@agent-native/core 0.130.0 → 0.130.1

package/corpus/core/src/integrations/task-queue-stats.ts

@@ -8,6 +8,7 @@
  * columns before the SELECTs execute.
  */
 import { getDbExec } from "../db/client.js";
+import { ensureA2AContinuationsTable } from "./a2a-continuations-store.js";
 import { ensurePendingTasksTable } from "./pending-tasks-store.js";
 
 export interface RecentFailure {
@@ -23,6 +24,18 @@ export interface TaskQueueStats {
   completed_last_hour: number;
   failed_last_hour: number;
   oldest_pending_age_seconds: number;
+  waiting_campaigns: number;
+  active_a2a_continuations: number;
+  oldest_active_a2a_age_seconds: number;
+  terminal_a2a_without_delivery: number;
+  recent_a2a_orphans: Array<{
+    continuation_id: string;
+    integration_task_id: string;
+    status: string;
+    attempts: number;
+    age_seconds: number;
+    reason_class: string;
+  }>;
   recent_failures: RecentFailure[];
   recent_tasks: Array<{
     id: string;
@@ -46,6 +59,11 @@ const ZERO_STATS: TaskQueueStats = {
   completed_last_hour: 0,
   failed_last_hour: 0,
   oldest_pending_age_seconds: 0,
+  waiting_campaigns: 0,
+  active_a2a_continuations: 0,
+  oldest_active_a2a_age_seconds: 0,
+  terminal_a2a_without_delivery: 0,
+  recent_a2a_orphans: [],
   recent_failures: [],
   recent_tasks: [],
 };
@@ -66,11 +84,14 @@ export async function getTaskQueueStats(
   scope: TaskQueueStatsScope,
 ): Promise<TaskQueueStats> {
   await ensurePendingTasksTable();
+  await ensureA2AContinuationsTable();
   const client = getDbExec();
   const now = Date.now();
   const oneHourAgo = now - 60 * 60 * 1000;
   const scopeSql = `owner_email = ?
               AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)`;
+  const joinedScopeSql = `t.owner_email = ?
+              AND ((t.org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR t.org_id = ?)`;
   const scopeArgs = [scope.ownerEmail, scope.orgId, scope.orgId];
 
   try {
@@ -178,6 +199,17 @@ export async function getTaskQueueStats(
         ),
       }),
     );
+    const waitingCampaigns = await readWaitingCampaignCount(
+      client,
+      joinedScopeSql,
+      scopeArgs,
+    );
+    const a2aStats = await readA2AContinuationStats(
+      client,
+      joinedScopeSql,
+      scopeArgs,
+      now,
+    );
 
     return {
       pending,
@@ -185,6 +217,8 @@ export async function getTaskQueueStats(
       completed_last_hour: completedLastHour,
       failed_last_hour: failedLastHour,
       oldest_pending_age_seconds: oldestPendingAgeSeconds,
+      waiting_campaigns: waitingCampaigns,
+      ...a2aStats,
       recent_failures: recentFailures,
       recent_tasks: recentTasks,
     };
@@ -195,3 +229,115 @@ export async function getTaskQueueStats(
     throw err;
   }
 }
+
+async function readWaitingCampaignCount(
+  client: ReturnType<typeof getDbExec>,
+  scopeSql: string,
+  scopeArgs: Array<string | null>,
+): Promise<number> {
+  try {
+    const result = await client.execute({
+      sql: `SELECT COUNT(*) AS c
+              FROM integration_campaigns c
+              INNER JOIN integration_pending_tasks t
+                ON t.id = c.integration_task_id
+             WHERE ${scopeSql}
+               AND c.status = 'waiting'`,
+      args: scopeArgs,
+    });
+    return Number(result.rows[0]?.c ?? 0);
+  } catch (err) {
+    if (isMissingTableError(err)) return 0;
+    throw err;
+  }
+}
+
+async function readA2AContinuationStats(
+  client: ReturnType<typeof getDbExec>,
+  scopeSql: string,
+  scopeArgs: Array<string | null>,
+  now: number,
+): Promise<
+  Pick<
+    TaskQueueStats,
+    | "active_a2a_continuations"
+    | "oldest_active_a2a_age_seconds"
+    | "terminal_a2a_without_delivery"
+    | "recent_a2a_orphans"
+  >
+> {
+  try {
+    const live = await client.execute({
+      sql: `SELECT
+                   COUNT(CASE WHEN c.status IN ('pending', 'processing', 'delivering') THEN 1 END) AS active_count,
+                   MIN(CASE WHEN c.status IN ('pending', 'processing', 'delivering') THEN c.created_at END) AS oldest_created_at,
+                   COUNT(CASE WHEN c.status IN ('completed', 'failed')
+                         AND c.terminal_delivery_confirmed_at IS NULL THEN 1 END) AS orphan_count
+              FROM integration_a2a_continuations c
+              INNER JOIN integration_pending_tasks t
+                ON t.id = c.integration_task_id
+             WHERE ${scopeSql}`,
+      args: scopeArgs,
+    });
+    const orphaned = await client.execute({
+      sql: `SELECT c.id, c.integration_task_id, c.status, c.attempts,
+                   c.created_at, c.error_message
+              FROM integration_a2a_continuations c
+              INNER JOIN integration_pending_tasks t
+                ON t.id = c.integration_task_id
+             WHERE ${scopeSql}
+               AND c.status IN ('completed', 'failed')
+               AND c.terminal_delivery_confirmed_at IS NULL
+             ORDER BY c.updated_at DESC
+             LIMIT 5`,
+      args: scopeArgs,
+    });
+    const activeCount = Number(live.rows[0]?.active_count ?? 0);
+    const orphanCount = Number(live.rows[0]?.orphan_count ?? 0);
+    const oldestCreatedAt = Number(live.rows[0]?.oldest_created_at ?? now);
+    const recentOrphans = (orphaned.rows as Array<Record<string, unknown>>).map(
+      (row) => ({
+        continuation_id: String(row.id ?? ""),
+        integration_task_id: String(row.integration_task_id ?? ""),
+        status: String(row.status ?? ""),
+        attempts: Number(row.attempts ?? 0),
+        age_seconds: Math.max(
+          0,
+          Math.floor((now - Number(row.created_at ?? now)) / 1000),
+        ),
+        reason_class: classifyA2AOrphanReason(row.error_message),
+      }),
+    );
+    return {
+      active_a2a_continuations: activeCount,
+      oldest_active_a2a_age_seconds:
+        activeCount > 0
+          ? Math.max(0, Math.floor((now - oldestCreatedAt) / 1000))
+          : 0,
+      terminal_a2a_without_delivery: orphanCount,
+      recent_a2a_orphans: recentOrphans,
+    };
+  } catch (err) {
+    if (isMissingTableError(err)) {
+      return {
+        active_a2a_continuations: 0,
+        oldest_active_a2a_age_seconds: 0,
+        terminal_a2a_without_delivery: 0,
+        recent_a2a_orphans: [],
+      };
+    }
+    throw err;
+  }
+}
+
+function classifyA2AOrphanReason(value: unknown): string {
+  const message = String(value ?? "");
+  if (!message) return "missing_terminal_delivery";
+  if (/timeout|timed out|abort/i.test(message)) return "timeout";
+  if (/token|secret|auth|credential/i.test(message)) return "authentication";
+  if (/database|sql|store|persist/i.test(message)) return "persistence";
+  if (/slack|provider|deliver|stream|response/i.test(message)) {
+    return "provider_delivery";
+  }
+  return "processor_failure";
+}

package/corpus/core/src/integrations/types.ts

@@ -134,6 +134,19 @@ export interface PlatformDeliveryReceipt {
   messageRefs?: string[];
 }
 
+export interface PlatformDeliveryOptions {
+  /** Provider-owned message reference that should be updated in place. */
+  placeholderRef?: string;
+  /** Stable logical delivery key for provider-side retry reconciliation. */
+  idempotencyKey?: string;
+  /** Earliest provider timestamp (epoch ms) that can contain this delivery. */
+  reconcileAfter?: number;
+  /** Abort provider I/O before the caller releases its durable delivery claim. */
+  signal?: AbortSignal;
+  /** Do not fall back to a fresh post if the stable target cannot be updated. */
+  strictTargetRef?: boolean;
+}
+
 /**
  * Proactive outbound message target for a platform.
  * Used when the agent needs to send to a saved destination instead of replying
@@ -201,12 +214,20 @@ export interface PlatformRunProgress {
    * credentials, or provider payload.
    */
   ref?: PlatformRunProgressRef;
+  /** Stable provider message target that can receive the terminal answer. */
+  responseTargetRef?: string;
   /** Receive normalized agent events. Implementations should throttle writes. */
-  onEvent(event: AgentChatEvent): Promise<void> | void;
+  onEvent(
+    event: AgentChatEvent,
+    opts?: { signal?: AbortSignal },
+  ): Promise<void> | void;
   /** Finalize the provider-native progress surface with the answer. */
-  complete(message: OutgoingMessage): Promise<void | PlatformDeliveryReceipt>;
+  complete(
+    message: OutgoingMessage,
+    opts?: { signal?: AbortSignal },
+  ): Promise<void | PlatformDeliveryReceipt>;
   /** Mark the provider-native surface failed and leave a retryable explanation. */
-  fail?(message: string): Promise<void>;
+  fail?(message: string, opts?: { signal?: AbortSignal }): Promise<void>;
 }
 
 /**
@@ -322,7 +343,7 @@ export interface PlatformAdapter {
   sendResponse(
     message: OutgoingMessage,
     context: IncomingMessage,
-    opts?: { placeholderRef?: string },
+    opts?: PlatformDeliveryOptions,
   ): Promise<void | PlatformDeliveryReceipt>;
 
   /**

package/corpus/core/src/integrations/webhook-handler.ts

@@ -67,7 +67,8 @@ import {
 import { runWithRequestContext } from "../server/request-context.js";
 import { normalizeReasoningEffortForRequest } from "../shared/reasoning-effort.js";
 import { A2A_CONTINUATION_QUEUED_MARKER } from "./a2a-continuation-marker.js";
-import { hasActiveA2AContinuationsForIntegrationTask } from "./a2a-continuations-store.js";
+import { reconcileTerminalA2AParentIfDisabled } from "./a2a-continuation-processor.js";
+import { getA2AContinuationTaskOutcome } from "./a2a-continuations-store.js";
 import {
   clearIntegrationAwaitingInput,
   setIntegrationAwaitingInput,
@@ -1086,10 +1087,22 @@ async function processIncomingMessage(
           JSON.parse(campaign.row.checkpoint).waitingForA2A === true;
       } catch {}
       if (waitingForA2A) {
-        const activeA2A = await hasActiveA2AContinuationsForIntegrationTask(
-          opts.taskId,
-        );
-        if (activeA2A) {
+        const a2aOutcome = await getA2AContinuationTaskOutcome(opts.taskId);
+        if (a2aOutcome !== "terminal-delivered") {
+          if (
+            a2aOutcome === "terminal-without-delivery" &&
+            (await reconcileTerminalA2AParentIfDisabled(opts.taskId))
+          ) {
+            await releaseApplicableIntegrationBudgets(
+              budgetReservations.reservations,
+            );
+            return { status: "campaign-failed" };
+          }
+          if (a2aOutcome !== "active") {
+            console.warn(
+              `[integrations] Waiting campaign ${campaign.row.id} has A2A outcome ${a2aOutcome} without terminal delivery proof`,
+            );
+          }
           const waiting = await waitForA2AIntegrationCampaign(campaign.row.id, {
             runId: campaign.runId,
             leaseToken: campaign.leaseToken,

package/corpus/templates/dispatch/changelog/2026-07-26-slack-replies-recover-after-connected-app-updates.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-26
+---
+
+Slack replies now recover after a connected app finishes an update, without repeating the update or losing the delivered reply from future thread context.

package/corpus/templates/slides/.agents/skills/design-systems/SKILL.md

@@ -40,6 +40,21 @@ Do not call `create-design-system` locally from `.fig` uploads. Do not call
 `import-document` for `.fig` files; it only handles metadata and will miss the
 Builder indexing flow.
 
+## Deleting a Design System
+
+`delete-design-system` requires admin access or higher (owner or admin share
+role) and removes the system, its shares, and the `designSystemId` link on
+every linked deck the caller can edit — decks the caller can't edit keep a
+dangling reference instead of being silently mutated, reported back as
+`decksSkippedForAccess` (clear it later with `patch-deck`'s
+`patch-deck-fields`, `designSystemId: null`). Those decks keep the tokens
+already baked into their slides — deletion never rewrites deck content — so a
+deck can look on-brand while no longer being linked to a system. If the
+deleted system was the caller's default, another of their design systems is
+promoted to default so future deck creation doesn't silently drop to "no
+design system". Deletion does not remove an upstream Builder-indexed design
+system.
+
 ## Applying to Slides
 
 Before creating or extending a system, read the `creative-context` skill and

package/corpus/templates/slides/actions/delete-design-system.ts

@@ -0,0 +1,145 @@
+import { defineAction } from "@agent-native/core";
+import {
+  assertAccess,
+  resolveAccess,
+  type ShareRole,
+} from "@agent-native/core/sharing";
+import { desc, eq } from "drizzle-orm";
+import { z } from "zod";
+
+import { getDb, schema } from "../server/db/index.js";
+import { withDeckLock } from "./patch-deck.js";
+
+function canEditDeckRole(role: "owner" | ShareRole) {
+  return role === "owner" || role === "admin" || role === "editor";
+}
+
+type UnlinkResult =
+  | { deckId: string; status: "unlinked" }
+  | { deckId: string; status: "skipped-no-access" };
+
+// Runs under the same per-deck lock patch-deck/save-deck/update-slide use for
+// all deck writes, re-reading the row inside the lock so a concurrent slide
+// edit can't be clobbered by this read-modify-write. Decks the caller can't
+// edit are left pointing at the deleted id rather than silently mutated —
+// admin access on a shared design system does not imply edit access on every
+// deck that happens to reference it.
+function unlinkDeck(
+  deckId: string,
+  designSystemId: string,
+): Promise<UnlinkResult> {
+  return withDeckLock(deckId, async () => {
+    const access = await resolveAccess("deck", deckId);
+    if (!access || !canEditDeckRole(access.role)) {
+      return { deckId, status: "skipped-no-access" };
+    }
+
+    const db = getDb();
+    const [deck] = await db
+      .select({
+        designSystemId: schema.decks.designSystemId,
+        data: schema.decks.data,
+      })
+      .from(schema.decks)
+      .where(eq(schema.decks.id, deckId));
+    if (!deck || deck.designSystemId !== designSystemId) {
+      return { deckId, status: "unlinked" };
+    }
+
+    const data = JSON.parse(deck.data);
+    if ("designSystemId" in data) delete data.designSystemId;
+    await db
+      .update(schema.decks)
+      .set({
+        designSystemId: null,
+        data: JSON.stringify(data),
+        updatedAt: new Date().toISOString(),
+      })
+      .where(eq(schema.decks.id, deckId));
+    return { deckId, status: "unlinked" };
+  });
+}
+
+export default defineAction({
+  description:
+    "Delete a design system. Requires admin access or higher. Decks linked to it that " +
+    "the caller can edit are unlinked; others keep a dangling reference (clear it with " +
+    "patch-deck's patch-deck-fields, designSystemId: null). If the deleted system was the " +
+    "caller's default, another of their design systems is promoted to default.",
+  schema: z.object({
+    id: z.string().min(1).describe("Design system ID to delete"),
+  }),
+  run: async ({ id }) => {
+    const access = await assertAccess("design-system", id, "admin");
+
+    const db = getDb();
+
+    const linkedDeckIds = (
+      await db
+        .select({ id: schema.decks.id })
+        .from(schema.decks)
+        .where(eq(schema.decks.designSystemId, id))
+    ).map((row) => row.id);
+
+    // Delete the design system (and its shares) before touching linked decks.
+    // Once the row is gone, apply-design-system/create-deck's
+    // assertAccess("design-system", ...) check fails for anyone trying to
+    // attach a fresh link, shrinking the window for a deck to end up pointing
+    // at a design system we're about to remove. If this was the owner's
+    // default, promote another of their design systems in the same
+    // transaction so deck creation never silently drops to "no design
+    // system" just because the default happened to be deleted.
+    await db.transaction(async (tx) => {
+      await tx
+        .delete(schema.designSystemShares)
+        .where(eq(schema.designSystemShares.resourceId, id));
+
+      await tx
+        .delete(schema.designSystems)
+        .where(eq(schema.designSystems.id, id));
+
+      if (access.resource.isDefault) {
+        const [next] = await tx
+          .select({ id: schema.designSystems.id })
+          .from(schema.designSystems)
+          .where(
+            eq(schema.designSystems.ownerEmail, access.resource.ownerEmail),
+          )
+          .orderBy(desc(schema.designSystems.updatedAt))
+          .limit(1);
+        if (next) {
+          await tx
+            .update(schema.designSystems)
+            .set({ isDefault: true, updatedAt: new Date().toISOString() })
+            .where(eq(schema.designSystems.id, next.id));
+        }
+      }
+    });
+
+    // Best-effort cleanup: the design system is already gone, so a deck we
+    // can't touch (missing access) or fail to update (write error) is left
+    // dangling rather than retried here. Both cases are reported back instead
+    // of swallowed, so the caller can decide whether to intervene.
+    const settled = await Promise.allSettled(
+      linkedDeckIds.map((deckId) => unlinkDeck(deckId, id)),
+    );
+
+    const decksSkippedForAccess: string[] = [];
+    const decksFailedToUnlink: string[] = [];
+    settled.forEach((result, index) => {
+      const deckId = linkedDeckIds[index];
+      if (result.status === "rejected") {
+        decksFailedToUnlink.push(deckId);
+      } else if (result.value.status === "skipped-no-access") {
+        decksSkippedForAccess.push(deckId);
+      }
+    });
+
+    return {
+      id,
+      deleted: true,
+      ...(decksSkippedForAccess.length > 0 ? { decksSkippedForAccess } : {}),
+      ...(decksFailedToUnlink.length > 0 ? { decksFailedToUnlink } : {}),
+    };
+  },
+});

package/corpus/templates/slides/actions/list-design-systems.ts

@@ -1,10 +1,38 @@
 import { defineAction } from "@agent-native/core";
-import { accessFilter } from "@agent-native/core/sharing";
-import { desc } from "drizzle-orm";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server/request-context";
+import {
+  accessFilter,
+  ROLE_RANK,
+  type ShareRole,
+} from "@agent-native/core/sharing";
+import { and, desc, eq, inArray, or, sql } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
 
+type EffectiveRole = "owner" | ShareRole;
+
+function canManageRole(role: EffectiveRole) {
+  return role === "owner" || role === "admin";
+}
+
+// Mirrors the core access model (assertAccess/resolveAccess), which compares
+// emails with `lower(column) = lowercased-input` so a share or ownership
+// grant survives casing differences between the stored principal and the
+// caller's session email.
+function normalizeEmail(email: string | undefined): string | null {
+  const normalized = email?.trim().toLowerCase();
+  return normalized || null;
+}
+
+function strongerRole(current: ShareRole | null, next: ShareRole): ShareRole {
+  if (!current || ROLE_RANK[next] > ROLE_RANK[current]) return next;
+  return current;
+}
+
 export default defineAction({
   description:
     "List all design systems accessible to the current user. " +
@@ -19,6 +47,8 @@ export default defineAction({
   http: { method: "GET" },
   run: async (args) => {
     const db = getDb();
+    const userEmail = normalizeEmail(getRequestUserEmail());
+    const orgId = getRequestOrgId();
     // Project only the columns this list returns. The default path returns
     // `data`, but neither path returns the heavy `assets` blob — a bare
     // `.select()` would load it off every row for nothing.
@@ -30,6 +60,8 @@ export default defineAction({
         data: schema.designSystems.data,
         isDefault: schema.designSystems.isDefault,
         visibility: schema.designSystems.visibility,
+        ownerEmail: schema.designSystems.ownerEmail,
+        orgId: schema.designSystems.orgId,
         createdAt: schema.designSystems.createdAt,
         updatedAt: schema.designSystems.updatedAt,
       })
@@ -41,12 +73,70 @@ export default defineAction({
       return { count: 0, designSystems: [] };
     }
 
+    // Resolve every row's role from a single batched shares query instead of
+    // calling resolveAccess() per row, which would re-load each resource and
+    // its shares (N+1) and fan out an unbounded Promise.all as the list grows.
+    const principalClauses: NonNullable<ReturnType<typeof and>>[] = [];
+    if (userEmail) {
+      principalClauses.push(
+        and(
+          eq(schema.designSystemShares.principalType, "user"),
+          sql`lower(${schema.designSystemShares.principalId}) = ${userEmail}`,
+        )!,
+      );
+    }
+    if (orgId) {
+      principalClauses.push(
+        and(
+          eq(schema.designSystemShares.principalType, "org"),
+          eq(schema.designSystemShares.principalId, orgId),
+        )!,
+      );
+    }
+
+    const shareRoleById = new Map<string, ShareRole>();
+    if (principalClauses.length > 0) {
+      const shareRows = await db
+        .select({
+          resourceId: schema.designSystemShares.resourceId,
+          role: schema.designSystemShares.role,
+        })
+        .from(schema.designSystemShares)
+        .where(
+          and(
+            inArray(
+              schema.designSystemShares.resourceId,
+              rows.map((row) => row.id),
+            ),
+            or(...principalClauses),
+          ),
+        );
+      for (const share of shareRows) {
+        shareRoleById.set(
+          share.resourceId,
+          strongerRole(shareRoleById.get(share.resourceId) ?? null, share.role),
+        );
+      }
+    }
+
     const items = rows.map((row) => {
+      let role: EffectiveRole = shareRoleById.get(row.id) ?? "viewer";
+      if (
+        userEmail &&
+        normalizeEmail(row.ownerEmail) === userEmail &&
+        (!row.orgId || row.orgId === orgId)
+      ) {
+        role = "owner";
+      }
+      const canManage = canManageRole(role);
+
       if (args.compact === "true") {
         return {
           id: row.id,
           title: row.title,
           isDefault: row.isDefault,
+          accessRole: role,
+          canManage,
         };
       }
       return {
@@ -56,6 +146,8 @@ export default defineAction({
         data: row.data,
         isDefault: row.isDefault,
         visibility: row.visibility,
+        accessRole: role,
+        canManage,
         createdAt: row.createdAt,
         updatedAt: row.updatedAt,
       };

package/corpus/templates/slides/app/components/design-system/DesignSystemCard.tsx

@@ -1,7 +1,21 @@
+import { useT } from "@agent-native/core/client/i18n";
 import { ShareButton } from "@agent-native/core/client/sharing";
 import { VisibilityBadge } from "@agent-native/toolkit/sharing";
-import { IconPalette, IconStar, IconStarFilled } from "@tabler/icons-react";
+import {
+  IconDots,
+  IconPalette,
+  IconStar,
+  IconStarFilled,
+  IconTrash,
+} from "@tabler/icons-react";
 
+import { Button } from "@/components/ui/button";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
 import {
   Tooltip,
   TooltipContent,
@@ -16,8 +30,10 @@ interface DesignSystemCardProps {
   data: DesignSystemData;
   isDefault: boolean;
   visibility?: "private" | "org" | "public" | null;
+  canManage?: boolean;
   onClick: () => void;
   onSetDefault: () => void;
+  onDelete: () => void;
 }
 
 function firstFontName(stack: string): string {
@@ -30,9 +46,12 @@ export function DesignSystemCard({
   data,
   isDefault,
   visibility,
+  canManage,
   onClick,
   onSetDefault,
+  onDelete,
 }: DesignSystemCardProps) {
+  const t = useT();
   const swatchColors = [
     { label: "Primary", color: data.colors.primary },
     { label: "Secondary", color: data.colors.secondary },
@@ -93,6 +112,29 @@ export function DesignSystemCard({
             resourceId={id}
             resourceTitle={title}
           />
+          {canManage && (
+            <DropdownMenu modal={false}>
+              <DropdownMenuTrigger asChild>
+                <Button
+                  variant="ghost"
+                  size="icon"
+                  aria-label={t("designSystems.moreActions")}
+                  className="h-9 w-9 rounded-md bg-background/80 backdrop-blur-sm border border-border/40 hover:bg-background cursor-pointer"
+                >
+                  <IconDots className="w-4 h-4 text-muted-foreground" />
+                </Button>
+              </DropdownMenuTrigger>
+              <DropdownMenuContent align="end">
+                <DropdownMenuItem
+                  onClick={onDelete}
+                  className="text-red-400 focus:text-red-400"
+                >
+                  <IconTrash className="w-3.5 h-3.5 me-2" />
+                  {t("designSystems.delete")}
+                </DropdownMenuItem>
+              </DropdownMenuContent>
+            </DropdownMenu>
+          )}
         </div>
 
         {/* Typography preview */}

package/corpus/templates/slides/app/hooks/use-design-systems.ts

@@ -7,6 +7,8 @@ type DesignSystemSummary = {
   data: string;
   isDefault: boolean;
   visibility?: "private" | "org" | "public" | null;
+  accessRole?: "owner" | "admin" | "editor" | "viewer";
+  canManage?: boolean;
   createdAt: string;
 };