Install the Bluesky Cloudflare Worker

// worker.js — Bluesky Agent Edge Network (drop-in Cloudflare Worker, zero deps).
// Runs in front of your site on Cloudflare. It passes EVERYTHING through to your
// origin, except verified AI answer-engine crawlers, which get your optimized AEO
// artifact. Classic search bots (Googlebot/Bingbot/Applebot) always pass through.

const AEN_BASE = "https://app.trybluesky.com";
const SERVE_MODE = "shadow"; // "shadow" | "default"  ← flip to "default" to actually serve
const ENABLED = new Set(["USER_TRIGGERED", "RETRIEVAL"]);

let botsetCache = null; // per-isolate best-effort cache

async function getBots(token) {
  if (botsetCache && Date.now() - botsetCache.at < 3_600_000) return botsetCache.bots;
  try {
    const r = await fetch(`${AEN_BASE}/api/v1/edge/botset`, { headers: { authorization: `Bearer ${token}` } });
    const j = await r.json();
    const bots = j?.botset?.bots ?? [];
    botsetCache = { at: Date.now(), bots };
    return bots;
  } catch {
    return botsetCache?.bots ?? [];
  }
}

function matchBot(ua, bots) {
  const low = ua.toLowerCase();
  let best = null;
  for (const b of bots) {
    const t = b.uaToken.toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
    if (new RegExp(`(?:^|[^a-z0-9])${t}(?:[^a-z0-9]|$)`, "i").test(low)) {
      if (!best || b.uaToken.length > best.uaToken.length) best = b;
    }
  }
  return best;
}

function ipInCidrs(ip, cidrs = []) {
  for (const c of cidrs) {
    const [net, bitsRaw] = c.split("/");
    const bits = Number(bitsRaw);
    if (ip.includes(":") || net.includes(":")) continue; // IPv4 only in this drop-in
    const a = ipToInt(ip), b = ipToInt(net);
    if (a === null || b === null) continue;
    const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
    if ((a & mask) === (b & mask)) return true;
  }
  return false;
}
function ipToInt(ip) {
  const p = ip.split(".");
  if (p.length !== 4) return null;
  let n = 0;
  for (const o of p) { const v = Number(o); if (!Number.isInteger(v) || v < 0 || v > 255) return null; n = (n << 8) | v; }
  return n >>> 0;
}
async function sha256hex(s) {
  const d = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(s));
  return [...new Uint8Array(d)].map((x) => x.toString(16).padStart(2, "0")).join("");
}

export default {
  async fetch(request, env, ctx) {
    const token = env.AEN_EDGE_TOKEN;
    if (!token) return fetch(request); // not configured → transparent passthrough

    const ua = request.headers.get("user-agent") || "";
    const ip = request.headers.get("cf-connecting-ip") || "";
    const bots = await getBots(token);
    const bot = matchBot(ua, bots);
    if (!bot) return fetch(request);

    // CLOAKING FIREWALL: classic search bots → always the real origin page.
    if (bot.isSearchIndex) return fetch(request);

    const verified = ipInCidrs(ip, bot.cidrs);
    const eligible = verified && ENABLED.has(bot.purpose);
    const url = new URL(request.url);

    let served = "PASSTHROUGH";
    let response = null;

    if (eligible && SERVE_MODE === "default") {
      try {
        const uh = await sha256hex(url.href);
        const ar = await fetch(`${AEN_BASE}/api/v1/edge/artifact?u=${uh}`, { headers: { authorization: `Bearer ${token}` } });
        if (ar.ok) {
          const { artifact } = await ar.json();
          if (artifact?.markdown) {
            served = "VARIANT";
            response = new Response(artifact.markdown, {
              status: 200,
              headers: { "content-type": "text/markdown; charset=utf-8", "x-aen-served": "variant", "cache-control": "no-store" },
            });
          }
        }
      } catch { /* fall through to passthrough */ }
    }
    if (!response) response = await fetch(request); // passthrough to origin

    // fire-and-forget telemetry (never blocks the response)
    const hit = {
      botName: bot.uaToken, path: url.pathname, statusCode: response.status, userAgent: ua, botIp: ip,
      trustLevel: verified ? "IP_VERIFIED" : "UA_ONLY", purposeClass: bot.purpose,
      verificationMethod: verified ? "cidr" : null,
      served: eligible ? (SERVE_MODE === "default" ? served : "PASSTHROUGH") : "PASSTHROUGH",
    };
    ctx.waitUntil(
      fetch(`${AEN_BASE}/api/v1/edge/telemetry`, {
        method: "POST",
        headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
        body: JSON.stringify({ hits: [hit] }),
      }).catch(() => {}),
    );

    return response;
  },
};