Integrate any stack (Node, PHP, Ruby, nginx, Apache)

<?php
// aen.php — include at the very top of your front controller (before output).
// require __DIR__ . '/aen.php'; aen_intercept();

const AEN_BASE   = 'https://app.trybluemoon.com';
const SERVE_MODE = 'shadow'; // 'shadow' | 'default'
const AEN_ENABLED = ['USER_TRIGGERED', 'RETRIEVAL'];

function aen_token() { return getenv('AEN_EDGE_TOKEN') ?: ''; }

function aen_get($path) {
  $ctx = stream_context_create(['http' => [
    'header' => 'Authorization: Bearer ' . aen_token(), 'timeout' => 5, 'ignore_errors' => true,
  ]]);
  $body = @file_get_contents(AEN_BASE . $path, false, $ctx);
  return $body ? json_decode($body, true) : null;
}

function aen_match_bot($ua, $bots) {
  $low = strtolower($ua); $best = null;
  foreach ($bots as $b) {
    if (empty($b['uaToken'])) continue;
    $tok = preg_quote(strtolower($b['uaToken']), '/');
    if (preg_match('/(?:^|[^a-z0-9])' . $tok . '(?:[^a-z0-9]|$)/i', $low)) {
      if ($best === null || strlen($b['uaToken']) > strlen($best['uaToken'])) $best = $b;
    }
  }
  return $best;
}

function aen_ip_in_cidrs($ip, $cidrs) {
  if (strpos($ip, ':') !== false) return false;
  $ipLong = ip2long($ip); if ($ipLong === false) return false;
  foreach ((array) $cidrs as $cidr) {
    if (strpos($cidr, ':') !== false) continue;
    [$netStr, $bitsStr] = array_pad(explode('/', $cidr), 2, '32');
    $net = ip2long($netStr); if ($net === false) continue;
    $bits = (int) $bitsStr;
    $mask = $bits === 0 ? 0 : (-1 << (32 - $bits)) & 0xFFFFFFFF;
    if ((($ipLong & $mask) & 0xFFFFFFFF) === (($net & $mask) & 0xFFFFFFFF)) return true;
  }
  return false;
}

function aen_client_ip() {
  if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) return trim($_SERVER['HTTP_CF_CONNECTING_IP']);
  if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) return trim(explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])[0]);
  return $_SERVER['REMOTE_ADDR'] ?? '';
}

function aen_report($bot, $path, $ua, $ip, $verified, $served) {
  $hit = ['botName' => $bot['uaToken'], 'path' => $path, 'statusCode' => 200, 'userAgent' => $ua,
    'botIp' => $ip, 'trustLevel' => $verified ? 'IP_VERIFIED' : 'UA_ONLY',
    'purposeClass' => $bot['purpose'] ?? 'UNKNOWN', 'verificationMethod' => $verified ? 'cidr' : null,
    'served' => $served];
  $ctx = stream_context_create(['http' => ['method' => 'POST', 'timeout' => 2,
    'header' => "Authorization: Bearer " . aen_token() . "\r\nContent-Type: application/json",
    'content' => json_encode(['hits' => [$hit]])]]);
  @file_get_contents(AEN_BASE . '/api/v1/edge/telemetry', false, $ctx); // fire-and-forget
}

function aen_intercept() {
  if (!aen_token()) return;
  $ua = $_SERVER['HTTP_USER_AGENT'] ?? '';
  $bots = aen_get('/api/v1/edge/botset')['botset']['bots'] ?? [];
  $bot = aen_match_bot($ua, $bots);
  if (!$bot || !empty($bot['isSearchIndex'])) return; // unknown or search bot → passthrough

  $ip = aen_client_ip();
  $verified = aen_ip_in_cidrs($ip, $bot['cidrs'] ?? []);
  $eligible = $verified && in_array($bot['purpose'] ?? '', AEN_ENABLED, true);
  $path = strtok($_SERVER['REQUEST_URI'] ?? '/', '?');
  $url = ($_SERVER['HTTPS'] ?? '' ? 'https' : 'http') . '://' . ($_SERVER['HTTP_HOST'] ?? '') . $path;

  if ($eligible && SERVE_MODE === 'default') {
    $uh = hash('sha256', $url);
    $art = aen_get('/api/v1/edge/artifact?u=' . $uh)['artifact']['markdown'] ?? null;
    if ($art) {
      aen_report($bot, $path, $ua, $ip, $verified, 'VARIANT');
      header('Content-Type: text/markdown; charset=utf-8');
      header('X-AEN-Served: variant');
      echo $art; exit;
    }
  }
  aen_report($bot, $path, $ua, $ip, $verified, 'PASSTHROUGH');
}

# aen.rb — Rack middleware. use Aen in config.ru, before your app.
require "digest"; require "json"; require "net/http"; require "uri"; require "ipaddr"

class Aen
  BASE = "https://app.trybluemoon.com"
  MODE = "shadow" # "shadow" | "default"
  ENABLED = %w[USER_TRIGGERED RETRIEVAL].freeze

  def initialize(app)
    @app = app
  end

  def token
    ENV["AEN_EDGE_TOKEN"]
  end

  def get(path)
    uri = URI("#{BASE}#{path}")
    req = Net::HTTP::Get.new(uri); req["Authorization"] = "Bearer #{token}"
    res = Net::HTTP.start(uri.host, uri.port, use_ssl: true, open_timeout: 5, read_timeout: 5) { |h| h.request(req) }
    JSON.parse(res.body) rescue nil
  end

  def bots
    @bots ||= (get("/api/v1/edge/botset") || {}).dig("botset", "bots") || []
  end

  def match(ua)
    low = ua.downcase; best = nil
    bots.each do |b|
      t = Regexp.escape(b["uaToken"].to_s.downcase)
      if low.match?(/(?:^|[^a-z0-9])#{t}(?:[^a-z0-9]|$)/)
        best = b if best.nil? || b["uaToken"].length > best["uaToken"].length
      end
    end
    best
  end

  def verified?(ip, cidrs)
    addr = IPAddr.new(ip) rescue (return false)
    Array(cidrs).any? { |c| (IPAddr.new(c).include?(addr) rescue false) }
  end

  def call(env)
    return @app.call(env) unless token
    req = Rack::Request.new(env)
    ua = req.get_header("HTTP_USER_AGENT").to_s
    bot = match(ua)
    return @app.call(env) if bot.nil? || bot["isSearchIndex"] # unknown or search bot

    ip = (req.get_header("HTTP_CF_CONNECTING_IP") || req.get_header("HTTP_X_FORWARDED_FOR").to_s.split(",").first || req.ip).to_s.strip
    ok = verified?(ip, bot["cidrs"]); eligible = ok && ENABLED.include?(bot["purpose"])
    url = "#{req.scheme}://#{req.host}#{req.path}"

    if eligible && MODE == "default"
      uh = Digest::SHA256.hexdigest(url)
      md = get("/api/v1/edge/artifact?u=#{uh}")&.dig("artifact", "markdown")
      if md
        report(bot, req.path, ua, ip, ok, "VARIANT")
        return [200, { "content-type" => "text/markdown; charset=utf-8", "x-aen-served" => "variant" }, [md]]
      end
    end
    report(bot, req.path, ua, ip, ok, "PASSTHROUGH")
    @app.call(env)
  end

  def report(bot, path, ua, ip, ok, served)
    hit = { botName: bot["uaToken"], path: path, statusCode: 200, userAgent: ua, botIp: ip,
            trustLevel: ok ? "IP_VERIFIED" : "UA_ONLY", purposeClass: bot["purpose"],
            verificationMethod: ok ? "cidr" : nil, served: served }
    Thread.new do
      uri = URI("#{BASE}/api/v1/edge/telemetry")
      r = Net::HTTP::Post.new(uri); r["Authorization"] = "Bearer #{token}"; r["Content-Type"] = "application/json"
      r.body = { hits: [hit] }.to_json
      Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(r) } rescue nil
    end
  end
end