amalgm 0.1.161 → 0.1.162

package/runtime/scripts/amalgm-mcp/tests/workspace-reconcile.test.js

@@ -0,0 +1,264 @@
+'use strict';
+
+// The workspace rule under test: every writer — human, agent, or remote
+// machine — writes into the same working tree, and no writer's work is
+// ever silently lost. Non-overlapping changes coexist; overlapping
+// changes preserve both and surface a named conflict; commits travel as
+// card-controlled transitions; nothing overwrites another writer.
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFile } = require('child_process');
+const { promisify } = require('util');
+
+const execFileAsync = promisify(execFile);
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-reconcile-test-'));
+process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
+process.env.AMALGM_WORKSPACES_DIR = path.join(process.env.AMALGM_DIR, 'workspaces');
+process.env.AMALGM_COMPUTER_ID = 'machine-fly';
+process.env.AMALGM_DEVICE_ID = 'device-machine-fly';
+
+fs.mkdirSync(process.env.AMALGM_DIR, { recursive: true });
+fs.writeFileSync(
+  path.join(process.env.AMALGM_DIR, 'computer.json'),
+  JSON.stringify({ computer_id: 'machine-fly', user_id: '11111111-1111-4111-8111-111111111111' }),
+);
+const legacyLedgerDir = path.join(process.env.AMALGM_DIR, 'state', 'workspace-follow');
+const migratedRecord = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+fs.mkdirSync(legacyLedgerDir, { recursive: true });
+fs.writeFileSync(
+  path.join(legacyLedgerDir, `${migratedRecord}.json`),
+  JSON.stringify({ peerMachine: 'retained-peer', repoKey: 'retained-repo' }),
+);
+
+const { closeLocalDb } = require('../state/db');
+const { captureWorktreeDiff, headOid } = require('../workspace/git');
+const { CHECKPOINT_CONTRACT, revisionOf } = require('../workspace/checkpoint');
+const { listPairStates } = require('../workspace/ledger');
+const { reconciliationStats, reconcilePair } = require('../workspace/reconcile');
+
+test.after(() => {
+  closeLocalDb();
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+});
+
+async function run(cwd, ...args) {
+  const { stdout } = await execFileAsync(
+    'git',
+    ['-c', 'user.email=test@amalgm.test', '-c', 'user.name=Amalgm Test', '-c', 'commit.gpgsign=false', ...args],
+    { cwd, env: { ...process.env, GIT_TERMINAL_PROMPT: '0', LC_ALL: 'C' } },
+  );
+  return stdout;
+}
+
+const REMOTE = 'https://github.com/amalgm-test/app';
+const TEN_LINES = Array.from({ length: 10 }, (_, i) => `line ${i + 1}`).join('\n');
+
+/** origin bare + an author clone (the peer) + a receiver clone (local). */
+async function makeRig(name) {
+  const origin = path.join(tempRoot, `${name}-origin.git`);
+  await run(tempRoot, 'init', '--bare', '-b', 'main', origin);
+  const author = path.join(tempRoot, `${name}-author`);
+  await run(tempRoot, 'clone', '-q', origin, author);
+  fs.writeFileSync(path.join(author, 'app.js'), 'v1\n');
+  fs.writeFileSync(path.join(author, 'doc.md'), `${TEN_LINES}\n`);
+  await run(author, 'add', '.');
+  await run(author, 'commit', '-m', 'c1');
+  await run(author, 'push', '-q', 'origin', 'main');
+  const receiver = path.join(tempRoot, `${name}-receiver`);
+  await run(tempRoot, 'clone', '-q', origin, receiver);
+  return { origin, author, receiver };
+}
+
+function cardFor(worktree, oid, { dirty = false, branch = 'main' } = {}) {
+  return {
+    path: worktree,
+    kind: 'primary',
+    health: 'healthy',
+    operation: 'none',
+    head: { branch, oid, detached: false },
+    repo: { remote: REMOTE, rootCommit: 'root' },
+    dirty: {
+      staged: 0, unstaged: dirty ? 1 : 0, untracked: 0, conflicted: 0, submodulesChanged: 0,
+    },
+  };
+}
+
+async function checkpointFor(worktree, machine) {
+  const captured = await captureWorktreeDiff(worktree);
+  return {
+    checkpoint: CHECKPOINT_CONTRACT,
+    machine,
+    repoKey: REMOTE,
+    branch: 'main',
+    baseOid: captured.baseOid,
+    revision: captured.diff === '' ? null : revisionOf(captured.baseOid, captured.diff),
+    diff: captured.diff,
+    capturedAt: new Date().toISOString(),
+  };
+}
+
+async function reconcile(rig, digest, { receiverDirty = true, peerDirty } = {}) {
+  const oidLocal = await headOid(rig.receiver);
+  const oidPeer = await headOid(rig.author);
+  const entry = await checkpointFor(rig.author, 'machine-mac');
+  return reconcilePair(
+    cardFor(rig.receiver, oidLocal, { dirty: receiverDirty }),
+    cardFor(rig.author, oidPeer, { dirty: peerDirty ?? entry.revision !== null }),
+    entry,
+    digest,
+  );
+}
+
+test('reconciliation exposes no per-machine enable or direction state', () => {
+  const stats = reconciliationStats();
+  assert.equal(Object.hasOwn(stats, 'enabled'), false);
+  assert.equal(Object.hasOwn(stats, 'direction'), false);
+});
+
+test('the renamed reconciliation ledger preserves existing pair ownership', () => {
+  const states = listPairStates();
+  assert.equal(states.some((state) => state.peerMachine === 'retained-peer'), true);
+  assert.equal(fs.existsSync(legacyLedgerDir), false);
+  assert.equal(
+    fs.existsSync(path.join(process.env.AMALGM_DIR, 'state', 'workspace-reconciliation', `${migratedRecord}.json`)),
+    true,
+  );
+});
+
+test('two writers in different files coexist, and a peer going clean removes only peer content', async () => {
+  const rig = await makeRig('coexist');
+
+  // Local work first — then the peer's edit arrives around it.
+  fs.writeFileSync(path.join(rig.receiver, 'local.md'), 'receiver work\n');
+  fs.appendFileSync(path.join(rig.author, 'app.js'), 'peer edit\n');
+
+  const applied = await reconcile(rig, 'pair-coexist');
+  assert.equal(applied.state, 'applied');
+  assert.equal(applied.reason, 'coexisting-with-local-work');
+  assert.equal(fs.readFileSync(path.join(rig.receiver, 'app.js'), 'utf8'), 'v1\npeer edit\n');
+  assert.equal(fs.readFileSync(path.join(rig.receiver, 'local.md'), 'utf8'), 'receiver work\n');
+
+  // The peer reverts: exactly their contribution leaves, local work stays.
+  fs.writeFileSync(path.join(rig.author, 'app.js'), 'v1\n');
+  const restored = await reconcile(rig, 'pair-coexist');
+  assert.equal(restored.state, 'local-work');
+  assert.equal(restored.reason, 'peer-clean');
+  assert.equal(fs.readFileSync(path.join(rig.receiver, 'app.js'), 'utf8'), 'v1\n');
+  assert.equal(fs.readFileSync(path.join(rig.receiver, 'local.md'), 'utf8'), 'receiver work\n');
+});
+
+test('two writers in the same file, different regions, merge into one combined file', async () => {
+  const rig = await makeRig('regions');
+
+  const docPath = path.join(rig.receiver, 'doc.md');
+  fs.writeFileSync(docPath, `${TEN_LINES}\n`.replace('line 1', 'line 1 (local)'));
+  fs.writeFileSync(path.join(rig.author, 'doc.md'), `${TEN_LINES}\n`.replace('line 10', 'line 10 (peer)'));
+
+  const outcome = await reconcile(rig, 'pair-regions');
+  assert.equal(outcome.state, 'applied');
+  const merged = fs.readFileSync(docPath, 'utf8');
+  assert.ok(merged.includes('line 1 (local)'), 'local region survives');
+  assert.ok(merged.includes('line 10 (peer)'), 'peer region arrives');
+});
+
+test('same region: both versions preserved, a named conflict surfaces, and resolution clears it', async () => {
+  const rig = await makeRig('overlap');
+
+  const appPath = path.join(rig.receiver, 'app.js');
+  fs.writeFileSync(appPath, 'local v2\n');
+  fs.writeFileSync(path.join(rig.author, 'app.js'), 'peer v2\n');
+
+  const conflicted = await reconcile(rig, 'pair-overlap');
+  assert.equal(conflicted.state, 'conflict');
+  assert.equal(conflicted.conflicts[0].path, 'app.js');
+  assert.equal(conflicted.conflicts[0].kind, 'content-overlap');
+  assert.equal(fs.readFileSync(appPath, 'utf8'), 'local v2\n', 'local version never overwritten');
+
+  // Unchanged inputs → the standing conflict is reported, not re-fought.
+  const standing = await reconcile(rig, 'pair-overlap');
+  assert.equal(standing.state, 'conflict');
+  assert.equal(fs.readFileSync(appPath, 'utf8'), 'local v2\n');
+
+  // The human resolves by adopting the peer's version → folds cleanly.
+  fs.writeFileSync(appPath, 'peer v2\n');
+  const resolved = await reconcile(rig, 'pair-overlap');
+  assert.equal(resolved.state, 'applied');
+});
+
+test('a peer deletion never removes a file the local writer edited', async () => {
+  const rig = await makeRig('delete');
+
+  fs.writeFileSync(path.join(rig.receiver, 'app.js'), 'precious local edit\n');
+  fs.rmSync(path.join(rig.author, 'app.js'));
+
+  const outcome = await reconcile(rig, 'pair-delete');
+  assert.equal(outcome.state, 'conflict');
+  assert.equal(outcome.conflicts[0].kind, 'delete-vs-edit');
+  assert.equal(fs.readFileSync(path.join(rig.receiver, 'app.js'), 'utf8'), 'precious local edit\n');
+});
+
+test('an echoed change — already present locally — folds as a no-op instead of looping', async () => {
+  const rig = await makeRig('echo');
+
+  fs.writeFileSync(path.join(rig.receiver, 'app.js'), 'shared edit\n');
+  fs.writeFileSync(path.join(rig.author, 'app.js'), 'shared edit\n');
+
+  const outcome = await reconcile(rig, 'pair-echo');
+  assert.equal(outcome.state, 'applied');
+  assert.equal(fs.readFileSync(path.join(rig.receiver, 'app.js'), 'utf8'), 'shared edit\n');
+});
+
+test('when the peer commits held work, the fast-forward absorbs it and local work rides along', async () => {
+  const rig = await makeRig('absorb');
+
+  // Coexisting first: peer content held, local work alongside.
+  fs.writeFileSync(path.join(rig.receiver, 'local.md'), 'receiver work\n');
+  fs.appendFileSync(path.join(rig.author, 'app.js'), 'peer edit\n');
+  assert.equal((await reconcile(rig, 'pair-absorb')).state, 'applied');
+
+  // The peer commits exactly what we hold and pushes.
+  await run(rig.author, 'commit', '-am', 'c2');
+  await run(rig.author, 'push', '-q', 'origin', 'main');
+  const c2 = await headOid(rig.author);
+
+  // Converge: at most a restore pass, then the forward, then settled.
+  let outcome;
+  for (let pass = 0; pass < 3; pass += 1) {
+    outcome = await reconcile(rig, 'pair-absorb', { peerDirty: false });
+    if (outcome.state === 'forwarded') break;
+    assert.equal(outcome.state, 'restoring', `unexpected state ${outcome.state}`);
+  }
+  assert.equal(outcome.state, 'forwarded');
+  assert.equal(await headOid(rig.receiver), c2);
+  assert.equal(fs.readFileSync(path.join(rig.receiver, 'app.js'), 'utf8'), 'v1\npeer edit\n');
+  assert.equal(fs.readFileSync(path.join(rig.receiver, 'local.md'), 'utf8'), 'receiver work\n');
+
+  const settled = await reconcile(rig, 'pair-absorb', { peerDirty: false });
+  assert.equal(settled.state, 'local-work');
+});
+
+test('a peer behind us never moves the tree back, and diverged histories never move at all', async () => {
+  const rig = await makeRig('history');
+  const c1 = await headOid(rig.receiver);
+
+  // Receiver commits ahead locally; the stale peer is simply behind.
+  fs.appendFileSync(path.join(rig.receiver, 'app.js'), 'local commit\n');
+  await run(rig.receiver, 'commit', '-am', 'local c2');
+  const behind = await reconcile(rig, 'pair-history', { receiverDirty: false });
+  assert.equal(behind.state, 'peer-behind');
+
+  // The peer commits its own line off c1: genuine divergence, no movement.
+  fs.appendFileSync(path.join(rig.author, 'app.js'), 'peer commit\n');
+  await run(rig.author, 'commit', '-am', 'peer c2');
+  await run(rig.author, 'push', '-q', 'origin', 'main');
+  const localHead = await headOid(rig.receiver);
+  const diverged = await reconcile(rig, 'pair-history', { receiverDirty: false });
+  assert.equal(diverged.state, 'diverged');
+  assert.equal(await headOid(rig.receiver), localHead, 'divergence never moves the tree');
+  assert.equal(c1 === localHead, false);
+});

package/runtime/scripts/amalgm-mcp/tests/workspace-tree-cloud.test.js

@@ -0,0 +1,155 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-workspace-tree-cloud-test-'));
+process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
+process.env.AMALGM_WORKSPACES_DIR = path.join(tempRoot, 'workspaces');
+process.env.AMALGM_COMPUTER_ID = 'computer-tree-cloud-test';
+process.env.AMALGM_DEVICE_ID = 'device-tree-cloud-test';
+fs.mkdirSync(process.env.AMALGM_DIR, { recursive: true });
+fs.mkdirSync(process.env.AMALGM_WORKSPACES_DIR, { recursive: true });
+const localUserId = '11111111-1111-4111-8111-111111111111';
+fs.writeFileSync(path.join(process.env.AMALGM_DIR, 'computer.json'), JSON.stringify({ user_id: localUserId }));
+
+const { closeLocalDb, openLocalDb } = require('../state/db');
+const {
+  applyCloudTreeMutation,
+  installCloudTreeSnapshot,
+  nodeForPath,
+} = require('../workspace/tree-store');
+const { enqueueWorkspaceContentAttachments } = require('../workspace/tree-cloud');
+const { uuidV7 } = require('../workspace/tree/identity');
+
+test.after(() => {
+  closeLocalDb();
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+});
+
+test('a recipient installs a workspace snapshot with its real role and applies UUID-addressed renames', () => {
+  const workspaceId = uuidV7();
+  const folderId = uuidV7();
+  const fileId = uuidV7();
+  const now = new Date().toISOString();
+  const snapshot = {
+    schemaVersion: 1,
+    workspaceId,
+    version: 0,
+    nodes: [
+      { id: fileId, workspaceId, parentId: folderId, kind: 'file', name: 'a.txt', createdAt: now, updatedAt: now },
+      { id: workspaceId, workspaceId, parentId: null, kind: 'folder', name: 'Shared workspace', createdAt: now, updatedAt: now },
+      { id: folderId, workspaceId, parentId: workspaceId, kind: 'folder', name: 'docs', createdAt: now, updatedAt: now },
+    ],
+  };
+  const bytes = Buffer.from(JSON.stringify(snapshot));
+  const target = path.join(process.env.AMALGM_WORKSPACES_DIR, 'recipient');
+  fs.mkdirSync(target);
+
+  const installed = installCloudTreeSnapshot(target, {
+    resourceId: workspaceId,
+    contract: 'workspace-tree@1',
+    schemaVersion: 1,
+    authorityEpoch: 7,
+    headVersion: 0,
+    snapshotVersion: 0,
+    snapshotChecksum: crypto.createHash('sha256').update(bytes).digest('hex'),
+    snapshotBase64: bytes.toString('base64'),
+    role: 'viewer',
+  });
+  assert.equal(installed.replica.resourceId, workspaceId);
+  assert.equal(fs.existsSync(path.join(target, 'docs', 'a.txt')), true);
+  assert.equal(nodeForPath(path.join(target, 'docs', 'a.txt')).node.id, fileId);
+  const permission = openLocalDb().prepare(`
+    SELECT role FROM workspace_node_permissions WHERE node_id = ? AND user_id = ? AND revoked_at IS NULL
+  `).get(workspaceId, localUserId);
+  assert.equal(permission.role, 'viewer');
+  const discovered = enqueueWorkspaceContentAttachments(workspaceId, [
+    { node_id: fileId, contract: 'text-yjs@1' },
+  ]);
+  assert.equal(discovered.length, 1);
+  assert.equal(discovered[0].resourceId, fileId);
+  assert.deepEqual(enqueueWorkspaceContentAttachments(workspaceId, [
+    { node_id: fileId, contract: 'text-yjs@1' },
+  ]), []);
+
+  applyCloudTreeMutation({
+    envelope: {
+      resourceId: workspaceId,
+      authorityEpoch: 7,
+      mutationId: 'mut_cloud_tree_0001',
+      deviceId: 'other-machine',
+      baseVersion: 0,
+      contract: 'workspace-tree@1',
+      schemaVersion: 1,
+      operationKind: 'tree.rename',
+      operation: { kind: 'tree.rename', workspaceId, nodeId: folderId, name: 'notes', changedAt: now },
+    },
+    version: 1,
+    committedAt: now,
+  });
+  assert.equal(fs.existsSync(path.join(target, 'notes', 'a.txt')), true);
+  assert.equal(nodeForPath(path.join(target, 'notes', 'a.txt')).node.id, fileId);
+
+  const nextFolderId = uuidV7();
+  const projected = {
+    schemaVersion: 1,
+    workspaceId,
+    version: 2,
+    nodes: [
+      { id: workspaceId, workspaceId, parentId: null, kind: 'folder', name: 'Shared workspace', createdAt: now, updatedAt: now },
+      { id: nextFolderId, workspaceId, parentId: workspaceId, kind: 'folder', name: 'allowed', createdAt: now, updatedAt: now },
+      { id: fileId, workspaceId, parentId: nextFolderId, kind: 'file', name: 'a.txt', createdAt: now, updatedAt: now },
+    ],
+  };
+  const projectedBytes = Buffer.from(JSON.stringify(projected));
+  installCloudTreeSnapshot(target, {
+    resourceId: workspaceId,
+    contract: 'workspace-tree@1',
+    schemaVersion: 1,
+    authorityEpoch: 8,
+    headVersion: 2,
+    snapshotVersion: 2,
+    snapshotChecksum: crypto.createHash('sha256').update(projectedBytes).digest('hex'),
+    snapshotBase64: projectedBytes.toString('base64'),
+    role: 'editor',
+    permissions: [{ node_id: nextFolderId, role: 'editor' }],
+  });
+  assert.equal(fs.existsSync(path.join(target, 'notes')), false);
+  assert.equal(fs.existsSync(path.join(target, 'allowed', 'a.txt')), true);
+  assert.equal(nodeForPath(path.join(target, 'allowed', 'a.txt')).node.id, fileId);
+  const rootPermission = openLocalDb().prepare(`
+    SELECT role FROM workspace_node_permissions WHERE node_id = ? AND user_id = ? AND revoked_at IS NULL
+  `).get(workspaceId, localUserId);
+  const childPermission = openLocalDb().prepare(`
+    SELECT role FROM workspace_node_permissions WHERE node_id = ? AND user_id = ? AND revoked_at IS NULL
+  `).get(nextFolderId, localUserId);
+  assert.equal(rootPermission, undefined);
+  assert.equal(childPermission.role, 'editor');
+
+  const conflictPath = path.join(target, 'allowed', 'already-here.txt');
+  fs.writeFileSync(conflictPath, 'preserve these bytes\n');
+  assert.throws(() => applyCloudTreeMutation({
+    envelope: {
+      resourceId: workspaceId,
+      authorityEpoch: 8,
+      mutationId: 'mut_cloud_tree_0002',
+      deviceId: 'other-machine',
+      baseVersion: 2,
+      contract: 'workspace-tree@1',
+      schemaVersion: 1,
+      operationKind: 'tree.create',
+      operation: {
+        kind: 'tree.create', workspaceId, nodeId: uuidV7(), parentId: nextFolderId,
+        nodeKind: 'file', name: 'already-here.txt', createdAt: now, changedAt: now,
+      },
+    },
+    version: 3,
+    committedAt: now,
+  }), /destination already exists/);
+  assert.equal(fs.readFileSync(conflictPath, 'utf8'), 'preserve these bytes\n');
+});

package/runtime/scripts/amalgm-mcp/tests/workspace-tree-core.test.js

@@ -0,0 +1,114 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const { can, resolveEffectiveRole } = require('../workspace/tree/access');
+const { isUuidV7, uuidV7, uuidV7Timestamp } = require('../workspace/tree/identity');
+const { applyTreeOperation } = require('../workspace/tree/reducer');
+
+test('UUIDv7 identity is standard, timestamped, and independent of path', () => {
+  const now = 1_782_000_123_456;
+  const id = uuidV7(now, () => Buffer.alloc(16, 0xab));
+  assert.equal(isUuidV7(id), true);
+  assert.equal(uuidV7Timestamp(id), now);
+  assert.equal(id[14], '7');
+  assert.match(id[19], /[89ab]/);
+});
+
+test('the closest explicit permission wins and no_access fails closed', () => {
+  const parents = new Map([
+    ['workspace', null],
+    ['folder', 'workspace'],
+    ['file', 'folder'],
+  ]);
+  assert.equal(resolveEffectiveRole('file', parents, new Map([['workspace', 'viewer']])), 'viewer');
+  assert.equal(resolveEffectiveRole('file', parents, new Map([
+    ['workspace', 'viewer'],
+    ['folder', 'editor'],
+  ])), 'editor');
+  assert.equal(resolveEffectiveRole('file', parents, new Map([
+    ['workspace', 'owner'],
+    ['file', 'no_access'],
+  ])), 'no_access');
+  assert.equal(can('editor', 'trash'), true);
+  assert.equal(can('editor', 'purge'), false);
+  assert.equal(can('owner', 'purge'), true);
+});
+
+test('tree operations preserve identity across rename and reject cycles', () => {
+  const workspaceId = uuidV7();
+  const folderId = uuidV7();
+  const fileId = uuidV7();
+  let nodes = new Map([[
+    workspaceId,
+    {
+      id: workspaceId,
+      workspaceId,
+      parentId: null,
+      kind: 'folder',
+      name: 'Workspace',
+      trashedAt: null,
+      purgedAt: null,
+      createdAt: new Date().toISOString(),
+      updatedAt: new Date().toISOString(),
+    },
+  ]]);
+  nodes = applyTreeOperation(nodes, {
+    kind: 'tree.create', workspaceId, nodeId: folderId, parentId: workspaceId, nodeKind: 'folder', name: 'src',
+  });
+  nodes = applyTreeOperation(nodes, {
+    kind: 'tree.create', workspaceId, nodeId: fileId, parentId: folderId, nodeKind: 'file', name: 'index.js',
+  });
+  nodes = applyTreeOperation(nodes, {
+    kind: 'tree.rename', workspaceId, nodeId: fileId, name: 'main.js',
+  });
+  assert.equal(nodes.get(fileId).id, fileId);
+  assert.equal(nodes.get(fileId).name, 'main.js');
+  assert.throws(() => applyTreeOperation(nodes, {
+    kind: 'tree.move', workspaceId, nodeId: folderId, parentId: fileId,
+  }), /destination folder does not exist|inside itself/);
+});
+
+test('trash cascades preserve independently trashed children', () => {
+  const workspaceId = uuidV7();
+  const folderId = uuidV7();
+  const fileId = uuidV7();
+  const createdAt = '2026-07-21T00:00:00.000Z';
+  let nodes = new Map([[
+    workspaceId,
+    {
+      id: workspaceId,
+      workspaceId,
+      parentId: null,
+      kind: 'folder',
+      name: 'Workspace',
+      trashedAt: null,
+      purgedAt: null,
+      createdAt,
+      updatedAt: createdAt,
+    },
+  ]]);
+  nodes = applyTreeOperation(nodes, {
+    kind: 'tree.create', workspaceId, nodeId: folderId, parentId: workspaceId, nodeKind: 'folder', name: 'folder', createdAt,
+  });
+  nodes = applyTreeOperation(nodes, {
+    kind: 'tree.create', workspaceId, nodeId: fileId, parentId: folderId, nodeKind: 'file', name: 'note.md', createdAt,
+  });
+  nodes = applyTreeOperation(nodes, {
+    kind: 'tree.trash', workspaceId, nodeId: fileId, trashedAt: '2026-07-21T00:01:00.000Z',
+  });
+  nodes = applyTreeOperation(nodes, {
+    kind: 'tree.trash', workspaceId, nodeId: folderId, trashedAt: '2026-07-21T00:02:00.000Z',
+  });
+  assert.equal(nodes.get(fileId).trashedAt, '2026-07-21T00:01:00.000Z');
+
+  nodes = applyTreeOperation(nodes, {
+    kind: 'tree.restore', workspaceId, nodeId: folderId,
+  });
+  assert.equal(nodes.get(folderId).trashedAt, null);
+  assert.equal(nodes.get(fileId).trashedAt, '2026-07-21T00:01:00.000Z');
+  assert.throws(() => applyTreeOperation(nodes, {
+    kind: 'tree.restore', workspaceId, nodeId: folderId,
+  }), /must be trashed/);
+});