@hasna/skills 0.3.0 → 0.5.0

package/dist/lib/remote-client.d.ts

@@ -1,4 +1,9 @@
+import { type RemoteWorkspaceMembersOptions, type RemoteWorkspaceMembersPage } from "./remote-workspace.js";
+import { type RemoteWorkspaceMemberErrorCode, type SetRemoteWorkspaceMemberRole, type RemoveRemoteWorkspaceMember, type RemoteWorkspaceMemberRoleResult, type RemoteWorkspaceMemberRemovalResult } from "./remote-workspace.js";
 import { type RemoteSkillRunContract } from "./remote-run-contract.js";
+import { type RemoteCreditPack, type RemoteRunApproval, type RemoteRunQuote } from "./remote-account.js";
+import { type RemoteInputFile } from "./remote-files.js";
+import { type UpdateRemoteProfile, type UpdateRemoteWorkspace } from "./remote-profile.js";
 /**
  * A server that predates this client's pin/tag/incremental-sync routes answered
  * 404/405 for them. The caller must never mistake that for "no pins" or "empty
@@ -15,7 +20,17 @@ export declare class RemoteRouteUnsupportedError extends Error {
 export declare class RemoteRequestError extends Error {
     readonly path: string;
     readonly status: number;
-    constructor(path: string, status: number, statusText: string);
+    constructor(path: string, status: number, _statusText?: string);
+}
+/** A recognized membership refusal, with fixed text and no server payload. */
+export declare class RemoteWorkspaceMemberError extends RemoteRequestError {
+    readonly code: RemoteWorkspaceMemberErrorCode;
+    constructor(path: string, code: RemoteWorkspaceMemberErrorCode);
+}
+/** A recognized unavailable capability; all displayed text is client-owned. */
+export declare class RemoteCapabilityUnavailableError extends RemoteRequestError {
+    readonly code: "SUBSCRIPTION_CHECKOUT_UNAVAILABLE";
+    constructor();
 }
 /**
  * A remote pin on a skill, matching the hosted-pins wire shape
@@ -55,6 +70,7 @@ export interface UpdatedSincePage {
 export declare class RemoteSkillsClient {
     private apiUrl;
     private apiKey;
+    private capabilities?;
     constructor(apiKey: string, apiUrl?: string);
     private request;
     /**
@@ -88,12 +104,79 @@ export declare class RemoteSkillsClient {
         status: number;
         body: unknown;
     }>;
-    submitRun(slug: string, input?: Record<string, unknown>, args?: string[]): Promise<RemoteSkillRunContract>;
+    /** Low-level admission transport; interactive surfaces use submitQuotedRun. */
+    submitRun(slug: string, input?: Record<string, unknown>, args?: string[], approval?: RemoteRunApproval): Promise<RemoteSkillRunContract>;
+    quoteRun(slug: string, input?: Record<string, unknown>, args?: string[]): Promise<RemoteRunQuote>;
+    getCapabilities(): Promise<{
+        contractVersion: 1;
+        apiVersion: 1;
+        capabilities: string[];
+        billing?: {
+            boundedRunApproval?: boolean;
+            unit?: string;
+        };
+    }>;
+    /** Quote first and fail closed when the caller has not approved the required credits. */
+    submitQuotedRun(slug: string, input?: Record<string, unknown>, args?: string[], approval?: RemoteRunApproval): Promise<RemoteSkillRunContract>;
+    getIdentity(): Promise<Record<string, unknown>>;
+    /** Requires a customer session; API keys and support impersonation cannot edit names. */
+    updateProfile(input: UpdateRemoteProfile): Promise<{
+        user: import("./remote-profile.js").RemoteCustomerProfile;
+    }>;
+    /** Owner/admin session only; the current workspace identity and slug stay fixed. */
+    updateCurrentWorkspace(input: UpdateRemoteWorkspace): Promise<{
+        organization: import("./remote-profile.js").RemoteCurrentWorkspace;
+    }>;
+    /** Current owner/admin customer session only; the server refuses API keys and impersonation. */
+    listWorkspaceMembers(options?: RemoteWorkspaceMembersOptions): Promise<RemoteWorkspaceMembersPage>;
+    /** Exact incarnation and expected role; no refresh or retry. Server enforces current authority. */
+    setWorkspaceMemberRole(membershipId: string, input: SetRemoteWorkspaceMemberRole): Promise<RemoteWorkspaceMemberRoleResult>;
+    /** Removes only this incarnation. A successful tombstone replay is returned unchanged. */
+    removeWorkspaceMember(membershipId: string, input: RemoveRemoteWorkspaceMember): Promise<RemoteWorkspaceMemberRemovalResult>;
+    private requestWorkspaceMember;
+    listApiKeys(): Promise<Record<string, unknown>[]>;
+    createApiKey(name: string, scopes?: string[]): Promise<{
+        key: string;
+        [field: string]: unknown;
+    }>;
+    revokeApiKey(keyId: string): Promise<Record<string, unknown>>;
+    getBillingStatus(): Promise<{
+        hasPaymentMethod?: boolean | undefined;
+        plan?: string | undefined;
+        creditBalance: number;
+        formattedCreditBalance: string;
+    }>;
+    listCreditPacks(): Promise<RemoteCreditPack[]>;
+    createCreditCheckout(packId: string): Promise<{
+        url: string;
+    }>;
+    getUsage(): Promise<Record<string, unknown>[]>;
+    listInvoices(): Promise<Record<string, unknown>[]>;
+    createBillingCheckout(): Promise<{
+        url: string;
+    }>;
+    createBillingPortal(): Promise<{
+        url: string;
+    }>;
+    cancelRun(runId: string): Promise<RemoteSkillRunContract>;
+    resumeRun(runId: string): Promise<RemoteSkillRunContract>;
+    private controlRun;
+    private checkoutResponse;
+    private arrayResponse;
     getRun(runId: string): Promise<RemoteSkillRunContract | null>;
     getRunLogs(runId: string): Promise<any[]>;
     listRuns(limit?: number): Promise<any[]>;
     getRunArtifacts(runId: string): Promise<any[]>;
     downloadRunArtifact(runId: string, artifactId: string): Promise<Response>;
+    getVerifiedRunArtifact(runId: string, artifactId: string, maximumBytes?: number): Promise<{
+        id: string;
+        fileName: string;
+        bytes: Uint8Array<ArrayBufferLike>;
+        byteSize: number;
+        sha256: any;
+    }>;
+    submitQuotedRunWithFiles(slug: string, input: Record<string, unknown>, args: string[], files: RemoteInputFile[], approval?: RemoteRunApproval): Promise<RemoteSkillRunContract>;
+    uploadRunFiles(runId: string, files: RemoteInputFile[]): Promise<void>;
     /**
      * Publish a skill to the configured instance.
      *
@@ -156,11 +239,12 @@ export declare class RemoteSkillsClient {
 }
 /**
  * The client for the configured instance, or null when this install runs on
- * this machine (no credential and no authority).
+ * this machine — which is now the explicit local opt-in only
+ * (`HASNA_SKILLS_LOCAL=1`); with no credential, no authority and no opt-in the
+ * shared ladder throws (fail-closed ruling), so the caller fails loudly instead
+ * of quietly reading the bundled corpus while authentication is unconfigured.
  *
- * A configured authority with no credential does NOT return null: the shared
- * ladder throws, so the caller fails loudly instead of quietly reading the
- * bundled corpus while authentication is unconfigured.
+ * A configured authority with no credential also throws for the same reason.
  *
  * ASYNC because the credential ladder is: a vault pointer
  * (`HASNA_SKILLS_API_KEY_REF`) is completed through the secrets vault before a

package/dist/lib/remote-customer-operations.d.ts

@@ -0,0 +1,106 @@
+import type { RemoteSkillsClient } from "./remote-client.js";
+/** Shared customer operation declarations for MCP registration and its discovery contract. */
+export declare const REMOTE_CUSTOMER_OPERATIONS: readonly [{
+    readonly name: "get_account";
+    readonly title: "Get Account Identity";
+    readonly parameter: null;
+    readonly mutates: false;
+    readonly invoke: (client: RemoteSkillsClient) => Promise<Record<string, unknown>>;
+}, {
+    readonly name: "get_server_capabilities";
+    readonly title: "Get Server Capabilities";
+    readonly parameter: null;
+    readonly mutates: false;
+    readonly invoke: (client: RemoteSkillsClient) => Promise<{
+        contractVersion: 1;
+        apiVersion: 1;
+        capabilities: string[];
+        billing?: {
+            boundedRunApproval?: boolean;
+            unit?: string;
+        };
+    }>;
+}, {
+    readonly name: "list_remote_skills";
+    readonly title: "List Remote Skills";
+    readonly parameter: null;
+    readonly mutates: false;
+    readonly invoke: (client: RemoteSkillsClient) => Promise<any[]>;
+}, {
+    readonly name: "get_billing_status";
+    readonly title: "Get Billing Status";
+    readonly parameter: null;
+    readonly mutates: false;
+    readonly invoke: (client: RemoteSkillsClient) => Promise<{
+        hasPaymentMethod?: boolean | undefined;
+        plan?: string | undefined;
+        creditBalance: number;
+        formattedCreditBalance: string;
+    }>;
+}, {
+    readonly name: "list_credit_packs";
+    readonly title: "List Credit Packs";
+    readonly parameter: null;
+    readonly mutates: false;
+    readonly invoke: (client: RemoteSkillsClient) => Promise<import("./remote-account.js").RemoteCreditPack[]>;
+}, {
+    readonly name: "create_credit_checkout";
+    readonly title: "Create Credit Checkout";
+    readonly parameter: "pack_id";
+    readonly mutates: true;
+    readonly invoke: (client: RemoteSkillsClient, value: string) => Promise<{
+        url: string;
+    }>;
+}, {
+    readonly name: "get_billing_usage";
+    readonly title: "Get Billing Usage";
+    readonly parameter: null;
+    readonly mutates: false;
+    readonly invoke: (client: RemoteSkillsClient) => Promise<Record<string, unknown>[]>;
+}, {
+    readonly name: "list_invoices";
+    readonly title: "List Invoices";
+    readonly parameter: null;
+    readonly mutates: false;
+    readonly invoke: (client: RemoteSkillsClient) => Promise<Record<string, unknown>[]>;
+}, {
+    readonly name: "create_billing_checkout";
+    readonly title: "Create Billing Checkout";
+    readonly parameter: null;
+    readonly mutates: true;
+    readonly invoke: (client: RemoteSkillsClient) => Promise<{
+        url: string;
+    }>;
+}, {
+    readonly name: "create_billing_portal";
+    readonly title: "Create Billing Portal";
+    readonly parameter: null;
+    readonly mutates: true;
+    readonly invoke: (client: RemoteSkillsClient) => Promise<{
+        url: string;
+    }>;
+}, {
+    readonly name: "get_run_logs";
+    readonly title: "Get Run Logs";
+    readonly parameter: "run_id";
+    readonly mutates: false;
+    readonly invoke: (client: RemoteSkillsClient, value: string) => Promise<any[]>;
+}, {
+    readonly name: "cancel_run";
+    readonly title: "Cancel Run";
+    readonly parameter: "run_id";
+    readonly mutates: true;
+    readonly invoke: (client: RemoteSkillsClient, value: string) => Promise<import("./remote-run-contract.js").RemoteSkillRunContract>;
+}, {
+    readonly name: "resume_run";
+    readonly title: "Resume Run";
+    readonly parameter: "run_id";
+    readonly mutates: true;
+    readonly invoke: (client: RemoteSkillsClient, value: string) => Promise<import("./remote-run-contract.js").RemoteSkillRunContract>;
+}, {
+    readonly name: "list_run_artifacts";
+    readonly title: "List Run Artifacts";
+    readonly parameter: "run_id";
+    readonly mutates: false;
+    readonly invoke: (client: RemoteSkillsClient, value: string) => Promise<any[]>;
+}];

package/dist/lib/remote-files.d.ts

@@ -0,0 +1,21 @@
+export declare const MAX_REMOTE_FILE_BYTES: number;
+export interface RemoteInputFile {
+    name: string;
+    bytes: Uint8Array;
+    contentType?: string;
+}
+export interface RemoteInputFileDescriptor {
+    name: string;
+    sizeBytes: number;
+    sha256: string;
+    contentType: string;
+}
+export declare function describeRemoteFiles(files: RemoteInputFile[]): RemoteInputFileDescriptor[];
+export declare function sha256(bytes: Uint8Array): string;
+export declare function readBoundedResponse(response: Response, maximum: number): Promise<Uint8Array>;
+/** Small inline inputs for agent transports; larger files belong in the CLI/SDK. */
+export declare function decodeRemoteFiles(files: Array<{
+    name: string;
+    base64: string;
+    contentType?: string;
+}>): RemoteInputFile[];

package/dist/lib/remote-profile.d.ts

@@ -0,0 +1,26 @@
+export type RemoteCustomerRole = "owner" | "admin" | "member" | "viewer";
+export type RemoteCustomerProfile = {
+    id: string;
+    email: string;
+    displayName: string | null;
+    role: RemoteCustomerRole;
+};
+export type RemoteCurrentWorkspace = {
+    id: string;
+    slug: string;
+    name: string;
+};
+export type UpdateRemoteProfile = {
+    displayName: string;
+};
+export type UpdateRemoteWorkspace = {
+    name: string;
+};
+/** Client input checks do not grant authority; the selected server owns policy. */
+export declare function customerNamePatch(input: unknown, field: "displayName" | "name"): Record<string, string>;
+export declare function parseUpdatedProfile(value: unknown): {
+    user: RemoteCustomerProfile;
+};
+export declare function parseUpdatedWorkspace(value: unknown): {
+    organization: RemoteCurrentWorkspace;
+};

package/dist/lib/remote-registry.d.ts

@@ -45,9 +45,13 @@ export declare function loadRemoteRegistry(options?: RemoteRegistryOptions): Pro
  * origin sees the folder UNION cloud in the plain `list`/`search` path, while
  * every other install keeps today's exact local behavior.
  *
- *   - Nothing configured (no credential, no authority) -> the local list is
- *     returned unchanged and no request is attempted. An install running on
- *     this machine must stay byte-identical to the pre-merge output.
+ *   - Nothing configured, local opted in -> the local list is returned
+ *     unchanged and no request is attempted. An install running on this
+ *     machine must stay byte-identical to the pre-merge output.
+ *   - Nothing configured and NO local opt-in -> this throws, from the shared
+ *     ladder (MISSING_API_CREDENTIAL, naming `HASNA_SKILLS_LOCAL` as the
+ *     deliberate way out): local mode is opt-in only, and an unconfigured
+ *     install is a refusal rather than a silent local listing.
  *   - An authority configured with NO credential -> this throws, from the
  *     shared ladder. It used to return the local half silently, which is the
  *     false green the 2026-09-04 ruling removes: an operator who pointed this

package/dist/lib/remote-workspace.d.ts

@@ -0,0 +1,76 @@
+import type { RemoteCustomerRole } from "./remote-profile.js";
+export type RemoteWorkspaceMember = {
+    membershipId: string;
+    userId: string;
+    email: string;
+    displayName: string | null;
+    role: RemoteCustomerRole;
+    /** Exact server timestamp, including microseconds; never rounded to Date. */
+    createdAt: string;
+};
+export type RemoteWorkspaceMembersPage = {
+    organizationId: string;
+    members: RemoteWorkspaceMember[];
+    nextCursor: string | null;
+};
+export type RemoteWorkspaceMembersOptions = {
+    limit?: number;
+    cursor?: string;
+};
+export type SetRemoteWorkspaceMemberRole = {
+    role: RemoteCustomerRole;
+    expectedRole: RemoteCustomerRole;
+};
+export type RemoveRemoteWorkspaceMember = {
+    expectedRole: RemoteCustomerRole;
+};
+export type RemoteWorkspaceMemberRoleResult = {
+    organizationId: string;
+    member: RemoteWorkspaceMember;
+    changed: boolean;
+};
+export type RemoteWorkspaceMemberRemovalResult = {
+    organizationId: string;
+    membershipId: string;
+    removed: true;
+    alreadyRemoved: boolean;
+};
+/** Pagination is transport input, not a workspace or authority selector. */
+export declare function workspaceMembersQuery(options?: RemoteWorkspaceMembersOptions): string;
+export declare class WorkspaceMemberInputError extends Error {
+    constructor();
+}
+/** Snapshot transport input before verification awaits; authority stays on the server. */
+export declare function workspaceMemberRoleInput(membershipId: string, input: SetRemoteWorkspaceMemberRole): {
+    membershipId: string;
+    body: {
+        role: RemoteCustomerRole;
+        expectedRole: RemoteCustomerRole;
+    };
+};
+export declare function workspaceMemberRemovalInput(membershipId: string, input: RemoveRemoteWorkspaceMember): {
+    membershipId: string;
+    body: {
+        expectedRole: RemoteCustomerRole;
+    };
+};
+export declare const invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.";
+export declare function parseWorkspaceMemberRoleResult(value: unknown, membershipId: string, role: RemoteCustomerRole): RemoteWorkspaceMemberRoleResult;
+export declare function parseWorkspaceMemberRemovalResult(value: unknown, membershipId: string): RemoteWorkspaceMemberRemovalResult;
+/** Only known code/status pairs become public messages; arbitrary server text stays private. */
+export declare const workspaceMemberFailures: {
+    readonly INVALID_REQUEST: readonly [400, "Provide the exact membership role parameters."];
+    readonly ACCOUNT_UNAVAILABLE: readonly [403, "Account is unavailable."];
+    readonly INTERACTIVE_SESSION_REQUIRED: readonly [403, "Fresh interactive sign-in is required."];
+    readonly WORKSPACE_ADMIN_REQUIRED: readonly [403, "A current workspace owner or admin is required."];
+    readonly MEMBERSHIP_ACTION_FORBIDDEN: readonly [403, "Your current workspace role cannot perform this membership action."];
+    readonly MEMBERSHIP_NOT_FOUND: readonly [404, "Membership was not found in the current workspace."];
+    readonly SELF_REMOVAL_UNAVAILABLE: readonly [409, "Leaving your own workspace is not available through member removal."];
+    readonly MEMBERSHIP_ROLE_CHANGED: readonly [409, "The member role changed. Refresh the roster before another action."];
+    readonly LAST_OWNER_REQUIRED: readonly [409, "The workspace must retain at least one active owner."];
+    readonly MEMBERSHIP_BUSY: readonly [503, "Membership is busy. Refresh the roster before another action."];
+};
+export type RemoteWorkspaceMemberErrorCode = keyof typeof workspaceMemberFailures;
+export declare function workspaceMemberFailure(value: unknown, status: number): RemoteWorkspaceMemberErrorCode | null;
+/** Project the documented roster only; auth metadata and other fields stay out. */
+export declare function parseWorkspaceMembersPage(value: unknown): RemoteWorkspaceMembersPage;

package/dist/lib/run-routing.d.ts

@@ -35,6 +35,7 @@ export type RunRoutingErrorCode = "REMOTE_REQUIRES_ORIGIN" | "REMOTE_REQUIRES_CR
 export type RunRouting = {
     route: "remote";
     apiKey: string;
+    apiOrigin: string;
 } | {
     route: "local";
 } | {

package/dist/lib/run-state.d.ts

@@ -25,6 +25,8 @@ export interface SkillRunRecord {
     durationMs?: number;
     remote: boolean;
     remoteRunId?: string;
+    /** Exact configured instance that owns a remote run; absent on historical records. */
+    remoteApiOrigin?: string;
     costCents?: number;
     error?: string;
     artifacts: SkillRunArtifact[];
@@ -47,6 +49,7 @@ export declare function createSkillRun(params: {
     prompt?: string;
     remote?: boolean;
     remoteRunId?: string;
+    remoteApiOrigin?: string;
     costCents?: number;
     status?: SkillRunStatus;
 }, targetDir?: string): SkillRunContext;

package/dist/lib/skillinfo.d.ts

@@ -45,7 +45,7 @@ export declare function getSkillDependencyStatus(name: string): SkillDependencyS
  */
 export declare function runSkill(name: string, args: string[], options?: {
     installed?: boolean;
-    stdio?: "inherit" | "pipe";
+    stdio?: "inherit" | "pipe" | "stderr";
     env?: Record<string, string>;
 }): Promise<{
     exitCode: number;

package/dist/mcp/helpers.d.ts

@@ -1,3 +1,24 @@
+/** The shape every tool handler returns; kept structural so registrars need no SDK type import. */
+type McpToolResult = {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+};
+/**
+ * Run a DATA tool behind the fleet ladder's refusal.
+ *
+ * The body is expected to go through `requireSkillsReadAccess()` /
+ * `getBrowseRegistry()` (lib/read-access.ts) before it reads the bundled
+ * catalog or the on-machine corpus. When the ladder refuses — no credential, no
+ * authority, no `HASNA_SKILLS_LOCAL=1` opt-in; an authority with no key; a
+ * deliberate selection that cannot be honoured — the refusal comes back as the
+ * same `AUTH_REQUIRED` result `get_run_status` already gives, never as the
+ * local answer. Any other failure propagates unchanged (the SDK reports it as
+ * a tool error with its message).
+ */
+export declare function readSurface(body: () => Promise<McpToolResult>): Promise<McpToolResult>;
 export declare function stripNulls(obj: Record<string, unknown>): Record<string, unknown>;
 export declare function cacheGet(key: string): unknown | undefined;
 export declare function cacheSet(key: string, value: unknown): void;
@@ -24,3 +45,4 @@ export declare const TOOL_DESCRIPTIONS: Record<string, {
     description: string;
     params: string[];
 }>;
+export {};

package/dist/mcp/index.d.ts

@@ -8,6 +8,22 @@
  *   skills-mcp          # Direct binary
  *   skills-mcp --http   # Streamable HTTP on 127.0.0.1:8836
  */
+/**
+ * FAIL CLOSED AT STARTUP (owner ruling 2026-09-04, hasna/apps#1720; #1720
+ * validation, round 1): the MCP process resolves the fleet ladder BEFORE it
+ * connects any transport. With no credential, no authority and no
+ * `HASNA_SKILLS_LOCAL=1` opt-in it exits 1 with the ladder's one line on
+ * stderr — before `initialize` is answered, before an HTTP port is bound —
+ * mirroring the CLI, which exits 1 on the same machine. Serving the bundled
+ * catalog to an agent host that registered `skills-mcp` on a station without
+ * its credential is the false green the ruling removed. The explicit local
+ * opt-in starts the server and announces local mode once on stderr; a
+ * credential (or a vault pointer the tools complete per call) starts it hosted.
+ *
+ * Every data tool still runs the same gate per call (lib/read-access.ts), so a
+ * credential that disappears mid-process is refused by the next call too.
+ */
+export declare function assertSkillsMcpConfigured(env?: Record<string, string | undefined>): void;
 /**
  * Start the Skills MCP server on stdio (newline-delimited JSON-RPC).
  *

package/dist/mcp/remote-customer-tools.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerRemoteCustomerTools(server: McpServer): void;

package/dist/sdk/governance-store.d.ts

@@ -51,6 +51,7 @@ export interface GovernanceStore {
         estimatedCents: number;
     }): Promise<CreditReservation>;
     reservationsForRun(orgId: string, runId: string): Promise<CreditReservation[]>;
+    /** First terminal reconciliation wins; retries return that persisted state unchanged. */
     reconcileReservation(reservationId: string, actualCents: number, status: "charged" | "released"): Promise<CreditReservation | null>;
     /** Sum of cost_cents of runs created in the given calendar month (YYYY-MM), plus un-reconciled reservations. */
     monthlySpendCents(orgId: string, monthPrefix: string): Promise<number>;

package/dist/sdk/index.d.ts

@@ -15,7 +15,7 @@
  * — the shared @hasna/contracts ladder — instead of reading an environment
  * variable of its own. See lib/fleet-credentials.ts.
  */
-export { MissingSkillsFleetError, SkillsFleetCredentialError, SKILLS_API_KEY_ENV, SKILLS_API_URL_ENV, SKILLS_APP, configuredSkillsApiUrl, noticeLocalSkillsMode, normalizeSkillsApiOrigin, requireSkillsApiOrigin, requireSkillsFleet, resolveSkillsApiOrigin, resolveSkillsFleet, skillsCredentialFilePath, skillsCredentialFiles, skillsCredentialOrReason, type HostedSkillsFleet, type LocalSkillsFleet, type SkillsFleet, type SkillsFleetErrorCode, type SkillsFleetOptions, } from "../lib/fleet-credentials.js";
+export { MissingSkillsFleetError, SkillsFleetCredentialError, SKILLS_API_KEY_ENV, SKILLS_API_URL_ENV, SKILLS_APP, SKILLS_LOCAL_OPT_IN_ENV_KEYS, configuredSkillsApiUrl, isSkillsLocalOptIn, noticeLocalSkillsMode, normalizeSkillsApiOrigin, requireSkillsApiOrigin, requireSkillsFleet, resolveSkillsApiOrigin, resolveSkillsFleet, selectsSkillsLocalMode, skillsCredentialFilePath, skillsCredentialFiles, skillsCredentialOrReason, type HostedSkillsFleet, type LocalSkillsFleet, type SkillsFleet, type SkillsFleetErrorCode, type SkillsFleetOptions, } from "../lib/fleet-credentials.js";
 export * from "./server.js";
 export * from "./registry.js";
 export * from "./runs.js";
@@ -30,3 +30,10 @@ export * from "./events.js";
 export * from "./spend.js";
 export * from "./offline.js";
 export * from "./execution/index.js";
+export { RemoteSkillsClient, createRemoteSkillsClient, RemoteRequestError, RemoteRouteUnsupportedError, RemoteCapabilityUnavailableError, RemoteWorkspaceMemberError } from "../lib/remote-client.js";
+export { RemoteCreditApprovalError, type RemoteRunApproval, type RemoteRunQuote, type RemoteCreditPack } from "../lib/remote-account.js";
+export { type RemoteInputFile, type RemoteInputFileDescriptor } from "../lib/remote-files.js";
+export { RemoteSkillsAuthClient, HostedApiError } from "../lib/remote-auth.js";
+export type { RemoteWorkspaceMember, RemoteWorkspaceMembersPage, RemoteWorkspaceMembersOptions } from "../lib/remote-workspace.js";
+export type { SetRemoteWorkspaceMemberRole, RemoveRemoteWorkspaceMember, RemoteWorkspaceMemberRoleResult, RemoteWorkspaceMemberRemovalResult, RemoteWorkspaceMemberErrorCode } from "../lib/remote-workspace.js";
+export type { RemoteCustomerRole, RemoteCustomerProfile, RemoteCurrentWorkspace, UpdateRemoteProfile, UpdateRemoteWorkspace } from "../lib/remote-profile.js";