OptionaloriginAllowed origin(s). '*' or omitted reflects whatever Origin the
request carries (permissive — fine for dev and same-trust deployments).
An explicit string or array restricts to those origins; a non-matching
origin gets no CORS headers (and the browser blocks the request).
Cross-origin policy for the HTTP routes (
/blobs,/collab/*,/healthz,/metrics). The viewer is typically served from a different origin than the collab-server, so a browserfetch()/PUTto the blob route needsAccess-Control-Allow-*headers and anOPTIONSpreflight response — without them the WebSocket doc syncs but geometry blobs are blocked, so recipients see an empty model.