feat(mcp,editor): Option A+B storage + 10 agent deliverables (Phase 7)

Ships the combined filesystem/Supabase storage adapter + MCP scene
lifecycle tools + Next.js API routes + editor /scene/[id] route, so
an MCP save is directly openable at /scene/<id> without any
injection hack. End-to-end verified: 10/10 e2e steps pass.

Storage (A1/A2/A3):
- SceneStore interface + error classes + slug helpers
- FilesystemSceneStore at $PASCAL_DATA_DIR (defaults XDG/~/.pascal)
  with atomic writes, .index sidecar, optimistic locking
- SupabaseSceneStore with scenes + scene_revisions tables, RLS
  migration SQL, mock-backed unit tests
- createSceneStore(env) auto-selects based on SUPABASE_URL +
  SUPABASE_SERVICE_ROLE_KEY

MCP tools (A4, A8, A9, A10):
- save_scene / load_scene / list_scenes / delete_scene / rename_scene
- list_templates / create_from_template (3 seed templates:
  empty-studio, two-bedroom, garden-house)
- generate_variants (7 mutation kinds, seeded RNG, save=true|false)
- photo_to_scene (vision sampling → scene graph → save)

Editor (A5, A6):
- /api/scenes + /api/scenes/[id] with RFC 7232 If-Match locking
- /scene/[id] and /scenes route pages with save button, SceneLoader
- Removed the window.__pascalScene dev injection hack

Security + UX edges (A7, A8):
- AssetUrl Zod validator: asset:// blob: data:image/ /path https:
  (http://localhost for dev) + PASCAL_ALLOWED_ASSET_ORIGINS env
  allowlist. Hardens scan.url, guide.url, item.asset.src,
  material.texture.url, MaterialMaps.*Map
- Auto-frame camera on empty→non-empty scene transition
  (camera-controls:fit-scene emitter event)

Shared utilities:
- rehydrateSiteChildren() extracted to packages/mcp/src/lib/ and
  used by both create-from-template and generate-variants to work
  around the SiteNode.children-as-objects vs. ids inconsistency
  (CROSS_CUTTING §2)
- Storage + MCP subpath exports added to packages/mcp/package.json
  (CROSS_CUTTING §4)

Tests: 293 pass / 0 fail across 40 files (was 142 pre-Phase-7).
Biome: clean.

Phase-7 e2e script at packages/mcp/test-reports/phase7-e2e.ts:
MCP HTTP + editor Next.js both point at $PASCAL_DATA_DIR =
/tmp/pascal-e2e, save_scene from MCP, GET /api/scenes/<id> from
editor server, /scenes list page renders all saved scenes, scene
page renders SceneLoader, delete_scene works.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/mcp/test-reports/phase7-e2e.ts

@@ -0,0 +1,95 @@
+/**
+ * Phase 7 end-to-end: prove MCP save_scene → editor /scene/[id] renders the scene
+ * without any window.__pascalScene injection.
+ *
+ * Run: PASCAL_DATA_DIR=/tmp/pascal-e2e bun run packages/mcp/test-reports/phase7-e2e.ts
+ */
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
+
+const MCP_URL = 'http://localhost:3917/mcp'
+const EDITOR_URL = 'http://localhost:3002'
+
+async function main() {
+  console.log('---- Phase 7 e2e ----')
+
+  // 1. Connect to MCP over HTTP
+  const transport = new StreamableHTTPClientTransport(new URL(MCP_URL))
+  const client = new Client({ name: 'e2e', version: '0.0.0' })
+  await client.connect(transport)
+  console.log('OK  1 connect MCP HTTP')
+
+  // 2. Build a scene from a template
+  const created = await client.callTool({
+    name: 'create_from_template',
+    arguments: { id: 'two-bedroom', name: 'e2e-two-bedroom' },
+  })
+  if (created.isError) throw new Error(`create_from_template: ${JSON.stringify(created)}`)
+  console.log('OK  2 create_from_template two-bedroom')
+
+  // 3. Save it
+  const saved = await client.callTool({
+    name: 'save_scene',
+    arguments: { name: 'e2e test house' },
+  })
+  if (saved.isError) throw new Error(`save_scene: ${JSON.stringify(saved)}`)
+  const savedData = JSON.parse((saved.content as Array<{ text: string }>)[0]!.text)
+  const sceneId = savedData.id as string
+  console.log(`OK  3 save_scene -> id=${sceneId}, version=${savedData.version}`)
+
+  // 4. list_scenes
+  const list = await client.callTool({ name: 'list_scenes', arguments: {} })
+  if (list.isError) throw new Error(`list_scenes: ${JSON.stringify(list)}`)
+  const listData = JSON.parse((list.content as Array<{ text: string }>)[0]!.text)
+  console.log(`OK  4 list_scenes -> ${listData.scenes.length} scenes`)
+
+  // 5. Fetch via editor's API (proves A5 works against the same store)
+  const apiRes = await fetch(`${EDITOR_URL}/api/scenes/${sceneId}`)
+  if (!apiRes.ok) throw new Error(`GET /api/scenes/${sceneId} → ${apiRes.status}`)
+  const apiBody = await apiRes.json()
+  const nodeCount = Object.keys(apiBody.graph.nodes).length
+  console.log(`OK  5 editor /api/scenes/${sceneId} → ${nodeCount} nodes`)
+
+  // 6. Fetch editor's /scenes list page (HTML)
+  const listHtmlRes = await fetch(`${EDITOR_URL}/scenes`)
+  if (!listHtmlRes.ok) throw new Error(`GET /scenes → ${listHtmlRes.status}`)
+  const listHtml = await listHtmlRes.text()
+  const hasSceneLink = listHtml.includes(`/scene/${sceneId}`)
+  console.log(`OK  6 /scenes renders, links scene: ${hasSceneLink}`)
+
+  // 7. Fetch /scene/[id] page
+  const sceneHtmlRes = await fetch(`${EDITOR_URL}/scene/${sceneId}`)
+  if (!sceneHtmlRes.ok) throw new Error(`GET /scene/${sceneId} → ${sceneHtmlRes.status}`)
+  console.log(`OK  7 /scene/${sceneId} renders (${sceneHtmlRes.status})`)
+
+  // 8. generate_variants — 3 variants, save=true
+  const variants = await client.callTool({
+    name: 'generate_variants',
+    arguments: { count: 3, vary: ['wall-thickness', 'wall-height'], save: true, seed: 42 },
+  })
+  if (variants.isError) throw new Error(`generate_variants: ${JSON.stringify(variants)}`)
+  const variantsData = JSON.parse((variants.content as Array<{ text: string }>)[0]!.text)
+  console.log(`OK  8 generate_variants -> ${variantsData.variants.length} variants`)
+
+  // 9. list_scenes again — should be > 1
+  const list2 = await client.callTool({ name: 'list_scenes', arguments: {} })
+  const list2Data = JSON.parse((list2.content as Array<{ text: string }>)[0]!.text)
+  console.log(`OK  9 list_scenes now shows ${list2Data.scenes.length} scenes`)
+
+  // 10. delete_scene
+  const deleted = await client.callTool({ name: 'delete_scene', arguments: { id: sceneId } })
+  if (deleted.isError) throw new Error(`delete_scene: ${JSON.stringify(deleted)}`)
+  const deletedData = JSON.parse((deleted.content as Array<{ text: string }>)[0]!.text)
+  console.log(`OK 10 delete_scene -> deleted=${deletedData.deleted}`)
+
+  await client.close()
+  console.log(`\nSceneId to open in browser: ${EDITOR_URL}/scenes`)
+  console.log(`Direct: ${EDITOR_URL}/scene/${variantsData.variants[0].sceneId}`)
+  console.log('\n✅ Phase 7 e2e PASSED\n')
+}
+
+main().catch((err) => {
+  console.error('\n❌ e2e failed:', err)
+  process.exit(1)
+})