client

type AuthInfo struct {
	ExtractorInfo
	// TokenField, when set, names where the access token lives in a
	// login response — a dotted path like "token", "accessToken", or
	// "data.token". The SDK reads it instead of guessing common shapes
	// (see extractLoginToken in nexus-client.js). Empty by default; the
	// framework leaves it unset so apps/extensions populate it via a
	// custom client.Config.Manifest projection when their login handler
	// uses a non-standard envelope.
	TokenField string `json:"tokenField,omitempty"`
	// CSRFCookie / CSRFHeader configure the double-submit CSRF defense
	// the SDK applies to state-changing requests under cookie-based auth
	// strategies (cookie/chain/custom). Empty falls back to the SDK
	// defaults ("csrftoken" / "X-CSRFToken", the Django/Laravel
	// convention; see DefaultCSRFCookie / DefaultCSRFHeader). auth.Module
	// populates these from auth.Config (defaulted via AuthMeta.WithDefaults)
	// so a wired app carries them explicitly.
	CSRFCookie      string `json:"csrfCookie,omitempty"`
	CSRFHeader      string `json:"csrfHeader,omitempty"`
	LoginPath       string `json:"loginPath,omitempty"`
	LoginTransport  string `json:"loginTransport,omitempty"`
	LoginName       string `json:"loginName,omitempty"`
	LogoutPath      string `json:"logoutPath,omitempty"`
	LogoutTransport string `json:"logoutTransport,omitempty"`
	LogoutName      string `json:"logoutName,omitempty"`
	MePath          string `json:"mePath,omitempty"`
	MeTransport     string `json:"meTransport,omitempty"`
	MeName          string `json:"meName,omitempty"`
}

type AuthMeta struct {
	TokenField string // dotted path to the login-response token ("data.token")
	CSRFCookie string // non-HttpOnly cookie the SDK reads for CSRF double-submit
	CSRFHeader string // header the SDK echoes the cookie value into
}

type Config struct {
	// Enabled gates the entire mount. Default false.
	Enabled bool

	// DevDisabled opts OUT of the dev-only auto-mount. Under
	// `nexus dev` (NEXUS_DEV=1) the framework mounts the client SDK's
	// manifest + runtime routes automatically when the app didn't
	// enable them itself — so the SPA's vite proxy auto-syncs module
	// RoutePrefixes (read from the live /__nexus/client/manifest.json)
	// and the SDK is available without ceremony. The implicit dev
	// mount never dumps files (OutDir is forced empty) — routes only.
	// Set DevDisabled to keep the SDK closed even in dev ("closed
	// manually"). No effect in production (NEXUS_DEV is never set
	// there) or when Enabled is already true.
	DevDisabled bool

	// Path is the URL prefix the SDK routes mount under. Default
	// DefaultPath ("/__nexus/client"). The dashboard at /__nexus/*
	// and the SDK at /__nexus/client/* share an obvious namespace;
	// the runtime files (client.js, vue.js, *.d.ts) are always
	// served unauthenticated since browsers fetch them anonymously
	// before any login. The MANIFEST is gated by the Public flag.
	Path string

	// Public, when true, exposes the FULL manifest (every endpoint,
	// every schema, every named ref, every WS path) on the
	// unauthenticated /manifest.json route — the v0.28.x default.
	//
	// Default false: the public manifest is stripped to the safe
	// minimum (Version, BasePath, Auth section, auth-flagged
	// endpoints only) so an anonymous browser can still complete
	// the login flow without leaking the API surface to scrapers.
	//
	// What works on each setting (runtime, browser-side):
	//
	//	             Public: false (default)   Public: true
	//	nx.auth.*    ✓                          ✓
	//	nx.rest      ✓ (path/args caller-side)  ✓
	//	nx.ws        ✓ (path caller-side)       ✓
	//	nx.query     ✗ (op lookup needs full)   ✓
	//	nx.mutate    ✗                          ✓
	//	nx.crud      ✗                          ✓
	//
	// TypeScript completion is unaffected by this flag — types
	// come from the dumped sdk/client.d.ts (vendored at build
	// time), not the runtime manifest.
	//
	// Recommended pattern for production: leave Public false on
	// public-facing deployments; flip to true only on internal
	// admin/dev listeners (compose with nexus.IfDeployment).
	//
	// Auto-derived from nexus.Config.Introspection: when
	// Introspection is true, Public is forced true at Mount time.
	// The two flags are the same "schema visibility" lever at
	// different layers — gating one without the other was security
	// theatre because GraphQL's __schema query already exposed more
	// than the skinny manifest would. Set Introspection: true and
	// the runtime manifest follows automatically; you no longer need
	// to repeat Public: true.
	Public bool

	// Middleware applies to every SDK route. Empty by default. For
	// the manifest specifically, prefer the Public flag — Middleware
	// gates the runtime .js files too, which most apps don't want.
	Middleware []httpx.HandlerFunc

	// Manifest overrides the default per-build manifest projection.
	// Most apps leave this nil; the framework's default reads the
	// live registry. Override for multi-tenant filtering or custom
	// type-stripping. Called once on first request, then cached;
	// see Handler.Reload to invalidate.
	Manifest func() Manifest

	// OutDir, when non-empty, makes Mount also dump the SDK files
	// (client.js + client.d.ts, vue.js + vue.d.ts, manifest.json) to
	// disk on startup so a frontend's filesystem-based tooling
	// (TypeScript compiler, Vite, JetBrains, VS Code) can resolve
	// types and runtime imports without a manual `nexus client --out`
	// step. Each .js sits next to its .d.ts so TS auto-pairs them
	// regardless of whether the import uses the runtime URL or a
	// plain relative path.
	//
	// Idempotent: files are byte-compared and skipped when content
	// matches, preserving mtime — file-watcher reloads + IDE
	// re-indexing don't fire on no-op restarts.
	//
	// Recommend leaving empty in production builds. Apps that need
	// it gated to dev only can branch on an env var when building
	// the Config (this field intentionally has no built-in env
	// magic — explicit beats implicit for "writes files to your
	// project tree").
	//
	// Auto-detection: when left empty AND a frontend dir is
	// detected (web/, frontend/, client/, app/ — anything containing
	// vite.config.ts), Mount fills this with `./<dir>/sdk`. Set
	// explicitly to override or to disable the dump in non-standard
	// layouts.
	OutDir string

	// TSConfig, when non-empty, makes Mount merge path mappings
	// (the runtime URL imports → OutDir files) into the named
	// jsconfig.json or tsconfig.json on startup. Existing fields
	// (compilerOptions.target, include, exclude, custom paths)
	// survive untouched. Same idempotent contract as OutDir.
	//
	// Only takes effect when OutDir is also set — the path
	// mappings need a target.
	//
	// Auto-detection: when left empty AND a frontend dir is
	// detected, Mount fills this with `./<dir>/tsconfig.json` IF
	// that file exists. Missing tsconfig (jsconfig-only or no TS
	// config at all) keeps the field empty so the dump path
	// doesn't try to read a phantom file.
	TSConfig string

	// ViteConfig, when non-empty, makes Mount auto-attach the
	// nexus-vite-plugin (auto-select) to a Vite config on startup.
	// Two idempotent edits land in the file:
	//
	//   1. an `import nexusAutoSelect from '<rel>/nexus-vite-plugin.js'`
	//      after the last top-level import,
	//   2. a `nexusAutoSelect()` entry inside the first `plugins:`
	//      array.
	//
	// Path can be absolute or relative to the Go binary's CWD.
	// Only takes effect when OutDir is set — the plugin file lives
	// under OutDir. Re-running is a no-op once both edits have
	// landed; the framework keys idempotence off the literal
	// "nexusAutoSelect" identifier in the file.
	//
	// Recommend gating this behind a dev-mode flag in production
	// builds — there's no reason to mutate a checked-in config on
	// every prod boot.
	//
	// Auto-detection: when left empty AND a frontend dir is
	// detected (vite.config.ts present), Mount fills this with
	// `./<dir>/vite.config.ts`. Together with the OutDir +
	// TSConfig defaults, this means the canonical scaffold layout
	// only needs `client.Config{Enabled: true}`.
	ViteConfig string

	// SkipAssets, when true, suppresses the static SDK asset routes
	// (client.js, client.d.ts, vue.js, vue.d.ts). The manifest and
	// contributions routes still mount — they're the codegen surface
	// and don't depend on the runtime SDK.
	//
	// Set this for apps that consume the typed codegen tree
	// (`nexus generate frontend`) instead of importing from
	// /__nexus/client/*.js at runtime. frontend.Plugin wires it
	// automatically based on its RuntimeSDK field; direct
	// client.Mount / nexus.ClientUse callers default to false
	// (assets served), preserving back-compat.
	SkipAssets bool

	// Unguarded disables the introspection-network gate that nexus.New
	// otherwise prepends to the SDK routes. By default the client
	// surface — the manifest (a full API map when Public) and the
	// .d.ts (the full type surface) — is locked down to the same peers
	// the dashboard allows: open under `nexus dev` / Introspection,
	// 404 to everyone else in a locked-down production binary. Set
	// Unguarded only when you deliberately serve the runtime SDK to the
	// public (e.g. a public SPA that fetches the runtime manifest at
	// load time instead of vendoring sdk/ at build time). Prefer
	// build-time vendoring (`nexus client --out`) over flipping this —
	// a public manifest is an attacker's API map.
	Unguarded bool
}

type ContributionFileRec struct {
	Path string `json:"path"`
	Body string `json:"body"`
}

type ContributionPluginRec struct {
	Name  string                `json:"name"`
	Files []ContributionFileRec `json:"files,omitempty"`
}

type ContributionsBuilder func(framework string) (ContributionsResponse, error)

type ContributionsResponse struct {
	Version   string                  `json:"version"`
	Framework string                  `json:"framework,omitempty"`
	Plugins   []ContributionPluginRec `json:"plugins,omitempty"`
}

type EndpointInfo struct {
	Service     string            `json:"service"`
	Module      string            `json:"module,omitempty"`
	Transport   string            `json:"transport"` // "rest" | "graphql" | "websocket"
	Method      string            `json:"method"`
	Path        string            `json:"path"`
	Name        string            `json:"name"`
	Description string            `json:"description,omitempty"`
	Args        *registry.TypeRef `json:"args,omitempty"`
	Return      *registry.TypeRef `json:"return,omitempty"`

	// AuthRequired is true when the endpoint is gated by auth.Required
	// (or any middleware whose name starts with "auth:" — covers
	// Required + Requires).
	AuthRequired bool `json:"authRequired,omitempty"`

	// RequiresPerm is the list of permission strings auth.Requires
	// declared. Empty for unauthed endpoints or auth.Required without
	// specific perms. Derived from middleware names of the form
	// "auth:requires:perm-a,perm-b".
	RequiresPerm []string `json:"requiresPerm,omitempty"`

	// AuthFlow is "login" | "logout" | "me" when the endpoint was
	// marked via nexus.AuthRoute. Empty for normal endpoints.
	AuthFlow string `json:"authFlow,omitempty"`

	Deprecated        bool   `json:"deprecated,omitempty"`
	DeprecationReason string `json:"deprecationReason,omitempty"`
}

type ExtractorInfo struct {
	Strategy   string          `json:"strategy"`
	HeaderName string          `json:"headerName,omitempty"`
	CookieName string          `json:"cookieName,omitempty"`
	Chain      []ExtractorInfo `json:"chain,omitempty"`
}

type Handler struct {
	// contains filtered or unexported fields
}

type Manifest struct {
	Version   string                        `json:"version"`
	BasePath  string                        `json:"basePath"`
	Services  []ServiceInfo                 `json:"services,omitempty"`
	Endpoints []EndpointInfo                `json:"endpoints,omitempty"`
	Resources []ResourceInfo                `json:"resources,omitempty"`
	WS        []WSPathInfo                  `json:"ws,omitempty"`
	Auth      *AuthInfo                     `json:"auth,omitempty"`
	Refs      map[string]registry.NamedType `json:"refs,omitempty"`

	// Projected marks the stripped (non-Public) manifest served to
	// anonymous browsers — auth flows only, no schemas, no GraphQL/CRUD
	// ops. The runtime SDK reads it to turn the otherwise-cryptic
	// "no op named X" miss into a "the server is serving the stripped
	// manifest" hint. Omitted (false) on the full manifest.
	Projected bool `json:"projected,omitempty"`
}

type ResourceInfo struct {
	Name        string `json:"name"`
	Kind        string `json:"kind"`
	Description string `json:"description,omitempty"`
}

type ServiceInfo struct {
	Name        string `json:"name"`
	Description string `json:"description,omitempty"`
}

type WSMessage struct {
	Type        string            `json:"type"`
	Args        *registry.TypeRef `json:"args,omitempty"`
	Description string            `json:"description,omitempty"`
}

type WSPathInfo struct {
	Path     string      `json:"path"`
	Service  string      `json:"service"`
	Messages []WSMessage `json:"messages"`
}