// -------------------------------------------------------------------- // Main download logic // -------------------------------------------------------------------- document.getElementById('downloadBtn').addEventListener('click', async (e) => const btn = e.currentTarget; btn.disabled = true; setStatus('Preparing download…');

/* Layout */ body font-family: system-ui, -apple-system, "Segoe UI", sans-serif; margin: 0; padding: 2rem; background: #f7f9fc; color: #333;

.download-section max-width: 480px; margin: 0 auto; text-align: center;

/* Button */ .download-btn display: inline-flex; align-items: center; gap: .5rem; padding: .75rem 1.5rem; font-size: 1rem; font-weight: 600; color: #fff; background: #0069d9; border: none; border-radius: .4rem; cursor: pointer; transition: background .2s;

function resolveSafeFile(requestedName) // Prevent path‑traversal (../) attacks const safeName = path.basename(requestedName); const absolutePath = path.join(FILE_ROOT, safeName); if (!absolutePath.startsWith(FILE_ROOT)) throw new Error('Invalid file path'); return absolutePath;