Content Security Policy (CSP) for Calcumate3D

If your site sends a CSP header, allow the following. Each domain goes in the directive that matches the resource type; a default-src catch-all also works but per-directive rules are tighter.

Directive	Value	Why
`script-src`	`https://cdn.calcumate.co` `https://www.gstatic.com` `'wasm-unsafe-eval'`	the calculator script; the Draco mesh decoder (JS + WebAssembly) fetched on demand from Google’s CDN for compressed 3D models
`worker-src`	`blob:`	the Draco decoder runs in a worker created from a blob URL
`style-src`	`https://cdn.calcumate.co`	`calcumate.css` is injected as a `<link>` by the script. The calculator writes other styles through the CSSOM (not blocked by CSP). If the console reports a `style-src` violation on your page after embedding, add `'unsafe-inline'` and tell us.
`connect-src`	`https://cdn.calcumate.co` `https://www.gstatic.com` `https://z7o2xijo6h.execute-api.ap-southeast-2.amazonaws.com`	model/thumbnail pre-fetch and the GLB loads; the decoder’s WASM; the Calcumate3D API (served under `/prod/`)
`img-src`	`https://cdn.calcumate.co` `data:`	item thumbnails, your logo, bundled inline images
`font-src`	`data:`	the bundled Inter font is inlined in `calcumate.css` (no external font fetch; with My website font the calculator uses the page’s own font)
`frame-src`	`https://*.calcumate.co`	only when you embed a Calcumate-hosted page in an iframe

Example header:

Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://cdn.calcumate.co https://www.gstatic.com 'wasm-unsafe-eval';
  worker-src 'self' blob:;
  style-src 'self' https://cdn.calcumate.co;
  connect-src 'self' https://cdn.calcumate.co https://www.gstatic.com https://z7o2xijo6h.execute-api.ap-southeast-2.amazonaws.com;
  img-src 'self' data: https://cdn.calcumate.co;
  font-src 'self' data:;

Notes:

The Calcumate (original) list (optimize.calcumate.co, the two S3 buckets, the r354ovsoac… API) is not needed for Calcumate3D unless both calculators run on the same site.
A blocked resource shows up in the console with the directive it violated; that tells you which line is missing.
ERR_BLOCKED_BY_CLIENT errors come from the visitor’s browser extensions, not from CSP.
Browsers without 'wasm-unsafe-eval' support accept 'unsafe-eval' as the broader fallback; prefer the former.