
+  "devDependencies": {
+    "@commitlint/cli": "^20.5.3",
+    "@commitlint/config-conventional": "^20.5.3",
+    "@jest/globals": "^30.3.0",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/github": "^12.0.6",
+    "@semantic-release/npm": "^12.0.1",
+    "@tsconfig/node20": "^20.1.4",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^20.12.12",
+    "@types/prompts": "^2.4.9",
+    "@types/signale": "^1.4.7",
+    "@types/yargs": "^17.0.32",
+    "@typescript-eslint/eslint-plugin": "^8.59.1",
+    "@typescript-eslint/parser": "^8.59.1",
+    "commitizen": "^4.3.0",
+    "cz-conventional-changelog": "^3.3.0",
+    "eslint": "^9.39.4",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-plugin-jest": "^29.15.2",
+    "eslint-plugin-prettier": "^5.1.3",
+    "eslint-plugin-unused-imports": "^4.4.1",
+    "globals": "^17.6.0",
+    "husky": "^9.0.11",
+    "jest": "^30.3.0",
+    "prettier": "^3.2.5",
+    "rimraf": "^6.1.3",
+    "semantic-release": "^25.0.3",
+    "ts-jest": "^29.4.9",
+    "ts-json-schema-generator": "^2.3.0",
+    "ts-node": "^10.9.2",
+    "tsup": "^8.5.1",
+    "typescript": "^5.4.5",
+    "typescript-eslint": "^8.59.1"
+  },
+  "dependencies": {
+    "ajv": "^8.18.0",
+    "chalk": "^5.3.0",
+    "cli-table3": "^0.6.5",
+    "consola": "^3.4.2",
+    "dotenv": "^16.4.5",
+    "find-up": "^6.3.0",
+    "yargs": "^17.7.2",
+    "zod": "^3.23.8"
+  },
+  "config": {
+    "commitizen": {
+      "path": "cz-conventional-changelog"
+    }
+  },
+  "pnpm": {
+    "overrides": {
+      "micromatch@<4.0.8": ">=4.0.8",
+      "cross-spawn": "^7.0.6",
+      "nanoid": ">=3.3.8",
+      "@octokit/request-error": ">=6.1.7",
+      "@octokit/endpoint": ">=10.1.3",
+      "@octokit/request": ">=9.2.1",
+      "@octokit/plugin-paginate-rest": ">=11.4.1",
+      "braces": ">=3.0.3",
+      "tmp": ">=0.2.6",
+      "esbuild": ">=0.25.0",
+      "@babel/helpers": ">=7.26.10",
+      "@babel/core": ">=7.29.6",
+      "handlebars": ">=4.7.9",
+      "minimatch@<3.1.4": ">=3.1.4",
+      "minimatch@>=9.0.0 <9.0.7": ">=9.0.7",
+      "glob@>=10.2.0 <10.5.0": ">=10.5.0",
+      "brace-expansion@<1.1.13": ">=1.1.13",
+      "brace-expansion@>=2.0.0 <2.0.3": ">=2.0.3",
+      "brace-expansion": ">=5.0.9",
+      "flatted@<3.4.2": ">=3.4.2",
+      "picomatch@<2.3.2": ">=2.3.2",
+      "js-yaml": ">=4.3.1",
+      "ajv@<6.14.0": "6.14.0",
+      "lodash@<=4.17.23": ">=4.18.0",
+      "lodash-es@<=4.17.23": ">=4.18.0",
+      "rollup@>=4.0.0 <4.59.0": ">=4.59.0",
+      "postcss@<8.5.10": ">=8.5.10",
+      "yaml@>=2.0.0 <2.8.3": ">=2.8.3",
+      "diff@>=4.0.0 <4.0.4": ">=4.0.4",
+      "undici": ">=7.29.0",
+      "fast-uri": ">=3.1.5"
+    }
+  }
+}

package/skills/doorman/SKILL.md

@@ -0,0 +1,132 @@
+---
+name: doorman
+description: 'Use when managing Vercel or Cloudflare WAF rules as code, configuring firewall rules, IP blocking, rate limiting, bot protection, or automating multi-provider security configuration deployment with Doorman CLI.'
+---
+
+# Doorman
+
+Multi-provider WAF automation as code. Manage Vercel Firewall and Cloudflare WAF rules in version-controlled `.doorman.json` files with automated deployment via CLI.
+
+## Key Concepts
+
+- **Config file**: `.doorman.json` (also supports legacy `vercel-firewall.config.json`)
+- **Providers**: Vercel (default) and Cloudflare (`--provider cloudflare`)
+- **Workflow**: Edit config → validate → diff → sync
+- **Schema**: `https://doorman.griffen.codes/schema.json`
+
+## Commands
+
+```bash
+doorman init --interactive       # Create new config
+doorman validate                 # Check config syntax
+doorman status                   # Sync status + health score
+doorman list                     # Show deployed rules
+doorman diff                     # Local vs remote differences
+doorman sync                     # Deploy local config to provider
+doorman download                 # Pull remote rules to local config
+doorman template <name>          # Add pre-built rule template
+doorman watch                    # Auto-sync on file changes
+doorman backup                   # Create config backup
+doorman export --format <fmt>    # Export as markdown|json|yaml|terraform
+```
+
+All commands accept `--provider vercel|cloudflare` and `--config <path>`.
+
+## Environment Variables
+
+```bash
+# Vercel
+VERCEL_TOKEN=your_token
+VERCEL_PROJECT_ID=prj_xxx
+VERCEL_TEAM_ID=team_xxx
+
+# Cloudflare
+CLOUDFLARE_API_TOKEN=your_token
+CLOUDFLARE_ZONE_ID=zone_xxx
+CLOUDFLARE_ACCOUNT_ID=acc_xxx  # optional, enables Lists API
+```
+
+## Config Structure
+
+```json
+{
+  "$schema": "https://doorman.griffen.codes/schema.json",
+  "projectId": "prj_xxx",
+  "teamId": "team_xxx",
+  "rules": [],
+  "ips": []
+}
+```
+
+For Cloudflare, use `provider` and `providers` fields instead of `projectId`/`teamId`.
+
+## Rule Quick Reference
+
+```json
+{
+  "id": "rule_block_admin",
+  "name": "Block Admin Access",
+  "description": "Block unauthorized admin access",
+  "active": true,
+  "conditionGroup": [
+    {
+      "conditions": [
+        { "type": "path", "op": "pre", "value": "/admin" },
+        { "type": "method", "op": "eq", "value": "POST" }
+      ]
+    }
+  ],
+  "action": {
+    "mitigate": {
+      "action": "deny"
+    }
+  }
+}
+```
+
+**Logic**: Conditions within a group are AND'd. Multiple groups are OR'd.
+
+**Condition types**: `path`, `method`, `host`, `user_agent`, `ip_address`, `header`, `query`, `cookie`, `geo_country`, `geo_city`, `geo_continent`, `scheme`
+
+**Operators**: `eq`, `pre` (starts_with), `suf` (ends_with), `sub` (contains), `inc` (in array), `re` (regex), `ex` (exists), `nex` (not exists)
+
+**Actions**: `deny`, `challenge`, `rate_limit`, `redirect`, `log`, `bypass`
+
+**See `rules-reference.md` for complete field documentation, advanced patterns, and examples.**
+
+## IP Blocking
+
+```json
+{
+  "ips": [{ "ip": "192.168.1.0/24", "action": "deny", "hostname": "bad-subnet", "notes": "Blocked for abuse" }]
+}
+```
+
+## Templates
+
+```bash
+doorman template bad-bots       # Block malicious bots
+doorman template ai-bots        # Block AI crawlers
+doorman template wordpress      # Block WordPress attack paths
+doorman template block-ofac-sanctioned-countries  # OFAC compliance
+```
+
+## Workflow
+
+```bash
+# Add a rule: edit .doorman.json, then:
+doorman validate && doorman sync
+
+# Pull existing rules from provider:
+doorman download
+
+# Check what would change before deploying:
+doorman diff
+```
+
+## Resources
+
+- [Docs](https://doorman.griffen.codes/docs)
+- [GitHub](https://github.com/gfargo/doorman)
+- [Wiki](https://github.com/gfargo/doorman/wiki)
+- [Examples](https://github.com/gfargo/doorman/tree/main/examples)