WebAssembly is blocked by Content Security Policy in Custom Components

I am developing a Thinkwise Custom Component that uses the @thatopen/components package to load IFC files.

The package uses web-ifc, which requires WebAssembly to load and process IFC files.

The web-ifc.wasm file is successfully requested, but the browser blocks the WebAssembly module from being compiled/instantiated because of the Content Security Policy applied to the Thinkwise application.

The following errors occur:

wasm streaming compile failed: CompileError: WebAssembly.instantiateStreaming(): Compiling or instantiating WebAssembly module violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "default-src 'self'".

The package then falls back to ArrayBuffer instantiation:

falling back to ArrayBuffer instantiation

However, this is also blocked:

WebAssembly.instantiate(): Compiling or instantiating WebAssembly module violates the following Content Security Policy directive.

As a result, the IFC file cannot be loaded.

The custom component cannot override or relax the Content Security Policy from JavaScript.

To allow WebAssembly based packages in Custom Components, the Content Security Policy should allow WebAssembly evaluation, preferably using:

script-src 'self' 'wasm-unsafe-eval'

instead of requiring the broader:

'unsafe-eval'

Could anyone confirm whether Thinkwise Custom Components support WebAssembly and, if so, how the Content Security Policy should be configured to allow WebAssembly modules such as web-ifc.wasm?