improve(server): replace Node sidecar with native Rust SDKs (ENG-1700)

.github/workflows/test.yml

@@ -132,12 +132,9 @@ jobs:
       SUI_NETWORK: testnet
       MEMWAL_PACKAGE_ID: "0xcf6ad755a1cdff7217865c796778fabe5aa399cb0cf2eba986f4b582047229c6"
       MEMWAL_REGISTRY_ID: "0xe80f2feec1c139616a86c9f71210152e2a7ca552b20841f2e192f99f75864437"
-      # Dummy token — sidecar (scripts/sidecar-server.ts) refuses to start
-      # without it, and the server panics when the sidecar doesn't come up.
-      # Not a real secret; SEAL encrypt / Walrus upload paths aren't exercised
-      # by the CI-scoped tests, so the sidecar running in degraded mode is
-      # fine for /health + auth-contract checks.
-      SIDECAR_AUTH_TOKEN: ci-test-sidecar-token-not-for-production
+      # ENG-1700: Node.js sidecar removed; SEAL/Walrus/Enoki run in-process
+      # via Mysten Rust SDKs (sui-sdk-types, seal-sdk, walrus_publisher,
+      # walrus_onchain, enoki). No SIDECAR_AUTH_TOKEN required.
 
     steps:
       - name: Checkout
@@ -156,22 +153,6 @@ jobs:
           key: cargo-${{ runner.os }}-${{ hashFiles('services/server/Cargo.lock') }}
           restore-keys: cargo-${{ runner.os }}-
 
-      - name: Setup Node (for TS sidecar auto-spawned by server)
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-
-      - name: Install sidecar deps
-        working-directory: services/server/scripts
-        # Server boot spawns `npx tsx sidecar-server.ts` which imports express
-        # et al — those must be installed up-front or the spawn fails fast.
-        run: |
-          if [ -f package-lock.json ]; then
-            npm ci
-          else
-            npm install
-          fi
-
       - name: Setup Python
         uses: actions/setup-python@v5
         with:

apps/app/src/config.ts

@@ -12,7 +12,6 @@ export const config = {
     suiNetwork: (import.meta.env.VITE_SUI_NETWORK as string || 'testnet') as 'testnet' | 'mainnet',
     sealKeyServers: (import.meta.env.VITE_SEAL_KEY_SERVERS as string || '')
         .split(',').map(s => s.trim()).filter(Boolean) as string[],
-    sidecarUrl: import.meta.env.VITE_SIDECAR_URL as string || 'http://localhost:9000',
     docsUrl: import.meta.env.VITE_DOCS_URL as string || '',
     demoUrls: (import.meta.env.VITE_DEMO_URLS as string || '')
         .split(',').map(s => s.trim()).filter(Boolean)

services/server/.env.example

@@ -29,7 +29,7 @@ MEMWAL_PACKAGE_ID=0x...
 MEMWAL_REGISTRY_ID=0x...
 
 # SEAL key servers (comma-separated object IDs)
-# Required for SEAL encrypt/decrypt in sidecar scripts
+# Required for SEAL encrypt/decrypt
 SEAL_KEY_SERVERS=0x...,0x...
 
 # SEAL threshold — minimum number of key servers that must respond for
@@ -44,9 +44,12 @@ SEAL_DECRYPT_THRESHOLD=2
 # Walrus upload relay (auto-detected from SUI_NETWORK if not set)
 # WALRUS_UPLOAD_RELAY_URL=https://upload-relay.mainnet.walrus.space
 
-# Enoki Sponsored Transactions (sidecar)
+# Enoki Sponsored Transactions
 ENOKI_API_KEY=
 ENOKI_NETWORK=mainnet
+# When ENOKI_API_KEY errors, fall back to direct-sign with SERVER_SUI_PRIVATE_KEYS[0].
+# Default: true (matches legacy behavior). Set to "false" to fail fast instead.
+# ENOKI_FALLBACK_TO_DIRECT_SIGN=true
 
 # Sponsor endpoint rate limiting (per IP + per sender, sliding window)
 SPONSOR_RATE_LIMIT_PER_MINUTE=10