feat(mcp,editor): Option A+B storage + 10 agent deliverables (Phase 7)

Ships the combined filesystem/Supabase storage adapter + MCP scene
lifecycle tools + Next.js API routes + editor /scene/[id] route, so
an MCP save is directly openable at /scene/<id> without any
injection hack. End-to-end verified: 10/10 e2e steps pass.

Storage (A1/A2/A3):
- SceneStore interface + error classes + slug helpers
- FilesystemSceneStore at $PASCAL_DATA_DIR (defaults XDG/~/.pascal)
  with atomic writes, .index sidecar, optimistic locking
- SupabaseSceneStore with scenes + scene_revisions tables, RLS
  migration SQL, mock-backed unit tests
- createSceneStore(env) auto-selects based on SUPABASE_URL +
  SUPABASE_SERVICE_ROLE_KEY

MCP tools (A4, A8, A9, A10):
- save_scene / load_scene / list_scenes / delete_scene / rename_scene
- list_templates / create_from_template (3 seed templates:
  empty-studio, two-bedroom, garden-house)
- generate_variants (7 mutation kinds, seeded RNG, save=true|false)
- photo_to_scene (vision sampling → scene graph → save)

Editor (A5, A6):
- /api/scenes + /api/scenes/[id] with RFC 7232 If-Match locking
- /scene/[id] and /scenes route pages with save button, SceneLoader
- Removed the window.__pascalScene dev injection hack

Security + UX edges (A7, A8):
- AssetUrl Zod validator: asset:// blob: data:image/ /path https:
  (http://localhost for dev) + PASCAL_ALLOWED_ASSET_ORIGINS env
  allowlist. Hardens scan.url, guide.url, item.asset.src,
  material.texture.url, MaterialMaps.*Map
- Auto-frame camera on empty→non-empty scene transition
  (camera-controls:fit-scene emitter event)

Shared utilities:
- rehydrateSiteChildren() extracted to packages/mcp/src/lib/ and
  used by both create-from-template and generate-variants to work
  around the SiteNode.children-as-objects vs. ids inconsistency
  (CROSS_CUTTING §2)
- Storage + MCP subpath exports added to packages/mcp/package.json
  (CROSS_CUTTING §4)

Tests: 293 pass / 0 fail across 40 files (was 142 pre-Phase-7).
Biome: clean.

Phase-7 e2e script at packages/mcp/test-reports/phase7-e2e.ts:
MCP HTTP + editor Next.js both point at $PASCAL_DATA_DIR =
/tmp/pascal-e2e, save_scene from MCP, GET /api/scenes/<id> from
editor server, /scenes list page renders all saved scenes, scene
page renders SceneLoader, delete_scene works.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/mcp/test-reports/casa-sol/build.ts

@@ -19,12 +19,12 @@
  *   bun packages/mcp/test-reports/casa-sol/build.ts
  */
 
-import { Client } from '@modelcontextprotocol/sdk/client/index.js'
-import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
-import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'
 import { writeFileSync } from 'node:fs'
 import { dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'
 
 const HERE = dirname(fileURLToPath(import.meta.url))
 const SERVER_URL = 'http://localhost:3917/mcp'
@@ -234,7 +234,14 @@ const OPENINGS: OpeningSpec[] = [
   },
   { wallDesignId: 2, kind: 'door', position: 0.65, width: 0.9, height: 2.1, label: 'kitchen-back' },
   { wallDesignId: 6, kind: 'door', position: 0.3, width: 0.8, height: 2.1, label: 'master-door' },
-  { wallDesignId: 7, kind: 'door', position: 0.5, width: 0.8, height: 2.1, label: 'bedroom-2-door' },
+  {
+    wallDesignId: 7,
+    kind: 'door',
+    position: 0.5,
+    width: 0.8,
+    height: 2.1,
+    label: 'bedroom-2-door',
+  },
   { wallDesignId: 9, kind: 'door', position: 0.5, width: 0.7, height: 2.0, label: 'bath2-door' },
   {
     wallDesignId: 1,
@@ -329,8 +336,12 @@ async function main(): Promise<void> {
     log(`[casa] falling back to in-memory MCP server (same tool surface)`)
     // Load the in-process MCP server to keep the build moving. This preserves
     // the tool contract; the only thing we lose is the HTTP wire test.
-    const { SceneBridge } = await import('/Users/adrian/Desktop/editor/.worktrees/mcp-server/packages/mcp/src/bridge/scene-bridge.ts')
-    const { createPascalMcpServer } = await import('/Users/adrian/Desktop/editor/.worktrees/mcp-server/packages/mcp/src/server.ts')
+    const { SceneBridge } = await import(
+      '/Users/adrian/Desktop/editor/.worktrees/mcp-server/packages/mcp/src/bridge/scene-bridge.ts'
+    )
+    const { createPascalMcpServer } = await import(
+      '/Users/adrian/Desktop/editor/.worktrees/mcp-server/packages/mcp/src/server.ts'
+    )
 
     const bridge = new SceneBridge()
     bridge.loadDefault()
@@ -530,7 +541,9 @@ async function main(): Promise<void> {
         })
       }
     }
-    const ids = openingResults.filter((r) => r.ok && r.openingId).map((r) => r.openingId!) as string[]
+    const ids = openingResults
+      .filter((r) => r.ok && r.openingId)
+      .map((r) => r.openingId!) as string[]
     return {
       summary: `${doors} doors, ${windows} windows, ${failures.length} failures`,
       nodeIds: ids,
@@ -691,9 +704,8 @@ async function main(): Promise<void> {
 
   // ----- Step 12: Final validate + summary counts -----
   const finalValid = await runValidate(client, 'final')
-  const allNodes = (
-    await callTool<{ nodes: Array<{ type: string }> }>(client, 'find_nodes', {})
-  ).nodes
+  const allNodes = (await callTool<{ nodes: Array<{ type: string }> }>(client, 'find_nodes', {}))
+    .nodes
   const tally: Record<string, number> = {}
   for (const n of allNodes) {
     tally[n.type] = (tally[n.type] ?? 0) + 1
@@ -790,7 +802,9 @@ async function main(): Promise<void> {
 
   lines.push('## Validation')
   lines.push('')
-  lines.push(`- Final \`validate_scene\`: valid=\`${finalValid.valid}\`, errors=${finalValid.errors.length}`)
+  lines.push(
+    `- Final \`validate_scene\`: valid=\`${finalValid.valid}\`, errors=${finalValid.errors.length}`,
+  )
   if (!finalValid.valid && finalValid.errors.length > 0) {
     lines.push('')
     lines.push('Errors (verbatim):')