@yosh I have some loose notes laying around for contributing to the conversation, but if wasm is to be a first-class language, we need a wasm-src directive in CSP. There are some audit standards that require CSP and they would definitely forbid wasm-unsafe-eval. (And in order for wasm-src to fully work, we need an alternative to the instantiateStreaming(fetch()) idiom.)