---
summary: "Canvas source relocated to src/services/canvas/ matching graph/llm/speech layout (consumer subpath @cyanheads/mcp-ts-core/canvas unchanged); design / add-tool / security-pass skills surface it as an option for tabular API servers."
breaking: false
---

# 0.8.10 — 2026-05-02

Internal refactor + skill docs follow-up to the v0.8.9 DataCanvas landing. Canvas source moves under `src/services/` to match the existing service-domain layout (graph, llm, speech). Consumer surface is unchanged — `@cyanheads/mcp-ts-core/canvas`, `ctx.core.canvas?`, env vars, and exported symbols are all identical.

## Changed

- **Canvas source relocated** — `src/canvas/` → `src/services/canvas/` (12 files: `core/{canvasFactory,CanvasInstance,CanvasRegistry,DataCanvas,IDataCanvasProvider,sqlGate}.ts`, `providers/duckdb/{DuckdbProvider,exportWriter,schemaSniffer}.ts`, `index.ts`, `types.ts`). `@module` JSDoc headers rewritten to `src/services/canvas/...`. Tests followed: `tests/unit/canvas/` → `tests/unit/services/canvas/` (7 suites).
- **`package.json` `./canvas` export remap** — `dist/canvas/index.{js,d.ts}` → `dist/services/canvas/index.{js,d.ts}`. Subpath name unchanged for consumers.
- **Internal import paths** — `src/core/app.ts` (`createCanvasService`, `DataCanvas` type) and `tests/smoke/canvas-duckdb.test.ts` (`CanvasRegistry`, `DataCanvas`, `sqlGate`, `DuckdbProvider`) rewritten to `@/services/canvas/...`.

## Docs

- **`skills/add-tool/SKILL.md`** — new bullet under "Match response density to context budget" framing `DataCanvas` as one option for tabular working sets that exceed context budgets. Pointer to `api-canvas` for the register / query / export pattern.
- **`skills/design-mcp-server/SKILL.md`** — Step 7 callout: "Tabular API servers: DataCanvas is one option" — describes when to consider the framework primitive vs. designing custom analytical state, with `ctx.core.canvas?` guard and Workers fail-closed note. Conditional checklist item added: "If exposing a SQL/analytical workspace over tabular data is in scope".
- **`skills/security-pass/SKILL.md`** — Step 1 capture block lists canvas-specific config to record when `CANVAS_PROVIDER_TYPE=duckdb` is set (auth mode, per-tenant cap, TTLs, export path, external rate-limiting status). New **Axis 9 — Canvas** subsection with 6 review checks framed around the public-data, token-sharing trade-off (designed for BrAPI / OpenAlex–style servers, not user-scoped data). Conditional checklist item added.
- **`README.md`** — DataCanvas surfaced in features bullet, `CANVAS_PROVIDER_TYPE` row in env-var table, `DataCanvas`/`CanvasInstance` import in subpath-exports block (originally landed as [acb6550](https://github.com/cyanheads/mcp-ts-core/commit/acb65505de4876c66119d4e9f68d49e442172f78), shipped here).
- **`AGENTS.md` / `CLAUDE.md`** — version header bumped (was stale at 0.8.7).
- **`docs/tree.md`** — regenerated to reflect the canvas relocation.
