feat(daemon): prepare daemon for publication

.env.sidecar.example → .env.daemon.example

@@ -7,13 +7,13 @@ TEST_WALLET_PRIVATE_KEY=your-test-wallet-private-key
 # Receives demo decryption rights; the demo only revokes what it granted.
 # DELEGATE_ADDRESS=0xAddressThatReceivesDemoDecryptionRights
 
-# application-memory (default), sidecar-memory, or persistent
+# application-memory (default), daemon-memory, or persistent
 CREDENTIAL_STORAGE=application-memory
-# Persistent storage requires SIDECAR_STORAGE_DIR and a private volume in the sidecar.
+# Persistent storage requires ZAMA_SDK_DAEMON_STORAGE_DIR and a private volume in the daemon.
 # CREDENTIAL_STORE_NAME=partner
 
 # Leave SDK options absent to retain SDK defaults. The first context fixes process runtime.
-# Restart the sidecar before changing a process-runtime setting.
+# Restart the daemon before changing a process-runtime setting.
 # SDK_SINGLE_THREAD=true
 # SDK_BATCH_RPC_CALLS=true
 # SDK_RPC_TIMEOUT_MS=10000

.github/workflows/sidecar.yml → .github/workflows/daemon.yml

@@ -1,26 +1,30 @@
-name: Sidecar CI
+name: Daemon CI
 
 on:
   pull_request:
     paths:
       - "clients/**"
       - "proto/**"
-      - "scripts/sidecar/**"
+      - "scripts/daemon/**"
       - "packages/sdk/**"
-      - "packages/sdk-sidecar/**"
+      - "packages/sdk-daemon/**"
       - "buf*.yaml"
       - "vitest.config.ts"
       - "vitest.shared.mts"
       - "rust-toolchain.toml"
       - "package.json"
       - "pnpm-lock.yaml"
       - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig*.json"
+      - "api-extractor*.json"
+      - "tools/**"
       - ".github/actions/install-deps/**"
-      - ".github/workflows/sidecar.yml"
+      - ".github/workflows/daemon.yml"
   workflow_dispatch:
 
 concurrency:
-  group: sidecar-ci-${{ github.ref }}
+  group: daemon-ci-${{ github.ref }}
   cancel-in-progress: true
 
 permissions:
@@ -83,9 +87,11 @@ jobs:
         run: cargo test --manifest-path clients/rust/Cargo.toml --all-features --all-targets --locked
       - name: Lint
         run: cargo clippy --manifest-path clients/rust/Cargo.toml --all-features --all-targets --locked -- -D warnings
+      - name: Validate crate for publication
+        run: cargo publish --dry-run --locked --all-features -p zama-sdk --manifest-path clients/rust/Cargo.toml
       - name: Regenerate protobuf bindings
         run: |
-          cargo run --manifest-path clients/rust/Cargo.toml -p zama-sdk-sidecar-codegen --locked
+          cargo run --manifest-path clients/rust/Cargo.toml -p zama-sdk-codegen --locked
           git diff --exit-code -- clients/rust
 
   equivalence:
@@ -94,16 +100,6 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/install-deps
-      - name: Fetch pull request base
-        if: github.event_name == 'pull_request'
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: git fetch --no-tags --depth=1 origin "$BASE_SHA"
-      - name: Check protobuf compatibility
-        if: github.event_name == 'pull_request'
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: pnpm exec node scripts/sidecar/check-proto-compatibility.mjs "$BASE_SHA"
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: clients/go/go.mod
@@ -113,13 +109,13 @@ jobs:
       - name: Regenerate TypeScript and Go protobuf bindings
         run: |
           pnpm exec buf format --diff --exit-code
-          pnpm sidecar:generate
+          pnpm daemon:generate
           sh clients/go/generate.sh
-          git diff --exit-code -- packages/sdk-sidecar/src/generated clients/go/internal/gen
-      - name: Build SDK and sidecar
-        run: pnpm sidecar:build
+          git diff --exit-code -- packages/sdk-daemon/src/generated clients/go/internal/gen
+      - name: Build SDK and daemon
+        run: pnpm daemon:build
       - name: Verify built package exports
-        run: node --test packages/sdk-sidecar/test/package-exports.test.mjs
+        run: node --test packages/sdk-daemon/test/package-exports.test.mjs
       - name: Prepare native test drivers
         run: |
           cargo test --manifest-path clients/rust/Cargo.toml --test external_storage_restart --locked --no-run
@@ -128,5 +124,19 @@ jobs:
           go test -run '^$' ./...
       - name: Verify SDK equivalence and native credential recovery
         env:
-          SIDECAR_NATIVE_TESTS: "1"
-        run: pnpm sidecar:test
+          ZAMA_SDK_DAEMON_NATIVE_TESTS: "1"
+        run: pnpm daemon:test
+
+  image:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: packages/sdk-daemon/Dockerfile
+          platforms: linux/amd64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/proto-compatibility.yml

@@ -0,0 +1,39 @@
+name: Protobuf Compatibility
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - "proto/**"
+      - "buf*.yaml"
+      - "scripts/daemon/**"
+      - ".github/workflows/proto-compatibility.yml"
+      - "package.json"
+      - "pnpm-lock.yaml"
+
+concurrency:
+  group: proto-compatibility-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  SAFE_CHAIN_MINIMUM_PACKAGE_AGE_HOURS: "72"
+  SAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONS: "@fhevm/sdk,@zama-fhe/sdk,@zama-fhe/react-sdk"
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: ./.github/actions/install-deps
+      - name: Fetch pull request base
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: git fetch --no-tags --depth=1 origin "$BASE_SHA"
+      - name: Check protobuf compatibility
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: pnpm exec node scripts/daemon/check-proto-compatibility.mjs "$BASE_SHA"

.gitignore

@@ -26,7 +26,7 @@ npm-debug.log*
 # env files
 .env*
 !.env.example
-!/.env.sidecar.example
+!/.env.daemon.example
 
 # typescript
 *.tsbuildinfo
@@ -62,6 +62,6 @@ contracts/.forge-deploy-lock/
 # turborepo
 .turbo
 
-# Rust and Go sidecar build tooling
+# Native client build output
 clients/rust/target/
 clients/go/.tools/

.oxfmtrc.json

@@ -8,7 +8,7 @@
   "objectWrap": "collapse",
   "sortPackageJson": true,
   "ignorePatterns": [
-    "packages/sdk-sidecar/src/generated/**",
+    "packages/sdk-daemon/src/generated/**",
     "dist",
     "node_modules",
     "pnpm-lock.yaml",

.oxlintrc.json

@@ -36,7 +36,7 @@
     }
   },
   "ignorePatterns": [
-    "packages/sdk-sidecar/src/generated/**",
+    "packages/sdk-daemon/src/generated/**",
     "**/dist/**",
     "**/node_modules/**",
     "**/next-env.d.ts",

.releaserc.cjs

@@ -102,7 +102,9 @@ module.exports = {
           "CHANGELOG.md",
           "packages/sdk/package.json",
           "packages/react-sdk/package.json",
-          "packages/sdk-sidecar/package.json",
+          "packages/sdk-daemon/package.json",
+          "clients/rust/Cargo.toml",
+          "clients/rust/Cargo.lock",
         ],
         message: "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}",
       },

buf.gen.yaml

@@ -1,7 +1,7 @@
 version: v2
 plugins:
   - local: protoc-gen-ts_proto
-    out: packages/sdk-sidecar/src/generated
+    out: packages/sdk-daemon/src/generated
     opt:
       - oneof=unions
       - env=node

buf.yaml

@@ -6,11 +6,11 @@ lint:
     - STANDARD
   ignore_only:
     RPC_REQUEST_STANDARD_NAME:
-      - proto/zama/sdk/v1alpha1/sidecar.proto
+      - proto/zama/sdk/v1beta1/daemon.proto
     RPC_RESPONSE_STANDARD_NAME:
-      - proto/zama/sdk/v1alpha1/sidecar.proto
+      - proto/zama/sdk/v1beta1/daemon.proto
     RPC_REQUEST_RESPONSE_UNIQUE:
-      - proto/zama/sdk/v1alpha1/sidecar.proto
+      - proto/zama/sdk/v1beta1/daemon.proto
 breaking:
   use:
     - FILE

clients/go/Dockerfile

@@ -15,4 +15,4 @@ ARG RUNTIME_GID=1000
 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=build /balance /usr/local/bin/balance
 USER ${RUNTIME_UID}:${RUNTIME_GID}
-ENTRYPOINT ["balance", "/run/zama/sdk.sock", "/config/.env.sidecar.local"]
+ENTRYPOINT ["balance", "/run/zama/sdk.sock", "/config/.env.daemon.local"]

clients/go/LICENSE

@@ -0,0 +1,32 @@
+BSD 3-Clause Clear License
+
+Copyright © 2026 Zama
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted (subject to the limitations in the disclaimer
+below) provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from this
+   software without specific prior written permission.
+
+NO EXPRESS OR IMPLIED LICENSES TO ANY PARTY'S PATENT RIGHTS ARE GRANTED BY
+THIS LICENSE. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.

clients/go/channel.go

@@ -1,4 +1,4 @@
-package sidecar
+package zama
 
 import (
 	"context"

clients/go/channel_test.go

@@ -1,4 +1,4 @@
-package sidecar
+package zama
 
 import (
 	"context"
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	pb "github.com/zama-ai/sdk/clients/go/internal/gen/zama/sdk/v1alpha1"
+	pb "github.com/zama-ai/sdk/clients/go/v3/internal/gen/zama/sdk/v1beta1"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"

clients/go/client.go

@@ -1,19 +1,19 @@
-package sidecar
+package zama
 
 import (
 	"context"
 	"errors"
 	"path/filepath"
 
-	pb "github.com/zama-ai/sdk/clients/go/internal/gen/zama/sdk/v1alpha1"
+	pb "github.com/zama-ai/sdk/clients/go/v3/internal/gen/zama/sdk/v1beta1"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/metadata"
 )
 
 type Client struct {
 	conn *grpc.ClientConn
-	rpc  pb.SidecarServiceClient
+	rpc  pb.DaemonServiceClient
 }
 
 type DialOptions struct{ MaxMessageBytes int }
@@ -34,7 +34,7 @@ func DialWithOptions(socket string, options DialOptions) (*Client, error) {
 	if err != nil {
 		return nil, err
 	}
-	return &Client{conn: conn, rpc: pb.NewSidecarServiceClient(conn)}, nil
+	return &Client{conn: conn, rpc: pb.NewDaemonServiceClient(conn)}, nil
 }
 func (c *Client) Close() error { return c.conn.Close() }
 

clients/go/client_test.go

@@ -1,4 +1,4 @@
-package sidecar
+package zama
 
 import (
 	"bytes"
@@ -14,14 +14,14 @@ import (
 	"time"
 
 	"github.com/ethereum/go-ethereum/common"
-	pb "github.com/zama-ai/sdk/clients/go/internal/gen/zama/sdk/v1alpha1"
+	pb "github.com/zama-ai/sdk/clients/go/v3/internal/gen/zama/sdk/v1beta1"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
 )
 
-func testClient(t *testing.T, service pb.SidecarServiceServer, interceptor grpc.UnaryServerInterceptor) *Client {
+func testClient(t *testing.T, service pb.DaemonServiceServer, interceptor grpc.UnaryServerInterceptor) *Client {
 	t.Helper()
 	// Short paths stay within macOS Unix-domain socket limits.
 	dir, err := os.MkdirTemp("/tmp", "sdk-go-")
@@ -39,7 +39,7 @@ func testClient(t *testing.T, service pb.SidecarServiceServer, interceptor grpc.
 		options = append(options, grpc.UnaryInterceptor(interceptor))
 	}
 	server := grpc.NewServer(options...)
-	pb.RegisterSidecarServiceServer(server, service)
+	pb.RegisterDaemonServiceServer(server, service)
 	go server.Serve(listener)
 	t.Cleanup(server.Stop)
 	client, err := Dial(socket)
@@ -101,7 +101,7 @@ func TestSDKContextParametersAndOptionalDefaults(t *testing.T) {
 	typedData := `{ "primaryType": "Permit", "message": {"value":"12"} }`
 	var sequence atomic.Uint64
 	requests := make(chan any, 32)
-	client := testClient(t, &pb.UnimplementedSidecarServiceServer{}, func(_ context.Context, request any, info *grpc.UnaryServerInfo, _ grpc.UnaryHandler) (any, error) {
+	client := testClient(t, &pb.UnimplementedDaemonServiceServer{}, func(_ context.Context, request any, info *grpc.UnaryServerInfo, _ grpc.UnaryHandler) (any, error) {
 		if strings.HasSuffix(info.FullMethod, "/CreateContext") {
 			requests <- request
 			return &pb.CreateContextResponse{ContextId: fmt.Sprint(sequence.Add(1))}, nil
@@ -230,7 +230,7 @@ func TestSDKContextParametersAndOptionalDefaults(t *testing.T) {
 }
 func number(n uint32) *uint32 { return &n }
 func TestRPCErrorTrailers(t *testing.T) {
-	client := testClient(t, &pb.UnimplementedSidecarServiceServer{}, func(ctx context.Context, _ any, _ *grpc.UnaryServerInfo, _ grpc.UnaryHandler) (any, error) {
+	client := testClient(t, &pb.UnimplementedDaemonServiceServer{}, func(ctx context.Context, _ any, _ *grpc.UnaryServerInfo, _ grpc.UnaryHandler) (any, error) {
 		grpc.SetTrailer(ctx, metadata.Pairs("zama-error-code", "RPC_RATE_LIMITED", "zama-error-retryable", "true", "zama-error-retry-after-seconds", "2"))
 		return nil, status.Error(codes.ResourceExhausted, "slow down")
 	})
@@ -242,7 +242,7 @@ func TestRPCErrorTrailers(t *testing.T) {
 }
 
 func TestSDKNumberRemainsDistinctFromBigIntAcrossWire(t *testing.T) {
-	client := testClient(t, &pb.UnimplementedSidecarServiceServer{}, func(_ context.Context, request any, _ *grpc.UnaryServerInfo, _ grpc.UnaryHandler) (any, error) {
+	client := testClient(t, &pb.UnimplementedDaemonServiceServer{}, func(_ context.Context, request any, _ *grpc.UnaryServerInfo, _ grpc.UnaryHandler) (any, error) {
 		if _, ok := request.(*pb.CreateContextRequest); ok {
 			return &pb.CreateContextResponse{ContextId: "number-context"}, nil
 		}

clients/go/config.go

@@ -1,10 +1,10 @@
-package sidecar
+package zama
 
 import (
 	"fmt"
 
 	"github.com/ethereum/go-ethereum/common"
-	pb "github.com/zama-ai/sdk/clients/go/internal/gen/zama/sdk/v1alpha1"
+	pb "github.com/zama-ai/sdk/clients/go/v3/internal/gen/zama/sdk/v1beta1"
 )
 
 type RelayerAuth interface{ wire() *pb.ChainAuth }