vitepress-plugin-filelist 0.4.0 → 0.5.0

package/dist/client/browser/index.js

@@ -1,5 +1,5 @@
 import "../style.css";
-import { Fragment, computed, createCommentVNode, createElementBlock, createElementVNode, createTextVNode, createVNode, defineComponent, normalizeClass, normalizeStyle, onBeforeUnmount, onMounted, openBlock, ref, renderList, toDisplayString, unref, vModelSelect, vModelText, watch, withDirectives, withKeys } from "vue";
+import { Fragment, computed, createCommentVNode, createElementBlock, createElementVNode, createTextVNode, createVNode, defineComponent, nextTick, normalizeClass, normalizeStyle, onBeforeUnmount, onMounted, openBlock, reactive, ref, renderList, toDisplayString, unref, vModelSelect, vModelText, watch, withDirectives, withKeys, withModifiers } from "vue";
 // src/client/locales.ts
 const fileListLocales = {
 	"zh-CN": {
@@ -11,7 +11,7 @@ const fileListLocales = {
 		batchCount: "批量下载（{count}）",
 		batching: "打包中 {percent}%",
 		passwordPrompt: "该目录受密码保护：",
-		passwordPlaceholder: "输入目录密码",
+		passwordPlaceholder: "输入密码",
 		open: "打开",
 		columnName: "文件名",
 		columnSize: "文件大小",
@@ -19,7 +19,7 @@ const fileListLocales = {
 		loading: "加载中…",
 		loadFailed: "加载失败：{message}",
 		guestHint: "在 OpenList 后台启用 guest，或给组件传一个只读 token。",
-		corsHint: "可能是跨域或混合内容被拦截，检查 OpenList 的 cors 配置与页面协议。",
+		corsHint: "可能是跨域或混合内容被拦截：检查 OpenList 的 cors.allow_origins（OpenList-Worker 为 ALLOW_URLS）与页面协议。",
 		retry: "重试",
 		empty: "没有文件",
 		preview: "预览",
@@ -52,7 +52,18 @@ const fileListLocales = {
 		previewUnsupported: "该类型暂不支持在线预览，可下载后查看",
 		previewUnavailable: "该文件无法在页面内预览，可下载后查看",
 		previewTooLarge: "文件较大（{size}），请下载后查看",
-		textTruncated: "仅显示前 {size}，完整内容请下载"
+		textTruncated: "仅显示前 {size}，完整内容请下载",
+		refreshing: "刷新中",
+		refreshFailed: "刷新失败：{message}",
+		cancel: "取消",
+		passwordFor: "{name} 的密码",
+		passwordWrong: "密码不正确或无权访问",
+		passwordStale: "已保存的密码已失效，请重新输入",
+		rememberPassword: "在此标签页中记住（关闭标签页后失效）",
+		remembered: "已记住",
+		forgetPassword: "忘记",
+		unlockFolder: "输入 {name} 的密码",
+		networkHint: "可能被跨域拦截：请检查 OpenList 的 cors.allow_origins，或 OpenList-Worker 的 ALLOW_URLS。"
 	},
 	"en-US": {
 		allFiles: "All files",
@@ -71,7 +82,7 @@ const fileListLocales = {
 		loading: "Loading…",
 		loadFailed: "Failed to load: {message}",
 		guestHint: "Enable the guest user in OpenList, or pass a read-only token.",
-		corsHint: "Possibly blocked by CORS or mixed content. Check OpenList cors settings and the page protocol.",
+		corsHint: "Possibly blocked by CORS or mixed content. Check cors.allow_origins in OpenList (ALLOW_URLS in OpenList-Worker) and the page protocol.",
 		retry: "Retry",
 		empty: "No files",
 		preview: "Preview",
@@ -104,7 +115,18 @@ const fileListLocales = {
 		previewUnsupported: "This file type cannot be previewed here. Download it to view.",
 		previewUnavailable: "This file cannot be previewed in the page. Download it to view.",
 		previewTooLarge: "This file is large ({size}). Download it to view.",
-		textTruncated: "Showing the first {size} only. Download for the full file."
+		textTruncated: "Showing the first {size} only. Download for the full file.",
+		refreshing: "Refreshing",
+		refreshFailed: "Refresh failed: {message}",
+		cancel: "Cancel",
+		passwordFor: "Password for {name}",
+		passwordWrong: "Wrong password or no permission",
+		passwordStale: "The saved password no longer works. Enter it again.",
+		rememberPassword: "Remember in this tab (cleared when the tab closes)",
+		remembered: "Remembered",
+		forgetPassword: "Forget",
+		unlockFolder: "Enter the password for {name}",
+		networkHint: "Possibly blocked by CORS: check cors.allow_origins in OpenList, or ALLOW_URLS in OpenList-Worker."
 	}
 };
 function formatLabel(template, values = {}) {
@@ -875,37 +897,112 @@ const _sfc_main$1 = /*@__PURE__*/ defineComponent({
 		};
 	}
 });
+// src/client/passwords.ts
+/**
+* Folder passwords remembered for the current browser tab.
+*
+* Stored in `sessionStorage`, so they live only in this tab and are gone when
+* it closes. Keyed by OpenList base URL, then by folder path; a remembered
+* folder also covers its sub-folders. Every access is guarded: private mode
+* or blocked storage simply means nothing is remembered.
+*/
+const PREFIX = "vitepress-plugin-filelist:passwords:";
+function store() {
+	try {
+		return typeof sessionStorage === "undefined" ? null : sessionStorage;
+	} catch {
+		return null;
+	}
+}
+function read(base) {
+	try {
+		const raw = store()?.getItem(PREFIX + base);
+		const parsed = raw ? JSON.parse(raw) : {};
+		return parsed && typeof parsed === "object" ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+function write(base, map) {
+	try {
+		const target = store();
+		if (!target) return;
+		if (Object.keys(map).length) target.setItem(PREFIX + base, JSON.stringify(map));
+		else target.removeItem(PREFIX + base);
+	} catch {}
+}
+function normalise(path) {
+	return path.replace(/\/+$/, "") || "/";
+}
+/** Whether `path` is `folder` itself or inside it. */
+function isWithin(path, folder) {
+	const p = normalise(path);
+	const f = normalise(folder);
+	return f === "/" || p === f || p.startsWith(`${f}/`);
+}
+/** The closest remembered folder at or above `path`, if any. */
+function findRememberedPassword(base, path) {
+	let best = null;
+	for (const [folder, password] of Object.entries(read(base))) {
+		if (typeof password !== "string" || !isWithin(path, folder)) continue;
+		if (!best || folder.length > best.path.length) best = {
+			path: folder,
+			password
+		};
+	}
+	return best;
+}
+function rememberFolderPassword(base, path, password) {
+	write(base, {
+		...read(base),
+		[normalise(path)]: password
+	});
+}
+function forgetFolderPassword(base, path) {
+	const map = read(base);
+	delete map[normalise(path)];
+	write(base, map);
+}
+/** Folders with a remembered password, for showing the "remembered" tag. */
+function rememberedFolders(base) {
+	return Object.keys(read(base));
+}
 // src/client/FileList.vue
-const _hoisted_1 = { class: "fl-bar" };
-const _hoisted_2 = {
+const _hoisted_1 = ["aria-busy"];
+const _hoisted_2 = { class: "fl-bar" };
+const _hoisted_3 = {
 	key: 0,
 	class: "fl-selection",
 	role: "status"
 };
-const _hoisted_3 = { class: "fl-selection-count" };
-const _hoisted_4 = { class: "fl-selection-size" };
-const _hoisted_5 = {
+const _hoisted_4 = { class: "fl-selection-count" };
+const _hoisted_5 = { class: "fl-selection-size" };
+const _hoisted_6 = {
 	key: 1,
 	class: "fl-title"
 };
-const _hoisted_6 = { class: "fl-title-text" };
-const _hoisted_7 = {
+const _hoisted_7 = { class: "fl-title-text" };
+const _hoisted_8 = {
 	key: 0,
 	class: "fl-demo-badge"
 };
-const _hoisted_8 = ["aria-label", "title"];
-const _hoisted_9 = { class: "fl-clear-text" };
-const _hoisted_10 = { class: "fl-tools" };
-const _hoisted_11 = { class: "fl-search" };
-const _hoisted_12 = ["placeholder", "aria-label"];
-const _hoisted_13 = ["aria-label", "title"];
-const _hoisted_14 = ["disabled"];
-const _hoisted_15 = {
+const _hoisted_9 = ["aria-label", "title"];
+const _hoisted_10 = { class: "fl-clear-text" };
+const _hoisted_11 = { class: "fl-tools" };
+const _hoisted_12 = { class: "fl-search" };
+const _hoisted_13 = ["placeholder", "aria-label"];
+const _hoisted_14 = [
+	"disabled",
+	"aria-label",
+	"title"
+];
+const _hoisted_15 = ["disabled"];
+const _hoisted_16 = { class: "fl-row fl-head" };
+const _hoisted_17 = {
 	key: 0,
-	class: "fl-password"
+	class: "fl-progress",
+	"aria-hidden": "true"
 };
-const _hoisted_16 = ["placeholder", "aria-label"];
-const _hoisted_17 = { class: "fl-row fl-head" };
 const _hoisted_18 = { class: "fl-cell fl-cell-check" };
 const _hoisted_19 = [
 	"aria-label",
@@ -937,84 +1034,139 @@ const _hoisted_29 = {
 const _hoisted_30 = ["aria-label"];
 const _hoisted_31 = ["value"];
 const _hoisted_32 = {
-	key: 1,
+	key: 0,
 	class: "fl-status"
 };
-const _hoisted_33 = {
+const _hoisted_33 = ["for"];
+const _hoisted_34 = {
+	key: 0,
+	id: "fl-root-unlock-error",
+	class: "fl-unlock-message",
+	role: "alert"
+};
+const _hoisted_35 = { class: "fl-unlock" };
+const _hoisted_36 = [
+	"id",
+	"data-unlock",
+	"placeholder",
+	"aria-invalid",
+	"aria-describedby"
+];
+const _hoisted_37 = [
+	"aria-pressed",
+	"aria-label",
+	"title"
+];
+const _hoisted_38 = ["disabled"];
+const _hoisted_39 = {
 	key: 2,
 	class: "fl-status fl-error"
 };
-const _hoisted_34 = {
+const _hoisted_40 = {
 	key: 0,
 	class: "fl-hint"
 };
-const _hoisted_35 = {
+const _hoisted_41 = {
 	key: 1,
 	class: "fl-hint"
 };
-const _hoisted_36 = {
+const _hoisted_42 = {
 	key: 3,
 	class: "fl-status"
 };
-const _hoisted_37 = { class: "fl-cell fl-cell-check" };
-const _hoisted_38 = [
+const _hoisted_43 = { class: "fl-cell fl-cell-check" };
+const _hoisted_44 = [
+	"disabled",
 	"aria-label",
 	"checked",
 	".indeterminate",
 	"onChange"
 ];
-const _hoisted_39 = ["title"];
-const _hoisted_40 = [
+const _hoisted_45 = ["title"];
+const _hoisted_46 = [
+	"aria-label",
+	"title",
+	"onClick"
+];
+const _hoisted_47 = [
 	"aria-label",
 	"aria-expanded",
 	"onClick"
 ];
-const _hoisted_41 = {
-	key: 1,
+const _hoisted_48 = {
+	key: 2,
 	class: "fl-arrow-placeholder",
 	"aria-hidden": "true"
 };
-const _hoisted_42 = {
-	key: 2,
+const _hoisted_49 = {
+	key: 3,
 	class: "fl-folder-icon",
 	viewBox: "0 0 24 24",
 	width: "18",
 	height: "18",
 	"aria-hidden": "true"
 };
-const _hoisted_43 = ["data-kind"];
-const _hoisted_44 = { class: "fl-label" };
-const _hoisted_45 = ["onClick"];
-const _hoisted_46 = { class: "fl-meta" };
-const _hoisted_47 = {
-	key: 4,
+const _hoisted_50 = ["data-kind"];
+const _hoisted_51 = { class: "fl-label" };
+const _hoisted_52 = ["onClick"];
+const _hoisted_53 = { class: "fl-meta" };
+const _hoisted_54 = {
+	key: 5,
 	class: "fl-count"
 };
-const _hoisted_48 = {
-	key: 5,
+const _hoisted_55 = ["id"];
+const _hoisted_56 = [
+	"aria-label",
+	"title",
+	"onClick"
+];
+const _hoisted_57 = {
+	key: 8,
 	class: "fl-loading",
 	"aria-hidden": "true"
 };
-const _hoisted_49 = { class: "fl-cell fl-cell-size" };
-const _hoisted_50 = { class: "fl-cell fl-cell-date" };
-const _hoisted_51 = { class: "fl-cell fl-cell-op" };
-const _hoisted_52 = [
+const _hoisted_58 = ["onSubmit", "onKeydown"];
+const _hoisted_59 = [
+	"onUpdate:modelValue",
+	"data-unlock",
+	"placeholder",
+	"aria-label",
+	"aria-invalid",
+	"aria-describedby"
+];
+const _hoisted_60 = [
+	"aria-pressed",
+	"aria-label",
+	"title",
+	"onClick"
+];
+const _hoisted_61 = ["disabled"];
+const _hoisted_62 = [
+	"aria-label",
+	"title",
+	"onClick"
+];
+const _hoisted_63 = { class: "fl-cell fl-cell-size" };
+const _hoisted_64 = { class: "fl-cell fl-cell-date" };
+const _hoisted_65 = { class: "fl-cell fl-cell-op" };
+const _hoisted_66 = ["aria-label", "onClick"];
+const _hoisted_67 = [
 	"aria-label",
 	"aria-expanded",
 	"onClick"
 ];
-const _hoisted_53 = [
+const _hoisted_68 = [
 	"aria-label",
 	"title",
 	"onClick"
 ];
-const _hoisted_54 = [
+const _hoisted_69 = [
 	"aria-label",
 	"title",
 	"onClick"
 ];
-const _hoisted_55 = { class: "fl-foot" };
-const _hoisted_56 = {
+const _hoisted_70 = { class: "fl-foot" };
+const _hoisted_71 = {
 	key: 4,
 	class: "fl-toast",
 	role: "status"
@@ -1032,6 +1184,10 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 		token: { default: "" },
 		password: { default: "" },
 		title: { default: "" },
+		rememberPassword: {
+			type: Boolean,
+			default: true
+		},
 		locale: { default: "zh-CN" },
 		labels: {}
 	},
@@ -1050,12 +1206,22 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 		}
 		const demo = computed(() => !props.base);
 		const baseUrl = computed(() => props.base.replace(/\/+$/, ""));
-		const activePassword = ref(props.password);
+		const rootEl = ref();
 		const roots = ref([]);
 		const loadingRoot = ref(false);
 		const errorMsg = ref("");
-		const needsPassword = ref(false);
-		const passwordInput = ref("");
+		const refreshing = ref(false);
+		let refreshSeq = 0;
+		/** Single-path mode: the listed folder itself needs a password. */
+		const rootLock = reactive({
+			active: false,
+			input: "",
+			error: "",
+			remember: false,
+			busy: false
+		});
+		/** Password the visitor typed for the listed folder (single-path mode). */
+		const rootPassword = ref("");
 		const keyword = ref("");
 		const selected = ref(/* @__PURE__ */ new Set());
 		const toast = ref("");
@@ -1079,6 +1245,90 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 		function isPasswordError(error) {
 			return /password|密码/i.test(errorText(error));
 		}
+		function isNetworkError(error) {
+			return /failed to fetch|networkerror|load failed|network request failed/i.test(errorText(error));
+		}
+		/** A failure toast; browser network errors are usually CORS, so say where to look. */
+		function failureMessage(key, error) {
+			const message = t(key, { message: errorText(error) });
+			return isNetworkError(error) ? `${message} ${t("networkHint")}` : message;
+		}
+		/** Total size for display: an empty total reads `0 B`, not `-`. */
+		function formatTotal(bytes) {
+			return bytes > 0 ? formatSize(bytes) : "0 B";
+		}
+		const canRemember = computed(() => props.rememberPassword !== false);
+		const passwordScope = computed(() => baseUrl.value || "demo");
+		/** Passwords typed on this page (not necessarily remembered), so a refresh keeps folders open. */
+		const typedPasswords = /* @__PURE__ */ new Map();
+		function typedPasswordFor(path) {
+			let best = "";
+			let bestPath = "";
+			for (const [folder, password] of typedPasswords) if (isWithin(path, folder) && folder.length > bestPath.length) {
+				best = password;
+				bestPath = folder;
+			}
+			return best;
+		}
+		/** Folders with a remembered password (mirrors sessionStorage so the template reacts). */
+		const rememberedPaths = ref(/* @__PURE__ */ new Set());
+		function syncRemembered() {
+			rememberedPaths.value = new Set(canRemember.value ? rememberedFolders(passwordScope.value) : []);
+		}
+		function storedPassword(path) {
+			return canRemember.value ? findRememberedPassword(passwordScope.value, path) : null;
+		}
+		/**
+		* Password for an item: its own or inherited one first (site-configured or
+		* typed), then one remembered in this tab, then the component's `password`.
+		*/
+		function passwordFor(node) {
+			if (node.password) return { password: node.password };
+			const typed = typedPasswordFor(node.path);
+			if (typed) return { password: typed };
+			const stored = storedPassword(node.path);
+			if (stored) return {
+				password: stored.password,
+				rememberedAt: stored.path
+			};
+			return { password: props.password };
+		}
+		function rootPasswordFor() {
+			if (rootPassword.value) return { password: rootPassword.value };
+			const stored = storedPassword(props.path);
+			if (stored) return {
+				password: stored.password,
+				rememberedAt: stored.path
+			};
+			return { password: props.password };
+		}
+		/** A remembered password stopped working: drop it so we do not keep retrying it. */
+		function dropStale(path) {
+			if (!path) return false;
+			forgetFolderPassword(passwordScope.value, path);
+			syncRemembered();
+			return true;
+		}
+		function focusUnlock(path) {
+			nextTick(() => {
+				(rootEl.value?.querySelector(`input[data-unlock="${CSS.escape(path)}"]`))?.focus();
+			});
+		}
+		/** Show the same-row password input; `focus` only for user actions, never on page load. */
+		function startPrompt(node, focus) {
+			node.prompting = true;
+			if (focus) focusUnlock(node.path);
+		}
+		function cancelUnlock(node) {
+			node.prompting = false;
+			node.unlockInput = "";
+			node.unlockError = "";
+		}
+		function unlockErrorText(error) {
+			if (error === "wrong") return t("passwordWrong");
+			if (error === "stale") return t("passwordStale");
+			return "";
+		}
 		const DEMO_TREE = {
 			"/": [
 				{
@@ -1110,6 +1360,12 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 					size: 0,
 					is_dir: true,
 					modified: "2026-09-01T08:00:00+08:00"
+				},
+				{
+					name: "加密示例（密码 1234）",
+					size: 0,
+					is_dir: true,
+					modified: "2026-10-20T18:00:00+08:00"
 				}
 			],
 			"/assignments": [{
@@ -1200,6 +1456,17 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 				is_dir: false,
 				modified: "2026-01-05T19:02:00+08:00"
 			}],
+			"/加密示例（密码 1234）": [{
+				name: "期末答案（教师版）.pdf",
+				size: 2621440,
+				is_dir: false,
+				modified: "2026-10-20T18:00:00+08:00"
+			}, {
+				name: "成绩登记表.xlsx",
+				size: 48128,
+				is_dir: false,
+				modified: "2026-10-21T09:12:00+08:00"
+			}],
 			"/slides": [{
 				name: "第一章 行列式.pptx",
 				size: 3145728,
@@ -1212,6 +1479,8 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 				modified: "2026-09-15T13:30:00+08:00"
 			}]
 		};
+		/** Demo-only folder passwords, so the demo can show the password flow. */
+		const DEMO_PASSWORDS = { "/加密示例（密码 1234）": "1234" };
 		class ApiError extends Error {
 			code;
 			constructor(message, code) {
@@ -1219,16 +1488,17 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 				this.code = code;
 			}
 		}
-		function authHeaders() {
+		/** JSON content type only when there is a body: a bare GET then needs no CORS preflight. */
+		function authHeaders(json) {
 			return {
-				"Content-Type": "application/json",
+				...json ? { "Content-Type": "application/json" } : {},
 				...props.token ? { Authorization: props.token } : {}
 			};
 		}
 		async function request(apiPath, body) {
 			const response = await fetch(`${baseUrl.value}${apiPath}`, {
 				method: body === void 0 ? "GET" : "POST",
-				headers: authHeaders(),
+				headers: authHeaders(body !== void 0),
 				body: body === void 0 ? void 0 : JSON.stringify(body)
 			});
 			const payload = await response.json().catch(() => null);
@@ -1236,9 +1506,11 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 			if (payload.code !== 200) throw new ApiError(payload.message || `HTTP ${response.status}`, payload.code ?? response.status);
 			return payload.data;
 		}
-		async function listDir(path, password = activePassword.value) {
+		async function listDir(path, password) {
 			if (demo.value) {
 				await new Promise((resolve) => setTimeout(resolve, 220));
+				const guard = Object.entries(DEMO_PASSWORDS).find(([folder]) => isWithin(path, folder));
+				if (guard && guard[1] !== password) throw new ApiError("password is incorrect or you have no permission", 403);
 				return DEMO_TREE[path] ?? [];
 			}
 			return (await request("/api/fs/list", {
@@ -1268,7 +1540,7 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 			try {
 				url = absoluteUrl((await request("/api/fs/get", {
 					path: node.path,
-					password: node.password || activePassword.value
+					password: passwordFor(node).password
 				}))?.raw_url ?? "");
 			} catch {
 				url = "";
@@ -1326,95 +1598,297 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 			const parts = path.split("/").filter(Boolean);
 			return parts[parts.length - 1] || path;
 		}
-		async function loadChildren(node) {
+		/**
+		* Load a folder's children. A password error marks the folder locked instead of
+		* toasting; `prompt` also shows its same-row input (and focuses it).
+		*/
+		async function loadChildren(node, prompt = false) {
 			if (node.loaded) return true;
+			if (node.locked) {
+				if (prompt) startPrompt(node, prompt === "focus");
+				return false;
+			}
 			node.loading = true;
+			const { password, rememberedAt } = passwordFor(node);
 			try {
-				node.children = toNodes(await listDir(node.path, node.password || activePassword.value), node.path, node.depth + 1, node.password, node.zipPath);
+				node.children = toNodes(await listDir(node.path, password), node.path, node.depth + 1, node.password, node.zipPath);
 				sortTree(node.children);
 				node.loaded = true;
 				return true;
 			} catch (error) {
-				if (isPasswordError(error)) needsPassword.value = true;
-				showToast(t("folderFailed", { message: errorText(error) }));
+				if (isPasswordError(error)) {
+					node.locked = true;
+					node.expanded = false;
+					node.unlockError = dropStale(rememberedAt) ? "stale" : "";
+					if (prompt) startPrompt(node, prompt === "focus");
+				} else showToast(failureMessage("folderFailed", error));
 				return false;
 			} finally {
 				node.loading = false;
 			}
 		}
-		async function loadSourceRoot(source) {
+		/** Submit the same-row password for a locked folder (or a locked root of unknown type). */
+		async function submitUnlock(node) {
+			const password = node.unlockInput ?? "";
+			if (!password || node.unlockBusy) return;
+			node.unlockBusy = true;
+			try {
+				if (node.unresolved) {
+					const data = await request("/api/fs/get", {
+						path: node.path,
+						password
+					});
+					const name = node.name;
+					Object.assign(node, data, { name });
+					if (node.is_dir) node.zipPath = [name];
+					else node.zipPath = [data.name || node.zipPath[0]];
+					node.unresolved = false;
+				}
+				if (node.is_dir) {
+					node.children = toNodes(await listDir(node.path, password), node.path, node.depth + 1, password, node.zipPath);
+					sortTree(node.children);
+					node.loaded = true;
+					node.expanded = true;
+				}
+				node.password = password;
+				typedPasswords.set(node.path, password);
+				if (node.unlockRemember && canRemember.value) {
+					rememberFolderPassword(passwordScope.value, node.path, password);
+					syncRemembered();
+				}
+				node.locked = false;
+				node.prompting = false;
+				node.unlockError = "";
+				node.unlockInput = "";
+				node.unlockRemember = false;
+			} catch (error) {
+				if (isPasswordError(error)) {
+					node.unlockError = "wrong";
+					node.unlockInput = "";
+					focusUnlock(node.path);
+				} else showToast(failureMessage("folderFailed", error));
+			} finally {
+				node.unlockBusy = false;
+			}
+		}
+		/** Forget a remembered password: the folder folds up and asks again next time. */
+		function forgetPassword(node) {
+			forgetFolderPassword(passwordScope.value, node.path);
+			typedPasswords.delete(node.path);
+			syncRemembered();
+			node.password = node.configuredPassword || "";
+			node.expanded = false;
+			node.loaded = false;
+			node.children = [];
+			node.locked = false;
+			selected.value = new Set([...selected.value].filter((path) => !isWithin(path, node.path)));
+			for (const key of [...downloadCache.keys()]) if (isWithin(key, node.path)) downloadCache.delete(key);
+		}
+		/** When OpenList cannot tell us, guess from the name: a known file extension means a file. */
+		function looksLikeFile(path) {
+			const name = sourceName(path);
+			return fileKind(name) !== "other" || previewKind(name) !== "none";
+		}
+		async function loadSourceRoot(source, expanded) {
 			const path = source.path;
-			const password = source.password ?? "";
+			const configured = source.password ?? "";
 			let item = {
 				name: sourceName(path),
 				size: 0,
-				is_dir: true,
+				is_dir: !looksLikeFile(path),
 				modified: ""
 			};
-			if (demo.value) {
-				if (/\/[^/]+\.[^/]+$/.test(path)) item = {
-					...item,
-					is_dir: false,
-					modified: "2026-09-01T08:00:00+08:00"
-				};
-			} else try {
-				const data = await request("/api/fs/get", {
-					path,
-					password: password || activePassword.value
-				});
-				item = {
-					...item,
-					...data
-				};
-			} catch {}
+			let locked = false;
+			let unlockError = "";
+			if (!demo.value) {
+				const { password, rememberedAt } = configured ? {
+					password: configured,
+					rememberedAt: void 0
+				} : (() => {
+					const stored = storedPassword(path);
+					return stored ? {
+						password: stored.password,
+						rememberedAt: stored.path
+					} : {
+						password: props.password,
+						rememberedAt: void 0
+					};
+				})();
+				try {
+					const data = await request("/api/fs/get", {
+						path,
+						password
+					});
+					item = {
+						...item,
+						...data
+					};
+				} catch (error) {
+					if (isPasswordError(error)) {
+						locked = true;
+						unlockError = dropStale(rememberedAt) ? "stale" : "";
+					}
+				}
+			}
 			const name = source.title || item.name || sourceName(path);
 			return {
 				...item,
 				name,
 				path,
 				depth: 0,
-				expanded: source.expanded ?? props.expanded,
+				expanded,
 				loaded: false,
 				loading: false,
 				children: [],
-				password,
+				password: configured,
+				configuredPassword: configured,
 				isRoot: true,
+				locked,
+				unresolved: locked,
+				unlockError,
+				prompting: locked && expanded,
 				zipPath: [item.is_dir ? name : item.name || sourceName(path)]
 			};
 		}
+		class RootLockedError extends Error {
+			rememberedAt;
+			constructor(rememberedAt) {
+				super("root locked");
+				this.rememberedAt = rememberedAt;
+			}
+		}
+		/**
+		* Build a fresh tree. `expandedPaths` re-opens those folders (refresh keeps
+		* what was open); without it the configured `expanded` defaults apply.
+		*/
+		async function buildTree(expandedPaths) {
+			let nodes;
+			if (props.sources.length) nodes = await Promise.all(props.sources.map((source) => loadSourceRoot(source, expandedPaths ? expandedPaths.has(source.path) : source.expanded ?? props.expanded)));
+			else {
+				const { password, rememberedAt } = rootPasswordFor();
+				let items;
+				try {
+					items = await listDir(props.path, password);
+				} catch (error) {
+					if (isPasswordError(error)) throw new RootLockedError(rememberedAt);
+					throw error;
+				}
+				nodes = toNodes(items, props.path, 0, rootPassword.value);
+				sortTree(nodes);
+			}
+			const open = async (list) => {
+				for (const node of list) {
+					if (!node.is_dir || node.locked || !node.expanded && !expandedPaths?.has(node.path)) continue;
+					node.expanded = await loadChildren(node, "show");
+					if (node.expanded && expandedPaths) await open(node.children);
+				}
+			};
+			await open(nodes);
+			return nodes;
+		}
+		/** First load, or a retry after an error: shows the loading state. */
 		async function loadRoot() {
+			refreshSeq += 1;
+			refreshing.value = false;
 			loadingRoot.value = true;
 			errorMsg.value = "";
-			needsPassword.value = false;
 			try {
-				if (props.sources.length) {
-					const nodes = await Promise.all(props.sources.map((source) => loadSourceRoot(source)));
-					roots.value = nodes;
-					for (const node of roots.value) if (node.is_dir && node.expanded) node.expanded = await loadChildren(node);
+				roots.value = await buildTree();
+				rootLock.active = false;
+				selected.value = /* @__PURE__ */ new Set();
+				downloadCache.clear();
+			} catch (error) {
+				if (error instanceof RootLockedError) {
+					roots.value = [];
+					rootLock.active = true;
+					rootLock.error = dropStale(error.rememberedAt) ? "stale" : "";
+				} else errorMsg.value = errorText(error);
+			} finally {
+				loadingRoot.value = false;
+			}
+		}
+		function expandedPathsOf(nodes, out = /* @__PURE__ */ new Set()) {
+			for (const node of nodes) if (node.is_dir && node.expanded) {
+				out.add(node.path);
+				expandedPathsOf(node.children, out);
+			}
+			return out;
+		}
+		/**
+		* Refresh keeps the old rows in place (dimmed) until the new tree is ready, then
+		* swaps it in. Open folders stay open; selected files that still exist stay selected.
+		*/
+		async function refresh() {
+			if (refreshing.value || loadingRoot.value) return;
+			if (!roots.value.length || errorMsg.value || rootLock.active) {
+				await loadRoot();
+				return;
+			}
+			const seq = ++refreshSeq;
+			refreshing.value = true;
+			try {
+				const fresh = await buildTree(expandedPathsOf(roots.value));
+				if (seq !== refreshSeq) return;
+				roots.value = fresh;
+				const existing = new Set(fresh.flatMap(descendantFiles).map((file) => file.path));
+				selected.value = new Set([...selected.value].filter((path) => existing.has(path)));
+				downloadCache.clear();
+			} catch (error) {
+				if (seq !== refreshSeq) return;
+				if (error instanceof RootLockedError) {
+					roots.value = [];
+					rootLock.active = true;
+					rootLock.error = dropStale(error.rememberedAt) ? "stale" : "wrong";
 					selected.value = /* @__PURE__ */ new Set();
-					downloadCache.clear();
-					return;
+				} else showToast(failureMessage("refreshFailed", error));
+			} finally {
+				if (seq === refreshSeq) refreshing.value = false;
+			}
+		}
+		/** Single-path mode: unlock the listed folder itself. */
+		async function submitRootUnlock() {
+			const password = rootLock.input;
+			if (!password || rootLock.busy) return;
+			rootLock.busy = true;
+			try {
+				const items = await listDir(props.path, password);
+				rootPassword.value = password;
+				if (rootLock.remember && canRemember.value) {
+					rememberFolderPassword(passwordScope.value, props.path, password);
+					syncRemembered();
 				}
-				const items = await listDir(props.path);
-				roots.value = toNodes(items, props.path, 0, activePassword.value);
-				sortTree(roots.value);
+				const nodes = toNodes(items, props.path, 0, password);
+				sortTree(nodes);
+				roots.value = nodes;
+				Object.assign(rootLock, {
+					active: false,
+					input: "",
+					error: "",
+					remember: false
+				});
 				selected.value = /* @__PURE__ */ new Set();
 				downloadCache.clear();
 			} catch (error) {
-				const message = errorText(error);
-				if (isPasswordError(error)) needsPassword.value = true;
-				else errorMsg.value = message;
+				if (isPasswordError(error)) {
+					rootLock.error = "wrong";
+					rootLock.input = "";
+					focusUnlock(props.path);
+				} else showToast(failureMessage("loadFailed", error));
 			} finally {
-				loadingRoot.value = false;
+				rootLock.busy = false;
 			}
 		}
 		async function toggleExpand(node) {
+			if (node.locked) {
+				startPrompt(node, true);
+				return;
+			}
 			if (!node.is_dir) return;
 			if (node.expanded) {
 				node.expanded = false;
 				return;
 			}
-			if (!await loadChildren(node)) return;
+			if (!await loadChildren(node, "focus")) return;
 			node.expanded = true;
 		}
 		const visible = computed(() => {
@@ -1444,18 +1918,33 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 			const hit = files.filter((file) => selected.value.has(file.path)).length;
 			return hit > 0 && hit < files.length;
 		}
-		/** Load a directory and all of its sub-directories. */
+		/**
+		* Load a directory and all of its sub-directories. Stops at the first folder
+		* that needs a password and returns it, so nothing is silently left out.
+		*/
 		async function loadTree(node) {
-			if (!node.is_dir) return true;
-			if (!await loadChildren(node)) return false;
-			for (const child of node.children) if (child.is_dir && !await loadTree(child)) return false;
-			return true;
+			if (!node.is_dir) return { ok: true };
+			if (!await loadChildren(node)) return node.locked ? {
+				ok: false,
+				locked: node
+			} : { ok: false };
+			for (const child of node.children) {
+				if (!child.is_dir) continue;
+				const result = await loadTree(child);
+				if (!result.ok) {
+					node.expanded = true;
+					return result;
+				}
+			}
+			return { ok: true };
 		}
 		async function toggleCheck(node, event) {
 			const input = event?.target;
 			if (node.is_dir && !isChecked(node)) {
-				if (await loadTree(node)) node.expanded = true;
+				const result = await loadTree(node);
+				if (result.ok) node.expanded = true;
 				else {
+					if (result.locked) startPrompt(result.locked, true);
 					if (input) input.checked = isChecked(node);
 					return;
 				}
@@ -1628,11 +2117,6 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 				batchBusy.value = false;
 			}
 		}
-		function submitPassword() {
-			activePassword.value = passwordInput.value;
-			downloadCache.clear();
-			loadRoot();
-		}
 		const displayTitle = computed(() => props.title || siteTitle.value || (props.path === "/" ? t("allFiles") : props.path));
 		const stickyTop = ref(0);
 		function measureStickyTop() {
@@ -1646,6 +2130,7 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 			stickyTop.value = top;
 		}
 		onMounted(() => {
+			syncRemembered();
 			loadRoot();
 			loadSiteTitle();
 			measureStickyTop();
@@ -1657,11 +2142,17 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 		});
 		return (_ctx, _cache) => {
 			return openBlock(), createElementBlock("div", {
-				class: normalizeClass(["fl-root", { "fl-selecting": selected.value.size > 0 }]),
-				style: normalizeStyle({ "--fl-sticky-top-auto": `${stickyTop.value}px` })
+				ref_key: "rootEl",
+				ref: rootEl,
+				class: normalizeClass(["fl-root", {
+					"fl-selecting": selected.value.size > 0,
+					"fl-refreshing": refreshing.value
+				}]),
+				style: normalizeStyle({ "--fl-sticky-top-auto": `${stickyTop.value}px` }),
+				"aria-busy": refreshing.value || loadingRoot.value
 			}, [
-				createElementVNode("div", _hoisted_1, [
-					selected.value.size ? (openBlock(), createElementBlock("div", _hoisted_2, [createElementVNode("span", _hoisted_3, toDisplayString(t("selected", { count: selected.value.size })), 1), createElementVNode("span", _hoisted_4, toDisplayString(t("totalSize", { size: unref(formatSize)(selectedBytes.value) })), 1)])) : (openBlock(), createElementBlock("div", _hoisted_5, [createElementVNode("span", _hoisted_6, toDisplayString(displayTitle.value), 1), demo.value ? (openBlock(), createElementBlock("span", _hoisted_7, toDisplayString(t("demoBadge")), 1)) : createCommentVNode("v-if", true)])),
+				createElementVNode("div", _hoisted_2, [
+					selected.value.size ? (openBlock(), createElementBlock("div", _hoisted_3, [createElementVNode("span", _hoisted_4, toDisplayString(t("selected", { count: selected.value.size })), 1), createElementVNode("span", _hoisted_5, toDisplayString(t("totalSize", { size: formatTotal(selectedBytes.value) })), 1)])) : (openBlock(), createElementBlock("div", _hoisted_6, [createElementVNode("span", _hoisted_7, toDisplayString(displayTitle.value), 1), demo.value ? (openBlock(), createElementBlock("span", _hoisted_8, toDisplayString(t("demoBadge")), 1)) : createCommentVNode("v-if", true)])),
 					selected.value.size ? (openBlock(), createElementBlock("button", {
 						key: 2,
 						class: "fl-clear",
@@ -1669,7 +2160,7 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 						"aria-label": t("clearSelection"),
 						title: t("clearSelection"),
 						onClick: clearSelection
-					}, [_cache[9] || (_cache[9] = createElementVNode("svg", {
+					}, [_cache[10] || (_cache[10] = createElementVNode("svg", {
 						class: "fl-clear-icon",
 						viewBox: "0 0 24 24",
 						width: "18",
@@ -1679,8 +2170,8 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 						"stroke-width": "2.2",
 						"stroke-linecap": "round",
 						"aria-hidden": "true"
-					}, [createElementVNode("path", { d: "M6 6l12 12" }), createElementVNode("path", { d: "M18 6 6 18" })], -1)), createElementVNode("span", _hoisted_9, toDisplayString(t("clear")), 1)], 8, _hoisted_8)) : createCommentVNode("v-if", true),
-					createElementVNode("div", _hoisted_10, [createElementVNode("label", _hoisted_11, [_cache[10] || (_cache[10] = createElementVNode("svg", {
+					}, [createElementVNode("path", { d: "M6 6l12 12" }), createElementVNode("path", { d: "M18 6 6 18" })], -1)), createElementVNode("span", _hoisted_10, toDisplayString(t("clear")), 1)], 8, _hoisted_9)) : createCommentVNode("v-if", true),
+					createElementVNode("div", _hoisted_11, [createElementVNode("label", _hoisted_12, [_cache[11] || (_cache[11] = createElementVNode("svg", {
 						viewBox: "0 0 24 24",
 						width: "15",
 						height: "15",
@@ -1698,13 +2189,14 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 						type: "text",
 						placeholder: t("filter"),
 						"aria-label": t("filter")
-					}, null, 8, _hoisted_12), [[vModelText, keyword.value]])]), createElementVNode("button", {
-						class: "fl-icon-btn",
+					}, null, 8, _hoisted_13), [[vModelText, keyword.value]])]), createElementVNode("button", {
+						class: normalizeClass(["fl-icon-btn fl-refresh", { "fl-spinning": refreshing.value }]),
 						type: "button",
-						"aria-label": t("refresh"),
-						title: t("refresh"),
-						onClick: loadRoot
-					}, [..._cache[11] || (_cache[11] = [createElementVNode("svg", {
+						disabled: refreshing.value || loadingRoot.value,
+						"aria-label": refreshing.value ? t("refreshing") : t("refresh"),
+						title: refreshing.value ? t("refreshing") : t("refresh"),
+						onClick: refresh
+					}, [..._cache[12] || (_cache[12] = [createElementVNode("svg", {
 						viewBox: "0 0 24 24",
 						width: "15",
 						height: "15",
@@ -1714,14 +2206,14 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 						"stroke-linecap": "round",
 						"stroke-linejoin": "round",
 						"aria-hidden": "true"
-					}, [createElementVNode("path", { d: "M21 12a9 9 0 1 1-3-6.7" }), createElementVNode("path", { d: "M21 4v5h-5" })], -1)])], 8, _hoisted_13)]),
+					}, [createElementVNode("path", { d: "M21 12a9 9 0 1 1-3-6.7" }), createElementVNode("path", { d: "M21 4v5h-5" })], -1)])], 10, _hoisted_14)]),
 					selected.value.size ? (openBlock(), createElementBlock("button", {
 						key: 3,
 						class: "fl-btn fl-btn-primary",
 						type: "button",
 						disabled: batchBusy.value,
 						onClick: batchDownload
-					}, [_cache[12] || (_cache[12] = createElementVNode("svg", {
+					}, [_cache[13] || (_cache[13] = createElementVNode("svg", {
 						viewBox: "0 0 24 24",
 						width: "15",
 						height: "15",
@@ -1735,24 +2227,10 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 						createElementVNode("path", { d: "M12 3v12" }),
 						createElementVNode("path", { d: "m7 10 5 5 5-5" }),
 						createElementVNode("path", { d: "M5 21h14" })
-					], -1)), createTextVNode(" " + toDisplayString(batchBusy.value ? t("batching", { percent: batchProgress.value }) : t("batch")), 1)], 8, _hoisted_14)) : createCommentVNode("v-if", true)
+					], -1)), createTextVNode(" " + toDisplayString(batchBusy.value ? t("batching", { percent: batchProgress.value }) : t("batch")), 1)], 8, _hoisted_15)) : createCommentVNode("v-if", true)
 				]),
-				needsPassword.value ? (openBlock(), createElementBlock("div", _hoisted_15, [
-					createElementVNode("span", null, toDisplayString(t("passwordPrompt")), 1),
-					withDirectives(createElementVNode("input", {
-						"onUpdate:modelValue": _cache[1] || (_cache[1] = ($event) => passwordInput.value = $event),
-						type: "password",
-						placeholder: t("passwordPlaceholder"),
-						"aria-label": t("passwordPlaceholder"),
-						onKeyup: withKeys(submitPassword, ["enter"])
-					}, null, 40, _hoisted_16), [[vModelText, passwordInput.value]]),
-					createElementVNode("button", {
-						class: "fl-btn fl-btn-primary",
-						type: "button",
-						onClick: submitPassword
-					}, toDisplayString(t("open")), 1)
-				])) : createCommentVNode("v-if", true),
-				createElementVNode("div", _hoisted_17, [
+				createElementVNode("div", _hoisted_16, [
+					refreshing.value ? (openBlock(), createElementBlock("span", _hoisted_17)) : createCommentVNode("v-if", true),
 					createElementVNode("label", _hoisted_18, [createElementVNode("input", {
 						type: "checkbox",
 						"aria-label": t("selectAll"),
@@ -1764,23 +2242,23 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 						class: "fl-sort-btn",
 						type: "button",
 						"aria-sort": sortKey.value === "name" ? sortAsc.value ? "ascending" : "descending" : void 0,
-						onClick: _cache[2] || (_cache[2] = ($event) => setSort("name"))
+						onClick: _cache[1] || (_cache[1] = ($event) => setSort("name"))
 					}, [createTextVNode(toDisplayString(t("columnName")), 1), createElementVNode("span", _hoisted_22, toDisplayString(sortKey.value === "name" ? sortAsc.value ? "▲" : "▼" : ""), 1)], 8, _hoisted_21)]),
 					createElementVNode("span", _hoisted_23, [createElementVNode("button", {
 						class: "fl-sort-btn",
 						type: "button",
-						onClick: _cache[3] || (_cache[3] = ($event) => setSort("size"))
+						onClick: _cache[2] || (_cache[2] = ($event) => setSort("size"))
 					}, [createTextVNode(toDisplayString(t("columnSize")), 1), createElementVNode("span", _hoisted_24, toDisplayString(sortKey.value === "size" ? sortAsc.value ? "▲" : "▼" : ""), 1)])]),
 					createElementVNode("span", _hoisted_25, [createElementVNode("button", {
 						class: "fl-sort-btn",
 						type: "button",
-						onClick: _cache[4] || (_cache[4] = ($event) => setSort("modified"))
+						onClick: _cache[3] || (_cache[3] = ($event) => setSort("modified"))
 					}, [createTextVNode(toDisplayString(t("columnDate")), 1), createElementVNode("span", _hoisted_26, toDisplayString(sortKey.value === "modified" ? sortAsc.value ? "▲" : "▼" : ""), 1)])]),
 					createElementVNode("span", _hoisted_27, [createElementVNode("label", _hoisted_28, [
 						createElementVNode("span", null, toDisplayString(t("sortBy")), 1),
 						createElementVNode("span", _hoisted_29, toDisplayString(sortOptions.value.find((option) => option.value === sortValue.value)?.label), 1),
 						withDirectives(createElementVNode("select", {
-							"onUpdate:modelValue": _cache[5] || (_cache[5] = ($event) => sortValue.value = $event),
+							"onUpdate:modelValue": _cache[4] || (_cache[4] = ($event) => sortValue.value = $event),
 							"aria-label": t("sortBy")
 						}, [(openBlock(true), createElementBlock(Fragment, null, renderList(sortOptions.value, (option) => {
 							return openBlock(), createElementBlock("option", {
@@ -1790,49 +2268,148 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 						}), 128))], 8, _hoisted_30), [[vModelSelect, sortValue.value]])
 					])])
 				]),
-				loadingRoot.value ? (openBlock(), createElementBlock("div", _hoisted_32, toDisplayString(t("loading")), 1)) : errorMsg.value ? (openBlock(), createElementBlock("div", _hoisted_33, [
+				loadingRoot.value ? (openBlock(), createElementBlock("div", _hoisted_32, toDisplayString(t("loading")), 1)) : rootLock.active ? (openBlock(), createElementBlock("form", {
+					key: 1,
+					class: normalizeClass(["fl-unlock-root", { "fl-unlock-error": rootLock.error }]),
+					onSubmit: withModifiers(submitRootUnlock, ["prevent"])
+				}, [
+					_cache[15] || (_cache[15] = createElementVNode("svg", {
+						class: "fl-unlock-lock",
+						viewBox: "0 0 24 24",
+						width: "16",
+						height: "16",
+						fill: "none",
+						stroke: "currentColor",
+						"stroke-width": "2.2",
+						"stroke-linecap": "round",
+						"stroke-linejoin": "round",
+						"aria-hidden": "true"
+					}, [createElementVNode("rect", {
+						x: "5",
+						y: "11",
+						width: "14",
+						height: "10",
+						rx: "2"
+					}), createElementVNode("path", { d: "M8 11V8a4 4 0 0 1 8 0v3" })], -1)),
+					createElementVNode("label", {
+						class: "fl-unlock-label",
+						for: `fl-root-unlock-${__props.path}`
+					}, toDisplayString(t("passwordPrompt")), 9, _hoisted_33),
+					rootLock.error ? (openBlock(), createElementBlock("span", _hoisted_34, toDisplayString(unlockErrorText(rootLock.error)), 1)) : createCommentVNode("v-if", true),
+					createElementVNode("span", _hoisted_35, [
+						withDirectives(createElementVNode("input", {
+							id: `fl-root-unlock-${__props.path}`,
+							"onUpdate:modelValue": _cache[5] || (_cache[5] = ($event) => rootLock.input = $event),
+							type: "password",
+							autocomplete: "off",
+							"data-unlock": __props.path,
+							placeholder: t("passwordPlaceholder"),
+							"aria-invalid": !!rootLock.error,
+							"aria-describedby": rootLock.error ? "fl-root-unlock-error" : void 0
+						}, null, 8, _hoisted_36), [[vModelText, rootLock.input]]),
+						canRemember.value ? (openBlock(), createElementBlock("button", {
+							key: 0,
+							class: "fl-unlock-remember",
+							type: "button",
+							"aria-pressed": rootLock.remember,
+							"aria-label": t("rememberPassword"),
+							title: t("rememberPassword"),
+							onClick: _cache[6] || (_cache[6] = ($event) => rootLock.remember = !rootLock.remember)
+						}, [..._cache[14] || (_cache[14] = [createElementVNode("svg", {
+							viewBox: "0 0 24 24",
+							width: "16",
+							height: "16",
+							fill: "none",
+							stroke: "currentColor",
+							"stroke-width": "2",
+							"stroke-linecap": "round",
+							"stroke-linejoin": "round",
+							"aria-hidden": "true"
+						}, [
+							createElementVNode("circle", {
+								cx: "8",
+								cy: "15",
+								r: "4"
+							}),
+							createElementVNode("path", { d: "m11 12 9-9" }),
+							createElementVNode("path", { d: "m17 6 3 3" })
+						], -1)])], 8, _hoisted_37)) : createCommentVNode("v-if", true),
+						createElementVNode("button", {
+							class: "fl-unlock-submit",
+							type: "submit",
+							disabled: rootLock.busy || !rootLock.input
+						}, toDisplayString(t("open")), 9, _hoisted_38)
+					])
+				], 34)) : errorMsg.value ? (openBlock(), createElementBlock("div", _hoisted_39, [
 					createTextVNode(toDisplayString(t("loadFailed", { message: errorMsg.value })) + " ", 1),
-					/guest/i.test(errorMsg.value) ? (openBlock(), createElementBlock("p", _hoisted_34, toDisplayString(t("guestHint")), 1)) : createCommentVNode("v-if", true),
-					/failed to fetch|networkerror/i.test(errorMsg.value) ? (openBlock(), createElementBlock("p", _hoisted_35, toDisplayString(t("corsHint")), 1)) : createCommentVNode("v-if", true),
+					/guest/i.test(errorMsg.value) ? (openBlock(), createElementBlock("p", _hoisted_40, toDisplayString(t("guestHint")), 1)) : createCommentVNode("v-if", true),
+					/failed to fetch|networkerror/i.test(errorMsg.value) ? (openBlock(), createElementBlock("p", _hoisted_41, toDisplayString(t("corsHint")), 1)) : createCommentVNode("v-if", true),
 					createElementVNode("button", {
 						class: "fl-btn",
 						type: "button",
 						onClick: loadRoot
 					}, toDisplayString(t("retry")), 1)
-				])) : visible.value.length === 0 ? (openBlock(), createElementBlock("div", _hoisted_36, toDisplayString(t("empty")), 1)) : createCommentVNode("v-if", true),
+				])) : visible.value.length === 0 ? (openBlock(), createElementBlock("div", _hoisted_42, toDisplayString(t("empty")), 1)) : createCommentVNode("v-if", true),
 				(openBlock(true), createElementBlock(Fragment, null, renderList(visible.value, (node) => {
 					return openBlock(), createElementBlock("div", {
 						key: node.path,
 						class: normalizeClass(["fl-row", {
 							"fl-row-dir": node.is_dir,
 							"fl-row-root": node.isRoot,
-							"fl-row-selected": !node.is_dir && selected.value.has(node.path)
+							"fl-row-selected": !node.is_dir && selected.value.has(node.path),
+							"fl-row-locked": node.locked,
+							"fl-row-prompting": node.locked && node.prompting,
+							"fl-row-error": node.locked && node.prompting && !!node.unlockError
 						}]),
 						style: normalizeStyle({ "--fl-depth": node.depth })
 					}, [
-						createElementVNode("label", _hoisted_37, [createElementVNode("input", {
+						createElementVNode("label", _hoisted_43, [createElementVNode("input", {
 							type: "checkbox",
+							disabled: node.locked,
 							"aria-label": t("selectItem", { name: node.name }),
 							checked: isChecked(node),
 							".indeterminate": isIndeterminate(node),
 							onChange: ($event) => toggleCheck(node, $event)
-						}, null, 40, _hoisted_38)]),
+						}, null, 40, _hoisted_44)]),
 						createElementVNode("span", {
 							class: "fl-cell fl-cell-name",
 							title: node.isRoot ? node.path : void 0
 						}, [
-							_cache[15] || (_cache[15] = createElementVNode("span", {
+							_cache[20] || (_cache[20] = createElementVNode("span", {
 								class: "fl-indent",
 								"aria-hidden": "true"
 							}, null, -1)),
-							node.is_dir ? (openBlock(), createElementBlock("button", {
+							node.locked ? (openBlock(), createElementBlock("button", {
 								key: 0,
+								class: "fl-arrow fl-lock",
+								type: "button",
+								"aria-label": t("unlockFolder", { name: node.name }),
+								title: t("unlockFolder", { name: node.name }),
+								onClick: ($event) => toggleExpand(node)
+							}, [..._cache[16] || (_cache[16] = [createElementVNode("svg", {
+								viewBox: "0 0 24 24",
+								width: "14",
+								height: "14",
+								fill: "none",
+								stroke: "currentColor",
+								"stroke-width": "2.2",
+								"stroke-linecap": "round",
+								"stroke-linejoin": "round",
+								"aria-hidden": "true"
+							}, [createElementVNode("rect", {
+								x: "5",
+								y: "11",
+								width: "14",
+								height: "10",
+								rx: "2"
+							}), createElementVNode("path", { d: "M8 11V8a4 4 0 0 1 8 0v3" })], -1)])], 8, _hoisted_46)) : node.is_dir ? (openBlock(), createElementBlock("button", {
+								key: 1,
 								class: normalizeClass(["fl-arrow", { "fl-arrow-open": node.expanded }]),
 								type: "button",
 								"aria-label": t(node.expanded ? "collapse" : "expand", { name: node.name }),
 								"aria-expanded": node.expanded,
 								onClick: ($event) => toggleExpand(node)
-							}, [..._cache[13] || (_cache[13] = [createElementVNode("svg", {
+							}, [..._cache[17] || (_cache[17] = [createElementVNode("svg", {
 								viewBox: "0 0 24 24",
 								width: "14",
 								height: "14",
@@ -1842,85 +2419,223 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 								"stroke-linecap": "round",
 								"stroke-linejoin": "round",
 								"aria-hidden": "true"
-							}, [createElementVNode("path", { d: "m9 6 6 6-6 6" })], -1)])], 10, _hoisted_40)) : (openBlock(), createElementBlock("span", _hoisted_41)),
-							node.is_dir ? (openBlock(), createElementBlock("svg", _hoisted_42, [..._cache[14] || (_cache[14] = [createElementVNode("path", { d: "M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z" }, null, -1)])])) : (openBlock(), createElementBlock("span", {
-								key: 3,
+							}, [createElementVNode("path", { d: "m9 6 6 6-6 6" })], -1)])], 10, _hoisted_47)) : (openBlock(), createElementBlock("span", _hoisted_48)),
+							node.is_dir ? (openBlock(), createElementBlock("svg", _hoisted_49, [..._cache[18] || (_cache[18] = [createElementVNode("path", { d: "M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z" }, null, -1)])])) : (openBlock(), createElementBlock("span", {
+								key: 4,
 								class: "fl-type",
 								"data-kind": unref(fileKind)(node.name),
 								"aria-hidden": "true"
-							}, toDisplayString(unref(extOf)(node.name) || "FILE"), 9, _hoisted_43)),
-							createElementVNode("span", _hoisted_44, [createElementVNode("span", {
+							}, toDisplayString(unref(extOf)(node.name) || "FILE"), 9, _hoisted_50)),
+							createElementVNode("span", _hoisted_51, [createElementVNode("span", {
 								class: normalizeClass(["fl-name", { "fl-name-dir": node.is_dir }]),
-								onClick: ($event) => node.is_dir ? toggleExpand(node) : download(node)
-							}, toDisplayString(node.name), 11, _hoisted_45), createElementVNode("span", _hoisted_46, [node.is_dir ? (openBlock(), createElementBlock(Fragment, { key: 0 }, [node.loaded ? (openBlock(), createElementBlock(Fragment, { key: 0 }, [createTextVNode(toDisplayString(t("folderItems", { count: folderFiles(node).length })) + " · " + toDisplayString(unref(formatSize)(unref(totalSize)(folderFiles(node)))), 1)], 64)) : createCommentVNode("v-if", true)], 64)) : (openBlock(), createElementBlock(Fragment, { key: 1 }, [createTextVNode(toDisplayString(unref(formatSize)(node.size)) + " · " + toDisplayString(unref(formatDate)(node.modified)), 1)], 64))])]),
-							node.is_dir && node.loaded ? (openBlock(), createElementBlock("span", _hoisted_47, toDisplayString(t("folderItems", { count: folderFiles(node).length })), 1)) : createCommentVNode("v-if", true),
-							node.loading ? (openBlock(), createElementBlock("span", _hoisted_48, "…")) : createCommentVNode("v-if", true)
-						], 8, _hoisted_39),
-						createElementVNode("span", _hoisted_49, toDisplayString(node.is_dir ? "—" : unref(formatSize)(node.size)), 1),
-						createElementVNode("span", _hoisted_50, toDisplayString(unref(formatDate)(node.modified)), 1),
-						createElementVNode("span", _hoisted_51, [node.is_dir ? (openBlock(), createElementBlock("button", {
-							key: 0,
-							class: normalizeClass(["fl-action fl-arrow-end", { "fl-arrow-open": node.expanded }]),
-							type: "button",
-							"aria-label": t(node.expanded ? "collapse" : "expand", { name: node.name }),
-							"aria-expanded": node.expanded,
-							onClick: ($event) => toggleExpand(node)
-						}, [..._cache[16] || (_cache[16] = [createElementVNode("svg", {
-							viewBox: "0 0 24 24",
-							width: "18",
-							height: "18",
-							fill: "none",
-							stroke: "currentColor",
-							"stroke-width": "2.2",
-							"stroke-linecap": "round",
-							"stroke-linejoin": "round",
-							"aria-hidden": "true"
-						}, [createElementVNode("path", { d: "m9 6 6 6-6 6" })], -1)])], 10, _hoisted_52)) : (openBlock(), createElementBlock(Fragment, { key: 1 }, [canPreview(node) ? (openBlock(), createElementBlock("button", {
+								onClick: ($event) => node.locked || node.is_dir ? toggleExpand(node) : download(node)
+							}, toDisplayString(node.name), 11, _hoisted_52), createElementVNode("span", _hoisted_53, [node.is_dir ? (openBlock(), createElementBlock(Fragment, { key: 0 }, [node.loaded ? (openBlock(), createElementBlock(Fragment, { key: 0 }, [createTextVNode(toDisplayString(t("folderItems", { count: folderFiles(node).length })) + " · " + toDisplayString(formatTotal(unref(totalSize)(folderFiles(node)))), 1)], 64)) : createCommentVNode("v-if", true)], 64)) : (openBlock(), createElementBlock(Fragment, { key: 1 }, [createTextVNode(toDisplayString(unref(formatSize)(node.size)) + " · " + toDisplayString(unref(formatDate)(node.modified)), 1)], 64))])]),
+							node.is_dir && node.loaded ? (openBlock(), createElementBlock("span", _hoisted_54, toDisplayString(t("folderItems", { count: folderFiles(node).length })), 1)) : createCommentVNode("v-if", true),
+							node.locked && node.prompting && node.unlockError ? (openBlock(), createElementBlock("span", {
+								key: 6,
+								id: `fl-unlock-error-${node.path}`,
+								class: "fl-unlock-message",
+								role: "alert"
+							}, toDisplayString(unlockErrorText(node.unlockError)), 9, _hoisted_55)) : createCommentVNode("v-if", true),
+							!node.locked && rememberedPaths.value.has(node.path) ? (openBlock(), createElementBlock("button", {
+								key: 7,
+								class: "fl-remembered",
+								type: "button",
+								"aria-label": `${t("forgetPassword")} ${node.name}`,
+								title: t("forgetPassword"),
+								onClick: ($event) => forgetPassword(node)
+							}, [_cache[19] || (_cache[19] = createElementVNode("svg", {
+								viewBox: "0 0 24 24",
+								width: "11",
+								height: "11",
+								fill: "none",
+								stroke: "currentColor",
+								"stroke-width": "2.2",
+								"stroke-linecap": "round",
+								"stroke-linejoin": "round",
+								"aria-hidden": "true"
+							}, [
+								createElementVNode("circle", {
+									cx: "8",
+									cy: "15",
+									r: "4"
+								}),
+								createElementVNode("path", { d: "m11 12 9-9" }),
+								createElementVNode("path", { d: "m17 6 3 3" })
+							], -1)), createTextVNode(" " + toDisplayString(t("remembered")) + " · " + toDisplayString(t("forgetPassword")), 1)], 8, _hoisted_56)) : createCommentVNode("v-if", true),
+							node.loading ? (openBlock(), createElementBlock("span", _hoisted_57, "…")) : createCommentVNode("v-if", true)
+						], 8, _hoisted_45),
+						node.locked && node.prompting ? (openBlock(), createElementBlock("form", {
 							key: 0,
-							class: "fl-action fl-download",
-							type: "button",
-							"aria-label": `${t("preview")} ${node.name}`,
-							title: t("preview"),
-							onClick: ($event) => preview(node)
-						}, [..._cache[17] || (_cache[17] = [createElementVNode("svg", {
-							viewBox: "0 0 24 24",
-							width: "16",
-							height: "16",
-							fill: "none",
-							stroke: "currentColor",
-							"stroke-width": "2",
-							"stroke-linecap": "round",
-							"stroke-linejoin": "round",
-							"aria-hidden": "true"
-						}, [createElementVNode("path", { d: "M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7-10-7-10-7Z" }), createElementVNode("circle", {
-							cx: "12",
-							cy: "12",
-							r: "3"
-						})], -1)])], 8, _hoisted_53)) : createCommentVNode("v-if", true), createElementVNode("button", {
-							class: "fl-action fl-download",
-							type: "button",
-							"aria-label": `${t("download")} ${node.name}`,
-							title: t("download"),
-							onClick: ($event) => download(node)
-						}, [..._cache[18] || (_cache[18] = [createElementVNode("svg", {
-							viewBox: "0 0 24 24",
-							width: "16",
-							height: "16",
-							fill: "none",
-							stroke: "currentColor",
-							"stroke-width": "2",
-							"stroke-linecap": "round",
-							"stroke-linejoin": "round",
-							"aria-hidden": "true"
+							class: "fl-unlock fl-unlock-row",
+							onSubmit: withModifiers(($event) => submitUnlock(node), ["prevent"]),
+							onKeydown: withKeys(withModifiers(($event) => cancelUnlock(node), ["prevent"]), ["esc"])
 						}, [
-							createElementVNode("path", { d: "M12 3v12" }),
-							createElementVNode("path", { d: "m7 10 5 5 5-5" }),
-							createElementVNode("path", { d: "M5 21h14" })
-						], -1)])], 8, _hoisted_54)], 64))])
+							_cache[23] || (_cache[23] = createElementVNode("svg", {
+								class: "fl-unlock-lock",
+								viewBox: "0 0 24 24",
+								width: "18",
+								height: "18",
+								fill: "none",
+								stroke: "currentColor",
+								"stroke-width": "2.2",
+								"stroke-linecap": "round",
+								"stroke-linejoin": "round",
+								"aria-hidden": "true"
+							}, [createElementVNode("rect", {
+								x: "5",
+								y: "11",
+								width: "14",
+								height: "10",
+								rx: "2"
+							}), createElementVNode("path", { d: "M8 11V8a4 4 0 0 1 8 0v3" })], -1)),
+							withDirectives(createElementVNode("input", {
+								"onUpdate:modelValue": ($event) => node.unlockInput = $event,
+								type: "password",
+								autocomplete: "off",
+								"data-unlock": node.path,
+								placeholder: node.unlockError ? unlockErrorText(node.unlockError) : t("passwordPlaceholder"),
+								"aria-label": t("passwordFor", { name: node.name }),
+								"aria-invalid": !!node.unlockError,
+								"aria-describedby": node.unlockError ? `fl-unlock-error-${node.path}` : void 0
+							}, null, 8, _hoisted_59), [[vModelText, node.unlockInput]]),
+							canRemember.value ? (openBlock(), createElementBlock("button", {
+								key: 0,
+								class: "fl-unlock-remember",
+								type: "button",
+								"aria-pressed": !!node.unlockRemember,
+								"aria-label": t("rememberPassword"),
+								title: t("rememberPassword"),
+								onClick: ($event) => node.unlockRemember = !node.unlockRemember
+							}, [..._cache[21] || (_cache[21] = [createElementVNode("svg", {
+								viewBox: "0 0 24 24",
+								width: "16",
+								height: "16",
+								fill: "none",
+								stroke: "currentColor",
+								"stroke-width": "2",
+								"stroke-linecap": "round",
+								"stroke-linejoin": "round",
+								"aria-hidden": "true"
+							}, [
+								createElementVNode("circle", {
+									cx: "8",
+									cy: "15",
+									r: "4"
+								}),
+								createElementVNode("path", { d: "m11 12 9-9" }),
+								createElementVNode("path", { d: "m17 6 3 3" })
+							], -1)])], 8, _hoisted_60)) : createCommentVNode("v-if", true),
+							createElementVNode("button", {
+								class: "fl-unlock-submit",
+								type: "submit",
+								disabled: node.unlockBusy || !node.unlockInput
+							}, toDisplayString(t("open")), 9, _hoisted_61),
+							createElementVNode("button", {
+								class: "fl-unlock-cancel",
+								type: "button",
+								"aria-label": t("cancel"),
+								title: t("cancel"),
+								onClick: ($event) => cancelUnlock(node)
+							}, [..._cache[22] || (_cache[22] = [createElementVNode("svg", {
+								viewBox: "0 0 24 24",
+								width: "14",
+								height: "14",
+								fill: "none",
+								stroke: "currentColor",
+								"stroke-width": "2.2",
+								"stroke-linecap": "round",
+								"aria-hidden": "true"
+							}, [createElementVNode("path", { d: "M6 6l12 12" }), createElementVNode("path", { d: "M18 6 6 18" })], -1)])], 8, _hoisted_62)
+						], 40, _hoisted_58)) : (openBlock(), createElementBlock(Fragment, { key: 1 }, [
+							createElementVNode("span", _hoisted_63, toDisplayString(node.is_dir || node.locked ? "—" : unref(formatSize)(node.size)), 1),
+							createElementVNode("span", _hoisted_64, toDisplayString(unref(formatDate)(node.modified)), 1),
+							createElementVNode("span", _hoisted_65, [node.locked ? (openBlock(), createElementBlock("button", {
+								key: 0,
+								class: "fl-action fl-arrow-end fl-lock",
+								type: "button",
+								"aria-label": t("unlockFolder", { name: node.name }),
+								onClick: ($event) => toggleExpand(node)
+							}, [..._cache[24] || (_cache[24] = [createElementVNode("svg", {
+								viewBox: "0 0 24 24",
+								width: "18",
+								height: "18",
+								fill: "none",
+								stroke: "currentColor",
+								"stroke-width": "2.2",
+								"stroke-linecap": "round",
+								"stroke-linejoin": "round",
+								"aria-hidden": "true"
+							}, [createElementVNode("rect", {
+								x: "5",
+								y: "11",
+								width: "14",
+								height: "10",
+								rx: "2"
+							}), createElementVNode("path", { d: "M8 11V8a4 4 0 0 1 8 0v3" })], -1)])], 8, _hoisted_66)) : node.is_dir ? (openBlock(), createElementBlock("button", {
+								key: 1,
+								class: normalizeClass(["fl-action fl-arrow-end", { "fl-arrow-open": node.expanded }]),
+								type: "button",
+								"aria-label": t(node.expanded ? "collapse" : "expand", { name: node.name }),
+								"aria-expanded": node.expanded,
+								onClick: ($event) => toggleExpand(node)
+							}, [..._cache[25] || (_cache[25] = [createElementVNode("svg", {
+								viewBox: "0 0 24 24",
+								width: "18",
+								height: "18",
+								fill: "none",
+								stroke: "currentColor",
+								"stroke-width": "2.2",
+								"stroke-linecap": "round",
+								"stroke-linejoin": "round",
+								"aria-hidden": "true"
+							}, [createElementVNode("path", { d: "m9 6 6 6-6 6" })], -1)])], 10, _hoisted_67)) : !node.locked ? (openBlock(), createElementBlock(Fragment, { key: 2 }, [canPreview(node) ? (openBlock(), createElementBlock("button", {
+								key: 0,
+								class: "fl-action fl-download",
+								type: "button",
+								"aria-label": `${t("preview")} ${node.name}`,
+								title: t("preview"),
+								onClick: ($event) => preview(node)
+							}, [..._cache[26] || (_cache[26] = [createElementVNode("svg", {
+								viewBox: "0 0 24 24",
+								width: "16",
+								height: "16",
+								fill: "none",
+								stroke: "currentColor",
+								"stroke-width": "2",
+								"stroke-linecap": "round",
+								"stroke-linejoin": "round",
+								"aria-hidden": "true"
+							}, [createElementVNode("path", { d: "M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7-10-7-10-7Z" }), createElementVNode("circle", {
+								cx: "12",
+								cy: "12",
+								r: "3"
+							})], -1)])], 8, _hoisted_68)) : createCommentVNode("v-if", true), createElementVNode("button", {
+								class: "fl-action fl-download",
+								type: "button",
+								"aria-label": `${t("download")} ${node.name}`,
+								title: t("download"),
+								onClick: ($event) => download(node)
+							}, [..._cache[27] || (_cache[27] = [createElementVNode("svg", {
+								viewBox: "0 0 24 24",
+								width: "16",
+								height: "16",
+								fill: "none",
+								stroke: "currentColor",
+								"stroke-width": "2",
+								"stroke-linecap": "round",
+								"stroke-linejoin": "round",
+								"aria-hidden": "true"
+							}, [
+								createElementVNode("path", { d: "M12 3v12" }),
+								createElementVNode("path", { d: "m7 10 5 5 5-5" }),
+								createElementVNode("path", { d: "M5 21h14" })
+							], -1)])], 8, _hoisted_69)], 64)) : createCommentVNode("v-if", true)])
+						], 64))
 					], 6);
 				}), 128)),
-				createElementVNode("div", _hoisted_55, [createElementVNode("span", null, toDisplayString(t("loaded", { count: allFiles.value.length })) + " · " + toDisplayString(t("totalSize", { size: unref(formatSize)(loadedBytes.value) })), 1)]),
-				toast.value ? (openBlock(), createElementBlock("div", _hoisted_56, toDisplayString(toast.value), 1)) : createCommentVNode("v-if", true),
+				createElementVNode("div", _hoisted_70, [createElementVNode("span", null, toDisplayString(t("loaded", { count: allFiles.value.length })) + " · " + toDisplayString(t("totalSize", { size: formatTotal(loadedBytes.value) })), 1)]),
+				toast.value ? (openBlock(), createElementBlock("div", _hoisted_71, toDisplayString(toast.value), 1)) : createCommentVNode("v-if", true),
 				createVNode(_sfc_main$1, {
 					open: !!previewNode.value,
 					file: previewNode.value,
@@ -1933,9 +2648,9 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 					position: previewPosition.value,
 					total: previewPosition.value ? previewList.value.length : 0,
 					onClose: closePreview,
-					onPrev: _cache[6] || (_cache[6] = ($event) => stepPreview(-1)),
-					onNext: _cache[7] || (_cache[7] = ($event) => stepPreview(1)),
-					onDownload: _cache[8] || (_cache[8] = ($event) => previewNode.value && download(previewNode.value))
+					onPrev: _cache[7] || (_cache[7] = ($event) => stepPreview(-1)),
+					onNext: _cache[8] || (_cache[8] = ($event) => stepPreview(1)),
+					onDownload: _cache[9] || (_cache[9] = ($event) => previewNode.value && download(previewNode.value))
 				}, null, 8, [
 					"open",
 					"file",
@@ -1948,7 +2663,7 @@ const _sfc_main = /*@__PURE__*/ defineComponent({
 					"position",
 					"total"
 				])
-			], 6);
+			], 14, _hoisted_1);
 		};
 	}
 });