# The two CSP values, for any server that is not Caddy (nginx file below uses the first). Keep identical to caddy/cfp-headers.caddy;
# build-dist.mjs fails if the import-map hash here goes stale.

models from the official hosts:
default-src 'none'; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-Cx7K6UEX75Ikji925IXGITkvUzcvvkRkesEaY4BnCDg='; worker-src 'self' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; media-src 'self' blob:; connect-src 'self' blob: data: https://huggingface.co https://*.huggingface.co https://*.hf.co https://raw.githubusercontent.com https://media.techofourown.com; manifest-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests

models self-hosted under /mirror/:
default-src 'none'; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-Cx7K6UEX75Ikji925IXGITkvUzcvvkRkesEaY4BnCDg='; worker-src 'self' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; media-src 'self' blob:; connect-src 'self' blob: data:; manifest-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
