Install and Configure the Bluesky Next.js Edge Middleware

import createMiddleware from "next-intl/middleware";
import type { NextRequest } from "next/server";
import { locales, defaultLocale } from "./i18n";
import { handle } from "@trybluesky/aen";

const intl = createMiddleware({ locales, defaultLocale });

export default async function middleware(req: NextRequest) {
  const served = await handle(req);   // verified AI crawler → AEN serves the artifact
  if (served) return served;
  return intl(req);                   // everyone else → your normal handling
}

export const config = { matcher: [/* keep your existing matcher */] };

// middleware.ts — Bluesky Agent Edge Network (drop-in, self-contained, zero deps).
// Put this at the root of your Next.js app. Runs on Vercel Edge.
//
// Setup:
//   1. In Vercel → your project → Settings → Environment Variables, add:
//        AEN_EDGE_TOKEN = <the edge token from Agent Analytics → Connect>
//   2. Deploy. Start in "shadow" mode (SERVE_MODE below) = logs only, serves the
//      normal page to everyone. Flip to "default" once you've seen hits come in.
//   3. Ask ChatGPT/Perplexity (with browsing) something that makes it fetch your site.
//      Its verified crawler IP is served the AEO artifact; you see it in Agent Analytics.

import { NextRequest, NextResponse } from "next/server";

const AEN_BASE = "https://app.trybluesky.com";
const EDGE_TOKEN = process.env.AEN_EDGE_TOKEN ?? "";
const SERVE_MODE: "shadow" | "default" = "shadow"; // ← flip to "default" to actually serve
const ENABLED = new Set(["USER_TRIGGERED", "RETRIEVAL"]);

export const config = { matcher: ["/((?!_next/|api/|favicon.ico).*)"] };

// ---- tiny cached control-plane fetches --------------------------------------
type Bot = { uaToken: string; purpose: string; cidrs?: string[]; isSearchIndex?: boolean };
let botsetCache: { at: number; bots: Bot[] } | null = null;

async function getBots(): Promise<Bot[]> {
  if (botsetCache && Date.now() - botsetCache.at < 3_600_000) return botsetCache.bots;
  try {
    const r = await fetch(`${AEN_BASE}/api/v1/edge/botset`, { headers: auth() });
    const j = await r.json();
    const bots: Bot[] = j?.botset?.bots ?? [];
    botsetCache = { at: Date.now(), bots };
    return bots;
  } catch {
    return botsetCache?.bots ?? [];
  }
}

function auth() {
  return { authorization: `Bearer ${EDGE_TOKEN}` };
}

// ---- detection (UA + IP verify) ---------------------------------------------
function matchBot(ua: string, bots: Bot[]): Bot | null {
  const low = ua.toLowerCase();
  let best: Bot | null = null;
  for (const b of bots) {
    const t = b.uaToken.toLowerCase();
    if (new RegExp(`(?:^|[^a-z0-9])${escapeRe(t)}(?:[^a-z0-9]|$)`, "i").test(low)) {
      if (!best || b.uaToken.length > best.uaToken.length) best = b;
    }
  }
  return best;
}
const escapeRe = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");

function ipInCidrs(ip: string, cidrs: string[] = []): boolean {
  for (const c of cidrs) {
    try {
      const [net, bitsRaw] = c.split("/");
      const bits = Number(bitsRaw);
      if (ip.includes(":") || net.includes(":")) continue; // IPv4 only in this drop-in
      const a = ipToInt(ip), b = ipToInt(net);
      if (a === null || b === null) continue;
      const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
      if ((a & mask) === (b & mask)) return true;
    } catch { /* skip */ }
  }
  return false;
}
function ipToInt(ip: string): number | null {
  const p = ip.split(".");
  if (p.length !== 4) return null;
  let n = 0;
  for (const o of p) { const v = Number(o); if (!Number.isInteger(v) || v < 0 || v > 255) return null; n = (n << 8) | v; }
  return n >>> 0;
}

async function sha256hex(s: string): Promise<string> {
  const d = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(s));
  return [...new Uint8Array(d)].map((x) => x.toString(16).padStart(2, "0")).join("");
}

// ---- middleware -------------------------------------------------------------
export async function middleware(req: NextRequest): Promise<NextResponse> {
  if (!EDGE_TOKEN) return NextResponse.next();

  const ua = req.headers.get("user-agent") ?? "";
  const ip = (req.headers.get("x-forwarded-for") ?? req.headers.get("x-real-ip") ?? "").split(",")[0].trim();
  const bots = await getBots();
  const bot = matchBot(ua, bots);
  if (!bot) return NextResponse.next();

  // CLOAKING FIREWALL: classic search bots (Googlebot/Bingbot/Applebot) → always the human page.
  if (bot.isSearchIndex) return NextResponse.next();

  const verified = ipInCidrs(ip, bot.cidrs);
  const eligible = verified && ENABLED.has(bot.purpose);

  const url = req.nextUrl.href;
  let served: "VARIANT" | "PASSTHROUGH" = "PASSTHROUGH";
  let resp = NextResponse.next();

  if (eligible && SERVE_MODE === "default") {
    try {
      const uh = await sha256hex(url);
      const ar = await fetch(`${AEN_BASE}/api/v1/edge/artifact?u=${uh}`, { headers: auth() });
      if (ar.ok) {
        const { artifact } = await ar.json();
        if (artifact?.markdown) {
          served = "VARIANT";
          resp = new NextResponse(artifact.markdown, {
            status: 200,
            headers: { "content-type": "text/markdown; charset=utf-8", "x-aen-served": "variant", "cache-control": "no-store" },
          });
        }
      }
    } catch { /* fall through to passthrough */ }
  }

  // fire-and-forget telemetry (never blocks the response)
  const hit = {
    botName: bot.uaToken, path: req.nextUrl.pathname, statusCode: 200, userAgent: ua, botIp: ip,
    trustLevel: verified ? "IP_VERIFIED" : "UA_ONLY", purposeClass: bot.purpose,
    verificationMethod: verified ? "cidr" : null,
    served: eligible ? (SERVE_MODE === "default" ? served : "PASSTHROUGH") : "PASSTHROUGH",
  };
  fetch(`${AEN_BASE}/api/v1/edge/telemetry`, {
    method: "POST", headers: { ...auth(), "content-type": "application/json" }, body: JSON.stringify({ hits: [hit] }),
  }).catch(() => {});

  return resp;
}

const AEN_BASE = "https://app.trybluesky.com";
const EDGE_TOKEN = process.env.AEN_EDGE_TOKEN ?? "";
const SERVE_MODE: "shadow" | "default" = "shadow"; // ← flip to "default" to actually serve
const ENABLED = new Set(["USER_TRIGGERED", "RETRIEVAL"]);

export const config = { matcher: ["/((?!_next/|api/|favicon.ico).*)"] };