feat(mcp,editor): Option A+B storage + 10 agent deliverables (Phase 7)

Ships the combined filesystem/Supabase storage adapter + MCP scene
lifecycle tools + Next.js API routes + editor /scene/[id] route, so
an MCP save is directly openable at /scene/<id> without any
injection hack. End-to-end verified: 10/10 e2e steps pass.

Storage (A1/A2/A3):
- SceneStore interface + error classes + slug helpers
- FilesystemSceneStore at $PASCAL_DATA_DIR (defaults XDG/~/.pascal)
  with atomic writes, .index sidecar, optimistic locking
- SupabaseSceneStore with scenes + scene_revisions tables, RLS
  migration SQL, mock-backed unit tests
- createSceneStore(env) auto-selects based on SUPABASE_URL +
  SUPABASE_SERVICE_ROLE_KEY

MCP tools (A4, A8, A9, A10):
- save_scene / load_scene / list_scenes / delete_scene / rename_scene
- list_templates / create_from_template (3 seed templates:
  empty-studio, two-bedroom, garden-house)
- generate_variants (7 mutation kinds, seeded RNG, save=true|false)
- photo_to_scene (vision sampling → scene graph → save)

Editor (A5, A6):
- /api/scenes + /api/scenes/[id] with RFC 7232 If-Match locking
- /scene/[id] and /scenes route pages with save button, SceneLoader
- Removed the window.__pascalScene dev injection hack

Security + UX edges (A7, A8):
- AssetUrl Zod validator: asset:// blob: data:image/ /path https:
  (http://localhost for dev) + PASCAL_ALLOWED_ASSET_ORIGINS env
  allowlist. Hardens scan.url, guide.url, item.asset.src,
  material.texture.url, MaterialMaps.*Map
- Auto-frame camera on empty→non-empty scene transition
  (camera-controls:fit-scene emitter event)

Shared utilities:
- rehydrateSiteChildren() extracted to packages/mcp/src/lib/ and
  used by both create-from-template and generate-variants to work
  around the SiteNode.children-as-objects vs. ids inconsistency
  (CROSS_CUTTING §2)
- Storage + MCP subpath exports added to packages/mcp/package.json
  (CROSS_CUTTING §4)

Tests: 293 pass / 0 fail across 40 files (was 142 pre-Phase-7).
Biome: clean.

Phase-7 e2e script at packages/mcp/test-reports/phase7-e2e.ts:
MCP HTTP + editor Next.js both point at $PASCAL_DATA_DIR =
/tmp/pascal-e2e, save_scene from MCP, GET /api/scenes/<id> from
editor server, /scenes list page renders all saved scenes, scene
page renders SceneLoader, delete_scene works.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/mcp/test-reports/t5-resources-prompts/run.ts

@@ -1,18 +1,6 @@
-/**
- * T5 — MCP resources + prompts test harness.
- *
- * Connects to the shared MCP HTTP server at http://localhost:3917 (path /mcp),
- * exercises the 4 documented resources and 3 prompts, and prints a structured
- * pass/fail summary that the REPORT.md can be authored from.
- *
- * Usage:
- *   bun packages/mcp/test-reports/t5-resources-prompts/run.ts
- */
-import { existsSync } from 'node:fs'
 import { dirname, resolve as pathResolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { Client } from '@modelcontextprotocol/sdk/client/index.js'
-import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
 
 const HTTP_URL = new URL('http://localhost:3917/mcp')
@@ -104,9 +92,7 @@ async function main(): Promise<void> {
           .join(', ')}`,
       )
     } catch (err) {
-      console.error(
-        `[t5] listResources error: ${err instanceof Error ? err.message : String(err)}`,
-      )
+      console.error(`[t5] listResources error: ${err instanceof Error ? err.message : String(err)}`)
     }
 
     // ---------------- Resource 1: pascal://scene/current ----------------
@@ -116,9 +102,7 @@ async function main(): Promise<void> {
       if (!c) {
         resourceOutcomes.push(fail('scene/current', 'no contents returned'))
       } else if (c.mimeType !== 'application/json') {
-        resourceOutcomes.push(
-          fail('scene/current', `wrong mime type: ${String(c.mimeType)}`),
-        )
+        resourceOutcomes.push(fail('scene/current', `wrong mime type: ${String(c.mimeType)}`))
       } else {
         const text = typeof c.text === 'string' ? c.text : ''
         let parsed: unknown
@@ -144,10 +128,7 @@ async function main(): Promise<void> {
           const nodeCount = Object.keys(obj.nodes as Record<string, unknown>).length
           const rootCount = (obj.rootNodeIds as unknown[]).length
           resourceOutcomes.push(
-            ok(
-              'scene/current',
-              `application/json, nodes=${nodeCount}, rootNodeIds=${rootCount}`,
-            ),
+            ok('scene/current', `application/json, nodes=${nodeCount}, rootNodeIds=${rootCount}`),
           )
         }
       }
@@ -172,13 +153,9 @@ async function main(): Promise<void> {
         const hasHeading = /^# /m.test(text)
         const hasZoneOrLevel = /level/i.test(text) || /zone/i.test(text)
         if (!hasHeading) {
-          resourceOutcomes.push(
-            fail('scene/current/summary', 'no markdown # heading found'),
-          )
+          resourceOutcomes.push(fail('scene/current/summary', 'no markdown # heading found'))
         } else if (!hasZoneOrLevel) {
-          resourceOutcomes.push(
-            fail('scene/current/summary', 'no level/zone references'),
-          )
+          resourceOutcomes.push(fail('scene/current/summary', 'no level/zone references'))
         } else {
           // Extract a few first lines as preview
           const preview = text.split('\n').slice(0, 4).join(' | ')
@@ -192,10 +169,7 @@ async function main(): Promise<void> {
       }
     } catch (err) {
       resourceOutcomes.push(
-        fail(
-          'scene/current/summary',
-          `threw: ${err instanceof Error ? err.message : String(err)}`,
-        ),
+        fail('scene/current/summary', `threw: ${err instanceof Error ? err.message : String(err)}`),
       )
     }
 
@@ -206,15 +180,16 @@ async function main(): Promise<void> {
       if (!c) {
         resourceOutcomes.push(fail('catalog/items', 'no contents returned'))
       } else if (c.mimeType !== 'application/json') {
-        resourceOutcomes.push(
-          fail('catalog/items', `wrong mime type: ${String(c.mimeType)}`),
-        )
+        resourceOutcomes.push(fail('catalog/items', `wrong mime type: ${String(c.mimeType)}`))
       } else {
         const text = typeof c.text === 'string' ? c.text : ''
         const parsed = JSON.parse(text) as { status?: unknown; items?: unknown }
         if (parsed.status !== 'catalog_unavailable') {
           resourceOutcomes.push(
-            fail('catalog/items', `expected status='catalog_unavailable' got ${String(parsed.status)}`),
+            fail(
+              'catalog/items',
+              `expected status='catalog_unavailable' got ${String(parsed.status)}`,
+            ),
           )
         } else {
           resourceOutcomes.push(
@@ -241,8 +216,7 @@ async function main(): Promise<void> {
         name: 'find_nodes',
         arguments: { type: 'level' },
       })
-      const sc = (findResult as { structuredContent?: { nodes?: unknown[] } })
-        .structuredContent
+      const sc = (findResult as { structuredContent?: { nodes?: unknown[] } }).structuredContent
       const nodes = Array.isArray(sc?.nodes) ? sc.nodes : []
       if (nodes.length > 0) {
         const first = nodes[0] as { id?: string }
@@ -252,9 +226,7 @@ async function main(): Promise<void> {
       }
       console.log(`[t5] discovered levelId = ${String(discoveredLevelId)}`)
     } catch (err) {
-      console.error(
-        `[t5] find_nodes threw: ${err instanceof Error ? err.message : String(err)}`,
-      )
+      console.error(`[t5] find_nodes threw: ${err instanceof Error ? err.message : String(err)}`)
     }
 
     if (!discoveredLevelId) {
@@ -281,19 +253,12 @@ async function main(): Promise<void> {
           }
           if (parsed.error) {
             resourceOutcomes.push(
-              fail(
-                'constraints/{levelId}',
-                `error in payload: ${safeStringify(parsed.error)}`,
-              ),
+              fail('constraints/{levelId}', `error in payload: ${safeStringify(parsed.error)}`),
             )
           } else if (!Array.isArray(parsed.slabs)) {
-            resourceOutcomes.push(
-              fail('constraints/{levelId}', 'missing slabs array'),
-            )
+            resourceOutcomes.push(fail('constraints/{levelId}', 'missing slabs array'))
           } else if (!Array.isArray(parsed.wallPolygons)) {
-            resourceOutcomes.push(
-              fail('constraints/{levelId}', 'missing wallPolygons array'),
-            )
+            resourceOutcomes.push(fail('constraints/{levelId}', 'missing wallPolygons array'))
           } else {
             resourceOutcomes.push(
               ok(
@@ -318,15 +283,9 @@ async function main(): Promise<void> {
       const list = await client.listPrompts()
       listPromptsCount = Array.isArray(list.prompts) ? list.prompts.length : 0
       console.log(`[t5] listPrompts count = ${listPromptsCount}`)
-      console.log(
-        `[t5] listPrompts names = ${(list.prompts ?? [])
-          .map((p) => p.name)
-          .join(', ')}`,
-      )
+      console.log(`[t5] listPrompts names = ${(list.prompts ?? []).map((p) => p.name).join(', ')}`)
     } catch (err) {
-      console.error(
-        `[t5] listPrompts error: ${err instanceof Error ? err.message : String(err)}`,
-      )
+      console.error(`[t5] listPrompts error: ${err instanceof Error ? err.message : String(err)}`)
     }
 
     // ---------------- Prompt 1: from_brief ----------------
@@ -386,10 +345,7 @@ async function main(): Promise<void> {
       }
     } catch (err) {
       promptOutcomes.push(
-        fail(
-          'iterate_on_feedback',
-          `threw: ${err instanceof Error ? err.message : String(err)}`,
-        ),
+        fail('iterate_on_feedback', `threw: ${err instanceof Error ? err.message : String(err)}`),
       )
     }
 
@@ -406,9 +362,7 @@ async function main(): Promise<void> {
       const messages = result.messages ?? []
       const userMsgs = messages.filter((m) => m.role === 'user')
       if (userMsgs.length === 0) {
-        promptOutcomes.push(
-          fail('renovation_from_photos', 'no user messages returned'),
-        )
+        promptOutcomes.push(fail('renovation_from_photos', 'no user messages returned'))
       } else {
         // Look across all message content for the URLs we passed.
         const allText = messages