diff --git a/package.json b/package.json
index c691d5dc..251329d2 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
     "format:eslint": "eslint --fix .",
     "format:prettier": "bun fmt",
     "build:css": "bun x @tailwindcss/cli -i ./src/main.css -o ./public/generated.css",
-    "build:client": "bun build public/script.ts public/results.ts --outdir public/ --target browser --minify",
+    "build:client": "bun build public/script.ts public/results.ts --outdir public/ --target browser --minify --format iife",
     "build:js": "tsc",
     "build:bin": "bun run build:css && bun run build:client && bun build --compile --minify --sourcemap --bytecode --format=esm --define 'process.env.NODE_ENV=\"production\"' src/index.tsx --outfile dist/convertx",
     "build:docker": "docker compose build",
diff --git a/public/script.ts b/public/script.ts
index 2f8bd647..a7e4cd4f 100644
--- a/public/script.ts
+++ b/public/script.ts
@@ -25,10 +25,9 @@ const api = edenFetch<App>(webroot);
 
 // ── Route helpers (typed via @elysiajs/eden inference from App) ────────────────
 
-// NOTE on `body as never`: elysiajs/eden's body type inference is limited for dynamic
-// routes, so we cast to `never` to bypass the type check. The functions return typed
+// NOTE: elysiajs/eden's body type inference is limited for dynamic routes,
+// so we cast to `never` to bypass the type check. The functions return typed
 // values where possible, but request bodies lose Eden's compile-time safety here.
-// See relevant issue on GitHub.
 
 async function postConversions(body: { fileType: string | null }): Promise<string> {
   const res = await api("/conversions", { method: "POST", body: body as never, headers: {} });
@@ -315,15 +314,14 @@ const uploadFile = (file: File): void => {
   };
 
   xhr.onerror = (): void => {
+    pendingFiles -= 1;
+    if (pendingFiles === 0 && formatSelected) {
+      convertButton.disabled = false;
+      convertButton.textContent = "Convert";
+    }
     console.log("Upload failed");
   };
 
-  pendingFiles -= 1;
-  if (pendingFiles === 0 && formatSelected) {
-    convertButton.disabled = false;
-  }
-  convertButton.textContent = "Convert";
-
   xhr.send(formData);
 };
 
diff --git a/tests/eden/app.test.ts b/tests/eden/app.test.ts
index edb2f1bd..2e2b4663 100644
--- a/tests/eden/app.test.ts
+++ b/tests/eden/app.test.ts
@@ -1,12 +1,17 @@
-import { describe, expect, test } from "bun:test";
+import { describe, expect, mock, test } from "bun:test";
 
 import { app } from "../../src/eden";
+import * as realEnvModule from "../../src/helpers/env";
+
+// The root endpoint requires auth by default (redirects to /login → 302).
+// Enable unauthenticated mode so the root page renders without a session.
+mock.module("../../src/helpers/env", () => ({ ...realEnvModule, ALLOW_UNAUTHENTICATED: true }));
 
 describe("eden app composition", () => {
   test("has all route endpoints mounted", async () => {
     // GET / — home page (root)
     const root = await app.handle(new Request("http://localhost/"));
-    expect(root.status).toBeLessThan(500);
+    expect(root.status).toBe(200);
 
     // POST /conversions — chooseConverter (public endpoint, lists converters)
     const conversions = await app.handle(