create-authenik8-app 2.4.12 → 2.4.14

package/templates/express-auth/src/utils/security.ts

@@ -1,54 +1,141 @@
+import { z } from "zod";
+import type { AgentIdentityConfig, Authenik8JwkConfig } from "authenik8-core";
+
 const sensitiveKeys = new Set(["token", "accessToken", "refreshToken"]);
 
-export function requiredSecret(name: string): string {
-  const value = process.env[name];
+const passwordSchema = z.string()
+  .min(8, "Password must be between 8 and 1024 characters")
+  .max(1024, "Password must be between 8 and 1024 characters")
+  .refine((password) => !/[\u0000-\u001f\u007f]/.test(password), "Password contains unsupported control characters");
+
+export const credentialsSchema = z.strictObject({
+  email: z.string().trim().toLowerCase().email("A valid email is required").max(254),
+  password: passwordSchema,
+});
+
+export const refreshTokenBodySchema = z.strictObject({
+  refreshToken: z.string().trim().min(16, "Refresh token is required").max(4096),
+});
+const secretSchema = z.string().trim().min(32);
+const environmentValueSchema = z.string().trim().min(1);
+const portSchema = z.coerce.number().int().min(1).max(65535);
+const signingJwkSchema = z.object({
+  kty: z.literal("EC"),
+  crv: z.literal("P-256"),
+  x: z.string().min(1),
+  y: z.string().min(1),
+  d: z.string().min(1).optional(),
+  kid: z.string().min(1),
+  alg: z.literal("ES256").optional(),
+  use: z.literal("sig").optional(),
+});
+const identifierSchema = z.string()
+  .trim()
+  .min(1)
+  .max(128)
+  .regex(/^[A-Za-z0-9._:-]+$/);
+const agentIdSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/);
+const agentScopeSchema = z.string().max(128).regex(/^[a-z][a-z0-9._/-]*(?::[a-z][a-z0-9._/-]*)+$/);
+const agentRegistrySchema = z.record(
+  agentIdSchema,
+  z.array(agentScopeSchema).min(1).max(64),
+);
+
+export class InputValidationError extends Error {}
+
+function validationMessage(error: z.ZodError, fallback: string): string {
+  return error.issues[0]?.message ?? fallback;
+}
 
-  if (typeof value !== "string" || value.trim().length < 32) {
-    throw new Error(`${name} must be set to at least 32 characters`);
+export function requiredSecret(name: string): string {
+  const result = secretSchema.safeParse(process.env[name]);
+  if (!result.success) {
+    throw new InputValidationError(`${name} must be set to at least 32 characters`);
   }
-
-  return value;
+  return result.data;
 }
 
-export function parseCredentials(body: unknown) {
-  if (!body || typeof body !== "object") {
-    throw new Error("Email and password are required");
-  }
+export function requiredEnv(name: string): string {
+  const result = environmentValueSchema.safeParse(process.env[name]);
+  if (!result.success) throw new InputValidationError(`${name} must be set`);
+  return result.data;
+}
 
-  const { email, password } = body as { email?: unknown; password?: unknown };
+export function requiredPort(): number {
+  const result = portSchema.safeParse(process.env.PORT ?? 3000);
+  if (!result.success) throw new InputValidationError("PORT must be between 1 and 65535");
+  return result.data;
+}
 
-  if (typeof email !== "string" || typeof password !== "string") {
-    throw new Error("Email and password are required");
+export function authJwkConfig(): Authenik8JwkConfig {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(requiredEnv("AUTHENIK8_SIGNING_JWKS"));
+  } catch {
+    throw new InputValidationError("AUTHENIK8_SIGNING_JWKS must be a valid JSON array");
   }
+  const result = z.array(signingJwkSchema).min(1).safeParse(parsed);
+  if (!result.success) {
+    throw new InputValidationError("AUTHENIK8_SIGNING_JWKS must contain ES256 P-256 JWKs");
+  }
+  const activeKid = requiredEnv("AUTHENIK8_ACTIVE_KID");
+  const activeKey = result.data.find((key) => key.kid === activeKid);
+  if (!activeKey?.d) throw new InputValidationError("AUTHENIK8_ACTIVE_KID must select a private signing JWK");
+  return {
+    keys: result.data,
+    activeKid,
+    issuer: requiredEnv("AUTHENIK8_ISSUER"),
+    audience: requiredEnv("AUTHENIK8_AUDIENCE"),
+  };
+}
 
-  const normalizedEmail = email.trim().toLowerCase();
-  const atIndex = normalizedEmail.indexOf("@");
-  const dotIndex = normalizedEmail.lastIndexOf(".");
-
+export function agentIdentityConfig(): AgentIdentityConfig | undefined {
+  const source = process.env.AUTHENIK8_AGENTS?.trim();
+  if (!source) return undefined;
 
-  if (atIndex < 1 || atIndex !== normalizedEmail.lastIndexOf("@") || dotIndex < atIndex + 2 ||dotIndex === normalizedEmail.length - 1 ) {
-	  throw new Error("A valid email is required");
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(source);
+  } catch {
+    throw new InputValidationError("AUTHENIK8_AGENTS must be a JSON object of agent scope arrays");
   }
-
-  if (password.length < 8 || password.length > 1024) {
-    throw new Error("Password must be between 8 and 1024 characters");
+  const result = agentRegistrySchema.safeParse(parsed);
+  if (!result.success) {
+    throw new InputValidationError("AUTHENIK8_AGENTS must map valid agent IDs to resource:action scopes");
   }
-
-  return { email: normalizedEmail, password };
+  if (!Object.keys(result.data).length) return undefined;
+
+  const registry = result.data;
+  return {
+    resolveAgent: async (agentId) => {
+      const scopes = Object.prototype.hasOwnProperty.call(registry, agentId)
+        ? registry[agentId]
+        : undefined;
+      return scopes ? { agentId, scopes, active: true } : null;
+    },
+  };
 }
 
-export function parseRefreshToken(body: unknown) {
-  if (!body || typeof body !== "object") {
-    throw new Error("Refresh token is required");
+export function parseCredentials(body: unknown): z.infer<typeof credentialsSchema> {
+  const result = credentialsSchema.safeParse(body);
+  if (!result.success) {
+    throw new InputValidationError(validationMessage(result.error, "Email and password are required"));
   }
+  return result.data;
+}
 
-  const { refreshToken } = body as { refreshToken?: unknown };
-
-  if (typeof refreshToken !== "string" || refreshToken.trim().length < 16) {
-    throw new Error("Refresh token is required");
+export function parseRefreshToken(body: unknown): string {
+  const result = refreshTokenBodySchema.safeParse(body);
+  if (!result.success) {
+    throw new InputValidationError(validationMessage(result.error, "Refresh token is required"));
   }
+  return result.data.refreshToken;
+}
 
-  return refreshToken;
+export function parseIdentifier(value: unknown, label: string): string {
+  const result = identifierSchema.safeParse(value);
+  if (!result.success) throw new InputValidationError(`${label} is invalid`);
+  return result.data;
 }
 
 export function sanitizeSessionResponse(value: unknown): unknown {

package/templates/express-auth+/README.md

@@ -15,14 +15,18 @@ For SQLite, Postgres in `docker-compose.yml` is optional. Redis is required for
 
 ## Environment
 
-Review `.env` before running. The generated secrets are development placeholders and must be replaced before deployment.
+The generator writes a unique signing key and refresh secret to git-ignored `.env`. Move them into your deployment secret manager and never commit the private JWK.
 
 Required:
 
 ```bash
 DATABASE_URL=file:./dev.db
-JWT_SECRET=dev-jwt-secret-change-before-production-123456
-REFRESH_SECRET=dev-refresh-secret-change-before-production-123456
+AUTHENIK8_SIGNING_JWKS='[{"kty":"EC","crv":"P-256","kid":"<generated>","x":"...","y":"...","d":"...","alg":"ES256"}]'
+AUTHENIK8_ACTIVE_KID=<generated>
+AUTHENIK8_ISSUER=http://localhost:3000
+AUTHENIK8_AUDIENCE=your-app-api
+AUTHENIK8_AGENTS={}
+REFRESH_SECRET=<generated-random-secret>
 REDIS_HOST=127.0.0.1
 REDIS_PORT=6379
 AUTHENIK8_OAUTH_PROVIDERS=google,github
@@ -124,10 +128,6 @@ Expected shape:
 
 ```json
 {
-  "user": {
-    "id": "user-id",
-    "email": "dev@example.com"
-  },
   "accessToken": "access-token",
   "refreshToken": "refresh-token"
 }
@@ -152,7 +152,10 @@ If a provider is not listed in `AUTHENIK8_OAUTH_PROVIDERS`, that provider route
 ## Environment Variables
 
 - `DATABASE_URL`: Prisma database connection. SQLite uses `file:./dev.db`; Postgres uses a `postgresql://...` URL.
-- `JWT_SECRET`: signs short-lived access tokens. Use a long random value in production.
+- `AUTHENIK8_SIGNING_JWKS`: JSON array containing the active private ES256 key and any previous public verification keys.
+- `AUTHENIK8_ACTIVE_KID`: selects the private key used to sign new access tokens.
+- `AUTHENIK8_ISSUER` / `AUTHENIK8_AUDIENCE`: required claims checked during verification.
+- `AUTHENIK8_AGENTS`: optional JSON map of agent IDs to exact `resource:action` scopes; keep `{}` to disable agent identity. See `AGENT_IDENTITY.md`.
 - `REFRESH_SECRET`: signs refresh tokens. Use a different long random value in production.
 - `REDIS_HOST`: Redis host for refresh-token/session security.
 - `REDIS_PORT`: Redis port, usually `6379` locally.
@@ -224,7 +227,7 @@ The callback URL in `.env` must match the provider dashboard exactly, including
 
 `Prisma Client did not initialize`: run `npm run prisma:migrate`, then restart `npm run dev`.
 
-`JWT_SECRET must be set to at least 32 characters`: check `.env`; both token secrets must be long strings.
+`AUTHENIK8_SIGNING_JWKS must be a valid JSON array`: restore the generated `.env` value or provide an ES256 P-256 key ring and matching `AUTHENIK8_ACTIVE_KID`.
 
 `Cannot POST /auth/login`: confirm the server is running and you generated the password or OAuth auth template.
 
@@ -234,7 +237,7 @@ The callback URL in `.env` must match the provider dashboard exactly, including
 
 `google OAuth is not configured`: add `google` to `AUTHENIK8_OAUTH_PROVIDERS` and set the Google env vars, or use only the enabled provider route.
 
-`Port 3000 already in use`: stop the other process or change the `app.listen(3000)` port in `src/server.ts`.
+`Port 3000 already in use`: stop the other process or set `PORT` in `.env`.
 
 `DATABASE_URL is wrong`: for SQLite use `file:./dev.db`; for local Docker Postgres use `postgresql://postgres:postgres@localhost:5432/authenik8?schema=public`.
 

package/templates/express-auth+/docker-compose.yml

@@ -6,6 +6,11 @@ services:
     command: ["redis-server", "--appendonly", "yes"]
     volumes:
       - redis-data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
 
   postgres:
     image: postgres:16-alpine
@@ -17,6 +22,11 @@ services:
       POSTGRES_DB: authenik8
     volumes:
       - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d authenik8"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
 
 volumes:
   redis-data:

package/templates/express-auth+/gitignore.template

@@ -0,0 +1,6 @@
+node_modules/
+dist/
+.env
+*.log
+coverage/
+.DS_Store

package/templates/express-auth+/package.json

@@ -3,25 +3,32 @@
   "description": "Authenik8 generated Express auth app",
   "main": "dist/server.js",
   "type": "commonjs",
+  "engines": {
+    "node": "^20.19 || ^22.12 || >=24"
+  },
   "scripts": {
     "dev": "ts-node-dev --respawn --transpile-only src/server.ts",
     "build": "tsc",
     "start": "node dist/server.js",
-    "prisma:migrate": "prisma migrate dev",
-    "docker:up": "docker compose up -d",
+    "prisma:migrate": "prisma migrate dev && prisma generate",
+    "docker:up": "docker compose up -d --wait",
     "docker:down": "docker compose down"
   },
   "dependencies": {
-    "authenik8-core": "^1.0.38",
+    "authenik8-core": "2.0.3",
     "dotenv": "^16.0.0",
     "express": "^4.19.2",
-    "@prisma/client": "5.22.0"
+    "@prisma/client": "7.8.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/express": "^4.17.21",
     "@types/node": "^26.0.1",
     "ts-node-dev": "^2.0.0",
     "typescript": "^5.0.0",
-     "prisma": "5.22.0"
+     "prisma": "7.8.0"
+  },
+  "overrides": {
+    "@hono/node-server": "1.19.13"
   }
 }

package/templates/express-auth+/src/auth/auth.ts

@@ -1,6 +1,6 @@
 import { createAuthenik8 } from "authenik8-core";
 import dotenv  from "dotenv";
-import { requiredSecret } from "../utils/security";
+import { agentIdentityConfig, authJwkConfig, requiredSecret } from "../utils/security";
 
 dotenv.config();
 
@@ -12,8 +12,9 @@ function oauthConfig() {
 
 export async function initAuth() {
   authInstance= await createAuthenik8({
-    jwtSecret: requiredSecret("JWT_SECRET"),
+    jwt: authJwkConfig(),
     refreshSecret: requiredSecret("REFRESH_SECRET"),
+    agent: agentIdentityConfig(),
     oauth: oauthConfig(),
   });
 

package/templates/express-auth+/src/auth/controllers/password.controller.ts

@@ -32,19 +32,15 @@ export const passwordController = {
       const { email, password } = parseCredentials(req.body);
       const user = await prisma.user.findUnique({ where: { email } });
 
-      if (!user || !(await comparePassword(password, user.password))) {
+      if (!user?.password || !(await comparePassword(password, user.password))) {
         return res.status(401).json({ error: "Invalid credentials" });
       }
 
       const auth = getAuth();
-      const accessToken = auth.signToken({
-        userId: user.id,
-        email: user.email,
-      });
-
-      const refreshToken = await auth.generateRefreshToken({
+      const { accessToken, refreshToken } = await auth.issueTokens({
         userId: user.id,
         email: user.email,
+        role: String(user.role).toLowerCase(),
       });
 
       res.json({ accessToken, refreshToken });

package/templates/express-auth+/src/auth/controllers/protected.controller.ts

@@ -1,8 +1,19 @@
 import { Request, Response } from "express";
-import { sanitizeSessionResponse } from "../../utils/security";
+import {
+  InputValidationError,
+  parseIdentifier,
+  sanitizeSessionResponse,
+} from "../../utils/security";
+
+function sessionError(res: Response, error: unknown, fallback: string) {
+  if (error instanceof InputValidationError) {
+    return res.status(400).json({ success: false, message: error.message });
+  }
+  return res.status(500).json({ success: false, message: fallback });
+}
 
 export const protectedController = {
-  protected( res: Response) {
+  protected(_req: Request, res: Response) {
     res.json({ message: "Protected route" });
   },
 
@@ -13,10 +24,11 @@ export const protectedController = {
         return res.status(503).json({ success: false, message: "Session management unavailable" });
       }
 
-      const sessions = await actions.listSessions(req.params.userId);
+      const userId = parseIdentifier(req.params.userId, "User ID");
+      const sessions = await actions.listSessions(userId);
       res.json({ sessions: sanitizeSessionResponse(sessions) });
-    } catch {
-      res.status(500).json({ success: false, message: "Failed to retrieve sessions" });
+    } catch (error) {
+      sessionError(res, error, "Failed to retrieve sessions");
     }
   },
 
@@ -27,10 +39,12 @@ export const protectedController = {
         return res.status(503).json({ success: false, message: "Session management unavailable" });
       }
 
-      await actions.revokeSession(req.params.userId, req.params.sessionId);
+      const userId = parseIdentifier(req.params.userId, "User ID");
+      const sessionId = parseIdentifier(req.params.sessionId, "Session ID");
+      await actions.revokeSession(userId, sessionId);
       res.json({ success: true, message: "Session revoked" });
-    } catch {
-      res.status(500).json({ success: false, message: "Failed to revoke session" });
+    } catch (error) {
+      sessionError(res, error, "Failed to revoke session");
     }
   },
 
@@ -41,10 +55,11 @@ export const protectedController = {
         return res.status(503).json({ success: false, message: "Session management unavailable" });
       }
 
-      await actions.revokeAllSessions(req.params.userId);
+      const userId = parseIdentifier(req.params.userId, "User ID");
+      await actions.revokeAllSessions(userId);
       res.json({ success: true, message: "All sessions revoked" });
-    } catch {
-      res.status(500).json({ success: false, message: "Failed to revoke sessions" });
+    } catch (error) {
+      sessionError(res, error, "Failed to revoke sessions");
     }
   },
 };

package/templates/express-auth+/src/auth/identity.adapter.ts

@@ -0,0 +1,90 @@
+import { prisma } from "../prisma/client";
+
+type ProviderIdentity = {
+  provider: string;
+  providerId: string;
+};
+
+type IdentityUser = {
+  id: string;
+  email: string;
+  role?: string;
+  providers: ProviderIdentity[];
+};
+
+const db = prisma as any;
+
+function toIdentityUser(user: any): IdentityUser | null {
+  if (!user) return null;
+
+  return {
+    id: user.id,
+    email: user.email,
+    role: typeof user.role === "string" ? user.role.toLowerCase() : undefined,
+    providers: (user.identityProviders ?? []).map((identity: ProviderIdentity) => ({
+      provider: identity.provider,
+      providerId: identity.providerId,
+    })),
+  };
+}
+
+const includeProviders = { identityProviders: true };
+
+export const identityAdapter = {
+  async findUserByEmail(email: string) {
+    const user = await db.user.findUnique({
+      where: { email: email.trim().toLowerCase() },
+      include: includeProviders,
+    });
+    return toIdentityUser(user);
+  },
+
+  async findUserByProvider(provider: string, providerId: string) {
+    const identity = await db.identityProvider.findUnique({
+      where: { provider_providerId: { provider, providerId } },
+      include: { user: { include: includeProviders } },
+    });
+    return toIdentityUser(identity?.user);
+  },
+
+  async createUser(data: { email: string; provider: string; providerId: string }) {
+    const email = data.email.trim().toLowerCase();
+    const existing = await this.findUserByEmail(email);
+    if (existing) return existing;
+
+    const user = await db.user.create({
+      data: {
+        email,
+        password: null,
+        verified: true,
+        identityProviders: {
+          create: { provider: data.provider, providerId: data.providerId },
+        },
+      },
+      include: includeProviders,
+    });
+
+    return toIdentityUser(user) as IdentityUser;
+  },
+
+  async linkProvider(userId: string, provider: string, providerId: string) {
+    const existing = await db.identityProvider.findUnique({
+      where: { provider_providerId: { provider, providerId } },
+    });
+
+    if (existing && existing.userId !== userId) {
+      throw new Error("Provider is already linked to another user");
+    }
+
+    const user = await db.user.findUnique({ where: { id: userId } });
+    if (!user) {
+      throw new Error(`User not found: ${userId}`);
+    }
+
+    await db.identityProvider.upsert({
+      where: { userId_provider: { userId, provider } },
+      create: { userId, provider, providerId },
+      update: { providerId },
+    });
+  },
+};

package/templates/express-auth+/src/auth/middleware/auth.middleware.ts

@@ -2,9 +2,8 @@ import { Request, Response, NextFunction } from "express";
 import { getAuth } from "../auth";
 
 export const adminMiddleware = (req: Request, res: Response, next: NextFunction) => {
-  getAuth().requireAdmin(req, res, next);
+  return getAuth().requireAdmin(req, res, next);
 };
 
-export const authMiddleware = (req: Request, res: Response, next: NextFunction) => {
-  getAuth().authenticateJWT(req, res, next);
-};
+export const authMiddleware = (req: Request, res: Response, next: NextFunction) =>
+  getAuth().requireAuth(req, res, next);

package/templates/express-auth+/src/auth/routes/protected.routes.ts

@@ -1,10 +1,10 @@
 import express from "express";
-import { adminMiddleware } from "../middleware/auth.middleware";
+import { adminMiddleware, authMiddleware } from "../middleware/auth.middleware";
 import { protectedController } from "../controllers/protected.controller";
 
 const router = express.Router();
 
-router.get("/protected", adminMiddleware, protectedController.protected);
+router.get("/protected", authMiddleware, protectedController.protected);
 router.get("/admin/sessions/:userId", adminMiddleware, protectedController.listSessions);
 router.delete("/admin/sessions/:userId/:sessionId", adminMiddleware, protectedController.revokeSession);
 router.delete("/admin/sessions/:userId", adminMiddleware, protectedController.revokeAllSessions);

package/templates/express-auth+/src/oauth-providers/github/src/auth/auth.ts

@@ -1,6 +1,6 @@
 import { createAuthenik8 } from "authenik8-core";
 import dotenv  from "dotenv";
-import { requiredEnv, requiredSecret } from "../../../../src/utils/security";
+import { agentIdentityConfig, authJwkConfig, requiredEnv, requiredSecret } from "../../../../src/utils/security";
 
 dotenv.config();
 
@@ -18,8 +18,9 @@ function oauthConfig() {
 
 export async function initAuth() {
   authInstance= await createAuthenik8({
-    jwtSecret: requiredSecret("JWT_SECRET"),
+    jwt: authJwkConfig(),
     refreshSecret: requiredSecret("REFRESH_SECRET"),
+    agent: agentIdentityConfig(),
     oauth: oauthConfig(),
   });
 

package/templates/express-auth+/src/oauth-providers/google/src/auth/auth.ts

@@ -1,6 +1,6 @@
 import { createAuthenik8 } from "authenik8-core";
 import dotenv  from "dotenv";
-import { requiredEnv, requiredSecret } from "../../../../src/utils/security";
+import { agentIdentityConfig, authJwkConfig, requiredEnv, requiredSecret } from "../../../../src/utils/security";
 
 dotenv.config();
 
@@ -18,8 +18,9 @@ function oauthConfig() {
 
 export async function initAuth() {
   authInstance= await createAuthenik8({
-    jwtSecret: requiredSecret("JWT_SECRET"),
+    jwt: authJwkConfig(),
     refreshSecret: requiredSecret("REFRESH_SECRET"),
+    agent: agentIdentityConfig(),
     oauth: oauthConfig(),
   });
 

package/templates/express-auth+/src/oauth-providers/google-github/src/auth/auth.ts

@@ -1,6 +1,6 @@
 import { createAuthenik8 } from "authenik8-core";
 import dotenv  from "dotenv";
-import { requiredEnv, requiredSecret } from "../utils/security";
+import { agentIdentityConfig, authJwkConfig, requiredEnv, requiredSecret } from "../utils/security";
 
 dotenv.config();
 
@@ -23,8 +23,9 @@ function oauthConfig() {
 
 export async function initAuth() {
   authInstance= await createAuthenik8({
-    jwtSecret: requiredSecret("JWT_SECRET"),
+    jwt: authJwkConfig(),
     refreshSecret: requiredSecret("REFRESH_SECRET"),
+    agent: agentIdentityConfig(),
     oauth: oauthConfig(),
   });
 

package/templates/express-auth+/src/server.ts

@@ -3,6 +3,7 @@ import passwordRoutes from "./auth/routes/password.route";
 import oauthRoutes from "./auth/routes/oauth.routes";
 import protectedRoutes from "./auth/routes/protected.routes";
 import { getAuth, initAuth } from "./auth/auth";
+import { requiredPort } from "./utils/security";
 
 async function start(){
 		await initAuth();
@@ -12,13 +13,15 @@ async function start(){
   app.use(express.json({ limit: "16kb", strict: true }));
   app.use(auth.helmet);
   app.use(auth.rateLimit);
+  app.get("/.well-known/jwks.json", (_req, res) => res.json(auth.getJwks()));
 
   app.use("/auth", passwordRoutes);
   app.use("/auth", oauthRoutes);
   app.use("/", protectedRoutes);
 
-  app.listen(3000, () => {
-    console.log("Auth system running on http://localhost:3000");
+  const port = requiredPort();
+  app.listen(port, () => {
+    console.log(`Auth system running on http://localhost:${port}`);
   });
 }
 
@@ -32,11 +35,3 @@ process.on("unhandledRejection", (err) => {
   console.error(" Unhandled Rejection:", err);
   process.exit(1);
 });
-setInterval(() => {
-  const used = process.memoryUsage().heapUsed / 1024 / 1024;
-
-  if (used > 300) {
-    console.error(` Memory exceeded: ${used.toFixed(2)} MB`);
-    process.exit(1);
-  }
-}, 10000);