feat: addressed concerns about type safety and xss possibilities from review

public/results.ts

@@ -13,6 +13,7 @@ function refreshData(): void {
     fetch(`${webroot}/progress/${jobId}`, { method: "POST" })
       .then((res) => res.text())
       .then((html) => {
+        // SECURE: server-rendered HTML fragment from trusted /progress endpoint (no user input)
         main.innerHTML = html;
       })
       .catch((err) => console.log(err));

public/script.ts

@@ -25,6 +25,11 @@ const api = edenFetch<App>(webroot);
 
 // ── Route helpers (typed via @elysiajs/eden inference from App) ────────────────
 
+// NOTE on `body as never`: elysiajs/eden's body type inference is limited for dynamic
+// routes, so we cast to `never` to bypass the type check. The functions return typed
+// values where possible, but request bodies lose Eden's compile-time safety here.
+// See https://github.com/elysiajs/eden/issues/138
+
 async function postConversions(body: { fileType: string | null }): Promise<string> {
   const res = await api("/conversions", { method: "POST", body: body as never, headers: {} });
   if (res.error) throw new Error(`POST /conversions failed: ${JSON.stringify(res.error)}`);
@@ -118,6 +123,7 @@ function handleFile(file: File): void {
 
     postConversions({ fileType: fileType ?? null })
       .then((html) => {
+        // SECURE: server-rendered HTML fragment from trusted /conversions endpoint (no user input)
         selectContainer.innerHTML = html;
         updateSearchBar();
       })

src/eden.ts

@@ -9,6 +9,7 @@ import { Elysia } from "elysia";
 import { chooseConverter } from "./pages/chooseConverter";
 import { convert } from "./pages/convert";
 import { deleteFile } from "./pages/deleteFile";
+import { deleteJob } from "./pages/deleteJob";
 import { download } from "./pages/download";
 import { healthcheck } from "./pages/healthcheck";
 import { history } from "./pages/history";
@@ -25,6 +26,7 @@ export const app = new Elysia()
   .use(upload)
   .use(history)
   .use(convert)
+  .use(deleteJob)
   .use(download)
   .use(results)
   .use(deleteFile)