fix: initialize hosted Studio behind HTTPS reverse proxies

README.md

@@ -149,3 +149,18 @@ browser storage; export before clearing browser data or moving to another origin
 The complete check includes mocked provider contract/error/lock tests and a
 compiled-server deployment check. A real APIMart completion requires your key
 and model access; it is not claimed by the mocked tests.
+
+### HTTPS proxy origin
+
+The app defaults STUDIO_PUBLIC_ORIGIN to https://component.wrnexusjs.dev. If you
+host this app under another domain, set STUDIO_PUBLIC_ORIGIN to that HTTPS origin
+in .env. The Studio route normalizes internal HTTP requests to this explicitly
+configured origin before validating browser Origin headers. It does not derive
+an allowed origin from untrusted forwarded headers. Local loopback development
+remains supported. Requests from other origins still return 403.
+
+The deployment check reproduces a browser module request carrying an HTTPS
+Origin while the proxy forwards it over HTTP, including missing/combined scheme
+headers. This prevents an apparently loaded editor with empty dropdowns when its
+module script is rejected before initialization. The browser also reports asset
+load failures instead of leaving the editor permanently at Checking.