@johpaz/hive-sdk 0.1.4 → 0.1.5

package/packages/core/src/storage/crypto.ts

@@ -1,41 +1,105 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto"
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import * as path from "node:path"
+import { getHiveDir } from "../config/loader.ts"
 import { logger } from "../utils/logger"
+import { col } from "./hive"
 
 const log = logger.child("crypto")
 const SERVICE = "hive"
 
-// ─── Keychain with in-memory fallback ────────────────────────────────────────
-// On Linux headless (no GNOME Keyring / libsecret) Bun.secrets throws.
-// Fall back to in-memory storage so the server stays functional, but log a
-// warning so operators know secrets won't survive a restart in that mode.
+interface SecretDoc {
+  ciphertext: string
+  iv: string
+}
+
+// ─── Durable secret store ────────────────────────────────────────────────────
+// The `secrets` collection is the source of truth: AES-256-GCM ciphertext in
+// the database, keyed by <HIVE_HOME>/.master.key. It lives inside the data
+// directory, so whatever persists the database (a Docker volume, a backup)
+// persists the secrets with it.
+//
+// The OS keychain (Bun.secrets) is only a best-effort mirror. It throws on
+// headless Linux/Docker (no libsecret/D-Bus), and on desktops it can be a
+// session keyring that is discarded when the session ends — so a secret
+// written *only* there does not survive a server restart. That is exactly
+// what was wiping every provider API key, channel token and MCP header on
+// restart in production.
 
 const _mem = new Map<string, string>()
 let _keychainOk: boolean | null = null // null = untested
 
 async function _get(name: string): Promise<string | null> {
-  if (_keychainOk === false) return _mem.get(name) ?? null
+  const cached = _mem.get(name)
+  if (cached !== undefined) return cached
+
+  // Durable store first — it is the one every write goes to.
+  const stored = await _readCollectionSecret(name)
+  if (stored) return stored
+
+  // Legacy/desktop installs may only have the value in the OS keychain.
+  const fromKeychain = await _keychainGet(name)
+  if (fromKeychain) _mem.set(name, fromKeychain)
+  return fromKeychain
+}
+
+/**
+ * Persist a secret. Always writes the durable store; the keychain is
+ * mirrored on top when available. Returns false only when the value ended up
+ * nowhere but this process's memory — callers can use that to warn instead of
+ * silently accepting a secret that dies with the process.
+ */
+async function _set(name: string, value: string): Promise<boolean> {
+  _mem.set(name, value)
+  const durable = await persistSecretToCollection(name, value)
+  const mirrored = await _keychainSet(name, value)
+  if (!durable && !mirrored) {
+    log.error(`[secrets] ${name} could not be persisted — it will be lost on restart`)
+  }
+  return durable || mirrored
+}
+
+/**
+ * Read a secret from the `secrets` HiveDB collection — the durable store.
+ * Decrypted values are cached in memory for the rest of the process.
+ */
+async function _readCollectionSecret(name: string): Promise<string | null> {
+  try {
+    const secrets = await col<SecretDoc>("secrets")
+    const entry = await secrets.get(name)
+    if (!entry) return null
+    const plain = decryptSecret(entry.doc.ciphertext, entry.doc.iv)
+    if (plain) {
+      // Cache in memory for subsequent lookups in this process
+      _mem.set(name, plain)
+    }
+    return plain || null
+  } catch {
+    return null
+  }
+}
+
+async function _keychainGet(name: string): Promise<string | null> {
+  if (_keychainOk === false) return null
   try {
     const val = await (Bun as any).secrets.get({ service: SERVICE, name })
     _keychainOk = true
     return val ?? null
   } catch {
     _keychainOk = false
-    return _mem.get(name) ?? null
+    return null
   }
 }
 
-async function _set(name: string, value: string): Promise<void> {
-  if (_keychainOk === false) {
-    log.warn(`[secrets] OS keychain unavailable — in-memory fallback (secret lost on restart): ${name}`)
-    _mem.set(name, value)
-    return
-  }
+async function _keychainSet(name: string, value: string): Promise<boolean> {
+  if (_keychainOk === false) return false
   try {
     await (Bun as any).secrets.set({ service: SERVICE, name, value })
     _keychainOk = true
+    return true
   } catch {
     _keychainOk = false
-    log.warn(`[secrets] OS keychain unavailable — in-memory fallback (secret lost on restart): ${name}`)
-    _mem.set(name, value)
+    return false
   }
 }
 
@@ -46,6 +110,28 @@ async function _del(name: string): Promise<void> {
   } catch {
     // ignore — might not exist or keychain unavailable
   }
+  try {
+    const secrets = await col<SecretDoc>("secrets")
+    await secrets.delete(name)
+  } catch {
+    // ignore — might not exist
+  }
+}
+
+/**
+ * Mint the master key (if this is a fresh install) and report where secrets
+ * will be stored. Called once at boot so an operator sees the answer before
+ * typing an API key, not after a restart lost it.
+ */
+export function ensureSecretsBackend(): { durable: boolean } {
+  const durable = getMasterKey() !== null
+  if (!durable) {
+    log.error(
+      `[secrets] No master key available — API keys and channel tokens will NOT survive a restart. ` +
+      `Set HIVE_MASTER_KEY or make ${getHiveDir()} writable.`
+    )
+  }
+  return { durable }
 }
 
 // ─── Primitive API ────────────────────────────────────────────────────────────
@@ -64,16 +150,22 @@ export async function deleteSecret(name: string): Promise<void> {
 
 // ─── Provider secrets ────────────────────────────────────────────────────────
 
-export async function storeProviderApiKey(id: string, apiKey: string): Promise<void> {
-  await _set(`provider:${id}:api_key`, apiKey)
+/**
+ * Returns true if the secret was persisted to a durable store (OS keychain
+ * or the `secrets` collection fallback). Returns false if it ended up in the
+ * per-process in-memory map only — useful so callers can avoid destructive
+ * actions that would lose data on restart.
+ */
+export async function storeProviderApiKey(id: string, apiKey: string): Promise<boolean> {
+  return await _set(`provider:${id}:api_key`, apiKey)
 }
 
 export async function loadProviderApiKey(id: string): Promise<string> {
   return (await _get(`provider:${id}:api_key`)) ?? ""
 }
 
-export async function storeProviderHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
-  await _set(`provider:${id}:headers`, JSON.stringify(headers))
+export async function storeProviderHeaders(id: string, headers: Record<string, unknown>): Promise<boolean> {
+  return await _set(`provider:${id}:headers`, JSON.stringify(headers))
 }
 
 export async function loadProviderHeaders(id: string): Promise<Record<string, unknown>> {
@@ -90,8 +182,8 @@ export async function deleteProviderSecrets(id: string): Promise<void> {
 
 // ─── Channel secrets ─────────────────────────────────────────────────────────
 
-export async function storeChannelConfig(id: string, config: Record<string, unknown>): Promise<void> {
-  await _set(`channel:${id}:config`, JSON.stringify(config))
+export async function storeChannelConfig(id: string, config: Record<string, unknown>): Promise<boolean> {
+  return await _set(`channel:${id}:config`, JSON.stringify(config))
 }
 
 export async function loadChannelConfig(id: string): Promise<Record<string, unknown>> {
@@ -105,8 +197,8 @@ export async function deleteChannelSecrets(id: string): Promise<void> {
 
 // ─── MCP secrets ──────────────────────────────────────────────────────────────
 
-export async function storeMcpHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
-  await _set(`mcp:${id}:headers`, JSON.stringify(headers))
+export async function storeMcpHeaders(id: string, headers: Record<string, unknown>): Promise<boolean> {
+  return await _set(`mcp:${id}:headers`, JSON.stringify(headers))
 }
 
 export async function loadMcpHeaders(id: string): Promise<Record<string, unknown>> {
@@ -114,8 +206,8 @@ export async function loadMcpHeaders(id: string): Promise<Record<string, unknown
   return raw ? JSON.parse(raw) : {}
 }
 
-export async function storeMcpEnv(id: string, env: Record<string, string>): Promise<void> {
-  await _set(`mcp:${id}:env`, JSON.stringify(env))
+export async function storeMcpEnv(id: string, env: Record<string, string>): Promise<boolean> {
+  return await _set(`mcp:${id}:env`, JSON.stringify(env))
 }
 
 export async function loadMcpEnv(id: string): Promise<Record<string, string>> {
@@ -132,8 +224,8 @@ export async function deleteMcpSecrets(id: string): Promise<void> {
 
 // ─── Agent secrets ────────────────────────────────────────────────────────────
 
-export async function storeAgentHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
-  await _set(`agent:${id}:headers`, JSON.stringify(headers))
+export async function storeAgentHeaders(id: string, headers: Record<string, unknown>): Promise<boolean> {
+  return await _set(`agent:${id}:headers`, JSON.stringify(headers))
 }
 
 export async function loadAgentHeaders(id: string): Promise<Record<string, unknown>> {
@@ -164,31 +256,15 @@ export function verifyPassword(password: string, hash: string): boolean {
   return hasher.digest("hex") === hash
 }
 
-// ─── Legacy AES-256-GCM decryption ──────────────────────────────────────────
-// Used only by the one-shot migration in storage/migrate.ts.
-// Safe to remove after all installs have run the migration once.
-
-export function legacyDecryptAES(encrypted: string, iv: string): string {
-  const nodeCrypto = require("node:crypto")
-  const nodeFs = require("node:fs")
-  const nodePath = require("node:path")
-  const nodeOs = require("node:os")
-
-  let key: Buffer
-  const masterKey = process.env.HIVE_MASTER_KEY
-  if (masterKey) {
-    key = Buffer.from(masterKey.slice(0, 32).padEnd(32, "0"), "utf8")
-  } else {
-    const hiveDir = process.env.HIVE_HOME || nodePath.join(nodeOs.homedir(), ".hive")
-    const keyPath = nodePath.join(hiveDir, ".master.key")
-    if (!nodeFs.existsSync(keyPath)) return ""
-    key = Buffer.from(nodeFs.readFileSync(keyPath, "utf-8").trim(), "hex")
-  }
+// ─── AES-256-GCM for the collection-backed secret fallback ──────────────────
 
+export function decryptSecret(encrypted: string, iv: string): string {
+  const key = getMasterKey()
+  if (!key) return ""
   try {
     const ivBuf = Buffer.from(iv, "hex")
     const [encData, authTag] = encrypted.split(":")
-    const decipher = nodeCrypto.createDecipheriv("aes-256-gcm", key, ivBuf)
+    const decipher = createDecipheriv("aes-256-gcm", key, ivBuf)
     decipher.setAuthTag(Buffer.from(authTag, "hex"))
     return decipher.update(encData, "hex", "utf8") + decipher.final("utf8")
   } catch {
@@ -196,38 +272,93 @@ export function legacyDecryptAES(encrypted: string, iv: string): string {
   }
 }
 
-// ─── SDK compatibility functions ─────────────────────────────────────────────
-
-export interface EncryptedData {
-  encrypted: string;
-  iv: string;
-}
-
-export function encrypt(text: string): EncryptedData {
-  const iv = Buffer.from(crypto.getRandomValues(new Uint8Array(16))).toString("hex").slice(0, 16);
-  const key = crypto.getRandomValues(new Uint8Array(32));
-  const encoder = new TextEncoder();
-  const data = encoder.encode(text);
-  // Simplified AES-GCM using Web Crypto
-  return { encrypted: text, iv };
-}
+let _masterKey: Buffer | null = null
+
+/**
+ * The AES key protecting the `secrets` collection.
+ *
+ * `HIVE_MASTER_KEY` wins when set (the recommended way to run in production:
+ * the key never touches the data volume). Otherwise the key is minted on
+ * first use and written 0600 to `<HIVE_HOME>/.master.key`, next to the
+ * database — a fresh install becomes durable without the user configuring
+ * anything, and restoring the data directory restores the ability to read
+ * the secrets inside it.
+ */
+function getMasterKey(): Buffer | null {
+  if (_masterKey) return _masterKey
+
+  const fromEnv = process.env.HIVE_MASTER_KEY
+  if (fromEnv) {
+    _masterKey = Buffer.from(fromEnv.slice(0, 32).padEnd(32, "0"), "utf8")
+    return _masterKey
+  }
 
-export function decrypt(data: EncryptedData): string {
-  return data.encrypted;
+  const keyPath = path.join(getHiveDir(), ".master.key")
+  try {
+    if (!existsSync(keyPath)) {
+      mkdirSync(path.dirname(keyPath), { recursive: true })
+      try {
+        // "wx" so two processes starting at once can't overwrite each other's key
+        writeFileSync(keyPath, randomBytes(32).toString("hex"), { mode: 0o600, flag: "wx" })
+        log.info(`[secrets] Master key generated at ${keyPath}`)
+      } catch (err) {
+        if ((err as NodeJS.ErrnoException).code !== "EEXIST") throw err
+      }
+    }
+    const key = Buffer.from(readFileSync(keyPath, "utf8").trim(), "hex")
+    if (key.length !== 32) {
+      log.error(`[secrets] ${keyPath} is not a 32-byte hex key — secrets cannot be read or written`)
+      return null
+    }
+    _masterKey = key
+    return _masterKey
+  } catch (err) {
+    log.error(`[secrets] Could not read or create ${keyPath}: ${(err as Error).message}`)
+    return null
+  }
 }
 
-export function encryptApiKey(apiKey: string): { encrypted: string; iv: string } {
-  return encrypt(apiKey);
+/**
+ * Encrypt a plaintext string with AES-256-GCM. Format:
+ * `<encDataHex>:<authTagHex>`. Used for every document in the `secrets`
+ * collection.
+ */
+export function encryptSecret(plain: string, ivHex: string): string {
+  const key = getMasterKey()
+  if (!key) return ""
+  try {
+    const iv = Buffer.from(ivHex, "hex")
+    const cipher = createCipheriv("aes-256-gcm", key, iv)
+    const encData = cipher.update(plain, "utf8", "hex") + cipher.final("hex")
+    const authTag = cipher.getAuthTag().toString("hex")
+    return `${encData}:${authTag}`
+  } catch {
+    return ""
+  }
 }
 
-export function decryptApiKey(encrypted: string, iv: string): string {
-  return decrypt({ encrypted, iv });
-}
+/**
+ * Persist a secret to the `secrets` collection — the durable store — keyed by
+ * the canonical secret name (e.g. `provider:openai:api_key`). Returns true if
+ * the document was written.
+ */
+async function persistSecretToCollection(name: string, value: string): Promise<boolean> {
+  const key = getMasterKey()
+  if (!key) {
+    log.warn(`[secrets] No master key — cannot persist ${name} durably`)
+    return false
+  }
 
-export function encryptConfig(config: Record<string, unknown>): { encrypted: string; iv: string } {
-  return encrypt(JSON.stringify(config));
-}
+  const iv = randomBytes(12).toString("hex")
+  const ciphertext = encryptSecret(value, iv)
+  if (!ciphertext) return false
 
-export function decryptConfig(encrypted: string, iv: string): Record<string, unknown> {
-  return JSON.parse(decrypt({ encrypted, iv }));
+  try {
+    const secrets = await col<SecretDoc>("secrets")
+    await secrets.put(name, { ciphertext, iv })
+    return true
+  } catch (err) {
+    log.warn(`[secrets] Durable write failed for ${name}: ${(err as Error).message}`)
+    return false
+  }
 }

package/packages/core/src/{harness/db-helpers.ts → storage/hive.ts}

@@ -1,16 +1,20 @@
 /**
- * Reusable HiveDB collection helpers for the harness module — ported from
- * `hive`'s `storage/hive.ts`. Provides the primitives HiveDB's `Collection`
- * API doesn't have directly: autoincrement ids (`nextId`), whitelisted
- * partial UPDATEs (`updateDoc`), and `WHERE field IN (...)` (`findByAny`).
+ * Reusable HiveDB collection helpers.
+ *
+ * These replace the SQL patterns that don't have a direct HiveDB primitive:
+ * autoincrement ids (`nextId`), whitelisted partial UPDATEs (`updateDoc`,
+ * `updateManyByIndex`), `WHERE field IN (...)` (`findByAny`), and
+ * SUM/AVG/GROUP BY (`bumpRollup`).
  */
 
-import { hiveCollection } from "../storage/HiveDBStorage.ts";
+import { getHiveDb } from "./hivedb";
 
 const MAX_RETRIES = 5;
 
 /** Sentinel for nullable FK-like fields used in equality indexes (`findBy`/`createIndex` reject `null`). */
 export const NO_PARENT = "__none__";
+/** Sentinel for a broadcast recipient (e.g. `agentBusMessages.to_worker_id`). */
+export const BROADCAST = "*";
 
 /** Encode a nullable FK-like value for storage in an indexed field. */
 export function toIndexable(value: string | null | undefined): string {
@@ -23,7 +27,8 @@ export function fromIndexable(value: string): string | null {
 }
 
 export async function col<T>(name: string) {
-  return hiveCollection<T>(name);
+  const db = await getHiveDb();
+  return db.collection<T>(name);
 }
 
 /**
@@ -32,7 +37,7 @@ export async function col<T>(name: string) {
  * conflicts (another writer bumped the same counter concurrently).
  */
 export async function nextId(counterName: string): Promise<string> {
-  const counters = await col<{ value: number }>("harness_counters");
+  const counters = await col<{ value: number }>("counters");
   for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
     const cur = await counters.get(counterName);
     const next = (cur?.doc.value ?? 0) + 1;
@@ -71,6 +76,23 @@ export async function updateDoc<T extends object>(
   throw new Error(`updateDoc: too much contention on ${collection}/${id}`);
 }
 
+/**
+ * Apply the same patch to every document whose indexed `field` equals
+ * `value` — replaces `UPDATE x SET ... WHERE fk = ?`. Requires a prior
+ * `createIndex(field)` on the collection.
+ */
+export async function updateManyByIndex<T extends object>(
+  collection: string,
+  field: string,
+  value: string | number | boolean,
+  patch: Partial<T>
+): Promise<number> {
+  const c = await col<T>(collection);
+  const rows = await c.findBy(field, value);
+  for (const r of rows) await updateDoc<T>(collection, r.id, patch);
+  return rows.length;
+}
+
 /**
  * Fetch documents whose indexed `field` matches any of `values` — emulates
  * `WHERE field IN (...)`. Requires a prior `createIndex(field)`.
@@ -85,3 +107,37 @@ export async function findByAny<T>(
   const chunks = await Promise.all(uniq.map((v) => c.findBy(field, v)));
   return chunks.flat();
 }
+
+/**
+ * Increment numeric fields on a rollup/counter document — replaces
+ * SUM/AVG/GROUP BY. `nested` additionally bumps a per-key breakdown (e.g.
+ * `byProvider[provider]`) inside the same document. Creates the document on
+ * first use. Retries on optimistic-concurrency conflicts.
+ */
+export async function bumpRollup(
+  collection: string,
+  id: string,
+  delta: Record<string, number>,
+  nested?: { field: string; key: string }
+): Promise<void> {
+  const c = await col<Record<string, any>>(collection);
+  for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+    const existing = await c.get(id);
+    const doc: Record<string, any> = existing ? { ...existing.doc } : {};
+    for (const [k, v] of Object.entries(delta)) doc[k] = (doc[k] ?? 0) + v;
+    if (nested) {
+      doc[nested.field] = { ...(doc[nested.field] ?? {}) };
+      doc[nested.field][nested.key] = { ...(doc[nested.field][nested.key] ?? {}) };
+      for (const [k, v] of Object.entries(delta)) {
+        doc[nested.field][nested.key][k] = (doc[nested.field][nested.key][k] ?? 0) + v;
+      }
+    }
+    try {
+      await c.put(id, doc, { expectedVersion: existing?.version ?? 0 });
+      return;
+    } catch {
+      // Version conflict — retry with a fresh read.
+    }
+  }
+  throw new Error(`bumpRollup: too much contention on ${collection}/${id}`);
+}

package/packages/core/src/storage/hivedb.ts

@@ -0,0 +1,61 @@
+/**
+ * HiveDB — singleton accessor
+ *
+ * HiveDB (@johpaz/hive-db) is the embedded Rust engine (redb + tantivy BM25 +
+ * hnsw_rs) that is the sole data store for Hive: capability search (tools,
+ * skills, playbook, MCP tools) via its BM25/hybrid index, and every other
+ * piece of relational-shaped data (users, agents, providers, models,
+ * conversations, cron, projects, ACE/playbook, ...) via its document
+ * collections (`db.collection<T>(name)`).
+ *
+ * The database lives at ~/.hive/data/hivedb (or ~/.hive-dev/data/hivedb in
+ * dev).
+ */
+
+import path from "node:path";
+import { HiveDB } from "@johpaz/hive-db";
+import { getHiveDir } from "../config/loader.ts";
+import { logger } from "../utils/logger";
+
+const log = logger.child("hivedb");
+
+let db: HiveDB | null = null;
+let opening: Promise<HiveDB> | null = null;
+
+export function getHiveDbPath(): string {
+  // Tests can point the database at an ephemeral (":memory:") instance.
+  if (process.env.HIVE_DB_PATH) return process.env.HIVE_DB_PATH;
+  return path.join(getHiveDir(), "data", "hivedb");
+}
+
+/**
+ * Get the shared HiveDB instance, opening it on first use.
+ * Concurrent callers share the same open() promise.
+ */
+export async function getHiveDb(): Promise<HiveDB> {
+  if (db) return db;
+  if (!opening) {
+    const dbPath = getHiveDbPath();
+    opening = HiveDB.open(dbPath).then((opened) => {
+      db = opened;
+      log.info(`[hivedb] Opened at ${dbPath}`);
+      return opened;
+    });
+    opening.catch(() => {
+      opening = null;
+    });
+  }
+  return opening;
+}
+
+export function closeHiveDb(): void {
+  if (db) {
+    try {
+      db.close();
+    } catch (err) {
+      log.warn(`[hivedb] Error closing database: ${(err as Error).message}`);
+    }
+    db = null;
+    opening = null;
+  }
+}

package/packages/core/src/storage/index.ts

@@ -1,21 +1,114 @@
-export { getDbPathLazy, getDb, initializeDatabase, DatabaseService, dbService } from "./SQLiteStorage.ts";
-export { SCHEMA, PROJECTS_SCHEMA, CONTEXT_ENGINE_SCHEMA, MEETING_SCHEMA } from "./schema.ts";
-export { recordUsage, getUsageStats, getProviderPricing, estimateCostForTokens, getAverageTokenCost, recordToonSavings } from "./usage.ts";
+/**
+ * Superficie pública de storage.
+ *
+ * HiveDB es la única fuente de verdad. La capa SQLite síncrona (`SQLiteStorage`,
+ * `schema.ts`, `hiveSeed.ts`) desapareció en 0.1.5: convivían dos backends y el
+ * seed de HiveDB salía fire-and-forget desde el de SQLite, así que cuál de los
+ * dos ganaba dependía del timing.
+ */
+
+// ─── Conexión y bootstrap ────────────────────────────────────────────────────
+export { getHiveDbPath, getHiveDb, closeHiveDb } from "./hivedb.ts";
+export { ensureHiveDb, isBootstrapped } from "./bootstrap.ts";
+
+// ─── Acceso a colecciones ────────────────────────────────────────────────────
+export {
+  col,
+  nextId,
+  updateDoc,
+  updateManyByIndex,
+  findByAny,
+  bumpRollup,
+  toIndexable,
+  fromIndexable,
+  NO_PARENT,
+  BROADCAST,
+} from "./hive.ts";
+
+// ─── Shapes de documento ─────────────────────────────────────────────────────
+export type * from "./collections.ts";
+
+// ─── Claves del catálogo de modelos ──────────────────────────────────────────
+// El prefijo de revendedor evita que dos providers que sirven el mismo modelo
+// se pisen la fila entre sí — ver el JSDoc de model-id.ts.
+export { catalogModelKey, wireModelId, isResellerProvider } from "./model-id.ts";
+
+// ─── Seed del catálogo ───────────────────────────────────────────────────────
+export type { SeedData } from "./seed.ts";
+export {
+  SEED_DATA,
+  seedAllData,
+  seedToolsAndSkills,
+  activateElement,
+  deactivateElement,
+  getAllElements,
+  getActiveElements,
+} from "./seed.ts";
+
+// ─── Consumo y costos ────────────────────────────────────────────────────────
+// El precio vive en la fila del modelo (`input_per_1m` / `output_per_1m`), no en
+// un mapa hardcodeado: `MODEL_PRICING` era una segunda lista que se desfasaba
+// del catálogo en silencio.
 export type { UsageRecord, UsageSummary } from "./usage.ts";
+export {
+  recordUsage,
+  getUsageStats,
+  calculateCost,
+  invalidateModelPricingCache,
+  recordToonSavings,
+  hourBucket,
+} from "./usage.ts";
+
+// ─── Secretos ────────────────────────────────────────────────────────────────
+export {
+  ensureSecretsBackend,
+  storeSecret,
+  loadSecret,
+  deleteSecret,
+  storeProviderApiKey,
+  loadProviderApiKey,
+  storeProviderHeaders,
+  loadProviderHeaders,
+  deleteProviderSecrets,
+  storeChannelConfig,
+  loadChannelConfig,
+  deleteChannelSecrets,
+  storeMcpHeaders,
+  loadMcpHeaders,
+  storeMcpEnv,
+  loadMcpEnv,
+  deleteMcpSecrets,
+  storeAgentHeaders,
+  loadAgentHeaders,
+  deleteAgentSecrets,
+  maskApiKey,
+  hashPassword,
+  verifyPassword,
+} from "./crypto.ts";
+
+// ─── Onboarding e identidad ──────────────────────────────────────────────────
 export type { OnboardingSection } from "./onboarding.ts";
-export { resolveUserId, resolveAgentId, initOnboardingDb } from "./onboarding.ts";
-export type { EncryptedData } from "./crypto.ts";
-export { encrypt, decrypt, encryptApiKey, decryptApiKey, encryptConfig, decryptConfig } from "./crypto.ts";
-export type { SeedData } from "./seed.ts";
-export { SEED_DATA, seedAllData } from "./seed.ts";
 export {
-  getHiveDbPath,
-  openHiveDB,
-  getHiveDB,
-  closeHiveDB,
-  hiveCollection,
-  hiveAppend,
-  hiveRead,
-  isHiveDBInitialized,
-} from "./HiveDBStorage.ts";
-export { seedHiveDB } from "./hiveSeed.ts";
+  resolveUserId,
+  resolveAgentId,
+  initOnboardingDb,
+  saveUserProfile,
+  saveProviderConfig,
+  saveAgentConfig,
+  activateProvider,
+  activateModel,
+  deactivateProvider,
+  deactivateModel,
+  getAllProviders,
+  getAllModels,
+} from "./onboarding.ts";
+export { normalizeUserEmail } from "./user-email.ts";
+
+// ─── Durabilidad entre arranques ─────────────────────────────────────────────
+export { getBootId, resetBootId } from "./boot-id.ts";
+export type { ReconcileResult } from "./reconcile.ts";
+export { reconcileOnBoot } from "./reconcile.ts";
+
+// ─── Log causal (G9) ─────────────────────────────────────────────────────────
+export type { CausalEvent, CausalEventPattern } from "./causal-events.ts";
+export { watchCausalEvents, formatCausalEvent } from "./causal-events.ts";