Serve editable world web files and mount the complete host API (T88)

host/src/api/app.js

@@ -2,7 +2,7 @@
 const bytes = text => Uint8Array.from(atob(text.replace(/-/g, '+').replace(/_/g, '/')), c => c.charCodeAt(0));
 const encoded = buffer => btoa(String.fromCharCode(...new Uint8Array(buffer))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 const post = async (path, body) => {
-  const response = await fetch(path, {method: 'POST', headers: {'content-type': 'application/json'}, body: JSON.stringify(body)});
+  const response = await fetch(new URL(path.replace(/^\//, ""), import.meta.url), {method: 'POST', headers: {'content-type': 'application/json'}, body: JSON.stringify(body)});
   const result = await response.json();
   if (!response.ok) throw new Error(result.message);
   return result;
@@ -56,7 +56,7 @@ form.addEventListener('submit', async event => {
       await post(`${path}/decide`, challenge.unlocked ? {decision, overrides} : await assertion(challenge));
     } else if (document.body.dataset.page === 'register') {
       const label = data.get('label');
-      const state = await (await fetch('/cred/passkeys')).json();
+      const state = await (await fetch(new URL('cred/passkeys', import.meta.url))).json();
       let gate;
       if (state.length) {
         const proof = await assertion(await post('/cred/passkeys/register/challenge', {label}));