fix: allow embedded worker API requests

server/src/WebDrop.Frontend/EmbeddedFrontend.cs

@@ -87,7 +87,9 @@ public static class EmbeddedFrontend
             ? "public, max-age=31536000, immutable"
             : "no-store";
 
-        if (path.Equals("index.html", StringComparison.Ordinal))
+        // Dedicated workers enforce the CSP returned with their own script response.
+        // Give bundled JS the same app policy so the crypto worker can call the same-origin API.
+        if (path.Equals("index.html", StringComparison.Ordinal) || path.EndsWith(".js", StringComparison.OrdinalIgnoreCase))
             context.Response.Headers["Content-Security-Policy"] = contentSecurityPolicy;
 
         if (!HttpMethods.IsHead(context.Request.Method))

web/src/core-bridge/worker/http.ts

@@ -1,7 +1,7 @@
 import { supportsApiContract } from '../contract';
 
 export type ApiError = Error & { status?: number; code?: string };
-let apiBase = '/api/v1';
+let apiBase = new URL('/api/v1', self.location.origin).toString();
 let contractCheck: Promise<void> | undefined;
 
 export function setApiBase(value: string): void {
@@ -11,7 +11,10 @@ export function setApiBase(value: string): void {
 }
 
 export const fail = (status: number, code: string): ApiError => Object.assign(new Error(code), { status, code });
-export const apiPath = (path: string): string => `${apiBase.replace(/\/$/, '')}${path}`;
+export const apiPath = (path: string): string => new URL(
+  `${apiBase.replace(/\/$/, '')}${path}`,
+  self.location.origin,
+).toString();
 
 function ensureApiContract(): Promise<void> {
   contractCheck ??= fetch(apiPath('/info'), {