Host setup and security

Content Security Policy

Permit https://warcraftforever.com in your site’s script-src, style-src, font-src, img-src, and connect-src directives. Merge these sources into your existing policy. The calculator uses inline style attributes for node positioning; your policy must allow those through style-src-attr (or its style-src fallback).

Put setup code in your own permitted JavaScript file, or use your existing nonce/hash policy for inline scripts. The iframe integration also needs Warcraft Forever in frame-src.

Data and persistence

Talent definitions, images, styles, and translations load from the origin that served the library. Each native calculator owns a Shadow DOM child of the mount target. Your application owns build persistence; the library does not send builds to your backend.

Store the build’s class, exported code, and layout revision together. For new integrations, request exportBuild('blizzard'); deprecated compact codes remain supported. The same code can mean something different under another layout revision. Destroy mounted instances when their host component unmounts.

Validate on your server

Validate submitted builds on your backend and enforce your application’s class, level, and access requirements there. Browser editing checks do not replace server validation.

A legal partial allocation is not necessarily complete. A complete level-30 build requires exactly 21 allocated points. Our MCP validator reports valid and complete separately.

Data coverage

Talent data comes from the client builds identified in each definition’s provenance. Tooltip values may be rendered at a different character level from an editor’s point budget. A level cap constrains allocation; it does not simulate character stats or recalculate spell scaling.

Item and recipe cards cover the published professions datasets. Unknown cards are not evidence that an item or spell does not exist in the game.