moneyos 0.3.3 → 0.4.0

package/README.md

@@ -1,17 +1,20 @@
 # MoneyOS
 
 MoneyOS is an open source programmable money SDK and CLI for developers and AI
-agents. The repo includes balance, send, swap, runtime-composition, wallet,
-and executor code, with the project currently centered on Arbitrum.
+agents. The root package covers runtime composition, balance/send flows,
+wallet/session management, and executor code. Swap now lives as a separate
+tool package, with the project currently centered on Arbitrum.
 
 The project is still early. Package boundaries and some APIs are still settling,
 but the repo is structured so each major surface can evolve independently.
 
 ## What lives in this repo
 
-- `moneyos`: the root SDK + CLI package
+- `moneyos`: the root SDK + CLI package for runtime, wallet, balance, and send
 - `@moneyos/core`: runtime interfaces, shared types, chain/token registries
-- `@moneyos/tool-swap`: swap execution tool and provider surface
+- `@moneyos/swap`: canonical swap package and Odos provider, published on npm
+
+Current package-boundary rules live in [`docs/architecture.md`](docs/architecture.md).
 
 ## CLI
 
@@ -22,13 +25,13 @@ moneyos init [--key 0x...] [--force] [--chain 42161] [--rpc https://...]
 moneyos auth unlock
 moneyos auth lock
 moneyos auth status
+moneyos auth change-password
 moneyos backup export [--out ./wallet-backup.json] [--force]
 moneyos backup restore <path> [--force]
 moneyos backup status
 moneyos keystore status
 moneyos balance <token> [--address 0x...]
 moneyos send <amount> <token> <to>
-moneyos swap <amount> <tokenIn> <tokenOut>
 ```
 
 For the full command surface and flag details, run `moneyos --help`.
@@ -63,12 +66,50 @@ The runtime seam is intentionally small. `createMoneyOS` can also take injected
 `execute`, `read`, and `assets` implementations, which is how external packages
 plug in.
 
-## Published npm package
+Swap is no longer built into the root SDK or CLI. The canonical implementation
+lives in `@moneyos/swap`, which executes against `moneyos.runtime`.
+
+Install it alongside the root package:
 
-`moneyos` is published on npm. `npm install moneyos` and `npx moneyos` give
-you the latest tagged release, not unreleased commits on `main`. If you want
-work that has not shipped in a tagged release yet, clone the repo and build
-from source.
+```bash
+npm install moneyos @moneyos/swap
+```
+
+Then call it against the root runtime seam:
+
+```ts
+import { createMoneyOS } from "moneyos";
+import { executeSwap, OdosProvider } from "@moneyos/swap";
+
+const moneyos = createMoneyOS({
+  chainId: 42161,
+  privateKey: process.env.MONEYOS_PRIVATE_KEY as `0x${string}`,
+});
+
+const result = await executeSwap(
+  {
+    tokenIn: "USDC",
+    tokenOut: "RYZE",
+    amount: "1",
+    provider: new OdosProvider(),
+    chainId: 42161,
+  },
+  moneyos.runtime,
+);
+
+console.log(result.hash);
+```
+
+## Published npm packages
+
+Published packages:
+
+- `moneyos`
+- `@moneyos/core`
+- `@moneyos/swap`
+
+`moneyos@0.4.0` no longer bundles swap into the root SDK or CLI. If you want
+swap, install `@moneyos/swap` alongside `moneyos`.
 
 ## Current wallet model
 
@@ -78,6 +119,7 @@ What is landed in code today:
 - `~/.moneyos/config.json` now stores only non-secret settings such as chain and RPC configuration
 - `MONEYOS_PRIVATE_KEY` remains an explicit override for ephemeral CI or agent runs
 - `moneyos auth unlock` opens a short-lived local session for write commands
+- `moneyos auth change-password` rotates the local wallet password and locks the current session
 - `moneyos backup export|restore|status` manages encrypted wallet backups
 - Normal wallet commands resolve their write path through one shared session-aware flow
 - Local EOA signers use viem's nonce manager, so back-to-back live transactions
@@ -119,6 +161,19 @@ If you have a legacy `~/.moneyos/config.json` with a plaintext `privateKey`
 field from a pre-encrypted-wallet version of the CLI, `moneyos init` with no
 flags will detect and import that key automatically.
 
+## Changing the wallet password
+
+Use:
+
+```bash
+moneyos auth change-password
+```
+
+This re-encrypts the active local wallet file with a new password and locks the
+current local session. Existing backup files and previously exported backups
+remain snapshots encrypted with the old password. If you want a backup under
+the new password, run `moneyos backup export` after the password change.
+
 ## Threat model
 
 What this wallet model is meant to protect against:
@@ -137,7 +192,7 @@ What it does not protect against:
 
 ## Known operational limitations
 
-- If a session-backed `send` or `swap` returns a timeout or disconnect error,
+- If a session-backed write command returns a timeout or disconnect error,
   do not assume nothing was broadcast. Verify on-chain before retrying.
 - PR #12 fixed the common 750ms false-timeout path, but client-disconnect
   detection and request idempotency are still follow-up work.
@@ -184,7 +239,7 @@ What still needs more hands-on validation:
 
 - live session-backed ETH send
 - live session-backed ERC-20 send
-- live session-backed swap
+- live execution of external tools against the session-backed runtime seam
 - more live usage of the encrypted-wallet/auth/backup flow in a real terminal
 
 ## Development
@@ -192,16 +247,18 @@ What still needs more hands-on validation:
 ```bash
 npm install
 npm run build:core
-npm run build:tool-swap
+npm run build:swap
 npm run typecheck
 npm test
 npm run lint
 npm run build
 ```
 
-The repo currently uses npm workspaces. Before any npm release, verify the
-packed tarballs with `npm pack --dry-run` and confirm publish-time dependency
-resolution for the extracted workspace packages.
+The repo currently uses npm workspaces. Test runs build `@moneyos/core` and
+`@moneyos/swap` first so the swap tests exercise the real workspace
+package boundary instead of source-relative imports. Before any npm release,
+verify the packed tarballs with `npm pack --dry-run` and confirm publish-time
+dependency resolution for the extracted workspace packages.
 
 ## License