Refactor(server): move the Go server to ZenNotes/znserver

.gitattributes

@@ -2,5 +2,3 @@
 # TUI consumers, so they must check out with LF on every platform, including
 # Windows runners whose Git defaults to CRLF conversion.
 packages/bridge-contract/fixtures/** text eol=lf
-apps/server/internal/vault/testdata/** text eol=lf
-apps/server/internal/httpserver/testdata/** text eol=lf

.github/workflows/boundary-artifact-release.yml

@@ -28,9 +28,6 @@ jobs:
         with:
           node-version: 22
           cache: npm
-      - uses: actions/setup-go@v6
-        with:
-          go-version: stable
       - run: npm ci
       - run: npm run typecheck
       - run: npm run test:run

.github/workflows/ci.yml

@@ -14,21 +14,6 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  server:
-    name: Go server without frontend dependencies
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/server
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: stable
-          cache-dependency-path: apps/server/go.sum
-      - run: go vet ./...
-      - run: go test ./...
-
   production-dependency-audit:
     name: Production dependency audit
     runs-on: ubuntu-latest
@@ -67,14 +52,6 @@ jobs:
           node-version: 22
           cache: npm
 
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          # Keep macOS on the current linker; older Go toolchains produced
-          # binaries without the LC_UUID load command required by dyld.
-          go-version: stable
-          cache-dependency-path: apps/server/go.sum
-
       - name: Install dependencies
         run: npm ci
 
@@ -111,13 +88,8 @@ jobs:
           path: ${{ runner.temp }}/app-core-browser-evidence
           if-no-files-found: ignore
 
-      - name: Verify contract fixture copies
-        run: npm run check:contract-fixtures
-
       - name: Verify browser asset build lock
         run: npm run test:web-dist-lock
 
       - name: Typecheck and build app
-        env:
-          GOCACHE: ${{ runner.temp }}/go-build-cache
         run: npm run build:prod

.github/workflows/nix-build.yml

@@ -1,8 +1,9 @@
 name: Nix build
 
-# Builds AND validates the flake packages on a Nix runner whenever the Nix
-# packaging changes, so the prebuilt-desktop wrapper and the server package are
-# verified in CI (the maintainers don't have a Nix machine to test on locally).
+# Builds AND validates the flake package on a Nix runner whenever the Nix
+# packaging changes, so the prebuilt-desktop wrapper is verified in CI (the
+# maintainers don't have a Nix machine to test on locally). The server's Nix
+# build lives in ZenNotes/znserver.
 
 on:
   push:
@@ -32,7 +33,6 @@ jobs:
       - name: Build packages
         run: |
           nix build --fallback --print-build-logs .#zennotes-desktop -o result-desktop
-          nix build --fallback --print-build-logs .#zennotes-server  -o result-server
 
       - name: Validate desktop package
         run: |

.github/workflows/nix-update.yml

@@ -41,7 +41,6 @@ jobs:
         run: |
           set -euo pipefail
           DATA=packaging/nix/release-data.json
-          FAKE="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
 
           # 1) Source hash — the fetchFromGitHub tree for tag v$V.
           SRC_HASH=$(nix run --fallback nixpkgs#nix-prefetch-github -- ZenNotes zennotes --rev "v$V" | jq -r '.hash // .sha256')
@@ -59,33 +58,15 @@ jobs:
             "https://github.com/ZenNotes/zennotes/releases/download/v$V/ZenNotes-$V-linux-x64.tar.gz" | jq -r '.hash')
           echo "desktopHash = $DESKTOP_HASH"
 
-          # Write version + source + npm + desktop now; leave vendorHash fake so the
-          # Go build surfaces the real one.
-          jq --arg v "$V" --arg h "$SRC_HASH" --arg n "$NPM_HASH" --arg d "$DESKTOP_HASH" --arg f "$FAKE" \
-            '.version=$v | .hash=$h | .npmDepsHash=$n | .desktopHash=$d | .vendorHash=$f' "$DATA" > "$DATA.tmp"
-          mv "$DATA.tmp" "$DATA"
-
-          # 3) vendorHash — build the server; the Go vendor fixed-output derivation
-          #    reports the real hash as a mismatch against the fake one.
-          set +e
-          nix build --fallback .#zennotes-server --no-link 2> build.log
-          set -e
-          VENDOR_HASH=$(grep -oE 'got:[[:space:]]+sha256-[A-Za-z0-9+/=]+' build.log \
-            | grep -oE 'sha256-[A-Za-z0-9+/=]+' | head -1 || true)
-          if [ -z "$VENDOR_HASH" ]; then
-            echo "::error::Could not extract vendorHash from the build output."
-            cat build.log
-            exit 1
-          fi
-          echo "vendorHash = $VENDOR_HASH"
-          jq --arg vh "$VENDOR_HASH" '.vendorHash=$vh' "$DATA" > "$DATA.tmp"
+          jq --arg v "$V" --arg h "$SRC_HASH" --arg n "$NPM_HASH" --arg d "$DESKTOP_HASH" \
+            '.version=$v | .hash=$h | .npmDepsHash=$n | .desktopHash=$d' "$DATA" > "$DATA.tmp"
           mv "$DATA.tmp" "$DATA"
 
           echo "=== updated release-data.json ==="
           cat "$DATA"
 
       - name: Verify the packages build with the new hashes
-        run: nix build --fallback .#zennotes-desktop .#zennotes-server --no-link --print-build-logs
+        run: nix build --fallback .#zennotes-desktop --no-link --print-build-logs
 
       - name: Open a PR with the update
         uses: peter-evans/create-pull-request@v6
@@ -100,6 +81,5 @@ jobs:
             - `version`
             - `hash` (source) — `nix-prefetch-github`
             - `npmDepsHash` — `prefetch-npm-deps`
-            - `vendorHash` — Go fixed-output build
 
-            Verified with `nix build .#zennotes-desktop .#zennotes-server`.
+            Verified with `nix build .#zennotes-desktop`.

.github/workflows/web-artifact.yml

@@ -5,7 +5,6 @@ on:
   pull_request:
     paths:
       - 'apps/web/**'
-      - 'apps/server/**'
       - 'packages/**'
       - 'tooling/scripts/**'
       - 'package*.json'
@@ -27,41 +26,9 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run test:web-artifact
-      - run: npm run check:contract-fixtures
       - run: npm run artifact:web
       - uses: actions/upload-artifact@v4
         with:
           name: self-hosted-web-candidate
           path: dist/web-artifacts/*
           if-no-files-found: error
-
-  server:
-    needs: browser
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          sparse-checkout: apps/server
-      - uses: actions/setup-go@v6
-        with:
-          go-version: stable
-          cache-dependency-path: apps/server/go.sum
-      - uses: actions/download-artifact@v4
-        with:
-          name: self-hosted-web-candidate
-          path: ${{ runner.temp }}/web-artifact
-      - name: Test and build using the pinned archive with Go alone
-        shell: bash
-        working-directory: apps/server
-        run: |
-          go vet ./...
-          go test ./...
-          manifests=("$RUNNER_TEMP"/web-artifact/*.tgz.json)
-          test "${#manifests[@]}" -eq 1
-          go run ./cmd/prepare-web -manifest "${manifests[0]}" -output web/dist
-          go test -tags=embed_web ./web
-          go build -tags=embed_web -trimpath -o bin/zennotes-server ./cmd/zennotes-server

.gitignore

@@ -8,8 +8,8 @@ apps/web/dist
 # The bare `dist` above does not cover these suffixed names.
 dist.stage-*
 dist.retired-*
-apps/server/web/.web-dist.lock
-apps/server/bin
+apps/web/.web-dist.lock
+dist/server-binaries
 .DS_Store
 *.log
 .env

CONTRIBUTING.md

@@ -23,11 +23,11 @@ npm run dev
 
 Useful scripts:
 
-- `npm run dev` — run the desktop app with hot reload (`dev:web`, `dev:server`, and `dev:web-stack` cover the web client and Go server)
+- `npm run dev` — run the desktop app with hot reload (`dev:web`, `dev:server`, and `dev:web-stack` cover the web client and the pinned Go server release)
 - `npm run typecheck` — TypeScript across every workspace
 - `npm run test:run` — the full test suite, non-interactive (`npm test` is the watch variant)
-- `npm run build` — production build of the web client, desktop app, and Go server
-- `cd apps/server && go test ./...` — the Go server's own tests
+- `npm run build` — production build of the web client and desktop app
+- The Go server and its tests live in [ZenNotes/znserver](https://github.com/ZenNotes/znserver)
 
 There is no lint step; match the style of the surrounding code (Prettier is available
 if a file you touched is already formatted with it).