Production checklist

The generated config is strict on purpose. In development it fills gaps for you: a random server key, localhost origins. In production it refuses to start rather than run unsafely. Here's the checklist it enforces, one error at a time.

Your task#

1. Open server/.env and uncomment NODE_ENV=production. The server stops: SERVER_PRIVATE_KEY is required in production, in the Server panel. Without a stable key, your server would have a new identity on every restart, and every client's proofs would stop matching it.
2. Click Generate a key in the preview and add it: SERVER_PRIVATE_KEY=<the key>. Next error: CLIENT_ORIGIN is required in production.
3. Add CLIENT_ORIGIN=https://notes.example.com (any HTTPS origin will do here). Try http:// first if you like: production refuses anything but HTTPS. When it starts, the server logs running in production.

Open server/src/bsv/config.ts to see every rule. It's generated code: read it, change it if you must.