@1agh/maude 0.40.0 → 0.42.0

package/apps/studio/http.ts

@@ -16,7 +16,8 @@ import { canvasLibPath } from './canvas-lib-resolver.ts';
 import { TranspileError } from './canvas-pipeline.ts';
 import type { AiActivity } from './collab/ai-activity.ts';
 import type { Context } from './context.ts';
-import { isFormat, isScope, runExport } from './exporters/index.ts';
+import { type Format, isFormat, isScope, type Scope } from './exporters/index.ts';
+import { type ExportJobQueue, ExportQueueFullError } from './exporters/jobs.ts';
 import type { ActiveJsonShape } from './exporters/scope.ts';
 import { createGitEndpoints } from './git/endpoints.ts';
 import { gitShowFile } from './git/service.ts';
@@ -594,7 +595,13 @@ export interface Http {
   isCanvasSafeRoute(pathname: string): boolean;
 }
 
-export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActivity): Http {
+export function createHttp(
+  ctx: Context,
+  api: Api,
+  inspect: Inspect,
+  ai: AiActivity,
+  exportJobs: ExportJobQueue
+): Http {
   // Cache invalidation — when canvas-lib changes, every cached canvas bundle
   // is stale because canvas-lib is inlined into each one via the resolver
   // plugin. Drop the whole cache so the next request rebuilds with the fresh
@@ -722,6 +729,38 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
   const gitJson = (r: { status: number; json: unknown }) =>
     Response.json(r.json, { status: r.status, headers: { 'Cache-Control': 'no-store' } });
 
+  // Shared by /_api/export and /_api/export-jobs — build the exportJobs.enqueue()
+  // args from a validated request body. `inspect.state` is the live `_active.json`;
+  // readers narrow to the resolver's subset locally so the export pipeline doesn't
+  // pin the wider ActiveState interface.
+  function buildExportArgs(
+    req: Request,
+    body: { format: Format; scope: Scope; options?: Record<string, unknown> }
+  ) {
+    const activeJson = inspect.state as unknown as ActiveJsonShape;
+    return {
+      format: body.format,
+      scope: body.scope,
+      options: body.options ?? {},
+      resolve: { activeJson, designRoot: ctx.paths.designRoot, repoRoot: ctx.paths.repoRoot },
+      ctx: {
+        designRoot: ctx.paths.designRoot,
+        repoRoot: ctx.paths.repoRoot,
+        // Adapters reach back into the server via this origin only when they
+        // need Playwright rendering (PNG / PDF / SVG / HTML). The host that
+        // received this request is, by definition, the one serving the canvas.
+        serverOrigin: new URL(req.url).origin,
+        // Mirror `client/app.jsx:85` — the per-DS tokensCssRel wins over the
+        // legacy top-level default (which still points at the pre-multi-DS
+        // layout `system/colors_and_type.css`). Without the per-DS path, the
+        // standalone `_canvas-shell.html` 404s on the tokens link and the
+        // rendered DOM uses `var(--bg-0)` unresolved → screenshots come out
+        // blank. See canvasShellUrl().
+        tokensCssRel: ctx.cfg.designSystems?.[0]?.tokensCssRel ?? ctx.cfg.tokensCssRel,
+      },
+    };
+  }
+
   const routes = {
     '/_health': () =>
       Response.json({
@@ -1409,6 +1448,7 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
         property?: unknown;
         value?: unknown;
         reset?: unknown;
+        idIndex?: unknown;
       }>(req, 8 * 1024);
       if (!body) return new Response('body required', { status: 400 });
       const result = await api.editCss(body);
@@ -1780,6 +1820,228 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
       );
     },
 
+    '/_api/delete-element': async (req: Request) => {
+      // Stage I (feature-element-editing-robustness) — delete an element by
+      // data-cd-id. POST { canvas, id, idIndex? } → api.deleteElementOp (reparse
+      // gate; reused-component instance via idIndex). Logs a whole-file undo seq
+      // (Cmd+Z via /_api/reorder-revert — a structural edit churns positional
+      // ids so an inverse descriptor goes stale). Same MAIN-ORIGIN-ONLY trust
+      // boundary as /_api/reorder: absent from CANVAS_SAFE_API + startCanvasServer
+      // routes (DDR-054); sameOriginWrite CSRF + loopback-Host (DNS-rebinding) gated.
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{ canvas?: unknown; id?: unknown; idIndex?: unknown }>(
+        req,
+        8 * 1024
+      );
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.deleteElementOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, deletedId: result.deletedId, seq: result.seq },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    '/_api/insert-element': async (req: Request) => {
+      // Stage I — insert a synthesized div/text/image relative to `refId`. POST
+      // { canvas, refId, position, kind, src?, refIndex? } → api.insertElementOp.
+      // Returns the new element's post-transpile id so the shell can select it.
+      // Whole-file undo seq. MAIN-ORIGIN ONLY (absent from both allowlists);
+      // sameOriginWrite + loopback-Host gated. An `image` src is contained to
+      // assets/ in the engine (no remote hotlink / ../ / scheme).
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{
+        canvas?: unknown;
+        refId?: unknown;
+        position?: unknown;
+        kind?: unknown;
+        src?: unknown;
+        refIndex?: unknown;
+      }>(req, 8 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.insertElementOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, newId: result.newId, seq: result.seq },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    '/_api/duplicate-element': async (req: Request) => {
+      // Cmd+D (Task L3) — duplicate an element (a copy as the next sibling). POST
+      // { canvas, id, idIndex? } → api.duplicateElementOp. Whole-file undo seq.
+      // MAIN-ORIGIN ONLY; sameOriginWrite + loopback-Host gated (dual-allowlist).
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{ canvas?: unknown; id?: unknown; idIndex?: unknown }>(
+        req,
+        8 * 1024
+      );
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.duplicateElementOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, newId: result.newId, seq: result.seq },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    '/_api/insert-artboard': async (req: Request) => {
+      // Stage I4 — insert a new EMPTY artboard from a screen-size preset. POST
+      // { canvas, id, label, width, height } → api.insertArtboardOp (appends a
+      // <DCArtboard id label width height></DCArtboard> after the last artboard;
+      // size JSX-authoritative per DDR-027). Whole-file undo seq. MAIN-ORIGIN
+      // ONLY (absent from both allowlists); sameOriginWrite + loopback-Host gated.
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{
+        canvas?: unknown;
+        id?: unknown;
+        label?: unknown;
+        width?: unknown;
+        height?: unknown;
+      }>(req, 8 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.insertArtboardOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, artboardId: result.artboardId, seq: result.seq },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    '/_api/assets': async (req: Request) => {
+      // Stage F1 (feature-element-editing-robustness) — list content-addressed
+      // image/video assets under <designRoot>/assets/ for the AssetPicker (Replace
+      // image / insert image). GET → { assets:[{path,name,ext,kind,size,mtimeMs}] }.
+      // MAIN-ORIGIN ONLY: the picker is a shell dialog; absent from CANVAS_SAFE_API
+      // + startCanvasServer routes (dual-allowlist, DDR-054). Loopback-Host gated
+      // (DNS-rebinding); read-only, so no sameOriginWrite (GET).
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const r = await api.listAssets();
+      return Response.json(
+        { ok: true, assets: r.assets },
+        { headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    '/_api/edit-scope': async (req: Request) => {
+      // Stage H (feature-element-editing-robustness) — the INV-3 predictability
+      // verdict. GET ?canvas&id&rendered → { ok, scope:'local'|'shared',
+      // componentName, affects, reason }. READ-only (a parse the shell runs on
+      // selection to render the Local/Shared badge). MAIN-ORIGIN ONLY: absent
+      // from CANVAS_SAFE_API + startCanvasServer routes (dual-allowlist, DDR-054);
+      // loopback-Host gated (DNS-rebinding); no sameOriginWrite (GET).
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const url = new URL(req.url);
+      const result = await api.editScopeOp({
+        canvas: url.searchParams.get('canvas') ?? undefined,
+        id: url.searchParams.get('id') ?? undefined,
+        rendered: url.searchParams.get('rendered') ?? undefined,
+      });
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(result, { headers: { 'Cache-Control': 'no-store' } });
+    },
+
+    '/_api/resize-artboard': async (req: Request) => {
+      // Stage D4 — free-hand artboard resize. POST { canvas, artboardId, width?,
+      // height? } → api.resizeArtboardOp (writes the NUMERIC width/height props on
+      // the <DCArtboard id="…">, addressed by its `id` prop since the rendered
+      // <article data-dc-screen> carries no data-cd-id; DDR-027). Whole-file undo
+      // seq. MAIN-ORIGIN ONLY; sameOriginWrite + loopback-Host gated.
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{
+        canvas?: unknown;
+        artboardId?: unknown;
+        width?: unknown;
+        height?: unknown;
+      }>(req, 8 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.resizeArtboardOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, seq: result.seq },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    '/_api/delete-artboard': async (req: Request) => {
+      // Delete an artboard by its `id` prop (Backspace / context-menu on a frame).
+      // POST { canvas, artboardId } → api.deleteArtboardOp (removes the
+      // <DCArtboard id="…"> span; refuses the last one). Whole-file undo seq.
+      // MAIN-ORIGIN ONLY; sameOriginWrite + loopback-Host gated (dual-allowlist).
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{ canvas?: unknown; artboardId?: unknown }>(req, 8 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.deleteArtboardOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, seq: result.seq },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
     '/_api/asset': async (req: Request) => {
       // Phase 23 / DDR-148 — binary media upload from the canvas (drag-drop /
       // paste). POST raw bytes → content-addressed write under
@@ -1818,17 +2080,28 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
 
     '/_api/export-history': async (req: Request) => {
       // Phase 6.5 T10 — read-only recent-exports feed for the dialog's
-      // Recent tab. Writes happen as a side-effect of `/_api/export`.
+      // Recent tab. Writes happen as a side-effect of job completion
+      // (exporters/jobs.ts persistAndEvict) rather than this handler.
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      const history = await api.loadExportHistory();
+      const history = exportJobs.loadHistory();
       return Response.json({ history }, { headers: { 'Cache-Control': 'no-store' } });
     },
 
     '/_api/export': async (req: Request) => {
-      // Phase 6.5 — single dispatch endpoint for the export pipeline.
-      // POST body { format, scope, options? } → binary stream with
-      // Content-Disposition + Content-Type set by the adapter.
+      // feature-background-export-notification-center — thin wrapper over the
+      // job queue: enqueue() then await the SAME job's result. Byte-for-byte
+      // identical external contract to the old synchronous handler, so
+      // `/design:export` (CLI) and any other blocking caller need zero changes.
+      // sameOriginWrite CSRF + loopback-Host (DNS-rebinding) gated, matching
+      // the write-route convention elsewhere in this file (e.g.
+      // /_api/delete-element) — closed as part of the /flow:done security
+      // fan-out (defender finding: this POST now has a disk-write + queue-
+      // growth consequence a bare cross-origin form-POST could trigger).
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         format?: unknown;
         scope?: unknown;
@@ -1837,63 +2110,108 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
       if (!body) return new Response('body required', { status: 400 });
       if (!isFormat(body.format)) return new Response('unknown or missing format', { status: 400 });
       if (!isScope(body.scope)) return new Response('unknown or missing scope', { status: 400 });
-      // `inspect.state` is the live `_active.json` — readers narrow to the
-      // resolver's subset locally so the export pipeline doesn't pin the
-      // wider ActiveState interface.
-      const activeJson = inspect.state as unknown as ActiveJsonShape;
+      const format = body.format;
+      const scope = body.scope;
       try {
-        const result = await runExport({
-          format: body.format,
-          scope: body.scope,
-          options: body.options ?? {},
-          resolve: { activeJson, designRoot: ctx.paths.designRoot, repoRoot: ctx.paths.repoRoot },
-          ctx: {
-            designRoot: ctx.paths.designRoot,
-            repoRoot: ctx.paths.repoRoot,
-            // Adapters reach back into the server via this origin only when
-            // they need Playwright rendering (PNG / PDF / SVG / HTML). The
-            // host that received this request is, by definition, the one
-            // serving the canvas.
-            serverOrigin: new URL(req.url).origin,
-            // Mirror `client/app.jsx:85` — the per-DS tokensCssRel wins over
-            // the legacy top-level default (which still points at the pre-
-            // multi-DS layout `system/colors_and_type.css`). Without the
-            // per-DS path, the standalone `_canvas-shell.html` 404s on the
-            // tokens link and the rendered DOM uses `var(--bg-0)` unresolved
-            // → screenshots come out blank. See canvasShellUrl().
-            tokensCssRel: ctx.cfg.designSystems?.[0]?.tokensCssRel ?? ctx.cfg.tokensCssRel,
-          },
-        });
-        // Fire-and-forget history append — failure here doesn't block the
-        // download. Synchronous await keeps the order: history reflects the
-        // export the moment the client sees a 200.
-        try {
-          await api.appendExportHistory({
-            format: body.format,
-            scope: body.scope,
-            options: body.options ?? {},
-            filename: result.filename,
-            at: new Date().toISOString(),
-          });
-        } catch {
-          /* ignore — history is best-effort */
-        }
+        const { result } = exportJobs.enqueue(
+          buildExportArgs(req, { format, scope, options: body.options })
+        );
+        const finished = await result;
         // Bun.serve accepts Uint8Array directly; the cast satisfies the
         // SharedArrayBuffer-strict BodyInit narrowing on @types/bun.
-        return new Response(result.body as unknown as BodyInit, {
+        return new Response(finished.body as unknown as BodyInit, {
           status: 200,
           headers: {
-            'Content-Type': result.contentType,
-            'Content-Disposition': `attachment; filename="${result.filename}"`,
+            'Content-Type': finished.contentType,
+            'Content-Disposition': `attachment; filename="${finished.filename}"`,
             'Cache-Control': 'no-store',
           },
         });
       } catch (err) {
+        if (err instanceof ExportQueueFullError) {
+          return new Response(err.message, { status: 429 });
+        }
         const msg = err instanceof Error ? err.message : String(err);
         return new Response(`export failed: ${msg}`, { status: 500 });
       }
     },
 
+    '/_api/export-jobs': async (req: Request) => {
+      // feature-background-export-notification-center — the non-blocking
+      // sibling of /_api/export: same body, returns 202 { jobId } immediately
+      // without awaiting the render. MAIN-ORIGIN ONLY (absent from
+      // CANVAS_SAFE_API + startCanvasServer routes, same trust boundary as
+      // /_api/export today — DDR-060). loopback-Host gated on every method;
+      // the mutating POST is additionally sameOriginWrite CSRF gated (same
+      // /flow:done security fan-out fix as /_api/export above).
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      if (req.method === 'GET') {
+        return Response.json(
+          { jobs: exportJobs.list() },
+          { headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      const body = await readJson<{
+        format?: unknown;
+        scope?: unknown;
+        options?: Record<string, unknown>;
+      }>(req, 64 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      if (!isFormat(body.format)) return new Response('unknown or missing format', { status: 400 });
+      if (!isScope(body.scope)) return new Response('unknown or missing scope', { status: 400 });
+      try {
+        const { id, result } = exportJobs.enqueue(
+          buildExportArgs(req, { format: body.format, scope: body.scope, options: body.options })
+        );
+        // This route deliberately doesn't await the render — the job's own
+        // status (surfaced via GET /_api/export-jobs + the export:job WS
+        // push) is the completion signal. A render failure still needs a
+        // handler here or it's an unhandled rejection on every failed/timed-
+        // out background job (security fan-out finding, /flow:done) — the
+        // failure is already recorded on the job record, so this is a no-op.
+        result.catch(() => {});
+        return Response.json(
+          { jobId: id },
+          { status: 202, headers: { 'Cache-Control': 'no-store' } }
+        );
+      } catch (err) {
+        if (err instanceof ExportQueueFullError) {
+          return new Response(err.message, { status: 429 });
+        }
+        throw err;
+      }
+    },
+
+    '/_api/export-jobs/download': async (req: Request) => {
+      // MAIN-ORIGIN ONLY, same boundary as /_api/export-jobs above.
+      // loopback-Host gated (read-only — no sameOriginWrite needed — but an
+      // unguessable job-scoped UUID plus this guard closes the DNS-rebinding
+      // angle the /flow:done security fan-out checked for).
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const id = new URL(req.url).searchParams.get('id');
+      if (!id) return new Response('id query param required', { status: 400 });
+      const dl = await exportJobs.getBytes(id);
+      if (!dl.ok) {
+        return new Response(dl.reason === 'not-done' ? 'job not finished' : 'Not found', {
+          status: dl.reason === 'not-done' ? 409 : 404,
+        });
+      }
+      return new Response(dl.bytes as unknown as BodyInit, {
+        status: 200,
+        headers: {
+          'Content-Type': dl.contentType,
+          'Content-Disposition': `attachment; filename="${dl.filename}"`,
+          'Cache-Control': 'no-store',
+        },
+      });
+    },
+
     '/_canvas-state': async (req: Request) => {
       const url = new URL(req.url);
       if (req.method === 'GET') {

package/apps/studio/input-router.tsx

@@ -475,6 +475,18 @@ export function useInputRouter(opts: UseInputRouterOptions): void {
       if (action.kind !== 'no-op') {
         e.preventDefault();
         e.stopImmediatePropagation();
+        // preventDefault above stops mousedown's default FOCUS, so a Cmd-click
+        // select would leave the iframe unfocused and every in-canvas keyboard
+        // shortcut (arrow-nudge, Cmd+D, copy/paste-style, Delete) dead until a
+        // drag happened to focus it (dogfood: "funguje jen když hnu myší").
+        // Restore canvas focus explicitly so the keydown listeners fire.
+        if (action.kind === 'select') {
+          try {
+            window.focus();
+          } catch {
+            /* focus may be rejected outside a user gesture */
+          }
+        }
       }
     };
 

package/apps/studio/marquee-overlay.tsx

@@ -54,7 +54,7 @@ function isChromeTarget(t: EventTarget | null): boolean {
   const el = t as Element;
   if (
     el.closest(
-      '.dc-mm, .dc-zoom-tb, .dc-tool-palette, .dc-context-menu, .dc-cv-halo, .dc-cv-group-bbox, .cm-composer, .cm-thread, .cm-mention-popup, .cm-pin, .dc-annot-svg, .dc-annot-ctx, .dc-tp-popover, .dc-annot-resize-handle, .dc-multi-artboard-tb, .dc-elem-ctx-tb, .dc-cv-eq-spacing-layer'
+      '.dc-mm, .dc-zoom-tb, .dc-tool-palette, .dc-context-menu, .dc-cv-halo, .dc-cv-group-bbox, .cm-composer, .cm-thread, .cm-mention-popup, .cm-pin, .dc-annot-svg, .dc-annot-ctx, .dc-tp-popover, .dc-annot-resize-handle, .dc-el-resize-handle, .dc-multi-artboard-tb, .dc-elem-ctx-tb, .dc-cv-eq-spacing-layer'
     )
   ) {
     return true;