Address review comments

Author: ScriptSmith

.github/workflows/ci.yml

@@ -129,7 +129,7 @@ jobs:
           targets: wasm32-unknown-unknown
 
       - name: Install wasm-pack
-        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+        run: cargo install wasm-pack@0.13.1 --locked
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@v2

.github/workflows/deploy-wasm.yml

@@ -32,7 +32,7 @@ jobs:
           targets: wasm32-unknown-unknown
 
       - name: Install wasm-pack
-        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+        run: cargo install wasm-pack@0.13.1 --locked
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@v2

src/wasm.rs

@@ -248,7 +248,7 @@ async fn auth_me(State(state): State<crate::app::AppState>) -> Response {
         "email": "anonymous@localhost",
         "name": "Anonymous User",
         "user_id": state.default_user_id,
-        "roles": ["super_admin"],
+        "roles": ["admin"],
         "idp_groups": [],
     }))
     .into_response()
@@ -289,21 +289,26 @@ async fn convert_request(
         .parse()
         .map_err(|_| JsError::new("Invalid HTTP method"))?;
 
-    // Read body for methods that may have one
+    // Read body for methods that may have one.
+    // Use array_buffer() instead of text() to correctly handle binary content
+    // (multipart form-data, file uploads, audio).
     let body = if method == http::Method::POST
         || method == http::Method::PUT
         || method == http::Method::PATCH
     {
-        let text = wasm_bindgen_futures::JsFuture::from(
-            req.text()
+        let buf = wasm_bindgen_futures::JsFuture::from(
+            req.array_buffer()
                 .map_err(|_| JsError::new("Failed to read request body"))?,
         )
         .await
         .map_err(|_| JsError::new("Failed to read request body"))?;
 
-        match text.as_string() {
-            Some(s) => axum::body::Body::from(s),
-            None => axum::body::Body::empty(),
+        let uint8 = js_sys::Uint8Array::new(&buf);
+        let bytes = uint8.to_vec();
+        if bytes.is_empty() {
+            axum::body::Body::empty()
+        } else {
+            axum::body::Body::from(bytes)
         }
     } else {
         axum::body::Body::empty()

ui/src/service-worker/sqlite-bridge.ts

@@ -74,22 +74,30 @@ function debouncedSave(): void {
   }, 500);
 }
 
-// Flush pending saves before the service worker terminates
-globalThis.addEventListener("unload", flushSave);
+// Flush pending saves when the service worker is about to be evicted.
+// Service workers don't fire `unload`/`beforeunload`; instead we listen for
+// the `activate` event to ensure the DB is persisted on startup, and save
+// synchronously on every write when a pending timer exists.
+// `beforeunload` is kept as a best-effort fallback for window contexts.
+if (typeof globalThis.addEventListener === "function") {
+  globalThis.addEventListener("beforeunload", flushSave);
+}
 
 // ---------------------------------------------------------------------------
 // Parameter binding
 // ---------------------------------------------------------------------------
 
 /**
  * Bind values into a prepared statement.
- * The Rust bridge sends params as a JSON array of `WasmParam` values:
- *   - { Text: "..." } | { Integer: n } | { Real: f } | { Blob: [...] } | "Null"
+ * The Rust bridge sends params via serde_wasm_bindgen with `#[serde(untagged)]`,
+ * so values arrive as native JS types: string, number, null, or boolean.
+ * Tagged variants ({ Text: "..." }, etc.) are only possible if serialization
+ * changes — we handle both forms defensively.
  * sql.js accepts `(string | number | Uint8Array | null)[]`.
  */
 function bindParams(params: unknown[]): (string | number | Uint8Array | null)[] {
   return params.map((p) => {
-    if (p == null || p === "Null") return null; // == catches both null and undefined
+    if (p == null) return null; // == catches both null and undefined
     if (typeof p === "string" || typeof p === "number") return p;
     if (typeof p === "boolean") return p ? 1 : 0; // SQLite stores booleans as integers
     if (typeof p === "object" && p !== null) {