Content security policy - script-src: unsafe-eval

Using the npm package in a web project with unsafe-eval disabled at CSP level errors with:

```
Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval'
is not an allowed source of script in the following
Content Security Policy directive: "script-src 'self' cdn.xxxxx.com".
at new Function ()
at tearOffGetter (internalAdmin.js:97912)
at tearOff (internalAdmin.js:97914)
at installTearOff (internalAdmin.js:97926)
at installInstanceTearOff (internalAdmin.js:97928)
at internalAdmin.js:97936
at installTearOffs (internalAdmin.js:107733)
at dartProgram (internalAdmin.js:107792)
at Object. (internalAdmin.js:108537)
at Object../node_modules/gltf-validator/gltf_validator.dart.js (internalAdmin.js:108538)
```
The dart compiler comes with a flag disabling dynamic code generation with the specific purpose of satisfying CSP restrictions:

https://dart.dev/tools/dart2js#:~:text=generated%20from%20packages.-,%2D%2Dcsp,-Disables%20dynamic%20generation

Could this flag be added to the build process that publishes the npm package?

Start by locating the npm package build process that produces internalAdmin.js and gltf_validator.dart.js, then review the dart2js documentation for the --csp flag. Verify the generated package under a policy that disallows unsafe-eval; done means it loads without the reported EvalError and existing validation behavior remains intact.

Written by the indexing model from the issue text.