@corsenai/corsen-context-nextjs 1.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Corsen AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,31 @@
+# @corsenai/corsen-context-nextjs
+
+Next.js adapter for **[Corsen Context](https://github.com/CorsenAI/corsen-context)** — drop-in route handlers for the MCP endpoint and `llms.txt`, with built-in auth, rate limiting, CORS, and security headers.
+
+```bash
+npm install @corsenai/corsen-context @corsenai/corsen-context-nextjs
+```
+
+**App Router** — `app/v1/mcp/route.ts`:
+
+```typescript
+import { createMCPHandler } from '@corsenai/corsen-context-nextjs';
+import { siteProvider } from '@/lib/corsen-provider';
+
+const { POST, OPTIONS } = createMCPHandler({ siteUrl: 'https://example.com' }, siteProvider);
+export { POST, OPTIONS };
+```
+
+For production (multi-instance / Vercel), pass a Redis cache and rate-limit store:
+
+```typescript
+import { RedisCache, RedisRateLimitStore } from '@corsenai/corsen-context';
+
+createMCPHandler(config, provider, {
+  cache: new RedisCache(redis),
+  rateLimitStore: new RedisRateLimitStore(redis),
+});
+```
+
+- **Full docs:** https://github.com/CorsenAI/corsen-context#readme
+- **License:** MIT

package/dist/index.d.mts

@@ -0,0 +1,87 @@
+import { CorsenContextConfig, CacheDriver, RateLimitStore, Logger, ContentProvider } from '@corsenai/corsen-context';
+export { CacheDriver, ContentProvider, CorsenContextConfig, Logger, RateLimitStore } from '@corsenai/corsen-context';
+
+interface NextConfig {
+    rewrites?: () => Promise<any[] | {
+        beforeFiles?: any[];
+        afterFiles?: any[];
+        fallback?: any[];
+    }>;
+    [key: string]: unknown;
+}
+/**
+ * Wraps a Next.js config to enable Corsen Context.
+ *
+ * Usage in next.config.mjs:
+ * ```js
+ * import { withCorsenContext } from '@corsenai/corsen-context-nextjs';
+ *
+ * export default withCorsenContext({
+ *   siteUrl: 'https://example.com',
+ * })({
+ *   // your existing Next.js config
+ * });
+ * ```
+ */
+declare function withCorsenContext(corsenConfig: CorsenContextConfig): (nextConfig?: NextConfig) => NextConfig;
+
+/**
+ * Optional production wiring for the Next.js handlers — inject the same
+ * distributed cache, rate-limit store, and logger the core supports (e.g. Redis
+ * on Vercel/multi-instance).
+ */
+interface HandlerOptions {
+    cache?: CacheDriver;
+    rateLimitStore?: RateLimitStore;
+    logger?: Logger;
+}
+/**
+ * Creates a Next.js App Router handler for the MCP endpoint (POST /v1/mcp).
+ *
+ * Uses the core MCPServer class from @corsenai/corsen-context for full
+ * MCP 2025-11-25 compliance including:
+ * - initialize, ping, notifications/initialized
+ * - tools/list, tools/call
+ * - resources/list, resources/read
+ * - JSON-RPC 2.0 notification handling (204 No Content when id is absent)
+ * - Rate limiting, CORS, API key auth, security headers
+ *
+ * Usage (App Router - app/v1/mcp/route.ts):
+ * ```ts
+ * import { createMCPHandler } from '@corsenai/corsen-context-nextjs';
+ *
+ * const { POST, OPTIONS } = createMCPHandler({
+ *   siteUrl: 'https://example.com',
+ * }, myProvider);
+ *
+ * export { POST, OPTIONS };
+ * ```
+ */
+declare function createMCPHandler(config: CorsenContextConfig, provider: ContentProvider, options?: HandlerOptions): {
+    POST: (request: Request) => Promise<Response>;
+    OPTIONS: (request: Request) => Promise<Response>;
+};
+/**
+ * Creates a SSE handler for MCP streaming (GET /v1/mcp/sse).
+ *
+ * This is a stub for future SSE transport support.
+ * Currently returns a proper SSE connection that sends the MCP endpoint URL
+ * so clients can discover the POST endpoint for JSON-RPC calls.
+ *
+ * Usage (App Router - app/v1/mcp/sse/route.ts):
+ * ```ts
+ * import { createSSEHandler } from '@corsenai/corsen-context-nextjs';
+ * export const GET = createSSEHandler({ siteUrl: 'https://example.com' });
+ * ```
+ */
+declare function createSSEHandler(config: CorsenContextConfig, provider?: ContentProvider, options?: HandlerOptions): (request: Request) => Promise<Response>;
+/**
+ * Creates a handler that serves /llms.txt
+ */
+declare function createLlmsTxtHandler(config: CorsenContextConfig, provider: ContentProvider): () => Promise<Response>;
+/**
+ * Creates a handler that serves /llms-full.txt
+ */
+declare function createLlmsFullTxtHandler(config: CorsenContextConfig, provider: ContentProvider): () => Promise<Response>;
+
+export { type HandlerOptions, createLlmsFullTxtHandler, createLlmsTxtHandler, createMCPHandler, createSSEHandler, withCorsenContext };

package/dist/index.d.ts

@@ -0,0 +1,87 @@
+import { CorsenContextConfig, CacheDriver, RateLimitStore, Logger, ContentProvider } from '@corsenai/corsen-context';
+export { CacheDriver, ContentProvider, CorsenContextConfig, Logger, RateLimitStore } from '@corsenai/corsen-context';
+
+interface NextConfig {
+    rewrites?: () => Promise<any[] | {
+        beforeFiles?: any[];
+        afterFiles?: any[];
+        fallback?: any[];
+    }>;
+    [key: string]: unknown;
+}
+/**
+ * Wraps a Next.js config to enable Corsen Context.
+ *
+ * Usage in next.config.mjs:
+ * ```js
+ * import { withCorsenContext } from '@corsenai/corsen-context-nextjs';
+ *
+ * export default withCorsenContext({
+ *   siteUrl: 'https://example.com',
+ * })({
+ *   // your existing Next.js config
+ * });
+ * ```
+ */
+declare function withCorsenContext(corsenConfig: CorsenContextConfig): (nextConfig?: NextConfig) => NextConfig;
+
+/**
+ * Optional production wiring for the Next.js handlers — inject the same
+ * distributed cache, rate-limit store, and logger the core supports (e.g. Redis
+ * on Vercel/multi-instance).
+ */
+interface HandlerOptions {
+    cache?: CacheDriver;
+    rateLimitStore?: RateLimitStore;
+    logger?: Logger;
+}
+/**
+ * Creates a Next.js App Router handler for the MCP endpoint (POST /v1/mcp).
+ *
+ * Uses the core MCPServer class from @corsenai/corsen-context for full
+ * MCP 2025-11-25 compliance including:
+ * - initialize, ping, notifications/initialized
+ * - tools/list, tools/call
+ * - resources/list, resources/read
+ * - JSON-RPC 2.0 notification handling (204 No Content when id is absent)
+ * - Rate limiting, CORS, API key auth, security headers
+ *
+ * Usage (App Router - app/v1/mcp/route.ts):
+ * ```ts
+ * import { createMCPHandler } from '@corsenai/corsen-context-nextjs';
+ *
+ * const { POST, OPTIONS } = createMCPHandler({
+ *   siteUrl: 'https://example.com',
+ * }, myProvider);
+ *
+ * export { POST, OPTIONS };
+ * ```
+ */
+declare function createMCPHandler(config: CorsenContextConfig, provider: ContentProvider, options?: HandlerOptions): {
+    POST: (request: Request) => Promise<Response>;
+    OPTIONS: (request: Request) => Promise<Response>;
+};
+/**
+ * Creates a SSE handler for MCP streaming (GET /v1/mcp/sse).
+ *
+ * This is a stub for future SSE transport support.
+ * Currently returns a proper SSE connection that sends the MCP endpoint URL
+ * so clients can discover the POST endpoint for JSON-RPC calls.
+ *
+ * Usage (App Router - app/v1/mcp/sse/route.ts):
+ * ```ts
+ * import { createSSEHandler } from '@corsenai/corsen-context-nextjs';
+ * export const GET = createSSEHandler({ siteUrl: 'https://example.com' });
+ * ```
+ */
+declare function createSSEHandler(config: CorsenContextConfig, provider?: ContentProvider, options?: HandlerOptions): (request: Request) => Promise<Response>;
+/**
+ * Creates a handler that serves /llms.txt
+ */
+declare function createLlmsTxtHandler(config: CorsenContextConfig, provider: ContentProvider): () => Promise<Response>;
+/**
+ * Creates a handler that serves /llms-full.txt
+ */
+declare function createLlmsFullTxtHandler(config: CorsenContextConfig, provider: ContentProvider): () => Promise<Response>;
+
+export { type HandlerOptions, createLlmsFullTxtHandler, createLlmsTxtHandler, createMCPHandler, createSSEHandler, withCorsenContext };

package/dist/index.js

@@ -0,0 +1,309 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  createLlmsFullTxtHandler: () => createLlmsFullTxtHandler,
+  createLlmsTxtHandler: () => createLlmsTxtHandler,
+  createMCPHandler: () => createMCPHandler,
+  createSSEHandler: () => createSSEHandler,
+  withCorsenContext: () => withCorsenContext
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/with-corsen-context.ts
+function withCorsenContext(corsenConfig) {
+  return function wrapNextConfig(nextConfig = {}) {
+    const existingRewrites = nextConfig.rewrites;
+    return {
+      ...nextConfig,
+      async rewrites() {
+        const corsenRewrites = [
+          {
+            source: "/llms.txt",
+            destination: "/api/corsen-context/llms-txt"
+          },
+          {
+            source: "/llms-full.txt",
+            destination: "/api/corsen-context/llms-full-txt"
+          }
+        ];
+        if (existingRewrites) {
+          const existing = await existingRewrites();
+          if (Array.isArray(existing)) {
+            return [...corsenRewrites, ...existing];
+          }
+          return {
+            ...existing,
+            beforeFiles: [...corsenRewrites, ...existing.beforeFiles || []]
+          };
+        }
+        return corsenRewrites;
+      },
+      // Store config for runtime handlers
+      env: {
+        ...nextConfig.env,
+        CORSEN_CONTEXT_CONFIG: JSON.stringify(corsenConfig)
+      }
+    };
+  };
+}
+
+// src/handlers.ts
+var import_corsen_context = require("@corsenai/corsen-context");
+var cachedInstances = /* @__PURE__ */ new WeakMap();
+function getInstance(config, provider, cache) {
+  let providerInstances = cachedInstances.get(provider);
+  if (!providerInstances) {
+    providerInstances = /* @__PURE__ */ new Map();
+    cachedInstances.set(provider, providerInstances);
+  }
+  const configKey = stableStringify(config);
+  let instance = providerInstances.get(configKey);
+  if (!instance) {
+    instance = new import_corsen_context.CorsenContext(config, provider, cache);
+    providerInstances.set(configKey, instance);
+  }
+  return instance;
+}
+async function readBoundedText(request) {
+  const body = request.body;
+  if (!body || typeof body.getReader !== "function") {
+    const text = await request.text();
+    return new TextEncoder().encode(text).length > import_corsen_context.MAX_BODY_SIZE ? null : text;
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (value) {
+      total += value.byteLength;
+      if (total > import_corsen_context.MAX_BODY_SIZE) {
+        await reader.cancel();
+        return null;
+      }
+      chunks.push(value);
+    }
+  }
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(merged);
+}
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value) ?? "undefined";
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+  }
+  const record = value;
+  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`).join(",")}}`;
+}
+function getClientIp(request, trustProxy) {
+  if (trustProxy) {
+    const cfIp = request.headers.get("cf-connecting-ip");
+    if (cfIp) return cfIp.trim();
+    const realIp = request.headers.get("x-real-ip");
+    if (realIp) return realIp.trim();
+    const xff = request.headers.get("x-forwarded-for");
+    if (xff) {
+      const first = xff.split(",")[0]?.trim();
+      if (first) return first;
+    }
+  }
+  const ua = request.headers.get("user-agent") || "";
+  return `anon-${simpleHash(ua)}`;
+}
+function simpleHash(str) {
+  let hash = 0;
+  for (let i = 0; i < str.length; i++) {
+    hash = (hash << 5) - hash + str.charCodeAt(i) | 0;
+  }
+  return Math.abs(hash).toString(36);
+}
+function getApiKey(request) {
+  return request.headers.get("x-mcp-key") || request.headers.get("authorization")?.replace("Bearer ", "") || void 0;
+}
+function createMCPHandler(config, provider, options) {
+  const trustProxy = config.security?.trustProxy ?? false;
+  function createServer(instance) {
+    return instance.createMCPServer({
+      rateLimitStore: options?.rateLimitStore,
+      logger: options?.logger
+    });
+  }
+  async function POST(request) {
+    const instance = getInstance(config, provider, options?.cache);
+    const server = createServer(instance);
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(server.getSecurityHeaders())) {
+      headers.set(key, value);
+    }
+    headers.set("Content-Type", "application/json");
+    const origin = request.headers.get("origin") || void 0;
+    for (const [key, value] of Object.entries(server.getCorsHeaders(origin))) {
+      headers.set(key, value);
+    }
+    const clientIp = getClientIp(request, trustProxy);
+    const apiKey = getApiKey(request);
+    const rateLimit = await server.checkRateLimit(clientIp, apiKey);
+    for (const [key, value] of Object.entries(rateLimit.headers)) {
+      headers.set(key, value);
+    }
+    if (!rateLimit.allowed) {
+      return new Response(
+        JSON.stringify({ jsonrpc: "2.0", error: { code: -32e3, message: "Rate limit exceeded" }, id: null }),
+        { status: 429, headers }
+      );
+    }
+    if (!server.checkAuth(apiKey)) {
+      return new Response(
+        JSON.stringify({ jsonrpc: "2.0", error: { code: -32e3, message: "Unauthorized" }, id: null }),
+        { status: 401, headers }
+      );
+    }
+    const raw = await readBoundedText(request);
+    if (raw === null) {
+      return new Response(
+        JSON.stringify({ jsonrpc: "2.0", error: { code: -32600, message: "Request body too large" }, id: null }),
+        { status: 413, headers }
+      );
+    }
+    let body;
+    try {
+      body = JSON.parse(raw);
+    } catch {
+      return new Response(
+        JSON.stringify({ jsonrpc: "2.0", error: { code: -32700, message: "Parse error" }, id: null }),
+        { status: 400, headers }
+      );
+    }
+    const result = await server.handleRequest(body, clientIp, apiKey, { skipRateLimit: true });
+    if (result === null) {
+      return new Response(null, { status: 204, headers });
+    }
+    return new Response(JSON.stringify(result), { status: 200, headers });
+  }
+  async function OPTIONS(request) {
+    const instance = getInstance(config, provider, options?.cache);
+    const server = createServer(instance);
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(server.getSecurityHeaders())) {
+      headers.set(key, value);
+    }
+    const origin = request.headers.get("origin") || void 0;
+    for (const [key, value] of Object.entries(server.getCorsHeaders(origin))) {
+      headers.set(key, value);
+    }
+    return new Response(null, { status: 204, headers });
+  }
+  return { POST, OPTIONS };
+}
+function createSSEHandler(config, provider, options) {
+  const trustProxy = config.security?.trustProxy ?? false;
+  const gateProvider = provider ?? {
+    async getPages() {
+      return [];
+    },
+    async getPageContent() {
+      return null;
+    },
+    async searchContent() {
+      return [];
+    }
+  };
+  return async function GET(request) {
+    const siteUrl = config.siteUrl.replace(/\/$/, "");
+    const mcpEndpoint = `${siteUrl}${config.mcp?.endpoint || "/v1/mcp"}`;
+    const instance = getInstance(config, gateProvider, options?.cache);
+    const server = instance.createMCPServer({ rateLimitStore: options?.rateLimitStore, logger: options?.logger });
+    const apiKey = getApiKey(request);
+    const clientIp = getClientIp(request, trustProxy);
+    const rl = await server.checkRateLimit(clientIp, apiKey);
+    if (!rl.allowed) {
+      return new Response("rate limit exceeded", { status: 429, headers: { ...import_corsen_context.SECURITY_HEADERS, "Retry-After": rl.headers["Retry-After"] || "60" } });
+    }
+    if (!server.checkAuth(apiKey)) {
+      return new Response("unauthorized", { status: 401, headers: { ...import_corsen_context.SECURITY_HEADERS } });
+    }
+    const headers = new Headers({
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+      ...import_corsen_context.SECURITY_HEADERS
+    });
+    headers.set("Cache-Control", "no-cache");
+    const encoder = new TextEncoder();
+    const stream = new ReadableStream({
+      start(controller) {
+        controller.enqueue(encoder.encode(`event: endpoint
+data: ${mcpEndpoint}
+
+`));
+        const interval = setInterval(() => {
+          try {
+            controller.enqueue(encoder.encode(": ping\n\n"));
+          } catch {
+            clearInterval(interval);
+          }
+        }, 3e4);
+        request.signal.addEventListener("abort", () => {
+          clearInterval(interval);
+          controller.close();
+        });
+      }
+    });
+    return new Response(stream, { status: 200, headers });
+  };
+}
+function createLlmsTxtHandler(config, provider) {
+  return async function GET() {
+    const instance = getInstance(config, provider);
+    const text = await instance.generateLlmsTxt();
+    const headers = new Headers(import_corsen_context.SECURITY_HEADERS);
+    headers.set("Content-Type", "text/plain; charset=utf-8");
+    headers.set("Cache-Control", "public, max-age=3600, s-maxage=3600");
+    return new Response(text, { status: 200, headers });
+  };
+}
+function createLlmsFullTxtHandler(config, provider) {
+  return async function GET() {
+    const instance = getInstance(config, provider);
+    const text = await instance.generateLlmsFullTxt();
+    const headers = new Headers(import_corsen_context.SECURITY_HEADERS);
+    headers.set("Content-Type", "text/plain; charset=utf-8");
+    headers.set("Cache-Control", "public, max-age=3600, s-maxage=3600");
+    return new Response(text, { status: 200, headers });
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createLlmsFullTxtHandler,
+  createLlmsTxtHandler,
+  createMCPHandler,
+  createSSEHandler,
+  withCorsenContext
+});

package/dist/index.mjs

@@ -0,0 +1,282 @@
+// src/with-corsen-context.ts
+function withCorsenContext(corsenConfig) {
+  return function wrapNextConfig(nextConfig = {}) {
+    const existingRewrites = nextConfig.rewrites;
+    return {
+      ...nextConfig,
+      async rewrites() {
+        const corsenRewrites = [
+          {
+            source: "/llms.txt",
+            destination: "/api/corsen-context/llms-txt"
+          },
+          {
+            source: "/llms-full.txt",
+            destination: "/api/corsen-context/llms-full-txt"
+          }
+        ];
+        if (existingRewrites) {
+          const existing = await existingRewrites();
+          if (Array.isArray(existing)) {
+            return [...corsenRewrites, ...existing];
+          }
+          return {
+            ...existing,
+            beforeFiles: [...corsenRewrites, ...existing.beforeFiles || []]
+          };
+        }
+        return corsenRewrites;
+      },
+      // Store config for runtime handlers
+      env: {
+        ...nextConfig.env,
+        CORSEN_CONTEXT_CONFIG: JSON.stringify(corsenConfig)
+      }
+    };
+  };
+}
+
+// src/handlers.ts
+import {
+  CorsenContext,
+  MAX_BODY_SIZE,
+  SECURITY_HEADERS
+} from "@corsenai/corsen-context";
+var cachedInstances = /* @__PURE__ */ new WeakMap();
+function getInstance(config, provider, cache) {
+  let providerInstances = cachedInstances.get(provider);
+  if (!providerInstances) {
+    providerInstances = /* @__PURE__ */ new Map();
+    cachedInstances.set(provider, providerInstances);
+  }
+  const configKey = stableStringify(config);
+  let instance = providerInstances.get(configKey);
+  if (!instance) {
+    instance = new CorsenContext(config, provider, cache);
+    providerInstances.set(configKey, instance);
+  }
+  return instance;
+}
+async function readBoundedText(request) {
+  const body = request.body;
+  if (!body || typeof body.getReader !== "function") {
+    const text = await request.text();
+    return new TextEncoder().encode(text).length > MAX_BODY_SIZE ? null : text;
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (value) {
+      total += value.byteLength;
+      if (total > MAX_BODY_SIZE) {
+        await reader.cancel();
+        return null;
+      }
+      chunks.push(value);
+    }
+  }
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(merged);
+}
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value) ?? "undefined";
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+  }
+  const record = value;
+  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`).join(",")}}`;
+}
+function getClientIp(request, trustProxy) {
+  if (trustProxy) {
+    const cfIp = request.headers.get("cf-connecting-ip");
+    if (cfIp) return cfIp.trim();
+    const realIp = request.headers.get("x-real-ip");
+    if (realIp) return realIp.trim();
+    const xff = request.headers.get("x-forwarded-for");
+    if (xff) {
+      const first = xff.split(",")[0]?.trim();
+      if (first) return first;
+    }
+  }
+  const ua = request.headers.get("user-agent") || "";
+  return `anon-${simpleHash(ua)}`;
+}
+function simpleHash(str) {
+  let hash = 0;
+  for (let i = 0; i < str.length; i++) {
+    hash = (hash << 5) - hash + str.charCodeAt(i) | 0;
+  }
+  return Math.abs(hash).toString(36);
+}
+function getApiKey(request) {
+  return request.headers.get("x-mcp-key") || request.headers.get("authorization")?.replace("Bearer ", "") || void 0;
+}
+function createMCPHandler(config, provider, options) {
+  const trustProxy = config.security?.trustProxy ?? false;
+  function createServer(instance) {
+    return instance.createMCPServer({
+      rateLimitStore: options?.rateLimitStore,
+      logger: options?.logger
+    });
+  }
+  async function POST(request) {
+    const instance = getInstance(config, provider, options?.cache);
+    const server = createServer(instance);
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(server.getSecurityHeaders())) {
+      headers.set(key, value);
+    }
+    headers.set("Content-Type", "application/json");
+    const origin = request.headers.get("origin") || void 0;
+    for (const [key, value] of Object.entries(server.getCorsHeaders(origin))) {
+      headers.set(key, value);
+    }
+    const clientIp = getClientIp(request, trustProxy);
+    const apiKey = getApiKey(request);
+    const rateLimit = await server.checkRateLimit(clientIp, apiKey);
+    for (const [key, value] of Object.entries(rateLimit.headers)) {
+      headers.set(key, value);
+    }
+    if (!rateLimit.allowed) {
+      return new Response(
+        JSON.stringify({ jsonrpc: "2.0", error: { code: -32e3, message: "Rate limit exceeded" }, id: null }),
+        { status: 429, headers }
+      );
+    }
+    if (!server.checkAuth(apiKey)) {
+      return new Response(
+        JSON.stringify({ jsonrpc: "2.0", error: { code: -32e3, message: "Unauthorized" }, id: null }),
+        { status: 401, headers }
+      );
+    }
+    const raw = await readBoundedText(request);
+    if (raw === null) {
+      return new Response(
+        JSON.stringify({ jsonrpc: "2.0", error: { code: -32600, message: "Request body too large" }, id: null }),
+        { status: 413, headers }
+      );
+    }
+    let body;
+    try {
+      body = JSON.parse(raw);
+    } catch {
+      return new Response(
+        JSON.stringify({ jsonrpc: "2.0", error: { code: -32700, message: "Parse error" }, id: null }),
+        { status: 400, headers }
+      );
+    }
+    const result = await server.handleRequest(body, clientIp, apiKey, { skipRateLimit: true });
+    if (result === null) {
+      return new Response(null, { status: 204, headers });
+    }
+    return new Response(JSON.stringify(result), { status: 200, headers });
+  }
+  async function OPTIONS(request) {
+    const instance = getInstance(config, provider, options?.cache);
+    const server = createServer(instance);
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(server.getSecurityHeaders())) {
+      headers.set(key, value);
+    }
+    const origin = request.headers.get("origin") || void 0;
+    for (const [key, value] of Object.entries(server.getCorsHeaders(origin))) {
+      headers.set(key, value);
+    }
+    return new Response(null, { status: 204, headers });
+  }
+  return { POST, OPTIONS };
+}
+function createSSEHandler(config, provider, options) {
+  const trustProxy = config.security?.trustProxy ?? false;
+  const gateProvider = provider ?? {
+    async getPages() {
+      return [];
+    },
+    async getPageContent() {
+      return null;
+    },
+    async searchContent() {
+      return [];
+    }
+  };
+  return async function GET(request) {
+    const siteUrl = config.siteUrl.replace(/\/$/, "");
+    const mcpEndpoint = `${siteUrl}${config.mcp?.endpoint || "/v1/mcp"}`;
+    const instance = getInstance(config, gateProvider, options?.cache);
+    const server = instance.createMCPServer({ rateLimitStore: options?.rateLimitStore, logger: options?.logger });
+    const apiKey = getApiKey(request);
+    const clientIp = getClientIp(request, trustProxy);
+    const rl = await server.checkRateLimit(clientIp, apiKey);
+    if (!rl.allowed) {
+      return new Response("rate limit exceeded", { status: 429, headers: { ...SECURITY_HEADERS, "Retry-After": rl.headers["Retry-After"] || "60" } });
+    }
+    if (!server.checkAuth(apiKey)) {
+      return new Response("unauthorized", { status: 401, headers: { ...SECURITY_HEADERS } });
+    }
+    const headers = new Headers({
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+      ...SECURITY_HEADERS
+    });
+    headers.set("Cache-Control", "no-cache");
+    const encoder = new TextEncoder();
+    const stream = new ReadableStream({
+      start(controller) {
+        controller.enqueue(encoder.encode(`event: endpoint
+data: ${mcpEndpoint}
+
+`));
+        const interval = setInterval(() => {
+          try {
+            controller.enqueue(encoder.encode(": ping\n\n"));
+          } catch {
+            clearInterval(interval);
+          }
+        }, 3e4);
+        request.signal.addEventListener("abort", () => {
+          clearInterval(interval);
+          controller.close();
+        });
+      }
+    });
+    return new Response(stream, { status: 200, headers });
+  };
+}
+function createLlmsTxtHandler(config, provider) {
+  return async function GET() {
+    const instance = getInstance(config, provider);
+    const text = await instance.generateLlmsTxt();
+    const headers = new Headers(SECURITY_HEADERS);
+    headers.set("Content-Type", "text/plain; charset=utf-8");
+    headers.set("Cache-Control", "public, max-age=3600, s-maxage=3600");
+    return new Response(text, { status: 200, headers });
+  };
+}
+function createLlmsFullTxtHandler(config, provider) {
+  return async function GET() {
+    const instance = getInstance(config, provider);
+    const text = await instance.generateLlmsFullTxt();
+    const headers = new Headers(SECURITY_HEADERS);
+    headers.set("Content-Type", "text/plain; charset=utf-8");
+    headers.set("Cache-Control", "public, max-age=3600, s-maxage=3600");
+    return new Response(text, { status: 200, headers });
+  };
+}
+export {
+  createLlmsFullTxtHandler,
+  createLlmsTxtHandler,
+  createMCPHandler,
+  createSSEHandler,
+  withCorsenContext
+};

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@corsenai/corsen-context-nextjs",
+  "version": "1.2.0",
+  "description": "Next.js adapter for Corsen Context — AI Context Layer with MCP + llms.txt",
+  "author": "Corsen AI <contact@corsen.ai>",
+  "license": "MIT",
+  "homepage": "https://github.com/CorsenAI/corsen-context",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/CorsenAI/corsen-context.git",
+    "directory": "packages/nextjs-adapter"
+  },
+  "keywords": [
+    "mcp",
+    "llms-txt",
+    "nextjs",
+    "ai",
+    "corsen"
+  ],
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "dependencies": {
+    "@corsenai/corsen-context": "1.2.0"
+  },
+  "peerDependencies": {
+    "next": ">=13.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "next": "^15.0.0",
+    "tsup": "^8.3.0",
+    "typescript": "^5.7.0",
+    "vitest": "^2.1.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bugs": {
+    "url": "https://github.com/CorsenAI/corsen-context/issues"
+  },
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format cjs,esm --dts --clean",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  }
+}