@bhooai/nexus-cli 0.1.5 → 2.0.1

package/templates/apps/ai-server/routers/preflight.py

@@ -1,169 +0,0 @@
-"""Preflight diagnostics router — connectivity + latency checks.
-
-The Node backend composes the targets it wants checked (backend health, AI
-server health, Mongo/Redis TCP reachability, service ports) and posts them here.
-Python performs the checks concurrently and returns a normalized report. Only
-stdlib (`socket`) + httpx are used, so this router adds no new dependencies.
-
-Failed checks carry an `errorCategory` (refused/timeout/dns/ssl/http/other) plus
-a short human-readable `error` message so the admin console never has to surface
-raw transport exceptions like httpx's "All connection attempts failed...".
-"""
-from __future__ import annotations
-
-import asyncio
-import socket
-import ssl
-import time
-from typing import Any, Literal
-from urllib.parse import urlparse
-
-import httpx
-from fastapi import APIRouter, HTTPException
-from pydantic import BaseModel
-
-router = APIRouter()
-
-
-class Target(BaseModel):
-    name: str
-    kind: Literal["http", "tcp"] = "tcp"
-    url: str | None = None
-    host: str | None = None
-    port: int | None = None
-    timeout: float | None = None
-
-
-class PreflightRequest(BaseModel):
-    targets: list[Target] = []
-    timeout: float = 2.0
-
-
-def _classify_error(e: Exception, host: str = "", port: int | None = None) -> tuple[str, str]:
-    """Map an exception to a (category, friendly message) pair.
-
-    httpx wraps low-level socket errors, so when the top-level exception is the
-    generic "All connection attempts failed..." the underlying cause is unwrapped.
-    """
-    endpoint = f"{host}:{port}" if host else "target"
-
-    if isinstance(e, (httpx.ConnectTimeout, httpx.ConnectError, asyncio.TimeoutError, socket.timeout)):
-        try:
-            cause = e.__cause__
-        except AttributeError:
-            cause = None
-        if isinstance(cause, socket.gaierror):
-            return "dns", f"host not found: {host or 'unknown'}"
-        if isinstance(cause, (ConnectionRefusedError, OSError)) and getattr(cause, "errno", None) == getattr(socket, "ECONNREFUSED", 111):
-            return "refused", f"connection refused on {endpoint} — is the service running?"
-        return "timeout", "timed out — the service may be filtering traffic or is down"
-
-    if isinstance(e, socket.gaierror):
-        return "dns", f"host not found: {host or 'unknown'}"
-    if isinstance(e, (ConnectionRefusedError, OSError)) and getattr(e, "errno", None) == getattr(socket, "ECONNREFUSED", 111):
-        return "refused", f"connection refused on {endpoint} — is the service running?"
-    if isinstance(e, ssl.SSLError):
-        return "ssl", "TLS handshake failed"
-    return "other", str(e) or type(e).__name__
-
-
-async def _check_http(target: Target, timeout: float) -> dict[str, Any]:
-    url = target.url or ""
-    start = time.perf_counter()
-    try:
-        async with httpx.AsyncClient(timeout=httpx.Timeout(timeout, connect=1.0, read=timeout, write=timeout, pool=timeout), follow_redirects=True) as client:
-            resp = await client.get(url)
-        latency_ms = round((time.perf_counter() - start) * 1000, 1)
-        ok = resp.status_code < 400
-        category: str | None = None
-        error: str | None = None
-        if not ok:
-            category = "http"
-            error = f"HTTP {resp.status_code}"
-        return {
-            "name": target.name,
-            "kind": "http",
-            "url": url,
-            "ok": ok,
-            "status": resp.status_code,
-            "latencyMs": latency_ms,
-            "errorCategory": category,
-            "error": error,
-        }
-    except Exception as e:  # noqa: BLE001 - classify connectivity errors
-        latency_ms = round((time.perf_counter() - start) * 1000, 1)
-        category, message = _classify_error(e, urlparse(url).hostname or "", urlparse(url).port)
-        return {
-            "name": target.name,
-            "kind": "http",
-            "url": url,
-            "ok": False,
-            "status": None,
-            "latencyMs": latency_ms,
-            "errorCategory": category,
-            "error": message,
-        }
-
-
-async def _check_tcp(target: Target, timeout: float) -> dict[str, Any]:
-    host = target.host or ""
-    port = target.port or 0
-    start = time.perf_counter()
-    try:
-        reader, writer = await asyncio.wait_for(
-            asyncio.open_connection(host, port, limit=256),
-            timeout,
-        )
-        latency_ms = round((time.perf_counter() - start) * 1000, 1)
-        writer.close()
-        try:
-            await writer.wait_closed()
-        except Exception:  # noqa: BLE001
-            pass
-        return {
-            "name": target.name,
-            "kind": "tcp",
-            "host": host,
-            "port": port,
-            "ok": True,
-            "latencyMs": latency_ms,
-            "errorCategory": None,
-            "error": None,
-        }
-    except Exception as e:  # noqa: BLE001 - classify connectivity errors
-        latency_ms = round((time.perf_counter() - start) * 1000, 1)
-        category, message = _classify_error(e, host, port)
-        return {
-            "name": target.name,
-            "kind": "tcp",
-            "host": host,
-            "port": port,
-            "ok": False,
-            "latencyMs": latency_ms,
-            "errorCategory": category,
-            "error": message,
-        }
-
-
-@router.post("/preflight")
-async def preflight(req: PreflightRequest):
-    if not req.targets:
-        raise HTTPException(status_code=400, detail="at least one target is required")
-    started = time.perf_counter()
-    results = await asyncio.gather(*(_check_http(t, t.timeout or req.timeout) if t.kind == "http" else _check_tcp(t, t.timeout or req.timeout) for t in req.targets))
-    duration_ms = round((time.perf_counter() - started) * 1000, 1)
-
-    failed = [c for c in results if not c["ok"]]
-    passed = [c for c in results if c["ok"]]
-    # failed then warnings (slow) then the rest, preserving stable order within groups.
-    slow = [c for c in passed if isinstance(c.get("latencyMs"), (int, float)) and c["latencyMs"] > 800]
-    ok = [c for c in passed if c not in slow]
-
-    return {
-        "ranAt": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-        "durationMs": duration_ms,
-        "passed": len(passed),
-        "warnings": len(slow),
-        "failed": len(failed),
-        "checks": failed + slow + ok,
-    }

package/templates/apps/ai-server/settings.py

@@ -1,48 +0,0 @@
-"""Configuration for the AI server (env-driven)."""
-from __future__ import annotations
-
-import os
-from dataclasses import dataclass, field
-
-
-def _env(key: str, default: str) -> str:
-    return os.environ.get(key, default)
-
-
-@dataclass
-class Settings:
-    # OpenAI-compatible upstreams. Both OpenAI and Ollama speak the same shape;
-    # only the base URL + auth header differ.
-    openai_base_url: str = field(default_factory=lambda: _env("AI_OPENAI_BASE_URL", "https://api.openai.com/v1"))
-    # Fall back to the generic OPENAI_API_KEY / OLLAMA_HOST names so project
-    # .env keys work with the AI server as well as the AI_* names.
-    openai_api_key: str = field(
-        default_factory=lambda: _env("AI_OPENAI_API_KEY", _env("OPENAI_API_KEY", ""))
-    )
-    ollama_base_url: str = field(
-        default_factory=lambda: _env(
-            "AI_OLLAMA_BASE_URL",
-            (_env("OLLAMA_HOST", "http://localhost:11434") + "/v1"),
-        )
-    )
-    ollama_api_key: str = field(default_factory=lambda: _env("AI_OLLAMA_API_KEY", ""))
-
-    default_provider: str = field(default_factory=lambda: _env("AI_DEFAULT_PROVIDER", "auto"))
-    request_timeout_s: float = field(default_factory=lambda: float(_env("AI_TIMEOUT_S", "120")))
-    server_port: int = field(default_factory=lambda: int(_env("AI_PORT", "8000")))
-
-    # CORS: the Node backend proxies, but allow dev tools + the admin to call directly.
-    cors_origins: list[str] = field(default_factory=lambda: _env("AI_CORS_ORIGINS", "*").split(","))
-
-
-settings = Settings()
-
-
-def resolve_provider(requested: str | None) -> str:
-    """Resolve 'auto' to a concrete provider. auto → openai if a key is set, else ollama."""
-    provider = (requested or settings.default_provider or "auto").lower()
-    if provider == "auto":
-        provider = "openai" if settings.openai_api_key else "ollama"
-    if provider not in ("openai", "ollama"):
-        raise ValueError(f"unknown provider: {provider}")
-    return provider

package/templates/apps/backend/package.json

@@ -1,34 +0,0 @@
-{
-  "name": "@bhooai/app-backend",
-  "version": "0.1.0",
-  "private": true,
-  "type": "module",
-  "main": "./src/main.ts",
-  "scripts": {
-    "dev": "tsx watch src/main.ts",
-    "start": "tsx src/main.ts",
-    "test": "vitest run"
-  },
-  "dependencies": {
-    "@bhooai/nexus-core": "*",
-    "@bhooai/nexus-auth": "*",
-    "@bhooai/nexus-telemetry": "*",
-    "@bhooai/nexus-data": "*",
-    "@bhooai/nexus-realtime": "*",
-    "@bhooai/nexus-graphql": "*",
-    "@bhooai/nexus-cache": "*",
-    "@bhooai/nexus-email": "*",
-    "@bhooai/nexus-payments": "*",
-    "@bhooai/nexus-crypto": "*",
-    "@bhooai/nexus-ads": "*",
-    "@bhooai/nexus-plugins": "*",
-    "@bhooai/nexus-ai-client": "*",
-    "@bhooai/nexus-cluster": "*"
-  },
-  "devDependencies": {
-    "@types/node": "^22.5.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.6.2",
-    "vitest": "^2.1.1"
-  }
-}

package/templates/apps/backend/src/main.ts

@@ -1,375 +0,0 @@
-import { dirname, join, resolve } from 'node:path';
-import { readFile } from 'node:fs/promises';
-import { fileURLToPath } from 'node:url';
-import { loadConfig, loadConfigAuto, Router, NexusServer, bodyParser, serveStatic, registerUploadRoutes } from '@bhooai/nexus-core';
-import { cors, csrf, securityHeaders, rateLimit, issueCsrfToken, AuthService, MemorySessionStore } from '@bhooai/nexus-auth';
-import { Logger, MetricsRegistry } from '@bhooai/nexus-telemetry';
-import {
-  connect,
-  getConnection,
-  resolveProjectInfo,
-  connectProjectInfo,
-  getProjectInfo,
-  listProjectInfo,
-  upsertProjectInfo,
-  closeProjectInfo,
-  type ProjectInfo,
-} from '@bhooai/nexus-data';
-import { RealtimeServer } from '@bhooai/nexus-realtime';
-import { createGateway, graphqlHttpHandler, SubscriptionServer, PubSub, type GraphQLContext } from '@bhooai/nexus-graphql';
-import { Cache } from '@bhooai/nexus-cache';
-import { createEmail, TemplateEngine } from '@bhooai/nexus-email';
-import { createPayments } from '@bhooai/nexus-payments';
-import { generateKeyPair, createSelfSignedCertificate, createCsr } from '@bhooai/nexus-crypto';
-import { ClusterManager } from '@bhooai/nexus-cluster';
-import { registerAuthRoutes } from './modules/auth/authRoutes.js';
-import { buildUsersSubgraph } from './modules/users/userGraph.js';
-import { loadPlugins } from './plugins/loadPlugins.js';
-import { registerAiRoutes } from './modules/ai/aiProxy.js';
-import { registerAdminRoutes } from './modules/admin/adminRoutes.js';
-import { registerPaymentRoutes } from './modules/payments/paymentRoutes.js';
-import { recordTransaction } from './modules/payments/paymentStore.js';
-import { appendRequestLog, closeRequestLog } from './modules/requests/requestLog.js';
-
-// Keep project-relative config and runtime directories tied to this app tree,
-// not to the directory from which the backend command was launched.
-const PROJECT_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
-
-/**
- * BhooAI Nexus backend bootstrap (Phase 5 checkpoint).
- *
- * Boots an inbuilt HTTP server with the security stack applied:
- * security headers → CORS → body parsing → CSRF → rate limiting.
- * Connects to MongoDB, registers the User model, mounts /auth/* routes,
- * and serves a single-subgraph GraphQL gateway over HTTP (/graphql) and
- * WebSocket subscriptions (/graphql/ws). Realtime (/ws) runs alongside.
- */
-async function main(): Promise<void> {
-  const config = await loadConfigAuto({ root: PROJECT_ROOT });
-  const log = new Logger({
-    level: config.logging.level,
-    format: config.logging.format,
-    console: config.logging.console,
-    redact: ['password', 'secret', 'authorization'],
-  });
-
-  // Each project owns its own database (named from its package.json). The
-  // default connection targets that database; a second connection targets the
-  // shared project-info store (nexus_projects) for name + settings.
-  const project: ProjectInfo = await resolveProjectInfo(PROJECT_ROOT);
-  const dbName = config.db.name ?? project.dbName;
-
-  connect(config.db.uri, { name: dbName, autoIndex: config.db.autoIndex });
-  await getConnection().db;
-  connectProjectInfo(config.db.uri, { autoIndex: config.db.autoIndex });
-  const allProjects = await listProjectInfo();
-  // Prefer the record matched by path so a project renamed via the admin panel
-  // keeps its identity (and settings) across restarts.
-  const storedProject = allProjects.find((p) => p.path === PROJECT_ROOT) ?? (await getProjectInfo(project.name).catch(() => null));
-  const configuredAiProviders = (config.ai.providers ?? []).map((provider) => ({
-    id: provider.id,
-    label: provider.label,
-    baseUrl: provider.baseUrl,
-    enabled: provider.enabled,
-    ...(provider.defaultModel ? { defaultModel: provider.defaultModel } : {}),
-  }));
-  await upsertProjectInfo({
-    ...project,
-    dbName,
-    status: 'running',
-    startedAt: new Date().toISOString(),
-    version: storedProject?.version ?? await readPackageVersion(PROJECT_ROOT),
-    settings: {
-      ...(storedProject?.settings ?? {}),
-      env: config.env,
-      host: config.server.host,
-      port: config.server.port,
-      graphqlPath: config.graphql.path,
-      websocketPath: config.ws.path,
-      database: dbName,
-      ...(!storedProject?.settings?.aiProviders && configuredAiProviders.length > 0
-        ? { aiProviders: configuredAiProviders }
-        : {}),
-    },
-  });
-  log.info('connected to MongoDB', { project: project.name, db: dbName });
-
-  // One AuthService shared by realtime + GraphQL context (token verification
-  // is stateless; the session store is only used for login/refresh flows).
-  const authService = new AuthService(
-    { secret: config.auth.jwt.secret, algorithm: 'HS256', issuer: config.auth.jwt.issuer, audience: config.auth.jwt.audience, accessTtl: config.auth.jwt.accessTtl, refreshTtl: config.auth.jwt.refreshTtl },
-    new MemorySessionStore(),
-  );
-
-  const router = new Router();
-  const uploadsDir = join(PROJECT_ROOT, config.uploads.dir);
-
-  // Multipart uploads are persisted beneath the project-local /uploads folder.
-  // Filenames are generated by the framework; the public path is read-only.
-  registerUploadRoutes(router, {
-    directory: uploadsDir,
-    path: config.uploads.path,
-    publicPath: config.uploads.path,
-    maxFileSize: config.uploads.maxFileSize,
-    maxFiles: config.uploads.maxFiles,
-    allowedTypes: config.uploads.allowedTypes,
-  });
-
-  // Health check (no CSRF, no rate limit — always available).
-  router.get('/health', (ctx) => {
-    ctx.json({ status: 'ok', env: config.env, time: Date.now() });
-  });
-
-  // CSRF token endpoint — mints a double-submit token cookie + returns it.
-  router.get('/csrf-token', (ctx) => {
-    const token = issueCsrfToken(ctx, { trustedOrigins: trustedOrigins(config) });
-    ctx.json({ token });
-  });
-
-  // A sample unsafe route to demonstrate CSRF enforcement.
-  router.post('/echo', (ctx) => {
-    ctx.json({ received: ctx.body });
-  });
-
-  // Auth routes (register/login/refresh/logout/me + OAuth). Requires DB.
-  registerAuthRoutes(router, config, () => pubsub.publish('USER_COUNT', 1));
-
-  // Create a mutable copy of the AI providers array so the admin provider
-  // management endpoints can mutate API keys / enabled state in-place, and
-  // the AI proxy sees the updates without restarting. The config is frozen
-  // (Object.freeze) so we must clone before passing to both routes.
-  const aiProviders = (config.ai.providers ?? []).map((p) => ({ ...p }));
-
-  // AI proxy — mounts /ai/* OpenAI-compatible routes that re-emit SSE from the
-  // Python AI server. The browser never calls Python directly.
-  registerAiRoutes(router, {
-    serverUrl: config.ai.serverUrl,
-    timeoutMs: config.ai.timeoutMs,
-    // Pass the mutable array — same reference the admin endpoints mutate.
-    providers: aiProviders,
-  });
-
-  // GraphQL: single-subgraph gateway over the users subgraph. The context
-  // builder verifies the optional Bearer access token so `me` can resolve.
-  const usersSubgraph = buildUsersSubgraph();
-  const gateway = createGateway({ subgraph: usersSubgraph });
-  // PubSub feeds the GraphQL `userCount` subscription (published on register).
-  const pubsub = new PubSub();
-  const graphContext = async (ctx: import('@bhooai/nexus-core').RequestContext): Promise<GraphQLContext> => {
-    const auth = ctx.headers['authorization'];
-    const header = Array.isArray(auth) ? auth[0] : auth;
-    const token = header && header.startsWith('Bearer ') ? header.slice(7) : undefined;
-    if (token) {
-      try {
-        const claims = await authService.verifyAccessToken(token);
-        return { request: ctx, user: { sub: claims.sub, roles: claims.roles ?? [], sid: claims.sid }, pubsub };
-      } catch { /* invalid token → anonymous */ }
-    }
-    return { request: ctx, pubsub };
-  };
-  router.post(config.graphql.path, graphqlHttpHandler({ gateway, introspection: config.graphql.introspection, context: graphContext }));
-  router.get(config.graphql.path, graphqlHttpHandler({ gateway, introspection: config.graphql.introspection, context: graphContext }));
-
-  // Phase 7 services — cache (lazy Redis), email (log provider in dev), payments
-  // webhook router (no providers enabled unless keys are configured), and a
-  // cert/CSR generation endpoint backed by nexus-crypto (hand-rolled DER for CSRs).
-  const cache = new Cache({ url: config.redis.url, keyPrefix: config.redis.keyPrefix });
-
-  const templates = new TemplateEngine();
-  templates.register('welcome', '<h1>Welcome, {{name}}!</h1><p>Verify your email to get started.</p>');
-  const email = createEmail(config.email, { templates });
-
-  const payments = createPayments(config.payments);
-  const webhookRouter = payments.webhookRouter((ev) => {
-    log.info('payment webhook event', { provider: ev.provider, event: ev.event, verified: ev.verified });
-    // Persist every verified webhook event as a transaction (admin dashboard).
-    if (ev.provider && ev.event) {
-      recordTransaction(ev.provider, ev).catch((err) => log.warn('failed to record payment transaction', { msg: err.message }));
-    }
-  });
-  if (config.payments.webhookPath) {
-    router.post(config.payments.webhookPath, webhookRouter.handler);
-  }
-  // Phase 11 — browser-facing checkout routes (auth-guarded). Webhooks stay separate.
-  registerPaymentRoutes(router, config, payments, authService);
-
-  // Generate a self-signed cert + keypair (and optionally a CSR) on demand.
-  router.post('/certs/self-signed', (ctx) => {
-    const body = (ctx.body ?? {}) as { commonName?: string; organization?: string; country?: string; csr?: boolean };
-    const kp = generateKeyPair(config.certs.keyType, {
-      modulusLength: config.certs.rsaModulus,
-      namedCurve: config.certs.ecCurve,
-    });
-    const cert = createSelfSignedCertificate({
-      keyPair: { publicKey: kp.publicKey, privateKey: kp.privateKey },
-      commonName: body.commonName ?? 'localhost',
-      organization: body.organization,
-      country: body.country,
-    });
-    const out: Record<string, string> = { cert: cert.pem, privateKey: kp.pem.private, publicKey: kp.pem.public };
-    if (body.csr) {
-      const csr = createCsr({
-        keyPair: { publicKey: kp.publicKey, privateKey: kp.privateKey },
-        commonName: body.commonName ?? 'localhost',
-        organization: body.organization,
-        country: body.country,
-      });
-      out.csr = csr.pem;
-    }
-    ctx.json(out);
-  });
-
-  const docsDir = join(PROJECT_ROOT, 'docs');
-
-  const server = new NexusServer({
-    router,
-    bodyLimit: config.server.bodyLimit,
-    middleware: [
-      securityHeaders(),
-      cors({ origin: true, credentials: true }),
-      serveStatic(uploadsDir, { prefix: config.uploads.path }),
-      serveStatic(docsDir, { prefix: '/docs' }),
-      bodyParser(config.server.bodyLimit),
-      csrf({ trustedOrigins: trustedOrigins(config) }),
-      rateLimit({ windowMs: 60_000, max: 300 }),
-    ],
-    onError: (err, ctx) => {
-      log.warn('request error', { code: err.code, path: ctx.path, method: ctx.method, msg: err.message });
-      return { error: { code: err.code, message: err.message } };
-    },
-  });
-
-  // Realtime (WebSocket) server: auth via access token on upgrade, optional
-  // CSRF origin/double-submit check. Reuses the shared authService.
-  const realtime = new RealtimeServer({
-    httpServer: server.httpServer,
-    path: config.ws.path,
-    authService,
-    csrfOptions: config.ws.requireCsrf ? { trustedOrigins: trustedOrigins(config) } : undefined,
-  });
-
-  // GraphQL subscriptions over WebSocket (graphql-transport-ws), on a path
-  // under the GraphQL route. Auth via the shared authService.
-  const subscriptions = new SubscriptionServer({
-    httpServer: server.httpServer,
-    gateway,
-    path: `${config.graphql.path}/ws`,
-    authService,
-    context: (_init, user) => ({ user, pubsub }),
-  });
-
-  // Phase 8 — plugins: build real HostBindings from the running services,
-  // discover plugins from the configured dir, and run their lifecycle in
-  // dependency order before the server accepts traffic. Exposes the admin
-  // extensions (pages/slots contributed by plugins) at /plugins/extensions.
-  const pluginsDir = join(PROJECT_ROOT, config.plugins.dir);
-  const configByPlugin: Record<string, unknown> = {};
-  for (const entry of config.plugins.entries) {
-    if (entry.enabled) configByPlugin[entry.path] = entry.config ?? {};
-  }
-  const plugins = await loadPlugins({
-    router,
-    log,
-    realtime,
-    pluginsDir,
-    configByPlugin,
-  });
-  router.get('/plugins/extensions', (ctx) => {
-    ctx.json(plugins.adminExtensions.toJSON());
-  });
-
-  // Admin endpoints — bearer-token auth + 'admin' role (first registered user
-  // is bootstrapped admin). Edits write to nexus.runtime.json (gitignored).
-  const metrics = new MetricsRegistry();
-  metrics.counter('http_requests_total', 'Total HTTP requests');
-  const requestLogDir = join(PROJECT_ROOT, config.logging.dir);
-  // Count every HTTP request so the admin overview "HTTP REQUESTS" stat reflects
-  // live traffic, and append each completed request (with IP, url, referer etc.)
-  // to a datewise JSON log file under the project's logging dir.
-  server.use((ctx, next) => {
-    metrics.inc('http_requests_total', 1, { method: ctx.method });
-    const started = Date.now();
-    ctx.res.on('finish', () => {
-      const headers = ctx.headers as Record<string, string | string[] | undefined>;
-      const first = (v: string | string[] | undefined): string | undefined => (Array.isArray(v) ? v[0] : v);
-      const forwarded = first(headers['x-forwarded-for'])?.split(',')[0]?.trim();
-      appendRequestLog(requestLogDir, {
-        time: started,
-        method: ctx.method,
-        path: ctx.path,
-        url: ctx.req.url,
-        status: ctx.res.statusCode,
-        durationMs: Date.now() - started,
-        ip: forwarded || ctx.req.socket.remoteAddress,
-        referer: first(headers['referer']),
-        userAgent: first(headers['user-agent']),
-        origin: first(headers['origin']),
-        requestId: ctx.requestId,
-        route: ctx.routePattern,
-      });
-    });
-    return next();
-  });
-
-  // Cluster manager — auto-starts the LB + autoscaler when config says enabled.
-  const cluster = new ClusterManager({ config: config.cluster, root: PROJECT_ROOT, aiServerUrl: config.ai.serverUrl, self: { id: 'master', baseUrl: `http://127.0.0.1:${config.server.port}` } });
-  if (config.cluster.enabled) {
-    try {
-      await cluster.listenLb(config.cluster.lbHost);
-      cluster.autoscaler.start(10_000);
-      log.info(`cluster LB listening on ${config.cluster.lbHost}:${config.cluster.lbPort} (auto-started)`);
-    } catch (err) {
-      log.warn(`cluster failed to auto-start: ${(err as Error).message}`);
-    }
-  }
-
-  registerAdminRoutes(router, config, { root: PROJECT_ROOT, project, adminExtensions: plugins.adminExtensions, metrics: () => metrics.toJSON(), payments, cluster, aiProviders });
-
-  await server.listen(config.server.port, config.server.host);
-  log.info(`Nexus backend listening on http://${config.server.host}:${config.server.port}`, {
-    graphql: config.graphql.path,
-    ws: config.ws.path,
-  });
-
-  const shutdown = async (signal: string) => {
-    log.info(`received ${signal}, shutting down`);
-    await plugins.host.stop();
-    plugins.scheduler.close();
-    await subscriptions.close();
-    await realtime.close();
-    await server.close();
-    await cluster.close();
-    await closeProjectInfo();
-    await getConnection().close();
-    await cache.close();
-    closeRequestLog();
-    process.exit(0);
-  };
-  process.on('SIGINT', () => void shutdown('SIGINT'));
-  process.on('SIGTERM', () => void shutdown('SIGTERM'));
-}
-
-function trustedOrigins(config: Awaited<ReturnType<typeof loadConfig>>): string[] {
-  const loopback = ['localhost', '127.0.0.1'];
-  const origins: string[] = [];
-  for (const host of loopback) {
-    for (const port of [config.server.port, config.frontend.port, config.admin.port]) {
-      origins.push(`http://${host}:${port}`);
-    }
-  }
-  return origins;
-}
-
-async function readPackageVersion(root: string): Promise<string | undefined> {
-  try {
-    const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8')) as { version?: string };
-    return typeof pkg.version === 'string' ? pkg.version : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-main().catch((err) => {
-  console.error(err);
-  process.exit(1);
-});