open-agreements 0.7.7 → 0.8.0

package/node_modules/@xmldom/xmldom/lib/grammar.js

@@ -136,6 +136,11 @@ if (UNICODE_SUPPORT) {
 	// eslint-disable-next-line es5/no-unicode-code-point-escape
 	Char = reg('[', chars(Char), '\\u{10000}-\\u{10FFFF}', ']');
 }
+// Negation of Char: matches any character that is NOT a valid XML 1.0 Char.
+// Derived directly from the Char character class above (after the unicode-support extension).
+// XML 1.0 Char production [2]: #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]
+// @see https://www.w3.org/TR/xml/#NT-Char
+var InvalidChar = new RegExp('[^' + chars(Char) + ']', UNICODE_SUPPORT ? 'u' : '');
 
 var _SChar = /[\x20\x09\x0D\x0A]/;
 var SChar_s = chars(_SChar);
@@ -397,6 +402,12 @@ var ExternalID_match = reg(
 		regg(PUBLIC, S, '(?<PubidLiteral>', PubidLiteral, ')', S, '(?<SystemLiteral>', SystemLiteral, ')')
 	)
 );
+// Full-string anchored matcher for requireWellFormed serializer checks
+// https://w3c.github.io/DOM-Parsing/#xml-serializing-a-document-node
+var PubidLiteral_match = reg('^', PubidLiteral, '$');
+// Full-string anchored matcher for requireWellFormed serializer checks
+// https://w3c.github.io/DOM-Parsing/#xml-serializing-a-document-node
+var SystemLiteral_match = reg('^', SystemLiteral, '$');
 
 // https://www.w3.org/TR/xml11/#NT-NDataDecl
 // `[76] NDataDecl ::= S 'NDATA' S Name` [VC: Notation Declared]
@@ -520,6 +531,7 @@ exports.PEReference = PEReference;
 exports.PI = PI;
 exports.PUBLIC = PUBLIC;
 exports.PubidLiteral = PubidLiteral;
+exports.PubidLiteral_match = PubidLiteral_match;
 exports.QName = QName;
 exports.QName_exact = QName_exact;
 exports.QName_group = QName_group;
@@ -528,6 +540,8 @@ exports.SChar_s = SChar_s;
 exports.S_OPT = S_OPT;
 exports.SYSTEM = SYSTEM;
 exports.SystemLiteral = SystemLiteral;
+exports.SystemLiteral_match = SystemLiteral_match;
+exports.InvalidChar = InvalidChar;
 exports.UNICODE_REPLACEMENT_CHARACTER = UNICODE_REPLACEMENT_CHARACTER;
 exports.UNICODE_SUPPORT = UNICODE_SUPPORT;
 exports.XMLDecl = XMLDecl;

package/node_modules/@xmldom/xmldom/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xmldom/xmldom",
-	"version": "0.9.9",
+	"version": "0.9.10",
 	"description": "A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.",
 	"keywords": [
 		"w3c",
@@ -27,13 +27,16 @@
 		"index.d.ts",
 		"lib"
 	],
+	"config": {
+		"test_stack_size": 256
+	},
 	"scripts": {
 		"lint": "eslint examples lib test",
 		"format": "prettier --write examples lib test index.d.ts",
 		"format:check": "prettier --check examples lib test index.d.ts",
 		"changelog": "auto-changelog --unreleased-only",
 		"start": "nodemon --watch package.json --watch lib --watch test --exec 'npm --silent run test && npm --silent run lint'",
-		"test": "jest",
+		"test": "node --stack-size=$npm_package_config_test_stack_size ./node_modules/.bin/jest",
 		"fuzz": "jest --config=./jest.fuzz.config.js",
 		"test:types": "cd examples/typescript-node-es6 && ./pretest.sh 3 && ./pretest.sh 4 && ./pretest.sh 5 && node dist/index.js",
 		"testrelease": "npm test && eslint lib",
@@ -44,21 +47,21 @@
 		"node": ">=14.6"
 	},
 	"devDependencies": {
-		"@homer0/prettier-plugin-jsdoc": "10.0.0",
+		"@homer0/prettier-plugin-jsdoc": "10.0.1",
 		"auto-changelog": "2.5.0",
 		"eslint": "8.57.1",
 		"eslint-config-prettier": "10.1.8",
-		"eslint-plugin-anti-trojan-source": "1.1.1",
+		"eslint-plugin-anti-trojan-source": "1.1.2",
 		"eslint-plugin-es5": "1.5.0",
-		"eslint-plugin-n": "17.21.3",
-		"eslint-plugin-prettier": "5.5.4",
+		"eslint-plugin-n": "17.24.0",
+		"eslint-plugin-prettier": "5.5.5",
 		"get-stream": "6.0.1",
 		"jest": "29.7.0",
-		"nodemon": "3.1.10",
+		"nodemon": "3.1.14",
 		"np": "8.0.4",
-		"prettier": "3.6.2",
+		"prettier": "3.8.1",
 		"xmltest": "2.0.3",
-		"yauzl": "3.2.1"
+		"yauzl": "3.3.0"
 	},
 	"bugs": {
 		"url": "https://github.com/xmldom/xmldom/issues"
@@ -70,5 +73,5 @@
 		"tagPrefix": "",
 		"template": "./auto-changelog.hbs"
 	},
-	"packageManager": "npm@11.6.3+sha512.4085a763162e0e3acd19a4e9d23ad3aa0978e501ccf947dd7233c12a689ae0bb0190763c4ef12366990056b34eec438903ffed38fde4fbd722a17c2a7407ee92"
+	"packageManager": "npm@11.12.1+sha512.cdca14b85d647b3192028d02aadbe82d75f79a446aceea9874be98e6d768f20ebd3555770a48d0e9906106007877bbc690f715e9372f2e2dc644a3c3157fb14c"
 }

package/package.json

@@ -1,13 +1,12 @@
 {
   "name": "open-agreements",
-  "version": "0.7.7",
+  "version": "0.8.0",
   "workspaces": [
     "packages/allure-test-factory",
     "packages/contract-templates-mcp",
     "packages/contracts-workspace",
     "packages/contracts-workspace-mcp",
-    "packages/checklist-mcp",
-    "packages/signing"
+    "packages/checklist-mcp"
   ],
   "description": "Open-source legal template filling CLI and library",
   "repository": {
@@ -93,8 +92,8 @@
     "build:arp-manifest": "node scripts/build-wellknown-ai-index.cjs",
     "sign:arp-manifest": "node scripts/sign-manifest.cjs",
     "prepare": "npm run build",
-    "report:allure": "rm -rf ./allure-report && npx allure awesome ./allure-results --output ./allure-report --group-by epic,feature,story && node scripts/patch_allure_html_sanitizer.mjs --report-dir ./allure-report",
-    "report:allure:open": "npx allure open ./allure-report",
+    "report:allure": "rm -rf ./allure-report && allure awesome ./allure-results --output ./allure-report --group-by epic,feature,story && node scripts/patch_allure_html_sanitizer.mjs --report-dir ./allure-report",
+    "report:allure:open": "allure open ./allure-report",
     "allure:deploy": "node scripts/deploy_allure_report.mjs",
     "allure:summary:export": "node scripts/export_allure_summary.mjs",
     "export:system-card-runtime": "node scripts/export_allure_summary.mjs",
@@ -138,9 +137,9 @@
     "evidence-collection"
   ],
   "author": "UseJunior <steven@usejunior.com>",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "dependencies": {
-    "@usejunior/docx-core": ">=0.7.0",
+    "@usejunior/docx-core": "^0.12.0",
     "@xmldom/xmldom": "^0.9.9",
     "adm-zip": "^0.5.16",
     "canonicalize": "^2.1.0",
@@ -160,6 +159,7 @@
     "@types/node": "^22.13.0",
     "@usejunior/allure-test-factory": "*",
     "@vitest/coverage-v8": "^3.2.4",
+    "allure": "^3.7.0",
     "allure-vitest": "^3.4.5",
     "docx": "^9.5.1",
     "jszip": "^3.10.1",

package/server.json

@@ -3,13 +3,13 @@
   "name": "io.github.open-agreements/open-agreements",
   "title": "Open Agreements",
   "description": "Fill standard legal agreement templates (NDAs, SAFEs, NVCA docs, employment) as DOCX files.",
-  "version": "0.5.0",
+  "version": "0.8.0",
   "websiteUrl": "https://openagreements.org",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@open-agreements/contract-templates-mcp",
-      "version": "0.5.0",
+      "version": "0.8.0",
       "transport": { "type": "stdio" },
       "runtimeHint": "npx",
       "environmentVariables": []
@@ -26,6 +26,6 @@
     "source": "github",
     "id": "open-agreements/open-agreements"
   },
-  "license": "MIT",
+  "license": "Apache-2.0",
   "tags": ["legal", "contracts", "templates", "docx", "nda", "safe", "nvca", "employment"]
 }

package/skills/{cloud-service-agreement → agreements/cloud-service-agreement}/SKILL.md

@@ -7,13 +7,13 @@ description: >-
   standard forms. Use when user says "SaaS agreement," "cloud contract,"
   "MSA," "order form," "software license," "pilot agreement," or "design
   partner agreement."
-license: MIT
+license: Apache-2.0
 compatibility: >-
   Works with any agent. Remote MCP requires no local dependencies.
   Local CLI requires Node.js >=20.
 metadata:
   author: open-agreements
-  version: "0.2.1"
+  version: "0.2.2"
 catalog_group: Agreement Drafting And Filling
 catalog_order: 30
 ---

package/skills/{nda → agreements/cloud-service-agreement}/template-filling-execution.md

@@ -1,6 +1,6 @@
 # Template Filling Execution Workflow
 
-Standard 6-step workflow shared by all template-filling skills. Each skill's SKILL.md provides skill-specific details (template options and example values) that plug into these steps.
+Standard 6-step workflow shared by all template-filling skills. Each skill's SKILL.md provides skill-specific details (template options and example values) that plug into these steps. Each skill carries its own copy of this file so the published bundle stays self-contained; CI enforces that all copies are identical, so edit them together.
 
 > **Interactivity note**: Always ask the user for missing inputs.
 > If your agent has an `AskUserQuestion` tool (Claude Code, Cursor, etc.),
@@ -86,7 +86,7 @@ Generate a markdown preview using the collected values. Label clearly as `PREVIE
 
 Report the output (download URL or file path) to the user. Remind them to review the document before signing.
 
-If Local CLI was used, clean up:
+If Local CLI was used, the `trap` from Step 4 removes the values file on shell exit; remove it sooner with:
 ```bash
 rm -f "$VALUES_FILE"
 ```

package/skills/{data-privacy-agreement → agreements/data-privacy-agreement}/SKILL.md

@@ -5,14 +5,15 @@ description: >-
   agreement, GDPR, HIPAA BAA, business associate agreement, AI addendum.
   Produces signable DOCX files from Common Paper standard forms. Use when user
   says "DPA," "data processing agreement," "HIPAA BAA," "business associate
-  agreement," or "AI addendum."
-license: MIT
+  agreement," or "AI addendum." To understand a U.S. state's consumer privacy
+  law (CCPA etc.) rather than draft, see data-privacy-law-explainer.
+license: Apache-2.0
 compatibility: >-
   Works with any agent. Remote MCP requires no local dependencies.
   Local CLI requires Node.js >=20.
 metadata:
   author: open-agreements
-  version: "0.2.0"
+  version: "0.2.2"
 catalog_group: Agreement Drafting And Filling
 catalog_order: 60
 ---
@@ -40,7 +41,7 @@ Use this skill when the user wants to:
 
 ## Execution
 
-Follow the [standard template-filling workflow](../shared/template-filling-execution.md) with these skill-specific details:
+Follow the [standard template-filling workflow](template-filling-execution.md) with these skill-specific details:
 
 ### Template options
 
@@ -74,6 +75,16 @@ Help the user choose the right data privacy template:
 
 Use `list_templates` (MCP) or `list --json` (CLI) for the latest inventory and field definitions.
 
+## See also
+
+- To **understand a U.S. state's consumer privacy law** before (or instead of)
+  drafting — who the CCPA/TDPSA/VCDPA-style acts cover, privacy-policy duties,
+  consumer rights, private rights of action, and who enforces — use the
+  OpenAgreements explainer skill. To avoid look-alike skills from other
+  publishers, identify it by its full package path, not the bare name:
+  `open-agreements/open-agreements@data-privacy-law-explainer`
+  (install: `npx skills add open-agreements/open-agreements`).
+
 ## Notes
 
 - All templates produce Word DOCX files preserving original formatting

package/skills/{safe → agreements/data-privacy-agreement}/template-filling-execution.md

@@ -1,6 +1,6 @@
 # Template Filling Execution Workflow
 
-Standard 6-step workflow shared by all template-filling skills. Each skill's SKILL.md provides skill-specific details (template options and example values) that plug into these steps.
+Standard 6-step workflow shared by all template-filling skills. Each skill's SKILL.md provides skill-specific details (template options and example values) that plug into these steps. Each skill carries its own copy of this file so the published bundle stays self-contained; CI enforces that all copies are identical, so edit them together.
 
 > **Interactivity note**: Always ask the user for missing inputs.
 > If your agent has an `AskUserQuestion` tool (Claude Code, Cursor, etc.),
@@ -52,15 +52,21 @@ Group fields by `section`. Ask the user for values in rounds of up to 4 question
 
 **If Remote MCP:** Collect values into a JSON object to pass to `fill_template`.
 
-**If Local CLI:** Write values to a temporary JSON file:
+**If Local CLI:** Write values to a per-run temporary JSON file with restrictive permissions:
 ```bash
-cat > /tmp/oa-values.json << 'FIELDS'
+VALUES_FILE="$(mktemp /tmp/oa-values.XXXXXX.json)"
+chmod 600 "$VALUES_FILE"
+trap 'rm -f "$VALUES_FILE"' EXIT
+
+cat > "$VALUES_FILE" << 'FIELDS'
 {
   "field_name": "value"
 }
 FIELDS
 ```
 
+Do not reuse a shared temp filename for confidential values.
+
 ## Step 5: Render DOCX
 
 **If Remote MCP:**
@@ -68,7 +74,7 @@ Use the `fill_template` tool with the template name and collected values. The se
 
 **If Local CLI:**
 ```bash
-open-agreements fill <template-name> -d /tmp/oa-values.json -o <output-name>.docx
+open-agreements fill <template-name> -d "$VALUES_FILE" -o <output-name>.docx
 ```
 
 **If Preview Only:**
@@ -80,9 +86,9 @@ Generate a markdown preview using the collected values. Label clearly as `PREVIE
 
 Report the output (download URL or file path) to the user. Remind them to review the document before signing.
 
-If Local CLI was used, clean up:
+If Local CLI was used, the `trap` from Step 4 removes the values file on shell exit; remove it sooner with:
 ```bash
-rm /tmp/oa-values.json
+rm -f "$VALUES_FILE"
 ```
 
 ## Bespoke edits (beyond template fields)

package/skills/{employment-contract → agreements/employment-contract}/SKILL.md

@@ -9,13 +9,13 @@ description: >-
   someone," "new hire paperwork," or "onboarding paperwork." To explain
   non-compete or restrictive-covenant law rather than draft a document, see the
   non-compete-contract-explainer skill.
-license: MIT
+license: Apache-2.0
 compatibility: >-
   Works with any agent. Remote MCP requires no local dependencies.
   Local CLI requires Node.js >=20.
 metadata:
   author: open-agreements
-  version: "0.3.0"
+  version: "0.3.1"
 catalog_group: Agreement Drafting And Filling
 catalog_order: 50
 ---
@@ -43,7 +43,7 @@ Use this skill when the user wants to:
 
 ## Execution
 
-Follow the [standard template-filling workflow](../shared/template-filling-execution.md) with these skill-specific details:
+Follow the [standard template-filling workflow](template-filling-execution.md) with these skill-specific details:
 
 ### Template options
 

package/skills/{cloud-service-agreement → agreements/employment-contract}/template-filling-execution.md

@@ -1,6 +1,6 @@
 # Template Filling Execution Workflow
 
-Standard 6-step workflow shared by all template-filling skills. Each skill's SKILL.md provides skill-specific details (template options and example values) that plug into these steps.
+Standard 6-step workflow shared by all template-filling skills. Each skill's SKILL.md provides skill-specific details (template options and example values) that plug into these steps. Each skill carries its own copy of this file so the published bundle stays self-contained; CI enforces that all copies are identical, so edit them together.
 
 > **Interactivity note**: Always ask the user for missing inputs.
 > If your agent has an `AskUserQuestion` tool (Claude Code, Cursor, etc.),
@@ -52,15 +52,21 @@ Group fields by `section`. Ask the user for values in rounds of up to 4 question
 
 **If Remote MCP:** Collect values into a JSON object to pass to `fill_template`.
 
-**If Local CLI:** Write values to a temporary JSON file:
+**If Local CLI:** Write values to a per-run temporary JSON file with restrictive permissions:
 ```bash
-cat > /tmp/oa-values.json << 'FIELDS'
+VALUES_FILE="$(mktemp /tmp/oa-values.XXXXXX.json)"
+chmod 600 "$VALUES_FILE"
+trap 'rm -f "$VALUES_FILE"' EXIT
+
+cat > "$VALUES_FILE" << 'FIELDS'
 {
   "field_name": "value"
 }
 FIELDS
 ```
 
+Do not reuse a shared temp filename for confidential values.
+
 ## Step 5: Render DOCX
 
 **If Remote MCP:**
@@ -68,7 +74,7 @@ Use the `fill_template` tool with the template name and collected values. The se
 
 **If Local CLI:**
 ```bash
-open-agreements fill <template-name> -d /tmp/oa-values.json -o <output-name>.docx
+open-agreements fill <template-name> -d "$VALUES_FILE" -o <output-name>.docx
 ```
 
 **If Preview Only:**
@@ -80,9 +86,9 @@ Generate a markdown preview using the collected values. Label clearly as `PREVIE
 
 Report the output (download URL or file path) to the user. Remind them to review the document before signing.
 
-If Local CLI was used, clean up:
+If Local CLI was used, the `trap` from Step 4 removes the values file on shell exit; remove it sooner with:
 ```bash
-rm /tmp/oa-values.json
+rm -f "$VALUES_FILE"
 ```
 
 ## Bespoke edits (beyond template fields)

package/skills/{nda → agreements/nda}/SKILL.md

@@ -5,13 +5,13 @@ description: >-
   agreement. Produces signable DOCX files from Common Paper and Bonterms
   standard forms. Use when user says "NDA," "non-disclosure agreement,"
   "confidentiality agreement," "mutual NDA," or "one-way NDA."
-license: MIT
+license: Apache-2.0
 compatibility: >-
   Works with any agent. Remote MCP requires no local dependencies.
   Local CLI requires Node.js >=20.
 metadata:
   author: open-agreements
-  version: "0.2.2"
+  version: "0.2.3"
 catalog_group: Agreement Drafting And Filling
 catalog_order: 20
 ---

package/skills/{open-agreements → agreements/nda}/template-filling-execution.md

@@ -1,6 +1,6 @@
 # Template Filling Execution Workflow
 
-Standard 6-step workflow shared by all template-filling skills. Each skill's SKILL.md provides skill-specific details (template options and example values) that plug into these steps.
+Standard 6-step workflow shared by all template-filling skills. Each skill's SKILL.md provides skill-specific details (template options and example values) that plug into these steps. Each skill carries its own copy of this file so the published bundle stays self-contained; CI enforces that all copies are identical, so edit them together.
 
 > **Interactivity note**: Always ask the user for missing inputs.
 > If your agent has an `AskUserQuestion` tool (Claude Code, Cursor, etc.),
@@ -52,15 +52,21 @@ Group fields by `section`. Ask the user for values in rounds of up to 4 question
 
 **If Remote MCP:** Collect values into a JSON object to pass to `fill_template`.
 
-**If Local CLI:** Write values to a temporary JSON file:
+**If Local CLI:** Write values to a per-run temporary JSON file with restrictive permissions:
 ```bash
-cat > /tmp/oa-values.json << 'FIELDS'
+VALUES_FILE="$(mktemp /tmp/oa-values.XXXXXX.json)"
+chmod 600 "$VALUES_FILE"
+trap 'rm -f "$VALUES_FILE"' EXIT
+
+cat > "$VALUES_FILE" << 'FIELDS'
 {
   "field_name": "value"
 }
 FIELDS
 ```
 
+Do not reuse a shared temp filename for confidential values.
+
 ## Step 5: Render DOCX
 
 **If Remote MCP:**
@@ -68,7 +74,7 @@ Use the `fill_template` tool with the template name and collected values. The se
 
 **If Local CLI:**
 ```bash
-open-agreements fill <template-name> -d /tmp/oa-values.json -o <output-name>.docx
+open-agreements fill <template-name> -d "$VALUES_FILE" -o <output-name>.docx
 ```
 
 **If Preview Only:**
@@ -80,9 +86,9 @@ Generate a markdown preview using the collected values. Label clearly as `PREVIE
 
 Report the output (download URL or file path) to the user. Remind them to review the document before signing.
 
-If Local CLI was used, clean up:
+If Local CLI was used, the `trap` from Step 4 removes the values file on shell exit; remove it sooner with:
 ```bash
-rm /tmp/oa-values.json
+rm -f "$VALUES_FILE"
 ```
 
 ## Bespoke edits (beyond template fields)

package/skills/{open-agreements → agreements/open-agreements}/SKILL.md

@@ -2,28 +2,27 @@
 name: open-agreements
 description: >-
   Fill standard legal agreement templates (NDAs, cloud service agreements, SAFEs)
-  and produce signable DOCX files. Supports Common Paper, Bonterms, and
+  and produce filled DOCX files. Supports Common Paper, Bonterms, and
   Y Combinator templates. Use when the user needs to draft a legal agreement,
   create an NDA, fill a contract template, or generate a SAFE.
-  Can also send agreements for electronic signature via DocuSign.
-license: MIT
+license: Apache-2.0
 homepage: https://github.com/open-agreements/open-agreements
 compatibility: >-
   Two execution paths: (1) Remote MCP at openagreements.org (template fill
   happens server-side, your data is sent to the hosted service); (2) Local
   CLI via npm (`npm install -g open-agreements@0.7.4`) — template fill is
-  fully local with no third-party data transfer except DocuSign at signing
-  time. Use the CLI path for guaranteed offline behavior.
+  fully local with no third-party data transfer. Use the CLI path for
+  guaranteed offline behavior.
 metadata:
   author: open-agreements
-  version: "0.2.3"
+  version: "0.2.4"
 catalog_group: Agreement Drafting And Filling
 catalog_order: 10
 ---
 
 # open-agreements
 
-Fill standard legal agreement templates, produce signable DOCX files, and send for electronic signature via DocuSign.
+Fill standard legal agreement templates and produce filled DOCX files.
 
 ## Activation
 
@@ -31,15 +30,7 @@ Use this skill when the user wants to:
 - Draft an NDA, confidentiality agreement, or cloud service agreement
 - Generate a SAFE (Simple Agreement for Future Equity) for a startup investment
 - Fill a legal template with their company details
-- Generate a signable DOCX from a standard form
-- Send a filled agreement for electronic signature via DocuSign
-
-## CRITICAL: DocuSign and Authentication
-
-- **Open Agreements handles DocuSign OAuth automatically.** Do NOT ask the user for a DocuSign API key or integration key.
-- **Do NOT tell the user to install or configure DocuSign separately.** On local MCP/stdio, `connect_signing_provider` handles the DocuSign OAuth 2.0 + PKCE flow. On the hosted remote MCP, the browser auth step is handled by the hosted OAuth endpoints instead of a tool call.
-- **Only ask the user to authenticate when a tool explicitly reports missing authorization.** Do not preemptively ask for credentials.
-- **Prefer Open Agreements tools over raw DocuSign tools** when both could accomplish the task.
+- Generate a filled DOCX from a standard form
 
 ## Execution — MCP Tools (Preferred)
 
@@ -47,8 +38,6 @@ If the Open Agreements MCP server is connected (remote or local), use these tool
 
 **Remote MCP URL:** `https://openagreements.org/api/mcp`
 
-**Transport note:** `connect_signing_provider` is local-MCP-only. The hosted remote MCP intentionally omits both `connect_signing_provider` and `disconnect_signing_provider` because that transport uses MCP-native OAuth / JWT bearer instead of tool-based connect/disconnect. Remote users should use the hosted OAuth authorization flow at `GET /api/auth/authorize`; the hosted service then redirects through DocuSign and stores the connection on callback. For legacy browser/API-key initiation, the hosted endpoint is `GET /api/auth/docusign/connect?key=<open_agreements_api_key>`. Remote disconnect is handled by `POST /api/auth/revoke`.
-
 ### Available MCP Tools
 
 | Tool | Purpose |
@@ -56,9 +45,6 @@ If the Open Agreements MCP server is connected (remote or local), use these tool
 | `list_templates` | List available templates as a paginated compact catalog (`template_id`, `display_name`, `category`, `description`, `field_count`, `priority_field_count`). Pages with `cursor` + `limit` (default 25, max 100). |
 | `get_template` | Get full field metadata for a specific template |
 | `fill_template` | Fill a template with values and return a downloadable DOCX |
-| `connect_signing_provider` | Local MCP only. Connect DocuSign via OAuth by returning a hosted URL for the user to open in a browser |
-| `send_for_signature` | Send a filled DOCX for e-signature via DocuSign |
-| `check_signature_status` | Check signing status and download signed PDF when complete |
 
 ### MCP Workflow
 
@@ -67,8 +53,6 @@ If the Open Agreements MCP server is connected (remote or local), use these tool
 3. **Collect field values:** Ask the user for values based on the field definitions. Use defaults where the user doesn't specify.
 4. **Fill template:** Call `fill_template` with the template ID and values. Returns a download URL for the DOCX.
 5. **User reviews document:** Present the download link. Wait for the user to confirm the document looks good.
-6. **Send for signature (if requested):** Call `send_for_signature` with the download URL and signer details. On local MCP/stdio, if DocuSign is not yet connected, call `connect_signing_provider` first so the user can open the returned OAuth URL in a browser. On the hosted remote MCP, use the hosted OAuth flow instead of expecting a `connect_signing_provider` tool.
-7. **Check status:** Call `check_signature_status` to monitor the envelope.
 
 ## Confirm-before-signing fields (statutory compliance representations)
 
@@ -128,14 +112,14 @@ Clean up: `rm /tmp/oa-values.json`
 
 ## Source Code and Audit
 
-Open Agreements is fully open source (MIT license). Review the complete source before installing:
+Open Agreements is fully open source (Apache-2.0 license). Review the complete source before installing:
 
 - **GitHub**: https://github.com/open-agreements/open-agreements
 - **npm registry**: https://www.npmjs.com/package/open-agreements
 - **Remote MCP**: https://openagreements.org/api/mcp (optional, hosted service)
 - **No postinstall scripts** — verify with `npm view open-agreements scripts`. The package declares no `postinstall`, `preinstall`, or `install` hooks. The `prepare` script only runs when installing from a git URL, not from the npm registry.
 
-All template field definitions, fill logic, and DocuSign integration code are auditable in the repository.
+All template field definitions and fill logic are auditable in the repository.
 
 ### A note on versions
 
@@ -152,12 +136,11 @@ Open Agreements has three distinct network postures depending on which execution
 
 | Path | Install-time network | Runtime network |
 |------|---------------------|----------------|
-| **Pinned global install** (`npm install -g open-agreements@0.7.4`) | One-time fetch from `registry.npmjs.org` | None for `list`/`fill`. DocuSign API only at signing time. |
+| **Pinned global install** (`npm install -g open-agreements@0.7.4`) | One-time fetch from `registry.npmjs.org` | None for `list`/`fill`. |
 | **Pinned npx** (`npx -y open-agreements@0.7.4`) | Fetch from `registry.npmjs.org` on first run, cached afterward | Same as above |
-| **Remote MCP** (`https://openagreements.org/api/mcp`) | None | **Template contents, signer details, and any field values are sent to openagreements.org.** Use only if you accept transmitting these values to the hosted service. |
-| **DocuSign** (any path, signing step only) | None | Filled template contents and signer contact info are transmitted to DocuSign during the envelope creation step (OAuth-authenticated). |
+| **Remote MCP** (`https://openagreements.org/api/mcp`) | None | **Template contents and any field values are sent to openagreements.org.** Use only if you accept transmitting these values to the hosted service. |
 
-**Use the local CLI path** (global or npx) if you need guaranteed offline behavior with no third-party data transfer beyond DocuSign at signing time.
+**Use the local CLI path** (global or npx) if you need guaranteed offline behavior with no third-party data transfer.
 
 ## Offline / Pinned Installation
 
@@ -186,7 +169,7 @@ Never use `@latest` — it pulls a fresh package on every cache miss and can int
 
 ## Shared Execution Reference
 
-For the full template-filling workflow (applicable to all agreement skills), see [template-filling-execution.md](../shared/template-filling-execution.md).
+For the full template-filling workflow (applicable to all agreement skills), see [template-filling-execution.md](template-filling-execution.md).
 
 ## Notes