@promptbook/cli 0.112.0-99 → 0.113.0-0

package/apps/agents-server/src/utils/publicUser.ts

@@ -0,0 +1,59 @@
+import type { AgentsServerDatabase } from '../database/schema';
+
+/**
+ * Database row shape for the `User` table.
+ */
+type UserRow = AgentsServerDatabase['public']['Tables']['User']['Row'];
+
+/**
+ * Public user shape safe to send to browser UI.
+ *
+ * @private internal Agents Server API shape
+ */
+export type PublicUser = Pick<
+    UserRow,
+    'id' | 'username' | 'isAdmin' | 'createdAt' | 'updatedAt' | 'profileImageUrl'
+> & {
+    /**
+     * Email address from external authentication providers.
+     */
+    readonly email?: string | null;
+    /**
+     * Human-readable display name from external authentication providers.
+     */
+    readonly displayName?: string | null;
+    /**
+     * Authentication provider marker such as `LOCAL` or `SHIBBOLETH`.
+     */
+    readonly authenticationProvider?: string | null;
+};
+
+/**
+ * Supabase projection for user fields safe to return from UI-facing endpoints.
+ *
+ * @private internal Agents Server API projection
+ */
+export const PUBLIC_USER_SELECT_COLUMNS: string =
+    'id, username, isAdmin, createdAt, updatedAt, profileImageUrl, email, displayName, authenticationProvider';
+
+/**
+ * Maps a database user projection into the public user response shape.
+ *
+ * @param row - User projection loaded from the database.
+ * @returns User data safe to serialize to the browser.
+ *
+ * @private internal Agents Server API mapper
+ */
+export function toPublicUser(row: PublicUser): PublicUser {
+    return {
+        id: row.id,
+        username: row.username,
+        isAdmin: row.isAdmin,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+        profileImageUrl: row.profileImageUrl ?? null,
+        email: row.email ?? null,
+        displayName: row.displayName ?? null,
+        authenticationProvider: row.authenticationProvider ?? null,
+    };
+}

package/apps/agents-server/src/utils/serverLimits.ts

@@ -39,6 +39,16 @@ export type SpawnAgentLimits = {
     readonly rateLimitWindowMs: number;
 };
 
+/**
+ * Dedicated subset consumed by the local coding-agent runner.
+ *
+ * @private internal Agents Server type
+ */
+export type LocalAgentRunnerLimits = {
+    readonly maxFailedAttempts: number;
+    readonly maxParallelMessages: number;
+};
+
 /**
  * Row shape loaded from the dedicated `ServerLimit` table.
  *
@@ -250,6 +260,21 @@ export async function getSpawnAgentLimits(): Promise<SpawnAgentLimits> {
     };
 }
 
+/**
+ * Loads the local coding-agent runner retry limits.
+ *
+ * @returns Dedicated local agent runner limits.
+ *
+ * @private internal Agents Server helper
+ */
+export async function getLocalAgentRunnerLimits(): Promise<LocalAgentRunnerLimits> {
+    const limits = await getServerLimits();
+    return {
+        maxFailedAttempts: limits[SERVER_LIMIT_KEYS.LOCAL_AGENT_RUNNER_MAX_FAILED_ATTEMPTS],
+        maxParallelMessages: limits[SERVER_LIMIT_KEYS.LOCAL_AGENT_RUNNER_MAX_PARALLEL_MESSAGES],
+    };
+}
+
 /**
  * Normalizes one arbitrary key/value object into the supported dedicated server-limit payload.
  *
@@ -277,7 +302,9 @@ export function normalizeServerLimitValues(rawValue: Record<string, unknown>): S
  */
 async function loadLegacyServerLimits(): Promise<Partial<Record<ServerLimitKey, unknown>>> {
     const metadata = await getMetadataMap(DEPRECATED_LIMIT_METADATA_KEYS);
-    const normalizedToolUsageLimits = normalizeToolUsageLimits(parseJsonValue(metadata[TOOL_USAGE_LIMITS_METADATA_KEY]));
+    const normalizedToolUsageLimits = normalizeToolUsageLimits(
+        parseJsonValue(metadata[TOOL_USAGE_LIMITS_METADATA_KEY]),
+    );
 
     return {
         [SERVER_LIMIT_KEYS.TIMEOUT_MAX_ACTIVE_PER_CHAT]: normalizedToolUsageLimits.timeout.maxActivePerChat,

package/apps/agents-server/src/utils/serverManagement/createManagedServer/bootstrapManagedServer.ts

@@ -5,7 +5,6 @@ import {
     acquireMigrationExecutionLock,
     releaseMigrationExecutionLock,
 } from '../../../database/acquireMigrationExecutionLock';
-import { scheduleDefaultFederatedAgentsSync } from '../../defaultFederatedAgents/scheduleDefaultFederatedAgentsSync';
 import { createServerPublicUrl, invalidateRegisteredServersCache } from '../../serverRegistry';
 import type { CreateServerResult } from '../createManagedServer';
 import { resolveManagedServerConnectionString } from '../resolveManagedServerConnectionString';
@@ -14,6 +13,7 @@ import { createFailedServerResult } from './createFailedServerResult';
 import { createSqlRecorder } from './createSqlRecorder';
 import { insertManagedServerRegistryRow } from './insertManagedServerRegistryRow';
 import type { NormalizedCreateServerInput } from './normalizeCreateServerInput';
+import { seedServerCoreAgents } from './seedServerCoreAgents';
 import { seedServerDefaultAgents } from './seedServerDefaultAgents';
 import { seedServerMetadata } from './seedServerMetadata';
 import { seedServerUsers } from './seedServerUsers';
@@ -47,16 +47,15 @@ export async function bootstrapManagedServer(input: NormalizedCreateServerInput)
         await applyManagedServerMigrations(client, input, sqlRecorder, migrationLogger);
         await seedServerUsers(client, input, sqlRecorder);
         await seedServerMetadata(client, input, sqlRecorder);
-        await seedServerDefaultAgents(client, input, sqlRecorder);
+        if (input.isDefaultAgentsInstalled) {
+            await seedServerDefaultAgents(client, input, sqlRecorder);
+        }
+        await seedServerCoreAgents(client, input, sqlRecorder);
 
         await client.query('COMMIT');
         sqlRecorder.addStatement('COMMIT');
 
         invalidateRegisteredServersCache();
-        scheduleDefaultFederatedAgentsSync({
-            tablePrefix: server.tablePrefix,
-            localServerUrl: createServerPublicUrl(server.domain).href,
-        });
 
         return {
             ok: true,

package/apps/agents-server/src/utils/serverManagement/createManagedServer/normalizeCreateServerInput.ts

@@ -51,6 +51,11 @@ export type NormalizedCreateServerInput = {
      * Initial metadata rows inserted during bootstrap.
      */
     readonly metadataEntries: ReadonlyArray<ServerMetadataSeedEntry>;
+
+    /**
+     * Whether bundled default agents from `agents/default` should be created during bootstrap.
+     */
+    readonly isDefaultAgentsInstalled: boolean;
 };
 
 /**
@@ -103,5 +108,6 @@ export function normalizeCreateServerInput(input: CreateServerInput): Normalized
             iconUrl,
             initialSettings: input.initialSettings,
         }),
+        isDefaultAgentsInstalled: input.isDefaultAgentsInstalled !== false,
     };
 }

package/apps/agents-server/src/utils/serverManagement/createManagedServer/seedServerCoreAgents.ts

@@ -0,0 +1,162 @@
+import type { Client } from 'pg';
+import { createAgentPersistenceRecords } from '../../../../../../src/collection/agent-collection/constructors/agent-collection-in-supabase/createAgentPersistenceRecords';
+import { DEFAULT_AGENT_VISIBILITY } from '../../agentVisibility';
+import { CORE_AGENT_DIRECTORY_NAME, loadCoreAgentBooks } from '../../defaultAgents/loadDefaultAgentBooks';
+import { createInsertStatement, quoteIdentifier, type SqlRecorder } from './createSqlRecorder';
+import type { NormalizedCreateServerInput } from './normalizeCreateServerInput';
+
+/**
+ * Loads bundled `.core` agent books from the repository and persists them into the newly created server.
+ *
+ * Each `*.book` file in `agents/default/.core` becomes one persisted agent in the `.core` folder with its initial
+ * history snapshot.
+ *
+ * @param client - Connected PostgreSQL client inside the bootstrap transaction.
+ * @param input - Normalized create-server payload.
+ * @param sqlRecorder - Mutable SQL dump recorder.
+ *
+ * @private function of createManagedServer
+ */
+export async function seedServerCoreAgents(
+    client: Client,
+    input: NormalizedCreateServerInput,
+    sqlRecorder: SqlRecorder,
+): Promise<void> {
+    const coreAgentBooks = await loadCoreAgentBooks();
+    if (coreAgentBooks.length === 0) {
+        return;
+    }
+
+    const coreFolderId = await insertCoreFolder(client, input, sqlRecorder);
+    const agentTableIdentifier = quoteIdentifier(`${input.tablePrefix}Agent`);
+    const agentHistoryTableIdentifier = quoteIdentifier(`${input.tablePrefix}AgentHistory`);
+
+    for (const [index, coreAgentBook] of coreAgentBooks.entries()) {
+        const createdAt = new Date().toISOString();
+        const { agentInsertRecord, agentHistoryInsertRecord } = createAgentPersistenceRecords(
+            coreAgentBook,
+            { folderId: coreFolderId, sortOrder: index },
+            createdAt,
+        );
+
+        await client.query(
+            `
+                INSERT INTO ${agentTableIdentifier} (
+                    "agentName",
+                    "createdAt",
+                    "updatedAt",
+                    "permanentId",
+                    "agentHash",
+                    "agentSource",
+                    "agentProfile",
+                    "promptbookEngineVersion",
+                    "usage",
+                    "folderId",
+                    "sortOrder",
+                    "visibility"
+                )
+                VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8, $9::jsonb, $10, $11, $12)
+            `,
+            [
+                agentInsertRecord.agentName,
+                agentInsertRecord.createdAt,
+                agentInsertRecord.updatedAt,
+                agentInsertRecord.permanentId,
+                agentInsertRecord.agentHash,
+                agentInsertRecord.agentSource,
+                JSON.stringify(agentInsertRecord.agentProfile),
+                agentInsertRecord.promptbookEngineVersion,
+                JSON.stringify(agentInsertRecord.usage),
+                coreFolderId,
+                agentInsertRecord.sortOrder ?? index,
+                agentInsertRecord.visibility ?? DEFAULT_AGENT_VISIBILITY,
+            ],
+        );
+        sqlRecorder.addStatement(
+            createInsertStatement(`${input.tablePrefix}Agent`, {
+                ...agentInsertRecord,
+                agentProfile: JSON.stringify(agentInsertRecord.agentProfile),
+                usage: JSON.stringify(agentInsertRecord.usage),
+                folderId: coreFolderId,
+                sortOrder: agentInsertRecord.sortOrder ?? index,
+                visibility: agentInsertRecord.visibility ?? DEFAULT_AGENT_VISIBILITY,
+            }),
+        );
+
+        await client.query(
+            `
+                INSERT INTO ${agentHistoryTableIdentifier} (
+                    "createdAt",
+                    "agentName",
+                    "permanentId",
+                    "agentHash",
+                    "previousAgentHash",
+                    "agentSource",
+                    "promptbookEngineVersion",
+                    "versionName"
+                )
+                VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+            `,
+            [
+                agentHistoryInsertRecord.createdAt,
+                agentHistoryInsertRecord.agentName,
+                agentHistoryInsertRecord.permanentId,
+                agentHistoryInsertRecord.agentHash,
+                agentHistoryInsertRecord.previousAgentHash,
+                agentHistoryInsertRecord.agentSource,
+                agentHistoryInsertRecord.promptbookEngineVersion,
+                agentHistoryInsertRecord.versionName,
+            ],
+        );
+        sqlRecorder.addStatement(createInsertStatement(`${input.tablePrefix}AgentHistory`, agentHistoryInsertRecord));
+    }
+}
+
+/**
+ * Inserts the `.core` folder row for the newly bootstrapped server.
+ *
+ * @param client - Connected PostgreSQL client inside the bootstrap transaction.
+ * @param input - Normalized create-server payload.
+ * @param sqlRecorder - Mutable SQL dump recorder.
+ * @returns Identifier of the inserted `.core` folder.
+ *
+ * @private function of createManagedServer
+ */
+async function insertCoreFolder(
+    client: Client,
+    input: NormalizedCreateServerInput,
+    sqlRecorder: SqlRecorder,
+): Promise<number> {
+    const agentFolderTableIdentifier = quoteIdentifier(`${input.tablePrefix}AgentFolder`);
+    const createdAt = new Date().toISOString();
+    const insertResult = await client.query<{ id: number }>(
+        `
+            INSERT INTO ${agentFolderTableIdentifier} (
+                "name",
+                "parentId",
+                "sortOrder",
+                "icon",
+                "color",
+                "createdAt",
+                "updatedAt"
+            )
+            VALUES ($1, NULL, $2, NULL, NULL, $3, NULL)
+            RETURNING "id"
+        `,
+        [CORE_AGENT_DIRECTORY_NAME, 0, createdAt],
+    );
+
+    sqlRecorder.addStatement(
+        createInsertStatement(`${input.tablePrefix}AgentFolder`, {
+            name: CORE_AGENT_DIRECTORY_NAME,
+            parentId: null,
+            sortOrder: 0,
+            icon: null,
+            color: null,
+            createdAt,
+            updatedAt: null,
+        }),
+    );
+
+    return insertResult.rows[0]!.id;
+}

package/apps/agents-server/src/utils/serverManagement/createManagedServer/seedServerDefaultAgents.ts

@@ -1,26 +1,10 @@
-import { access, readFile, readdir } from 'node:fs/promises';
-import { resolve } from 'node:path';
-import type { string_book } from '../../../../../../src/book-2.0/agent-source/string_book';
 import { createAgentPersistenceRecords } from '../../../../../../src/collection/agent-collection/constructors/agent-collection-in-supabase/createAgentPersistenceRecords';
-import { DatabaseError } from '../../../../../../src/errors/DatabaseError';
 import type { Client } from 'pg';
-import { spaceTrim } from 'spacetrim';
+import { DEFAULT_AGENT_VISIBILITY } from '../../agentVisibility';
+import { loadDefaultAgentBooks } from '../../defaultAgents/loadDefaultAgentBooks';
 import { createInsertStatement, quoteIdentifier, type SqlRecorder } from './createSqlRecorder';
 import type { NormalizedCreateServerInput } from './normalizeCreateServerInput';
 
-/**
- * Candidate directories where bundled default agent books can be located.
- *
- * The app test suite runs from `apps/agents-server`, while local development usually runs from the repository root.
- *
- * @private function of createManagedServer
- */
-const DEFAULT_AGENT_DIRECTORY_CANDIDATES = [
-    resolve(process.cwd(), 'agents', 'default'),
-    resolve(process.cwd(), '..', '..', 'agents', 'default'),
-    resolve(__dirname, '../../../../../../agents/default'),
-] as const;
-
 /**
  * Loads default agent books from the repository and persists them into the newly created server.
  *
@@ -62,9 +46,10 @@ export async function seedServerDefaultAgents(
                     "promptbookEngineVersion",
                     "usage",
                     "folderId",
-                    "sortOrder"
+                    "sortOrder",
+                    "visibility"
                 )
-                VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8, $9::jsonb, $10, $11)
+                VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8, $9::jsonb, $10, $11, $12)
             `,
             [
                 agentInsertRecord.agentName,
@@ -78,6 +63,7 @@ export async function seedServerDefaultAgents(
                 JSON.stringify(agentInsertRecord.usage),
                 agentInsertRecord.folderId ?? null,
                 agentInsertRecord.sortOrder ?? index,
+                agentInsertRecord.visibility ?? DEFAULT_AGENT_VISIBILITY,
             ],
         );
         sqlRecorder.addStatement(
@@ -87,6 +73,7 @@ export async function seedServerDefaultAgents(
                 usage: JSON.stringify(agentInsertRecord.usage),
                 folderId: agentInsertRecord.folderId ?? null,
                 sortOrder: agentInsertRecord.sortOrder ?? index,
+                visibility: agentInsertRecord.visibility ?? DEFAULT_AGENT_VISIBILITY,
             }),
         );
 
@@ -118,70 +105,3 @@ export async function seedServerDefaultAgents(
         sqlRecorder.addStatement(createInsertStatement(`${input.tablePrefix}AgentHistory`, agentHistoryInsertRecord));
     }
 }
-
-/**
- * Loads all default agent books in deterministic filename order.
- *
- * @returns Sorted default agent sources.
- *
- * @private function of `seedServerDefaultAgents`
- */
-async function loadDefaultAgentBooks(): Promise<ReadonlyArray<string_book>> {
-    const defaultAgentDirectory = await resolveDefaultAgentDirectory();
-    const directoryEntries = await readdir(defaultAgentDirectory);
-    const defaultAgentFilenames = directoryEntries
-        .filter((entry) => entry.toLowerCase().endsWith('.book'))
-        .sort((leftFilename, rightFilename) => leftFilename.localeCompare(rightFilename));
-
-    return Promise.all(
-        defaultAgentFilenames.map(async (filename) => {
-            const filePath = resolve(defaultAgentDirectory, filename);
-            return (await readFile(filePath, 'utf-8')) as string_book;
-        }),
-    );
-}
-
-/**
- * Resolves the repository directory that stores default managed-server agents.
- *
- * @returns Absolute path to `agents/default`.
- *
- * @private function of `seedServerDefaultAgents`
- */
-async function resolveDefaultAgentDirectory(): Promise<string> {
-    for (const directoryCandidate of DEFAULT_AGENT_DIRECTORY_CANDIDATES) {
-        try {
-            await access(directoryCandidate);
-            return directoryCandidate;
-        } catch {
-            // Continue to the next candidate directory.
-        }
-    }
-
-    throw new DatabaseError(
-        spaceTrim(
-            (block) => `
-                Failed to locate the default Agents Server books directory.
-
-                Checked:
-                ${block(
-                    DEFAULT_AGENT_DIRECTORY_CANDIDATES.map(
-                        (candidate) => `- \`${normalizePathForLogs(candidate)}\``,
-                    ).join('\n'),
-                )}
-            `,
-        ),
-    );
-}
-
-/**
- * Normalizes path separators for diagnostics.
- *
- * @param value - Raw filesystem path.
- * @returns Slash-normalized path.
- *
- * @private function of `seedServerDefaultAgents`
- */
-function normalizePathForLogs(value: string): string {
-    return value.split('\\').join('/');
-}

package/apps/agents-server/src/utils/serverManagement/createManagedServer.ts

@@ -108,6 +108,11 @@ export type CreateServerInput = {
      */
     readonly additionalUsers?: ReadonlyArray<ServerSeedUserInput>;
 
+    /**
+     * Whether bundled default agents from `agents/default` should be created during bootstrap.
+     */
+    readonly isDefaultAgentsInstalled?: boolean;
+
     /**
      * Initial metadata values for the new server.
      */

package/apps/agents-server/src/utils/session.ts

@@ -1,8 +1,10 @@
-import { createHmac } from 'crypto';
+import { createHmac, randomBytes } from 'crypto';
 import { cookies, headers } from 'next/headers';
 import { cache } from 'react';
+import { spaceTrim } from 'spacetrim';
+import { EnvironmentMismatchError } from '../../../../src/errors/EnvironmentMismatchError';
+import { isTimingSafeEqualString } from '../../../../src/utils/isTimingSafeEqualString';
 import { isStandaloneVpsRawIpBootstrapActive } from './standaloneVpsRawIpBootstrap';
-import { writeShibbolethAuthenticationLog } from './shibboleth/writeShibbolethAuthenticationLog';
 
 /**
  * Cookie name used to store the signed user session.
@@ -10,9 +12,64 @@ import { writeShibbolethAuthenticationLog } from './shibboleth/writeShibbolethAu
 export const SESSION_COOKIE_NAME = 'sessionToken';
 
 /**
- * Secret key used for signing session payloads.
+ * Cached HMAC signing key resolved from `SESSION_SECRET` on first use.
+ *
+ * Computed lazily so module imports never fail eagerly at build time and the
+ * environment can still be configured before the first authenticated request.
  */
-const SECRET_KEY = process.env.ADMIN_PASSWORD || 'default-secret-key-change-me';
+let resolvedSessionSigningKey: string | null = null;
+
+/**
+ * Resolves the HMAC signing key used for session payloads.
+ *
+ * In production, `SESSION_SECRET` must be configured explicitly — falling back
+ * to any shared credential (in particular `ADMIN_PASSWORD`) or a hardcoded
+ * literal would let anyone who learns that value forge session tokens for any
+ * user (including `admin`). Outside production, a per-process random key is
+ * generated on first use so local development works without configuration
+ * while still rejecting the unsafe hardcoded default.
+ *
+ * @returns HMAC signing key.
+ * @throws {EnvironmentMismatchError} When `SESSION_SECRET` is missing in production.
+ */
+function getSessionSigningKey(): string {
+    if (resolvedSessionSigningKey !== null) {
+        return resolvedSessionSigningKey;
+    }
+
+    const configuredSecret = process.env.SESSION_SECRET?.trim();
+    if (configuredSecret) {
+        resolvedSessionSigningKey = configuredSecret;
+        return resolvedSessionSigningKey;
+    }
+
+    if (process.env.NODE_ENV === 'production') {
+        throw new EnvironmentMismatchError(
+            spaceTrim(`
+                Missing required \`SESSION_SECRET\` environment variable in production.
+
+                The Agents Server signs session cookies with HMAC-SHA256 keyed by
+                \`SESSION_SECRET\`. Reusing \`ADMIN_PASSWORD\` or a hardcoded fallback
+                would let anyone who learns that value forge session tokens for any
+                user (including \`admin\`).
+
+                **Fix:** set \`SESSION_SECRET\` to a long random string (for example
+                the output of \`openssl rand -hex 32\`) in the deployment environment
+                and restart the server.
+            `),
+        );
+    }
+
+    resolvedSessionSigningKey = randomBytes(32).toString('hex');
+    console.warn(
+        spaceTrim(`
+            \`SESSION_SECRET\` is not configured — generated a random per-process
+            signing key for this non-production run. Existing session cookies will
+            be invalidated on every restart until \`SESSION_SECRET\` is set.
+        `),
+    );
+    return resolvedSessionSigningKey;
+}
 
 /**
  * Signed session payload persisted in the authentication cookie.
@@ -74,7 +131,7 @@ export type SessionCookieSecurityContext = {
  */
 export function serializeSessionToken(user: SessionUser): string {
     const payload = JSON.stringify(user);
-    const signature = createHmac('sha256', SECRET_KEY).update(payload).digest('hex');
+    const signature = createHmac('sha256', getSessionSigningKey()).update(payload).digest('hex');
     return `${Buffer.from(payload).toString('base64')}.${signature}`;
 }
 
@@ -95,9 +152,9 @@ export function parseSessionToken(token: string | null | undefined): SessionUser
     }
 
     const payload = Buffer.from(payloadBase64, 'base64').toString('utf-8');
-    const expectedSignature = createHmac('sha256', SECRET_KEY).update(payload).digest('hex');
+    const expectedSignature = createHmac('sha256', getSessionSigningKey()).update(payload).digest('hex');
 
-    if (signature !== expectedSignature) {
+    if (!isTimingSafeEqualString(signature, expectedSignature)) {
         return null;
     }
 
@@ -162,17 +219,9 @@ export function shouldUseSecureSessionCookieForRequest(context: SessionCookieSec
  */
 export async function setSession(user: SessionUser) {
     const token = serializeSessionToken(user);
-    const headerStore = await headers();
-    const cookieStore = await cookies();
-    const secure = shouldUseSecureSessionCookieForHeaders(headerStore);
+    const secure = await shouldUseSecureSessionCookie();
 
-    writeShibbolethAuthenticationLog(headerStore, {
-        event: 'session-set',
-        hasSessionCookie: cookieStore.has(SESSION_COOKIE_NAME),
-        isSecureSessionCookie: secure,
-    });
-
-    cookieStore.set(SESSION_COOKIE_NAME, token, {
+    (await cookies()).set(SESSION_COOKIE_NAME, token, {
         httpOnly: true,
         secure,
         path: '/',
@@ -184,17 +233,9 @@ export async function setSession(user: SessionUser) {
  * Clears the current authenticated session cookie.
  */
 export async function clearSession() {
-    const headerStore = await headers();
-    const cookieStore = await cookies();
-
-    writeShibbolethAuthenticationLog(headerStore, {
-        event: 'session-cleared',
-        hasSessionCookie: cookieStore.has(SESSION_COOKIE_NAME),
-    });
-
-    cookieStore.delete(SESSION_COOKIE_NAME);
+    (await cookies()).delete(SESSION_COOKIE_NAME);
     // Also clear legacy adminToken
-    cookieStore.delete('adminToken');
+    (await cookies()).delete('adminToken');
 }
 
 /**
@@ -217,12 +258,13 @@ export async function getSession(): Promise<SessionUser | null> {
 }
 
 /**
- * Resolves the runtime cookie security decision from one request header snapshot.
+ * Resolves the runtime cookie security decision from the current request headers.
  *
- * @param headerStore - Request headers from the active request.
  * @returns `true` when the session cookie should keep the `Secure` flag.
  */
-function shouldUseSecureSessionCookieForHeaders(headerStore: Pick<Headers, 'get'>): boolean {
+async function shouldUseSecureSessionCookie(): Promise<boolean> {
+    const headerStore = await headers();
+
     return shouldUseSecureSessionCookieForRequest({
         isProduction: process.env.NODE_ENV === 'production',
         host: headerStore.get('host'),