domma-cms 1.6.56 → 1.6.57

package/plugins/_lib/admin/mail/when-closed.js

@@ -5,9 +5,19 @@
  * `options[event]` when that happens to be a function, so it silently does
  * nothing - every "on close" cleanup in the mail client written that way
  * (editor teardown, resize handles, address suggesters, settling a dialog's
- * promise when it was closed by its X) never ran. `options.onClose` is what
- * close() itself reads, at the moment it closes - so it also fires only when a
- * close really happens, after any "discard changes?" guard has let it through.
+ * promise when it was closed by its X) never ran.
+ *
+ * Two kinds of component, two hooks:
+ *
+ * - A slideover is a class whose close() reads `options.onClose` at the moment
+ *   it closes - so chaining that fires only when a close really happens, after
+ *   any "discard changes?" guard has let it through.
+ * - E.modal is a `<domma-modal>` web component. Its handle's `options` is the
+ *   element's `_options` - usually undefined, so the old code returned without
+ *   hooking anything - and close() never reads it: it dispatches a `close` DOM
+ *   event instead - for the X, the backdrop, Escape and close() alike. Chaining
+ *   `onClose` there did nothing at all, which is how a modal shut with Escape
+ *   left its promise unsettled (Email Pro saw it). The event is what fires.
  *
  * @module _lib/admin/mail/when-closed
  *
@@ -17,6 +27,26 @@
  */
 export function whenClosed(component, fn) {
     const opts = component?.options;
+    const el = component?.element;
+    // The web component (`<domma-modal>` - a custom element's tag has a
+    // hyphen). Its handle's `options` is the element's `_options`, which is
+    // often not even set, so it cannot be what decides.
+    const custom = typeof el?.tagName === 'string' && el.tagName.includes('-');
+    if (el && typeof el.addEventListener === 'function' && (custom || !opts || el._options === opts)) {
+        // Once per close: the X sits in the modal's shadow root, so its click
+        // also reaches the host's backdrop handler and close() emits twice.
+        // Re-armed when the modal opens again.
+        let fired = false;
+        el.addEventListener('open', (event) => { if (event.target === el) fired = false; });
+        el.addEventListener('close', (event) => {
+            // `close` bubbles and is composed: a modal opened INSIDE this one
+            // closing must not count as this one closing.
+            if (event.target !== el || fired) return;
+            fired = true;
+            try { fn(component); } catch { /* one cleanup failing must not stop the next */ }
+        });
+        return;
+    }
     if (!opts) return;
     const previous = opts.onClose;
     opts.onClose = (instance) => {

package/plugins/_lib/mail/readRoutes.js

@@ -151,7 +151,8 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
     }
 
     /**
-     * Run an IMAP operation, turning transport failures into tidy 502s.
+     * Run an IMAP operation, turning transport failures into tidy 502s
+     * (resolving to undefined after replying).
      *
      * @param   {object} reply
      * @param   {() => Promise<any>} fn
@@ -163,7 +164,11 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
         } catch (err) {
             fastify.log.error({err}, `[${pluginName}] IMAP operation failed`);
             reply.code(502).send({error: describeError(err)});
-            return null;
+            // undefined, NOT null: an async handler that resolves to anything
+            // but undefined has it sent as well, and Fastify logs "Reply was
+            // already sent" over the 502 just sent (every IMAP failure did it,
+            // /folders?counts=1 most visibly).
+            return undefined;
         }
     }
 
@@ -177,19 +182,40 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
      * STATUS (no select, so nothing can be marked read), and kept a minute
      * per user - the sidebar asks every minute from every open admin tab.
      */
+    // The badge's minute-long cache, per user. Forgotten whenever that user's
+    // mailboxes change or a read goes to the server anyway (a Refresh, the
+    // folder counts), so the screen's `dm:sidebar-count` after it gets the
+    // new number rather than the one from before.
+    //
+    // Each forget also bumps the user's generation: a badge request that was
+    // already on its way (asking IMAP) when the forget happened carries the
+    // old one, and must not write its now-stale count back into the cache.
+    const badgeCache = new Map();
+    const badgeGen = new Map();
+    const forgetBadge = (uid) => {
+        if (!uid) return;
+        badgeCache.delete(uid);
+        badgeGen.set(uid, (badgeGen.get(uid) ?? 0) + 1);
+    };
+    // A mailbox that failed (a changed password, a server down) is not asked
+    // again every minute: that is a failed IMAP login per minute per open tab,
+    // enough to trip fail2ban or a provider lockout. It backs off 5 min, doubling
+    // to an hour; saving the account (a new updatedAt) retries straight away, and
+    // so does the mailbox answering anywhere else (a Refresh, a folder listing) -
+    // or a working Refresh would leave the badge red for up to an hour.
+    const failures = new Map();
+    const failKey = (uid, account) => `${uid}:${account.id}:${account.updatedAt || account.createdAt || ''}`;
+    const clearFailures = (uid, accountId) => {
+        const prefix = `${uid}:${accountId}:`;
+        for (const key of failures.keys()) if (key.startsWith(prefix)) failures.delete(key);
+    };
     if (withUnreadBadge) {
-        const badgeCache = new Map();
-        // A mailbox that failed (a changed password, a server down) is not asked
-        // again every minute: that is a failed IMAP login per minute per open tab,
-        // enough to trip fail2ban or a provider lockout. It backs off 5 min, doubling
-        // to an hour; saving the account (a new updatedAt) retries straight away.
-        const failures = new Map();
-        const failKey = (uid, account) => `${uid}:${account.id}:${account.updatedAt || account.createdAt || ''}`;
         fastify.get('/unread', {preHandler: [authenticate]}, async (request, reply) => {
             const uid = userId(request);
             if (!uid) return reply.code(401).send({error: 'Authentication required.'});
             const hit = badgeCache.get(uid);
             if (hit && Date.now() - hit.at < 60_000) return hit.value;
+            const gen = badgeGen.get(uid) ?? 0;
             const boxes = [];
             for (const account of await accounts.listAccounts(uid)) {
                 const key = failKey(uid, account);
@@ -207,7 +233,8 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
                 }
             }
             const value = unreadBadge(boxes);
-            badgeCache.set(uid, {at: Date.now(), value});
+            // Only if nothing changed while IMAP was being asked.
+            if ((badgeGen.get(uid) ?? 0) === gen) badgeCache.set(uid, {at: Date.now(), value});
             return value;
         });
     }
@@ -235,6 +262,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
         if (!where.ok) return reply.code(400).send({error: where.error});
 
         const saved = await accounts.saveAccount(uid, null, result.value);
+        forgetBadge(uid);
         return {account: accounts.toPublic(saved)};
     });
 
@@ -255,6 +283,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
         const saved = await accounts.saveAccount(uid, request.params.id, result.value);
         // The pooled connection was opened with the old details.
         pool.release(`${uid}:${request.params.id}`);
+        forgetBadge(uid);
         return {account: accounts.toPublic(saved)};
     });
 
@@ -277,6 +306,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
         const existing = await accounts.getAccount(uid, request.params.id);
         const deleted = await accounts.deleteAccount(uid, request.params.id);
         if (!deleted) return reply.code(404).send({error: 'That mailbox does not exist.'});
+        forgetBadge(uid);
         // A signed-in mailbox hands its sign-in back where the provider allows
         // it (Google). Best-effort and after the delete: forgetting it here
         // must not wait on, or fail because of, the provider.
@@ -366,7 +396,10 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
             // folder listing pays.
             if (request.query.counts === '1') {
                 await withUnreadCounts(ctx, folders);
+                forgetBadge(ctx.uid);
             }
+            // The mailbox answered: it is not failing any more.
+            clearFailures(ctx.uid, ctx.account.id);
 
             return {accountId: ctx.account.id, folders};
         });
@@ -429,6 +462,11 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
         // answered from the store - instant, and no connection needed. It
         // returns null for anything not mirrored, which falls through to the
         // wire exactly as the free edition always does.
+        if (request.query.fresh === '1') {
+            // A Refresh: ask the server again for the badge, back-off or not.
+            forgetBadge(ctx.uid);
+            clearFailures(ctx.uid, ctx.account.id);
+        }
         if (cachedList && request.query.fresh !== '1') {
             try {
                 const cached = await cachedList({

package/plugins/_lib/mail/unreadBadge.js

@@ -27,7 +27,10 @@ export function unreadBadge(boxes = []) {
         label: boxes.length
             ? `${plural(count, 'unread message')} in the inbox${boxes.length > 1 ? 'es' : ''}${failed ? ` (${plural(failed, 'mailbox', 'mailboxes')} could not be checked)` : ''}`
             : 'No mailbox set up',
-        tone: 'info',
+        // A mailbox that cannot be reached is the thing worth seeing: red, and
+        // shown even at 0 - otherwise a broken password reads as "all read".
+        tone: failed ? 'danger' : 'info',
+        ...(failed ? {showZero: true} : {}),
         details: {
             title: 'Mail',
             rows: boxes.map(b => ({

package/plugins/blog/CLAUDE.md

@@ -339,3 +339,17 @@ Declared in plugin.json `permissions` (granted once to `admin`), checked on EVER
   read. **Every non-GET route of this plugin forgets it in an `onSend` hook** - before the writer's response leaves -
   so the admin's own next read, and the public POST /comments, are fresh. The TTL only covers writes made outside
   the plugin (Collections tool, Blog Pro). Callers share the cached array: filter/sort copies, never mutate it.
+
+## 1.10.0 (2026-10-15 Tool Upgrade, second pass)
+
+- **Drafts**: pure rules in `admin/lib/drafts.js` (tests/drafts.test.js); storage via `drafts.read/keep/drop` in
+  views/kit.js, one key per draft (`blog.draft.<key>`), never a map. A kept draft carries `was`; the restore question
+  puts "Throw away" on OK, so Cancel/Escape keep it, and a draft is removed only after an answer.
+- **`post.new` is owned**: each editor mount stamps an `owner` token. A new post's first save drops `post.new` only
+  when it is this editor's; leaving during that save keeps the draft under the post's real id (back to `post.new`
+  if the save fails); `keepDraft()` never overwrites another editor's `post.new` (warning toast instead).
+- `viewScope()` returns `add` with `add.here()` - check it after EVERY await, including right after `scanHelp`
+  (an overtaken mount disposes its popovers and returns before binding).
+- `menuKeys(list, rowSel)`: Shift+F10 on a focused row opens its menu. `pokeSidebar()` after any change that moves
+  the badge. `withSkeleton(slot, promise, shape)` wraps core's loading.js (slot must be a block element).
+- Settings: leaving always keeps the draft (the old `unloading` flag is gone).

package/plugins/blog/admin/css/index.css

@@ -204,3 +204,8 @@
 .blog-save-state.is-dirty { color: var(--dm-warning, #d97706); }
 .blog-save-state.is-dirty::before { content: '●'; margin-right: .3rem; font-size: .7em; vertical-align: .1em; }
 .blog-editor-bar .btn { display: inline-flex; align-items: center; gap: .35rem; }
+
+/* The first-load skeleton's slot (admin/js/lib/loading.js draws into it). No
+   display rule here: one would beat the [hidden] the binding sets. */
+.blog-loading { color: var(--dm-text-muted); font-size: var(--dm-text-sm); }
+.blog-editor[hidden] { display: none !important; }

package/plugins/blog/admin/lib/drafts.js

@@ -0,0 +1,95 @@
+/**
+ * Kept drafts - what an editor left unsaved when its screen (or panel) was
+ * left, and how to tell, when it is offered back, whether the record moved on
+ * meanwhile.
+ *
+ * PURE: no DOM, no storage - the views keep each draft under its own key (one
+ * per editor, never a map of drafts) and tests/drafts.test.js covers this.
+ *
+ * A draft is `{id, name, values, was, at}`: `id` the record (null for a new
+ * one), `was` the record's version when editing BEGAN (its updatedAt, or a
+ * fingerprint of the fields that matter when it has none - a category, the
+ * settings), `at` when it was kept.
+ *
+ * @module blog/admin/lib/drafts
+ */
+
+/** JSON with sorted keys, so {a, b} and {b, a} are one value. */
+export function stableJson(value) {
+    if (Array.isArray(value)) return `[${value.map(stableJson).join(',')}]`;
+    if (value && typeof value === 'object') {
+        return `{${Object.keys(value).sort().filter(k => value[k] !== undefined)
+            .map(k => `${JSON.stringify(k)}:${stableJson(value[k])}`).join(',')}}`;
+    }
+    return JSON.stringify(value ?? null);
+}
+
+/** A short fingerprint of a value (FNV-1a over its stable JSON). */
+export function fingerprint(value) {
+    const s = stableJson(value);
+    let h = 0x811c9dc5;
+    for (let i = 0; i < s.length; i++) {
+        h ^= s.charCodeAt(i);
+        h = Math.imul(h, 0x01000193) >>> 0;
+    }
+    return `f:${h.toString(36)}`;
+}
+
+/**
+ * A record's version: its updatedAt when it has one, else a fingerprint of
+ * `keys` (or of the whole record). '' for no record.
+ *
+ * @param {object|null} record
+ * @param {string[]} [keys] - the fields that matter
+ * @returns {string}
+ */
+export function versionOf(record, keys = null) {
+    if (!record || typeof record !== 'object') return '';
+    if (record.updatedAt) return `u:${record.updatedAt}`;
+    const picked = keys ? Object.fromEntries(keys.map(k => [k, record[k] ?? null])) : record;
+    return fingerprint(picked);
+}
+
+/**
+ * How a kept draft stands against the record as it is now.
+ *
+ * @param {{id?: string|null, values?: object, was?: string, at?: string}|null} draft
+ * @param {object|null} record - null when it no longer exists
+ * @param {string[]} [keys] - as versionOf
+ * @returns {'none'|'same'|'changed'|'deleted'}
+ */
+export function draftState(draft, record, keys = null) {
+    if (!draft || !draft.values) return 'none';
+    if (!draft.id) return 'same';
+    if (!record) return 'deleted';
+    if (draft.was) return draft.was === versionOf(record, keys) ? 'same' : 'changed';
+    // A draft kept before `was` existed: by the clock, when the record says when it was saved.
+    return draft.at && record.updatedAt && String(record.updatedAt) > String(draft.at) ? 'changed' : 'same';
+}
+
+/**
+ * The question asked when a kept draft is found, as plain text (the caller
+ * escapes it). Asked so that OK is the DESTRUCTIVE answer - "Throw away" -
+ * because Domma's E.confirm resolves false for Cancel, Escape and a backdrop
+ * click alike, and dismissing must never lose someone's work: Cancel keeps
+ * the changes (puts them back in the form).
+ *
+ * @param {object} o
+ * @param {string} o.what   - 'post', 'category', 'settings'…
+ * @param {string} [o.name] - the record's name, when it has one
+ * @param {'same'|'changed'|'deleted'} o.state
+ * @param {boolean} [o.isNew] - the draft is of a record not yet saved
+ * @returns {string}
+ */
+export function restoreQuestion({what, name = '', state, isNew = false}) {
+    const which = isNew ? `a new ${what}` : name ? `the ${what} "${name}"` : `the ${what}`;
+    const note = state === 'changed'
+        ? ` It has been saved since you left them - keeping yours puts your older changes over it once you save.`
+        : state === 'deleted'
+            ? ` It has been deleted since - keeping yours starts it again as a new ${what}.`
+            : '';
+    return `Throw away the changes you left unsaved to ${which}?${note}`;
+}
+
+/** The answers that go with restoreQuestion: OK throws away, Cancel (and Escape) keeps. */
+export const RESTORE_ANSWERS = Object.freeze({confirmText: 'Throw away', cancelText: 'Keep them'});

package/plugins/blog/admin/templates/blog.html

@@ -30,7 +30,7 @@
     <span data-help="Search matches titles, excerpts and slugs. Right-click a post, or use its ⋮, to publish, unpublish, duplicate or delete it."></span>
   </div>
 
-  <p class="blog-state" data-if="loading.value">Loading posts…</p>
+  <div class="blog-loading dm-loading-slot" data-bind-hidden="!loading.value">Loading posts…</div>
   <p class="blog-state" data-if="isEmpty.value" data-bind-text="emptyText.value"></p>
 
   <div class="blog-list">

package/plugins/blog/admin/templates/categories.html

@@ -11,7 +11,7 @@
     </span>
   </div>
 
-  <p class="blog-state" data-if="loading.value">Loading categories…</p>
+  <div class="blog-loading dm-loading-slot" data-bind-hidden="!loading.value">Loading categories…</div>
   <p class="blog-state" data-if="isEmpty.value">No categories yet - New category adds one.</p>
 
   <div class="blog-list">

package/plugins/blog/admin/templates/comments.html

@@ -19,7 +19,7 @@
   </p>
   <p class="blog-note blog-note--quiet" data-if="!commentsOff.value" data-bind-text="moderationText.value"></p>
 
-  <p class="blog-state" data-if="loading.value">Loading comments…</p>
+  <div class="blog-loading dm-loading-slot" data-bind-hidden="!loading.value">Loading comments…</div>
   <p class="blog-state" data-if="isEmpty.value" data-bind-text="emptyText.value"></p>
 
   <div class="blog-list">

package/plugins/blog/admin/templates/post-editor.html

@@ -16,7 +16,11 @@
   </div>
 </div>
 
-<div class="flex gap-4 blog-editor">
+<!-- The skeleton's slot while the post loads; the form stays hidden until it is in
+     (typed into before the post arrived, it was overwritten). -->
+<div class="blog-loading dm-loading-slot">Loading the post…</div>
+
+<div class="flex gap-4 blog-editor" hidden>
   <!-- Main content area -->
   <div class="blog-editor-main">
     <div class="card mb-3">

package/plugins/blog/admin/views/blog.js

@@ -54,7 +54,9 @@ export const blogView = {
         const kit = await import(`./kit.js?v=${ASSET_VERSION}`);
         const {BASE} = kit;
         const add = kit.viewScope('posts', /^#\/plugins\/blog(\/posts)?\/?$/);
+        const here = add.here;
         const root = $container.get(0);
+        const slot = root.querySelector('.blog-loading');
 
         // ---- State ----
         const posts = M.observable([]);
@@ -129,21 +131,26 @@ export const blogView = {
         // ---- Server ----
         const byId = (id) => posts.peek().find(p => p.id === id);
 
+        // The first load draws a skeleton; a reload keeps the rows on screen.
+        let loaded = false;
         async function load() {
-            loading.value = true;
+            const work = Promise.all([
+                H.get(`${BASE}/posts`),
+                H.get(`${BASE}/categories`).catch(() => []),
+                kit.sitePath()
+            ]);
             try {
-                const [postsRes, catsRes] = await Promise.all([
-                    H.get(`${BASE}/posts`),
-                    H.get(`${BASE}/categories`).catch(() => [])
-                ]);
-                site = await kit.sitePath();
+                const [postsRes, catsRes, base] = loaded ? await work : await kit.withSkeleton(slot, work);
+                if (!here()) return;
+                site = base;
                 // GET /posts sends a BARE ARRAY; `.data` is only for a wrapped reply.
                 posts.value = postsRes?.data ?? (Array.isArray(postsRes) ? postsRes : []);
                 categories.value = catsRes?.data ?? (Array.isArray(catsRes) ? catsRes : []);
+                loaded = true;
             } catch {
-                E.toast('Failed to load posts.', {type: 'error'});
+                if (here()) E.toast('Failed to load posts.', {type: 'error'});
             } finally {
-                loading.value = false;
+                if (here()) loading.value = false;
             }
         }
 
@@ -155,19 +162,25 @@ export const blogView = {
 
         async function publish(id) {
             try {
-                upsert(await H.post(`${BASE}/posts/${id}/publish`, {}));
+                const res = await H.post(`${BASE}/posts/${id}/publish`, {});
+                kit.pokeSidebar();
+                if (!here()) return;
+                upsert(res);
                 E.toast('Post published.', {type: 'success'});
             } catch (err) {
-                E.toast(err?.message ?? 'Failed to publish.', {type: 'error'});
+                if (here()) E.toast(err?.message ?? 'Failed to publish.', {type: 'error'});
             }
         }
 
         async function unpublish(id) {
             try {
-                upsert(await H.put(`${BASE}/posts/${id}`, {status: 'draft'}));
+                const res = await H.put(`${BASE}/posts/${id}`, {status: 'draft'});
+                kit.pokeSidebar();
+                if (!here()) return;
+                upsert(res);
                 E.toast('Post moved back to drafts.', {type: 'success'});
             } catch (err) {
-                E.toast(err?.message ?? 'Failed to unpublish.', {type: 'error'});
+                if (here()) E.toast(err?.message ?? 'Failed to unpublish.', {type: 'error'});
             }
         }
 
@@ -181,10 +194,12 @@ export const blogView = {
                     content: p.content ?? '', excerpt: p.excerpt ?? '', featuredImage: p.featuredImage ?? null,
                     categories: p.categories ?? [], tags: p.tags ?? [], template: p.template ?? '', status: 'draft'
                 });
+                kit.pokeSidebar();
+                if (!here()) return;
                 upsert(copy);
                 E.toast('Copied as a draft.', {type: 'success'});
             } catch (err) {
-                E.toast(err?.message ?? 'Failed to duplicate.', {type: 'error'});
+                if (here()) E.toast(err?.message ?? 'Failed to duplicate.', {type: 'error'});
             }
         }
 
@@ -194,13 +209,15 @@ export const blogView = {
             const ok = await E.confirm(p?.status === 'published'
                 ? 'Delete this published post? Its page goes offline and links to it will break.'
                 : 'Delete this post? This cannot be undone.');
-            if (!ok) return;
+            if (!ok || !here()) return;
             try {
                 await H.delete(`${BASE}/posts/${id}`);
+                kit.pokeSidebar();
+                if (!here()) return;
                 posts.value = posts.peek().filter(x => x.id !== id);
                 E.toast('Post deleted.', {type: 'success'});
             } catch {
-                E.toast('Failed to delete post.', {type: 'error'});
+                if (here()) E.toast('Failed to delete post.', {type: 'error'});
             }
         }
 
@@ -218,7 +235,10 @@ export const blogView = {
         const list = root.querySelector('.blog-list');
         root.querySelector('.blog-rows').innerHTML = ROW_TEMPLATE;
         root.querySelector('.blog-chips').innerHTML = CHIP_TEMPLATE;
-        add(await kit.scanHelp(root));
+        // Overtaken while it loaded: register nothing - the lifetime is the new mount's now.
+        const offHelp = await kit.scanHelp(root);
+        if (!here()) { offHelp(); return; }
+        add(offHelp);
         const handle = M.applyBindings(data, root, {
             methods: {
                 create: () => R.navigate('#/plugins/blog/posts/new'),
@@ -294,22 +314,26 @@ export const blogView = {
             try {
                 const res = await H.post(`${BASE}/samples`, {});
                 if (res?.error) throw new Error(res.error);
+                kit.pokeSidebar();
+                if (!here()) return;
                 E.toast(res.added ? `Added ${res.added} sample posts. Remove them from ⋮ whenever you like.` : 'The sample posts are already here.', {type: 'success'});
                 await load();
             } catch (err) {
-                E.toast(err?.message ?? 'Could not add the sample posts.', {type: 'error'});
+                if (here()) E.toast(err?.message ?? 'Could not add the sample posts.', {type: 'error'});
             }
         }
 
         async function removeSamples() {
-            if (!(await E.confirm('Remove the sample posts, and any sample category nothing else uses? Your own posts are not touched.'))) return;
+            if (!(await E.confirm('Remove the sample posts, and any sample category nothing else uses? Your own posts are not touched.')) || !here()) return;
             try {
                 const res = await H.delete(`${BASE}/samples`);
                 if (res?.error) throw new Error(res.error);
+                kit.pokeSidebar();
+                if (!here()) return;
                 E.toast(`Removed ${res.posts} sample posts.`, {type: 'success'});
                 await load();
             } catch (err) {
-                E.toast(err?.message ?? 'Could not remove the sample posts.', {type: 'error'});
+                if (here()) E.toast(err?.message ?? 'Could not remove the sample posts.', {type: 'error'});
             }
         }
 
@@ -324,6 +348,7 @@ export const blogView = {
             const row = e.target.closest?.('.blog-row');
             if (row && e.key === 'Enter' && e.target === row) R.navigate(`#/plugins/blog/posts/${row.dataset.id}`);
         });
+        add(kit.menuKeys(list, '.blog-row'));
 
         if (typeof I !== 'undefined' && I.scan) I.scan(root);
         await load();