v0.2.1

0.2.1 (2026-10-24)

Bug Fixes

• serve: the response type comes from file_url only; every response sends nosniff, inline types get a strict sandbox CSP (PDFs inline without CSP so browsers render them), everything else downloads as an attachment (#6) (e8df9de, 27d94c1)
• private files: downloads require a File whose file_url equals the request path; saves cannot change file_url, thumbnail_url or content_hash (#6) (e8df9de)
• shared objects: making a file private or public copies a shared object instead of deleting it; the new hooks s3storage_before_object_delete and s3storage_before_object_write run before every object delete or overwrite (#6) (e8df9de, 343604b)
• migrate: --to-local writes a unique temp file per download (#6) (e8df9de)