Install the Bluemoon WordPress plugin

<?php
/**
 * Plugin Name:       Bluemoon Agent Edge Network
 * Plugin URI:        https://docs.trybluemoon.com/guides/wordpress
 * Description:       Detect verified AI answer-engine crawlers (ChatGPT, Perplexity, Claude…) and serve them your AEO-optimized content. Humans and search bots always get your normal page.
 * Version:           0.2.0
 * Requires at least: 5.6
 * Requires PHP:      7.4
 * Author:            Bluemoon
 * Author URI:        https://trybluemoon.com
 * License:           GPLv2 or later
 * Text Domain:       bluesky-aen
 */

if (!defined('ABSPATH')) {
    exit; // no direct access
}

if (!defined('AEN_BASE')) {
    define('AEN_BASE', 'https://app.trybluemoon.com');
}

/** The edge token: a wp-config constant wins, else the saved option. */
function aen_token() {
    if (defined('AEN_EDGE_TOKEN') && AEN_EDGE_TOKEN) {
        return AEN_EDGE_TOKEN;
    }
    return trim((string) get_option('aen_edge_token', ''));
}

function aen_auth_headers($token) {
    return array('Authorization' => 'Bearer ' . $token);
}

/** Bot registry, cached in a transient (~1h). */
function aen_get_botset($token) {
    $cached = get_transient('aen_botset');
    if (is_array($cached)) {
        return $cached;
    }
    $res = wp_remote_get(AEN_BASE . '/api/v1/edge/botset', array('headers' => aen_auth_headers($token), 'timeout' => 5));
    if (is_wp_error($res) || wp_remote_retrieve_response_code($res) !== 200) {
        return array();
    }
    $json = json_decode(wp_remote_retrieve_body($res), true);
    $bots = isset($json['botset']['bots']) ? $json['botset']['bots'] : array();
    set_transient('aen_botset', $bots, HOUR_IN_SECONDS);
    return $bots;
}

/** Dashboard-controlled config (serve mode, purposes), cached ~5 min. */
function aen_get_config($token) {
    $cached = get_transient('aen_config');
    if (is_array($cached)) {
        return $cached;
    }
    $cfg = array('serveMode' => 'shadow', 'enabledPurposes' => array('USER_TRIGGERED', 'RETRIEVAL'));
    $res = wp_remote_get(AEN_BASE . '/api/v1/edge/config', array('headers' => aen_auth_headers($token), 'timeout' => 5));
    if (!is_wp_error($res) && wp_remote_retrieve_response_code($res) === 200) {
        $body = json_decode(wp_remote_retrieve_body($res), true);
        if (is_array($body)) {
            $cfg = array_merge($cfg, $body);
        }
    }
    set_transient('aen_config', $cfg, 300);
    return $cfg;
}

/** Longest user-agent token match (word-boundary), like the Next/Cloudflare drop-ins. */
function aen_match_bot($ua, $bots) {
    $low = strtolower($ua);
    $best = null;
    foreach ($bots as $b) {
        if (empty($b['uaToken'])) {
            continue;
        }
        $tok = preg_quote(strtolower($b['uaToken']), '/');
        if (preg_match('/(?:^|[^a-z0-9])' . $tok . '(?:[^a-z0-9]|$)/i', $low)) {
            if ($best === null || strlen($b['uaToken']) > strlen($best['uaToken'])) {
                $best = $b;
            }
        }
    }
    return $best;
}

/** IPv4 CIDR membership (IPv6 is skipped in this drop-in). */
function aen_ip_in_cidrs($ip, $cidrs) {
    if (strpos($ip, ':') !== false) {
        return false;
    }
    $ipLong = ip2long($ip);
    if ($ipLong === false) {
        return false;
    }
    foreach ((array) $cidrs as $cidr) {
        if (strpos($cidr, ':') !== false) {
            continue;
        }
        $parts = explode('/', $cidr);
        $net = ip2long($parts[0]);
        $bits = isset($parts[1]) ? (int) $parts[1] : 32;
        if ($net === false) {
            continue;
        }
        $mask = $bits === 0 ? 0 : (-1 << (32 - $bits)) & 0xFFFFFFFF;
        if ((($ipLong & $mask) & 0xFFFFFFFF) === (($net & $mask) & 0xFFFFFFFF)) {
            return true;
        }
    }
    return false;
}

function aen_client_ip() {
    if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) {
        return trim($_SERVER['HTTP_CF_CONNECTING_IP']);
    }
    if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $parts = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
        return trim($parts[0]);
    }
    return isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '';
}

function aen_current_url() {
    $scheme = is_ssl() ? 'https' : 'http';
    $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
    $path = isset($_SERVER['REQUEST_URI']) ? strtok($_SERVER['REQUEST_URI'], '?') : '/';
    return $scheme . '://' . $host . $path;
}

function aen_telemetry($token, $bot, $url, $ua, $ip, $verified, $served) {
    $path = parse_url($url, PHP_URL_PATH);
    $hit = array(
        'botName'            => $bot['uaToken'],
        'path'               => $path ? $path : '/',
        'statusCode'         => 200,
        'userAgent'          => $ua,
        'botIp'              => $ip,
        'trustLevel'         => $verified ? 'IP_VERIFIED' : 'UA_ONLY',
        'purposeClass'       => isset($bot['purpose']) ? $bot['purpose'] : 'UNKNOWN',
        'verificationMethod' => $verified ? 'cidr' : null,
        'served'             => $served,
    );
    wp_remote_post(AEN_BASE . '/api/v1/edge/telemetry', array(
        'headers'  => array_merge(aen_auth_headers($token), array('Content-Type' => 'application/json')),
        'body'     => wp_json_encode(array('hits' => array($hit))),
        'timeout'  => 2,
        'blocking' => false, // fire-and-forget, never delays the response
    ));
}

/** The interception. Runs before the theme renders; serves verified AI crawlers the artifact. */
function aen_intercept() {
    if (is_admin()) {
        return;
    }
    $token = aen_token();
    if (!$token) {
        return;
    }
    $cfg = aen_get_config($token);
    $mode = isset($cfg['serveMode']) ? $cfg['serveMode'] : 'shadow';
    if ($mode === 'off') {
        return;
    }

    $ua = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';
    $bots = aen_get_botset($token);
    $bot = aen_match_bot($ua, $bots);
    if (!$bot) {
        return;
    }
    if (!empty($bot['isSearchIndex'])) {
        return; // cloaking firewall: Googlebot/Bingbot/Applebot always get the real page
    }

    $ip = aen_client_ip();
    $verified = aen_ip_in_cidrs($ip, isset($bot['cidrs']) ? $bot['cidrs'] : array());
    $enabled = isset($cfg['enabledPurposes']) ? $cfg['enabledPurposes'] : array('USER_TRIGGERED', 'RETRIEVAL');
    $eligible = $verified && in_array($bot['purpose'], $enabled, true);
    $url = aen_current_url();
    $served = 'PASSTHROUGH';

    $base = explode(':', $mode)[0];
    if ($eligible && ($base === 'default' || $base === 'canary')) {
        $uh = hash('sha256', $url);
        $doServe = $base === 'default';
        if ($base === 'canary') {
            $mparts = explode(':', $mode);
            $pct = isset($mparts[1]) ? (int) $mparts[1] : 0;
            $doServe = (hexdec(substr($uh, 0, 8)) % 100) < $pct;
        }
        if ($doServe) {
            $res = wp_remote_get(AEN_BASE . '/api/v1/edge/artifact?u=' . $uh, array('headers' => aen_auth_headers($token), 'timeout' => 5));
            if (!is_wp_error($res) && wp_remote_retrieve_response_code($res) === 200) {
                $json = json_decode(wp_remote_retrieve_body($res), true);
                $md = isset($json['artifact']['markdown']) ? $json['artifact']['markdown'] : null;
                if ($md) {
                    $served = 'VARIANT';
                    aen_telemetry($token, $bot, $url, $ua, $ip, $verified, $served);
                    header('Content-Type: text/markdown; charset=utf-8');
                    header('X-AEN-Served: variant');
                    header('Cache-Control: no-store');
                    echo $md; // phpcs:ignore WordPress.Security.EscapeOutput — markdown body, served as-is to the crawler
                    exit;
                }
            }
        }
    }

    aen_telemetry($token, $bot, $url, $ua, $ip, $verified, $served);
}
add_action('template_redirect', 'aen_intercept', 0);

/* ------------------------------------------------------------------ */
/* Settings page                                                       */
/* ------------------------------------------------------------------ */

add_action('admin_menu', function () {
    add_options_page('Bluemoon AEN', 'Bluemoon AEN', 'manage_options', 'bluesky-aen', 'aen_settings_page');
});

add_action('admin_init', function () {
    register_setting('aen_settings', 'aen_edge_token', array('sanitize_callback' => 'sanitize_text_field'));
});

function aen_settings_page() {
    if (!current_user_can('manage_options')) {
        return;
    }
    ?>
    <div class="wrap">
        <h1>Bluemoon Agent Edge Network</h1>
        <p>Serve verified AI crawlers your AEO-optimized content. Get your edge token from
           <a href="https://app.trybluemoon.com/en/agent-analytics" target="_blank" rel="noreferrer">Agent Analytics &rarr; Settings</a>.</p>
        <form method="post" action="options.php">
            <?php settings_fields('aen_settings'); ?>
            <table class="form-table">
                <tr>
                    <th scope="row"><label for="aen_edge_token">Edge token</label></th>
                    <td>
                        <input name="aen_edge_token" id="aen_edge_token" type="text" class="regular-text"
                               value="<?php echo esc_attr(get_option('aen_edge_token', '')); ?>" placeholder="aen_…" />
                        <p class="description">It ships in <strong>shadow</strong> mode (safe). Switch to Live from the Agent Analytics dashboard.</p>
                    </td>
                </tr>
            </table>
            <?php submit_button(); ?>
        </form>
    </div>
    <?php
}