@swarmclawai/swarmclaw 0.2.0

package/src/lib/schedule-dedupe.ts

@@ -0,0 +1,174 @@
+import type { ScheduleType } from '@/types'
+
+export type ScheduleLike = {
+  id?: string
+  name?: string | null
+  agentId?: string | null
+  taskPrompt?: string | null
+  scheduleType?: ScheduleType | string | null
+  cron?: string | null
+  intervalMs?: number | null
+  runAt?: number | null
+  status?: string | null
+  updatedAt?: number | null
+  createdAt?: number | null
+  createdByAgentId?: string | null
+  createdInSessionId?: string | null
+}
+
+export interface ScheduleDuplicateCandidate {
+  id?: string | null
+  agentId?: string | null
+  taskPrompt?: string | null
+  scheduleType?: ScheduleType | string | null
+  cron?: string | null
+  intervalMs?: number | null
+  runAt?: number | null
+  createdByAgentId?: string | null
+  createdInSessionId?: string | null
+}
+
+export interface FindDuplicateScheduleOptions {
+  ignoreId?: string | null
+  includeStatuses?: string[]
+  creatorScope?: {
+    agentId?: string | null
+    sessionId?: string | null
+  } | null
+}
+
+interface ScheduleSignature {
+  id: string
+  agentId: string
+  taskPrompt: string
+  scheduleType: ScheduleType
+  cron: string
+  intervalMs: number | null
+  runAt: number | null
+}
+
+function normalizeString(value: unknown): string {
+  return typeof value === 'string' ? value.trim() : ''
+}
+
+function normalizePrompt(value: unknown): string {
+  const text = normalizeString(value)
+  if (!text) return ''
+  return text.replace(/\s+/g, ' ').trim().toLowerCase()
+}
+
+function normalizeCron(value: unknown): string {
+  const cron = normalizeString(value)
+  if (!cron) return ''
+  return cron.replace(/\s+/g, ' ').trim()
+}
+
+function normalizePositiveInt(value: unknown): number | null {
+  const parsed = typeof value === 'number'
+    ? value
+    : typeof value === 'string'
+      ? Number.parseInt(value, 10)
+      : Number.NaN
+  if (!Number.isFinite(parsed)) return null
+  const intVal = Math.trunc(parsed)
+  return intVal > 0 ? intVal : null
+}
+
+function normalizeScheduleType(value: unknown): ScheduleType {
+  if (value === 'cron' || value === 'once' || value === 'interval') return value
+  return 'interval'
+}
+
+function toSignature(raw: ScheduleLike | ScheduleDuplicateCandidate): ScheduleSignature {
+  return {
+    id: normalizeString(raw.id),
+    agentId: normalizeString(raw.agentId),
+    taskPrompt: normalizePrompt(raw.taskPrompt),
+    scheduleType: normalizeScheduleType(raw.scheduleType),
+    cron: normalizeCron(raw.cron),
+    intervalMs: normalizePositiveInt(raw.intervalMs),
+    runAt: normalizePositiveInt(raw.runAt),
+  }
+}
+
+function cadenceKey(signature: ScheduleSignature): string {
+  if (signature.scheduleType === 'cron') return `cron:${signature.cron || ''}`
+  if (signature.scheduleType === 'interval') return `interval:${signature.intervalMs ?? ''}`
+  if (signature.scheduleType === 'once') return `once:${signature.runAt ?? ''}`
+  return signature.scheduleType
+}
+
+export function getScheduleSignatureKey(input: ScheduleLike | ScheduleDuplicateCandidate): string {
+  const signature = toSignature(input)
+  if (!signature.agentId || !signature.taskPrompt) return ''
+  if (!sameCadence(signature, signature)) return ''
+  return `${signature.agentId}::${signature.taskPrompt}::${signature.scheduleType}::${cadenceKey(signature)}`
+}
+
+function sameCadence(a: ScheduleSignature, b: ScheduleSignature): boolean {
+  if (a.scheduleType !== b.scheduleType) return false
+  if (a.scheduleType === 'cron') return a.cron !== '' && a.cron === b.cron
+  if (a.scheduleType === 'interval') return a.intervalMs != null && a.intervalMs === b.intervalMs
+  if (a.scheduleType === 'once') {
+    if (a.runAt == null || b.runAt == null) return false
+    return Math.abs(a.runAt - b.runAt) <= 1000
+  }
+  return false
+}
+
+function isEligibleStatus(status: unknown, includeStatuses: Set<string>): boolean {
+  const normalized = normalizeString(status).toLowerCase() || 'active'
+  return includeStatuses.has(normalized)
+}
+
+function matchesCreatorScope(
+  schedule: ScheduleLike,
+  scope: FindDuplicateScheduleOptions['creatorScope'],
+): boolean {
+  if (!scope) return true
+  const scopeAgent = normalizeString(scope.agentId)
+  const scopeSession = normalizeString(scope.sessionId)
+  if (!scopeAgent && !scopeSession) return true
+
+  const existingAgent = normalizeString(schedule.createdByAgentId)
+  const existingSession = normalizeString(schedule.createdInSessionId)
+
+  if (scopeAgent && existingAgent && scopeAgent !== existingAgent) return false
+  if (scopeSession && existingSession && scopeSession !== existingSession) return false
+  return true
+}
+
+function compareUpdatedDesc(a: ScheduleLike, b: ScheduleLike): number {
+  const aTs = typeof a.updatedAt === 'number' ? a.updatedAt : (typeof a.createdAt === 'number' ? a.createdAt : 0)
+  const bTs = typeof b.updatedAt === 'number' ? b.updatedAt : (typeof b.createdAt === 'number' ? b.createdAt : 0)
+  return bTs - aTs
+}
+
+export function findDuplicateSchedule(
+  schedules: Record<string, ScheduleLike>,
+  candidateRaw: ScheduleDuplicateCandidate,
+  opts: FindDuplicateScheduleOptions = {},
+): ScheduleLike | null {
+  const candidate = toSignature(candidateRaw)
+  if (!candidate.agentId) return null
+  if (!candidate.taskPrompt) return null
+
+  const ignoreId = normalizeString(opts.ignoreId || candidate.id)
+  const statuses = new Set((opts.includeStatuses?.length ? opts.includeStatuses : ['active', 'paused']).map((s) => s.toLowerCase()))
+
+  const matches = Object.values(schedules)
+    .filter((existing) => existing && typeof existing === 'object')
+    .filter((existing) => {
+      const signature = toSignature(existing)
+      if (!signature.id) return false
+      if (ignoreId && signature.id === ignoreId) return false
+      if (!isEligibleStatus(existing.status, statuses)) return false
+      if (!matchesCreatorScope(existing, opts.creatorScope || null)) return false
+      if (signature.agentId !== candidate.agentId) return false
+      if (signature.taskPrompt !== candidate.taskPrompt) return false
+      return sameCadence(signature, candidate)
+    })
+    .sort(compareUpdatedDesc)
+
+  return matches[0] || null
+}

package/src/lib/schedule-name.ts

@@ -0,0 +1,62 @@
+const MAX_SCHEDULE_NAME_LENGTH = 80
+
+function normalizeWhitespace(value: string): string {
+  return value.replace(/\s+/g, ' ').trim()
+}
+
+function truncate(value: string, maxLength = MAX_SCHEDULE_NAME_LENGTH): string {
+  if (value.length <= maxLength) return value
+  return `${value.slice(0, Math.max(0, maxLength - 1)).trimEnd()}...`
+}
+
+function isGenericName(name: string): boolean {
+  const normalized = normalizeWhitespace(name).toLowerCase()
+  return normalized === '' || normalized === 'schedule' || normalized === 'new schedule' || normalized === 'unnamed schedule'
+}
+
+function deriveFromPrompt(taskPrompt: string): string {
+  const prompt = normalizeWhitespace(taskPrompt)
+  if (!prompt) return 'Scheduled Task'
+
+  const lower = prompt.toLowerCase()
+  if (lower.includes('wikipedia') && (lower.includes('screenshot') || lower.includes('screen shot'))) {
+    return 'Wikipedia Screenshot'
+  }
+  if (lower.includes('screenshot')) {
+    return 'Screenshot Task'
+  }
+  if (lower.includes('backup')) {
+    return 'Backup Task'
+  }
+  if (lower.includes('health check') || lower.includes('heartbeat')) {
+    return 'Health Check'
+  }
+  if (lower.includes('report')) {
+    return 'Report Task'
+  }
+
+  const firstLine = prompt.split('\n')[0] || prompt
+  const firstClause = firstLine.split(/[.,;:!?]/)[0] || firstLine
+  const cleaned = normalizeWhitespace(
+    firstClause
+      .replace(/^(please\s+)?(can you|could you|would you)\s+/i, '')
+      .replace(/^(create|make|set up|setup|schedule|run|execute|trigger|perform|generate|send|take|capture|navigate|go|open|check|monitor|fetch|pull|build|test)\b\s*/i, '')
+      .replace(/^to\s+/i, ''),
+  )
+  if (!cleaned) return 'Scheduled Task'
+  return `${cleaned.charAt(0).toUpperCase()}${cleaned.slice(1)}`
+}
+
+export function resolveScheduleName(input: {
+  name?: unknown
+  taskPrompt?: unknown
+}): string {
+  const providedName = typeof input.name === 'string' ? normalizeWhitespace(input.name) : ''
+  if (providedName && !isGenericName(providedName)) {
+    return truncate(providedName)
+  }
+
+  const taskPrompt = typeof input.taskPrompt === 'string' ? input.taskPrompt : ''
+  return truncate(deriveFromPrompt(taskPrompt))
+}
+

package/src/lib/schedules.ts

@@ -0,0 +1,16 @@
+import { api } from './api-client'
+import type { Schedule } from '../types'
+
+export const fetchSchedules = () => api<Record<string, Schedule>>('GET', '/schedules')
+
+export const createSchedule = (data: Omit<Schedule, 'id' | 'createdAt' | 'lastRunAt' | 'nextRunAt'>) =>
+  api<Schedule>('POST', '/schedules', data)
+
+export const updateSchedule = (id: string, data: Partial<Schedule>) =>
+  api<Schedule>('PUT', `/schedules/${id}`, data)
+
+export const deleteSchedule = (id: string) =>
+  api<string>('DELETE', `/schedules/${id}`)
+
+export const runSchedule = (id: string) =>
+  api<{ ok: boolean }>('POST', `/schedules/${id}/run`)

package/src/lib/server/agent-registry.ts

@@ -0,0 +1,70 @@
+import { loadAgents, loadTasks, loadSessions } from './storage'
+import type { Agent, BoardTask } from '@/types'
+
+export interface AgentDirectoryEntry {
+  id: string
+  name: string
+  description: string
+  capabilities: string[]
+  status: 'idle' | 'working'
+  statusDetail?: string
+}
+
+export function getAgentDirectory(excludeId?: string): AgentDirectoryEntry[] {
+  const agents = loadAgents() as Record<string, Agent>
+  const tasks = loadTasks() as Record<string, BoardTask>
+  const sessions = loadSessions()
+
+  // Find running tasks per agent
+  const runningTasks = new Map<string, string>()
+  for (const task of Object.values(tasks)) {
+    if (task.status === 'running' && task.agentId) {
+      runningTasks.set(task.agentId, task.title)
+    }
+  }
+
+  // Find active sessions per agent
+  const activeSessions = new Set<string>()
+  for (const session of Object.values(sessions) as Record<string, unknown>[]) {
+    if (session.active && session.agentId) {
+      activeSessions.add(session.agentId as string)
+    }
+  }
+
+  const entries: AgentDirectoryEntry[] = []
+  for (const agent of Object.values(agents)) {
+    if (excludeId && agent.id === excludeId) continue
+
+    const runningTask = runningTasks.get(agent.id)
+    const isActive = activeSessions.has(agent.id)
+    const isWorking = !!runningTask || isActive
+
+    entries.push({
+      id: agent.id,
+      name: agent.name,
+      description: agent.description,
+      capabilities: agent.capabilities || [],
+      status: isWorking ? 'working' : 'idle',
+      statusDetail: runningTask ? `working on: ${runningTask}` : undefined,
+    })
+  }
+
+  return entries
+}
+
+export function buildAgentAwarenessBlock(excludeId: string): string {
+  const directory = getAgentDirectory(excludeId)
+  if (!directory.length) return ''
+
+  const lines = directory.map((entry) => {
+    const caps = entry.capabilities.length ? ` (${entry.capabilities.join(', ')})` : ''
+    const status = entry.statusDetail || entry.status
+    return `- **${entry.name}** [id: ${entry.id}]${caps} — ${status}`
+  })
+
+  return [
+    '## Available Agents',
+    ...lines,
+    'You can delegate tasks to any agent using the delegate_to_agent tool.',
+  ].join('\n')
+}

package/src/lib/server/api-routes.test.ts

@@ -0,0 +1,362 @@
+import { describe, it } from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+
+// ---------------------------------------------------------------------------
+// Helpers — validate request body shapes the same way the route handlers do
+// ---------------------------------------------------------------------------
+
+function validateKnowledgePost(body: unknown): { ok: true; data: { title: string; content: string; tags?: string[] } } | { ok: false; error: string } {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) {
+    return { ok: false, error: 'Invalid JSON body.' }
+  }
+  const { title, content, tags } = body as Record<string, unknown>
+  if (typeof title !== 'string' || !title.trim()) {
+    return { ok: false, error: 'title is required.' }
+  }
+  if (typeof content !== 'string') {
+    return { ok: false, error: 'content is required.' }
+  }
+  const normalizedTags = Array.isArray(tags)
+    ? (tags as unknown[]).filter((t): t is string => typeof t === 'string' && t.trim().length > 0)
+    : undefined
+  return { ok: true, data: { title: title.trim(), content, tags: normalizedTags } }
+}
+
+function validateKnowledgePut(body: unknown): { ok: true; updates: Record<string, unknown> } | { ok: false; error: string } {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) {
+    return { ok: false, error: 'Invalid JSON body.' }
+  }
+  const { title, content, tags } = body as Record<string, unknown>
+  const updates: Record<string, unknown> = {}
+  if (typeof title === 'string' && title.trim()) updates.title = title.trim()
+  if (typeof content === 'string') updates.content = content
+  if (Array.isArray(tags)) {
+    updates.tags = (tags as unknown[]).filter((t): t is string => typeof t === 'string' && t.trim().length > 0)
+  }
+  return { ok: true, updates }
+}
+
+type McpTransport = 'stdio' | 'sse' | 'streamable-http'
+
+const VALID_TRANSPORTS: McpTransport[] = ['stdio', 'sse', 'streamable-http']
+
+interface McpServerBody {
+  name: string
+  transport: McpTransport
+  command?: string
+  args?: string[]
+  url?: string
+  env?: Record<string, string>
+  headers?: Record<string, string>
+}
+
+function validateMcpServerPost(body: unknown): { ok: true; data: McpServerBody } | { ok: false; error: string } {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) {
+    return { ok: false, error: 'Invalid JSON body.' }
+  }
+  const b = body as Record<string, unknown>
+  if (typeof b.name !== 'string' || !b.name.trim()) {
+    return { ok: false, error: 'name is required.' }
+  }
+  if (typeof b.transport !== 'string' || !VALID_TRANSPORTS.includes(b.transport as McpTransport)) {
+    return { ok: false, error: 'transport must be one of: stdio, sse, streamable-http.' }
+  }
+  const transport = b.transport as McpTransport
+  if (transport === 'stdio' && (typeof b.command !== 'string' || !b.command.trim())) {
+    return { ok: false, error: 'command is required for stdio transport.' }
+  }
+  if ((transport === 'sse' || transport === 'streamable-http') && (typeof b.url !== 'string' || !b.url.trim())) {
+    return { ok: false, error: 'url is required for sse/streamable-http transport.' }
+  }
+  return { ok: true, data: b as unknown as McpServerBody }
+}
+
+function parseKnowledgeQueryParams(url: string) {
+  const { searchParams } = new URL(url)
+  const q = searchParams.get('q')
+  const tagsParam = searchParams.get('tags')
+  const limitParam = searchParams.get('limit')
+  const tags = tagsParam ? tagsParam.split(',').map((t) => t.trim()).filter(Boolean) : undefined
+  const limit = limitParam ? Math.max(1, Math.min(500, Number.parseInt(limitParam, 10) || 50)) : undefined
+  return { q, tags, limit }
+}
+
+// ---------------------------------------------------------------------------
+// Route source-code existence checks
+// ---------------------------------------------------------------------------
+
+const thisFile = new URL(import.meta.url).pathname
+const routeDir = path.resolve(path.dirname(thisFile), '../../app/api')
+
+function readRoute(...segments: string[]): string {
+  return fs.readFileSync(path.join(routeDir, ...segments), 'utf-8')
+}
+
+// ===========================================================================
+// Tests
+// ===========================================================================
+
+describe('Knowledge API contract', () => {
+  // --- POST validation ---------------------------------------------------
+  describe('POST body validation', () => {
+    it('accepts valid body with title and content', () => {
+      const result = validateKnowledgePost({ title: 'My doc', content: 'Some text' })
+      assert.equal(result.ok, true)
+      if (result.ok) {
+        assert.equal(result.data.title, 'My doc')
+        assert.equal(result.data.content, 'Some text')
+      }
+    })
+
+    it('rejects missing title', () => {
+      const result = validateKnowledgePost({ content: 'Hello' })
+      assert.equal(result.ok, false)
+      if (!result.ok) assert.match(result.error, /title/)
+    })
+
+    it('rejects empty-string title', () => {
+      const result = validateKnowledgePost({ title: '   ', content: 'Hello' })
+      assert.equal(result.ok, false)
+      if (!result.ok) assert.match(result.error, /title/)
+    })
+
+    it('rejects missing content', () => {
+      const result = validateKnowledgePost({ title: 'T' })
+      assert.equal(result.ok, false)
+      if (!result.ok) assert.match(result.error, /content/)
+    })
+
+    it('rejects non-object bodies', () => {
+      assert.equal(validateKnowledgePost(null).ok, false)
+      assert.equal(validateKnowledgePost([]).ok, false)
+      assert.equal(validateKnowledgePost('str').ok, false)
+    })
+
+    it('normalizes tags — filters out non-strings and empty strings', () => {
+      const result = validateKnowledgePost({ title: 'T', content: 'C', tags: ['a', '', 42, 'b', '  '] })
+      assert.equal(result.ok, true)
+      if (result.ok) {
+        assert.deepEqual(result.data.tags, ['a', 'b'])
+      }
+    })
+
+    it('trims title', () => {
+      const result = validateKnowledgePost({ title: '  Trimmed  ', content: 'C' })
+      assert.equal(result.ok, true)
+      if (result.ok) assert.equal(result.data.title, 'Trimmed')
+    })
+  })
+
+  // --- PUT validation ----------------------------------------------------
+  describe('PUT body validation', () => {
+    it('accepts partial updates (title only)', () => {
+      const result = validateKnowledgePut({ title: 'New title' })
+      assert.equal(result.ok, true)
+      if (result.ok) {
+        assert.equal(result.updates.title, 'New title')
+        assert.equal(result.updates.content, undefined)
+      }
+    })
+
+    it('accepts partial updates (content only)', () => {
+      const result = validateKnowledgePut({ content: 'New content' })
+      assert.equal(result.ok, true)
+      if (result.ok) {
+        assert.equal(result.updates.content, 'New content')
+        assert.equal(result.updates.title, undefined)
+      }
+    })
+
+    it('ignores empty-string title in PUT (does not overwrite)', () => {
+      const result = validateKnowledgePut({ title: '' })
+      assert.equal(result.ok, true)
+      if (result.ok) assert.equal(result.updates.title, undefined)
+    })
+
+    it('rejects non-object bodies', () => {
+      assert.equal(validateKnowledgePut(null).ok, false)
+      assert.equal(validateKnowledgePut([1, 2]).ok, false)
+    })
+
+    it('normalizes tags in PUT', () => {
+      const result = validateKnowledgePut({ tags: ['x', 99, '', 'y'] })
+      assert.equal(result.ok, true)
+      if (result.ok) assert.deepEqual(result.updates.tags, ['x', 'y'])
+    })
+  })
+
+  // --- GET query parsing -------------------------------------------------
+  describe('GET query param parsing', () => {
+    it('parses q param', () => {
+      const { q } = parseKnowledgeQueryParams('http://localhost/api/knowledge?q=hello')
+      assert.equal(q, 'hello')
+    })
+
+    it('parses tags as comma-separated list', () => {
+      const { tags } = parseKnowledgeQueryParams('http://localhost/api/knowledge?tags=a,b,%20c')
+      assert.deepEqual(tags, ['a', 'b', 'c'])
+    })
+
+    it('filters empty tag segments', () => {
+      const { tags } = parseKnowledgeQueryParams('http://localhost/api/knowledge?tags=a,,b,')
+      assert.deepEqual(tags, ['a', 'b'])
+    })
+
+    it('returns undefined tags when param is absent', () => {
+      const { tags } = parseKnowledgeQueryParams('http://localhost/api/knowledge')
+      assert.equal(tags, undefined)
+    })
+
+    it('clamps limit between 1 and 500', () => {
+      // parseInt('0') === 0 which is falsy, so || 50 kicks in => max(1,min(500,50)) = 50
+      assert.equal(parseKnowledgeQueryParams('http://localhost/api/knowledge?limit=0').limit, 50)
+      // parseInt('-5') === -5 which is truthy, so max(1, min(500, -5)) = max(1, -5) = 1
+      assert.equal(parseKnowledgeQueryParams('http://localhost/api/knowledge?limit=-5').limit, 1)
+      assert.equal(parseKnowledgeQueryParams('http://localhost/api/knowledge?limit=9999').limit, 500)
+      assert.equal(parseKnowledgeQueryParams('http://localhost/api/knowledge?limit=50').limit, 50)
+    })
+
+    it('defaults to 50 for non-numeric limit', () => {
+      assert.equal(parseKnowledgeQueryParams('http://localhost/api/knowledge?limit=abc').limit, 50)
+    })
+
+    it('returns undefined limit when param is absent', () => {
+      assert.equal(parseKnowledgeQueryParams('http://localhost/api/knowledge').limit, undefined)
+    })
+  })
+
+  // --- Route file structure -----------------------------------------------
+  describe('route file exports', () => {
+    it('knowledge/route.ts exports GET and POST', () => {
+      const src = readRoute('knowledge', 'route.ts')
+      assert.match(src, /export\s+async\s+function\s+GET/)
+      assert.match(src, /export\s+async\s+function\s+POST/)
+    })
+
+    it('knowledge/[id]/route.ts exports GET, PUT, DELETE', () => {
+      const src = readRoute('knowledge', '[id]', 'route.ts')
+      assert.match(src, /export\s+async\s+function\s+GET/)
+      assert.match(src, /export\s+async\s+function\s+PUT/)
+      assert.match(src, /export\s+async\s+function\s+DELETE/)
+    })
+  })
+})
+
+describe('MCP Server API contract', () => {
+  // --- POST validation ---------------------------------------------------
+  describe('POST body validation', () => {
+    it('accepts valid stdio server', () => {
+      const result = validateMcpServerPost({
+        name: 'My MCP',
+        transport: 'stdio',
+        command: 'node',
+        args: ['server.js'],
+      })
+      assert.equal(result.ok, true)
+      if (result.ok) {
+        assert.equal(result.data.name, 'My MCP')
+        assert.equal(result.data.transport, 'stdio')
+        assert.equal(result.data.command, 'node')
+      }
+    })
+
+    it('accepts valid sse server', () => {
+      const result = validateMcpServerPost({
+        name: 'SSE Server',
+        transport: 'sse',
+        url: 'http://localhost:8080/sse',
+      })
+      assert.equal(result.ok, true)
+    })
+
+    it('accepts valid streamable-http server', () => {
+      const result = validateMcpServerPost({
+        name: 'HTTP Server',
+        transport: 'streamable-http',
+        url: 'http://localhost:8080/mcp',
+      })
+      assert.equal(result.ok, true)
+    })
+
+    it('rejects missing name', () => {
+      const result = validateMcpServerPost({ transport: 'stdio', command: 'node' })
+      assert.equal(result.ok, false)
+      if (!result.ok) assert.match(result.error, /name/)
+    })
+
+    it('rejects missing transport', () => {
+      const result = validateMcpServerPost({ name: 'Server' })
+      assert.equal(result.ok, false)
+      if (!result.ok) assert.match(result.error, /transport/)
+    })
+
+    it('rejects invalid transport value', () => {
+      const result = validateMcpServerPost({ name: 'S', transport: 'websocket' })
+      assert.equal(result.ok, false)
+      if (!result.ok) assert.match(result.error, /transport/)
+    })
+
+    it('rejects stdio without command', () => {
+      const result = validateMcpServerPost({ name: 'S', transport: 'stdio' })
+      assert.equal(result.ok, false)
+      if (!result.ok) assert.match(result.error, /command/)
+    })
+
+    it('rejects sse without url', () => {
+      const result = validateMcpServerPost({ name: 'S', transport: 'sse' })
+      assert.equal(result.ok, false)
+      if (!result.ok) assert.match(result.error, /url/)
+    })
+
+    it('rejects streamable-http without url', () => {
+      const result = validateMcpServerPost({ name: 'S', transport: 'streamable-http' })
+      assert.equal(result.ok, false)
+      if (!result.ok) assert.match(result.error, /url/)
+    })
+
+    it('rejects non-object body', () => {
+      assert.equal(validateMcpServerPost(null).ok, false)
+      assert.equal(validateMcpServerPost('hello').ok, false)
+      assert.equal(validateMcpServerPost([]).ok, false)
+    })
+  })
+
+  // --- Transport enum completeness ----------------------------------------
+  describe('transport enum', () => {
+    it('includes exactly three valid transport values', () => {
+      assert.deepEqual(VALID_TRANSPORTS, ['stdio', 'sse', 'streamable-http'])
+      assert.equal(VALID_TRANSPORTS.length, 3)
+    })
+  })
+
+  // --- Route file structure -----------------------------------------------
+  describe('route file exports', () => {
+    it('mcp-servers/route.ts exports GET and POST', () => {
+      const src = readRoute('mcp-servers', 'route.ts')
+      assert.match(src, /export\s+async\s+function\s+GET/)
+      assert.match(src, /export\s+async\s+function\s+POST/)
+    })
+
+    it('mcp-servers/[id]/route.ts exports GET, PUT, DELETE', () => {
+      const src = readRoute('mcp-servers', '[id]', 'route.ts')
+      assert.match(src, /export\s+async\s+function\s+GET/)
+      assert.match(src, /export\s+async\s+function\s+PUT/)
+      assert.match(src, /export\s+async\s+function\s+DELETE/)
+    })
+
+    it('MCP POST route assigns an id via crypto.randomBytes', () => {
+      const src = readRoute('mcp-servers', 'route.ts')
+      assert.match(src, /crypto\.randomBytes/)
+    })
+
+    it('MCP PUT route preserves id and sets updatedAt', () => {
+      const src = readRoute('mcp-servers', '[id]', 'route.ts')
+      assert.match(src, /updatedAt:\s*Date\.now\(\)/)
+      // Verify id is pinned (spread then override)
+      assert.match(src, /\.\.\.servers\[id\]/)
+      assert.match(src, /\bid\b,/)
+    })
+  })
+})