@everfur/cli 0.8.0 → 0.9.1

package/LICENSE.md

@@ -0,0 +1 @@
+Copyright (c) 2026 Strand Health Inc. dba Everfur. All rights reserved. Proprietary and confidential. Not open source. Use is permitted only under the Everfur SDK License at https://docs.everfur.com/license, accepted in the Everfur partner console, and, for production use, a written Partner Agreement with Everfur. Any other copying, modification, distribution or reverse engineering is prohibited. Contact: legal@everfur.com.

package/README.md

@@ -86,10 +86,10 @@ browser is the picker and the speech engine: photo attachments and voice dictati
 `attachments={false}` and `dictation={false}` turn them off. On React Native records is the app's screen flow:
 `<EverfurRecords>` opens on the pet's dashboard and owns its own stack (the hardware back key pops it), and
 `initialScreen={{ name: 'request', requestId }}` opens a request directly, which is what the generated notification
-router's `record_request` handler says to do. On the web records is a page, the shape of Everfur's own web records
-page: the generated `EverfurRecordsSurface` renders `EverfurRecordsPage` and opens what it links to (the full record,
-the timeline, an upload) in the records flow in the same place, with no route added to your app; the page holds no clinic
-request of its own, so `records-clinic` mounts beside it. Every screen is exported by name for your own navigator,
+router's `record_request` handler says to do. On the web the generated `EverfurRecordsSurface` renders
+`EverfurRecordsPage` with the SDK's default records-sheet layout; pass `sheet={false}` for the classic page layout.
+Both open the linked record, timeline, upload and clinic-request flows in place, with no route added to your app.
+A plan that also asks for `records-clinic` mounts its dedicated request surface beside the page. Every screen is exported by name for your own navigator,
 and the plan's `mount-records-screens` step names them per platform. The mount passes `petName={selectedPet.name}` for
 headings such as `{petName}'s lab trends` (and `onCopy={copyText}` on React Native, for the share sheet). An Expo
 records mount also passes `onOpenUrl={openRecordUrl}`, which handles the share sheet the way the Everfur app does: a
@@ -99,7 +99,7 @@ the SDK's default opens both in the system browser until you pass your own. Lab
 edits and the signature gallery need the platform flag `partner.records_full_depth_enabled`; while it is off the
 SDK hides them.
 
-**The vet visit runs inside your app.** A plan that mounts `televet` installs `@everfur/sdk@^0.11.0`, a release
+**The vet visit runs inside your app.** A plan that mounts `televet` installs `@everfur/sdk@^0.17.0`, a release
 whose `VetVisitButton`, `useVetVisit().open()` and `openVisit()`, and every vet entry inside chat open the visit in
 the app by default, and writes the two things that default needs: `registerEverfurDaily(...)` once at load, from
 `@everfur/sdk/televet/call` over `@daily-co/react-native-daily-js` (React Native) or from
@@ -112,7 +112,7 @@ manifest and Info.plist edits), and the notifications file opens a tapped visit
 The booking lists vets only for the member's US state and the SDK never reads a device location, so the file's
 `YOUR_USER_US_STATE` reaches the button, the chat and the notifications bridge, and `everfur verify --project-root`
 fails while it is still `null` as shipped. The hosted visit in the system browser or a new tab is the SDK's explicit
-`prefer="redirect"`, which no generated file passes. A plan without `televet` installs the same `@everfur/sdk@^0.11.0`
+`prefer="redirect"`, which no generated file passes. A plan without `televet` installs the same `@everfur/sdk@^0.17.0`
 and none of the call.
 
 <!-- Owner-approved 2026-10-01 (production sandbox plan, PC-1/PC-2): what `test` and the key prefixes mean. -->
@@ -238,7 +238,8 @@ The four values, and where they come from:
 | `EVERFUR_DOCS_KEY` | A read-only docs key (`dk_partner_...`) that opens `GET /partners/contract` and nothing else. |
 | `EVERFUR_SESSION_TOKEN` | A short-lived session your backend minted for a test user. Only `everfur_verify_integration` reads it. |
 
-The secret key (`sk_partner_...`) never appears in an MCP configuration: the server never reads it. Going
+The secret key (`sk_partner_...`) never appears in an MCP configuration, and the integration tools never read it
+(the one exception is the claims sandbox tools, below, which read a sandbox tenant's key from a local shell only). Going
 live changes every value in the block: the production base URL, and the production tenant's own publishable
 key and docs key (its secret key changes on your backend at the same time). Production keys are issued only
 after `everfur_verify_integration` passes on the sandbox tenant.
@@ -257,10 +258,45 @@ the publishable key are not accepted for the contract; do not put the secret key
 
 `EVERFUR_SESSION_TOKEN` is for `everfur_verify_integration`. It is a short-lived session your backend minted for a
 test user (the same mint your session route performs); the tool reads the entitlement verdict and the surfaces with
-it, and mints nothing itself. The server never reads `EVERFUR_PARTNER_SECRET_KEY`, even when it is set: the secret
-key stays on your backend. Sessions expire, so mint a fresh one before verifying; without one the session step is
+it, and mints nothing itself. The integration tools never read `EVERFUR_PARTNER_SECRET_KEY`, even when it is set:
+the secret key stays on your backend. Sessions expire, so mint a fresh one before verifying; without one the session step is
 skipped and names the variable.
 
+The claims tools are for an insurer connecting its own claims system to Everfur; none of them reads a claim,
+evidence, an eligibility answer or a decision. Start with the **inbound claims webhook**: your claims system posts its
+own native events, signed, to the inbound URL Everfur gave you, and a field mapping turns each one into a claim, its
+documents or a pet profile.
+
+1. `everfur_propose_claims_mapping` proposes the mapping (format 1) from 1 to 10 sample native events, offline: each
+   field's source path, transforms and why, the required fields still unfilled per kind, and the personal data paths
+   to scrub (`pii_paths`). It never maps an owner name, email, phone, address or payment field. On a local server,
+   `sample_files` reads JSON files and `verify_with_server` previews the proposal on the sandbox.
+2. `everfur_save_claims_mapping` saves the reviewed mapping as the sandbox draft and answers with a confirmation
+   phrase. Activating the draft takes `confirm: true` plus that phrase, typed back by a person who has read the draft;
+   an agent never activates on its own.
+3. `everfur_claims_inbound_signing_setup` turns the endpoint's signing config into plain steps for your claims system,
+   and with `rotate_secret: true` rotates the sandbox secret into a local env file (mode 600) without returning it.
+4. `everfur_send_claims_inbound_samples` signs synthetic samples as the config says, posts them to the sandbox
+   inbound URL and reports each one: received, duplicate, applied (with its `insurer_claim_id` or `pet_ref`), or
+   refused or failed with its reason code and the exact fix. Opt-in checks: `duplicate`, `bad_signature` and
+   `stale_time`.
+
+`everfur_explain_claims_error` explains every inbound code, Claims API code and webhook state offline.
+`everfur_plan_claims_integration` lists the inbound steps first and, optionally, writes server code (claim sending,
+profile import and outcomes, an outbound webhook receiver and its tests) for Express, Fastify, Next.js, FastAPI, Flask
+or Django.
+
+Steps 2 to 4 run only on a server you run yourself and read `EVERFUR_PARTNER_SECRET_KEY` from a local shell only:
+export the sandbox tenant's key in the shell that starts the server, never in `.mcp.json`; the API refuses a live key.
+The samples are signed with `EVERFUR_CLAIMS_INBOUND_SECRET` and posted to `EVERFUR_CLAIMS_INBOUND_URL`, read from the
+server's environment or the env file you pass as `secret_env_file`.
+
+**Optional, outbound webhooks.** If you also receive Everfur's outbound claims webhooks, two more tools run on a
+server you run yourself: `everfur_verify_claims_receiver` sends signed synthetic deliveries to your receiver
+(localhost or public https) with `EVERFUR_WEBHOOK_SECRET`, and `everfur_send_claims_test_events` manages sandbox
+outbound endpoints and sends synthetic test events, with the same sandbox key from a local shell only. It writes a
+new endpoint's signing secret to the env file you name and never returns it.
+
 Then ask your agent to add Everfur to your app. The `everfur_plan_integration` tool reads your project
 (the framework and package manager are detected, never asked) and refuses to guess the facts only you can
 answer, naming each one:
@@ -408,7 +444,10 @@ with no network call and no credential.
 |---|---|
 | `EVERFUR_API_BASE_URL` | Everything that touches the network. No default host. |
 | `EVERFUR_PARTNER_KEY` | Your publishable key (`pk_test_...` or `pk_live_...`). Identifies your tenant. The prefix names the tenant mode: `pk_test_` for a sandbox tenant, `pk_live_` for a live one; a sandbox created before `pk_test_` keys may still carry `pk_live_`. |
-| `EVERFUR_PARTNER_SECRET_KEY` | Session minting, server side only. Never ship it in an app, and never put it in an MCP server's environment. `everfur verify` mints with it locally only when `EVERFUR_SESSION_TOKEN` is not set. |
+| `EVERFUR_PARTNER_SECRET_KEY` | Session minting, server side only. Never ship it in an app, and never put it in an MCP configuration. `everfur verify` mints with it locally only when `EVERFUR_SESSION_TOKEN` is not set. The claims sandbox tools (`everfur_save_claims_mapping`, `everfur_claims_inbound_signing_setup`, `everfur_send_claims_inbound_samples`, the mapping preview of `everfur_propose_claims_mapping`, and the optional `everfur_send_claims_test_events`) read a sandbox tenant's key from the shell that started the server, and only those tools. |
+| `EVERFUR_CLAIMS_INBOUND_SECRET` | The inbound claims endpoint's shared secret (`whsec_...`). Only `everfur_send_claims_inbound_samples` reads it, to sign sandbox samples; `everfur_claims_inbound_signing_setup` writes a rotated one to the env file you name. |
+| `EVERFUR_CLAIMS_INBOUND_URL` | The sandbox inbound URL Everfur gave for your endpoint. Only `everfur_send_claims_inbound_samples` reads it, and reports it with its token replaced. |
+| `EVERFUR_WEBHOOK_SECRET` | Optional: an outbound claims webhook endpoint's signing secret (`whsec_...`). Only `everfur_verify_claims_receiver` reads it, to sign synthetic deliveries to your own receiver. |
 | `EVERFUR_SESSION_TOKEN` | A short-lived session your backend minted. `everfur verify` and `everfur_verify_integration` use it instead of minting (the MCP tool verifies only this way); `everfur diagnose` uses it for the signed path. |
 | `EVERFUR_DOCS_KEY` | Your partner docs key (`dk_partner_...`). Fetches the contract; accepted by no other route. Minted with `POST /api/v1/partners/docs-keys`. |
 | `EVERFUR_CACHE_DIR` | Optional directory for the cached contract. |
@@ -441,4 +480,12 @@ looking for a repository you cannot open.
 
 ## License
 
-MIT
+This checkout prepares version 2.1 licensing for a future release. The already-published
+`@everfur/cli@0.8.0` and `@everfur/mcp@0.8.0` artifacts contain MIT notices.
+Partner-console acceptance for version 2.1 is not yet available; publication of the terms is not acceptance.
+See [license rollout status](https://docs.everfur.com/license-rollout/) before starting.
+
+For versions released under these terms, the materials are proprietary. Use is subject to the [Everfur SDK License, version 2.1](https://docs.everfur.com/license),
+accepted in the Everfur partner console, and a written Partner Agreement for production use.
+See `LICENSE.md` and the full terms in `SDK-LICENSE.txt` in the package. Third-party components retain their own licenses, listed in
+`THIRD-PARTY-NOTICES.md`.

package/SDK-LICENSE.txt

@@ -0,0 +1,129 @@
+# Everfur SDK License
+
+Version 2.1. Effective October 1, 2026. Published at https://docs.everfur.com/license.
+
+This Everfur SDK License (this "License") is a binding agreement between Strand Health Inc., a Delaware corporation doing business as Everfur, with its principal place of business at 1002 Dean Street, Suite 101, Brooklyn, NY 11238 ("Everfur"), and the entity or individual that accepts this License or that downloads, installs, copies, accesses or uses any Everfur Materials ("Licensee").
+
+THE EVERFUR MATERIALS ARE PROPRIETARY AND CONFIDENTIAL. THEY ARE NOT OPEN SOURCE SOFTWARE AND ARE NOT LICENSED UNDER THE MIT LICENSE OR ANY OTHER OPEN SOURCE LICENSE. EVERFUR GRANTS NO RIGHTS TO ANYONE WHO HAS NOT ACCEPTED THIS LICENSE IN THE EVERFUR PARTNER CONSOLE, AND ANY OTHER DOWNLOAD, INSTALLATION, COPY OR USE IS UNAUTHORIZED. BY CLICKING TO ACCEPT THIS LICENSE, OR BY DOWNLOADING, INSTALLING, COPYING, ACCESSING OR USING ANY EVERFUR MATERIALS, LICENSEE AGREES TO BE BOUND BY THIS LICENSE. AN INDIVIDUAL WHO ACCEPTS ON BEHALF OF AN ENTITY REPRESENTS THAT THEY HAVE AUTHORITY TO BIND THAT ENTITY, AND THE ENTITY IS THE LICENSEE.
+
+- "Authorized Personnel" means Licensee's employees and individual contractors who need access to the Everfur Materials to integrate the Licensee Application with the Services, who are bound by written confidentiality and use restrictions at least as protective of Everfur as this License, and whose names Licensee gives Everfur on request.
+
+- "Credentials" means publishable keys, secret keys, docs keys, session tokens, webhook signing secrets and any other access credentials Everfur issues.
+
+- "Documentation" means the guides, references, sample code, interface descriptions and contract files Everfur makes available, including at docs.everfur.com and through the Everfur MCP server and command line tool.
+
+- "End User" means an individual who uses the Licensee Application.
+
+- "Everfur Materials" means the SDK, the Documentation, the Services, the Credentials, the Output, any Integration Code and any other code, data, models, configuration or information Everfur makes available, together with all copies, modifications and derivative works of any of them, by whomever made.
+
+- "Licensee Application" means the mobile application, website or storefront that Licensee owns and operates and that is identified in the Partner Agreement or, for evaluation, in the partner console.
+
+- "Output" means any response, content, record, data, analysis or other result the Services return.
+
+- "Partner Agreement" means a written agreement signed by Everfur and Licensee under which Everfur provides the Services for Production Use.
+
+- "Production Use" means any use with real End Users, real animal health information or a live tenant.
+
+- "Sandbox" means a test tenant that Everfur designates as a sandbox.
+
+- "SDK" means the @everfur/sdk, @everfur/mcp and @everfur/cli packages and all other software Everfur makes available, in any form and any version released under this License, together with all updates.
+
+- "Services" means Everfur's hosted application programming interfaces, models, data and services that the SDK accesses.
+
+Everfur grants rights only to a Licensee that has accepted this License in the Everfur partner console. Anyone else receives no right or license of any kind.
+
+Evaluation license. If Licensee has accepted this License and holds Credentials for a Sandbox, Everfur grants Licensee a limited, revocable, nonexclusive, nontransferable and nonsublicensable license, for ninety (90) days after acceptance or until Everfur ends it, whichever comes first, for its Authorized Personnel to install and use the SDK and the Documentation internally, solely to evaluate and build an integration of the Licensee Application with the Services in a Sandbox. The evaluation license excludes Production Use, and Everfur may end it at any time for any reason.
+
+Production license. If Licensee has also signed a Partner Agreement that is in effect, Everfur grants Licensee, for the term of that Partner Agreement, a limited, revocable, nonexclusive, nontransferable and nonsublicensable license to: (a) let its Authorized Personnel install and use the SDK internally, solely to integrate the Licensee Application with the Services; (b) reproduce the SDK in object code form, unmodified, solely as compiled or bundled into the Licensee Application, and distribute it to End Users solely as an inseparable part of the Licensee Application; and (c) display Output within the Licensee Application to the End User who requested it, who may copy, save and share that Output for personal, noncommercial purposes.
+
+End user terms. Licensee will distribute the Licensee Application only under end user terms that prohibit reverse engineering, extraction and redistribution of the application to the extent permitted by law, and that disclaim all warranties and liability on Everfur's behalf.
+
+Versions. Each version of the SDK is governed by the version of this License that Licensee accepted for it. Licensee will use only versions of the SDK released under this License, and this License supersedes, as between Everfur and Licensee, any license under which Licensee received any earlier version.
+
+Services. No version of the SDK, under any license, grants any right to access the Services. Access to the Services requires valid Credentials and is governed by this License and the Partner Agreement.
+
+Partner Agreement. If this License conflicts with a Partner Agreement, the Partner Agreement controls only where it refers expressly to this License and to the provision it changes.
+
+Except as expressly permitted in the section titled Who may use the Everfur Materials, Licensee will not, and will not permit, assist or enable any person to:
+
+1. copy, modify, adapt, translate, port or create derivative works of any Everfur Materials;
+
+2. decompile, disassemble, decrypt, deobfuscate, unminify, reverse engineer or otherwise attempt to derive the source code, algorithms, models, prompts, weights, data structures, schemas, ontologies, scoring logic or underlying ideas of any Everfur Materials, except to the limited extent applicable law expressly permits that activity notwithstanding this restriction, and then only after giving Everfur thirty (30) days' written notice and an opportunity to provide the information on reasonable terms;
+
+3. intercept, record, replay, inspect or analyze network traffic between the SDK and the Services, except as Authorized Personnel need to debug Licensee's own integration in a Sandbox;
+
+4. access the Services other than through the SDK and the interfaces described in the Documentation, or call any undocumented interface;
+
+5. sell, rent, lease, lend, sublicense, publish, disclose, host, mirror or distribute any Everfur Materials on a standalone basis or in source code form, or place them in any public or private repository, package registry, archive, forum or AI system that anyone other than Authorized Personnel can access;
+
+6. use any Everfur Materials, or any information obtained from them, to design, build, train, improve, benchmark or market any product or service that competes with or substitutes for the Services, or assist any third party in doing so;
+
+7. use any Everfur Materials or Output to train, fine tune, distill, evaluate, ground or improve any artificial intelligence or machine learning model, dataset or retrieval index other than Everfur's;
+
+8. scrape, harvest, crawl, cache in bulk or systematically extract Output or other data from the Services, build any database from them, or retain Output except as a Partner Agreement permits;
+
+9. use Output outside the Licensee Application or for anyone other than the End User who requested it, except as a Partner Agreement permits;
+
+10. circumvent, disable or interfere with any Credential, entitlement check, rate limit, usage limit, attribution, security feature or other technological measure, or attempt to access any tenant, data or capability not provisioned for Licensee;
+
+11. run any penetration test, vulnerability scan, load test or other security test against the Services without Everfur's prior written authorization, although Licensee may report suspected vulnerabilities to security@everfur.com;
+
+12. publish or disclose the results of any benchmark, comparison, performance, security or functionality test of any Everfur Materials;
+
+13. remove, alter, obscure or misrepresent any proprietary notice, license header, attribution, clinical disclaimer, urgency banner or source indication included in or displayed by the Everfur Materials, or represent Output as a diagnosis or as advice from Licensee's own veterinarians or staff;
+
+14. disclose, share or embed any secret Credential in any client application, or use any Credential for any tenant, application or purpose other than the one for which Everfur issued it;
+
+15. combine, link or distribute any Everfur Materials with software in a manner that would subject them to the terms of any open source or copyleft license;
+
+16. attempt to reidentify any person or animal from deidentified data in any Everfur Materials;
+
+17. use any Everfur trademark, name or logo except as Everfur permits in writing, or register or use any mark, domain or handle confusingly similar to one;
+
+18. permit anyone other than Authorized Personnel to access nonpublic Everfur Materials; or
+
+19. use any Everfur Materials in violation of law, including laws governing veterinary practice, telemedicine, privacy, data protection, electronic communications, consumer protection and export control.
+
+AI coding assistants. Notwithstanding the Restrictions, Authorized Personnel may use AI coding assistants, including through the Everfur MCP server, solely to integrate the Licensee Application with the Services, provided Licensee turns on every available setting that prevents the assistant's provider from training on or retaining the Everfur Materials.
+
+Licensee will keep secret Credentials only in server environments under its control, will protect all Credentials with at least the care it uses for its own most sensitive credentials and no less than reasonable care, will notify Everfur at security@everfur.com within twenty four (24) hours after learning of any unauthorized access to or use of any Credential, the Services or other Everfur Materials, or of any breach of the Restrictions by any person, and will cooperate with Everfur's investigation. Everfur may rotate, revoke or suspend any Credential at any time. Licensee acknowledges that the Credentials and entitlement checks are technological measures that effectively control access to the Everfur Materials.
+
+The Everfur Materials are licensed, not sold. As between the parties, Everfur owns all right, title and interest, including all intellectual property rights, in and to the Everfur Materials, including Output except as a Partner Agreement expressly provides. The Everfur Materials contain trade secrets of Everfur. If Licensee or anyone acting for it creates any modification or derivative work of the Everfur Materials, whether or not permitted, Licensee assigns all rights in it to Everfur. All rights not expressly granted in this License are reserved, and no right or license is granted by implication, estoppel or otherwise.
+
+If Everfur writes or provides code, configuration or integration plans for the Licensee Application ("Integration Code"), Everfur owns the Integration Code to the extent it embodies or is derived from the Everfur Materials and licenses it to Licensee under this License. Licensee owns the Licensee Application and its preexisting code, excluding the Everfur Materials.
+
+The SDK in every form, the nonpublic portions of the Documentation, the Credentials and all nonpublic information about the Services, including their architecture, performance, models, roadmaps and pricing, are Everfur's confidential information. Distribution of the SDK in object code inside the Licensee Application does not make it public. Licensee will use Everfur's confidential information only to exercise its rights under this License, will disclose it only to Authorized Personnel and will protect it with at least reasonable care. Licensee may not use any of it on the basis that it was retained in the unaided memory of any person. If law requires disclosure, Licensee will give Everfur prompt notice and cooperate in seeking protection. These obligations last for five (5) years after this License ends and, for trade secrets, for as long as the information remains a trade secret.
+
+Everfur may use any suggestion, comment or other feedback from Licensee or its personnel for any purpose without restriction or compensation, and Licensee assigns to Everfur all rights in it.
+
+The SDK may include components licensed by third parties under open source licenses, identified in a notices file distributed with the SDK. Those licenses govern only those components. Nothing in this License restricts rights Licensee has under those licenses in those components, and nothing in those licenses grants any right in any other part of the Everfur Materials.
+
+Everfur may update, modify, deprecate or discontinue any part of the Everfur Materials, may change any capability of the Services for Licensee through server side configuration, and may require Licensee to install an update within the period stated in the Partner Agreement or, if none is stated, within thirty (30) days. Everfur may suspend any access immediately if Everfur believes Licensee has breached this License or that suspension is needed to protect the Services, End Users or third parties. Everfur has no support obligation except under a Partner Agreement.
+
+The SDK and the Services collect technical data about their use, such as version, platform, configuration, errors, performance, integration identifiers and request metadata. Everfur may use that data to provide, secure, support, improve and enforce the Everfur Materials, subject to the Partner Agreement's terms on End User data.
+
+On Everfur's written request, no more than once in any twelve month period unless Everfur reasonably suspects a breach, Licensee will within ten (10) days: (a) certify in writing, signed by an officer, that it complies with this License; (b) give Everfur a list of all Authorized Personnel who have accessed nonpublic Everfur Materials; and (c) give Everfur, or an independent auditor bound by confidentiality, reasonable access to the records, systems, code repositories and personnel needed to verify compliance with the Restrictions. If a verification reveals a breach, Licensee will reimburse Everfur's costs of the verification.
+
+Any use of the Everfur Materials beyond the scope of this License is unlicensed. Without limiting Everfur's other remedies, Licensee will pay Everfur for any unlicensed use at Everfur's then current list price for the corresponding use or, if there is none, at the highest price Everfur charged any customer for comparable use in the prior twelve months, from the date the unlicensed use began.
+
+This License begins when Licensee first accepts it or first downloads, installs, copies, accesses or uses any Everfur Materials, whichever is earlier. The evaluation license ends as stated above, and the production license ends when the Partner Agreement ends. This License terminates automatically, without notice, if Licensee breaches the Restrictions, Credentials and security or Confidentiality sections. Everfur may terminate this License (a) for any other breach that Licensee does not cure within ten (10) days after notice; (b) immediately on notice if Licensee or its parent undergoes a change of control involving a competitor of Everfur; or (c) immediately on notice if Licensee or any of its affiliates challenges the validity or ownership of any Everfur intellectual property.
+
+When this License or any license under it ends, all affected rights end. Licensee will immediately stop using the affected Everfur Materials, remove the SDK from the Licensee Application in its next release and in any event within thirty (30) days, delete all copies of the Everfur Materials, Credentials and Output in its possession or control except as a Partner Agreement expressly permits, and certify that deletion in writing, signed by an officer, within ten (10) days after Everfur requests it. End Users may keep copies of the Licensee Application already installed on their devices, but the Services may stop responding to them. The Restrictions, Ownership and reservation of rights, Integration code, Confidentiality, Feedback, Verification and audit, Unlicensed use, Effect of termination, Equitable relief and enforcement, Disclaimer of warranties, Limitation of liability, Indemnification, Governing law and disputes, Notices and General sections survive.
+
+Licensee agrees that any breach of the Restrictions, Credentials and security or Confidentiality sections will cause Everfur irreparable harm for which money damages are inadequate, and that Everfur is entitled to injunctive and other equitable relief to prevent or stop it, in any court of competent jurisdiction and without posting bond to the extent permitted by law, in addition to every other remedy. Licensee will reimburse Everfur's reasonable attorneys' fees and costs in any action or proceeding in which Everfur prevails in enforcing or defending this License.
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND EXCEPT AS EXPRESSLY STATED IN A PARTNER AGREEMENT, THE EVERFUR MATERIALS ARE PROVIDED "AS IS" AND "AS AVAILABLE", AND EVERFUR DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT. Output is not veterinary medical advice, diagnosis or treatment and is not a substitute for examination and care by a licensed veterinarian, except where a licensed veterinarian provides care through the Services under a Partner Agreement.
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, EVERFUR WILL NOT BE LIABLE UNDER THIS LICENSE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL, AND EVERFUR'S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THIS LICENSE WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US$100). Everfur's liability for the Services is governed solely by the Partner Agreement. Nothing in this License or any Partner Agreement limits Licensee's liability for breach of the Restrictions, Credentials and security or Confidentiality sections, for infringement or misappropriation of Everfur's intellectual property, for fees under the Unlicensed use section, or under the Indemnification section.
+
+Licensee will defend, indemnify and hold harmless Everfur and its officers, directors, employees and agents from and against all claims, losses, damages, liabilities, costs and expenses, including reasonable attorneys' fees, arising out of or relating to (a) the Licensee Application, excluding the unmodified Everfur Materials; (b) Licensee's presentation or use of Output; (c) any breach of this License by Licensee or its personnel; or (d) Licensee's violation of law.
+
+Licensee will comply with all applicable export control and sanctions laws and will not export, reexport or provide access to any Everfur Materials to any prohibited country, entity or person.
+
+The SDK is "commercial computer software" and the Documentation is "commercial computer software documentation" as those terms are used in 48 C.F.R. 12.212 and 48 C.F.R. 227.7202. U.S. government end users acquire only the rights set out in this License.
+
+This License is governed by the laws of the State of New York, without regard to its conflict of laws rules, and the United Nations Convention on Contracts for the International Sale of Goods does not apply. The state and federal courts located in New York County, New York have exclusive jurisdiction over any claim Licensee brings arising out of or relating to this License, and Licensee consents to personal jurisdiction there. Everfur may bring any claim or seek equitable relief in any court of competent jurisdiction. EACH PARTY WAIVES TRIAL BY JURY. Licensee will bring claims only in its individual capacity and not as a plaintiff or class member in any class or representative proceeding. Any claim by Licensee must be brought within one (1) year after it arises.
+
+Notices to Everfur must be sent by email to legal@everfur.com and by courier to Strand Health Inc. dba Everfur, 1002 Dean Street, Suite 101, Brooklyn, NY 11238, Attention: Legal. Suspected security vulnerabilities go to security@everfur.com. Everfur may give notice to Licensee through the partner console or the contact details Licensee provided there.
+
+Licensee may not assign or transfer this License, by operation of law, change of control or otherwise, without Everfur's prior written consent, and any attempt to do so is void. Everfur may assign this License freely. If any provision is held unenforceable, it will be reformed and enforced to the maximum extent permissible and the rest of this License remains in effect; in particular, if applicable law limits any restriction on reverse engineering, every other restriction remains in full force. No waiver is effective unless in writing, and no failure or delay in enforcing any right is a waiver. Acceptance by clicking or other electronic means is binding. This License and the Partner Agreement are the entire agreement between the parties about the Everfur Materials. The parties are independent contractors, and headings do not affect interpretation.

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,21 @@
+# Third-party notices
+
+The `@everfur/cli` bundles contain the third-party components listed below. Each component
+retains its own license; the full notices are reproduced here. The Everfur SDK License governs
+Everfur materials, not these third-party components.
+
+The list is derived from the esbuild input manifest: a conservative record of third-party
+source considered by the bundler. Later transforms may remove some of that code.
+
+This file is generated by `scripts/build-third-party-notices.mjs` from the installed dependency
+tree. Do not edit it by hand.
+
+## Summary
+
+| Package | Version | License |
+| --- | --- | --- |
+
+No third-party components are bundled into these files. Runtime dependencies are installed
+separately by npm and carry their own license and notices in their packages.
+
+---