feat: migrate SDK to @mysten-incubation + OIDC Trusted Publishing

.changeset/README.md

@@ -1,6 +1,6 @@
 # Changesets
 
-This project uses [Changesets](https://github.com/changesets/changesets) to manage versioning and changelogs for `@mysten/memwal`.
+This project uses [Changesets](https://github.com/changesets/changesets) to manage versioning and changelogs for `@mysten-incubation/memwal`.
 
 ## How to add a changeset
 
@@ -11,7 +11,7 @@ pnpm changeset
 ```
 
 This will prompt you to:
-1. Select which packages have changed (`@mysten/memwal`)
+1. Select which packages have changed (`@mysten-incubation/memwal`)
 2. Choose the semver bump type (major / minor / patch)
 3. Write a summary of the change
 

.github/workflows/release-sdk.yml

@@ -32,15 +32,18 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
           cache: pnpm
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Upgrade npm for OIDC Trusted Publishing
+        run: npm install -g npm@latest
+
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --no-frozen-lockfile
 
       - name: Typecheck
-        run: pnpm --filter @mysten/memwal typecheck
+        run: pnpm --filter @mysten-incubation/memwal typecheck
 
       - name: Build SDK
         run: pnpm build:sdk
@@ -50,18 +53,16 @@ jobs:
         if: github.ref == 'refs/heads/main'
         run: |
           BASE_VERSION=$(node -p "require('./packages/sdk/package.json').version")
-          npm view @mysten/memwal@$BASE_VERSION version 2>/dev/null \
+          npm view @mysten-incubation/memwal@$BASE_VERSION version 2>/dev/null \
             && echo "Version $BASE_VERSION already published, skipping" && exit 0
-          cd packages/sdk && npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          cd packages/sdk && npm publish --provenance --access public
 
       # ── staging branch → release candidate (rc tag, auto-increment) ──
       - name: Publish staging release candidate
         if: github.ref == 'refs/heads/staging'
         run: |
           BASE_VERSION=$(node -p "require('./packages/sdk/package.json').version")
-          LATEST=$(npm view @mysten/memwal versions --json 2>/dev/null \
+          LATEST=$(npm view @mysten-incubation/memwal versions --json 2>/dev/null \
             | node -p "
                 const versions = JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
                 const nums = (Array.isArray(versions) ? versions : [versions])
@@ -72,19 +73,17 @@ jobs:
               " || echo "-1")
           NEXT=$((LATEST + 1))
           NEW_VERSION="${BASE_VERSION}-rc.${NEXT}"
-          echo "Publishing @mysten/memwal@${NEW_VERSION}"
+          echo "Publishing @mysten-incubation/memwal@${NEW_VERSION}"
           cd packages/sdk
           node -e "const p=require('./package.json');p.version='${NEW_VERSION}';require('fs').writeFileSync('./package.json',JSON.stringify(p,null,4)+'\n')"
-          npm publish --tag rc --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          npm publish --tag rc --provenance --access public
 
       # ── dev branch → prerelease (dev tag, auto-increment) ──
       - name: Publish dev prerelease
         if: github.ref == 'refs/heads/dev'
         run: |
           BASE_VERSION=$(node -p "require('./packages/sdk/package.json').version")
-          LATEST=$(npm view @mysten/memwal versions --json 2>/dev/null \
+          LATEST=$(npm view @mysten-incubation/memwal versions --json 2>/dev/null \
             | node -p "
                 const versions = JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
                 const nums = (Array.isArray(versions) ? versions : [versions])
@@ -95,9 +94,7 @@ jobs:
               " || echo "-1")
           NEXT=$((LATEST + 1))
           NEW_VERSION="${BASE_VERSION}-dev.${NEXT}"
-          echo "Publishing @mysten/memwal@${NEW_VERSION}"
+          echo "Publishing @mysten-incubation/memwal@${NEW_VERSION}"
           cd packages/sdk
           node -e "const p=require('./package.json');p.version='${NEW_VERSION}';require('fs').writeFileSync('./package.json',JSON.stringify(p,null,4)+'\n')"
-          npm publish --tag dev --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          npm publish --tag dev --provenance --access public

README.md

@@ -8,7 +8,7 @@ retrieving them with semantic search.
 ## Install
 
 ```bash
-pnpm add @mysten/memwal
+pnpm add @mysten-incubation/memwal
 ```
 
 Peer dependencies (install as needed):
@@ -20,7 +20,7 @@ pnpm add @mysten/sui @mysten/seal @mysten/walrus ai zod
 ## Quick Start
 
 ```ts
-import { MemWal } from "@mysten/memwal";
+import { MemWal } from "@mysten-incubation/memwal";
 
 const memwal = MemWal.create({
   key: "your-delegate-key-hex",
@@ -77,9 +77,9 @@ For broader local setup guidance, see:
 
 | Entry | Description |
 |---|---|
-| `@mysten/memwal` | Default client (`MemWal`). The relayer handles embedding, encryption, Walrus upload/download, retrieval, and restore. |
-| `@mysten/memwal/manual` | Manual client flow (`MemWalManual`). You handle embedding calls and local SEAL operations. The relayer still handles upload relay, registration, search, and restore. |
-| `@mysten/memwal/ai` | Vercel AI SDK integration - wraps `MemWal` as middleware for use with `streamText`, `generateText`, etc. |
+| `@mysten-incubation/memwal` | Default client (`MemWal`). The relayer handles embedding, encryption, Walrus upload/download, retrieval, and restore. |
+| `@mysten-incubation/memwal/manual` | Manual client flow (`MemWalManual`). You handle embedding calls and local SEAL operations. The relayer still handles upload relay, registration, search, and restore. |
+| `@mysten-incubation/memwal/ai` | Vercel AI SDK integration - wraps `MemWal` as middleware for use with `streamText`, `generateText`, etc. |
 
 ## How It Works
 

apps/app/Dockerfile

@@ -20,9 +20,9 @@ COPY apps/app/package.json      ./apps/app/
 # Install all workspace deps
 RUN pnpm install
 
-# Build SDK first (apps/app depends on @mysten/memwal via workspace:*)
+# Build SDK first (apps/app depends on @mysten-incubation/memwal via workspace:*)
 COPY packages/sdk/ ./packages/sdk/
-RUN pnpm --filter @mysten/memwal build
+RUN pnpm --filter @mysten-incubation/memwal build
 
 # Copy app source
 COPY apps/app/ ./apps/app/

apps/app/package.json

@@ -12,7 +12,7 @@
   "dependencies": {
     "@mysten/dapp-kit": "^1.0.3",
     "@mysten/enoki": "^1.0.4",
-    "@mysten/memwal": "workspace:*",
+    "@mysten-incubation/memwal": "workspace:*",
     "@mysten/seal": "^1.1.0",
     "@mysten/sui": "^2.6.0",
     "@mysten/walrus": "^1.0.3",

apps/app/src/pages/Dashboard.tsx

@@ -10,8 +10,8 @@ import {
     useSuiClient,
 } from '@mysten/dapp-kit'
 import { useSponsoredTransaction } from '../hooks/useSponsoredTransaction'
-import { generateDelegateKey, addDelegateKey, removeDelegateKey } from '@mysten/memwal/account'
-import type { WalletSigner } from '@mysten/memwal/manual'
+import { generateDelegateKey, addDelegateKey, removeDelegateKey } from '@mysten-incubation/memwal/account'
+import type { WalletSigner } from '@mysten-incubation/memwal/manual'
 import { Link } from 'react-router-dom'
 import { Copy, Eye, EyeOff, Trash2, RefreshCw, Plus, LogOut } from 'lucide-react'
 import { Light as SyntaxHighlighter } from 'react-syntax-highlighter'
@@ -208,7 +208,7 @@ export default function Dashboard() {
     // SDK code snippets
     // ============================================================
 
-    const sdkSnippet = `import { MemWal } from "@mysten/memwal"
+    const sdkSnippet = `import { MemWal } from "@mysten-incubation/memwal"
 
 const memwal = MemWal.create({
   key: "${delegateKey?.slice(0, 8)}...${delegateKey?.slice(-8)}",
@@ -224,7 +224,7 @@ const result = await memwal.recall("food allergies")
 console.log(result.results[0].text)`
 
     const aiSnippet = `import { generateText } from "ai"
-import { withMemWal } from "@mysten/memwal/ai"
+import { withMemWal } from "@mysten-incubation/memwal/ai"
 import { openai } from "@ai-sdk/openai"
 
 const model = withMemWal(openai("gpt-4o"), {
@@ -606,10 +606,10 @@ const result = await generateText({
                         ))}
                     </div>
                     <SyntaxHighlighter language="bash" style={githubGist} className="demo-code-block install-command" customStyle={{ margin: 0, borderTopLeftRadius: 0, borderTopRightRadius: 0 }}>
-                        {pkgManager === 'npm' ? 'npm install @mysten/memwal' :
-                         pkgManager === 'pnpm' ? 'pnpm add @mysten/memwal' :
-                         pkgManager === 'yarn' ? 'yarn add @mysten/memwal' :
-                         'bun add @mysten/memwal'}
+                        {pkgManager === 'npm' ? 'npm install @mysten-incubation/memwal' :
+                         pkgManager === 'pnpm' ? 'pnpm add @mysten-incubation/memwal' :
+                         pkgManager === 'yarn' ? 'yarn add @mysten-incubation/memwal' :
+                         'bun add @mysten-incubation/memwal'}
                     </SyntaxHighlighter>
                 </div>
             </div>

apps/app/src/pages/Playground.tsx

@@ -20,8 +20,8 @@ import {
     useSuiClient,
 } from '@mysten/dapp-kit'
 import { useSponsoredTransaction } from '../hooks/useSponsoredTransaction'
-import { MemWal } from '@mysten/memwal'
-import { MemWalManual } from '@mysten/memwal/manual'
+import { MemWal } from '@mysten-incubation/memwal'
+import { MemWalManual } from '@mysten-incubation/memwal/manual'
 import { useDelegateKey } from '../App'
 import { config } from '../config'
 import memwalLogo from '../assets/memwal-logo.svg'
@@ -459,7 +459,7 @@ export default function Playground() {
                     <p>
                         try each memwal SDK operation live. click{' '}
                         <strong>▶ run</strong> to execute against your server
-                        using <code>@mysten/memwal</code>.
+                        using <code>@mysten-incubation/memwal</code>.
                         {config.docsUrl && (
                             <> See the <a href={config.docsUrl} target="_blank" rel="noopener noreferrer" style={{ color: '#000', fontWeight: 600 }}>documentation</a> for full API reference.</>
                         )}
@@ -475,7 +475,7 @@ export default function Playground() {
                         key: <span className="demo-tag-value demo-tag-value--key">{keyPreview}</span>
                     </div>
                     <div className="demo-server-tag">
-                        SDK: <span className="demo-tag-value demo-tag-value--sdk">@mysten/memwal</span>
+                        SDK: <span className="demo-tag-value demo-tag-value--sdk">@mysten-incubation/memwal</span>
                     </div>
                     <div className="demo-server-tag" style={{ padding: 0, display: 'flex', alignItems: 'center' }}>
                         <span style={{ padding: '8px 0 8px 16px', whiteSpace: 'nowrap' }}>namespace:</span>
@@ -494,7 +494,7 @@ export default function Playground() {
                     number={1}
                     title="health check"
                     description="verify the memwal server is running"
-                    code={`import { MemWal } from "@mysten/memwal"
+                    code={`import { MemWal } from "@mysten-incubation/memwal"
 
 const memwal = MemWal.create({
   key: "${keyPreview}",
@@ -705,7 +705,7 @@ const result = await memwal.restore("${namespace || 'default'}")
 
                     <div className={askResult || askError || askPhase ? 'demo-code-block--spaced' : ''}>
                         <SyntaxHighlighter language="javascript" style={githubGist} className="demo-code-block" customStyle={{ margin: 0 }}>
-{`import { withMemWal } from "@mysten/memwal/ai"
+{`import { withMemWal } from "@mysten-incubation/memwal/ai"
 import { openai } from "@ai-sdk/openai"
 import { generateText } from "ai"
 
@@ -837,7 +837,7 @@ const { text } = await generateText({
 
                     <div className={fullRememberResult || fullRememberError || fullRememberPhase ? 'demo-code-block--spaced' : ''}>
                         <SyntaxHighlighter language="javascript" style={githubGist} className="demo-code-block" customStyle={{ margin: 0 }}>
-{`import { MemWalManual } from "@mysten/memwal/manual"
+{`import { MemWalManual } from "@mysten-incubation/memwal/manual"
 
 const memwal = MemWalManual.create({
   key: delegateKeyHex,

apps/chatbot/Dockerfile

@@ -20,14 +20,14 @@ COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
 COPY packages/sdk/package.json ./packages/sdk/
 COPY apps/chatbot/package.json ./apps/chatbot/
 
-# Install all workspace deps (resolves workspace:* for @mysten/memwal)
+# Install all workspace deps (resolves workspace:* for @mysten-incubation/memwal)
 RUN pnpm install --frozen-lockfile
 
 # ── Stage 2: Build SDK ─────────────────────────────────────
 FROM deps AS sdk-builder
 
 COPY packages/sdk/ ./packages/sdk/
-RUN pnpm --filter @mysten/memwal build
+RUN pnpm --filter @mysten-incubation/memwal build
 
 # ── Stage 3: Build Next.js App ─────────────────────────────
 FROM sdk-builder AS builder

apps/chatbot/lib/ai/providers.ts

@@ -4,7 +4,7 @@ import {
   extractReasoningMiddleware,
   wrapLanguageModel,
 } from "ai";
-import { withMemWal } from "@mysten/memwal/ai";
+import { withMemWal } from "@mysten-incubation/memwal/ai";
 import { isTestEnvironment } from "../constants";
 
 const THINKING_SUFFIX_REGEX = /-thinking$/;

apps/chatbot/package.json

@@ -22,7 +22,7 @@
     "@ai-sdk/openai": "^3.0.41",
     "@ai-sdk/provider": "^3.0.3",
     "@ai-sdk/react": "3.0.39",
-    "@mysten/memwal": "workspace:*",
+    "@mysten-incubation/memwal": "workspace:*",
     "@codemirror/lang-javascript": "^6.2.2",
     "@codemirror/lang-python": "^6.1.6",
     "@codemirror/state": "^6.5.0",

apps/noter/Dockerfile

@@ -20,12 +20,12 @@ COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
 COPY packages/sdk/package.json ./packages/sdk/
 COPY apps/noter/package.json   ./apps/noter/
 
-# Install all workspace deps (resolves workspace:* for @mysten/memwal)
+# Install all workspace deps (resolves workspace:* for @mysten-incubation/memwal)
 RUN pnpm install --frozen-lockfile
 
-# Build SDK first (@mysten/memwal is the package name — matches sdk/package.json)
+# Build SDK first (@mysten-incubation/memwal is the package name — matches sdk/package.json)
 COPY packages/sdk/ ./packages/sdk/
-RUN pnpm --filter @mysten/memwal build
+RUN pnpm --filter @mysten-incubation/memwal build
 
 # ── Stage 2: Build Next.js App ─────────────────────────────
 FROM deps AS builder

apps/noter/app/api/chat/route.ts

@@ -1,6 +1,6 @@
 import { streamText, convertToModelMessages, stepCountIs } from "ai";
 import { createOpenAI } from "@ai-sdk/openai";
-import { withMemWal } from "@mysten/memwal/ai";
+import { withMemWal } from "@mysten-incubation/memwal/ai";
 import { DEFAULT_MODEL } from "@/shared/lib/ai/constant";
 import { createTools } from "@/shared/lib/ai/tools";
 import { db } from "@/shared/lib/db";

apps/noter/next.config.ts

@@ -11,7 +11,7 @@ const nextConfig: NextConfig = {
     ],
   },
   serverExternalPackages: [
-    "@mysten/memwal",
+    "@mysten-incubation/memwal",
     "@mysten/seal",
     "@mysten/walrus",
     "@mysten/sui",

apps/noter/package.json

@@ -18,7 +18,7 @@
     "@ai-sdk/openai": "^3.0.41",
     "@ai-sdk/react": "3.0.39",
     "@base-ui/react": "^1.2.0",
-    "@mysten/memwal": "workspace:*",
+    "@mysten-incubation/memwal": "workspace:*",
     "@hookform/resolvers": "^5.2.2",
     "@lexical/code": "^0.41.0",
     "@lexical/link": "^0.41.0",

apps/noter/package/feature/note/lib/pdw-client.ts

@@ -6,7 +6,7 @@
  * Key can be set from env var OR at runtime via setMemWalKey().
  */
 
-import { MemWal } from "@mysten/memwal";
+import { MemWal } from "@mysten-incubation/memwal";
 
 let _memwal: MemWal | null = null;
 let _runtimeKey: string | null = null;

apps/researcher/Dockerfile

@@ -12,7 +12,7 @@ WORKDIR /app
 
 COPY apps/researcher/package.json ./
 
-# Install deps — @mysten/memwal is now on npm, no local SDK needed
+# Install deps — @mysten-incubation/memwal is now on npm, no local SDK needed
 RUN bun install
 
 # ── Stage 2: Build ─────────────────────────────────────────

apps/researcher/lib/sprint/memwal.ts

@@ -1,7 +1,7 @@
 import "server-only";
 
-import { MemWal } from "@mysten/memwal";
-import type { RememberResult } from "@mysten/memwal";
+import { MemWal } from "@mysten-incubation/memwal";
+import type { RememberResult } from "@mysten-incubation/memwal";
 import type { Citation, SourceMeta } from "./types";
 
 function getMemWalClient(key: string, accountId?: string) {

apps/researcher/package.json

@@ -24,7 +24,7 @@
         "@ai-sdk/openai": "^3.0.41",
         "@ai-sdk/provider": "^3.0.3",
         "@ai-sdk/react": "3.0.39",
-        "@mysten/memwal": "0.0.1-dev.0",
+        "@mysten-incubation/memwal": "^0.0.1-dev.0",
         "@codemirror/lang-javascript": "^6.2.2",
         "@codemirror/lang-python": "^6.1.6",
         "@codemirror/state": "^6.5.0",

docs/contract/delegate-key-management.md

@@ -17,7 +17,7 @@ Delegate keys are lightweight Ed25519 keys used for SDK authentication. They are
 Use the SDK's `generateDelegateKey()` helper to create a new Ed25519 keypair:
 
 ```ts
-import { generateDelegateKey } from "@mysten/memwal/account";
+import { generateDelegateKey } from "@mysten-incubation/memwal/account";
 
 const delegate = await generateDelegateKey();
 // delegate.privateKey — hex string, store securely
@@ -30,7 +30,7 @@ const delegate = await generateDelegateKey();
 Only the account owner can add delegate keys:
 
 ```ts
-import { addDelegateKey } from "@mysten/memwal/account";
+import { addDelegateKey } from "@mysten-incubation/memwal/account";
 
 await addDelegateKey({
   packageId: "0x...",
@@ -44,7 +44,7 @@ await addDelegateKey({
 ### 3. Use the private key in the SDK
 
 ```ts
-import { MemWal } from "@mysten/memwal";
+import { MemWal } from "@mysten-incubation/memwal";
 
 const memwal = MemWal.create({
   key: delegate.privateKey,
@@ -57,7 +57,7 @@ const memwal = MemWal.create({
 Removing a delegate key prevents future relayer access from that key:
 
 ```ts
-import { removeDelegateKey } from "@mysten/memwal/account";
+import { removeDelegateKey } from "@mysten-incubation/memwal/account";
 
 await removeDelegateKey({
   packageId: "0x...",