From 7d79284fd76ead1f866a75fae332ed323c1ad2eb Mon Sep 17 00:00:00 2001
From: Falkan <falkan@openclaw.local>
Date: Wed, 18 Mar 2026 20:30:34 -0400
Subject: [PATCH] feat: start.sh for production server, hooks.server.ts stub,
 svelte.config cleanup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- start.sh: builds and launches Node production server on 192.168.0.94:4078
- Multi-domain CSRF: not needed — SvelteKit natively passes when Origin matches Host
- hooks.server.ts: minimal stub with explanation
- svelte.config.js: reverted csrf experiment (not supported in this version)
---
 src/hooks.server.ts |  4 ++++
 start.sh            | 15 +++++++++++++++
 svelte.config.js    |  2 +-
 3 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 src/hooks.server.ts
 create mode 100755 start.sh

diff --git a/src/hooks.server.ts b/src/hooks.server.ts
new file mode 100644
index 0000000..fd70449
--- /dev/null
+++ b/src/hooks.server.ts
@@ -0,0 +1,4 @@
+// hooks.server.ts intentionally minimal — CSRF is handled natively by SvelteKit
+// when the Origin header matches the request Host. For multi-domain setups,
+// trusted origins are declared in svelte.config.js via kit.csrf.checkOrigin / allowedOrigins.
+export {};
diff --git a/start.sh b/start.sh
new file mode 100755
index 0000000..b5b3965
--- /dev/null
+++ b/start.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# start.sh — build and launch humor-units production server
+set -e
+
+cd "$(dirname "$0")"
+
+echo "Building..."
+npx vite build
+
+echo "Starting server on 192.168.0.94:4078..."
+exec env \
+  PORT=4078 \
+  HOST=192.168.0.94 \
+  ORIGIN=http://192.168.0.94:4078 \
+  node build/index.js
diff --git a/svelte.config.js b/svelte.config.js
index ad116dc..6423e6e 100644
--- a/svelte.config.js
+++ b/svelte.config.js
@@ -3,7 +3,7 @@ import adapter from '@sveltejs/adapter-node';
 /** @type {import('@sveltejs/kit').Config} */
 const config = {
 	kit: {
-		adapter: adapter()
+		adapter: adapter(),
 	},
 	vitePlugin: {
 		dynamicCompileOptions: ({ filename }) =>