webspresso 0.0.66 → 0.0.68

package/README.md

@@ -17,6 +17,7 @@ A minimal, file-based SSR framework for Node.js with Nunjucks templating.
 - **Plugin System**: Extensible architecture with version control and inter-plugin communication
 - **Built-in Plugins**: Development dashboard, sitemap generator, SEO checker, analytics integration (Google, Yandex, Bing), self-hosted site analytics, optional Swagger UI for HTTP APIs, configurable HTTP health probe endpoint, optional REST CRUD routes from ORM models, optional admin UI for ORM query cache metrics and purge
 - **Session authentication** (optional): `createAuth` / `quickAuth` in **`webspresso/core/auth`** — pass the manager to **`createApp({ auth })`** for `express-session`, `req.user` / `req.auth`, remember-me tokens, and policy-style authorization. Full walkthrough: **[`doc/index.html#authentication`](doc/index.html#authentication)**.
+- **Optional client runtime** (Alpine.js + [swup](https://swup.js.org/)): **`createApp({ clientRuntime: { alpine, swup } })`** serves scripts under **`/__webspresso/client-runtime/`** and exposes **`clientRuntime`** in Nunjucks; layouts can include **`views/partials/webspresso-client-runtime.njk`**. Env overrides: **`WEBSPRESSO_ALPINE`**, **`WEBSPRESSO_SWUP`**. Demo: **`examples/alpine-swup-demo/`**. Details: **[`doc/index.html#client-runtime`](doc/index.html#client-runtime)**.
 - **TypeScript**: Published **`index.d.ts`** (via `package.json` `"types"`) for `createApp`, ORM, plugins, and router helpers — use from TS/JS with IDE autocomplete; runtime stays CommonJS
 
 ## Installation
@@ -128,6 +129,17 @@ If you select a database:
 - `models/` directory is created
 - `DATABASE_URL` is added to `.env.example` with a template
 
+**Scaffold: `config/` and environment files**
+
+New projects include:
+
+- **`config/load-env.js`** — loads, in order, `.env`, `.env.local`, `.env.${NODE_ENV}`, and `.env.${NODE_ENV}.local` (each file overrides keys from earlier ones).
+- **`config/env.schema.js`** — validates `process.env` with **Zod** before the app starts (`PORT`, `NODE_ENV`, i18n vars, `BASE_URL`, optional `DATABASE_URL`).
+- **`config/app.js`** — returns `createApp()` options (paths; if `webspresso.db.js` exists, also **`createDatabase`** as `db`).
+- **`server.js`** — calls `loadEnv()`, then `createApp(getCreateAppOptions())`, then `listen` using the parsed `PORT`.
+
+Copy **`.env.example`** to **`.env`** (and use `.env.local` for machine-specific overrides). Patterns such as `.env.development.local` are gitignored via `.env.*.local`.
+
 **Seed Data Generation:**
 After selecting a database, you'll be asked if you want to generate seed data:
 - If yes, `@faker-js/faker` is added to dependencies
@@ -357,8 +369,9 @@ Creates and configures the Express app.
   - `false`: Disable Helmet
   - `Object`: Custom Helmet configuration (merged with defaults)
 - `middlewares` (optional): Named middleware registry for routes
+- `clientRuntime` (optional): **`{ alpine?: boolean | object, swup?: boolean | object }`**. When either flag is enabled, mounts vendored Alpine 3 / swup 4 (+ Head + Scripts plugins) at **`/__webspresso/client-runtime/*`** and passes resolved **`{ alpine, swup }`** into SSR templates as **`clientRuntime`**. Override with env **`WEBSPRESSO_ALPINE`** / **`WEBSPRESSO_SWUP`** (`1` or `true`). Package exports **`resolveClientRuntime`** and **`CLIENT_RUNTIME_BASE`**. See **[Client runtime](#client-runtime)** below and **[`doc/index.html#client-runtime`](doc/index.html#client-runtime)**.
 - `auth` (optional): `AuthManager` from **`createAuth()`** / **`quickAuth()`** (`require('webspresso/core/auth')`). Registers session + cookie parsing, attaches **`req.auth`** / **`req.user`**, and injects named route middleware **`auth`** and **`guest`** (do not reuse those names for custom handlers if you pass `auth`). See **[`doc/index.html#authentication`](doc/index.html#authentication)**.
-- `setupRoutes(app, ctx)` (optional): Register custom Express routes after file routes and plugin `onRoutesReady`, before the 404 handler — use for login/logout handlers when using the auth module; **`ctx.authMiddleware`** exposes `requireAuth`, `requireGuest`, etc.
+- `setupRoutes(app, ctx)` (optional): Register custom Express routes after file routes and plugin `onRoutesReady`, before the 404 handler — use for login/logout handlers when using the auth module; **`ctx.authMiddleware`** exposes `requireAuth`, `requireGuest`, etc.; **`ctx.clientRuntime`** is **`{ alpine, swup }`**
 
 **Example with middlewares:**
 
@@ -423,6 +436,27 @@ middlewares: {
 
 Plain `(req, res, next) => …` handlers still work as today. Tuple form **requires** a factory for that name (you get a clear error if you mix a plain handler with `['name', opts]`).
 
+### Client runtime
+
+Alpine.js + swup — opt-in progressive enhancement for SSR pages:
+
+- **`clientRuntime: { alpine: true, swup: true }`** (each can be toggled independently). Default is off; no scripts are injected when both are disabled.
+- Include **`{% include "partials/webspresso-client-runtime.njk" %}`** in your layout (copy from the npm package’s **`views/partials/`** or the framework repo). When **swup** is on, wrap the main content in **`<main id="swup">…</main>`** so transitions replace the correct region.
+- **swup** uses Head + Scripts plugins; **Alpine** is re-bound after each visit via **`Alpine.initTree`** on the container. Use **`data-no-swup`** on links for a full page load. Paths **`/_admin`** and **`/_webspresso`** are ignored by the default bootstrap; the admin panel and dev dashboard stay separate Mithril apps.
+- Dynamic UI can call **`pages/api/*`** from Alpine with **`fetch`** (see **`examples/alpine-swup-demo/`**).
+- **Helmet / CSP**: production **`script-src 'self'`** works for **`/__webspresso/client-runtime/`**; some Alpine builds may need **`unsafe-eval`** — validate for your version or use a stricter build.
+
+```javascript
+const { createApp } = require('webspresso');
+
+const { app } = createApp({
+  pagesDir: './pages',
+  viewsDir: './views',
+  publicDir: './public',
+  clientRuntime: { alpine: true, swup: true },
+});
+```
+
 ### App context (`req.db`, `getDb`, `attachDbMiddleware`)
 
 With **`createApp({ db })`**, file-based **API** routes (`pages/api/*.js`) get the same ORM instance on **`req.db`** before your **`middleware`** array and the handler run — no extra `require` in the handler:
@@ -2018,6 +2052,45 @@ const { app } = createApp({
 
 List query parameters: `page`, `perPage`, `sort`, `order`, `include`, `trashed` (`only` / `include` when the model uses soft delete), plus **equality filters** on real columns (unknown keys are ignored).
 
+### File upload plugin
+
+Registers **POST** `multipart/form-data` (field name **`file`** by default) and stores the file via a pluggable provider. The framework ships with **`createLocalFileProvider({ destDir, publicBasePath })`** (writes to disk and returns a public URL path). Use **`mimeAllowlist`** / **`extensionAllowlist`** and **`maxBytes`** (default **10 MiB**) on the server; production apps should prefer an explicit MIME allowlist.
+
+**Setup:**
+
+```javascript
+const { createApp, uploadPlugin, adminPanelPlugin } = require('webspresso');
+
+const { app } = createApp({
+  pagesDir: './pages',
+  publicDir: './public',
+  db,
+  plugins: [
+    uploadPlugin({
+      path: '/api/upload',
+      local: {
+        destDir: './public/uploads',
+        publicBasePath: '/uploads',
+      },
+      maxBytes: 10 * 1024 * 1024,
+      mimeAllowlist: ['image/jpeg', 'image/png', 'application/pdf'],
+      extensionAllowlist: ['jpg', 'jpeg', 'png', 'pdf'],
+      middleware: [], // optional Express handlers (e.g. session auth)
+      fieldName: 'file',
+    }),
+    adminPanelPlugin({
+      db,
+      // uploadUrl optional: defaults to app.get('webspresso.uploadPath') set by uploadPlugin
+    }),
+  ],
+});
+```
+
+- **ORM:** `zdb.file({ maxLength: 2048, nullable: true })` — string column for the stored public URL or path; migrations use `table.string(..., maxLength)`.
+- **Admin:** the panel reads **`settings.uploadUrl`** from the registry (set automatically when `uploadPlugin` is registered **before** `adminPanelPlugin`, or pass **`adminPanelPlugin({ uploadUrl: '/api/upload' })`**). File fields (`type: 'file'` or `customFields` type `file-upload`) POST to that URL with credentials.
+- **Response:** `{ url, publicUrl, key? }` — clients typically persist **`url`** / **`publicUrl`** in the model.
+- **Custom storage:** `uploadPlugin({ provider: { async put({ buffer, originalName, mimeType, size, req }) { return { publicUrl: '...' }; } } })`.
+
 ### Health check plugin
 
 Exposes a lightweight **GET** endpoint for load balancers and orchestrators (Kubernetes, Docker healthcheck, etc.). **Enabled by default** in all environments; set `enabled: false` to turn it off.

package/bin/commands/doctor.js

@@ -107,6 +107,29 @@ function registerCommand(program) {
         warnings += 1;
       }
 
+      console.log('\nEnvironment files');
+      console.log('-----------------');
+
+      const envExamplePath = path.join(cwd, '.env.example');
+      const envPath = path.join(cwd, '.env');
+      if (fs.existsSync(envExamplePath)) {
+        line('✓', '.env.example present');
+      } else {
+        line('○', 'No .env.example (optional; new scaffolds include one)');
+      }
+      if (fs.existsSync(envPath)) {
+        line('✓', '.env present');
+      } else if (fs.existsSync(envExamplePath)) {
+        line('⚠', 'No .env — copy .env.example to .env if the app expects env vars');
+        warnings += 1;
+      } else {
+        line('○', 'No .env (fine if you do not use dotenv in this project)');
+      }
+      const loadEnvPath = path.join(cwd, 'config', 'load-env.js');
+      if (fs.existsSync(loadEnvPath)) {
+        line('✓', 'config/load-env.js present (dotenv chain scaffold)');
+      }
+
       console.log('\nDatabase config');
       console.log('---------------');
 

package/bin/commands/new.js

@@ -159,6 +159,7 @@ function registerCommand(program) {
       fs.mkdirSync(path.join(projectPath, 'pages', 'locales'), { recursive: true });
       fs.mkdirSync(path.join(projectPath, 'views'), { recursive: true });
       fs.mkdirSync(path.join(projectPath, 'public'), { recursive: true });
+      fs.mkdirSync(path.join(projectPath, 'config'), { recursive: true });
       
       // Create models directory if database is selected
       if (useDatabase && databaseType) {
@@ -177,7 +178,8 @@ function registerCommand(program) {
         },
         dependencies: {
           webspresso: '*',
-          dotenv: '^16.3.1'
+          dotenv: '^16.3.1',
+          zod: '^3.23.0'
         }
       };
       
@@ -203,28 +205,108 @@ function registerCommand(program) {
         JSON.stringify(packageJson, null, 2) + '\n'
       );
       
-      // Create server.js
-      const serverJs = `require('dotenv').config();
-const { createApp } = require('webspresso');
+      // config/load-env.js — dotenv chain (last file wins for each key)
+      const loadEnvJs = `const fs = require('fs');
 const path = require('path');
+const dotenv = require('dotenv');
+
+/**
+ * Load env files in order: .env, .env.local, .env.<NODE_ENV>, .env.<NODE_ENV>.local
+ * @param {string} [rootDir] Project root (default: parent of config/)
+ */
+function loadEnv(rootDir) {
+  const root = rootDir || path.resolve(__dirname, '..');
+  const loadFile = (name) => {
+    const full = path.join(root, name);
+    if (fs.existsSync(full)) {
+      dotenv.config({ path: full, override: true });
+    }
+  };
+  loadFile('.env');
+  loadFile('.env.local');
+  const mode = process.env.NODE_ENV || 'development';
+  loadFile(\`.env.\${mode}\`);
+  loadFile(\`.env.\${mode}.local\`);
+}
+
+module.exports = { loadEnv };
+`;
 
-const { app } = createApp({
-  pagesDir: path.join(__dirname, 'pages'),
-  viewsDir: path.join(__dirname, 'views'),
-  publicDir: path.join(__dirname, 'public')
+      const envSchemaJs = `const { z } = require('zod');
+
+const envSchema = z.object({
+  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
+  PORT: z.coerce.number().int().positive().default(3000),
+  DEFAULT_LOCALE: z.string().min(1).default('en'),
+  SUPPORTED_LOCALES: z.string().min(1).default('en,de'),
+  BASE_URL: z.string().url().default('http://localhost:3000'),
+  DATABASE_URL: z.string().optional(),
 });
 
-const PORT = process.env.PORT || 3000;
+let _parsed = null;
+
+function parseEnv() {
+  if (_parsed) return _parsed;
+  const result = envSchema.safeParse(process.env);
+  if (!result.success) {
+    console.error('Invalid environment variables:');
+    console.error(result.error.format());
+    process.exit(1);
+  }
+  _parsed = result.data;
+  return _parsed;
+}
+
+module.exports = { envSchema, parseEnv };
+`;
+
+      const appConfigJs = `const path = require('path');
+const fs = require('fs');
+const { parseEnv } = require('./env.schema');
+
+function getCreateAppOptions() {
+  parseEnv();
+  const rootDir = path.resolve(__dirname, '..');
+  const options = {
+    pagesDir: path.join(rootDir, 'pages'),
+    viewsDir: path.join(rootDir, 'views'),
+    publicDir: path.join(rootDir, 'public'),
+  };
+  const dbFile = path.join(rootDir, 'webspresso.db.js');
+  if (fs.existsSync(dbFile)) {
+    const { createDatabase } = require('webspresso');
+    const knexConfig = require(dbFile);
+    options.db = createDatabase(knexConfig);
+  }
+  return options;
+}
+
+module.exports = getCreateAppOptions;
+`;
+
+      const serverJs = `const { loadEnv } = require('./config/load-env');
+loadEnv();
 
-app.listen(PORT, () => {
-  console.log(\`🚀 Server running at http://localhost:\${PORT}\`);
+const { createApp } = require('webspresso');
+const getCreateAppOptions = require('./config/app');
+const { parseEnv } = require('./config/env.schema');
+
+const env = parseEnv();
+const { app } = createApp(getCreateAppOptions());
+
+app.listen(env.PORT, () => {
+  console.log(\`🚀 Server running at http://localhost:\${env.PORT}\`);
 });
 `;
-      
+
+      fs.writeFileSync(path.join(projectPath, 'config', 'load-env.js'), loadEnvJs);
+      fs.writeFileSync(path.join(projectPath, 'config', 'env.schema.js'), envSchemaJs);
+      fs.writeFileSync(path.join(projectPath, 'config', 'app.js'), appConfigJs);
       fs.writeFileSync(path.join(projectPath, 'server.js'), serverJs);
       
-      // Create .env.example
-      let envExample = `PORT=3000
+      // Create .env.example (see config/load-env.js for merge order)
+      let envExample = `# Copy to .env and adjust. Optional overrides: .env.local, .env.<NODE_ENV>, .env.<NODE_ENV>.local
+PORT=3000
 NODE_ENV=development
 DEFAULT_LOCALE=en
 SUPPORTED_LOCALES=en,de
@@ -308,10 +390,11 @@ BASE_URL=http://localhost:3000
         fs.writeFileSync(path.join(projectPath, 'seeds', 'index.js'), seedIndex);
       }
       
-      // Create .gitignore
+      // Create .gitignore (.env optional: teams often commit a non-secret .env for local defaults)
       const gitignore = `node_modules/
 .env
 .env.local
+.env.*.local
 .DS_Store
 coverage/
 *.log
@@ -482,10 +565,18 @@ Webspresso project
 
 \`\`\`bash
 npm install
+cp .env.example .env
 npm run dev
 \`\`\`
 
 Visit http://localhost:3000
+
+## Configuration
+
+- **\`config/load-env.js\`** — loads \`.env\`, \`.env.local\`, then \`.env.$NODE_ENV\` and \`.env.$NODE_ENV.local\` (later files override keys).
+- **\`config/env.schema.js\`** — [Zod](https://zod.dev) schema for \`process.env\`; fails fast on invalid values.
+- **\`config/app.js\`** — builds options passed to \`createApp()\` (paths; adds \`db\` when \`webspresso.db.js\` exists).
+- **\`server.js\`** — calls \`loadEnv()\`, then \`createApp(getCreateAppOptions())\`.
 `;
       
       fs.writeFileSync(path.join(projectPath, 'README.md'), readme);

package/core/orm/migrations/scaffold.js

@@ -112,6 +112,12 @@ function generateColumnLine(columnName, meta) {
       parts.push(`table.text('${columnName}')`);
       break;
 
+    case 'file': {
+      const fileLen = meta.maxLength || 2048;
+      parts.push(`table.string('${columnName}', ${fileLen})`);
+      break;
+    }
+
     case 'float':
       parts.push(`table.float('${columnName}')`);
       break;

package/core/orm/schema-helpers.js

@@ -420,6 +420,25 @@ function createSchemaHelpers(z) {
       }, z);
     },
 
+    /**
+     * File / URL column (stored as varchar; value is public URL or path from upload)
+     * @param {Partial<import('./types').ColumnMeta>} [options={}]
+     * @returns {SchemaBuilder}
+     */
+    file(options = {}) {
+      const { maxLength = 2048, nullable = false, ...rest } = options;
+      let schema = z.string().max(maxLength);
+      if (nullable) {
+        schema = schema.nullable().optional();
+      }
+      return createSchemaBuilder(schema, {
+        type: 'file',
+        maxLength,
+        nullable,
+        ...rest,
+      }, z);
+    },
+
     /**
      * Integer column
      * @param {Partial<import('./types').ColumnMeta>} [options={}]

package/core/orm/types.js

@@ -9,7 +9,7 @@
 // ============================================================================
 
 /**
- * @typedef {'id'|'string'|'text'|'integer'|'bigint'|'float'|'decimal'|'boolean'|'date'|'datetime'|'timestamp'|'json'|'array'|'enum'|'uuid'|'nanoid'} ColumnType
+ * @typedef {'id'|'string'|'text'|'file'|'integer'|'bigint'|'float'|'decimal'|'boolean'|'date'|'datetime'|'timestamp'|'json'|'array'|'enum'|'uuid'|'nanoid'} ColumnType
  */
 
 /**

package/index.d.ts

@@ -45,6 +45,11 @@ export interface CreateAppOptions {
   timeout?: string | false;
   auth?: unknown;
   db?: DatabaseInstance | null;
+  /** Opt-in Alpine / swup assets under `/__webspresso/client-runtime/*`. Env: WEBSPRESSO_ALPINE, WEBSPRESSO_SWUP. */
+  clientRuntime?: {
+    alpine?: boolean | Record<string, unknown>;
+    swup?: boolean | Record<string, unknown>;
+  };
   setupRoutes?: (app: Application, ctx: SetupRoutesContext) => void;
   [key: string]: unknown;
 }
@@ -54,6 +59,7 @@ export interface SetupRoutesContext {
   authMiddleware?: RequestHandler;
   pluginManager: PluginManager;
   options: CreateAppOptions;
+  clientRuntime: { alpine: boolean; swup: boolean };
 }
 
 export interface CreateAppResult {
@@ -525,3 +531,33 @@ export interface RestResourcePluginOptions {
 export function restResourcePlugin(options?: RestResourcePluginOptions): WebspressoPlugin;
 
 export function ormCacheAdminPlugin(options: { db: DatabaseInstance }): WebspressoPlugin;
+
+/** Multipart upload storage (e.g. local disk or S3). */
+export interface UploadStorageProvider {
+  put(args: {
+    buffer?: Buffer;
+    stream?: NodeJS.ReadableStream;
+    originalName: string;
+    mimeType: string;
+    size: number;
+    req: Request;
+  }): Promise<{ publicUrl: string; key?: string }>;
+}
+
+export interface UploadPluginOptions {
+  path?: string;
+  provider?: UploadStorageProvider;
+  local?: { destDir?: string; publicBasePath?: string };
+  maxBytes?: number;
+  mimeAllowlist?: string[] | null;
+  extensionAllowlist?: string[] | null;
+  middleware?: RequestHandler | RequestHandler[];
+  fieldName?: string;
+}
+
+export function uploadPlugin(options?: UploadPluginOptions): WebspressoPlugin;
+
+export function createLocalFileProvider(options?: {
+  destDir?: string;
+  publicBasePath?: string;
+}): UploadStorageProvider;

package/index.js

@@ -3,6 +3,8 @@
  */
 
 const { createApp } = require('./src/server');
+const { resolveClientRuntime } = require('./src/client-runtime/resolve');
+const { CLIENT_RUNTIME_BASE } = require('./src/client-runtime/mount');
 const {
   attachDbMiddleware,
   getAppContext,
@@ -38,11 +40,25 @@ const {
 const orm = require('./core/orm');
 
 // Built-in plugins
-const { schemaExplorerPlugin, adminPanelPlugin, siteAnalyticsPlugin, auditLogPlugin, recaptchaPlugin, swaggerPlugin, healthCheckPlugin, restResourcePlugin, ormCacheAdminPlugin } = require('./plugins');
+const {
+  schemaExplorerPlugin,
+  adminPanelPlugin,
+  siteAnalyticsPlugin,
+  auditLogPlugin,
+  recaptchaPlugin,
+  swaggerPlugin,
+  healthCheckPlugin,
+  restResourcePlugin,
+  ormCacheAdminPlugin,
+  uploadPlugin,
+  createLocalFileProvider,
+} = require('./plugins');
 
 module.exports = {
   // Main API
   createApp,
+  resolveClientRuntime,
+  CLIENT_RUNTIME_BASE,
 
   attachDbMiddleware,
   getAppContext,
@@ -91,4 +107,6 @@ module.exports = {
   healthCheckPlugin,
   restResourcePlugin,
   ormCacheAdminPlugin,
+  uploadPlugin,
+  createLocalFileProvider,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.66",
+  "version": "0.0.68",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",
@@ -42,9 +42,13 @@
     "utils/",
     "core/",
     "plugins/",
-    "templates/"
+    "templates/",
+    "views/partials/webspresso-client-runtime.njk"
   ],
   "dependencies": {
+    "@swup/head-plugin": "^2.3.1",
+    "@swup/scripts-plugin": "^2.1.0",
+    "alpinejs": "^3.15.11",
     "bcrypt": "^5.1.1",
     "commander": "^11.1.0",
     "connect-timeout": "^1.9.1",
@@ -55,8 +59,10 @@
     "helmet": "^7.2.0",
     "inquirer": "^8.2.6",
     "knex": "^3.1.0",
+    "multer": "^2.1.1",
     "nunjucks": "^3.2.4",
     "sharp": "^0.33.5",
+    "swup": "^4.8.3",
     "zod": "^3.23.0",
     "zod-to-json-schema": "^3.25.2"
   },
@@ -85,10 +91,10 @@
     }
   },
   "devDependencies": {
-    "@types/express": "^4.17.21",
-    "@types/node": "^20.14.0",
     "@faker-js/faker": "^9.9.0",
     "@playwright/test": "^1.48.0",
+    "@types/express": "^4.17.21",
+    "@types/node": "^20.14.0",
     "@vitest/coverage-v8": "^3.0.0",
     "better-sqlite3": "^11.10.0",
     "chokidar": "^3.5.3",
@@ -102,6 +108,7 @@
     "node": ">=18.0.0"
   },
   "overrides": {
+    "basic-ftp": "^5.3.0",
     "tar": "^7.5.11",
     "undici": "^6.24.0"
   }

package/plugins/admin-panel/api.js

@@ -308,8 +308,8 @@ function createApiHandlers(options) {
         } else if (value !== undefined && value !== null && value !== '') {
           switch (op) {
             case 'contains':
-              // Apply LIKE for string/text types, or if type is unknown
-              if (colType === 'string' || colType === 'text' || !colMeta) {
+              // Apply LIKE for string/text/file types, or if type is unknown
+              if (colType === 'string' || colType === 'text' || colType === 'file' || !colMeta) {
                 query = query.where(colName, 'like', `%${value}%`);
                 countQuery = countQuery.where(colName, 'like', `%${value}%`);
               }
@@ -319,13 +319,13 @@ function createApiHandlers(options) {
               countQuery = countQuery.where(colName, '=', value);
               break;
             case 'starts_with':
-              if (colType === 'string' || colType === 'text' || !colMeta) {
+              if (colType === 'string' || colType === 'text' || colType === 'file' || !colMeta) {
                 query = query.where(colName, 'like', `${value}%`);
                 countQuery = countQuery.where(colName, 'like', `${value}%`);
               }
               break;
             case 'ends_with':
-              if (colType === 'string' || colType === 'text' || !colMeta) {
+              if (colType === 'string' || colType === 'text' || colType === 'file' || !colMeta) {
                 query = query.where(colName, 'like', `%${value}`);
                 countQuery = countQuery.where(colName, 'like', `%${value}`);
               }
@@ -359,7 +359,7 @@ function createApiHandlers(options) {
       if (req.query.search) {
         const searchTerm = `%${req.query.search}%`;
         const stringColumns = Array.from(model.columns.entries())
-          .filter(([_, meta]) => meta.type === 'string' || meta.type === 'text')
+          .filter(([_, meta]) => meta.type === 'string' || meta.type === 'text' || meta.type === 'file')
           .map(([name]) => name);
 
         if (stringColumns.length > 0) {