pmx-canvas 0.1.36 → 0.2.0

package/src/server/server.ts

@@ -47,7 +47,7 @@ import type {
   ListResourceTemplatesResult,
   ListToolsResult,
 } from '@modelcontextprotocol/sdk/types.js';
-import { type CanvasAnnotation, type CanvasEdge, type CanvasLayout, type CanvasNodeState, IMAGE_MIME_MAP, canvasState } from './canvas-state.js';
+import { type CanvasAnnotation, type CanvasLayout, type CanvasNodeState, IMAGE_MIME_MAP, canvasState } from './canvas-state.js';
 import { buildAxBridge, buildAxStateBridge, buildContentHeightReporter, buildHtmlSurfaceDocument, HTML_SURFACE_SANDBOX, normalizeSurfaceTheme } from './html-surface.js';
 import { findCanvasExtAppNodeId as findCanvasExtAppNodeIdShared } from './ext-app-lookup.js';
 import { normalizeExtAppToolResult } from './ext-app-tool-result.js';
@@ -60,99 +60,54 @@ import {
   listMcpAppResources,
   listMcpAppResourceTemplates,
   listMcpAppTools,
-  openMcpApp,
   readMcpAppResource,
-  type ExternalMcpTransportConfig,
 } from './mcp-app-runtime.js';
 import { findOpenCanvasPosition, computeGroupBounds } from './placement.js';
-import { searchNodes, buildSpatialContext } from './spatial-analysis.js';
-import { diffLayouts, formatDiff, mutationHistory } from './mutation-history.js';
-import {
-  buildCanvasSummary,
-  serializeCanvasLayout,
-  serializeCanvasLayoutWithBlobSummaries,
-  serializeCanvasNode,
-  serializeCanvasNodeWithBlobSummaries,
-  summarizeCanvasAnnotation,
-} from './canvas-serialization.js';
+import { mutationHistory } from './mutation-history.js';
+import { summarizeCanvasAnnotation } from './canvas-serialization.js';
 import { buildCodeGraphSummary, formatCodeGraph } from './code-graph.js';
 import { buildAgentContextPreamble, serializeNodeForAgentContext } from './agent-context.js';
 import { buildCanvasAxContext, buildCanvasAxSurfaceSnapshot } from './ax-context.js';
-import { applyAxInteraction, resolveNodeAxCapabilities, normalizeNodeAxCapabilities } from './ax-interaction.js';
-import { isAxEventKind, isAxEvidenceKind, isAxActivityKind } from './ax-state.js';
-import { waitForAxResolution, AX_WAIT_MAX_MS } from './ax-wait.js';
+import { applyAxInteraction, resolveNodeAxCapabilities } from './ax-interaction.js';
+import { isAxEvidenceKind, isAxActivityKind } from './ax-state.js';
 import type {
   PmxAxEvidenceKind,
   PmxAxPolicy,
   PmxAxReviewAnchorType,
   PmxAxReviewKind,
-  PmxAxReviewRegion,
   PmxAxReviewSeverity,
-  PmxAxReviewStatus,
   PmxAxSource,
   PmxAxWorkItemStatus,
 } from './ax-state.js';
 import { normalizeCanvasTheme, type CanvasTheme } from './canvas-db.js';
 import { validateLocalImageFile } from './image-source.js';
 import {
-  addCanvasNode,
-  addCanvasEdge,
-  MARKDOWN_NODE_DEFAULT_SIZE,
-  MCP_APP_NODE_DEFAULT_SIZE,
-  IMAGE_NODE_DEFAULT_SIZE,
-  LEDGER_NODE_DEFAULT_SIZE,
   applyCanvasNodeUpdates,
-  appendCanvasJsonRenderStream,
-  buildStructuredNodeUpdate,
-  arrangeCanvasNodes,
-  clearCanvas,
-  createCanvasGraphNode,
-  createCanvasGroup,
-  createCanvasJsonRenderNode,
-  createCanvasStreamingJsonRenderNode,
-  deleteCanvasSnapshot,
-  executeCanvasBatch,
-  fitCanvasView,
-  gcCanvasSnapshots,
-  groupCanvasNodes,
-  listCanvasSnapshots,
   refreshCanvasWebpageNode,
-  removeCanvasNode,
-  removeCanvasEdge,
-  resolveHtmlContent,
-  restoreCanvasSnapshot,
-  saveCanvasSnapshot,
-  scheduleCodeGraphRecompute,
   primeCanvasRuntimeBackends,
   setCanvasLayoutUpdateEmitter,
   syncCanvasRuntimeBackends,
-  setCanvasContextPins,
-  ungroupCanvasNodes,
-  validateCanvasNodePatch,
-  hasStructuredNodeUpdateFields,
-  hasTraceNodeDataFields,
-  mergeTraceNodeDataFields,
 } from './canvas-operations.js';
-import { validateCanvasLayout } from './canvas-validation.js';
-import { describeCanvasSchema, validateStructuredCanvasPayload } from './canvas-schema.js';
-import { buildHtmlPrimitive, getHtmlPrimitiveSemanticMetadata, isHtmlPrimitiveKind } from './html-primitives.js';
+import { dispatchOperationRoute, setOperationEventEmitter } from './operations/index.js';
+import { setWebviewRunner } from './operations/webview-runner.js';
+import {
+  closeNodeAppSession,
+  nodeAppSessionId,
+} from './operations/ops/nodes.js';
 import {
   EXCALIDRAW_READ_CHECKPOINT_TOOL,
   EXCALIDRAW_SAVE_CHECKPOINT_TOOL,
   buildExcalidrawCheckpointId,
-  buildExcalidrawOpenMcpAppInput,
   buildExcalidrawRestoreCheckpointToolInput,
   ensureExcalidrawCheckpointId,
   getExcalidrawCheckpointIdFromToolResult,
   isExcalidrawCreateView,
 } from './diagram-presets.js';
 import { traceManager } from './trace-manager.js';
-import { buildWebArtifactOnCanvas, resolveWorkspacePath } from './web-artifacts.js';
 import {
   buildJsonRenderViewerHtml,
 } from '../json-render/server.js';
 import {
-  WEBPAGE_NODE_DEFAULT_SIZE,
   normalizeWebpageUrl,
 } from './webpage-node.js';
 import type { JsonRenderSpec } from '../json-render/server.js';
@@ -172,6 +127,52 @@ let primaryWorkbenchAutoOpenEnabled = true;
 const initialCanvasThemeSetting = normalizeCanvasTheme(process.env.PMX_CANVAS_THEME);
 let lastWorkbenchContextCardsEnvelope: Record<string, unknown> | null = null;
 
+// Operation-registry SSE wiring (plan-005): the registry never imports this
+// module — the workbench event emitter is injected here, mirroring the
+// setCanvasLayoutUpdateEmitter pattern. Wired at module top level so local
+// (in-process) MCP/SDK invocations emit even without startCanvasServer().
+setOperationEventEmitter((event, payload) => {
+  emitPrimaryWorkbenchEvent(event, payload);
+});
+
+// Webview-runner wiring (plan-008 Wave 3): the webview ops never import this
+// module — the Bun.WebView automation runner is injected here, mirroring the
+// setOperationEventEmitter pattern. The closures call the real automation
+// functions (declared below, hoisted) so a webview op resolves to the same
+// machinery the legacy hand-written tools/routes used. `screenshot` stays out —
+// it returns binary and remains the standalone canvas_screenshot tool.
+setWebviewRunner({
+  status: () => getCanvasAutomationWebViewStatus(),
+  start: async (options) => {
+    const url = currentWorkbenchUrl();
+    if (!url) {
+      // Mirrors the legacy 503 "server not running" branch: no URL → not a
+      // start failure but a precondition error. Surface it through the
+      // error-shaped result so the op can map it to the same 503 wire body
+      // (no webview field, matching the legacy handler).
+      return {
+        ok: false as const,
+        serverNotRunning: true as const,
+        error: 'Canvas server is not running.',
+      };
+    }
+    try {
+      const webview = await startCanvasAutomationWebView(url, options);
+      return { ok: true as const, webview };
+    } catch (error) {
+      return {
+        ok: false as const,
+        error: error instanceof Error ? error.message : String(error),
+        // 500-vs-501 is read off webview.supported (the status), so no separate field.
+        webview: getCanvasAutomationWebViewStatus(),
+      };
+    }
+  },
+  stop: () => stopCanvasAutomationWebView(),
+  resize: (width, height) => resizeCanvasAutomationWebView(width, height),
+  evaluate: (expression) => evaluateCanvasAutomationWebView(expression),
+});
+
 function normalizeGraphViewerSpec(
   node: { type: string; data: Record<string, unknown> },
   spec: JsonRenderSpec,
@@ -719,155 +720,6 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
 
-function pickFiniteNumber(record: Record<string, unknown>, key: string): number | undefined {
-  const value = record[key];
-  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
-}
-
-function getRecord(value: unknown): Record<string, unknown> | undefined {
-  return isRecord(value) ? value : undefined;
-}
-
-function pickPositiveNumber(record: Record<string, unknown>, key: string): number | undefined {
-  const value = pickFiniteNumber(record, key);
-  return value !== undefined && value > 0 ? value : undefined;
-}
-
-function normalizeGeometryInput(body: Record<string, unknown>): {
-  x?: number;
-  y?: number;
-  width?: number;
-  height?: number;
-  position?: { x?: number; y?: number };
-  size?: { width?: number; height?: number };
-} {
-  const position = getRecord(body.position);
-  const size = getRecord(body.size);
-  return {
-    ...(pickFiniteNumber(body, 'x') !== undefined ? { x: pickFiniteNumber(body, 'x') } : {}),
-    ...(pickFiniteNumber(body, 'y') !== undefined ? { y: pickFiniteNumber(body, 'y') } : {}),
-    ...(pickFiniteNumber(body, 'width') !== undefined ? { width: pickFiniteNumber(body, 'width') } : {}),
-    ...(pickFiniteNumber(body, 'height') !== undefined ? { height: pickFiniteNumber(body, 'height') } : {}),
-    ...(position ? {
-      position: {
-        ...(pickFiniteNumber(position, 'x') !== undefined ? { x: pickFiniteNumber(position, 'x') } : {}),
-        ...(pickFiniteNumber(position, 'y') !== undefined ? { y: pickFiniteNumber(position, 'y') } : {}),
-      },
-    } : {}),
-    ...(size ? {
-      size: {
-        ...(pickFiniteNumber(size, 'width') !== undefined ? { width: pickFiniteNumber(size, 'width') } : {}),
-        ...(pickFiniteNumber(size, 'height') !== undefined ? { height: pickFiniteNumber(size, 'height') } : {}),
-      },
-    } : {}),
-  };
-}
-
-function resolveCreateGeometry(body: Record<string, unknown>): {
-  x?: number;
-  y?: number;
-  width?: number;
-  height?: number;
-} {
-  const geometry = normalizeGeometryInput(body);
-  const x = geometry.x ?? geometry.position?.x;
-  const y = geometry.y ?? geometry.position?.y;
-  const width = geometry.width ?? geometry.size?.width;
-  const height = geometry.height ?? geometry.size?.height;
-  return {
-    ...(x !== undefined ? { x } : {}),
-    ...(y !== undefined ? { y } : {}),
-    ...(width !== undefined ? { width } : {}),
-    ...(height !== undefined ? { height } : {}),
-  };
-}
-
-function resolvePatchGeometry(
-  body: Record<string, unknown>,
-  existing: CanvasNodeState,
-): {
-  position?: { x: number; y: number };
-  size?: { width: number; height: number };
-} {
-  const geometry = normalizeGeometryInput(body);
-  const x = geometry.x ?? geometry.position?.x;
-  const y = geometry.y ?? geometry.position?.y;
-  const width = geometry.width ?? geometry.size?.width;
-  const height = geometry.height ?? geometry.size?.height;
-  return {
-    ...(x !== undefined || y !== undefined
-      ? { position: { x: x ?? existing.position.x, y: y ?? existing.position.y } }
-      : {}),
-    ...(width !== undefined || height !== undefined
-      ? { size: { width: width ?? existing.size.width, height: height ?? existing.size.height } }
-      : {}),
-  };
-}
-
-function parseGraphPayloadData(value: unknown): Array<Record<string, unknown>> | null {
-  if (!Array.isArray(value)) return null;
-  if (value.some((item) => !isRecord(item))) return null;
-  return value as Array<Record<string, unknown>>;
-}
-
-type StringListField = { value?: string[]; error?: string };
-
-function parseStringListField(field: string, value: unknown): StringListField {
-  if (value === undefined) return {};
-  if (!Array.isArray(value)) return { error: `"${field}" must be an array of node IDs.` };
-  const invalid = value.find((item) => typeof item !== 'string' || item.trim().length === 0);
-  if (invalid !== undefined) return { error: `"${field}" must contain only non-empty node IDs.` };
-  return { value };
-}
-
-function pickGroupChildIds(body: Record<string, unknown>): StringListField {
-  if ('children' in body) return parseStringListField('children', body.children);
-  if ('childIds' in body) return parseStringListField('childIds', body.childIds);
-  const data = isRecord(body.data) ? body.data : undefined;
-  return data && 'children' in data ? parseStringListField('data.children', data.children) : {};
-}
-
-function validateGroupChildIds(groupId: string, childIds: string[]): string | null {
-  const missingChildIds = childIds.filter((id) => !canvasState.getNode(id));
-  if (missingChildIds.length > 0) {
-    return `Missing child node ID${missingChildIds.length === 1 ? '' : 's'}: ${missingChildIds.join(', ')}.`;
-  }
-  const invalidChildIds = childIds.filter((id) => {
-    const node = canvasState.getNode(id);
-    return id === groupId || node?.type === 'group';
-  });
-  if (invalidChildIds.length > 0) {
-    return `Invalid group child ID${invalidChildIds.length === 1 ? '' : 's'}: ${invalidChildIds.join(', ')}.`;
-  }
-  return null;
-}
-
-function setGroupChildrenFromApi(groupId: string, childIds: string[]): boolean {
-  const group = canvasState.getNode(groupId);
-  if (!group || group.type !== 'group') return false;
-
-  const dataChildIds = Array.isArray(group.data.children)
-    ? group.data.children.filter((id): id is string => typeof id === 'string')
-    : [];
-  const parentBackrefIds = canvasState.getLayout().nodes
-    .filter((node) => node.id !== groupId && node.data.parentGroup === groupId)
-    .map((node) => node.id);
-  const currentChildIds = [...new Set([...dataChildIds, ...parentBackrefIds])];
-  if (currentChildIds.length > 0) {
-    if (currentChildIds.length !== dataChildIds.length || currentChildIds.some((id) => !dataChildIds.includes(id))) {
-      canvasState.updateNode(groupId, { data: { ...group.data, children: currentChildIds } });
-    }
-    canvasState.ungroupNodes(groupId);
-  }
-  if (childIds.length === 0) return true;
-
-  const latestGroup = canvasState.getNode(groupId);
-  return canvasState.groupNodes(groupId, childIds, {
-    preservePositions: true,
-    keepGroupFrame: latestGroup?.data.frameMode === 'manual',
-  });
-}
-
 function getExtAppNodeCheckpointId(node: CanvasNodeState): string {
   const appCheckpoint = isRecord(node.data.appCheckpoint) ? node.data.appCheckpoint : null;
   const storedCheckpointId = appCheckpoint?.id;
@@ -1075,34 +927,6 @@ async function readJson(req: Request): Promise<Record<string, unknown>> {
   }
 }
 
-/**
- * Like {@link readJson}, but PRESERVES a top-level JSON array. For endpoints that
- * accept either an object or a bare array (e.g. `/api/canvas/batch`, whose CLI
- * help and handler both document a bare `[...]` form). readJson coerces arrays to
- * `{}` so object-shaped handlers never crash on `body.field`; this variant keeps
- * the array so the handler's array branch can run. Empty/whitespace/malformed
- * bodies still resolve to `{}`.
- */
-async function readJsonObjectOrArray(req: Request): Promise<Record<string, unknown> | unknown[]> {
-  let text = '';
-  try {
-    text = await req.text();
-  } catch (error) {
-    logWorkbenchWarning('readJson', error);
-    return {};
-  }
-  if (!text.trim()) return {};
-  try {
-    const value = JSON.parse(text) as unknown;
-    if (Array.isArray(value)) return value;
-    if (!value || typeof value !== 'object') return {};
-    return value as Record<string, unknown>;
-  } catch (error) {
-    logWorkbenchWarning('readJson', error);
-    return {};
-  }
-}
-
 function htmlEscape(value: string): string {
   return value
     .replaceAll('&', '&amp;')
@@ -1643,14 +1467,6 @@ async function handleCanvasAddAnnotation(req: Request): Promise<Response> {
   return responseJson({ ok: true, annotation: summarizeCanvasAnnotation(annotation) });
 }
 
-function handleCanvasRemoveAnnotation(id: string): Response {
-  const decodedId = decodeURIComponent(id);
-  const removed = canvasState.removeAnnotation(decodedId);
-  if (!removed) return responseJson({ ok: false, error: `Annotation "${decodedId}" not found.` }, 404);
-  emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  return responseJson({ ok: true, removed: decodedId });
-}
-
 // ── Serve image file for image nodes ─────────────────────────
 async function handleCanvasImage(pathname: string): Promise<Response> {
   const nodeId = pathname.replace('/api/canvas/image/', '');
@@ -1687,384 +1503,6 @@ async function handleCanvasImage(pathname: string): Promise<Response> {
   });
 }
 
-// ── Add node from client ─────────────────────────────────────
-const VALID_NODE_TYPES = new Set(['markdown', 'status', 'context', 'ledger', 'trace', 'file', 'image', 'mcp-app', 'webpage', 'html', 'group']);
-
-function buildNodeResponse(node: CanvasNodeState): Record<string, unknown> {
-  const serialized = serializeCanvasNode(node);
-  return {
-    ok: true,
-    node: serialized,
-    ...serialized,
-    // `nodeId` aliases `id` so HTTP/CLI node-create responses match the MCP
-    // createdNodePayload — agents using either key (or a cached schema) work.
-    nodeId: node.id,
-  };
-}
-
-function withContextPinReadState(node: CanvasNodeState): CanvasNodeState {
-  return {
-    ...node,
-    pinned: node.pinned || canvasState.contextPinnedNodeIds.has(node.id),
-  };
-}
-
-function withContextPinLayoutReadState(layout: CanvasLayout): CanvasLayout {
-  return {
-    ...layout,
-    nodes: layout.nodes.map(withContextPinReadState),
-  };
-}
-
-async function createCanvasWebpageNode(body: Record<string, unknown>): Promise<Response> {
-  const rawUrl = typeof body.url === 'string' && body.url.trim().length > 0
-    ? body.url
-    : typeof body.content === 'string'
-      ? body.content
-      : '';
-
-  let normalizedUrl: string;
-  try {
-    normalizedUrl = normalizeWebpageUrl(rawUrl);
-  } catch (error) {
-    return responseJson({ ok: false, error: error instanceof Error ? error.message : 'Invalid webpage URL.' }, 400);
-  }
-
-  const extraData = body.data && typeof body.data === 'object' && !Array.isArray(body.data)
-    ? body.data as Record<string, unknown>
-    : undefined;
-  const geometry = resolveCreateGeometry(body);
-  const { id, node } = addCanvasNode({
-    type: 'webpage',
-    ...(typeof body.title === 'string' ? { title: body.title } : {}),
-    content: normalizedUrl,
-    ...(extraData ? { data: extraData } : {}),
-    ...(body.strictSize === true ? { strictSize: true } : {}),
-    ...geometry,
-    ...(geometry.width === undefined ? { width: WEBPAGE_NODE_DEFAULT_SIZE.width } : {}),
-    ...(geometry.height === undefined ? { height: WEBPAGE_NODE_DEFAULT_SIZE.height } : {}),
-  });
-
-  emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  const refreshed = await refreshCanvasWebpageNode(id);
-  emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  const created = canvasState.getNode(id) ?? node;
-  return responseJson({
-    ...buildNodeResponse(created),
-    fetch: refreshed.ok
-      ? { ok: true }
-      : { ok: false, error: refreshed.error ?? 'Failed to fetch webpage content.' },
-    ...(refreshed.ok ? {} : { error: refreshed.error }),
-  });
-}
-
-async function handleCanvasAddNode(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const queryType = new URL(req.url).searchParams.get('type');
-  // Report #50: require a resolvable type rather than silently defaulting to a
-  // markdown node — an empty / type-less body created a phantom node before.
-  const type = typeof body.type === 'string' ? body.type : (queryType || '');
-  if (!type) {
-    return responseJson({
-      ok: false,
-      error: `node creation requires a 'type' — pass it in the JSON body ({ "type": "markdown", ... }) or as a ?type= query param. Valid types: ${[...VALID_NODE_TYPES].join(', ')} (json-render / graph / web-artifact have dedicated endpoints).`,
-    }, 400);
-  }
-
-  if (!VALID_NODE_TYPES.has(type)) {
-    if (type === 'json-render') {
-      return responseJson({
-        ok: false,
-        error: 'Node type "json-render" is created via POST /api/canvas/json-render. See /api/canvas/schema for the required spec shape.',
-      }, 400);
-    }
-    if (type === 'graph') {
-      return responseJson({
-        ok: false,
-        error: 'Node type "graph" is created via POST /api/canvas/graph. See /api/canvas/schema for graphType + data fields.',
-      }, 400);
-    }
-    if (type === 'web-artifact') {
-      return responseJson({
-        ok: false,
-        error: 'Node type "web-artifact" is created via POST /api/canvas/web-artifact with appTsx + title.',
-      }, 400);
-    }
-    if (type === 'html-primitive') {
-      return createCanvasHtmlPrimitiveNode(body);
-    }
-    return responseJson({ ok: false, error: `Invalid node type: "${type}".` }, 400);
-  }
-
-  if (type === 'webpage') {
-    return createCanvasWebpageNode(body);
-  }
-
-  if (type === 'html' && (typeof body.primitive === 'string' || typeof body.kind === 'string')) {
-    return createCanvasHtmlPrimitiveNode(body);
-  }
-
-  if (type === 'group') {
-    const geometry = resolveCreateGeometry(body);
-    const childList = pickGroupChildIds(body);
-    if (childList.error) return responseJson({ ok: false, error: `Cannot create group: ${childList.error}` }, 400);
-    const childIds = childList.value ?? [];
-    const childError = validateGroupChildIds('', childIds);
-    if (childError) return responseJson({ ok: false, error: `Cannot create group: ${childError}` }, 400);
-    const { node } = createCanvasGroup({
-      ...(typeof body.title === 'string' ? { title: body.title } : {}),
-      childIds,
-      ...(typeof body.color === 'string' ? { color: body.color } : {}),
-      ...geometry,
-    });
-    emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-    return responseJson(buildNodeResponse(node));
-  }
-
-  const extraData = body.data && typeof body.data === 'object' && !Array.isArray(body.data)
-    ? body.data as Record<string, unknown>
-    : undefined;
-  if (type === 'html') {
-    if ('html' in body && typeof body.html !== 'string') {
-      return responseJson({ ok: false, error: 'HTML node field "html" must be a string.' }, 400);
-    }
-    if (extraData && 'html' in extraData && typeof extraData.html !== 'string') {
-      return responseJson({ ok: false, error: 'HTML node field "data.html" must be a string.' }, 400);
-    }
-  }
-  const content = type === 'image' && typeof body.path === 'string' && typeof body.content !== 'string'
-    ? body.path
-    : body.content;
-  // For html nodes, accept top-level `html` AND `axCapabilities` and merge into data
-  // so callers can POST { type: 'html', title, html, axCapabilities } without nesting
-  // under `data` (report #53 — transport parity with MCP canvas_add_html_node). A
-  // top-level value overrides the same key under `data` (mirrors the `html` precedence).
-  const topAxCapabilities = type === 'html' ? normalizeNodeAxCapabilities(body.axCapabilities) : null;
-  const htmlMergedData = type === 'html'
-    ? {
-        ...(extraData ?? {}),
-        ...(typeof body.html === 'string' ? { html: resolveHtmlContent(body.html) } : {}),
-        ...(typeof body.summary === 'string' ? { summary: body.summary } : {}),
-        ...(typeof body.agentSummary === 'string' ? { agentSummary: body.agentSummary } : {}),
-        ...(typeof body.description === 'string' ? { description: body.description } : {}),
-        ...(body.presentation === true ? { presentation: true } : {}),
-        ...(Array.isArray(body.slideTitles) ? { slideTitles: body.slideTitles } : {}),
-        ...(Array.isArray(body.embeddedNodeIds) ? { embeddedNodeIds: body.embeddedNodeIds } : {}),
-        ...(Array.isArray(body.embeddedUrls) ? { embeddedUrls: body.embeddedUrls } : {}),
-        ...(topAxCapabilities ? { axCapabilities: topAxCapabilities } : {}),
-      }
-    : extraData;
-  let added: ReturnType<typeof addCanvasNode>;
-  const geometry = resolveCreateGeometry(body);
-  try {
-    added = addCanvasNode({
-      type: type as CanvasNodeState['type'],
-      ...(typeof body.title === 'string' ? { title: body.title } : {}),
-      ...(typeof content === 'string' ? { content } : {}),
-      ...(htmlMergedData && Object.keys(htmlMergedData).length > 0 ? { data: htmlMergedData } : {}),
-      ...(type === 'trace' && typeof body.toolName === 'string' ? { toolName: body.toolName } : {}),
-      ...(type === 'trace' && typeof body.category === 'string' ? { category: body.category } : {}),
-      ...(type === 'trace' && typeof body.status === 'string' ? { status: body.status } : {}),
-      ...(type === 'trace' && typeof body.duration === 'string' ? { duration: body.duration } : {}),
-      ...(type === 'trace' && typeof body.resultSummary === 'string' ? { resultSummary: body.resultSummary } : {}),
-      ...(type === 'trace' && typeof body.error === 'string' ? { error: body.error } : {}),
-      ...(body.strictSize === true ? { strictSize: true } : {}),
-      ...geometry,
-      defaultWidth: type === 'html'
-        ? 720
-        : type === 'markdown'
-          ? MARKDOWN_NODE_DEFAULT_SIZE.width
-          : type === 'mcp-app'
-            ? MCP_APP_NODE_DEFAULT_SIZE.width
-            : type === 'image'
-              ? IMAGE_NODE_DEFAULT_SIZE.width
-              : type === 'ledger'
-                ? LEDGER_NODE_DEFAULT_SIZE.width
-                : 360,
-      defaultHeight: type === 'html'
-        ? 640
-        : type === 'markdown'
-          ? MARKDOWN_NODE_DEFAULT_SIZE.height
-          : type === 'mcp-app'
-            ? MCP_APP_NODE_DEFAULT_SIZE.height
-            : type === 'image'
-              ? IMAGE_NODE_DEFAULT_SIZE.height
-              : type === 'ledger'
-                ? LEDGER_NODE_DEFAULT_SIZE.height
-                : 200,
-      fileMode: 'auto',
-    });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return responseJson({ ok: false, error: message }, 400);
-  }
-  const { node, needsCodeGraphRecompute } = added;
-
-  emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  if (needsCodeGraphRecompute) {
-    scheduleCodeGraphRecompute(() => {
-      emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-    });
-  }
-  return responseJson(buildNodeResponse(node));
-}
-
-function createCanvasHtmlPrimitiveNode(body: Record<string, unknown>): Response {
-  const rawKind = typeof body.primitive === 'string' ? body.primitive : body.kind;
-  if (typeof rawKind !== 'string' || !isHtmlPrimitiveKind(rawKind)) {
-    return responseJson({ ok: false, error: `Unknown HTML primitive: ${String(rawKind)}.` }, 400);
-  }
-  const data = isRecord(body.data) ? body.data : {};
-  let built: ReturnType<typeof buildHtmlPrimitive>;
-  try {
-    built = buildHtmlPrimitive({
-      kind: rawKind,
-      ...(typeof body.title === 'string' ? { title: body.title } : {}),
-      data,
-    });
-  } catch (error) {
-    return responseJson({ ok: false, error: error instanceof Error ? error.message : String(error) }, 400);
-  }
-  const geometry = resolveCreateGeometry(body);
-  const { node } = addCanvasNode({
-    type: 'html',
-    title: built.title,
-    data: {
-      html: built.html,
-      htmlPrimitive: built.kind,
-      primitiveData: built.data,
-      description: built.summary,
-      agentSummary: typeof data.agentSummary === 'string' ? data.agentSummary : built.summary,
-      ...(typeof data.summary === 'string' ? { summary: data.summary } : {}),
-      ...getHtmlPrimitiveSemanticMetadata(built.data),
-    },
-    ...(body.strictSize === true ? { strictSize: true } : {}),
-    ...geometry,
-    defaultWidth: built.defaultSize.width,
-    defaultHeight: built.defaultSize.height,
-  });
-  emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  return responseJson({
-    ...buildNodeResponse(node),
-    primitive: {
-      kind: built.kind,
-      title: built.title,
-      htmlBytes: Buffer.byteLength(built.html, 'utf-8'),
-      defaultSize: built.defaultSize,
-    },
-  });
-}
-
-// ── Group operations ─────────────────────────────────────────
-async function handleCanvasCreateGroup(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const title = typeof body.title === 'string' ? body.title : 'Group';
-  const childIds = Array.isArray(body.childIds) ? body.childIds.filter((id: unknown) => typeof id === 'string') : [];
-  const color = typeof body.color === 'string' ? body.color : undefined;
-  const x = typeof body.x === 'number' ? body.x : undefined;
-  const y = typeof body.y === 'number' ? body.y : undefined;
-  const width = typeof body.width === 'number' ? body.width : undefined;
-  const height = typeof body.height === 'number' ? body.height : undefined;
-  const childLayout =
-    body.childLayout === 'grid' || body.childLayout === 'column' || body.childLayout === 'flow'
-      ? body.childLayout
-      : undefined;
-  if (childIds.length > 0) {
-    const missingChildIds = childIds.filter((id) => !canvasState.getNode(id));
-    if (missingChildIds.length > 0) {
-      return responseJson({
-        ok: false,
-        error: `Cannot create group: missing child node ID${missingChildIds.length === 1 ? '' : 's'}: ${missingChildIds.join(', ')}.`,
-      }, 400);
-    }
-  }
-
-  const { node } = createCanvasGroup({ title, childIds, color, x, y, width, height, ...(childLayout ? { childLayout } : {}) });
-
-  broadcastWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  return responseJson(buildNodeResponse(node));
-}
-
-async function handleCanvasGroupNodes(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const groupId = body.groupId as string;
-  const childIds = Array.isArray(body.childIds) ? body.childIds.filter((id: unknown) => typeof id === 'string') : [];
-  const childLayout =
-    body.childLayout === 'grid' || body.childLayout === 'column' || body.childLayout === 'flow'
-      ? body.childLayout
-      : undefined;
-  if (!groupId || childIds.length === 0) {
-    return responseJson({ ok: false, error: 'Missing groupId or childIds.' }, 400);
-  }
-  const { ok } = groupCanvasNodes(groupId, childIds, childLayout ? { childLayout } : {});
-  if (!ok) return responseJson({ ok: false, error: 'Group not found or no valid children.' }, 400);
-  broadcastWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  return responseJson({ ok: true, groupId });
-}
-
-async function handleCanvasUngroupNodes(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const groupId = body.groupId as string;
-  if (!groupId) return responseJson({ ok: false, error: 'Missing groupId.' }, 400);
-  const { ok } = ungroupCanvasNodes(groupId);
-  if (!ok) return responseJson({ ok: false, error: 'Group not found or empty.' }, 400);
-  broadcastWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  return responseJson({ ok: true, groupId });
-}
-
-const VALID_EDGE_TYPES = new Set(['relation', 'depends-on', 'flow', 'references']);
-const VALID_EDGE_STYLES = new Set(['solid', 'dashed', 'dotted']);
-
-async function handleCanvasAddEdge(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const type = body.type as string;
-  const style = typeof body.style === 'string' ? body.style : undefined;
-
-  if (
-    !type ||
-    (!body.from && !body.fromSearch) ||
-    (!body.to && !body.toSearch)
-  ) {
-    return responseJson({ ok: false, error: 'Missing required fields: type plus from/fromSearch and to/toSearch.' }, 400);
-  }
-  if (!VALID_EDGE_TYPES.has(type)) {
-    return responseJson({ ok: false, error: `Invalid edge type: "${type}".` }, 400);
-  }
-  if (style && !VALID_EDGE_STYLES.has(style)) {
-    return responseJson({ ok: false, error: `Invalid edge style: "${style}". Use solid, dashed, or dotted.` }, 400);
-  }
-  try {
-    const result = addCanvasEdge({
-      ...(typeof body.from === 'string' ? { from: body.from } : {}),
-      ...(typeof body.to === 'string' ? { to: body.to } : {}),
-      ...(typeof body.fromSearch === 'string' ? { fromSearch: body.fromSearch } : {}),
-      ...(typeof body.toSearch === 'string' ? { toSearch: body.toSearch } : {}),
-      type: type as CanvasEdge['type'],
-      ...(body.label ? { label: String(body.label) } : {}),
-      ...(style ? { style: style as CanvasEdge['style'] } : {}),
-      ...(body.animated !== undefined ? { animated: Boolean(body.animated) } : {}),
-    });
-    emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-    return responseJson({ ok: true, ...result });
-  } catch (error) {
-    return responseJson({ ok: false, error: error instanceof Error ? error.message : 'Duplicate or self-edge.' }, 400);
-  }
-}
-
-async function handleCanvasRemoveEdge(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const edgeId = body.edge_id as string;
-  if (!edgeId) {
-    return responseJson({ ok: false, error: 'Missing edge_id.' }, 400);
-  }
-  const { removed } = removeCanvasEdge(edgeId);
-  if (!removed) {
-    return responseJson({ ok: false, error: `Edge "${edgeId}" not found.` }, 404);
-  }
-  emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  return responseJson({ ok: true, removed: edgeId });
-}
-
 async function handleCanvasRefreshWebpageNode(nodeId: string, req: Request): Promise<Response> {
   const existing = canvasState.getNode(nodeId);
   if (!existing || existing.type !== 'webpage') {
@@ -2087,513 +1525,28 @@ async function handleCanvasRefreshWebpageNode(nodeId: string, req: Request): Pro
   return responseJson(result, result.ok ? 200 : 400);
 }
 
-// ── Individual node update (PATCH) ──────────────────────────
-async function handleCanvasUpdateNode(nodeId: string, req: Request): Promise<Response> {
-  const existing = canvasState.getNode(nodeId);
-  if (!existing) return responseJson({ ok: false, error: `Node "${nodeId}" not found.` }, 404);
-  const body = await readJson(req);
-  if (existing.type === 'webpage' && body.refresh === true) {
-    return handleCanvasRefreshWebpageNode(nodeId, req);
-  }
-  const groupChildList = existing.type === 'group' ? pickGroupChildIds(body) : {};
-  if (groupChildList.error) return responseJson({ ok: false, error: `Cannot update group: ${groupChildList.error}` }, 400);
-  const groupChildIds = groupChildList.value;
-  if (groupChildIds !== undefined) {
-    const childError = validateGroupChildIds(nodeId, groupChildIds);
-    if (childError) return responseJson({ ok: false, error: `Cannot update group: ${childError}` }, 400);
-  }
-  const patch: Record<string, unknown> = resolvePatchGeometry(body, existing);
-  if (body.collapsed !== undefined) patch.collapsed = body.collapsed;
-  if (body.pinned !== undefined) patch.pinned = Boolean(body.pinned);
-  if (body.dockPosition === null || body.dockPosition === 'left' || body.dockPosition === 'right') {
-    patch.dockPosition = body.dockPosition;
-  }
-  if (hasStructuredNodeUpdateFields(body)) {
-    try {
-      patch.data = buildStructuredNodeUpdate(existing, body).data;
-    } catch (error) {
-      return responseJson({ ok: false, error: error instanceof Error ? error.message : String(error) }, 400);
-    }
-  } else if (
-    body.title !== undefined ||
-    body.content !== undefined ||
-    body.data ||
-    typeof body.arrangeLocked === 'boolean' ||
-    typeof body.strictSize === 'boolean' ||
-    (existing.type === 'trace' && hasTraceNodeDataFields(body)) ||
-    (existing.type === 'html' && (body.html !== undefined || body.axCapabilities !== undefined))
-  ) {
-    const data = { ...existing.data };
-    if (body.title !== undefined) {
-      data.title = String(body.title);
-      if (existing.type === 'webpage') {
-        data.titleSource = 'user';
-      }
-    }
-    if (body.content !== undefined) data.content = String(body.content);
-    if (typeof body.arrangeLocked === 'boolean') data.arrangeLocked = body.arrangeLocked;
-    if (typeof body.strictSize === 'boolean') data.strictSize = body.strictSize;
-    // Merge extra data fields (for status, context, ledger, trace nodes)
-    if (body.data && typeof body.data === 'object' && !Array.isArray(body.data)) {
-      Object.assign(data, body.data as Record<string, unknown>);
-    }
-    // Report #53: for html nodes, accept top-level `html` / `axCapabilities` on PATCH
-    // too (top-level overrides the `data.*` merge above — matches POST + MCP parity).
-    if (existing.type === 'html') {
-      if (body.html !== undefined) {
-        if (typeof body.html !== 'string') {
-          return responseJson({ ok: false, error: 'HTML node field "html" must be a string.' }, 400);
-        }
-        data.html = resolveHtmlContent(body.html);
-      }
-      const patchAxCapabilities = normalizeNodeAxCapabilities(body.axCapabilities);
-      if (patchAxCapabilities) data.axCapabilities = patchAxCapabilities;
-    }
-    if (existing.type === 'webpage') {
-      const nextUrl = typeof body.url === 'string'
-        ? body.url
-        : typeof (body.data as Record<string, unknown> | undefined)?.url === 'string'
-          ? (body.data as Record<string, unknown>).url as string
-          : undefined;
-      if (typeof nextUrl === 'string' && nextUrl.trim().length > 0) {
-        try {
-          data.url = normalizeWebpageUrl(nextUrl);
-        } catch (error) {
-          return responseJson({ ok: false, error: error instanceof Error ? error.message : 'Invalid webpage URL.' }, 400);
-        }
-      }
-    }
-    patch.data = existing.type === 'trace'
-      ? mergeTraceNodeDataFields(data, body)
-      : data;
-  }
-  const error = validateCanvasNodePatch({
-    ...(patch.position ? { position: patch.position as { x: number; y: number } } : {}),
-    ...(patch.size ? { size: patch.size as { width: number; height: number } } : {}),
-  });
-  if (error) return responseJson({ ok: false, error }, 400);
-  canvasState.updateNode(nodeId, patch as Partial<CanvasNodeState>);
-  if (groupChildIds !== undefined && !setGroupChildrenFromApi(nodeId, groupChildIds)) {
-    return responseJson({ ok: false, error: `Group "${nodeId}" not found.` }, 404);
-  }
-  emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  const updated = canvasState.getNode(nodeId);
-  return responseJson(updated ? buildNodeResponse(updated) : { ok: true, id: nodeId });
-}
-
-// ── Arrange nodes ───────────────────────────────────────────
-async function handleCanvasArrange(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const layout = typeof body.layout === 'string' ? body.layout : 'grid';
-  if (!['grid', 'column', 'flow'].includes(layout)) {
-    return responseJson({ ok: false, error: `Invalid layout: "${layout}". Use: grid, column, flow` }, 400);
-  }
-  const result = arrangeCanvasNodes(layout as 'grid' | 'column' | 'flow');
-  emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  const validation = validateCanvasLayout(canvasState.getLayout());
-  return responseJson({
-    ok: validation.ok,
-    arranged: result.arranged,
-    layout: result.layout,
-    ...(validation.ok ? {} : { validation, collisions: validation.summary.collisions }),
-  });
-}
+// handleCanvasBuildWebArtifact migrated to the operation registry
+// (plan-008 Wave 4): src/server/operations/ops/app.ts (webartifact.build).
 
-// ── Focus on node ───────────────────────────────────────────
-async function handleCanvasFocus(req: Request): Promise<Response> {
+async function handleCanvasThemeUpdate(req: Request): Promise<Response> {
   const body = await readJson(req);
-  const nodeId = body.id as string;
-  if (!nodeId) return responseJson({ ok: false, error: 'Missing id.' }, 400);
-  const node = canvasState.getNode(nodeId);
-  if (!node) return responseJson({ ok: false, error: `Node "${nodeId}" not found.` }, 404);
-  const noPan = body.noPan === true;
-  if (!noPan) {
-    canvasState.setViewport({ x: node.position.x - 100, y: node.position.y - 100 });
-  } else {
-    const maxZ = canvasState.getLayout().nodes.reduce((max, layoutNode) => Math.max(max, layoutNode.zIndex), 0);
-    canvasState.updateNode(nodeId, { zIndex: maxZ + 1 });
-  }
-  const focus = canvasState.setAxFocus([nodeId], { source: 'api', recordHistory: false });
-  broadcastWorkbenchEvent('ax-state-changed', {
-    focus,
+  const theme = normalizeCanvasTheme(body.theme, canvasState.theme);
+  const next = canvasState.setTheme(theme);
+  broadcastWorkbenchEvent('theme-changed', {
+    theme: next,
     sessionId: primaryWorkbenchSessionId,
     timestamp: new Date().toISOString(),
   });
-  emitPrimaryWorkbenchEvent('canvas-focus-node', { nodeId, noPan });
-  if (!noPan) emitPrimaryWorkbenchEvent('canvas-viewport-update', { viewport: canvasState.viewport });
-  emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  return responseJson({ ok: true, focused: nodeId, panned: !noPan, axFocus: focus });
+  return responseJson({ ok: true, theme: next });
 }
 
-async function handleCanvasFit(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const nodeIds = Array.isArray(body.nodeIds)
-    ? body.nodeIds.filter((id): id is string => typeof id === 'string')
-    : undefined;
-  const result = fitCanvasView({
-    ...(typeof body.width === 'number' ? { width: body.width } : {}),
-    ...(typeof body.height === 'number' ? { height: body.height } : {}),
-    ...(typeof body.padding === 'number' ? { padding: body.padding } : {}),
-    ...(typeof body.maxScale === 'number' ? { maxScale: body.maxScale } : {}),
-    ...(nodeIds ? { nodeIds } : {}),
-  });
-  emitPrimaryWorkbenchEvent('canvas-viewport-update', { viewport: result.viewport });
-  return responseJson(result);
-}
-
-async function handleCanvasBuildWebArtifact(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const title = typeof body.title === 'string' ? body.title.trim() : '';
-  const appTsx = typeof body.appTsx === 'string' ? body.appTsx : '';
-  if (!title || !appTsx) {
-    return responseJson({ ok: false, error: 'Missing required fields: title, appTsx.' }, 400);
-  }
-
-  const files: Record<string, string> = {};
-  if (body.files && typeof body.files === 'object' && !Array.isArray(body.files)) {
-    for (const [pathKey, value] of Object.entries(body.files as Record<string, unknown>)) {
-      if (typeof value === 'string') files[pathKey] = value;
-    }
-  }
-
-  try {
-    const result = await buildWebArtifactOnCanvas({
-      title,
-      appTsx,
-      ...(typeof body.indexCss === 'string' ? { indexCss: body.indexCss } : {}),
-      ...(typeof body.mainTsx === 'string' ? { mainTsx: body.mainTsx } : {}),
-      ...(typeof body.indexHtml === 'string' ? { indexHtml: body.indexHtml } : {}),
-      ...(Object.keys(files).length > 0 ? { files } : {}),
-      ...(typeof body.projectPath === 'string'
-        ? { projectPath: resolveWorkspacePath(body.projectPath, activeWorkspaceRoot) }
-        : {}),
-      ...(typeof body.outputPath === 'string'
-        ? { outputPath: resolveWorkspacePath(body.outputPath, activeWorkspaceRoot) }
-        : {}),
-      // Script-path overrides are honored only when contained inside the
-      // workspace (enforced by resolveTrustedScriptPath in
-      // executeWebArtifactBuild), so they cannot point at an arbitrary host
-      // script for bash execution.
-      ...(typeof body.initScriptPath === 'string'
-        ? { initScriptPath: body.initScriptPath }
-        : {}),
-      ...(typeof body.bundleScriptPath === 'string'
-        ? { bundleScriptPath: body.bundleScriptPath }
-        : {}),
-      ...(Array.isArray(body.deps)
-        ? { deps: body.deps.filter((dep): dep is string => typeof dep === 'string') }
-        : {}),
-      ...(typeof body.timeoutMs === 'number' ? { timeoutMs: body.timeoutMs } : {}),
-      ...(typeof body.openInCanvas === 'boolean' ? { openInCanvas: body.openInCanvas } : {}),
-    });
-
-    return responseJson({
-      ok: true,
-      path: result.filePath,
-      bytes: result.fileSize,
-      projectPath: result.projectPath,
-      openedInCanvas: result.openedInCanvas,
-      startedAt: result.startedAt,
-      completedAt: result.completedAt,
-      durationMs: result.durationMs,
-      timeoutMs: result.timeoutMs,
-      // `id` is the canvas node id alias used by every other add-style
-      // response. It is only present when a canvas node was actually
-      // created (i.e. openInCanvas was not explicitly disabled). When
-      // there is no canvas node, the alias is intentionally omitted so
-      // consumers can `'id' in response` to detect the build-only case.
-      ...(typeof result.nodeId === 'string' ? { id: result.nodeId } : {}),
-      nodeId: result.nodeId,
-      url: result.url,
-      metadata: result.metadata,
-      logs: result.logs,
-      ...(body.includeLogs === true ? {
-        stdout: result.stdout,
-        stderr: result.stderr,
-      } : {}),
-    });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return responseJson({ ok: false, error: message }, 400);
-  }
-}
-
-function handleCanvasDescribeSchema(): Response {
-  return responseJson(describeCanvasSchema());
-}
-
-async function handleCanvasValidateSpec(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const rawType = typeof body.type === 'string' ? body.type.trim() : '';
-  if (rawType !== 'json-render' && rawType !== 'graph' && rawType !== 'html-primitive') {
-    return responseJson({ ok: false, error: 'Validation type must be "json-render", "graph", or "html-primitive".' }, 400);
-  }
-
-  try {
-    if (rawType === 'json-render') {
-      const rawSpec =
-        body.spec && typeof body.spec === 'object' && !Array.isArray(body.spec)
-          ? body.spec
-          : body;
-      return responseJson(validateStructuredCanvasPayload({
-        type: 'json-render',
-        spec: rawSpec,
-      }));
-    }
-
-    if (rawType === 'html-primitive') {
-      const kind = typeof body.kind === 'string'
-        ? body.kind
-        : typeof body.primitive === 'string'
-          ? body.primitive
-          : '';
-      const data = isRecord(body.data) ? body.data : {};
-      return responseJson(validateStructuredCanvasPayload({
-        type: 'html-primitive',
-        primitive: {
-          kind,
-          ...(typeof body.title === 'string' ? { title: body.title } : {}),
-          data,
-        },
-      }));
-    }
-
-    const data = parseGraphPayloadData(body.data);
-    if (!data) {
-      return responseJson({ ok: false, error: 'Graph validation requires a data array.' }, 400);
-    }
-
-    const aggregate =
-      body.aggregate === 'sum' || body.aggregate === 'count' || body.aggregate === 'avg'
-        ? body.aggregate
-        : undefined;
-
-    return responseJson(validateStructuredCanvasPayload({
-      type: 'graph',
-      graph: {
-        title: typeof body.title === 'string' && body.title.trim() ? body.title.trim() : 'Graph',
-        graphType: typeof body.graphType === 'string'
-          ? body.graphType
-          : typeof body.typeName === 'string'
-            ? body.typeName
-            : 'line',
-        data,
-        ...(typeof body.xKey === 'string' ? { xKey: body.xKey } : {}),
-        ...(typeof body.yKey === 'string' ? { yKey: body.yKey } : {}),
-        ...(typeof body.zKey === 'string' ? { zKey: body.zKey } : {}),
-        ...(typeof body.nameKey === 'string' ? { nameKey: body.nameKey } : {}),
-        ...(typeof body.valueKey === 'string' ? { valueKey: body.valueKey } : {}),
-        ...(typeof body.axisKey === 'string' ? { axisKey: body.axisKey } : {}),
-        ...(Array.isArray(body.metrics)
-          ? { metrics: body.metrics.filter((m: unknown): m is string => typeof m === 'string') }
-          : {}),
-        ...(Array.isArray(body.series)
-          ? { series: body.series.filter((s: unknown): s is string => typeof s === 'string') }
-          : {}),
-        ...(typeof body.barKey === 'string' ? { barKey: body.barKey } : {}),
-        ...(typeof body.lineKey === 'string' ? { lineKey: body.lineKey } : {}),
-        ...(aggregate ? { aggregate } : {}),
-        ...(typeof body.color === 'string' ? { color: body.color } : {}),
-        ...(typeof body.barColor === 'string' ? { barColor: body.barColor } : {}),
-        ...(typeof body.lineColor === 'string' ? { lineColor: body.lineColor } : {}),
-        ...(typeof body.height === 'number' ? { height: body.height } : {}),
-      },
-    }));
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return responseJson({ ok: false, error: message, type: rawType }, 400);
-  }
-}
-
-async function handleCanvasAddJsonRender(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const title = typeof body.title === 'string' ? body.title.trim() : '';
-  const rawSpec =
-    body.spec && typeof body.spec === 'object' && !Array.isArray(body.spec) ? body.spec : body;
-  const geometry = resolveCreateGeometry(body);
-
-  try {
-    const result = createCanvasJsonRenderNode({
-      ...(title ? { title } : {}),
-      spec: rawSpec,
-      ...(body.strictSize === true ? { strictSize: true } : {}),
-      ...geometry,
-    });
-    emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-    return responseJson({ ...buildNodeResponse(result.node), url: result.url, spec: result.spec });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return responseJson({ ok: false, error: message }, 400);
-  }
-}
-
-async function handleJsonRenderStream(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const patches = Array.isArray(body.patches) ? body.patches : [];
-  const done = body.done === true;
-  const geometry = resolveCreateGeometry(body);
-  try {
-    let nodeId = typeof body.nodeId === 'string' && body.nodeId ? body.nodeId : undefined;
-    let url = '';
-    if (!nodeId) {
-      const created = createCanvasStreamingJsonRenderNode({
-        ...(typeof body.title === 'string' ? { title: body.title } : {}),
-        ...(body.strictSize === true ? { strictSize: true } : {}),
-        ...geometry,
-      });
-      nodeId = created.id;
-      url = created.url;
-    }
-    const result = appendCanvasJsonRenderStream(nodeId, patches, done);
-    if (!result.ok) return responseJson({ ok: false, error: result.error }, 400);
-    emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-    const node = canvasState.getNode(nodeId);
-    return responseJson({ id: nodeId, url: url || String(node?.data.url ?? ''), ...result });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return responseJson({ ok: false, error: message }, 400);
-  }
-}
-
-async function handleCanvasAddGraph(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const title = typeof body.title === 'string' && body.title.trim() ? body.title.trim() : 'Graph';
-  const graphType = typeof body.graphType === 'string' ? body.graphType : typeof body.type === 'string' ? body.type : 'line';
-  const data = parseGraphPayloadData(body.data);
-  if (!data) {
-    return responseJson({ ok: false, error: 'Missing required field: data.' }, 400);
-  }
-
-  try {
-    const aggregate =
-      body.aggregate === 'sum' || body.aggregate === 'count' || body.aggregate === 'avg'
-        ? body.aggregate
-        : undefined;
-    const metrics = Array.isArray(body.metrics)
-      ? body.metrics.filter((m: unknown): m is string => typeof m === 'string')
-      : null;
-    const series = Array.isArray(body.series)
-      ? body.series.filter((s: unknown): s is string => typeof s === 'string')
-      : null;
-    const position = getRecord(body.position);
-    const size = getRecord(body.size);
-    const x = pickFiniteNumber(body, 'x') ?? (position ? pickFiniteNumber(position, 'x') : undefined);
-    const y = pickFiniteNumber(body, 'y') ?? (position ? pickFiniteNumber(position, 'y') : undefined);
-    const width = pickPositiveNumber(body, 'width') ?? (size ? pickPositiveNumber(size, 'width') : undefined);
-    // Node FRAME height. `body.height` is the CHART plot height (passed through as
-    // `input.height` below), so the node frame accepts `nodeHeight` / `heightPx` /
-    // `size.height` as aliases — `heightPx` matches createCanvasGraphNode's own input
-    // field, the natural thing a caller reaches for. (With content-fit the node grows
-    // to the chart anyway; this just removes the silent "height ignored" surprise.)
-    const nodeHeight = pickPositiveNumber(body, 'nodeHeight')
-      ?? pickPositiveNumber(body, 'heightPx')
-      ?? (size ? pickPositiveNumber(size, 'height') : undefined);
-    const showLegend = typeof body.showLegend === 'boolean' ? body.showLegend : undefined;
-    const showLabels = typeof body.showLabels === 'boolean' ? body.showLabels : undefined;
-    const colorBy =
-      body.colorBy === 'series' || body.colorBy === 'category' || body.colorBy === 'value' || body.colorBy === 'none'
-        ? body.colorBy
-        : undefined;
-    const highlight =
-      typeof body.highlight === 'number' || body.highlight === 'max' || body.highlight === 'min' || body.highlight === null
-        ? body.highlight
-        : undefined;
-    const sort =
-      body.sort === 'asc' || body.sort === 'desc' || body.sort === 'none' ? body.sort : undefined;
-    const result = createCanvasGraphNode({
-      title,
-      graphType,
-      data,
-      ...(typeof body.xKey === 'string' ? { xKey: body.xKey } : {}),
-      ...(typeof body.yKey === 'string' ? { yKey: body.yKey } : {}),
-      ...(typeof body.zKey === 'string' ? { zKey: body.zKey } : {}),
-      ...(typeof body.nameKey === 'string' ? { nameKey: body.nameKey } : {}),
-      ...(typeof body.valueKey === 'string' ? { valueKey: body.valueKey } : {}),
-      ...(typeof body.axisKey === 'string' ? { axisKey: body.axisKey } : {}),
-      ...(metrics ? { metrics } : {}),
-      ...(series ? { series } : {}),
-      ...(typeof body.barKey === 'string' ? { barKey: body.barKey } : {}),
-      ...(typeof body.lineKey === 'string' ? { lineKey: body.lineKey } : {}),
-      ...(aggregate ? { aggregate } : {}),
-      ...(typeof body.color === 'string' ? { color: body.color } : {}),
-      ...(colorBy ? { colorBy } : {}),
-      ...(highlight !== undefined ? { highlight } : {}),
-      ...(typeof body.barColor === 'string' ? { barColor: body.barColor } : {}),
-      ...(typeof body.lineColor === 'string' ? { lineColor: body.lineColor } : {}),
-      ...(typeof body.labelKey === 'string' ? { labelKey: body.labelKey } : {}),
-      ...(typeof body.targetKey === 'string' ? { targetKey: body.targetKey } : {}),
-      ...(typeof body.rangesKey === 'string' ? { rangesKey: body.rangesKey } : {}),
-      ...(typeof body.beforeKey === 'string' ? { beforeKey: body.beforeKey } : {}),
-      ...(typeof body.afterKey === 'string' ? { afterKey: body.afterKey } : {}),
-      ...(typeof body.beforeLabel === 'string' ? { beforeLabel: body.beforeLabel } : {}),
-      ...(typeof body.afterLabel === 'string' ? { afterLabel: body.afterLabel } : {}),
-      ...(sort ? { sort } : {}),
-      ...(typeof body.fill === 'boolean' ? { fill: body.fill } : {}),
-      ...(typeof body.showEndDot === 'boolean' ? { showEndDot: body.showEndDot } : {}),
-      ...(typeof body.showMinMax === 'boolean' ? { showMinMax: body.showMinMax } : {}),
-      ...(typeof body.showValue === 'boolean' ? { showValue: body.showValue } : {}),
-      ...(typeof body.colorByDirection === 'boolean' ? { colorByDirection: body.colorByDirection } : {}),
-      ...(typeof body.height === 'number' ? { height: body.height } : {}),
-      ...(showLegend !== undefined ? { showLegend } : {}),
-      ...(showLabels !== undefined ? { showLabels } : {}),
-      ...(body.strictSize === true ? { strictSize: true } : {}),
-      ...(x !== undefined ? { x } : {}),
-      ...(y !== undefined ? { y } : {}),
-      ...(width !== undefined ? { width } : {}),
-      ...(nodeHeight !== undefined ? { heightPx: nodeHeight } : {}),
-    });
-    emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-    return responseJson({ ...buildNodeResponse(result.node), url: result.url, spec: result.spec });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return responseJson({ ok: false, error: message }, 400);
-  }
-}
-
-async function handleCanvasBatch(req: Request): Promise<Response> {
-  // Accept both documented shapes: { operations: [...] } and a bare [...] array.
-  // Uses the array-preserving reader so the bare-array form isn't coerced to {}.
-  const body = await readJsonObjectOrArray(req);
-  const operations = Array.isArray(body)
-    ? body
-    : Array.isArray(body.operations) ? body.operations : [];
-  const normalized = operations
-    .filter((operation): operation is Record<string, unknown> => operation && typeof operation === 'object' && !Array.isArray(operation))
-    .map((operation) => ({
-      op: String(operation.op ?? ''),
-      ...(typeof operation.assign === 'string' ? { assign: operation.assign } : {}),
-      args: operation.args && typeof operation.args === 'object' && !Array.isArray(operation.args)
-        ? operation.args as Record<string, unknown>
-        : {},
-    }));
-  const result = await executeCanvasBatch(normalized);
-  emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-  return responseJson(result, result.ok ? 200 : 400);
-}
-
-function handleCanvasValidate(): Response {
-  return responseJson(validateCanvasLayout(canvasState.getLayout()));
-}
-
-async function handleCanvasThemeUpdate(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const theme = normalizeCanvasTheme(body.theme, canvasState.theme);
-  const next = canvasState.setTheme(theme);
-  broadcastWorkbenchEvent('theme-changed', {
-    theme: next,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, theme: next });
-}
-
-async function handleJsonRenderView(url: URL): Promise<Response> {
-  const nodeId = url.searchParams.get('nodeId') ?? '';
-  if (!nodeId) return responseText('Missing nodeId', 400);
-  const node = canvasState.getNode(nodeId);
-  if (!node || (node.type !== 'json-render' && node.type !== 'graph')) {
-    return responseText('json-render node not found', 404);
-  }
+async function handleJsonRenderView(url: URL): Promise<Response> {
+  const nodeId = url.searchParams.get('nodeId') ?? '';
+  if (!nodeId) return responseText('Missing nodeId', 400);
+  const node = canvasState.getNode(nodeId);
+  if (!node || (node.type !== 'json-render' && node.type !== 'graph')) {
+    return responseText('json-render node not found', 404);
+  }
 
   const rawSpec = node.data.spec;
   if (!rawSpec || typeof rawSpec !== 'object') {
@@ -2660,13 +1613,6 @@ function responseText(text: string, status = 400): Response {
   });
 }
 
-function parsePositiveIntegerParam(value: string | null): number | undefined {
-  if (!value) return undefined;
-  const parsed = Number(value);
-  if (!Number.isFinite(parsed) || parsed <= 0) return undefined;
-  return Math.floor(parsed);
-}
-
 function handleArtifactView(url: URL): Response {
   const pathLike = url.searchParams.get('path') ?? '';
   const safePath = resolveWorkspaceArtifactPath(pathLike);
@@ -2855,229 +1801,6 @@ function handleRead(pathLike: string): Response {
   });
 }
 
-function randomExtAppToolCallId(): string {
-  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-}
-
-function nodeAppSessionId(node: CanvasNodeState | undefined): string | null {
-  if (!node || node.type !== 'mcp-app') return null;
-  const sessionId = node.data.appSessionId;
-  return typeof sessionId === 'string' && sessionId.trim().length > 0 ? sessionId : null;
-}
-
-function closeNodeAppSession(node: CanvasNodeState | undefined): void {
-  const sessionId = nodeAppSessionId(node);
-  if (sessionId) closeMcpAppSession(sessionId);
-}
-
-function normalizeStringRecord(value: unknown): Record<string, string> | undefined {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
-  const entries = Object.entries(value)
-    .filter((entry): entry is [string, string] => typeof entry[1] === 'string')
-    .map(([key, text]) => [key, text.trim()] as const)
-    .filter(([, text]) => text.length > 0);
-  return entries.length > 0 ? Object.fromEntries(entries) : undefined;
-}
-
-function parseExternalMcpTransportConfig(body: Record<string, unknown>): ExternalMcpTransportConfig | null {
-  const transport = body.transport;
-  if (!transport || typeof transport !== 'object' || Array.isArray(transport)) return null;
-  const transportRecord = transport as Record<string, unknown>;
-
-  const type = typeof transportRecord.type === 'string' ? transportRecord.type : '';
-  if (type === 'http') {
-    const url = typeof transportRecord.url === 'string' ? transportRecord.url.trim() : '';
-    if (!url) return null;
-    const headers = normalizeStringRecord(transportRecord.headers);
-    return {
-      type: 'http',
-      url,
-      ...(headers ? { headers } : {}),
-    };
-  }
-
-  if (type === 'stdio') {
-    const command = typeof transportRecord.command === 'string' ? transportRecord.command.trim() : '';
-    if (!command) return null;
-    const env = normalizeStringRecord(transportRecord.env);
-    return {
-      type: 'stdio',
-      command,
-      ...(Array.isArray(transportRecord.args)
-        ? { args: transportRecord.args.filter((value: unknown): value is string => typeof value === 'string') }
-        : {}),
-      ...(typeof transportRecord.cwd === 'string' && transportRecord.cwd.trim().length > 0 ? { cwd: transportRecord.cwd } : {}),
-      ...(env ? { env } : {}),
-    };
-  }
-
-  return null;
-}
-
-interface RunAndEmitOpenMcpAppParams {
-  transport: ExternalMcpTransportConfig;
-  toolName: string;
-  toolArguments?: Record<string, unknown>;
-  nodeId?: string;
-  serverName?: string;
-  title?: string;
-  x?: number;
-  y?: number;
-  width?: number;
-  height?: number;
-  timeoutMs?: number;
-}
-
-async function runAndEmitOpenMcpApp(params: RunAndEmitOpenMcpAppParams): Promise<Response> {
-  try {
-    const targetNode = params.nodeId ? canvasState.getNode(params.nodeId) : undefined;
-    if (params.nodeId && !targetNode) {
-      return responseJson({ ok: false, error: `Node "${params.nodeId}" not found.` }, 404);
-    }
-    if (targetNode && (targetNode.type !== 'mcp-app' || targetNode.data.mode !== 'ext-app')) {
-      return responseJson({ ok: false, error: `Node "${params.nodeId}" is not an external app node.` }, 400);
-    }
-
-    const opened = await openMcpApp({
-      transport: params.transport,
-      toolName: params.toolName,
-      ...(params.toolArguments ? { toolArguments: params.toolArguments } : {}),
-      ...(params.serverName ? { serverName: params.serverName } : {}),
-      ...(typeof params.timeoutMs === 'number' ? { timeoutMs: params.timeoutMs } : {}),
-    });
-
-    const toolCallId = randomExtAppToolCallId();
-    if (params.nodeId) closeNodeAppSession(targetNode);
-    const nodeIdSeed = params.nodeId ?? (toolCallId.startsWith('ext-app-') ? toolCallId : `ext-app-${toolCallId}`);
-    const toolResult = isExcalidrawCreateView(opened.serverName, opened.toolName)
-      ? ensureExcalidrawCheckpointId(opened.toolResult, nodeIdSeed)
-      : opened.toolResult;
-    const nodeTitle = params.title
-      ?? (typeof targetNode?.data.title === 'string' ? targetNode.data.title : undefined)
-      ?? opened.tool.title
-      ?? opened.tool.name;
-
-    emitPrimaryWorkbenchEvent('ext-app-open', {
-      toolCallId,
-      nodeId: nodeIdSeed,
-      title: nodeTitle,
-      html: opened.html,
-      toolInput: opened.toolInput,
-      serverName: opened.serverName,
-      toolName: opened.toolName,
-      appSessionId: opened.sessionId,
-      transportConfig: params.transport,
-      resourceUri: opened.resourceUri,
-      toolDefinition: opened.tool,
-      sessionStatus: 'ready',
-      sessionError: null,
-      ...(opened.resourceMeta ? { resourceMeta: opened.resourceMeta } : {}),
-      ...(typeof params.x === 'number' ? { x: params.x } : {}),
-      ...(typeof params.y === 'number' ? { y: params.y } : {}),
-      ...(typeof params.width === 'number' ? { width: params.width } : {}),
-      ...(typeof params.height === 'number' ? { height: params.height } : {}),
-    });
-    emitPrimaryWorkbenchEvent('ext-app-result', {
-      toolCallId,
-      nodeId: nodeIdSeed,
-      serverName: opened.serverName,
-      toolName: opened.toolName,
-      success: toolResult.isError !== true,
-      result: toolResult,
-    });
-    const nodeId = params.nodeId ?? findCanvasExtAppNodeId(toolCallId);
-
-    return responseJson({
-      ok: true,
-      ...(nodeId ? { id: nodeId } : {}),
-      nodeId,
-      toolCallId,
-      sessionId: opened.sessionId,
-      resourceUri: opened.resourceUri,
-      serverName: opened.serverName,
-      toolName: opened.toolName,
-    });
-  } catch (error) {
-    return responseJson({
-      ok: false,
-      error: error instanceof Error ? error.message : String(error),
-    }, 400);
-  }
-}
-
-async function handleCanvasOpenMcpApp(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const transport = parseExternalMcpTransportConfig(body);
-  const toolName = typeof body.toolName === 'string' ? body.toolName.trim() : '';
-  if (!transport || !toolName) {
-    return responseJson({ ok: false, error: 'Missing valid transport or toolName.' }, 400);
-  }
-
-  const toolArguments =
-    body.toolArguments && typeof body.toolArguments === 'object' && !Array.isArray(body.toolArguments)
-      ? body.toolArguments as Record<string, unknown>
-      : undefined;
-
-  const requestedTitle = typeof body.title === 'string' && body.title.trim().length > 0
-    ? body.title.trim()
-    : undefined;
-  const requestedServerName = typeof body.serverName === 'string' && body.serverName.trim().length > 0
-    ? body.serverName.trim()
-    : undefined;
-  const requestedNodeId = typeof body.nodeId === 'string' && body.nodeId.trim().length > 0
-    ? body.nodeId.trim()
-    : undefined;
-
-  return runAndEmitOpenMcpApp({
-    transport,
-    toolName,
-    ...(toolArguments ? { toolArguments } : {}),
-    ...(requestedNodeId ? { nodeId: requestedNodeId } : {}),
-    ...(requestedServerName ? { serverName: requestedServerName } : {}),
-    ...(requestedTitle ? { title: requestedTitle } : {}),
-    ...(typeof body.x === 'number' ? { x: body.x } : {}),
-    ...(typeof body.y === 'number' ? { y: body.y } : {}),
-    ...(typeof body.width === 'number' ? { width: body.width } : {}),
-    ...(typeof body.height === 'number' ? { height: body.height } : {}),
-    ...(typeof body.timeoutMs === 'number' ? { timeoutMs: body.timeoutMs } : {}),
-  });
-}
-
-async function handleCanvasAddDiagram(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  let built;
-  try {
-    built = buildExcalidrawOpenMcpAppInput({
-      elements: body.elements,
-      ...(typeof body.nodeId === 'string' ? { nodeId: body.nodeId } : {}),
-      ...(typeof body.title === 'string' ? { title: body.title } : {}),
-      ...(typeof body.x === 'number' ? { x: body.x } : {}),
-      ...(typeof body.y === 'number' ? { y: body.y } : {}),
-      ...(typeof body.width === 'number' ? { width: body.width } : {}),
-      ...(typeof body.height === 'number' ? { height: body.height } : {}),
-      ...(typeof body.timeoutMs === 'number' ? { timeoutMs: body.timeoutMs } : {}),
-    });
-  } catch (error) {
-    return responseJson({
-      ok: false,
-      error: error instanceof Error ? error.message : String(error),
-    }, 400);
-  }
-  return runAndEmitOpenMcpApp({
-    transport: built.transport,
-    toolName: built.toolName,
-    toolArguments: built.toolArguments,
-    serverName: built.serverName,
-    ...(built.nodeId ? { nodeId: built.nodeId } : {}),
-    ...(built.title ? { title: built.title } : {}),
-    ...(typeof built.x === 'number' ? { x: built.x } : {}),
-    ...(typeof built.y === 'number' ? { y: built.y } : {}),
-    ...(typeof built.width === 'number' ? { width: built.width } : {}),
-    ...(typeof built.height === 'number' ? { height: built.height } : {}),
-    ...(typeof built.timeoutMs === 'number' ? { timeoutMs: built.timeoutMs } : {}),
-  });
-}
-
 async function handleExtAppCallTool(req: Request): Promise<Response> {
   const body = await readJson(req);
   const sessionId = typeof body.sessionId === 'string' ? body.sessionId.trim() : '';
@@ -3279,120 +2002,15 @@ function handleWorkbenchState(): Response {
   });
 }
 
-function parseCanvasAutomationWebViewRequestBody(
-  body: Record<string, unknown>,
-): CanvasAutomationWebViewOptions {
-  const backendValue = typeof body.backend === 'string' ? body.backend.trim() : '';
-  const backend =
-    backendValue === 'chrome' || backendValue === 'webkit'
-      ? backendValue
-      : undefined;
-
-  const width = typeof body.width === 'number' ? body.width : undefined;
-  const height = typeof body.height === 'number' ? body.height : undefined;
-  const chromePath = typeof body.chromePath === 'string' ? body.chromePath : undefined;
-  const dataStoreDir = typeof body.dataStoreDir === 'string' ? body.dataStoreDir : undefined;
-  const chromeArgv = Array.isArray(body.chromeArgv)
-    ? body.chromeArgv.filter((value): value is string => typeof value === 'string')
-    : undefined;
-
-  return {
-    ...(backend ? { backend } : {}),
-    ...(width !== undefined ? { width } : {}),
-    ...(height !== undefined ? { height } : {}),
-    ...(chromePath ? { chromePath } : {}),
-    ...(chromeArgv ? { chromeArgv } : {}),
-    ...(dataStoreDir ? { dataStoreDir } : {}),
-  };
-}
-
+// Webview status / start / stop / evaluate / resize HTTP routes migrated to the
+// operation registry (plan-008 Wave 3): src/server/operations/ops/webview.ts,
+// dispatched in the fetch handler. The screenshot route + handler below stay
+// hand-written (binary response). `currentWorkbenchUrl` is still used by the
+// injected webview runner's start closure (see setWebviewRunner above).
 function currentWorkbenchUrl(): string | null {
   return server && typeof server.port === 'number' ? `${loopbackBaseUrl(server.port)}/workbench` : null;
 }
 
-function handleWorkbenchWebViewStatus(): Response {
-  return responseJson(getCanvasAutomationWebViewStatus());
-}
-
-async function handleWorkbenchWebViewStart(req: Request): Promise<Response> {
-  const url = currentWorkbenchUrl();
-  if (!url) {
-    return responseJson({ ok: false, error: 'Canvas server is not running.' }, 503);
-  }
-
-  const body = await readJson(req);
-  const options = parseCanvasAutomationWebViewRequestBody(body);
-
-  try {
-    const webview = await startCanvasAutomationWebView(url, options);
-    return responseJson({ ok: true, webview });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    const status = hasCanvasAutomationWebViewSupport() ? 500 : 501;
-    return responseJson({
-      ok: false,
-      error: message,
-      webview: getCanvasAutomationWebViewStatus(),
-    }, status);
-  }
-}
-
-async function handleWorkbenchWebViewStop(): Promise<Response> {
-  try {
-    const stopped = await stopCanvasAutomationWebView();
-    return responseJson({
-      ok: true,
-      stopped,
-      webview: getCanvasAutomationWebViewStatus(),
-    });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return responseJson({
-      ok: false,
-      error: message,
-      webview: getCanvasAutomationWebViewStatus(),
-    }, 500);
-  }
-}
-
-async function handleWorkbenchWebViewEvaluate(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const expression = typeof body.expression === 'string' ? body.expression.trim() : '';
-  const script = typeof body.script === 'string' ? body.script.trim() : '';
-  if ((expression ? 1 : 0) + (script ? 1 : 0) !== 1) {
-    return responseJson({
-      ok: false,
-      error: 'Pass exactly one of "expression" (single JS expression) or "script" (multi-statement body, wrapped in an async IIFE).',
-    }, 400);
-  }
-  const source = script ? wrapCanvasAutomationScript(script) : expression;
-
-  try {
-    const value = await evaluateCanvasAutomationWebView(source);
-    return responseJson({ ok: true, value });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return responseJson({ ok: false, error: message, webview: getCanvasAutomationWebViewStatus() }, 400);
-  }
-}
-
-async function handleWorkbenchWebViewResize(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const width = typeof body.width === 'number' ? body.width : NaN;
-  const height = typeof body.height === 'number' ? body.height : NaN;
-  if (!Number.isFinite(width) || width <= 0 || !Number.isFinite(height) || height <= 0) {
-    return responseJson({ ok: false, error: 'Missing required positive numeric fields: width, height.' }, 400);
-  }
-
-  try {
-    const webview = await resizeCanvasAutomationWebView(width, height);
-    return responseJson({ ok: true, webview });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return responseJson({ ok: false, error: message, webview: getCanvasAutomationWebViewStatus() }, 400);
-  }
-}
-
 async function handleWorkbenchWebViewScreenshot(req: Request): Promise<Response> {
   const body = await readJson(req);
   const format = body.format === 'jpeg' || body.format === 'webp' || body.format === 'png'
@@ -3866,43 +2484,6 @@ async function handleCanvasPrompt(req: Request): Promise<Response> {
   return responseJson({ ok: true, nodeId });
 }
 
-async function handleSnapshotSave(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const name = typeof body.name === 'string' ? body.name.trim() : '';
-  if (!name) return responseText('Missing snapshot name', 400);
-  const snapshot = saveCanvasSnapshot(name);
-  if (!snapshot) return responseText('Failed to save snapshot', 500);
-  return responseJson({ ok: true, id: snapshot.id, snapshot });
-}
-
-async function handleSnapshotGc(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const keepValue = body.keep;
-  const keep = typeof keepValue === 'number'
-    ? keepValue
-    : typeof keepValue === 'string'
-      ? Number(keepValue)
-      : undefined;
-  const dryRun = body.dryRun === true || body['dry-run'] === true;
-  return responseJson(gcCanvasSnapshots({ keep, dryRun }));
-}
-
-async function handleContextPinsUpdate(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const MAX_PINS = 20;
-  const nodeIds = Array.isArray(body.nodeIds)
-    ? (body.nodeIds.filter((id: unknown) => typeof id === 'string') as string[]).slice(0, MAX_PINS)
-    : [];
-  const result = setCanvasContextPins(nodeIds, 'set');
-  broadcastWorkbenchEvent('context-pins-changed', {
-    count: result.count,
-    nodeIds: result.nodeIds,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, count: result.count });
-}
-
 function handleGetPinnedContext(): Response {
   const pinnedIds = Array.from(canvasState.contextPinnedNodeIds);
   const preamble = pinnedIds.length > 0 ? buildSelectionContextPreamble(pinnedIds) : '';
@@ -3936,10 +2517,6 @@ function normalizeAxSource(value: unknown, fallback: PmxAxSource): PmxAxSource {
     : fallback;
 }
 
-function handleGetAxState(): Response {
-  return responseJson({ ok: true, state: canvasState.getAxState() });
-}
-
 function handleGetAxContext(url: URL): Response {
   // Optional ?consumer= filters the compact `delivery` lead block (loop-safe — a
   // consumer never sees steering/activity it originated), so a host adapter can
@@ -3948,12 +2525,6 @@ function handleGetAxContext(url: URL): Response {
   return responseJson(buildCanvasAxContext(consumer));
 }
 
-// Clamp ?waitMs= to [0, AX_WAIT_MAX_MS]. 0 (or absent/NaN) = a plain single read.
-function parseAxWaitMs(url: URL): number {
-  const raw = Number(url.searchParams.get('waitMs') ?? '');
-  return Number.isFinite(raw) && raw > 0 ? Math.min(raw, AX_WAIT_MAX_MS) : 0;
-}
-
 function isReviewSeverity(v: unknown): v is PmxAxReviewSeverity {
   return v === 'info' || v === 'warning' || v === 'error';
 }
@@ -4030,43 +2601,10 @@ async function handleAxActivityIngest(req: Request): Promise<Response> {
   return responseJson({ ok: true, ...result });
 }
 
-// Report primitive D: single-item read of a gate, with optional ?waitMs= long-poll
-// that resolves when the human resolves it in the browser (gates that actually gate).
-async function handleAxApprovalGet(url: URL, id: string, req: Request): Promise<Response> {
-  const waitMs = parseAxWaitMs(url);
-  const { value, pending } = await waitForAxResolution({
-    read: () => canvasState.getApproval(id),
-    isResolved: (g) => g.status !== 'pending',
-    timeoutMs: waitMs,
-    signal: req.signal,
-  });
-  if (!value) return responseJson({ ok: false, error: 'approval gate not found.' }, 404);
-  return responseJson({ ok: true, approvalGate: value, pending });
-}
-
-async function handleAxElicitationGet(url: URL, id: string, req: Request): Promise<Response> {
-  const waitMs = parseAxWaitMs(url);
-  const { value, pending } = await waitForAxResolution({
-    read: () => canvasState.getElicitation(id),
-    isResolved: (e) => e.status !== 'pending',
-    timeoutMs: waitMs,
-    signal: req.signal,
-  });
-  if (!value) return responseJson({ ok: false, error: 'elicitation not found.' }, 404);
-  return responseJson({ ok: true, elicitation: value, pending });
-}
-
-async function handleAxModeGet(url: URL, id: string, req: Request): Promise<Response> {
-  const waitMs = parseAxWaitMs(url);
-  const { value, pending } = await waitForAxResolution({
-    read: () => canvasState.getModeRequest(id),
-    isResolved: (m) => m.status !== 'pending',
-    timeoutMs: waitMs,
-    signal: req.signal,
-  });
-  if (!value) return responseJson({ ok: false, error: 'mode request not found.' }, 404);
-  return responseJson({ ok: true, modeRequest: value, pending });
-}
+// Report primitive D single-item gate reads (GET /api/canvas/ax/{approval,
+// elicitation,mode}/:id) with the optional ?waitMs= long-poll migrated to the
+// operation registry (plan-007 Slice B wave 4):
+// src/server/operations/ops/ax-await.ts.
 
 // Compact AX state for surfaces (the same shape seeded into AX-enabled iframes).
 // The client fetches this and pushes it to surfaces over the ax-update channel.
@@ -4113,136 +2651,34 @@ async function handleAxInteraction(req: Request): Promise<Response> {
   return responseJson(result, result.ok ? 200 : result.status);
 }
 
-function handleAxDeliveryPending(url: URL): Response {
-  const consumer = url.searchParams.get('consumer') ?? undefined;
-  const limitRaw = Number(url.searchParams.get('limit') ?? '');
-  const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? limitRaw : undefined;
-  const pending = canvasState.getPendingSteering({
-    ...(consumer ? { consumer } : {}),
-    ...(limit ? { limit } : {}),
-  });
-  return responseJson({ ok: true, pending });
-}
-
-function handleAxDeliveryMark(id: string): Response {
-  const delivered = canvasState.markSteeringDelivered(id);
-  if (delivered) {
-    broadcastWorkbenchEvent('ax-event-created', {
-      steeringDelivered: id,
-      sessionId: primaryWorkbenchSessionId,
-      timestamp: new Date().toISOString(),
-    });
-  }
-  return responseJson({ ok: true, delivered });
-}
+// handleAxDeliveryPending / handleAxDeliveryMark migrated to the operation
+// registry (plan-007 Slice B wave 3): src/server/operations/ops/ax-timeline.ts.
 
 function handleAxElicitationList(): Response {
   return responseJson({ ok: true, elicitations: canvasState.getElicitations() });
 }
 
-async function handleAxElicitationRequest(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  if (typeof body.prompt !== 'string' || !body.prompt.trim()) {
-    return responseJson({ ok: false, error: 'elicitation requires a prompt.' }, 400);
-  }
-  const elicitation = canvasState.requestElicitation(
-    {
-      prompt: body.prompt,
-      ...(Array.isArray(body.fields) ? { fields: body.fields.filter((f: unknown): f is string => typeof f === 'string') } : {}),
-      ...(Array.isArray(body.nodeIds) ? { nodeIds: normalizeAxNodeIds(body.nodeIds) } : {}),
-    },
-    { source: normalizeAxSource(body.source, 'api') },
-  );
-  broadcastWorkbenchEvent('ax-state-changed', { elicitation, sessionId: primaryWorkbenchSessionId, timestamp: new Date().toISOString() });
-  return responseJson({ ok: true, elicitation });
-}
-
-async function handleAxElicitationRespond(req: Request, id: string): Promise<Response> {
-  const body = await readJson(req);
-  const response = isRecord(body.response) ? body.response : {};
-  const elicitation = canvasState.respondElicitation(id, response, { source: normalizeAxSource(body.source, 'api') });
-  if (!elicitation) return responseJson({ ok: false, error: 'elicitation not found or already answered.' }, 404);
-  broadcastWorkbenchEvent('ax-state-changed', { elicitation, sessionId: primaryWorkbenchSessionId, timestamp: new Date().toISOString() });
-  return responseJson({ ok: true, elicitation });
-}
+// handleAxElicitationRequest / handleAxElicitationRespond migrated to the
+// operation registry (plan-007 Slice B wave 2): src/server/operations/ops/ax-work.ts.
 
 function handleAxModeList(): Response {
   return responseJson({ ok: true, modeRequests: canvasState.getModeRequests() });
 }
 
-async function handleAxModeRequest(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  if (body.mode !== 'plan' && body.mode !== 'execute' && body.mode !== 'autonomous') {
-    return responseJson({ ok: false, error: 'mode request requires mode plan|execute|autonomous.' }, 400);
-  }
-  const modeRequest = canvasState.requestMode(
-    {
-      mode: body.mode,
-      ...(typeof body.reason === 'string' ? { reason: body.reason } : {}),
-      ...(Array.isArray(body.nodeIds) ? { nodeIds: normalizeAxNodeIds(body.nodeIds) } : {}),
-    },
-    { source: normalizeAxSource(body.source, 'api') },
-  );
-  broadcastWorkbenchEvent('ax-state-changed', { modeRequest, sessionId: primaryWorkbenchSessionId, timestamp: new Date().toISOString() });
-  return responseJson({ ok: true, modeRequest });
-}
-
-async function handleAxModeResolve(req: Request, id: string): Promise<Response> {
-  const body = await readJson(req);
-  if (body.decision !== 'approved' && body.decision !== 'rejected') {
-    return responseJson({ ok: false, error: 'resolve requires decision approved or rejected.' }, 400);
-  }
-  const modeRequest = canvasState.resolveModeRequest(id, body.decision, {
-    ...(typeof body.resolution === 'string' ? { resolution: body.resolution } : {}),
-    source: normalizeAxSource(body.source, 'api'),
-  });
-  if (!modeRequest) return responseJson({ ok: false, error: 'mode request not found or already resolved.' }, 404);
-  broadcastWorkbenchEvent('ax-state-changed', { modeRequest, sessionId: primaryWorkbenchSessionId, timestamp: new Date().toISOString() });
-  return responseJson({ ok: true, modeRequest });
-}
+// handleAxModeRequest / handleAxModeResolve migrated to the operation registry
+// (plan-007 Slice B wave 2): src/server/operations/ops/ax-work.ts.
 
 function handleAxCommandList(): Response {
   return responseJson({ ok: true, commands: canvasState.getCommandRegistry() });
 }
 
-async function handleAxCommandInvoke(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  if (typeof body.name !== 'string') {
-    return responseJson({ ok: false, error: 'command requires a name.' }, 400);
-  }
-  const event = canvasState.invokeCommand(body.name, isRecord(body.args) ? body.args : null, { source: normalizeAxSource(body.source, 'api') });
-  if (!event) return responseJson({ ok: false, error: `Unknown command "${body.name}".` }, 400);
-  broadcastWorkbenchEvent('ax-event-created', { event, sessionId: primaryWorkbenchSessionId, timestamp: new Date().toISOString() });
-  return responseJson({ ok: true, event });
-}
+// handleAxCommandInvoke migrated to the operation registry (plan-007 Slice B
+// wave 3): src/server/operations/ops/ax-timeline.ts.
 
 function handleAxPolicyGet(): Response {
   return responseJson({ ok: true, policy: canvasState.getPolicy() });
 }
 
-async function handleAxPolicySet(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const patch: { tools?: Partial<PmxAxPolicy['tools']>; prompt?: Partial<PmxAxPolicy['prompt']> } = {};
-  if (isRecord(body.tools)) patch.tools = body.tools as Partial<PmxAxPolicy['tools']>;
-  if (isRecord(body.prompt)) patch.prompt = body.prompt as Partial<PmxAxPolicy['prompt']>;
-  const policy = canvasState.setPolicy(patch, { source: normalizeAxSource(body.source, 'api') });
-  broadcastWorkbenchEvent('ax-state-changed', { policy, sessionId: primaryWorkbenchSessionId, timestamp: new Date().toISOString() });
-  return responseJson({ ok: true, policy });
-}
-
-async function handleAxFocusUpdate(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const nodeIds = normalizeAxNodeIds(body.nodeIds);
-  const source = normalizeAxSource(body.source, 'api');
-  const focus = canvasState.setAxFocus(nodeIds, { source });
-  broadcastWorkbenchEvent('ax-state-changed', {
-    focus,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, focus });
-}
-
 async function handleAxStatePatch(req: Request): Promise<Response> {
   const body = await readJson(req);
   if (!body.focus || typeof body.focus !== 'object' || Array.isArray(body.focus)) {
@@ -4260,52 +2696,8 @@ async function handleAxStatePatch(req: Request): Promise<Response> {
   return responseJson({ ok: true, state: canvasState.getAxState() });
 }
 
-async function handleAxEventAdd(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  if (!isAxEventKind(body.kind) || typeof body.summary !== 'string') {
-    return responseJson({ ok: false, error: 'event requires kind and summary.' }, 400);
-  }
-  const event = canvasState.recordAxEvent(
-    {
-      kind: body.kind,
-      summary: body.summary,
-      detail: typeof body.detail === 'string' ? body.detail : null,
-      nodeIds: normalizeAxNodeIds(body.nodeIds),
-      data: isRecord(body.data) ? body.data : null,
-    },
-    { source: normalizeAxSource(body.source, 'api') },
-  );
-  broadcastWorkbenchEvent('ax-event-created', {
-    event,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, event });
-}
-
-async function handleAxSteer(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  if (typeof body.message !== 'string' || !body.message.trim()) {
-    return responseJson({ ok: false, error: 'steer requires a non-empty message.' }, 400);
-  }
-  const steering = canvasState.recordSteeringMessage(body.message, {
-    source: normalizeAxSource(body.source, 'api'),
-  });
-  broadcastWorkbenchEvent('ax-event-created', {
-    steering,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, steering });
-}
-
-function handleAxTimelineGet(url: URL): Response {
-  const limit = Number(url.searchParams.get('limit') ?? '');
-  return responseJson({
-    ok: true,
-    ...canvasState.getAxTimeline(Number.isFinite(limit) && limit > 0 ? { limit } : {}),
-  });
-}
+// handleAxEventAdd / handleAxSteer / handleAxTimelineGet migrated to the
+// operation registry (plan-007 Slice B wave 3): src/server/operations/ops/ax-timeline.ts.
 
 const AX_WORK_STATUSES = new Set(['todo', 'in-progress', 'blocked', 'done', 'cancelled']);
 
@@ -4319,234 +2711,33 @@ function handleAxWorkList(): Response {
   return responseJson({ ok: true, workItems: canvasState.getWorkItems() });
 }
 
-async function handleAxWorkAdd(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  if (typeof body.title !== 'string' || !body.title.trim()) {
-    return responseJson({ ok: false, error: 'work item requires a title.' }, 400);
-  }
-  // Report #56: reject an unknown status (e.g. "in_progress") instead of silently
-  // dropping it — the accepted tokens use hyphens.
-  if (body.status !== undefined && !normalizeAxWorkItemStatus(body.status)) {
-    return responseJson({ ok: false, error: `invalid work item status "${String(body.status)}"; expected one of: todo, in-progress, blocked, done, cancelled.` }, 400);
-  }
-  const status = normalizeAxWorkItemStatus(body.status);
-  const workItem = canvasState.addWorkItem(
-    {
-      title: body.title,
-      ...(status ? { status } : {}),
-      ...(typeof body.detail === 'string' ? { detail: body.detail } : {}),
-      ...(Array.isArray(body.nodeIds) ? { nodeIds: normalizeAxNodeIds(body.nodeIds) } : {}),
-    },
-    { source: normalizeAxSource(body.source, 'api') },
-  );
-  broadcastWorkbenchEvent('ax-state-changed', {
-    workItem,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, workItem });
-}
-
-async function handleAxWorkUpdate(req: Request, id: string): Promise<Response> {
-  const body = await readJson(req);
-  // Report #56: reject an unknown status instead of returning ok:true + no-op.
-  if (body.status !== undefined && !normalizeAxWorkItemStatus(body.status)) {
-    return responseJson({ ok: false, error: `invalid work item status "${String(body.status)}"; expected one of: todo, in-progress, blocked, done, cancelled.` }, 400);
-  }
-  const status = normalizeAxWorkItemStatus(body.status);
-  const workItem = canvasState.updateWorkItem(
-    id,
-    {
-      ...(typeof body.title === 'string' ? { title: body.title } : {}),
-      ...(status ? { status } : {}),
-      ...(typeof body.detail === 'string' || body.detail === null ? { detail: body.detail as string | null } : {}),
-      ...(Array.isArray(body.nodeIds) ? { nodeIds: normalizeAxNodeIds(body.nodeIds) } : {}),
-    },
-    { source: normalizeAxSource(body.source, 'api') },
-  );
-  if (!workItem) return responseJson({ ok: false, error: 'work item not found.' }, 404);
-  broadcastWorkbenchEvent('ax-state-changed', {
-    workItem,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, workItem });
-}
+// handleAxWorkAdd / handleAxWorkUpdate migrated to the operation registry
+// (plan-007 Slice B wave 2): src/server/operations/ops/ax-work.ts.
 
 function handleAxApprovalList(): Response {
   return responseJson({ ok: true, approvalGates: canvasState.getApprovalGates() });
 }
 
-async function handleAxApprovalRequest(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  if (typeof body.title !== 'string' || !body.title.trim()) {
-    return responseJson({ ok: false, error: 'approval request requires a title.' }, 400);
-  }
-  const approvalGate = canvasState.requestApproval(
-    {
-      title: body.title,
-      ...(typeof body.detail === 'string' ? { detail: body.detail } : {}),
-      ...(typeof body.action === 'string' ? { action: body.action } : {}),
-      ...(Array.isArray(body.nodeIds) ? { nodeIds: normalizeAxNodeIds(body.nodeIds) } : {}),
-    },
-    { source: normalizeAxSource(body.source, 'api') },
-  );
-  broadcastWorkbenchEvent('ax-state-changed', {
-    approvalGate,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, approvalGate });
-}
-
-async function handleAxApprovalResolve(req: Request, id: string): Promise<Response> {
-  const body = await readJson(req);
-  if (body.decision !== 'approved' && body.decision !== 'rejected') {
-    return responseJson({ ok: false, error: 'resolve requires decision approved or rejected.' }, 400);
-  }
-  const approvalGate = canvasState.resolveApproval(
-    id,
-    body.decision,
-    {
-      ...(typeof body.resolution === 'string' ? { resolution: body.resolution } : {}),
-      source: normalizeAxSource(body.source, 'api'),
-    },
-  );
-  if (!approvalGate) return responseJson({ ok: false, error: 'approval gate not found or already resolved.' }, 404);
-  broadcastWorkbenchEvent('ax-state-changed', {
-    approvalGate,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, approvalGate });
-}
+// handleAxApprovalRequest / handleAxApprovalResolve migrated to the operation
+// registry (plan-007 Slice B wave 2): src/server/operations/ops/ax-work.ts.
 
-async function handleAxEvidenceAdd(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  if (!isAxEvidenceKind(body.kind) || typeof body.title !== 'string' || !body.title.trim()) {
-    return responseJson({ ok: false, error: 'evidence requires kind and title.' }, 400);
-  }
-  const evidence = canvasState.addEvidence(
-    {
-      kind: body.kind,
-      title: body.title,
-      body: typeof body.body === 'string' ? body.body : null,
-      ref: typeof body.ref === 'string' ? body.ref : null,
-      nodeIds: normalizeAxNodeIds(body.nodeIds),
-      data: isRecord(body.data) ? body.data : null,
-    },
-    { source: normalizeAxSource(body.source, 'api') },
-  );
-  broadcastWorkbenchEvent('ax-event-created', {
-    evidence,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, evidence });
-}
+// handleAxEvidenceAdd migrated to the operation registry (plan-007 Slice B
+// wave 3): src/server/operations/ops/ax-timeline.ts.
 
-const AX_REVIEW_KINDS = new Set(['comment', 'finding']);
-const AX_REVIEW_SEVERITIES = new Set(['info', 'warning', 'error']);
-const AX_REVIEW_STATUSES = new Set(['open', 'resolved', 'dismissed']);
-const AX_REVIEW_ANCHORS = new Set(['node', 'file', 'region']);
-
-function normalizeAxReviewKind(value: unknown): PmxAxReviewKind | undefined {
-  return typeof value === 'string' && AX_REVIEW_KINDS.has(value) ? value as PmxAxReviewKind : undefined;
-}
-function normalizeAxReviewSeverity(value: unknown): PmxAxReviewSeverity | undefined {
-  return typeof value === 'string' && AX_REVIEW_SEVERITIES.has(value) ? value as PmxAxReviewSeverity : undefined;
-}
-function normalizeAxReviewStatus(value: unknown): PmxAxReviewStatus | undefined {
-  return typeof value === 'string' && AX_REVIEW_STATUSES.has(value) ? value as PmxAxReviewStatus : undefined;
-}
-function normalizeAxReviewAnchor(value: unknown): PmxAxReviewAnchorType | undefined {
-  return typeof value === 'string' && AX_REVIEW_ANCHORS.has(value) ? value as PmxAxReviewAnchorType : undefined;
-}
-function normalizeAxReviewRegion(value: unknown): PmxAxReviewRegion | undefined {
-  if (!isRecord(value)) return undefined;
-  return {
-    ...(typeof value.line === 'number' ? { line: value.line } : {}),
-    ...(typeof value.endLine === 'number' ? { endLine: value.endLine } : {}),
-    ...(typeof value.label === 'string' ? { label: value.label } : {}),
-  };
-}
+// The AX review normalize helpers + their constant sets moved with the
+// migrated handlers (plan-007 Slice B wave 2): src/server/operations/ops/ax-work.ts.
 
 function handleAxReviewList(): Response {
   return responseJson({ ok: true, reviewAnnotations: canvasState.getReviewAnnotations() });
 }
 
-async function handleAxReviewAdd(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  if (typeof body.body !== 'string' || !body.body.trim()) {
-    return responseJson({ ok: false, error: 'review annotation requires a body.' }, 400);
-  }
-  const kind = normalizeAxReviewKind(body.kind);
-  const severity = normalizeAxReviewSeverity(body.severity);
-  const anchorType = normalizeAxReviewAnchor(body.anchorType);
-  const region = normalizeAxReviewRegion(body.region);
-  const reviewAnnotation = canvasState.addReviewAnnotation(
-    {
-      body: body.body,
-      ...(kind ? { kind } : {}),
-      ...(severity ? { severity } : {}),
-      ...(anchorType ? { anchorType } : {}),
-      ...(typeof body.nodeId === 'string' ? { nodeId: body.nodeId } : {}),
-      ...(typeof body.file === 'string' ? { file: body.file } : {}),
-      ...(region ? { region } : {}),
-      ...(typeof body.author === 'string' ? { author: body.author } : {}),
-    },
-    { source: normalizeAxSource(body.source, 'api') },
-  );
-  if (!reviewAnnotation) {
-    return responseJson({ ok: false, error: 'node-anchored review annotation requires a nodeId that exists on the canvas.' }, 400);
-  }
-  broadcastWorkbenchEvent('ax-state-changed', {
-    reviewAnnotation,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, reviewAnnotation });
-}
-
-async function handleAxReviewUpdate(req: Request, id: string): Promise<Response> {
-  const body = await readJson(req);
-  const status = normalizeAxReviewStatus(body.status);
-  const severity = normalizeAxReviewSeverity(body.severity);
-  const kind = normalizeAxReviewKind(body.kind);
-  const reviewAnnotation = canvasState.updateReviewAnnotation(
-    id,
-    {
-      ...(typeof body.body === 'string' ? { body: body.body } : {}),
-      ...(status ? { status } : {}),
-      ...(severity ? { severity } : {}),
-      ...(kind ? { kind } : {}),
-    },
-    { source: normalizeAxSource(body.source, 'api') },
-  );
-  if (!reviewAnnotation) return responseJson({ ok: false, error: 'review annotation not found.' }, 404);
-  broadcastWorkbenchEvent('ax-state-changed', {
-    reviewAnnotation,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, reviewAnnotation });
-}
+// handleAxReviewAdd / handleAxReviewUpdate migrated to the operation registry
+// (plan-007 Slice B wave 2): src/server/operations/ops/ax-work.ts.
 
 function handleAxHostCapabilityGet(): Response {
   return responseJson({ ok: true, host: canvasState.getHostCapability() });
 }
 
-async function handleAxHostCapabilityReport(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const host = canvasState.setHostCapability(body, { source: normalizeAxSource(body.source, 'api') });
-  broadcastWorkbenchEvent('ax-state-changed', {
-    host,
-    sessionId: primaryWorkbenchSessionId,
-    timestamp: new Date().toISOString(),
-  });
-  return responseJson({ ok: true, host });
-}
-
 // ── Port resolution ───────────────────────────────────────────
 
 function buildPortCandidates(preferredPort: number): number[] {
@@ -5310,6 +3501,15 @@ export function startCanvasServer(options: CanvasServerOptions = {}): string | n
         hostname: DEFAULT_HOST,
         port: portCandidate,
         idleTimeout: 0,
+        // Last-resort boundary: any throw that escapes the fetch handler must NOT
+        // render Bun's default dev error overlay (HTTP 500 text/html disclosing the
+        // absolute server source path + stack). Return a clean JSON 500 and log the
+        // real error server-side only. Operation dispatch has its own catch
+        // (operations/http.ts); this covers the hand-written routes too.
+        error(error) {
+          logWorkbenchWarning('serverFetch', error);
+          return responseJson({ ok: false, error: 'Internal server error.' }, 500);
+        },
         async fetch(req) {
           const url = new URL(req.url);
 
@@ -5370,30 +3570,20 @@ export function startCanvasServer(options: CanvasServerOptions = {}): string | n
             return handleWorkbenchIntent(req);
           }
 
-          if (url.pathname === '/api/workbench/webview' && req.method === 'GET') {
-            return handleWorkbenchWebViewStatus();
-          }
-
-          if (url.pathname === '/api/workbench/webview/start' && req.method === 'POST') {
-            return handleWorkbenchWebViewStart(req);
-          }
-
-          if (url.pathname === '/api/workbench/webview/evaluate' && req.method === 'POST') {
-            return handleWorkbenchWebViewEvaluate(req);
-          }
-
-          if (url.pathname === '/api/workbench/webview/resize' && req.method === 'POST') {
-            return handleWorkbenchWebViewResize(req);
+          // Webview automation routes (plan-008 Wave 3): status / start /
+          // evaluate / resize / stop are now registered operations served by the
+          // registry. A null return falls through (e.g. the screenshot route
+          // below, which stays hand-written — it returns a binary image, not a
+          // JSON wire body).
+          if (url.pathname.startsWith('/api/workbench/webview')) {
+            const webviewResponse = await dispatchOperationRoute(req, url);
+            if (webviewResponse) return webviewResponse;
           }
 
           if (url.pathname === '/api/workbench/webview/screenshot' && req.method === 'POST') {
             return handleWorkbenchWebViewScreenshot(req);
           }
 
-          if (url.pathname === '/api/workbench/webview' && req.method === 'DELETE') {
-            return handleWorkbenchWebViewStop();
-          }
-
           if (url.pathname === '/api/file/save' && req.method === 'POST') {
             return handleSave(req);
           }
@@ -5402,16 +3592,11 @@ export function startCanvasServer(options: CanvasServerOptions = {}): string | n
             return handleRender(req);
           }
 
-          // Canvas state API
-          if (url.pathname === '/api/canvas/state' && req.method === 'GET') {
-            const includeBlobs = url.searchParams.get('includeBlobs') === 'true';
-            return responseJson(includeBlobs
-              ? serializeCanvasLayout(canvasState.getLayout())
-              : serializeCanvasLayoutWithBlobSummaries(withContextPinLayoutReadState(canvasState.getLayoutForPersistence())));
-          }
-
-          if (url.pathname === '/api/canvas/summary' && req.method === 'GET') {
-            return responseJson(buildCanvasSummary());
+          // Operation registry routes (plan-005): registered operations are
+          // dispatched here; a null return falls through to the legacy routes.
+          if (url.pathname.startsWith('/api/canvas/')) {
+            const operationResponse = await dispatchOperationRoute(req, url);
+            if (operationResponse) return operationResponse;
           }
 
           if (url.pathname === '/api/canvas/theme' && req.method === 'GET') {
@@ -5426,17 +3611,8 @@ export function startCanvasServer(options: CanvasServerOptions = {}): string | n
             return handleCanvasUpdate(req);
           }
 
-          if (url.pathname === '/api/canvas/schema' && req.method === 'GET') {
-            return handleCanvasDescribeSchema();
-          }
-
-          if (url.pathname === '/api/canvas/schema/validate' && req.method === 'POST') {
-            return handleCanvasValidateSpec(req);
-          }
-
-          if (url.pathname === '/api/canvas/batch' && req.method === 'POST') {
-            return handleCanvasBatch(req);
-          }
+          // POST /api/canvas/batch migrated to the operation registry
+          // (plan-008 Wave 2): src/server/operations/ops/batch.ts.
 
           if (url.pathname === '/api/canvas/viewport' && req.method === 'POST') {
             return handleCanvasViewport(req);
@@ -5446,25 +3622,9 @@ export function startCanvasServer(options: CanvasServerOptions = {}): string | n
             return handleCanvasAddAnnotation(req);
           }
 
-          if (url.pathname.startsWith('/api/canvas/annotation/') && req.method === 'DELETE') {
-            return handleCanvasRemoveAnnotation(url.pathname.slice('/api/canvas/annotation/'.length));
-          }
-
-          if (url.pathname === '/api/canvas/node' && req.method === 'POST') {
-            return handleCanvasAddNode(req);
-          }
-
-          if (url.pathname === '/api/canvas/mcp-app/open' && req.method === 'POST') {
-            return handleCanvasOpenMcpApp(req);
-          }
-
-          if (url.pathname === '/api/canvas/diagram' && req.method === 'POST') {
-            return handleCanvasAddDiagram(req);
-          }
-
-          if (url.pathname === '/api/canvas/web-artifact' && req.method === 'POST') {
-            return handleCanvasBuildWebArtifact(req);
-          }
+          // POST /api/canvas/mcp-app/open, /api/canvas/diagram, and
+          // /api/canvas/web-artifact migrated to the operation registry
+          // (plan-008 Wave 4): src/server/operations/ops/app.ts.
 
           // Individual node GET/PATCH/DELETE
           if (url.pathname.startsWith('/api/canvas/node/') && url.pathname.endsWith('/refresh') && req.method === 'POST') {
@@ -5472,111 +3632,15 @@ export function startCanvasServer(options: CanvasServerOptions = {}): string | n
             return handleCanvasRefreshWebpageNode(nodeId, req);
           }
 
-          if (url.pathname.startsWith('/api/canvas/node/') && req.method === 'GET') {
-            const nodeId = decodeURIComponent(url.pathname.slice('/api/canvas/node/'.length));
-            const includeBlobs = url.searchParams.get('includeBlobs') === 'true';
-            const node = includeBlobs ? canvasState.getNode(nodeId) : canvasState.getNodeForPersistence(nodeId);
-            if (!node) return responseJson({ ok: false, error: `Node "${nodeId}" not found.` }, 404);
-            const responseNode = withContextPinReadState(node);
-            return responseJson(includeBlobs
-              ? serializeCanvasNode(responseNode)
-              : serializeCanvasNodeWithBlobSummaries(responseNode));
-          }
-
-          if (url.pathname.startsWith('/api/canvas/node/') && req.method === 'PATCH') {
-            const nodeId = url.pathname.slice('/api/canvas/node/'.length);
-            return handleCanvasUpdateNode(nodeId, req);
-          }
-
-          if (url.pathname.startsWith('/api/canvas/node/') && req.method === 'DELETE') {
-            const nodeId = url.pathname.slice('/api/canvas/node/'.length);
-            closeNodeAppSession(canvasState.getNode(nodeId));
-            const result = removeCanvasNode(nodeId);
-            if (!result.removed) return responseJson({ ok: false, error: `Node "${nodeId}" not found.` }, 404);
-            emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-            if (result.needsCodeGraphRecompute) {
-              scheduleCodeGraphRecompute(() => {
-                emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-              });
-            }
-            return responseJson({ ok: true, removed: nodeId });
-          }
-
           if (url.pathname.startsWith('/api/canvas/image/') && req.method === 'GET') {
             return await handleCanvasImage(url.pathname);
           }
 
-          if (url.pathname === '/api/canvas/edge' && req.method === 'POST') {
-            return handleCanvasAddEdge(req);
-          }
-
-          if (url.pathname === '/api/canvas/edge' && req.method === 'DELETE') {
-            return handleCanvasRemoveEdge(req);
-          }
-
-          // Snapshot API
-          if (url.pathname === '/api/canvas/snapshots' && req.method === 'GET') {
-            return responseJson(listCanvasSnapshots({
-              limit: parsePositiveIntegerParam(url.searchParams.get('limit')),
-              query: url.searchParams.get('q') ?? url.searchParams.get('query') ?? undefined,
-              before: url.searchParams.get('before') ?? undefined,
-              after: url.searchParams.get('after') ?? undefined,
-              all: url.searchParams.get('all') === 'true',
-            }));
-          }
-
-          if (url.pathname === '/api/canvas/snapshots' && req.method === 'POST') {
-            return handleSnapshotSave(req);
-          }
-
-          if (url.pathname === '/api/canvas/snapshots/gc' && req.method === 'POST') {
-            return handleSnapshotGc(req);
-          }
-
-          if (url.pathname === '/api/canvas/snapshots/diff' && req.method === 'GET') {
-            const name = url.searchParams.get('name') ?? url.searchParams.get('id') ?? '';
-            if (!name.trim()) return responseJson({ ok: false, error: 'Missing snapshot name or id.' }, 400);
-            const snapshot = canvasState.getSnapshotData(name);
-            if (!snapshot) return responseJson({ ok: false, error: `Snapshot "${name}" not found.` }, 404);
-            const diff = diffLayouts(snapshot.name, snapshot, canvasState.getLayout());
-            return responseJson({ ok: true, text: formatDiff(diff), diff });
-          }
-
-          if (url.pathname.startsWith('/api/canvas/snapshots/') && url.pathname.endsWith('/diff') && req.method === 'GET') {
-            const id = decodeURIComponent(url.pathname.slice('/api/canvas/snapshots/'.length, -'/diff'.length));
-            const snapshot = canvasState.getSnapshotData(id);
-            if (!snapshot) return responseJson({ ok: false, error: `Snapshot "${id}" not found.` }, 404);
-            const diff = diffLayouts(snapshot.name, snapshot, canvasState.getLayout());
-            return responseJson({ ok: true, text: formatDiff(diff), diff });
-          }
-
-          if (url.pathname.startsWith('/api/canvas/snapshots/') && req.method === 'POST') {
-            const id = decodeURIComponent(url.pathname.slice('/api/canvas/snapshots/'.length));
-            const result = await restoreCanvasSnapshot(id);
-            if (!result.ok) return responseText('Snapshot not found', 404);
-            broadcastWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-            return responseJson({ ok: true });
-          }
-
-          if (url.pathname.startsWith('/api/canvas/snapshots/') && req.method === 'DELETE') {
-            const id = url.pathname.split('/').pop() ?? '';
-            const result = deleteCanvasSnapshot(id);
-            if (!result.ok) return responseText('Snapshot not found', 404);
-            return responseJson({ ok: true });
-          }
-
-          // Context pins API
-          if (url.pathname === '/api/canvas/context-pins' && req.method === 'POST') {
-            return handleContextPinsUpdate(req);
-          }
-
           if (url.pathname === '/api/canvas/pinned-context' && req.method === 'GET') {
             return handleGetPinnedContext();
           }
 
-          if (url.pathname === '/api/canvas/ax' && req.method === 'GET') {
-            return handleGetAxState();
-          }
+          // GET /api/canvas/ax migrated to the operation registry (plan-007 Slice B.1).
 
           if (url.pathname === '/api/canvas/ax' && req.method === 'PATCH') {
             return handleAxStatePatch(req);
@@ -5598,202 +3662,85 @@ export function startCanvasServer(options: CanvasServerOptions = {}): string | n
             return handleOpenExternalSurface(req);
           }
 
-          if (url.pathname === '/api/canvas/ax/focus' && req.method === 'POST') {
-            return handleAxFocusUpdate(req);
-          }
+          // POST /api/canvas/ax/focus migrated to the operation registry (plan-007 Slice B.1).
 
-          if (url.pathname === '/api/canvas/ax/event' && req.method === 'POST') {
-            return handleAxEventAdd(req);
-          }
-
-          if (url.pathname === '/api/canvas/ax/steer' && req.method === 'POST') {
-            return handleAxSteer(req);
-          }
-
-          if (url.pathname === '/api/canvas/ax/timeline' && req.method === 'GET') {
-            return handleAxTimelineGet(url);
-          }
+          // POST /api/canvas/ax/event + POST /api/canvas/ax/steer + GET
+          // /api/canvas/ax/timeline migrated to the operation registry
+          // (plan-007 Slice B wave 3): src/server/operations/ops/ax-timeline.ts.
 
           if (url.pathname === '/api/canvas/ax/work' && req.method === 'GET') {
             return handleAxWorkList();
           }
 
-          if (url.pathname === '/api/canvas/ax/work' && req.method === 'POST') {
-            return handleAxWorkAdd(req);
-          }
-
-          if (url.pathname.startsWith('/api/canvas/ax/work/') && req.method === 'PATCH') {
-            const workItemId = decodeURIComponent(url.pathname.slice('/api/canvas/ax/work/'.length));
-            return handleAxWorkUpdate(req, workItemId);
-          }
+          // POST /api/canvas/ax/work + PATCH /api/canvas/ax/work/:id migrated to
+          // the operation registry (plan-007 Slice B wave 2).
 
           if (url.pathname === '/api/canvas/ax/approval' && req.method === 'GET') {
             return handleAxApprovalList();
           }
 
-          if (url.pathname === '/api/canvas/ax/approval' && req.method === 'POST') {
-            return handleAxApprovalRequest(req);
-          }
+          // POST /api/canvas/ax/approval + POST /api/canvas/ax/approval/:id/resolve
+          // migrated to the operation registry (plan-007 Slice B wave 2).
 
-          if (url.pathname.startsWith('/api/canvas/ax/approval/') && url.pathname.endsWith('/resolve') && req.method === 'POST') {
-            const approvalId = decodeURIComponent(
-              url.pathname.slice('/api/canvas/ax/approval/'.length, -'/resolve'.length),
-            );
-            return handleAxApprovalResolve(req, approvalId);
-          }
+          // GET /api/canvas/ax/approval/:id (single-item read + ?waitMs long-poll)
+          // migrated to the operation registry (plan-007 Slice B wave 4).
 
-          if (url.pathname.startsWith('/api/canvas/ax/approval/') && !url.pathname.endsWith('/resolve') && req.method === 'GET') {
-            const approvalId = decodeURIComponent(url.pathname.slice('/api/canvas/ax/approval/'.length));
-            return handleAxApprovalGet(url, approvalId, req);
-          }
-
-          if (url.pathname === '/api/canvas/ax/evidence' && req.method === 'POST') {
-            return handleAxEvidenceAdd(req);
-          }
+          // POST /api/canvas/ax/evidence migrated to the operation registry
+          // (plan-007 Slice B wave 3): src/server/operations/ops/ax-timeline.ts.
 
           if (url.pathname === '/api/canvas/ax/review' && req.method === 'GET') {
             return handleAxReviewList();
           }
 
-          if (url.pathname === '/api/canvas/ax/review' && req.method === 'POST') {
-            return handleAxReviewAdd(req);
-          }
-
-          if (url.pathname.startsWith('/api/canvas/ax/review/') && req.method === 'PATCH') {
-            const reviewId = decodeURIComponent(url.pathname.slice('/api/canvas/ax/review/'.length));
-            return handleAxReviewUpdate(req, reviewId);
-          }
+          // POST /api/canvas/ax/review + PATCH /api/canvas/ax/review/:id migrated
+          // to the operation registry (plan-007 Slice B wave 2).
 
           if (url.pathname === '/api/canvas/ax/host-capability' && req.method === 'GET') {
             return handleAxHostCapabilityGet();
           }
 
-          if (url.pathname === '/api/canvas/ax/host-capability' && req.method === 'PUT') {
-            return handleAxHostCapabilityReport(req);
-          }
+          // PUT /api/canvas/ax/host-capability migrated to the operation registry (plan-007 Slice B.1).
 
           if (url.pathname === '/api/canvas/ax/interaction' && req.method === 'POST') {
             return handleAxInteraction(req);
           }
 
-          if (url.pathname === '/api/canvas/ax/delivery/pending' && req.method === 'GET') {
-            return handleAxDeliveryPending(url);
-          }
-
-          if (url.pathname.startsWith('/api/canvas/ax/delivery/') && url.pathname.endsWith('/mark') && req.method === 'POST') {
-            const deliveryId = decodeURIComponent(
-              url.pathname.slice('/api/canvas/ax/delivery/'.length, -'/mark'.length),
-            );
-            return handleAxDeliveryMark(deliveryId);
-          }
+          // GET /api/canvas/ax/delivery/pending + POST /api/canvas/ax/delivery/:id/mark
+          // migrated to the operation registry (plan-007 Slice B wave 3):
+          // src/server/operations/ops/ax-timeline.ts.
 
           if (url.pathname === '/api/canvas/ax/elicitation' && req.method === 'GET') {
             return handleAxElicitationList();
           }
 
-          if (url.pathname === '/api/canvas/ax/elicitation' && req.method === 'POST') {
-            return handleAxElicitationRequest(req);
-          }
+          // POST /api/canvas/ax/elicitation + POST /api/canvas/ax/elicitation/:id/respond
+          // migrated to the operation registry (plan-007 Slice B wave 2).
 
-          if (url.pathname.startsWith('/api/canvas/ax/elicitation/') && url.pathname.endsWith('/respond') && req.method === 'POST') {
-            const elicitationId = decodeURIComponent(
-              url.pathname.slice('/api/canvas/ax/elicitation/'.length, -'/respond'.length),
-            );
-            return handleAxElicitationRespond(req, elicitationId);
-          }
-
-          if (url.pathname.startsWith('/api/canvas/ax/elicitation/') && !url.pathname.endsWith('/respond') && req.method === 'GET') {
-            const elicitationId = decodeURIComponent(url.pathname.slice('/api/canvas/ax/elicitation/'.length));
-            return handleAxElicitationGet(url, elicitationId, req);
-          }
+          // GET /api/canvas/ax/elicitation/:id (single-item read + ?waitMs long-poll)
+          // migrated to the operation registry (plan-007 Slice B wave 4).
 
           if (url.pathname === '/api/canvas/ax/mode' && req.method === 'GET') {
             return handleAxModeList();
           }
 
-          if (url.pathname === '/api/canvas/ax/mode' && req.method === 'POST') {
-            return handleAxModeRequest(req);
-          }
+          // POST /api/canvas/ax/mode + POST /api/canvas/ax/mode/:id/resolve migrated
+          // to the operation registry (plan-007 Slice B wave 2).
 
-          if (url.pathname.startsWith('/api/canvas/ax/mode/') && url.pathname.endsWith('/resolve') && req.method === 'POST') {
-            const modeId = decodeURIComponent(
-              url.pathname.slice('/api/canvas/ax/mode/'.length, -'/resolve'.length),
-            );
-            return handleAxModeResolve(req, modeId);
-          }
-
-          if (url.pathname.startsWith('/api/canvas/ax/mode/') && !url.pathname.endsWith('/resolve') && req.method === 'GET') {
-            const modeId = decodeURIComponent(url.pathname.slice('/api/canvas/ax/mode/'.length));
-            return handleAxModeGet(url, modeId, req);
-          }
+          // GET /api/canvas/ax/mode/:id (single-item read + ?waitMs long-poll)
+          // migrated to the operation registry (plan-007 Slice B wave 4).
 
           if (url.pathname === '/api/canvas/ax/command' && req.method === 'GET') {
             return handleAxCommandList();
           }
 
-          if (url.pathname === '/api/canvas/ax/command' && req.method === 'POST') {
-            return handleAxCommandInvoke(req);
-          }
+          // POST /api/canvas/ax/command migrated to the operation registry
+          // (plan-007 Slice B wave 3): src/server/operations/ops/ax-timeline.ts.
 
           if (url.pathname === '/api/canvas/ax/policy' && req.method === 'GET') {
             return handleAxPolicyGet();
           }
 
-          if (url.pathname === '/api/canvas/ax/policy' && req.method === 'POST') {
-            return handleAxPolicySet(req);
-          }
-
-          // Spatial context API
-          if (url.pathname === '/api/canvas/spatial-context' && req.method === 'GET') {
-            const layout = canvasState.getLayout();
-            const spatial = buildSpatialContext(layout.nodes, layout.edges, canvasState.contextPinnedNodeIds, layout.annotations);
-            return responseJson(spatial);
-          }
-
-          // Search API
-          if (url.pathname === '/api/canvas/search' && req.method === 'GET') {
-            const q = url.searchParams.get('q') ?? '';
-            if (!q.trim()) {
-              return responseJson({ results: [], query: q });
-            }
-            const results = searchNodes(canvasState.getLayout().nodes, q);
-            return responseJson({ results, query: q });
-          }
-
-          // Group API
-          if (url.pathname === '/api/canvas/group' && req.method === 'POST') {
-            return handleCanvasCreateGroup(req);
-          }
-
-          if (url.pathname === '/api/canvas/group/add' && req.method === 'POST') {
-            return handleCanvasGroupNodes(req);
-          }
-
-          if (url.pathname === '/api/canvas/group/ungroup' && req.method === 'POST') {
-            return handleCanvasUngroupNodes(req);
-          }
-
-          // Arrange / Focus / Clear API (for agent CLI)
-          if (url.pathname === '/api/canvas/arrange' && req.method === 'POST') {
-            return handleCanvasArrange(req);
-          }
-
-          if (url.pathname === '/api/canvas/focus' && req.method === 'POST') {
-            return handleCanvasFocus(req);
-          }
-
-          if (url.pathname === '/api/canvas/fit' && req.method === 'POST') {
-            return handleCanvasFit(req);
-          }
-
-          if (url.pathname === '/api/canvas/clear' && req.method === 'POST') {
-            for (const node of canvasState.getLayout().nodes) {
-              closeNodeAppSession(node);
-            }
-            clearCanvas();
-            emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-            return responseJson({ ok: true });
-          }
+          // POST /api/canvas/ax/policy migrated to the operation registry (plan-007 Slice B.1).
 
           // Code graph API
           if (url.pathname === '/api/canvas/code-graph' && req.method === 'GET') {
@@ -5801,54 +3748,10 @@ export function startCanvasServer(options: CanvasServerOptions = {}): string | n
             return responseJson(summary);
           }
 
-          if (url.pathname === '/api/canvas/json-render' && req.method === 'POST') {
-            return handleCanvasAddJsonRender(req);
-          }
-
-          if (url.pathname === '/api/canvas/json-render/stream' && req.method === 'POST') {
-            return handleJsonRenderStream(req);
-          }
-
-          if (url.pathname === '/api/canvas/graph' && req.method === 'POST') {
-            return handleCanvasAddGraph(req);
-          }
-
           if (url.pathname === '/api/canvas/prompt' && req.method === 'POST') {
             return handleCanvasPrompt(req);
           }
 
-          // Undo/Redo/History API
-          if (url.pathname === '/api/canvas/undo' && req.method === 'POST') {
-            const entry = mutationHistory.undo();
-            if (!entry) return responseJson({ ok: false, description: 'Nothing to undo' });
-            await syncCanvasRuntimeBackends();
-            emitPrimaryWorkbenchEvent('canvas-viewport-update', { viewport: canvasState.viewport });
-            emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-            return responseJson({ ok: true, description: `Undid: ${entry.description}` });
-          }
-
-          if (url.pathname === '/api/canvas/redo' && req.method === 'POST') {
-            const entry = mutationHistory.redo();
-            if (!entry) return responseJson({ ok: false, description: 'Nothing to redo' });
-            await syncCanvasRuntimeBackends();
-            emitPrimaryWorkbenchEvent('canvas-viewport-update', { viewport: canvasState.viewport });
-            emitPrimaryWorkbenchEvent('canvas-layout-update', { layout: canvasState.getLayout() });
-            return responseJson({ ok: true, description: `Redid: ${entry.description}` });
-          }
-
-          if (url.pathname === '/api/canvas/history' && req.method === 'GET') {
-            return responseJson({
-              text: mutationHistory.toHumanReadable(),
-              entries: mutationHistory.getSummaries(),
-              canUndo: mutationHistory.canUndo(),
-              canRedo: mutationHistory.canRedo(),
-            });
-          }
-
-          if (url.pathname === '/api/canvas/validate' && req.method === 'GET') {
-            return handleCanvasValidate();
-          }
-
           if (url.pathname === '/api/ext-app/call-tool' && req.method === 'POST') {
             return handleExtAppCallTool(req);
           }