domma-cms 1.6.55 → 1.6.57

package/plugins/security/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "security",
   "displayName": "Security",
-  "version": "1.1.3",
+  "version": "1.2.0",
   "tier": "free",
   "description": "Keeps a Domma CMS site safe: a health check of what is weak and how to fix it, sign-in lockout after repeated wrong passwords, password rules, a log of every sign-in, and blocking of the scanners that probe every site for WordPress, .env files and the like.",
   "author": "Domma CMS",
-  "date": "2026-09-27",
+  "date": "2026-10-15",
   "minCmsVersion": "0.83.0",
   "icon": "shield",
   "permissions": [

package/plugins/security/tests/screen-state.test.js

@@ -0,0 +1,69 @@
+/** Security - the screen's pure decisions (admin/lib/screen-state.js). */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {applySettingsChanges, settingsChanges, draftKey, draftNote, draftValues, fingerprint, signinCounts, signinInResult, signinMatches, stableJson, usableDraft, withCount} from '../admin/lib/screen-state.js';
+
+test('fingerprint ignores key order and changes with any value', () => {
+    assert.equal(stableJson({b: 1, a: [1, {d: 2, c: 3}]}), '{"a":[1,{"c":3,"d":2}],"b":1}');
+    assert.equal(fingerprint({a: 1, b: {c: 2}}), fingerprint({b: {c: 2}, a: 1}));
+    assert.notEqual(fingerprint({a: 1}), fingerprint({a: 2}));
+    assert.notEqual(fingerprint({lockout: {enabled: true}}), fingerprint({lockout: {enabled: false}}));
+});
+
+test('a kept draft says when the settings were saved since; an old or matching one says nothing', () => {
+    const fp = fingerprint({signinDays: 30});
+    assert.equal(draftNote({was: fp}, fp), '');
+    assert.match(draftNote({was: fp}, fingerprint({signinDays: 60})), /those later changes stay/);
+    assert.match(draftNote({was: fp, full: true}, fingerprint({signinDays: 60})), /older changes over them/);
+    assert.equal(draftNote({was: ''}, fp), '', 'a draft without was cannot know');
+    assert.equal(draftNote({was: fp}, ''), '', 'the stored settings could not be read');
+});
+
+test('usableDraft checks what storage holds; draftValues keeps only the form\'s keys', () => {
+    assert.equal(usableDraft(null), null);
+    assert.equal(usableDraft('x'), null);
+    assert.equal(usableDraft({values: [1]}), null);
+    assert.deepEqual(usableDraft({changes: {acc: '5'}, was: 'w', at: 't'}), {changes: {acc: '5'}, was: 'w', at: 't', full: false});
+    assert.deepEqual(usableDraft({values: {acc: '5'}, was: 7}), {changes: {acc: '5'}, was: '', at: '', full: true}, 'an older full-values draft is still read');
+    assert.equal(usableDraft({changes: {}}), null, 'nothing changed: nothing to offer');
+    assert.equal(usableDraft({changes: ['x']}), null);
+    assert.deepEqual(draftValues({acc: '5', evil: 'x', lockOn: false}, ['acc', 'lockOn', 'max']), {acc: '5', lockOn: false});
+    assert.equal(draftKey(''), '');
+    assert.equal(draftKey('u1'), 'security.settings-draft.u1');
+});
+
+test('sign-in counts agree with the filters the list uses', () => {
+    const log = [
+        {email: 'a@x.test', ip: '1.1.1.1', ok: true},
+        {email: 'a@x.test', ip: '1.1.1.1', ok: false, reason: 'password'},
+        {email: 'b@x.test', ip: '2.2.2.2', ok: false, reason: 'unknown'},
+        {email: 'b@x.test', ip: '2.2.2.2', ok: true, kind: 'reset'}
+    ];
+    assert.deepEqual(signinCounts(log), {all: 4, failed: 2, ok: 1, resets: 1});
+    assert.deepEqual(signinCounts(log, {ip: '2.2.2.2'}), {all: 2, failed: 1, ok: 0, resets: 1});
+    assert.deepEqual(signinCounts(log, {query: 'A@X'}), {all: 2, failed: 1, ok: 1, resets: 0});
+    for (const r of ['all', 'failed', 'ok', 'resets']) {
+        assert.equal(log.filter(e => signinInResult(e, r) && signinMatches(e, {})).length, signinCounts(log)[r], r);
+    }
+    assert.equal(signinInResult(log[3], 'ok'), false, 'a reset\'s ok is not a sign-in');
+});
+
+test('a count on each button; none while nothing is loaded', () => {
+    assert.equal(withCount('Failed', 3), 'Failed 3');
+    assert.equal(withCount('All', 1234), 'All 1,234');
+    assert.equal(withCount('Failed', undefined), 'Failed');
+});
+
+test('a draft keeps only what was changed, and lays just that over the settings as they are now', () => {
+    const opened = {acc: '5', lockOn: true, days: '30', stale: '90'};
+    const typed = {...opened, days: '45'};
+    const changes = settingsChanges(typed, opened);
+    assert.deepEqual(changes, {days: '45'});
+    assert.deepEqual(settingsChanges(opened, opened), {});
+    assert.deepEqual(settingsChanges({...opened, lockOn: false}, opened), {lockOn: false}, 'a switch turned off is a change');
+    // Someone else saved stale = 120 and switched the lockout off since: both stay.
+    const now = {acc: '5', lockOn: false, days: '30', stale: '120'};
+    assert.deepEqual(applySettingsChanges(now, changes), {acc: '5', lockOn: false, days: '45', stale: '120'});
+    assert.deepEqual(applySettingsChanges(now, {evil: 'x'}), now, 'a key the form lacks is never added');
+    assert.deepEqual(applySettingsChanges(now, null), now);
+});

package/plugins/shopping-cart/CLAUDE.md

@@ -250,3 +250,16 @@ no amount, reason or restock box, and OK refunded the WHOLE order. `refund()` in
 slideover (`openPanel`, like Fulfil): amount (prefilled with what is left), reason, restock box (greyed out unless the
 amount is all that is left), a Refund button. Never put form fields in `E.confirm` / `E.alert`.
 `tests/pure.test.js` "admin: no form fields inside E.confirm" guards it across the admin views.
+
+## 1.7.0 (2026-10-15 Tool Upgrade, second pass)
+
+- Product and settings drafts live in `admin/lib/drafts.js` (pure, tested): one map under
+  `shopping-cart.product-drafts` and `shopping-cart.settings-draft`. Payment keys are never kept (`SECRET_KEYS`), a
+  draft carries `was`, and OK on the restore question means throw away. Pro's Downloads values are not drafted.
+- `openPanel` takes `busy`, `discarded` and `lock`. `wireRows` handles Shift+F10 once (`keyboardTrigger: false`) and
+  leaves fields to the browser.
+- Anything a key press leads to that may open an E.confirm runs on the next task (`kit.soon` / `deferItems`;
+  `wireRows` defers Enter and menu actions). Domma's dialog otherwise reads the same Enter as OK, and every OK here is
+  destructive.
+- Fulfil and Refund panels are in `actionPanels`, closed by the screen teardown; their saves refuse once it has gone.
+- The accounts test sets a Site URL in `config/site.json` and restores it (`/account/register` needs a link base).

package/plugins/shopping-cart/admin/css/index.css

@@ -9,6 +9,16 @@
 .shp-note.is-bad { color: var(--dm-danger); }
 .shp-spacer { flex: 1; }
 .shp-loading { color: var(--dm-text-muted); padding: 2rem 0; }
+/* A skeleton slot: a block of its own (a flex row would collapse the skeleton to a sliver). */
+.shp-loading-slot { display: block; color: var(--dm-text-muted); font-size: var(--dm-text-sm); min-height: 1.5rem; }
+.shp-sales.is-busy .shp-tiles, .shp-sales.is-busy .shp-card { opacity: .55; transition: opacity .15s; }
+/* Drafts left unsaved with no row to show them on (a new product, one deleted since). */
+.shp-drafts { display: flex; flex-wrap: wrap; align-items: center; gap: .4rem; padding: .5rem .7rem; border: 1px dashed color-mix(in srgb, var(--dm-primary) 45%, var(--dm-border));
+    border-radius: var(--dm-radius-md); font-size: var(--dm-text-sm); color: var(--dm-text-muted); }
+.shp-drafts button.shp-chip { border: 0; cursor: pointer; font: inherit; font-size: var(--dm-text-xs); font-weight: 600; }
+.shp-drafts button.shp-chip:hover { background: color-mix(in srgb, var(--dm-primary) 24%, transparent); }
+.shp-form.is-locked { opacity: .7; cursor: progress; }
+.shp-restored { border-left-color: var(--dm-primary); background: color-mix(in srgb, var(--dm-primary) 8%, transparent); font-size: var(--dm-text-sm); }
 
 /* Tabs under the banner */
 .shp-nav { display: flex; flex-wrap: wrap; gap: .15rem; border-bottom: 1px solid var(--dm-border); }
@@ -106,6 +116,9 @@ a.shp-tile:hover { border-color: var(--dm-primary); }
 .shp-mini-main { flex: 1; min-width: 0; display: flex; flex-direction: column; }
 .shp-mini-main small { color: var(--dm-text-muted); font-size: var(--dm-text-xs); }
 .shp-mini-amt { font-weight: 600; font-variant-numeric: tabular-nums; }
+.shp-top.is-link { cursor: pointer; border-radius: var(--dm-radius-sm); }
+.shp-top.is-link:hover, .shp-top.is-link:focus-visible { background: var(--shp-soft); outline: none; }
+.shp-mini .shp-kebab { flex: none; }
 .shp-top { display: grid; grid-template-columns: minmax(0, 1fr) 30% auto; gap: .75rem; align-items: center; padding: .4rem 0; }
 .shp-top-name { display: flex; flex-direction: column; min-width: 0; }
 .shp-top-name small { color: var(--dm-text-muted); font-size: var(--dm-text-xs); }
@@ -121,7 +134,7 @@ a.shp-tile:hover { border-color: var(--dm-primary); }
     border: 1px solid var(--dm-border); border-radius: var(--dm-radius-md); padding: .75rem 1rem; }
 .shp-steps li::before { content: counter(st); grid-row: 1 / 3; width: 2rem; height: 2rem; border-radius: 50%; display: grid; place-items: center;
     background: var(--shp-soft); font-weight: 700; }
-.shp-steps li.is-done::before { content: '✓'; background: var(--dm-success); color: #fff; }
+.shp-steps li.is-done::before { content: '✓'; background: color-mix(in srgb, var(--dm-success) 18%, transparent); color: var(--dm-success); }
 .shp-steps li span { grid-column: 2; color: var(--dm-text-muted); font-size: var(--dm-text-sm); }
 .shp-steps li .btn { grid-column: 3; grid-row: 1 / 3; }
 
@@ -158,9 +171,12 @@ a.shp-tile:hover { border-color: var(--dm-primary); }
 .shp-pic, .shp-pic-add { position: relative; width: 5.5rem; height: 5.5rem; border-radius: var(--dm-radius-md); overflow: hidden; }
 .shp-pic { cursor: grab; background: var(--shp-soft); }
 .shp-pic img { width: 100%; height: 100%; object-fit: cover; display: block; }
-.shp-pic-x { position: absolute; top: .25rem; right: .25rem; width: 1.4rem; height: 1.4rem; border-radius: 50%; border: 0; background: rgba(0,0,0,.6); color: #fff;
-    cursor: pointer; line-height: 1; opacity: 0; transition: opacity .15s; }
-.shp-pic:hover .shp-pic-x, .shp-pic-x:focus { opacity: 1; }
+.shp-pic-x, .shp-pic-more { position: absolute; top: .25rem; right: .25rem; width: 1.4rem; height: 1.4rem; border-radius: 50%; border: 1px solid var(--dm-border);
+    background: color-mix(in srgb, var(--dm-surface, var(--dm-body-bg)) 88%, transparent); color: var(--dm-text); cursor: pointer; line-height: 1; padding: 0;
+    opacity: 0; transition: opacity .15s; }
+.shp-pic-more { right: auto; left: .25rem; }
+.shp-pic:hover .shp-pic-x, .shp-pic-x:focus, .shp-pic:hover .shp-pic-more, .shp-pic-more:focus, .shp-pic:focus-within .shp-pic-more, .shp-pic:focus-within .shp-pic-x { opacity: 1; }
+.shp-pic:focus-visible { outline: 2px solid var(--dm-primary); outline-offset: 2px; }
 .shp-pic-main { position: absolute; left: .25rem; bottom: .25rem; font-size: .62rem; font-weight: 700; background: var(--dm-primary); color: var(--dm-primary-text, #fff);
     padding: .05rem .35rem; border-radius: 999px; }
 .shp-pic-add { border: 1.5px dashed var(--dm-border); background: none; color: var(--dm-text-muted); cursor: pointer; display: flex; flex-direction: column;
@@ -178,7 +194,7 @@ a.shp-tile:hover { border-color: var(--dm-primary); }
 .shp-variants-head .form-label { margin: 0; white-space: nowrap; }
 .shp-optname { max-width: 12rem; }
 .shp-vtable { width: 100%; display: flex; flex-direction: column; gap: .35rem; }
-.shp-vrow { display: grid; grid-template-columns: minmax(0, 2fr) minmax(0, 1fr) minmax(0, 1.2fr) minmax(0, .9fr) 1.8rem; gap: .35rem; align-items: center; }
+.shp-vrow { display: grid; grid-template-columns: minmax(0, 2fr) minmax(0, 1fr) minmax(0, 1.2fr) minmax(0, .9fr) 1.6rem 1.6rem; gap: .35rem; align-items: center; }
 .shp-vrow.is-head { font-size: var(--dm-text-xs); color: var(--dm-text-muted); font-weight: 600; }
 .shp-vrow .form-input { padding: .35rem .5rem; font-size: var(--dm-text-sm); }
 

package/plugins/shopping-cart/admin/lib/drafts.js

@@ -0,0 +1,174 @@
+/**
+ * Shop admin - kept drafts (pure; tested in ../../tests/drafts.test.js).
+ *
+ * The product editor keeps what was left unsaved, one entry per product in ONE
+ * stored map (`shopping-cart.product-drafts`, key = the product's id, `new` for
+ * one not yet added). Every change reads the map fresh, changes its own entry
+ * and writes it straight back - nothing holds a copy across an await, so a
+ * screen that has gone cannot write an old map over a newer one.
+ *
+ * A draft carries `was` - the product's updatedAt when the edits it holds
+ * began - so the restore question can say the product was changed (or
+ * deleted) since. Shop settings keep a draft too, WITHOUT the payment keys
+ * (`SECRET_KEYS` never reach storage); their `was` is a fingerprint of the
+ * settings as they were, since settings have no updatedAt.
+ *
+ * Every restore question puts the DESTRUCTIVE answer on OK ("Throw away"):
+ * Domma's E.confirm answers false for Cancel, Escape and the backdrop alike,
+ * so a false must always keep the changes.
+ */
+
+export const PRODUCT_DRAFTS_KEY = 'shopping-cart.product-drafts';
+export const SETTINGS_DRAFT_KEY = 'shopping-cart.settings-draft';
+export const NEW_KEY = 'new';
+
+/** Settings that are never kept in a draft (the browser's storage is not a safe). */
+export const SECRET_KEYS = ['stripeSecretKey', 'stripeWebhookSecret', 'paypalClientId', 'paypalSecret'];
+
+/** The map's key for a product id ('' / null = a new product). */
+export const draftKey = (id) => (id ? String(id) : NEW_KEY);
+
+/** JSON with object keys sorted, so two equal values always compare equal. */
+export function stableJson(v) {
+    if (Array.isArray(v)) return `[${v.map(stableJson).join(',')}]`;
+    if (v && typeof v === 'object') {
+        return `{${Object.keys(v).sort().filter(k => v[k] !== undefined).map(k => `${JSON.stringify(k)}:${stableJson(v[k])}`).join(',')}}`;
+    }
+    return JSON.stringify(v ?? null);
+}
+
+/** Is this a usable kept draft (this module's shape)? */
+export function isDraft(d) {
+    return Boolean(d && typeof d === 'object' && d.values && typeof d.values === 'object' && !Array.isArray(d.values));
+}
+
+/** The stored map, whatever an older build or a broken write left there. */
+export function readMap(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {};
+    const out = {};
+    for (const [k, d] of Object.entries(raw)) if (isDraft(d)) out[k] = d;
+    return out;
+}
+
+/** The map with `key` set to `draft` (null removes it). A new object; the input is untouched. */
+export function withDraft(map, key, draft) {
+    const out = {...readMap(map)};
+    if (draft) out[key] = draft; else delete out[key];
+    return out;
+}
+
+/** Does the draft hold anything the form does not already show? Only the form's own fields count. */
+export function draftDiffers(draft, form) {
+    if (!isDraft(draft)) return false;
+    const keys = Object.keys(form || {});
+    const pick = (o) => Object.fromEntries(keys.map(k => [k, o?.[k]]));
+    return stableJson(pick(draft.values)) !== stableJson(pick(form));
+}
+
+/** A draft's values, limited to the form's own fields (an older build may have kept others). */
+export function draftValues(draft, form) {
+    const out = {};
+    for (const k of Object.keys(form || {})) if (isDraft(draft) && k in draft.values) out[k] = draft.values[k];
+    return out;
+}
+
+/**
+ * What became of the record since the draft's edits began.
+ * @param {{was?: string|null, at?: string}} draft
+ * @param {string|null|undefined} now - the record's updatedAt (or fingerprint) now; null = it has gone
+ * @returns {'deleted'|'changed'|''}
+ */
+export function draftFate(draft, now) {
+    if (now === null) return 'deleted';
+    if (!now) return '';
+    if (draft?.was) return now !== draft.was ? 'changed' : '';
+    return '';
+}
+
+/** E.confirm renders its message as HTML: a product's name goes in escaped. */
+export const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+
+const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+/** "15 Oct, 14:05" - local time; '' for anything unreadable. */
+export function when(iso) {
+    const t = Date.parse(iso);
+    if (!Number.isFinite(t)) return '';
+    const d = new Date(t);
+    const p = (n) => String(n).padStart(2, '0');
+    return `${d.getDate()} ${MONTHS[d.getMonth()]}, ${p(d.getHours())}:${p(d.getMinutes())}`;
+}
+
+const KEEP = {title: 'Unsaved changes', confirmText: 'Throw away', cancelText: 'Keep them'};
+
+/**
+ * The question a kept product draft is offered back with. OK throws it away;
+ * Cancel / Escape / backdrop keep it - put back in the form, or (`asNew`: the
+ * product has been deleted) made into a new product.
+ * @param {object} draft
+ * @param {{name?: string, updatedAt?: string}|null} product - as stored now; null when it has gone
+ * @param {{isNew?: boolean}} [opts]
+ * @returns {{text: string, asNew: boolean, options: object}}
+ */
+export function productDraftQuestion(draft, product, {isNew = false} = {}) {
+    const name = esc(String(product?.name || draft?.values?.name || '').trim());
+    const what = isNew ? `a new product${name ? ` (“${name}”)` : ''}` : (name ? `“${name}”` : 'this product');
+    const at = when(draft?.at);
+    const ask = `Throw away the changes you left unsaved on ${what}${at ? ` (${at})` : ''}?`;
+    if (isNew) return {asNew: false, options: KEEP, text: `${ask} Keeping them puts them back in the form.`};
+    switch (draftFate(draft, product ? (product.updatedAt || '') : null)) {
+        case 'deleted':
+            return {asNew: true, options: {...KEEP, cancelText: 'Keep them as a new product'},
+                text: `${ask} The product has been deleted since - keeping them makes a new product from them.`};
+        case 'changed':
+            return {asNew: false, options: KEEP,
+                text: `${ask} The product has been changed since${product.updatedAt ? ` (${when(product.updatedAt)})` : ''} - keeping them puts your changes over that when you save.`};
+        default:
+            return {asNew: false, options: KEEP, text: `${ask} Keeping them puts them back in the form.`};
+    }
+}
+
+/**
+ * A deleted product's draft, made a new product's: its `was` meant the old
+ * record, so it starts empty; its options lose their ids (they belonged to the
+ * deleted product); `adopted` tells the editor the person has already said keep.
+ */
+export function adoptAsNew(draft, now = new Date().toISOString()) {
+    const values = {...(draft?.values || {})};
+    if (Array.isArray(values.variants)) values.variants = values.variants.map(v => ({...v, id: ''}));
+    return {values, slugTouched: Boolean(draft?.slugTouched), was: null, at: draft?.at || now, adopted: true};
+}
+
+/** The question for another new-product draft an adopted one would replace. */
+export function replaceNewDraftQuestion(other) {
+    const name = esc(String(other?.values?.name || '').trim());
+    const at = when(other?.at);
+    return {
+        text: `There is already a new product left unsaved${name ? ` - “${name}”` : ''}${at ? ` (${at})` : ''}. Throw it away to make room for these changes?`,
+        options: {title: 'Unsaved new product', confirmText: 'Throw it away', cancelText: 'Keep both'}
+    };
+}
+
+// ---- Settings ---------------------------------------------------------------------
+
+/** Settings values safe to keep: everything but the payment keys. */
+export function keepableSettings(values) {
+    const out = {};
+    for (const [k, v] of Object.entries(values || {})) if (!SECRET_KEYS.includes(k)) out[k] = v;
+    return out;
+}
+
+/** A fingerprint of the stored settings (secrets left out - they arrive masked anyway). */
+export const settingsFingerprint = (settings) => stableJson(keepableSettings(settings));
+
+/** The settings' restore question. OK throws the draft away; anything else puts it back. */
+export function settingsDraftQuestion(draft, nowFingerprint) {
+    const at = when(draft?.at);
+    const ask = `Throw away the changes you left unsaved in Shop settings${at ? ` (${at})` : ''}?`;
+    const changed = draftFate(draft, nowFingerprint || '') === 'changed';
+    return {
+        options: KEEP,
+        text: changed
+            ? `${ask} The settings have been changed since - keeping them puts your changes over that when you save. Payment keys are never kept; type them again if you changed any.`
+            : `${ask} Keeping them puts them back in the form. Payment keys are never kept; type them again if you changed any.`
+    };
+}

package/plugins/shopping-cart/admin/lib/kit.js

@@ -17,22 +17,27 @@ export const BASE = '/api/plugins/shopping-cart';
 
 let kit = null;
 
-/** tool-kit, plugin-chrome and help-popover, once, with stand-ins for an older admin. */
+/** tool-kit, plugin-chrome, help-popover and loading, once, with stand-ins for an older admin. */
 export function loadKit() {
     if (!kit) {
         kit = Promise.all([
             import('/admin/js/lib/tool-kit.js').catch(() => ({})),
             import('/admin/js/lib/plugin-chrome.js').catch(() => ({})),
-            import('/admin/js/lib/help-popover.js').catch(() => ({}))
-        ]).then(([tk, chrome, help]) => ({
+            import('/admin/js/lib/help-popover.js').catch(() => ({})),
+            import('/admin/js/lib/loading.js').catch(() => ({}))
+        ]).then(([tk, chrome, help, loading]) => ({
             onceClosed: tk.onceClosed || ((so, fn) => { const c = so.close.bind(so); so.close = (...a) => { const r = c(...a); fn?.(); return r; }; }),
             openMenuAt: tk.openMenuAt || ((el) => {
                 const r = el.getBoundingClientRect();
                 el.dispatchEvent(new MouseEvent('contextmenu', {bubbles: true, cancelable: true, clientX: r.left, clientY: r.bottom, view: window}));
             }),
-            viewLifetime: tk.viewLifetime || (() => ({add() {}, reset() {}})),
+            viewLifetime: tk.viewLifetime || (() => ({add() { return () => {}; }, reset() {}})),
+            promptWith: tk.promptWith || ((message, options, value) => E.prompt(message, {...options, inputValue: String(value ?? '')})),
             addBannerAction: chrome.addBannerAction || (() => null),
-            helpPopovers: help.helpPopovers || (() => () => {})
+            helpPopovers: help.helpPopovers || (() => () => {}),
+            // A skeleton while a first load runs (core's loading.js); an older core just waits.
+            whileLoading: loading.whileLoading || ((slot, promise) => (typeof promise === 'function' ? promise() : promise)),
+            SHAPES: loading.SHAPES || {}
         }));
     }
     return kit;
@@ -95,11 +100,61 @@ export function fragment(html) {
     return t.content.firstElementChild;
 }
 
+/**
+ * `fn`, run on the next task instead of now. Anything a key press leads to that may open a dialog goes through
+ * this: Domma's dialog listens for keys on the document from the moment it opens, so one opened while an Enter
+ * is still on its way up reads that same Enter as OK - and every OK here is the destructive answer (Throw away,
+ * Discard, Delete). A click does not need it, but it costs nothing, so buttons and menu items use it too.
+ */
+export const soon = (fn) => (...args) => { setTimeout(() => fn(...args), 0); };
+
+/** Storage that never throws (blocked storage, private windows). */
 export const store = {
-    get(k) { try { return S.get(k); } catch { return null; } },
-    set(k, v) { try { S.set(k, v); } catch { /* a convenience */ } }
+    get(k) { try { return S.get(k) ?? null; } catch { return null; } },
+    set(k, v) { try { S.set(k, v); } catch { /* a convenience */ } },
+    remove(k) { try { if (S.remove) S.remove(k); else S.set(k, null); } catch { /* a convenience */ } }
 };
 
+/**
+ * E.confirm that a screen can take back: `dismiss()` answers it with Cancel -
+ * which every question here makes the keeping, non-destructive answer - so a
+ * question about a screen the person has left does not stay up over the next
+ * one. The caller ignores the answer once its screen has gone.
+ *
+ * @returns {{answer: Promise<boolean>, dismiss: () => void}}
+ */
+export function ask(text, options = {}) {
+    const answer = E.confirm(text, options);
+    const box = [...document.querySelectorAll('.dm-dialog')].at(-1) || null;
+    return {
+        answer,
+        dismiss() {
+            if (!box?.isConnected) return;
+            const label = options.cancelText || 'Cancel';
+            [...box.querySelectorAll('button')].find(b => b.textContent.trim() === label)?.click();
+        }
+    };
+}
+
+/**
+ * Once-only claims for panels, per mount: `take(key)` answers a release
+ * function, or null when that panel is already opening or open (a double
+ * click, a row clicked while its panel is still loading). Whoever takes a
+ * claim must release it if opening fails, or the panel never opens again.
+ */
+export function claims() {
+    const held = new Map();
+    return {
+        take(key) {
+            if (held.has(key)) return null;
+            const token = {};
+            held.set(key, token);
+            return () => { if (held.get(key) === token) held.delete(key); };
+        },
+        has: (key) => held.has(key)
+    };
+}
+
 /** The sidebar re-asks the Shop's badge. */
 export function refreshBadge() {
     try { window.dispatchEvent(new CustomEvent('dm:sidebar-count', {detail: {url: SIDEBAR_URL}})); } catch { /* no sidebar */ }
@@ -135,12 +190,22 @@ export function when(iso) {
 // ---- Slideovers ---------------------------------------------------------------------
 
 /**
- * Open a slideover holding `html`, bound to `model`. Closing with something
- * changed asks first (once). Everything is disposed and removed on close.
+ * Open a slideover holding `html`, bound to `model`. Everything is disposed
+ * and removed on close.
  *
- * @returns {Promise<{so, panel, close: (force?: boolean) => void}>}
+ * - `dirty()`: closing (X, Escape, the backdrop, Close) asks first - OK
+ *   discards, Cancel / Escape keep the panel open.
+ * - `busy()`: while true (a save on its way) the person cannot close it; only
+ *   code can (`close(true)`), so the panel the save reports back to is still there.
+ * - `discarded()`: called when the PERSON closes it (after saying discard, or
+ *   with nothing to lose) - not when code force-closes it (a save, the screen
+ *   going) - so a kept draft is dropped only on their say-so.
+ * - `lock(on)` makes the form inert while a save that closes the panel runs, so
+ *   nothing typed meanwhile is lost with it.
+ *
+ * @returns {Promise<{so, panel, close: (force?: boolean) => void, isOpen: () => boolean, lock: (on: boolean) => void}>}
  */
-export async function openPanel({title, size = 'md', html, model = {}, methods = {}, dirty, cleanup = () => {}, before}) {
+export async function openPanel({title, size = 'md', html, model = {}, methods = {}, dirty, busy, discarded, cleanup = () => {}, before}) {
     const {onceClosed, helpPopovers} = await loadKit();
     const so = E.slideover({title: esc(title), size, position: 'right'});
     const panel = fragment(html);
@@ -148,17 +213,25 @@ export async function openPanel({title, size = 'md', html, model = {}, methods =
     before?.(panel);
     const disposeHelp = helpPopovers(panel);
     const handle = M.applyBindings(model, panel, {methods});
-    onceClosed(so, () => { cleanup(); handle.dispose(); disposeHelp(); });
+    let question = null;
+    onceClosed(so, () => { question?.dismiss(); cleanup(); handle.dispose(); disposeHelp(); });
     const close = so.close.bind(so);
     let closed = false;
-    let asking = false;
     so.close = async (force) => {
-        if (!closed && force !== true && dirty?.()) {
-            if (asking) return undefined;
-            asking = true;
-            const ok = await E.confirm('Discard your changes?');
-            asking = false;
-            if (!ok) return undefined;
+        if (!closed && force !== true) {
+            if (busy?.()) return undefined;
+            if (dirty?.()) {
+                if (question) return undefined;
+                // Not inside the key press that asked to close (Enter on Close, Escape): see soon().
+                question = {dismiss() {}};
+                await new Promise(r => setTimeout(r, 0));
+                if (closed) { question = null; return undefined; }
+                question = ask('Discard your changes?', {title: 'Unsaved changes', confirmText: 'Discard', cancelText: 'Keep editing'});
+                const ok = await question.answer;
+                question = null;
+                if (!ok || closed || busy?.()) return undefined;
+            }
+            try { discarded?.(); } catch { /* the panel still closes */ }
         }
         closed = true;
         return close();
@@ -168,7 +241,12 @@ export async function openPanel({title, size = 'md', html, model = {}, methods =
     });
     I.scan(panel);
     so.open();
-    return {so, panel, close: (force) => so.close(force)};
+    return {
+        so, panel,
+        close: (force) => so.close(force),
+        isOpen: () => !closed,
+        lock(on) { panel.inert = Boolean(on); panel.classList.toggle('is-locked', Boolean(on)); }
+    };
 }
 
 /**
@@ -212,26 +290,47 @@ export async function mountPanels(anchor, {on, ctx, info = {}}) {
     return {panels, destroy: () => undo.forEach(fn => { try { fn(); } catch { /* gone */ } })};
 }
 
+/** Typing fields keep the browser's own right-click (paste) and their own clicks. */
+const FIELDS = 'input, textarea, select';
+
 /**
  * Rows: click (or Enter) = the main action; right-click, ⋮ or Shift+F10 = the
- * menu. `scope` receives the teardown.
+ * menu. A right-click or click on a field inside a row is left to the
+ * browser. `scope` receives the teardown.
  */
 export function wireRows(list, {items, main, openMenuAt, scope, match = '.shp-row'}) {
-    const menu = E.contextMenu(list, {cursor: 'glyph', match, inherit: false, density: 'compact',
-        items: (row) => items(row.dataset.id)});
+    // keyboardTrigger off: Shift+F10 is answered here, once (Domma's own document listener answering it too
+    // opened the menu and closed it again at once), and the ContextMenu key is left alone (Chrome on Windows
+    // opens its own menu on key-up).
+    // Menu items run on the next task: an item picked with Enter that asks something must not hand it that Enter.
+    const menu = E.contextMenu(list, {cursor: 'glyph', match, exclude: FIELDS, inherit: false, density: 'compact', keyboardTrigger: false,
+        items: (row) => deferItems(items(row.dataset.id))});
     const onClick = (e) => {
         const row = e.target.closest(match);
-        if (!row) return;
-        if (e.target.closest('[data-stop]')) return;
+        if (!row || !list.contains(row)) return;
+        if (e.target.closest('[data-stop]') || e.target.closest(FIELDS)) return;
         const kebab = e.target.closest('.shp-kebab');
         if (kebab) { openMenuAt(kebab); return; }
         main(row.dataset.id);
     };
     const onKey = (e) => {
         const row = e.target.closest(match);
-        if (!row) return;
-        if (e.key === 'F10' && e.shiftKey) { e.preventDefault(); openMenuAt(row); }
-        else if (e.key === 'Enter' && e.target === row) main(row.dataset.id);
+        if (!row || !list.contains(row)) return;
+        if (e.key === 'F10' && e.shiftKey) {
+            if (e.target.closest(FIELDS)) return;
+            e.preventDefault();
+            e.stopPropagation();
+            openMenuAt(row.querySelector('.shp-kebab') || row);
+        }
+        else if (e.key === 'Enter' && e.target === row) {
+            // A link row follows itself. Otherwise the Enter stops here and the main action runs after it,
+            // so a question it opens (a kept draft's) does not read this Enter as OK.
+            if (row.matches('a[href]')) return;
+            e.preventDefault();
+            e.stopPropagation();
+            const id = row.dataset.id;
+            setTimeout(() => main(id), 0);
+        }
         else if ((e.key === 'ArrowDown' || e.key === 'ArrowUp') && e.target === row) {
             e.preventDefault();
             const rows = [...list.querySelectorAll(match)].filter(r => r.offsetParent);
@@ -243,6 +342,15 @@ export function wireRows(list, {items, main, openMenuAt, scope, match = '.shp-ro
     scope(() => { list.removeEventListener('click', onClick); list.removeEventListener('keydown', onKey); menu?.destroy?.(); });
 }
 
+/** Menu items with every action deferred (soon), submenus included. */
+export function deferItems(list) {
+    return (list || []).map(x => ({
+        ...x,
+        ...(typeof x.action === 'function' ? {action: soon(x.action)} : {}),
+        ...(Array.isArray(x.items) ? {items: deferItems(x.items)} : {})
+    }));
+}
+
 /** Copy text, and say so. */
 export function copy(text, what = 'Copied') {
     navigator.clipboard?.writeText(text).then(() => E.toast(`${what}.`, {type: 'success'}), () => E.toast(text));