URL.createObjectURL(blob) mints a blob:... URL that points at the in-memory data and can be assigned to any URL-accepting attribute. Programmatic .click() on a hidden <a> with the download attribute is the only cross-browser way to trigger a save dialog from JS. Inserting the anchor into the DOM is required in some browsers (Firefox in particular); pulling it back out keeps the page tree clean. Calling URL.revokeObjectURL immediately after the click frees the underlying blob reference so the GC can reclaim memory.

Wrapping the blob helper with a JSON serialiser gives you a one-line export for state.toJSON() or any structured payload. Defaulting to pretty-print with two-space indent is friendlier for users who open the file in a text editor; flip the flag for machine-to-machine downloads to save bytes. Setting the MIME type to application/json makes some browsers (and OSes) preview the file correctly. Add a BOM (\uFEFF prefix) only if Excel users are downloading and need correct UTF-8 detection.

Some older Chromium and embedded webview combinations cancel the download if the object URL is revoked synchronously after click(), because the actual disk-write is queued on the renderer's IO thread. Wrapping the cleanup in a zero-delay setTimeout lets the navigation settle before the URL is freed. Adding rel = 'noopener' is defence-in-depth for the rare case where the link does navigate (it should not, with download, but a misconfigured CSP or extension can interfere). For production, ship the deferred-revoke version.