@agent-native/core 0.176.1 → 0.176.2-nightly-20260831185956

package/corpus/templates/plan/server/lib/plan-versions.ts

@@ -1,3 +1,4 @@
+import { getRequestRunContext } from "@agent-native/core/server";
 import { and, asc, desc, eq } from "drizzle-orm";
 
 import type {
@@ -21,6 +22,59 @@ const SNAPSHOT_INTERVAL_MS = 5 * 60 * 1000;
  */
 const BURST_COALESCE_WINDOW_MS = 90 * 1000; // 90 seconds
 
+export interface PlanVersionChatContext {
+  threadId?: string;
+  runId?: string;
+  turnId?: string;
+}
+
+function planVersionChatContextFromFields(value: {
+  threadId?: unknown;
+  runId?: unknown;
+  turnId?: unknown;
+}): PlanVersionChatContext | undefined {
+  const context: PlanVersionChatContext = {};
+  for (const key of ["threadId", "runId", "turnId"] as const) {
+    if (typeof value[key] === "string" && value[key].trim()) {
+      context[key] = value[key];
+    }
+  }
+  return context.runId || context.turnId ? context : undefined;
+}
+
+function requestPlanVersionChatContext(): PlanVersionChatContext | undefined {
+  const run = getRequestRunContext();
+  return run ? planVersionChatContextFromFields(run) : undefined;
+}
+
+export function planVersionChatContextFromRun(run: {
+  threadId?: unknown;
+  runId?: unknown;
+  turnId?: unknown;
+}): PlanVersionChatContext | undefined {
+  return planVersionChatContextFromFields(run);
+}
+
+export function parsePlanVersionChatContext(
+  raw: string | null | undefined,
+): PlanVersionChatContext | undefined {
+  if (raw == null) return undefined;
+  let value: unknown;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error("Plan version chat metadata is not valid JSON.");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Plan version chat metadata is invalid.");
+  }
+  const context = planVersionChatContextFromFields(
+    value as Record<string, unknown>,
+  );
+  if (!context) throw new Error("Plan version chat metadata is invalid.");
+  return context;
+}
+
 function canCoalesceBurstLabel(label: string | undefined): label is string {
   return label !== undefined && !label.startsWith("Before ");
 }
@@ -231,6 +285,7 @@ export async function createPlanVersionSnapshot(
     force?: boolean;
     label?: string;
     createdBy?: PlanAuthor;
+    chatContext?: PlanVersionChatContext;
   } = {},
 ): Promise<{ created: boolean; id?: string; reason?: string }> {
   const db = getDb();
@@ -311,6 +366,7 @@ export async function createPlanVersionSnapshot(
   }
 
   const id = newVersionId();
+  const chatContext = options.chatContext ?? requestPlanVersionChatContext();
   await db.insert(schema.planVersions).values({
     id,
     ownerEmail: plan.ownerEmail,
@@ -320,6 +376,7 @@ export async function createPlanVersionSnapshot(
     changeLabel: options.label,
     createdBy: options.createdBy ?? "agent",
     createdAt: new Date().toISOString(),
+    ...(chatContext ? { chatContext: JSON.stringify(chatContext) } : {}),
     status: summaryColumns.status,
     source: summaryColumns.source,
     blockCount: summaryColumns.blockCount,

package/corpus/templates/plan/server/plugins/agent-chat.ts

@@ -9,10 +9,92 @@ import { z } from "zod";
 import actionsRegistry from "../../.generated/actions-registry.js";
 import { PLAN_CONNECTOR_CATALOG } from "../lib/plan-connector-catalog.js";
 import { PLAN_FRAMEWORK_TOOLS } from "../lib/plan-framework-tools.js";
+import { planVersionChatContextFromRun } from "../lib/plan-versions.js";
 import { resolvePlanAnonymousOwner } from "../lib/public-plans.js";
+import { assertPlanEditor } from "../plans.js";
 
 const PLAN_BACKGROUND_RUN_SOFT_TIMEOUT_MS = 13 * 60_000;
 
+const PLAN_EDIT_TOOLS = new Set([
+  "convert-visual-plan-to-prototype",
+  "patch-visual-plan-source",
+  "restore-plan-version",
+  "update-visual-plan",
+]);
+
+function eventRecord(entry: unknown): Record<string, unknown> | undefined {
+  if (!entry || typeof entry !== "object") return undefined;
+  const event = (entry as { event?: unknown }).event;
+  return event && typeof event === "object"
+    ? (event as Record<string, unknown>)
+    : undefined;
+}
+
+function inputForCompletedTool(
+  events: readonly unknown[],
+  index: number,
+  completed: Record<string, unknown>,
+): Record<string, unknown> | undefined {
+  if (completed.input && typeof completed.input === "object") {
+    return completed.input as Record<string, unknown>;
+  }
+  const id = typeof completed.id === "string" ? completed.id : undefined;
+  for (let cursor = index - 1; cursor >= 0; cursor -= 1) {
+    const candidate = eventRecord(events[cursor]);
+    if (
+      candidate?.type !== "tool_start" ||
+      candidate.tool !== completed.tool ||
+      (id && candidate.id !== id)
+    ) {
+      continue;
+    }
+    return candidate.input && typeof candidate.input === "object"
+      ? (candidate.input as Record<string, unknown>)
+      : undefined;
+  }
+  return undefined;
+}
+
+function hasPlanEdit(
+  run: { events: readonly unknown[] },
+  planId: string,
+): boolean {
+  return run.events.some((entry, index) => {
+    const record = eventRecord(entry);
+    const input = record
+      ? inputForCompletedTool(run.events, index, record)
+      : undefined;
+    return (
+      record?.type === "tool_done" &&
+      record.completedSideEffect === true &&
+      record.isError !== true &&
+      typeof record.tool === "string" &&
+      PLAN_EDIT_TOOLS.has(record.tool) &&
+      (input?.planId ?? input?.id) === planId
+    );
+  });
+}
+
+async function autosavePlanAfterAgentTurn(
+  scope: { type: string; id: string },
+  run: {
+    events: readonly unknown[];
+    threadId?: string;
+    runId?: string;
+    turnId?: string;
+  },
+): Promise<void> {
+  if (scope.type !== "plan" || !hasPlanEdit(run, scope.id)) return;
+  await assertPlanEditor(scope.id);
+  const { createPlanVersionSnapshot } = await import("../lib/plan-versions.js");
+  await createPlanVersionSnapshot(scope.id, {
+    force: true,
+    label: "Chat autosave",
+    createdBy: "agent",
+    chatContext: planVersionChatContextFromRun(run),
+  });
+}
+
 // ---------------------------------------------------------------------------
 // Register plan event-bus events
 // ---------------------------------------------------------------------------
@@ -127,6 +209,7 @@ const INITIAL_TOOL_NAMES = [
 
 const planAgentChatOptions = {
   appId: "plan",
+  onAgentTurnComplete: autosavePlanAfterAgentTurn,
   actions: loadActionsFromStaticRegistry(actionsRegistry),
   initialToolNames: INITIAL_TOOL_NAMES,
   anonymousOwner: resolvePlanAnonymousOwner,

package/corpus/templates/plan/server/plugins/core-routes.ts

@@ -3,6 +3,7 @@ import { createCoreRoutesPlugin } from "@agent-native/core/server";
 import { resolvePlanAnonymousOwner } from "../lib/public-plans.js";
 
 export default createCoreRoutesPlugin({
+  googleOAuthManagedConnection: "not_applicable",
   anonymousOwner: resolvePlanAnonymousOwner,
   // Plan's published MCP server id is the bare `plan`, not the derived
   // `agent-native-plan`: `.agents/plugins/agent-native-visual-plans/.mcp.json`

package/corpus/templates/plan/server/plugins/db.ts

@@ -421,6 +421,16 @@ ALTER TABLE plan_versions ADD COLUMN IF NOT EXISTS has_prototype INTEGER;
 ALTER TABLE plan_versions ADD COLUMN IF NOT EXISTS preview_text TEXT`,
       },
     },
+    {
+      version: 38,
+      name: "plan-version-chat-context",
+      sql: {
+        postgres:
+          "ALTER TABLE plan_versions ADD COLUMN IF NOT EXISTS chat_context TEXT",
+        sqlite:
+          "ALTER TABLE plan_versions ADD COLUMN IF NOT EXISTS chat_context TEXT",
+      },
+    },
   ],
   { table: "plans_migrations" },
 );

package/corpus/templates/slides/.agents/skills/frontend-design/SKILL.md

@@ -68,6 +68,10 @@ is the target: a surface full of information and nearly empty of narration. So
 "make it minimal" is never satisfied by removing data or by burying it behind
 extra clicks, and never blocked by deleting a sentence.
 
+Keep on-screen text and badging minimal: show the shortest label needed for the
+next action, remove decorative or duplicate status chips, and put context in a
+tooltip or progressive disclosure when it is not needed to decide.
+
 Do not add, unless asked:
 
 - A page title that repeats the nav item or route the user just clicked, or a

package/corpus/templates/slides/.agents/skills/secrets/SKILL.md

@@ -31,6 +31,53 @@ standard workspace connections and org/workspace vault scopes; never put them
 in `.env` or deployment environment variables, and never add a provider-specific
 action or startup bootstrap just to write a credential for one organization.
 
+## Google OAuth triage
+
+| Observation | Meaning | Next action |
+| --- | --- | --- |
+| `invalid_grant` from a deliberately fake code | Google accepted the client pair and rejected only the code | Do not rotate credentials; check flow state and callback registration |
+| `invalid_client` | Google rejected the client id/secret pair | Verify the exact pair and deployment source before rotating |
+| `redirect_uri_mismatch` | The client, host, callback path, and Google registration disagree | Compare that exact tuple in Google Cloud Console; publish a new deploy if site-scoped or build-time configuration changes |
+
+Do not reason about this from memory. The probe checks both contracts: the
+unqualified `/health/google` endpoint reports the sign-in contract, while
+`/health/google?client=managed` reports deployment-level managed OAuth. It asks
+Google directly whether each live `(client_id, redirect_uri)` pair is
+registered:
+
+```bash
+pnpm check:google-redirect-uris -- --env all
+```
+
+The sign-in health path calls `checkGoogleSignInCredential()`, which prefers
+the active Better Auth pair and otherwise uses `resolveGoogleSignInCredentials()`
+from `packages/core/src/server/google-oauth-credentials.ts`. Managed health
+calls `checkGoogleManagedCredential()`, which resolves
+`["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"]` through `resolveSecretPair()` in
+`packages/core/src/server/credential-provider.ts`. App provider handlers use
+`resolveGoogleProviderCredentialCandidatesWithReader()` with `resolveSecret`
+under request context. These are separate flows and can intentionally land on
+different Google clients, so a clean result for one says nothing about the
+other. Read both contracts before changing anything:
+
+```bash
+curl -s https://HOST/_agent-native/health/google | jq '{clientId,mismatchedPairs,credentialSource}'
+curl -s "https://HOST/_agent-native/health/google?client=managed" | jq '{clientId,mismatchedPairs,credentialSource}'
+```
+
+Different `clientId` values across those two, or `mismatchedPairs: true`, is a
+divergence to understand, not damage to undo. Never repair it by rotating a
+secret: writing a fresh value into whichever namespace the failing flow does
+not read verifies clean and changes nothing. Do not collapse the namespaces
+without first confirming which flow uses which client; separate sign-in and
+managed clients on one host can be deliberate. For prebuilt Netlify deploys,
+uploaded Functions read site-scoped secrets at runtime, and the health route
+resolves them per request. The build may receive masked placeholder values.
+After changing a site-scoped env var, publish a new deploy before verifying
+live behavior. Call it a rebuild when the changed value is baked into build
+output or static assets; a runtime-only secret does not need to be baked into
+the bundle.
+
 ## Credential Modeling Preflight
 
 Before registering a provider's fields, inspect the workspace/provider connection

package/corpus/templates/slides/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable user-facing changes to Agent-Native Slides are documented here. Open it any
 time from the command menu (Cmd+K → "What's new").
 
+## 2026-08-28
+
+### Fixed
+
+- Image position and size edits persist while dropped images finish uploading.
+- A slide containing a `<style>` block no longer renders empty on shared and presented links — the block and everything after it now survive.
+- Keep the standard app layout visible when a Slides workspace has no decks.
+
 ## 2026-08-27
 
 ### Added
@@ -15,6 +23,7 @@ time from the command menu (Cmd+K → "What's new").
 
 ### Fixed
 
+- Image fit controls now apply cover crops and let you choose their position.
 - Copying a slide in Slides now makes it available to paste into another deck.
 - PowerPoint exports now embed the deck's own fonts and pin every text box, so a deck opened in PowerPoint or moved into Google Slides keeps the type and layout it had in the editor.
 

package/corpus/templates/slides/actions/_deck-write.ts

@@ -4,12 +4,77 @@
  * it — this module is not itself an action.
  */
 import { assertAccess, ForbiddenError } from "@agent-native/core/sharing";
+import { and, eq, isNull, type AnyColumn } from "drizzle-orm";
 
 import { ASPECT_RATIO_VALUES } from "../shared/aspect-ratios.js";
 
 /** A deck is stored as one opaque JSON blob in `decks.data`. */
 export type DeckPayload = Record<string, unknown>;
 
+export function nextDeckRevision(
+  expectedUpdatedAt: string | null | undefined,
+  now = new Date(),
+): string {
+  const expectedMs = expectedUpdatedAt
+    ? Date.parse(expectedUpdatedAt)
+    : Number.NaN;
+  const nextMs = Number.isFinite(expectedMs)
+    ? Math.max(now.getTime(), expectedMs + 1)
+    : now.getTime();
+  return new Date(nextMs).toISOString();
+}
+
+export function deckRevisionWhere(
+  table: { id: AnyColumn; updatedAt: AnyColumn },
+  deckId: string,
+  expectedUpdatedAt: string | null | undefined,
+): ReturnType<typeof and> {
+  if (expectedUpdatedAt === undefined) {
+    throw new Error(
+      `Deck ${deckId} is missing its revision. Re-read it before saving.`,
+    );
+  }
+  return and(
+    eq(table.id, deckId),
+    expectedUpdatedAt === null
+      ? isNull(table.updatedAt)
+      : eq(table.updatedAt, expectedUpdatedAt),
+  );
+}
+
+export function assertDeckWriteApplied(
+  result: unknown,
+  deckId: string,
+  operation: string,
+): void {
+  const candidate = result as {
+    rowsAffected?: unknown;
+    affectedRows?: unknown;
+    rowCount?: unknown;
+    count?: unknown;
+    changes?: unknown;
+    meta?: { changes?: unknown };
+  } | null;
+  const affected =
+    candidate?.rowsAffected ??
+    candidate?.affectedRows ??
+    candidate?.rowCount ??
+    candidate?.count ??
+    candidate?.changes ??
+    candidate?.meta?.changes;
+  if (typeof affected !== "number") {
+    throw new Error(
+      `Database did not report the affected row count for ${operation} on deck ${deckId}; refusing to claim persistence.`,
+    );
+  }
+  if (affected !== 1) {
+    throw deckHttpError(
+      409,
+      `Deck ${deckId} changed while saving ${operation}; re-read the deck and retry the edit.`,
+    );
+  }
+}
+
 /**
  * Actions surface HTTP status through `statusCode`; the action route echoes the
  * message verbatim for client errors and swallows it for anything >= 500.

package/corpus/templates/slides/actions/add-slide.ts

@@ -15,13 +15,21 @@ import { z } from "zod";
 import { normalizeSlidePadding } from "../app/lib/normalize-slide-padding.js";
 import { getDb, schema } from "../server/db/index.js";
 import { notifyClients } from "../server/handlers/decks.js";
-import { createDeckVersionSnapshot } from "../server/lib/deck-versions.js";
+import {
+  createDeckVersionSnapshot,
+  deckVersionChatContextFromAction,
+} from "../server/lib/deck-versions.js";
 import { repairGeneratedDeckTitle } from "../shared/deck-title.js";
 import {
   createLayoutFitRevision,
   hashSlideContent,
 } from "../shared/slide-fit.js";
 import { slideLabelFor, touchAgentSlidePresence } from "./_agent-presence.js";
+import {
+  assertDeckWriteApplied,
+  deckRevisionWhere,
+  nextDeckRevision,
+} from "./_deck-write.js";
 // Use the shared, globalThis-pinned per-deck lock so add-slide, update-slide,
 // and the browser's patch-deck all serialise against the SAME lock — writes to
 // different slides of the same deck can never clobber each other.
@@ -165,17 +173,20 @@ export default defineAction({
     }),
   },
   http: false,
-  run: async ({
-    deckId,
-    content,
-    slideId,
-    layout,
-    notes,
-    position,
-    contextPackId,
-    contextModeOverride,
-    reuseLabels,
-  }) =>
+  run: async (
+    {
+      deckId,
+      content,
+      slideId,
+      layout,
+      notes,
+      position,
+      contextPackId,
+      contextModeOverride,
+      reuseLabels,
+    },
+    ctx,
+  ) =>
     withDeckLock(deckId, async () => {
       await assertAccess("deck", deckId, "editor");
       const db = getDb();
@@ -312,7 +323,7 @@ export default defineAction({
       const shouldRepairTitle = slides.length === 0;
       slides.splice(insertIndex, 0, newSlide);
 
-      const now = new Date().toISOString();
+      const now = nextDeckRevision(row.updatedAt);
       deck.slides = slides;
       deck.updatedAt = now;
       const currentTitle =
@@ -332,24 +343,33 @@ export default defineAction({
               reuseLabels: mergedReuseLabels,
             };
 
-      await createDeckVersionSnapshot(
-        {
-          id: row.id,
-          title: row.title,
-          data: row.data,
-          ownerEmail: row.ownerEmail,
-        },
-        { label: "Before adding slide" },
-      );
       await db.transaction(async (tx: any) => {
-        await tx
+        await createDeckVersionSnapshot(
+          {
+            id: row.id,
+            title: row.title,
+            data: row.data,
+            ownerEmail: row.ownerEmail,
+          },
+          {
+            force:
+              ctx?.caller === "tool" ||
+              ctx?.caller === "mcp" ||
+              ctx?.caller === "a2a",
+            chatContext: deckVersionChatContextFromAction(ctx),
+            label: "Before adding slide",
+            db: tx,
+          },
+        );
+        const updateResult = await tx
           .update(schema.decks)
           .set({
             ...(repairedTitle ? { title: repairedTitle } : {}),
             data: JSON.stringify(deck),
             updatedAt: now,
           })
-          .where(eq(schema.decks.id, deckId));
+          .where(deckRevisionWhere(schema.decks, deckId, row.updatedAt));
+        assertDeckWriteApplied(updateResult, deckId, "slide addition");
         await recordGenerationCreativeContext(
           {
             appId: "slides",

package/corpus/templates/slides/actions/clone-context-slide.ts

@@ -29,6 +29,11 @@ import { getDb, schema } from "../server/db/index.js";
 import { notifyClients } from "../server/handlers/decks.js";
 import { createDeckVersionSnapshot } from "../server/lib/deck-versions.js";
 import { getDeckUrl } from "./_app-url.js";
+import {
+  assertDeckWriteApplied,
+  deckRevisionWhere,
+  nextDeckRevision,
+} from "./_deck-write.js";
 import { withDeckLock } from "./patch-deck.js";
 
 export function cloneableNativeSlide(context: ContextDetail): {
@@ -158,7 +163,7 @@ export default defineAction({
           ? slides.length
           : Math.max(0, Math.min(position, slides.length));
       slides.splice(insertAt, 0, clonedSlide);
-      const now = new Date().toISOString();
+      const now = nextDeckRevision(row.updatedAt);
       const existingContext =
         deck.creativeContext &&
         typeof deck.creativeContext === "object" &&
@@ -237,20 +242,25 @@ export default defineAction({
         })),
       );
 
-      await createDeckVersionSnapshot(
-        {
-          id: row.id,
-          title: row.title,
-          data: row.data,
-          ownerEmail: row.ownerEmail,
-        },
-        { label: "Before cloning Creative Context slide" },
-      );
       await db.transaction(async (tx: any) => {
-        await tx
+        await createDeckVersionSnapshot(
+          {
+            id: row.id,
+            title: row.title,
+            data: row.data,
+            ownerEmail: row.ownerEmail,
+          },
+          { label: "Before cloning Creative Context slide", db: tx },
+        );
+        const updateResult = await tx
           .update(schema.decks)
           .set({ data: JSON.stringify(deck), updatedAt: now })
-          .where(eq(schema.decks.id, deckId));
+          .where(deckRevisionWhere(schema.decks, deckId, row.updatedAt));
+        assertDeckWriteApplied(
+          updateResult,
+          deckId,
+          "Creative Context slide clone",
+        );
         await recordGenerationCreativeContext(
           {
             appId: "slides",

package/corpus/templates/slides/actions/create-deck.ts

@@ -29,6 +29,11 @@ import {
   rebindCreativeContextSlideLabels,
 } from "../shared/slide-ids.js";
 import { getDeckUrl } from "./_app-url.js";
+import {
+  assertDeckWriteApplied,
+  deckRevisionWhere,
+  nextDeckRevision,
+} from "./_deck-write.js";
 
 const ReuseLabelSchema = z
   .object({
@@ -253,37 +258,47 @@ export default defineAction({
         repairGeneratedDeckTitle(title, firstSlideContent, existing[0].title) ??
         resolvedTitle;
       assertHumanReadableDeckTitle(existingDeckTitle);
-      await createDeckVersionSnapshot(
-        {
-          id: existing[0].id,
-          title: existing[0].title,
-          data: existing[0].data,
-          ownerEmail: existing[0].ownerEmail,
-        },
-        { force: true, label: "Before bulk replace" },
-      );
-      const prevData = existing[0] ? JSON.parse(existing[0].data) : {};
+      const writeNow = nextDeckRevision(existing[0].updatedAt);
+      const prevData = JSON.parse(existing[0].data);
       const data = {
         title: existingDeckTitle,
         slides,
-        updatedAt: now,
+        updatedAt: writeNow,
         aspectRatio: aspectRatio ?? prevData.aspectRatio,
         designSystemId: designSystemId ?? prevData.designSystemId,
         creativeContext: creativeContextProvenance,
       };
-      await db
-        .update(schema.decks)
-        .set({
-          title: existingDeckTitle,
-          data: JSON.stringify(data),
-          designSystemId: designSystemId ?? existing[0]?.designSystemId ?? null,
-          updatedAt: now,
-        })
-        .where(eq(schema.decks.id, deckId));
+      await db.transaction(async (tx: any) => {
+        await createDeckVersionSnapshot(
+          {
+            id: existing[0].id,
+            title: existing[0].title,
+            data: existing[0].data,
+            ownerEmail: existing[0].ownerEmail,
+          },
+          { force: true, label: "Before bulk replace", db: tx },
+        );
+        const updateResult = await tx
+          .update(schema.decks)
+          .set({
+            title: existingDeckTitle,
+            data: JSON.stringify(data),
+            designSystemId:
+              designSystemId ?? existing[0].designSystemId ?? null,
+            updatedAt: writeNow,
+          })
+          .where(
+            deckRevisionWhere(schema.decks, deckId, existing[0].updatedAt),
+          );
+        assertDeckWriteApplied(updateResult, deckId, "deck replacement");
+      });
       // Broadcast to open editors (in-process SSE) + application-state
       // refresh signal (cross-process polling fallback for serverless).
       notifyClients(deckId);
-      await writeAppState("refresh-signal", { ts: now, source: "create-deck" });
+      await writeAppState("refresh-signal", {
+        ts: writeNow,
+        source: "create-deck",
+      });
       await recordGenerationCreativeContext({
         appId: "slides",
         artifactType: "deck",

package/corpus/templates/slides/actions/delete-design-system.ts

@@ -9,6 +9,11 @@ import { and, desc, eq, isNull } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import {
+  assertDeckWriteApplied,
+  deckRevisionWhere,
+  nextDeckRevision,
+} from "./_deck-write.js";
 import { withDeckLock } from "./patch-deck.js";
 
 function canEditDeckRole(role: "owner" | ShareRole) {
@@ -40,6 +45,7 @@ function unlinkDeck(
       .select({
         designSystemId: schema.decks.designSystemId,
         data: schema.decks.data,
+        updatedAt: schema.decks.updatedAt,
       })
       .from(schema.decks)
       .where(eq(schema.decks.id, deckId));
@@ -49,14 +55,15 @@ function unlinkDeck(
 
     const data = JSON.parse(deck.data);
     if ("designSystemId" in data) delete data.designSystemId;
-    await db
+    const updateResult = await db
       .update(schema.decks)
       .set({
         designSystemId: null,
         data: JSON.stringify(data),
-        updatedAt: new Date().toISOString(),
+        updatedAt: nextDeckRevision(deck.updatedAt),
       })
-      .where(eq(schema.decks.id, deckId));
+      .where(deckRevisionWhere(schema.decks, deckId, deck.updatedAt));
+    assertDeckWriteApplied(updateResult, deckId, "design-system unlink");
     return { deckId, status: "unlinked" };
   });
 }