feat(mcp,editor): Option A+B storage + 10 agent deliverables (Phase 7)

Ships the combined filesystem/Supabase storage adapter + MCP scene
lifecycle tools + Next.js API routes + editor /scene/[id] route, so
an MCP save is directly openable at /scene/<id> without any
injection hack. End-to-end verified: 10/10 e2e steps pass.

Storage (A1/A2/A3):
- SceneStore interface + error classes + slug helpers
- FilesystemSceneStore at $PASCAL_DATA_DIR (defaults XDG/~/.pascal)
  with atomic writes, .index sidecar, optimistic locking
- SupabaseSceneStore with scenes + scene_revisions tables, RLS
  migration SQL, mock-backed unit tests
- createSceneStore(env) auto-selects based on SUPABASE_URL +
  SUPABASE_SERVICE_ROLE_KEY

MCP tools (A4, A8, A9, A10):
- save_scene / load_scene / list_scenes / delete_scene / rename_scene
- list_templates / create_from_template (3 seed templates:
  empty-studio, two-bedroom, garden-house)
- generate_variants (7 mutation kinds, seeded RNG, save=true|false)
- photo_to_scene (vision sampling → scene graph → save)

Editor (A5, A6):
- /api/scenes + /api/scenes/[id] with RFC 7232 If-Match locking
- /scene/[id] and /scenes route pages with save button, SceneLoader
- Removed the window.__pascalScene dev injection hack

Security + UX edges (A7, A8):
- AssetUrl Zod validator: asset:// blob: data:image/ /path https:
  (http://localhost for dev) + PASCAL_ALLOWED_ASSET_ORIGINS env
  allowlist. Hardens scan.url, guide.url, item.asset.src,
  material.texture.url, MaterialMaps.*Map
- Auto-frame camera on empty→non-empty scene transition
  (camera-controls:fit-scene emitter event)

Shared utilities:
- rehydrateSiteChildren() extracted to packages/mcp/src/lib/ and
  used by both create-from-template and generate-variants to work
  around the SiteNode.children-as-objects vs. ids inconsistency
  (CROSS_CUTTING §2)
- Storage + MCP subpath exports added to packages/mcp/package.json
  (CROSS_CUTTING §4)

Tests: 293 pass / 0 fail across 40 files (was 142 pre-Phase-7).
Biome: clean.

Phase-7 e2e script at packages/mcp/test-reports/phase7-e2e.ts:
MCP HTTP + editor Next.js both point at $PASCAL_DATA_DIR =
/tmp/pascal-e2e, save_scene from MCP, GET /api/scenes/<id> from
editor server, /scenes list page renders all saved scenes, scene
page renders SceneLoader, delete_scene works.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/editor/lib/scene-store-server.test.ts

@@ -0,0 +1,58 @@
+import { beforeEach, describe, expect, mock, test } from 'bun:test'
+
+describe('getSceneStore', () => {
+  beforeEach(() => {
+    mock.module('@pascal-app/mcp/storage', () => {
+      let callCount = 0
+      return {
+        createSceneStore: async (_env?: NodeJS.ProcessEnv) => {
+          callCount++
+          return {
+            backend: 'filesystem' as const,
+            __instanceNumber: callCount,
+            save: async () => ({}) as never,
+            load: async () => null,
+            list: async () => [],
+            delete: async () => false,
+            rename: async () => ({}) as never,
+          }
+        },
+      }
+    })
+  })
+
+  test('returns the same promise on repeated calls', async () => {
+    const mod = await import('./scene-store-server')
+    mod.__resetSceneStoreForTests()
+
+    const a = mod.getSceneStore()
+    const b = mod.getSceneStore()
+
+    expect(a).toBe(b)
+  })
+
+  test('resolves to the same store instance across calls', async () => {
+    const mod = await import('./scene-store-server')
+    mod.__resetSceneStoreForTests()
+
+    const storeA = await mod.getSceneStore()
+    const storeB = await mod.getSceneStore()
+
+    expect(storeA).toBe(storeB)
+    // Factory should have been invoked exactly once — asserted indirectly via
+    // our mock's instance counter.
+    expect((storeA as unknown as { __instanceNumber: number }).__instanceNumber).toBe(1)
+    expect((storeB as unknown as { __instanceNumber: number }).__instanceNumber).toBe(1)
+  })
+
+  test('reset helper clears the cached singleton', async () => {
+    const mod = await import('./scene-store-server')
+    mod.__resetSceneStoreForTests()
+
+    const first = await mod.getSceneStore()
+    mod.__resetSceneStoreForTests()
+    const second = await mod.getSceneStore()
+
+    expect(first).not.toBe(second)
+  })
+})

apps/editor/lib/scene-store-server.ts

@@ -0,0 +1,91 @@
+// TODO: auth — every call in this module currently runs unauthenticated.
+// v0.1 skips auth; the factory should eventually receive a user context from
+// middleware / a request-scoped session and propagate it into SceneStore.
+// Only import this module from server code (route handlers, server components,
+// server actions). Importing from client code will leak the Supabase service
+// role key into the browser bundle.
+
+import type { SceneGraph } from '@pascal-app/core/clone-scene-graph'
+
+/**
+ * Inlined copies of the shared storage contract. The canonical source lives in
+ * `packages/mcp/src/storage/types.ts`; re-declared here so the editor only
+ * needs the runtime factory from `@pascal-app/mcp/storage` and type-checks
+ * without a hard compile-time dependency on the MCP package's source tree.
+ *
+ * Keep this file in sync whenever the MCP storage types change.
+ */
+export type SceneId = string
+
+export interface SceneMeta {
+  id: SceneId
+  name: string
+  projectId: string | null
+  thumbnailUrl: string | null
+  version: number
+  createdAt: string
+  updatedAt: string
+  ownerId: string | null
+  sizeBytes: number
+  nodeCount: number
+}
+
+export interface SceneWithGraph extends SceneMeta {
+  graph: SceneGraph
+}
+
+export interface SceneSaveOptions {
+  id?: SceneId
+  name: string
+  projectId?: string | null
+  ownerId?: string | null
+  graph: SceneGraph
+  thumbnailUrl?: string | null
+  expectedVersion?: number
+}
+
+export interface SceneListOptions {
+  projectId?: string
+  ownerId?: string
+  limit?: number
+}
+
+export interface SceneMutateOptions {
+  expectedVersion?: number
+}
+
+export interface SceneStore {
+  readonly backend: 'filesystem' | 'supabase'
+  save(opts: SceneSaveOptions): Promise<SceneMeta>
+  load(id: SceneId): Promise<SceneWithGraph | null>
+  list(opts?: SceneListOptions): Promise<SceneMeta[]>
+  delete(id: SceneId, opts?: SceneMutateOptions): Promise<boolean>
+  rename(id: SceneId, newName: string, opts?: SceneMutateOptions): Promise<SceneMeta>
+}
+
+/**
+ * Per-process singleton. The factory is async because backend modules are
+ * dynamically imported — we cache the in-flight promise so concurrent calls
+ * during a cold start share a single instantiation.
+ */
+let cached: Promise<SceneStore> | null = null
+
+export function getSceneStore(): Promise<SceneStore> {
+  if (!cached) {
+    cached = (async () => {
+      const mod = (await import('@pascal-app/mcp/storage')) as {
+        createSceneStore: (env?: NodeJS.ProcessEnv) => Promise<SceneStore>
+      }
+      return mod.createSceneStore(process.env)
+    })()
+  }
+  return cached
+}
+
+/**
+ * Test-only helper to reset the cached singleton. Not exported for production
+ * callers.
+ */
+export function __resetSceneStoreForTests(): void {
+  cached = null
+}