@vryzel/file-next 0.5.2 → 0.6.0

package/README.md

@@ -169,7 +169,7 @@ import { createShareRouteHandler } from "@vryzel/file-next/server";
 export const GET = createShareRouteHandler({ store, fs });
 ```
 
-The handler streams the object through Next.js. Folders cannot be shared this way. Optional `sharePathPrefix` on `createServerActions` (default `/api/share`).
+The handler streams objects up to 32MB through Next.js and redirects larger ones to a 60-second signed URL. Folders cannot be shared this way. Optional `sharePathPrefix` on `createServerActions` (default `/api/share`).
 
 ### 8. Route handlers (upload / download)
 
@@ -180,6 +180,7 @@ import { getFileSystem } from "@vryzel/file-next";
 
 export const PUT = createUploadRouteHandler({
   fs: getFileSystem(),
+  getAuth: async () => session ?? null,
   maxBytes: 25 * 1024 * 1024,
   allowedContentTypes: ["image/*", "application/pdf"],
 });

package/dist/{filesystem-Djiiu6YU.d.ts → filesystem-CF4TFF58.d.ts}

@@ -206,6 +206,11 @@ interface PresignedUploadInput {
     contentType?: string;
     /** Expiry in seconds. Providers enforce a max (e.g. 7 days for S3). */
     expiresIn?: number;
+    /**
+     * When set, the signature binds `Content-Length` to this value.
+     * A PUT with any other length is rejected by the provider.
+     */
+    contentLength?: number;
 }
 interface PresignedDownloadInput {
     key: S3Key;
@@ -401,53 +406,19 @@ interface S3CompatibleAdapter {
 declare const CredentialsSchema: z.ZodObject<{
     accessKeyId: z.ZodString;
     secretAccessKey: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    accessKeyId: string;
-    secretAccessKey: string;
-}, {
-    accessKeyId: string;
-    secretAccessKey: string;
-}>;
+}, z.core.$strip>;
 type Credentials = z.infer<typeof CredentialsSchema>;
 declare const S3ConfigSchema: z.ZodObject<{
     provider: z.ZodLiteral<"s3">;
     bucket: z.ZodString;
     region: z.ZodString;
-    /** Optional S3-compatible endpoint (MinIO, LocalStack, ...). */
     endpoint: z.ZodOptional<z.ZodString>;
     credentials: z.ZodObject<{
         accessKeyId: z.ZodString;
         secretAccessKey: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }>;
-    /** Default false; some S3-compatible providers need path-style. */
+    }, z.core.$strip>;
     forcePathStyle: z.ZodDefault<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    provider: "s3";
-    bucket: string;
-    region: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    forcePathStyle: boolean;
-    endpoint?: string | undefined;
-}, {
-    provider: "s3";
-    bucket: string;
-    region: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    endpoint?: string | undefined;
-    forcePathStyle?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 declare const R2ConfigSchema: z.ZodObject<{
     provider: z.ZodLiteral<"r2">;
     bucket: z.ZodString;
@@ -455,107 +426,29 @@ declare const R2ConfigSchema: z.ZodObject<{
     credentials: z.ZodObject<{
         accessKeyId: z.ZodString;
         secretAccessKey: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }>;
-    /** R2 ONLY supports path-style; the literal-true type makes that explicit. */
+    }, z.core.$strip>;
     forcePathStyle: z.ZodLiteral<true>;
-}, "strip", z.ZodTypeAny, {
-    provider: "r2";
-    bucket: string;
-    endpoint: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    forcePathStyle: true;
-}, {
-    provider: "r2";
-    bucket: string;
-    endpoint: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    forcePathStyle: true;
-}>;
-declare const FileSystemConfigSchema: z.ZodDiscriminatedUnion<"provider", [z.ZodObject<{
+}, z.core.$strip>;
+declare const FileSystemConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     provider: z.ZodLiteral<"s3">;
     bucket: z.ZodString;
     region: z.ZodString;
-    /** Optional S3-compatible endpoint (MinIO, LocalStack, ...). */
     endpoint: z.ZodOptional<z.ZodString>;
     credentials: z.ZodObject<{
         accessKeyId: z.ZodString;
         secretAccessKey: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }>;
-    /** Default false; some S3-compatible providers need path-style. */
+    }, z.core.$strip>;
     forcePathStyle: z.ZodDefault<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    provider: "s3";
-    bucket: string;
-    region: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    forcePathStyle: boolean;
-    endpoint?: string | undefined;
-}, {
-    provider: "s3";
-    bucket: string;
-    region: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    endpoint?: string | undefined;
-    forcePathStyle?: boolean | undefined;
-}>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     provider: z.ZodLiteral<"r2">;
     bucket: z.ZodString;
     endpoint: z.ZodString;
     credentials: z.ZodObject<{
         accessKeyId: z.ZodString;
         secretAccessKey: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }>;
-    /** R2 ONLY supports path-style; the literal-true type makes that explicit. */
+    }, z.core.$strip>;
     forcePathStyle: z.ZodLiteral<true>;
-}, "strip", z.ZodTypeAny, {
-    provider: "r2";
-    bucket: string;
-    endpoint: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    forcePathStyle: true;
-}, {
-    provider: "r2";
-    bucket: string;
-    endpoint: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    forcePathStyle: true;
-}>]>;
+}, z.core.$strip>], "provider">;
 type S3Config = z.infer<typeof S3ConfigSchema>;
 type R2Config = z.infer<typeof R2ConfigSchema>;
 type FileSystemConfig = z.infer<typeof FileSystemConfigSchema>;
@@ -831,11 +724,14 @@ interface FileSystem {
     readonly tenantId?: string;
     /** Optional per-tenant byte cap enforced by write-through. */
     readonly quotaBytes?: number;
+    /** Optional per-object byte cap enforced on presigned confirm. */
+    readonly maxBytes?: number;
     forTenant(tenantId: string): FileSystem;
 }
 interface CreateFileSystemOptions {
     readonly store?: MetadataStore;
     readonly quotaBytes?: number;
+    readonly maxBytes?: number;
     /**
      * When true (default), `forTenant(id)` prefixes object keys with
      * `t/{id}/`. Set false for a single-tenant bucket or an R2 token

package/dist/{filesystem-C0vVDtg4.d.cts → filesystem-CFRC-gky.d.cts}

@@ -206,6 +206,11 @@ interface PresignedUploadInput {
     contentType?: string;
     /** Expiry in seconds. Providers enforce a max (e.g. 7 days for S3). */
     expiresIn?: number;
+    /**
+     * When set, the signature binds `Content-Length` to this value.
+     * A PUT with any other length is rejected by the provider.
+     */
+    contentLength?: number;
 }
 interface PresignedDownloadInput {
     key: S3Key;
@@ -401,53 +406,19 @@ interface S3CompatibleAdapter {
 declare const CredentialsSchema: z.ZodObject<{
     accessKeyId: z.ZodString;
     secretAccessKey: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    accessKeyId: string;
-    secretAccessKey: string;
-}, {
-    accessKeyId: string;
-    secretAccessKey: string;
-}>;
+}, z.core.$strip>;
 type Credentials = z.infer<typeof CredentialsSchema>;
 declare const S3ConfigSchema: z.ZodObject<{
     provider: z.ZodLiteral<"s3">;
     bucket: z.ZodString;
     region: z.ZodString;
-    /** Optional S3-compatible endpoint (MinIO, LocalStack, ...). */
     endpoint: z.ZodOptional<z.ZodString>;
     credentials: z.ZodObject<{
         accessKeyId: z.ZodString;
         secretAccessKey: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }>;
-    /** Default false; some S3-compatible providers need path-style. */
+    }, z.core.$strip>;
     forcePathStyle: z.ZodDefault<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    provider: "s3";
-    bucket: string;
-    region: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    forcePathStyle: boolean;
-    endpoint?: string | undefined;
-}, {
-    provider: "s3";
-    bucket: string;
-    region: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    endpoint?: string | undefined;
-    forcePathStyle?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 declare const R2ConfigSchema: z.ZodObject<{
     provider: z.ZodLiteral<"r2">;
     bucket: z.ZodString;
@@ -455,107 +426,29 @@ declare const R2ConfigSchema: z.ZodObject<{
     credentials: z.ZodObject<{
         accessKeyId: z.ZodString;
         secretAccessKey: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }>;
-    /** R2 ONLY supports path-style; the literal-true type makes that explicit. */
+    }, z.core.$strip>;
     forcePathStyle: z.ZodLiteral<true>;
-}, "strip", z.ZodTypeAny, {
-    provider: "r2";
-    bucket: string;
-    endpoint: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    forcePathStyle: true;
-}, {
-    provider: "r2";
-    bucket: string;
-    endpoint: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    forcePathStyle: true;
-}>;
-declare const FileSystemConfigSchema: z.ZodDiscriminatedUnion<"provider", [z.ZodObject<{
+}, z.core.$strip>;
+declare const FileSystemConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     provider: z.ZodLiteral<"s3">;
     bucket: z.ZodString;
     region: z.ZodString;
-    /** Optional S3-compatible endpoint (MinIO, LocalStack, ...). */
     endpoint: z.ZodOptional<z.ZodString>;
     credentials: z.ZodObject<{
         accessKeyId: z.ZodString;
         secretAccessKey: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }>;
-    /** Default false; some S3-compatible providers need path-style. */
+    }, z.core.$strip>;
     forcePathStyle: z.ZodDefault<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    provider: "s3";
-    bucket: string;
-    region: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    forcePathStyle: boolean;
-    endpoint?: string | undefined;
-}, {
-    provider: "s3";
-    bucket: string;
-    region: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    endpoint?: string | undefined;
-    forcePathStyle?: boolean | undefined;
-}>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     provider: z.ZodLiteral<"r2">;
     bucket: z.ZodString;
     endpoint: z.ZodString;
     credentials: z.ZodObject<{
         accessKeyId: z.ZodString;
         secretAccessKey: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }, {
-        accessKeyId: string;
-        secretAccessKey: string;
-    }>;
-    /** R2 ONLY supports path-style; the literal-true type makes that explicit. */
+    }, z.core.$strip>;
     forcePathStyle: z.ZodLiteral<true>;
-}, "strip", z.ZodTypeAny, {
-    provider: "r2";
-    bucket: string;
-    endpoint: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    forcePathStyle: true;
-}, {
-    provider: "r2";
-    bucket: string;
-    endpoint: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    forcePathStyle: true;
-}>]>;
+}, z.core.$strip>], "provider">;
 type S3Config = z.infer<typeof S3ConfigSchema>;
 type R2Config = z.infer<typeof R2ConfigSchema>;
 type FileSystemConfig = z.infer<typeof FileSystemConfigSchema>;
@@ -831,11 +724,14 @@ interface FileSystem {
     readonly tenantId?: string;
     /** Optional per-tenant byte cap enforced by write-through. */
     readonly quotaBytes?: number;
+    /** Optional per-object byte cap enforced on presigned confirm. */
+    readonly maxBytes?: number;
     forTenant(tenantId: string): FileSystem;
 }
 interface CreateFileSystemOptions {
     readonly store?: MetadataStore;
     readonly quotaBytes?: number;
+    readonly maxBytes?: number;
     /**
      * When true (default), `forTenant(id)` prefixes object keys with
      * `t/{id}/`. Set false for a single-tenant bucket or an R2 token

package/dist/index.cjs

@@ -3080,10 +3080,16 @@ var createPresignedUploadUrl = async (client, config, input) => {
     const cmd = new clientS3.PutObjectCommand({
       Bucket: config.bucket,
       Key: input.key,
-      ContentType: input.contentType
+      ContentType: input.contentType,
+      ContentLength: input.contentLength
     });
     const url = await s3RequestPresigner.getSignedUrl(client, cmd, { expiresIn: input.expiresIn ?? 900 });
-    return ok({ url, method: "PUT" });
+    const requiredHeaders = {};
+    if (input.contentType) requiredHeaders["Content-Type"] = input.contentType;
+    if (input.contentLength != null) {
+      requiredHeaders["Content-Length"] = String(input.contentLength);
+    }
+    return ok({ url, method: "PUT", requiredHeaders });
   } catch (e) {
     return err(fromAws(e));
   }
@@ -3390,11 +3396,17 @@ function createMemoryAdapter(options = {}) {
   };
   const createPresignedUploadUrl2 = async (input) => {
     const expiresIn = input.expiresIn ?? 900;
+    const requiredHeaders = {};
+    if (input.contentType) requiredHeaders["Content-Type"] = input.contentType;
+    if (input.contentLength != null) {
+      requiredHeaders["Content-Length"] = String(input.contentLength);
+    }
     return {
       ok: true,
       value: {
         url: `in-memory://${bucket}/${input.key}?expiresIn=${expiresIn}`,
-        method: "PUT"
+        method: "PUT",
+        requiredHeaders
       }
     };
   };
@@ -3623,6 +3635,7 @@ var assemble = (adapter, config, options) => {
     metadata: options?.store,
     tenantId,
     quotaBytes: options?.quotaBytes,
+    maxBytes: options?.maxBytes,
     forTenant
   });
   return {
@@ -3630,6 +3643,7 @@ var assemble = (adapter, config, options) => {
     config,
     metadata: options?.store,
     quotaBytes: options?.quotaBytes,
+    maxBytes: options?.maxBytes,
     forTenant
   };
 };
@@ -4479,22 +4493,22 @@ var buildInner = (Database, options) => {
   const stmtUpdateSelfMove = db.prepare(`
     UPDATE nodes
     SET parent_id = ?, name = ?, path = ?, updated_at = ?
-    WHERE id = ?
+    WHERE id = ? AND tenant_id = ?
   `);
   const stmtCascadeDescendants = db.prepare(`
     UPDATE nodes
     SET path = ? || SUBSTR(path, LENGTH(?) + 1), updated_at = ?
-    WHERE path LIKE ? || '/%'
+    WHERE tenant_id = ? AND path LIKE ? || '/%' ESCAPE '\\'
   `);
   const stmtTombstone = db.prepare(`
     UPDATE nodes
     SET deleted_at = ?, updated_at = ?
-    WHERE id = ?
+    WHERE id = ? AND tenant_id = ?
   `);
   const stmtTombstoneSubtree = db.prepare(`
     UPDATE nodes
     SET deleted_at = ?, updated_at = ?
-    WHERE (id = ? OR path LIKE ? || '/%')
+    WHERE tenant_id = ? AND (id = ? OR path LIKE ? || '/%' ESCAPE '\\')
       AND deleted_at IS NULL
   `);
   const stmtHasLiveChild = db.prepare(`
@@ -4522,7 +4536,7 @@ var buildInner = (Database, options) => {
     WHERE nodes_fts MATCH ?
       AND n.tenant_id = ?
       AND n.deleted_at IS NULL
-      AND (n.id = ? OR n.path LIKE ? || '/%')
+      AND (n.id = ? OR n.path LIKE ? || '/%' ESCAPE '\\')
     ORDER BY bm25(nodes_fts)
     LIMIT ?
   `);
@@ -4559,6 +4573,7 @@ var buildInner = (Database, options) => {
       retryable: false
     })
   );
+  const escapeLike = (s) => s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
   return {
     async createNode(input) {
       const normalized = normalizeNodeName(input.name);
@@ -4611,7 +4626,7 @@ var buildInner = (Database, options) => {
         return err(
           new FileSystemError({
             code: "InternalError",
-            message: `createNode failed: ${e.message}`,
+            message: "createNode failed",
             retryable: false
           })
         );
@@ -4698,14 +4713,16 @@ var buildInner = (Database, options) => {
             newName,
             newPath,
             nowIso(),
-            input.id
+            input.id,
+            input.tenantId
           );
           if (current.path !== newPath) {
             stmtCascadeDescendants.run(
               newPath,
               current.path,
               nowIso(),
-              current.path
+              input.tenantId,
+              escapeLike(current.path)
             );
           }
         });
@@ -4723,7 +4740,7 @@ var buildInner = (Database, options) => {
         return err(
           new FileSystemError({
             code: "InternalError",
-            message: `moveNode failed: ${e.message}`,
+            message: "moveNode failed",
             retryable: false
           })
         );
@@ -4757,9 +4774,9 @@ var buildInner = (Database, options) => {
       }
       const now = nowIso();
       if (input.recursive || node.kind === "file") {
-        stmtTombstoneSubtree.run(now, now, input.id, node.path);
+        stmtTombstoneSubtree.run(now, now, input.tenantId, input.id, escapeLike(node.path));
       } else {
-        stmtTombstone.run(now, now, input.id);
+        stmtTombstone.run(now, now, input.id, input.tenantId);
       }
       return ok(void 0);
     },
@@ -4776,19 +4793,19 @@ var buildInner = (Database, options) => {
           })
         );
       }
-      const like = `${node.path}/%`;
+      const like = `${escapeLike(node.path)}/%`;
       const files = db.prepare(
         `SELECT s3_key FROM nodes
            WHERE tenant_id = ? AND deleted_at IS NOT NULL AND kind = 'file' AND s3_key != ''
-             AND (id = ? OR path LIKE ?)`
+             AND (id = ? OR path LIKE ? ESCAPE '\\')`
       ).all(input.tenantId, input.id, like);
       db.prepare(
         `DELETE FROM shares WHERE tenant_id = ? AND node_id IN (
-           SELECT id FROM nodes WHERE tenant_id = ? AND deleted_at IS NOT NULL AND (id = ? OR path LIKE ?)
+           SELECT id FROM nodes WHERE tenant_id = ? AND deleted_at IS NOT NULL AND (id = ? OR path LIKE ? ESCAPE '\\')
          )`
       ).run(input.tenantId, input.tenantId, input.id, like);
       db.prepare(
-        `DELETE FROM nodes WHERE tenant_id = ? AND deleted_at IS NOT NULL AND (id = ? OR path LIKE ?)`
+        `DELETE FROM nodes WHERE tenant_id = ? AND deleted_at IS NOT NULL AND (id = ? OR path LIKE ? ESCAPE '\\')`
       ).run(input.tenantId, input.id, like);
       return ok({ s3Keys: files.map((row) => row.s3_key) });
     },
@@ -4828,7 +4845,7 @@ var buildInner = (Database, options) => {
               ftsQuery,
               input.tenantId,
               input.parentId,
-              parent.path,
+              escapeLike(parent.path),
               limit
             );
           }
@@ -5300,7 +5317,7 @@ var buildInner2 = (pg, options) => {
         return err(
           new FileSystemError({
             code: "InternalError",
-            message: `createNode failed: ${e.message}`,
+            message: "createNode failed",
             retryable: false
           })
         );
@@ -5417,16 +5434,16 @@ var buildInner2 = (pg, options) => {
           await client.query(
             `UPDATE "${schema}".nodes
              SET parent_id = $1, name = $2, path = $3, updated_at = now()
-             WHERE id = $4`,
-            [input.newParentId, newName, newPath, input.id]
+             WHERE id = $4 AND tenant_id = $5`,
+            [input.newParentId, newName, newPath, input.id, input.tenantId]
           );
           if (current.path !== newPath) {
             await client.query(
               `UPDATE "${schema}".nodes
                SET path = $1 || substring(path FROM length($2) + 1),
                    updated_at = now()
-               WHERE path LIKE $2 || '/%'`,
-              [newPath, current.path]
+               WHERE tenant_id = $3 AND path LIKE $4 || '/%' ESCAPE '\\'`,
+              [newPath, current.path, input.tenantId, escapeLike(current.path)]
             );
           }
         });
@@ -5443,7 +5460,7 @@ var buildInner2 = (pg, options) => {
         return err(
           new FileSystemError({
             code: "InternalError",
-            message: `moveNode failed: ${e.message}`,
+            message: "moveNode failed",
             retryable: false
           })
         );
@@ -5498,17 +5515,17 @@ var buildInner2 = (pg, options) => {
           input.tenantId,
           `UPDATE "${schema}".nodes
            SET deleted_at = now(), updated_at = now()
-           WHERE (id = $1 OR path LIKE $2 || '/%')
+           WHERE tenant_id = $1 AND (id = $2 OR path LIKE $3 || '/%' ESCAPE '\\')
              AND deleted_at IS NULL`,
-          [input.id, node.path]
+          [input.tenantId, input.id, escapeLike(node.path)]
         );
       } else {
         await q(
           input.tenantId,
           `UPDATE "${schema}".nodes
            SET deleted_at = now(), updated_at = now()
-           WHERE id = $1`,
-          [input.id]
+           WHERE id = $1 AND tenant_id = $2`,
+          [input.id, input.tenantId]
         );
       }
       return ok(void 0);
@@ -5531,26 +5548,26 @@ var buildInner2 = (pg, options) => {
           })
         );
       }
-      const like = `${node.path}/%`;
+      const like = `${escapeLike(node.path)}/%`;
       const files = await q(
         input.tenantId,
         `SELECT s3_key FROM "${schema}".nodes
          WHERE tenant_id = $1 AND deleted_at IS NOT NULL AND kind = 'file' AND s3_key <> ''
-           AND (id = $2 OR path LIKE $3)`,
+           AND (id = $2 OR path LIKE $3 ESCAPE '\\')`,
         [input.tenantId, input.id, like]
       );
       await q(
         input.tenantId,
         `DELETE FROM "${schema}".shares WHERE tenant_id = $1 AND node_id IN (
            SELECT id FROM "${schema}".nodes
-           WHERE tenant_id = $1 AND deleted_at IS NOT NULL AND (id = $2 OR path LIKE $3)
+           WHERE tenant_id = $1 AND deleted_at IS NOT NULL AND (id = $2 OR path LIKE $3 ESCAPE '\\')
          )`,
         [input.tenantId, input.id, like]
       );
       await q(
         input.tenantId,
         `DELETE FROM "${schema}".nodes
-         WHERE tenant_id = $1 AND deleted_at IS NOT NULL AND (id = $2 OR path LIKE $3)`,
+         WHERE tenant_id = $1 AND deleted_at IS NOT NULL AND (id = $2 OR path LIKE $3 ESCAPE '\\')`,
         [input.tenantId, input.id, like]
       );
       return ok({ s3Keys: files.rows.map((row) => row.s3_key) });
@@ -5624,11 +5641,11 @@ var buildInner2 = (pg, options) => {
             input.tenantId,
             `SELECT * FROM "${schema}".nodes
              WHERE tenant_id = $1 AND deleted_at IS NULL
-               AND (id = $2 OR path LIKE $3 || '/%')
+               AND (id = $2 OR path LIKE $3 || '/%' ESCAPE '\\')
                AND name ILIKE $4 ESCAPE '\\'
              ORDER BY lower(name) ASC
              LIMIT $5`,
-            [input.tenantId, input.parentId, parent.path, pattern, limit]
+            [input.tenantId, input.parentId, escapeLike(parent.path), pattern, limit]
           );
         }
       }