SendToKobo web USB installer corresponding source -- GPL-3.0-or-later

The original project code is licensed under GPL-3.0-or-later. See LICENSE
and SOURCE_LICENSE.txt. The separately supplied fflate 0.8.3 browser module
retains its MIT license. All dependency notices are retained.

This archive supplies the editable HTML, CSS and JavaScript actually served
by the tested installer, without minification or a hidden build step. It also
contains the fixed package materials needed to reconstruct those HTTP routes.
materials/ contains program/dependency binaries and their supplied notices,
NOT user books, device settings, pairing identities or private signing keys.

Rebuild with Node.js >=22:
  1. Extract this archive to a NEW computer directory, never to a Kobo drive.
  2. Run: node rebuild-installer.mjs
  3. The new rebuilt-static-* directory contains the exact website program
     and package files. Downloadable source ZIPs are distribution companions,
     not recursively embedded inside their own source archive.
     The script reads back every written file; exactReviewedBytes is true
     when all source files still match this reviewed edition.
  4. Editable source changes are supported. The script reports false for
     exactReviewedBytes rather than pretending modified code was reviewed.
     Pinned program materials are separate from editable installer code;
     modifying receiver payloads requires rebuilding its manifests/pins too.

No npm install, network access, user directory selection or installation runs
during reconstruction. This source archive is not an installer executable.
The separate receiver-source-kit.zip supplies corresponding receiver sources,
the offline Go toolchain/dependencies/rebuild recipe and FBInk source archives.
Keep that archive available alongside this installer; do not copy it to Kobo.
NickelMenu remains an unmodified, separately licensed MIT component.

Deployment review (NOT performed by this archive):
- The page's absolute URLs require a dedicated origin root, not an arbitrary
  subdirectory. The public HTTPS origin, security headers, download/source
  links and caching must be configured and verified by central operations.
- Desktop Chrome/Edge directory-picker permission is still user-controlled.
- The public-style edition replaces only local-test display labels and adds
  a source/license section. Its editable source already contains those exact
  changes; the rebuild script does not apply a hidden transformation.
  Internal package/diagnostic releaseReady=false is not a site deployment
  status and remains unchanged. Deployment still needs explicit approval.
- Do not serve the source working directory or any files beyond the checked
  static inventory. Do not add filesystem read/write HTTP APIs.
- The original installer preserves existing NickelMenu and books, and offers
  only the reviewed file operations after the user's confirmation.

The signing private key and backup tools are not distributed. Rebuilding or
USB-installing a user-modified receiver does not require the official key;
only official wireless updates must pass the device's configured trust check.
