@pascal-app/mcp 0.2.0

package/dist/lib/rehydrate-site-children.js

@@ -0,0 +1,40 @@
+/**
+ * `cloneSceneGraph` normalises `SiteNode.children` to an array of node IDs,
+ * but core's `SiteNode` schema expects an array of embedded `BuildingNode` /
+ * `ItemNode` objects (see `packages/mcp/CROSS_CUTTING.md` §2). To keep the
+ * cloned graph validating against `AnyNode`, re-embed the site children from
+ * the flat dict.
+ *
+ * Pure: returns a new graph without mutating the input.
+ */
+export function rehydrateSiteChildren(graph) {
+    const out = {
+        nodes: { ...graph.nodes },
+        rootNodeIds: [...graph.rootNodeIds],
+        ...(graph.collections ? { collections: graph.collections } : {}),
+    };
+    for (const [id, node] of Object.entries(out.nodes)) {
+        if (node.type !== 'site')
+            continue;
+        const childrenField = node.children;
+        if (!Array.isArray(childrenField))
+            continue;
+        const rehydrated = [];
+        for (const child of childrenField) {
+            if (typeof child === 'string') {
+                const target = out.nodes[child];
+                if (target && (target.type === 'building' || target.type === 'item')) {
+                    rehydrated.push(target);
+                }
+            }
+            else if (child && typeof child === 'object' && 'id' in child) {
+                rehydrated.push(child);
+            }
+        }
+        out.nodes[id] = {
+            ...node,
+            children: rehydrated,
+        };
+    }
+    return out;
+}

package/dist/lib/safe-fetch.d.ts

@@ -0,0 +1,19 @@
+export type SafeFetchOptions = {
+    maxBytes?: number;
+    timeoutMs?: number;
+    /** Request `Accept` header to send. */
+    accept?: string;
+};
+export type SafeFetchResult = {
+    buffer: Buffer;
+    contentType: string | null;
+    finalUrl: string;
+    hops: string[];
+};
+/**
+ * SSRF-safe fetch that follows redirects manually, revalidating the host
+ * allowlist + private-IP check on every hop. Throws `McpError` for blocked
+ * URLs, non-2xx responses, oversize bodies, or timeouts.
+ */
+export declare function safeFetch(urlStr: string, opts?: SafeFetchOptions): Promise<SafeFetchResult>;
+//# sourceMappingURL=safe-fetch.d.ts.map

package/dist/lib/safe-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.d.ts","sourceRoot":"","sources":["../../src/lib/safe-fetch.ts"],"names":[],"mappings":"AAkHA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,EAAE,CAAA;CACf,CAAA;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,eAAe,CAAC,CA6F1B"}

package/dist/lib/safe-fetch.js

@@ -0,0 +1,221 @@
+import { isIPv4, isIPv6 } from 'node:net';
+import { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+/**
+ * SSRF-safe fetch for user-supplied URLs (image URLs in vision tools).
+ *
+ * Blocks the usual server-side-request-forgery attack surface:
+ * - loopback (127.0.0.0/8, ::1)
+ * - link-local (169.254.0.0/16 — includes cloud metadata at 169.254.169.254)
+ * - private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7)
+ * - non-http(s) schemes
+ * - manual-redirect with the same allowlist applied to each hop
+ * - max body size (default 20 MB)
+ * - request timeout (default 10 s)
+ *
+ * Optional allowlist via `PASCAL_ALLOWED_ASSET_ORIGINS` env var (comma-separated).
+ *
+ * Phase 10 A2 found that photo_to_scene / analyze_floorplan_image /
+ * analyze_room_photo all called raw `fetch(url)` with no protection, giving
+ * a direct `169.254.169.254` exfil primitive on any host.
+ */
+const DEFAULT_MAX_BYTES = 20 * 1024 * 1024; // 20 MB
+const DEFAULT_TIMEOUT_MS = 10_000;
+const MAX_REDIRECTS = 3;
+function isPrivateOrLoopbackV4(addr) {
+    const parts = addr.split('.').map(Number);
+    if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
+        return true; // malformed → treat as unsafe
+    const [a, b] = parts;
+    if (a === 127)
+        return true; // 127.0.0.0/8 loopback
+    if (a === 10)
+        return true; // 10.0.0.0/8 private
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // 172.16.0.0/12 private
+    if (a === 192 && b === 168)
+        return true; // 192.168.0.0/16 private
+    if (a === 169 && b === 254)
+        return true; // link-local incl. cloud metadata
+    if (a === 0)
+        return true; // current-network
+    if (a >= 224)
+        return true; // multicast / reserved
+    return false;
+}
+function isPrivateOrLoopbackV6(addr) {
+    const lower = addr.toLowerCase();
+    if (lower === '::1' || lower === '::')
+        return true;
+    if (lower.startsWith('fe80:') ||
+        lower.startsWith('fe90:') ||
+        lower.startsWith('fea0:') ||
+        lower.startsWith('feb0:'))
+        return true; // link-local
+    if (lower.startsWith('fc') || lower.startsWith('fd'))
+        return true; // ULA fc00::/7
+    if (lower.startsWith('::ffff:')) {
+        // v4-mapped
+        const v4 = lower.slice(7);
+        if (isIPv4(v4))
+            return isPrivateOrLoopbackV4(v4);
+    }
+    return false;
+}
+function isUnsafeHost(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, ''); // strip IPv6 brackets if any
+    if (isIPv4(host))
+        return isPrivateOrLoopbackV4(host);
+    if (isIPv6(host))
+        return isPrivateOrLoopbackV6(host);
+    // Hostname (not IP) — block well-known local names.
+    const lower = host.toLowerCase();
+    if (lower === 'localhost' ||
+        lower.endsWith('.localhost') ||
+        lower === 'broadcasthost' ||
+        lower.endsWith('.local') ||
+        lower.endsWith('.internal') ||
+        lower.endsWith('.corp')) {
+        return true;
+    }
+    return false;
+}
+function assertAllowedUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new McpError(ErrorCode.InvalidParams, 'invalid_url', { url });
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new McpError(ErrorCode.InvalidParams, 'url_scheme_not_allowed', {
+            url,
+            protocol: parsed.protocol,
+        });
+    }
+    if (isUnsafeHost(parsed.hostname)) {
+        throw new McpError(ErrorCode.InvalidParams, 'url_host_blocked', {
+            url,
+            hostname: parsed.hostname,
+        });
+    }
+    // Optional env-allowlist narrowing.
+    const allowEnv = process.env.PASCAL_ALLOWED_ASSET_ORIGINS;
+    if (allowEnv) {
+        const origins = allowEnv
+            .split(',')
+            .map((s) => s.trim())
+            .filter(Boolean);
+        if (!origins.includes(parsed.origin)) {
+            throw new McpError(ErrorCode.InvalidParams, 'url_origin_not_allowlisted', {
+                url,
+                origin: parsed.origin,
+            });
+        }
+    }
+    return parsed;
+}
+/**
+ * SSRF-safe fetch that follows redirects manually, revalidating the host
+ * allowlist + private-IP check on every hop. Throws `McpError` for blocked
+ * URLs, non-2xx responses, oversize bodies, or timeouts.
+ */
+export async function safeFetch(urlStr, opts = {}) {
+    const maxBytes = opts.maxBytes ?? DEFAULT_MAX_BYTES;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const hops = [];
+    let current = urlStr;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        for (let i = 0; i <= MAX_REDIRECTS; i++) {
+            const parsed = assertAllowedUrl(current);
+            hops.push(parsed.toString());
+            const res = await fetch(parsed, {
+                redirect: 'manual',
+                signal: controller.signal,
+                headers: opts.accept ? { Accept: opts.accept } : undefined,
+            });
+            // Manual redirect handling
+            if (res.status >= 300 && res.status < 400) {
+                const location = res.headers.get('location');
+                if (!location) {
+                    throw new McpError(ErrorCode.InvalidParams, 'redirect_without_location', {
+                        url: parsed.toString(),
+                        status: res.status,
+                    });
+                }
+                current = new URL(location, parsed).toString();
+                continue;
+            }
+            if (!res.ok) {
+                throw new McpError(ErrorCode.InvalidParams, 'fetch_failed', {
+                    url: parsed.toString(),
+                    status: res.status,
+                    statusText: res.statusText,
+                });
+            }
+            // Enforce Content-Length up front if present.
+            const declared = Number(res.headers.get('content-length'));
+            if (Number.isFinite(declared) && declared > maxBytes) {
+                throw new McpError(ErrorCode.InvalidParams, 'response_too_large', {
+                    url: parsed.toString(),
+                    declared,
+                    maxBytes,
+                });
+            }
+            // Stream with a running cap so servers that lie about length still get bounded.
+            const reader = res.body?.getReader();
+            if (!reader) {
+                throw new McpError(ErrorCode.InvalidParams, 'empty_response', {
+                    url: parsed.toString(),
+                });
+            }
+            const chunks = [];
+            let total = 0;
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                if (value) {
+                    total += value.byteLength;
+                    if (total > maxBytes) {
+                        try {
+                            await reader.cancel();
+                        }
+                        catch {
+                            // ignore
+                        }
+                        throw new McpError(ErrorCode.InvalidParams, 'response_too_large', {
+                            url: parsed.toString(),
+                            received: total,
+                            maxBytes,
+                        });
+                    }
+                    chunks.push(value);
+                }
+            }
+            return {
+                buffer: Buffer.concat(chunks.map((c) => Buffer.from(c))),
+                contentType: res.headers.get('content-type'),
+                finalUrl: parsed.toString(),
+                hops,
+            };
+        }
+        throw new McpError(ErrorCode.InvalidParams, 'too_many_redirects', {
+            hops: hops.slice(0, MAX_REDIRECTS + 1),
+        });
+    }
+    catch (err) {
+        if (err instanceof McpError)
+            throw err;
+        if (err.name === 'AbortError') {
+            throw new McpError(ErrorCode.InvalidParams, 'fetch_timeout', { url: urlStr, timeoutMs });
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        throw new McpError(ErrorCode.InvalidParams, 'fetch_error', { url: urlStr, message });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/operations/index.d.ts

@@ -0,0 +1,2 @@
+export { type CreateSceneOperationsOptions, createSceneOperations, type SceneOperations, } from './scene-operations';
+//# sourceMappingURL=index.d.ts.map

package/dist/operations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/operations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAA"}

package/dist/operations/index.js

@@ -0,0 +1 @@
+export { createSceneOperations, } from './scene-operations';

package/dist/operations/scene-operations.d.ts

@@ -0,0 +1,67 @@
+import type { SceneGraph } from '@pascal-app/core/clone-scene-graph';
+import type { AnyNode, AnyNodeId, AnyNodeType } from '@pascal-app/core/schema';
+import type { ActiveSceneMeta, Patch, SceneBridge, ValidationResult } from '../bridge/scene-bridge';
+import type { ProjectCreateOptions, ProjectStatus, SceneEvent, SceneEventAppendOptions, SceneEventListOptions, SceneListOptions, SceneMeta, SceneMutateOptions, SceneSaveOptions, SceneStore, SceneWithGraph } from '../storage/types';
+export type CreateSceneOperationsOptions = {
+    bridge?: SceneBridge;
+    store?: SceneStore;
+};
+export interface SceneOperations {
+    readonly hasBridge: boolean;
+    readonly hasStore: boolean;
+    readonly hasSceneEvents: boolean;
+    readonly canAppendSceneEvents: boolean;
+    readonly canListSceneEvents: boolean;
+    readonly canCreateProject: boolean;
+    readonly canGetProjectStatus: boolean;
+    readonly storeBackend: SceneStore['backend'] | null;
+    setActiveScene(meta: ActiveSceneMeta): void;
+    getActiveScene(): ActiveSceneMeta | null;
+    clearActiveScene(): void;
+    loadDefault(): void;
+    setScene(nodes: Record<AnyNodeId, AnyNode>, rootNodeIds: AnyNodeId[]): void;
+    exportJSON(): SceneGraph & {
+        collections: Record<string, unknown>;
+    };
+    exportSceneGraph(): SceneGraph;
+    loadJSON(json: string | SceneGraph): void;
+    getNode(id: AnyNodeId): AnyNode | null;
+    getNodes(): Record<AnyNodeId, AnyNode>;
+    getRootNodeIds(): AnyNodeId[];
+    getChildren(parentId: AnyNodeId): AnyNode[];
+    getAncestry(id: AnyNodeId): AnyNode[];
+    findNodes(filter: {
+        type?: AnyNodeType;
+        parentId?: AnyNodeId | null;
+        levelId?: AnyNodeId;
+    }): AnyNode[];
+    resolveLevelId(id: AnyNodeId): AnyNodeId | null;
+    createNode(node: AnyNode, parentId?: AnyNodeId): AnyNodeId;
+    updateNode(id: AnyNodeId, data: Partial<AnyNode>): void;
+    deleteNode(id: AnyNodeId, cascade?: boolean): string[];
+    applyPatch(patches: Patch[]): {
+        appliedOps: number;
+        deletedIds: AnyNodeId[];
+        createdIds: AnyNodeId[];
+    };
+    undo(steps?: number): number;
+    redo(steps?: number): number;
+    validateScene(): ValidationResult;
+    flushDirty(): string[];
+    getHistory(): {
+        pastCount: number;
+        futureCount: number;
+    };
+    clearHistory(): void;
+    createProject(options: ProjectCreateOptions): Promise<ProjectStatus>;
+    getProjectStatus(id: string): Promise<ProjectStatus | null>;
+    saveScene(options: SceneSaveOptions): Promise<SceneMeta>;
+    loadStoredScene(id: string): Promise<SceneWithGraph | null>;
+    listScenes(options?: SceneListOptions): Promise<SceneMeta[]>;
+    deleteStoredScene(id: string, options?: SceneMutateOptions): Promise<boolean>;
+    renameStoredScene(id: string, newName: string, options?: SceneMutateOptions): Promise<SceneMeta>;
+    appendSceneEvent(options: SceneEventAppendOptions): Promise<SceneEvent | null>;
+    listSceneEvents(id: string, options?: SceneEventListOptions): Promise<SceneEvent[]>;
+}
+export declare function createSceneOperations(options: CreateSceneOperationsOptions): SceneOperations;
+//# sourceMappingURL=scene-operations.d.ts.map

package/dist/operations/scene-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scene-operations.d.ts","sourceRoot":"","sources":["../../src/operations/scene-operations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACnG,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,EAChB,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACf,MAAM,kBAAkB,CAAA;AAEzB,MAAM,MAAM,4BAA4B,GAAG;IACzC,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,KAAK,CAAC,EAAE,UAAU,CAAA;CACnB,CAAA;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;IAClC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;IACrC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAA;IAEnD,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAAA;IAC3C,cAAc,IAAI,eAAe,GAAG,IAAI,CAAA;IACxC,gBAAgB,IAAI,IAAI,CAAA;IACxB,WAAW,IAAI,IAAI,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,IAAI,CAAA;IAC3E,UAAU,IAAI,UAAU,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAA;IACnE,gBAAgB,IAAI,UAAU,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IACzC,OAAO,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,GAAG,IAAI,CAAA;IACtC,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACtC,cAAc,IAAI,SAAS,EAAE,CAAA;IAC7B,WAAW,CAAC,QAAQ,EAAE,SAAS,GAAG,OAAO,EAAE,CAAA;IAC3C,WAAW,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,EAAE,CAAA;IACrC,SAAS,CAAC,MAAM,EAAE;QAChB,IAAI,CAAC,EAAE,WAAW,CAAA;QAClB,QAAQ,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;QAC3B,OAAO,CAAC,EAAE,SAAS,CAAA;KACpB,GAAG,OAAO,EAAE,CAAA;IACb,cAAc,CAAC,EAAE,EAAE,SAAS,GAAG,SAAS,GAAG,IAAI,CAAA;IAC/C,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IAC1D,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAA;IACvD,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAA;IACtD,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG;QAC5B,UAAU,EAAE,MAAM,CAAA;QAClB,UAAU,EAAE,SAAS,EAAE,CAAA;QACvB,UAAU,EAAE,SAAS,EAAE,CAAA;KACxB,CAAA;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAC5B,aAAa,IAAI,gBAAgB,CAAA;IACjC,UAAU,IAAI,MAAM,EAAE,CAAA;IACtB,UAAU,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;IACxD,YAAY,IAAI,IAAI,CAAA;IAEpB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACpE,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IAC3D,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACxD,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAA;IAC3D,UAAU,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAC5D,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7E,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAChG,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAC9E,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;CACpF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,eAAe,CAE5F"}

package/dist/operations/scene-operations.js

@@ -0,0 +1,192 @@
+export function createSceneOperations(options) {
+    return new SceneOperationsFacade(options);
+}
+class SceneOperationsFacade {
+    #bridge;
+    #store;
+    constructor(options) {
+        this.#bridge = options.bridge;
+        this.#store = options.store;
+    }
+    get hasBridge() {
+        return this.#bridge !== undefined;
+    }
+    get hasStore() {
+        return this.#store !== undefined;
+    }
+    get hasSceneEvents() {
+        return this.canAppendSceneEvents && this.canListSceneEvents;
+    }
+    get canAppendSceneEvents() {
+        return typeof this.#store?.appendSceneEvent === 'function';
+    }
+    get canListSceneEvents() {
+        return typeof this.#store?.listSceneEvents === 'function';
+    }
+    get canCreateProject() {
+        return typeof this.#store?.createProject === 'function';
+    }
+    get canGetProjectStatus() {
+        return typeof this.#store?.getProjectStatus === 'function';
+    }
+    get storeBackend() {
+        return this.#store?.backend ?? null;
+    }
+    setActiveScene(meta) {
+        this.requireBridge().setActiveScene(meta);
+    }
+    getActiveScene() {
+        return this.requireBridge().getActiveScene();
+    }
+    clearActiveScene() {
+        this.requireBridge().clearActiveScene();
+    }
+    loadDefault() {
+        this.requireBridge().loadDefault();
+    }
+    setScene(nodes, rootNodeIds) {
+        this.requireBridge().setScene(nodes, rootNodeIds);
+    }
+    exportJSON() {
+        return this.requireBridge().exportJSON();
+    }
+    exportSceneGraph() {
+        const exported = this.exportJSON();
+        return {
+            nodes: exported.nodes,
+            rootNodeIds: exported.rootNodeIds,
+            collections: exported.collections,
+        };
+    }
+    loadJSON(json) {
+        this.requireBridge().loadJSON(json);
+    }
+    getNode(id) {
+        return this.requireBridge().getNode(id);
+    }
+    getNodes() {
+        return this.requireBridge().getNodes();
+    }
+    getRootNodeIds() {
+        return this.requireBridge().getRootNodeIds();
+    }
+    getChildren(parentId) {
+        return this.requireBridge().getChildren(parentId);
+    }
+    getAncestry(id) {
+        return this.requireBridge().getAncestry(id);
+    }
+    findNodes(filter) {
+        return this.requireBridge().findNodes(filter);
+    }
+    resolveLevelId(id) {
+        return this.requireBridge().resolveLevelId(id);
+    }
+    createNode(node, parentId) {
+        return this.requireBridge().createNode(node, parentId);
+    }
+    updateNode(id, data) {
+        this.requireBridge().updateNode(id, data);
+    }
+    deleteNode(id, cascade) {
+        return this.requireBridge().deleteNode(id, cascade);
+    }
+    applyPatch(patches) {
+        return this.requireBridge().applyPatch(patches);
+    }
+    undo(steps) {
+        return this.requireBridge().undo(steps);
+    }
+    redo(steps) {
+        return this.requireBridge().redo(steps);
+    }
+    validateScene() {
+        return this.requireBridge().validateScene();
+    }
+    flushDirty() {
+        return this.requireBridge().flushDirty();
+    }
+    getHistory() {
+        return this.requireBridge().getHistory();
+    }
+    clearHistory() {
+        this.requireBridge().clearHistory();
+    }
+    async createProject(options) {
+        const store = this.requireStore();
+        if (!store.createProject) {
+            throw new Error('create_project_unavailable');
+        }
+        return store.createProject(options);
+    }
+    async getProjectStatus(id) {
+        const store = this.requireStore();
+        if (store.getProjectStatus) {
+            return store.getProjectStatus(id);
+        }
+        const scene = await store.load(id);
+        if (!scene)
+            return null;
+        const editorUrl = scene.editorUrl ?? `/editor/${scene.id}`;
+        return {
+            id: scene.id,
+            projectId: scene.projectId ?? scene.id,
+            name: scene.name,
+            editorUrl,
+            url: editorUrl,
+            ownerId: scene.ownerId,
+            thumbnailUrl: scene.thumbnailUrl,
+            publishedVersion: scene.published === false ? null : scene.version,
+            latestVersion: scene.version,
+            draftVersion: null,
+            browserVisibleVersion: scene.version,
+            version: scene.version,
+            isEmpty: scene.nodeCount === 0,
+            sizeBytes: scene.sizeBytes,
+            nodeCount: scene.nodeCount,
+            graphHash: scene.graphHash ?? null,
+            createdAt: scene.createdAt,
+            updatedAt: scene.updatedAt,
+        };
+    }
+    async saveScene(options) {
+        return this.requireStore().save(options);
+    }
+    async loadStoredScene(id) {
+        return this.requireStore().load(id);
+    }
+    async listScenes(options) {
+        return this.requireStore().list(options);
+    }
+    async deleteStoredScene(id, options) {
+        return this.requireStore().delete(id, options);
+    }
+    async renameStoredScene(id, newName, options) {
+        return this.requireStore().rename(id, newName, options);
+    }
+    async appendSceneEvent(options) {
+        const append = this.requireStore().appendSceneEvent;
+        if (!append)
+            return null;
+        return append(options);
+    }
+    async listSceneEvents(id, options) {
+        const list = this.requireStore().listSceneEvents;
+        if (!list) {
+            throw new Error('scene_events_unavailable');
+        }
+        return list(id, options);
+    }
+    requireBridge() {
+        if (!this.#bridge) {
+            throw new Error('scene_bridge_unavailable');
+        }
+        return this.#bridge;
+    }
+    requireStore() {
+        if (!this.#store) {
+            throw new Error('scene_store_unavailable');
+        }
+        return this.#store;
+    }
+}

package/dist/prompts/from-brief.d.ts

@@ -0,0 +1,11 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { SceneOperations } from '../operations';
+/**
+ * Build the user-facing prompt text for `from_brief`. Pure function for testability.
+ */
+export declare function buildFromBriefPrompt(args: {
+    brief: string;
+    constraints?: string | undefined;
+}): string;
+export declare function registerFromBrief(server: McpServer, _bridge: SceneOperations): void;
+//# sourceMappingURL=from-brief.d.ts.map

package/dist/prompts/from-brief.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-brief.d.ts","sourceRoot":"","sources":["../../src/prompts/from-brief.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAExE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAmBpD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC,GAAG,MAAM,CAWT;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CAwBnF"}

package/dist/prompts/from-brief.js

@@ -0,0 +1,48 @@
+import { z } from 'zod';
+import { SCENE_DESIGN_GUIDANCE } from './scene-guidance';
+const PREAMBLE = [
+    'You are a Pascal 3D scene designer.',
+    'You have access to semantic scene tools and the lower-level `apply_patch` tool. Prefer semantic construction/room/opening/furnishing tools for architectural work, and use `apply_patch` for bulk graph edits that need exact control.',
+    'If the user asks for a new project, call `create_project` before building. Use `create_house_from_brief` for a fast starter, then refine with semantic tools. Semantic tools update the browser-visible draft; call `save_scene` with `saveMode: "checkpoint"` only for meaningful milestones, then call `verify_scene` and `get_project_status`, and return the final `editorUrl`.',
+    'Build incrementally with visible progress. Starting from an empty scene, first create/load a Site and Building, then create occupied Levels and `create_story_shell` once per story before detailed rooms, openings, furniture, a dedicated roof level via `create_roof`, and landscaping.',
+    'Respect these invariants:',
+    '  - Levels live under a Building.',
+    '  - Walls, fences, zones, slabs, ceilings, roofs, stairs live under a Level.',
+    '  - Multi-story exterior walls are per-level story walls; never make lower-level walls taller to stand in for upper-level walls.',
+    '  - Doors and windows live under a Wall (parentId = wallId).',
+    '  - Floor items live under a Level; wall/ceiling-attached items live under their target Wall or Ceiling. Do not place items directly under the Site node.',
+    'Use realistic dimensions in meters. Keep wall thickness small (0.1–0.3 m) and ceiling height 2.4–3.0 m unless the brief dictates otherwise.',
+    SCENE_DESIGN_GUIDANCE,
+    'Respond ONLY with tool calls. Do not produce verbose narrative or prose; keep any explanations in short tool-call arguments.',
+].join('\n');
+/**
+ * Build the user-facing prompt text for `from_brief`. Pure function for testability.
+ */
+export function buildFromBriefPrompt(args) {
+    const parts = [PREAMBLE, '', '## Brief', args.brief.trim()];
+    if (args.constraints && args.constraints.trim().length > 0) {
+        parts.push('', '## Constraints', args.constraints.trim());
+    }
+    parts.push('', '## Task', 'Produce tool calls that realise the brief within the stated constraints. For a new project, call create_project first. Use create_house_from_brief for a fast starter or prefer create_story_shell/create_room/add_door/add_window/create_stair_between_levels/create_roof/furnish_room for architectural layout, use apply_patch for exact bulk graph work, call save_scene with saveMode: "checkpoint" only when the design reaches a meaningful milestone, then call validate_scene, verify_scene, and get_project_status.');
+    return parts.join('\n');
+}
+export function registerFromBrief(server, _bridge) {
+    server.registerPrompt('from_brief', {
+        title: 'Generate a Pascal scene from a brief',
+        description: 'Produces a plan of apply_patch calls to create a scene from a natural-language brief.',
+        argsSchema: {
+            brief: z.string(),
+            constraints: z.string().optional(),
+        },
+    }, async ({ brief, constraints }) => ({
+        messages: [
+            {
+                role: 'user',
+                content: {
+                    type: 'text',
+                    text: buildFromBriefPrompt({ brief, constraints }),
+                },
+            },
+        ],
+    }));
+}

package/dist/prompts/index.d.ts

@@ -0,0 +1,10 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { SceneOperations } from '../operations';
+/**
+ * Registers all MCP prompts exposed by `@pascal-app/mcp`:
+ * - `from_brief`                — generate a scene from a natural-language brief
+ * - `iterate_on_feedback`       — minimal-diff patches from user feedback
+ * - `renovation_from_photos`    — photo-driven renovation plan via vision tools
+ */
+export declare function registerPrompts(server: McpServer, operations: SceneOperations): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/prompts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAKpD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,GAAG,IAAI,CAIpF"}

package/dist/prompts/index.js

@@ -0,0 +1,14 @@
+import { registerFromBrief } from './from-brief';
+import { registerIterateOnFeedback } from './iterate-on-feedback';
+import { registerRenovationFromPhotos } from './renovation-from-photos';
+/**
+ * Registers all MCP prompts exposed by `@pascal-app/mcp`:
+ * - `from_brief`                — generate a scene from a natural-language brief
+ * - `iterate_on_feedback`       — minimal-diff patches from user feedback
+ * - `renovation_from_photos`    — photo-driven renovation plan via vision tools
+ */
+export function registerPrompts(server, operations) {
+    registerFromBrief(server, operations);
+    registerIterateOnFeedback(server, operations);
+    registerRenovationFromPhotos(server, operations);
+}

package/dist/prompts/iterate-on-feedback.d.ts

@@ -0,0 +1,11 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { SceneOperations } from '../operations';
+/**
+ * Build the user-facing prompt text for `iterate_on_feedback`.
+ * Pure function for testability.
+ */
+export declare function buildIterateOnFeedbackPrompt(args: {
+    feedback: string;
+}): string;
+export declare function registerIterateOnFeedback(server: McpServer, _bridge: SceneOperations): void;
+//# sourceMappingURL=iterate-on-feedback.d.ts.map