Problem
Three download/export routes use three different Content-Disposition formats. files/download emits RFC 6266 correct (filename="..."; filename*=UTF-8''...). flows/export emits only filename="..." with no UTF-8 extended form. skills/export places the unsanitized URL path param inside the quoted legacy filename, risking a malformed header.
Location
apps/web/src/app/api/w/[slug]/files/download/route.ts:60; apps/web/src/app/api/u/[slug]/flows/[id]/export/route.ts:60; apps/web/src/app/api/u/[slug]/skills/[name]/export/route.ts:38
Impact
Wrong download names for non-ASCII names and a potential malformed-header risk on skills export.
Suggested fix
Standardize on one helper that emits a sanitized ASCII filename="..." plus filename*=UTF-8''<encoded>, and use it in all three routes.
Source: code investigation.
Problem
Three download/export routes use three different
Content-Dispositionformats.files/downloademits RFC 6266 correct (filename="..."; filename*=UTF-8''...).flows/exportemits onlyfilename="..."with no UTF-8 extended form.skills/exportplaces the unsanitized URL path param inside the quoted legacy filename, risking a malformed header.Location
apps/web/src/app/api/w/[slug]/files/download/route.ts:60;apps/web/src/app/api/u/[slug]/flows/[id]/export/route.ts:60;apps/web/src/app/api/u/[slug]/skills/[name]/export/route.ts:38Impact
Wrong download names for non-ASCII names and a potential malformed-header risk on skills export.
Suggested fix
Standardize on one helper that emits a sanitized ASCII
filename="..."plusfilename*=UTF-8''<encoded>, and use it in all three routes.Source: code investigation.