@fluid-app/fluid-cli-payments 0.0.0-stage → 0.1.1

package/dist/index.mjs

@@ -0,0 +1,1922 @@
+import prompts from "prompts";
+import { NAV_HELP, assertInteractive, createDomainCommand, terminalPrompter } from "@fluid-app/fluid-cli";
+import { readFile } from "node:fs/promises";
+import { basename, extname } from "node:path";
+//#region src/fields.ts
+const STEPS = [
+	{
+		id: "business-type",
+		name: "The Basics"
+	},
+	{
+		id: "business-info",
+		name: "Business Info"
+	},
+	{
+		id: "legal-entities",
+		name: "Legal Entities"
+	},
+	{
+		id: "bank-accounts",
+		name: "Bank Accounts"
+	},
+	{
+		id: "personal-info",
+		name: "Personal Info"
+	},
+	{
+		id: "relevant-persons",
+		name: "Relevant Persons"
+	},
+	{
+		id: "countries",
+		name: "Countries"
+	},
+	{
+		id: "underwriting",
+		name: "Underwriting"
+	},
+	{
+		id: "terms-and-conditions",
+		name: "Terms & Conditions"
+	}
+];
+const f = (key, type, label, step, required = "always", extra = {}) => ({
+	key,
+	group: key.split(".")[0],
+	type,
+	label,
+	required,
+	step,
+	...extra
+});
+const MLM = "underwriting.company_is_mlm is true";
+const HEALTH = "underwriting.sells_health_supplements is true";
+const INGREDIENTS = [
+	["kratom", "Kratom"],
+	["ephedra", "Ephedra"],
+	["cannabis", "Cannabis"],
+	["cbd", "CBD"],
+	["aristolochia", "Aristolochia"],
+	["germanium", "Germanium"]
+];
+const DISEASE_CLAIMS = [
+	["cancer", "cancer"],
+	["impotency", "impotency"],
+	["alzheimers", "Alzheimer's"],
+	["memory_loss", "memory loss"]
+];
+const FIELDS = [
+	f("info.beneficial_individual_owner", "boolean", "Does any individual own 25% or more of the business?", "business-type"),
+	f("info.user_is_owner", "boolean", "Are you one of those owners?", "business-type", "conditional", { when: "info.beneficial_individual_owner is true" }),
+	f("info.beneficial_business_owner", "boolean", "Does another business own 25% or more of the business?", "business-type"),
+	f("info.other_legal_entities", "boolean", "Does the business operate through more than one legal entity?", "business-type"),
+	f("info.user_has_authority", "boolean", "Are you authorised to act for the business?", "business-type"),
+	f("info.user_is_signatory", "boolean", "Are you an authorised signatory?", "business-type"),
+	f("info.operates_internationally", "boolean", "Does the business sell outside its home country?", "business-type", "optional"),
+	f("info.business_structure_complexity", "enum", "Ownership structure", "business-type", "optional", { options: ["simple", "complex"] }),
+	f("underwriting.company_is_mlm", "boolean", "Is the business a direct-sales (MLM) company? Turns on the MLM questions.", "business-type", "optional"),
+	f("entity.legal_name", "string", "Legal company name", "business-info"),
+	f("entity.trading_name", "string", "Trading (DBA) name", "business-info", "optional"),
+	f("entity.classification", "business_type", "Business type, from `options business-types`", "business-info"),
+	f("entity.business_identification_number", "string", "Business tax ID: EIN in the US, VAT ID in VAT countries", "business-info", "always", { sensitive: true }),
+	f("entity.registration_number", "string", "Business registration number", "business-info"),
+	f("entity.date_of_incorporation", "date", "Date of incorporation (YYYY-MM-DD)", "business-info"),
+	f("entity.phone", "phone", "Business phone, at least 8 digits", "business-info"),
+	f("entity.phone_country_code", "string", "Phone country code, e.g. +1", "business-info", "optional"),
+	f("entity.website", "url", "Website, starting with http:// or https://", "business-info"),
+	f("entity.primary_mcc", "mcc", "Primary merchant category code, from `options mcc-codes`", "business-info"),
+	f("entity.secondary_mcc", "mcc", "Secondary merchant category code", "business-info", "optional"),
+	f("entity.address1", "string", "Registered street address", "business-info"),
+	f("entity.address2", "string", "Registered address line 2", "business-info", "optional"),
+	f("entity.city", "string", "Registered city", "business-info"),
+	f("entity.province", "string", "Registered state or province", "business-info"),
+	f("entity.postal_code", "string", "Registered postal code", "business-info"),
+	f("entity.country_iso", "country", "Registered country (ISO code, e.g. US)", "business-info"),
+	f("entity.business_registration_certificate", "file", "Business registration certificate", "business-info"),
+	f("entity.business_license", "file", "Business license", "business-info"),
+	f("entity.articles_of_incorporation", "file", "Articles of incorporation", "business-info"),
+	f("entity.w_9", "file", "IRS form W-9", "business-info", "conditional", { when: "entity.country_iso is US" }),
+	f("entity.last_3_months_processing_statements", "files", "Last three months of card processing statements", "business-info", "optional"),
+	f("bank.bank_name", "string", "Bank name", "bank-accounts"),
+	f("bank.holder_name", "string", "Account holder name", "bank-accounts"),
+	f("bank.account_number", "string", "Account number or IBAN", "bank-accounts", "always", { sensitive: true }),
+	f("bank.routing_number", "string", "Routing number", "bank-accounts", "conditional", {
+		when: "bank.country_iso is US",
+		sensitive: true
+	}),
+	f("bank.swift_bic", "string", "SWIFT/BIC code", "bank-accounts", "conditional", { when: "bank.country_iso is not US" }),
+	f("bank.country_iso", "country", "Bank country (ISO code)", "bank-accounts"),
+	f("bank.currency_iso", "currency", "Account currency (ISO code, e.g. USD)", "bank-accounts"),
+	f("bank.city", "string", "Bank city", "bank-accounts"),
+	f("bank.entity_id", "number", "Legal entity the account belongs to (defaults to the primary entity)", "bank-accounts", "optional"),
+	f("bank.last_3_months_bank_statements", "files", "Last three months of bank statements", "bank-accounts"),
+	f("bank.bank_letter_or_voided_check", "file", "Bank letter or voided check", "bank-accounts"),
+	f("owner.full_name", "string", "Full legal name", "personal-info"),
+	f("owner.work_email", "email", "Work email", "personal-info"),
+	f("owner.date_of_birth", "date", "Date of birth (YYYY-MM-DD)", "personal-info", "always", { sensitive: true }),
+	f("owner.place_of_birth", "string", "Place of birth", "personal-info"),
+	f("owner.nationality", "country", "Nationality (ISO code)", "personal-info"),
+	f("owner.country_iso", "country", "Country of residence (ISO code)", "personal-info"),
+	f("owner.street_address", "string", "Home street address", "personal-info"),
+	f("owner.city", "string", "Home city", "personal-info"),
+	f("owner.state", "string", "Home state or province", "personal-info"),
+	f("owner.postcode", "string", "Home postcode", "personal-info"),
+	f("owner.phone", "phone", "Phone", "personal-info"),
+	f("owner.identification_number", "string", "Personal ID number (SSN in the US)", "personal-info", "always", { sensitive: true }),
+	f("owner.position", "string", "Job title", "personal-info"),
+	f("owner.native_name", "string", "Name in native script", "personal-info", "optional"),
+	f("owner.is_managing_director", "boolean", "Managing director", "relevant-persons", "optional"),
+	f("owner.is_beneficial_owner", "boolean", "Owns 25% or more", "relevant-persons", "optional"),
+	f("owner.percent_ownership", "percent", "Ownership percentage, 25 or more for a beneficial owner", "relevant-persons", "conditional", { when: "owner.is_beneficial_owner is true" }),
+	f("owner.is_authorized_signatory", "boolean", "Authorised signatory", "relevant-persons", "optional"),
+	f("owner.onboarding_contact", "boolean", "The person filling in the form (one per company)", "personal-info", "optional"),
+	f("owner.entity_id", "number", "Legal entity the person belongs to (defaults to the primary entity)", "relevant-persons", "optional"),
+	f("owner.government_issued_ids", "files", "Government ID: passport photo page, or the front and back of a driver's license or national ID. Pass --id-type.", "personal-info"),
+	f("owner.proof_of_residence", "file", "Proof of residence, such as a utility bill", "personal-info"),
+	f("country.<ISO>.currency", "currency", "Currency customers pay in for that country", "countries"),
+	f("country.<ISO>.settlement_currency", "currency", "Currency payouts settle in", "countries"),
+	f("country.<ISO>.entity_id", "number", "Legal entity that sells in that country (defaults to the primary entity)", "countries"),
+	f("country.<ISO>.entity_legally_registered", "boolean", "The entity is legally registered to sell there; must be true", "countries"),
+	f("underwriting.company_description", "text", "What the company does", "underwriting"),
+	f("underwriting.management_stability", "text", "How long the management team has been in place", "underwriting"),
+	f("underwriting.uses_third_party_accounting", "yes_no", "Uses a third-party accounting firm (Yes - firm name / No)", "underwriting"),
+	f("underwriting.financials_audited", "boolean", "Financial statements are audited (true or false). The six financial statements are required either way.", "underwriting"),
+	f("underwriting.projected_annual_sales_volume", "number", "Projected annual sales volume", "underwriting"),
+	f("underwriting.average_order_value", "number", "Average order value", "underwriting"),
+	f("underwriting.cit_share_percentage", "percent", "% of sales that are one-time purchases (CIT); CIT + MIT = 100", "underwriting"),
+	f("underwriting.mit_share_percentage", "percent", "% of sales that are subscriptions (MIT); CIT + MIT = 100", "underwriting"),
+	f("underwriting.balance_sheet_year1", "file", "Balance sheet, most recent year", "underwriting"),
+	f("underwriting.balance_sheet_year2", "file", "Balance sheet, previous year", "underwriting"),
+	f("underwriting.income_statement_year1", "file", "Income statement, most recent year", "underwriting"),
+	f("underwriting.income_statement_year2", "file", "Income statement, previous year", "underwriting"),
+	f("underwriting.cash_flow_year1", "file", "Cash flow statement or P&L, most recent year", "underwriting"),
+	f("underwriting.cash_flow_year2", "file", "Cash flow statement or P&L, previous year", "underwriting"),
+	f("underwriting.has_compliance_officer", "yes_no", "Has a compliance officer (Yes - name / No)", "underwriting"),
+	f("underwriting.compliance_officer_responsibilities", "text", "The compliance officer's responsibilities", "underwriting"),
+	f("underwriting.distributor_monitoring_policies", "text", "How the company monitors its members' activity", "underwriting"),
+	f("underwriting.suspicious_activity_escalation_process", "text", "How suspicious activity is escalated", "underwriting"),
+	f("underwriting.retains_outside_legal_counsel", "yes_no", "Retains outside legal counsel (Yes - firm / No)", "underwriting"),
+	f("underwriting.investigations_description", "text", "Past or current regulatory investigations, or \"None\"", "underwriting"),
+	f("underwriting.negative_media_events", "text", "Negative media coverage, or \"None\"", "underwriting"),
+	f("underwriting.bbb_rating", "string", "Better Business Bureau rating, or \"N/A\"", "underwriting"),
+	f("underwriting.trustpilot_rating", "string", "Trustpilot rating, or \"N/A\"", "underwriting"),
+	f("underwriting.terms_and_conditions", "link_or_file", "Storefront terms & conditions: a URL (.link) or a file", "underwriting"),
+	f("underwriting.refund_or_return_policy", "link_or_file", "Refund or return policy: a URL (.link) or a file", "underwriting"),
+	f("underwriting.privacy_policy", "link_or_file", "Privacy policy: a URL (.link) or a file", "underwriting"),
+	f("underwriting.mlm_ownership_structure", "text", "How the business is owned and controlled", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.mlm_ownership_structure_file", "file", "Ownership chart", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.commission_payment_method", "text", "How commissions are paid", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.commission_payment_channels", "text", "Channels commissions are paid through", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.commission_payment_countries", "text", "Countries commissions are paid in", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.compensation_plan", "files", "Compensation plan", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.recruiter_commission_for_recruiting", "yes_no", "Members earn commission just for recruiting (Yes - details / No)", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.all_distributors_can_profit", "yes_no", "Every member can profit (Yes / No - details)", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.provides_average_compensation_report", "yes_no", "Publishes an average compensation report (Yes / No)", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.income_disclosure_statement", "link_or_file", "Income disclosure statement", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.distributor_identification_requirements", "text", "How members are identified at sign-up", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.distributor_pii_collected", "text", "Personal data collected from members", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.distributor_due_diligence", "text", "Due diligence on new members", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.distributor_country_restrictions", "text", "Countries members may not operate in", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.distributor_decline_termination_reasons", "text", "Reasons a member is declined or terminated", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.distributor_cross_border_sales", "yes_no", "Members may sell internationally (Yes - details / No)", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.distributor_training_description", "text", "Training given to members", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.distributor_policies", "link_or_file", "Member policies and procedures", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.sample_distributor_agreement", "link_or_file", "Sample member agreement", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.business_opportunity_disclosures", "link_or_file", "Business opportunity disclosures", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.fulfillment_agreement", "link_or_file", "Fulfillment agreement", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.manufacturing_agreement", "link_or_file", "Manufacturing agreement", "underwriting", "conditional", { when: MLM }),
+	f("underwriting.distributor_retention_turnover_rates", "text", "Member retention and turnover rates", "underwriting", "optional"),
+	f("underwriting.owners_principals_list", "text", "Owners and principals", "underwriting", "optional"),
+	f("underwriting.product_service_description", "text", "Products and services sold", "underwriting", "optional"),
+	f("underwriting.revenue_from_recruiting_percentage", "percent", "% of revenue from recruiting", "underwriting", "optional", { sendAsText: true }),
+	f("underwriting.revenue_from_website_percentage", "percent", "% of revenue from the website", "underwriting", "optional", { sendAsText: true }),
+	f("underwriting.retail_sales_outside_downline_percentage", "percent", "% of retail sales to people outside the downline", "underwriting", "optional", { sendAsText: true }),
+	f("underwriting.compliance_monitoring_processes", "text", "Compliance monitoring processes", "underwriting", "optional"),
+	f("underwriting.signup_fees_description", "text", "Sign-up fees", "underwriting", "optional"),
+	f("underwriting.training_types_description", "text", "Types of training offered", "underwriting", "optional"),
+	f("underwriting.purchase_requirements_description", "text", "Purchase requirements for members", "underwriting", "optional"),
+	f("underwriting.ftc_compliance_description", "text", "How the company complies with FTC guidance", "underwriting", "optional"),
+	f("underwriting.sells_health_supplements", "boolean", "Sells health products or supplements. Turns on the health questions.", "underwriting", "optional"),
+	f("underwriting.is_product_manufacturer", "yes_no", "Manufactures its own products (Yes / No - manufacturer)", "underwriting", "conditional", { when: HEALTH }),
+	f("underwriting.marketing_methods_description", "text", "How the products are marketed", "underwriting", "conditional", { when: HEALTH }),
+	f("underwriting.cancellation_methods_description", "text", "How customers cancel subscriptions", "underwriting", "conditional", { when: HEALTH }),
+	f("underwriting.scientific_studies_description", "text", "Scientific studies or evidence behind the products", "underwriting", "conditional", { when: HEALTH }),
+	f("underwriting.health_product_lawsuit_history", "text", "Lawsuits or investigations about the products, or \"None\"", "underwriting", "conditional", { when: HEALTH }),
+	...INGREDIENTS.flatMap(([id, label]) => [f(`underwriting.contains_${id}`, "boolean", `A product contains ${label}`, "underwriting", "optional"), f(`underwriting.${id}_product_names`, "text", `Products containing ${label}`, "underwriting", "conditional", { when: `underwriting.contains_${id} is true` })]),
+	f("underwriting.contains_none_listed", "boolean", "No product contains any listed ingredient. With health products, one contains_* must be true.", "underwriting", "optional"),
+	...DISEASE_CLAIMS.flatMap(([id, label]) => [f(`underwriting.claims_${id}_treatment`, "boolean", `A product claims to treat ${label}`, "underwriting", "optional"), f(`underwriting.${id}_treatment_products`, "text", `Products claiming to treat ${label}`, "underwriting", "conditional", { when: `underwriting.claims_${id}_treatment is true` })]),
+	f("underwriting.claims_no_diseases", "boolean", "No product claims to treat a disease. With health products, one claims_* must be true.", "underwriting", "optional")
+];
+const INGREDIENT_IDS = INGREDIENTS.map(([id, label]) => ({
+	id,
+	label
+}));
+const DISEASE_CLAIM_IDS = DISEASE_CLAIMS.map(([id, label]) => ({
+	id,
+	label
+}));
+const ID_TYPES = [
+	"passport",
+	"license",
+	"national_id"
+];
+/** Document uploads are refused above this size. */
+const MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
+const BY_KEY = new Map(FIELDS.map((field) => [field.key, field]));
+/** The definition for a `--set`/`--file` key, normalising a country key
+*  like `country.us.currency` to its `country.<ISO>.currency` entry. */
+function fieldFor(key) {
+	const country = /^country\.([A-Za-z]{2})\.(\w+)$/.exec(key);
+	if (country) return BY_KEY.get(`country.<ISO>.${country[2]}`);
+	return BY_KEY.get(key);
+}
+function isSensitive(key) {
+	return fieldFor(key)?.sensitive === true;
+}
+/** Strip the group prefix: `entity.legal_name` -> `legal_name`. */
+function attributeOf(key) {
+	return key.slice(key.indexOf(".") + 1);
+}
+//#endregion
+//#region src/requirements.ts
+/** The server's step keys. Submission means all of these are 100 and the
+*  terms are agreed (`PaymentsStatus::IndexAction#onboarding_completed?`). */
+const SERVER_STEP_KEYS = [
+	"basic_info",
+	"business_info",
+	"legal_entities",
+	"bank_accounts_i",
+	"bank_accounts_ii",
+	"personal_info",
+	"relevant_persons",
+	"countries",
+	"underwriting"
+];
+const filled = (value) => typeof value === "string" ? value.trim() !== "" : value !== null && value !== void 0 && value !== false;
+const hasFiles = (value) => Array.isArray(value) && value.length > 0;
+function targetFlag(target) {
+	if (!target) return "";
+	if (target.entity !== void 0) return `--entity ${target.entity} `;
+	if (target.bank !== void 0) return `--bank ${target.bank} `;
+	if (target.owner !== void 0) return `--owner ${target.owner} `;
+	return "";
+}
+function fixFor(field, target) {
+	const type = fieldFor(field)?.type;
+	const prefix = targetFlag(target);
+	if (type === "file" || type === "files") return `${prefix}--file ${field}=<path>${field === "owner.government_issued_ids" ? " --id-type <passport|license|national_id>" : ""}`;
+	if (type === "link_or_file") return `${prefix}--set ${field}.link=<url>  (or --file ${field}=<path>)`;
+	return `${prefix}--set ${field}=<value>`;
+}
+var Collector = class {
+	items = [];
+	add(step, field, message, target) {
+		const key = `${step}|${field}|${JSON.stringify(target ?? {})}`;
+		if (this.items.some((m) => `${m.step}|${m.field}|${JSON.stringify(m.target ?? {})}` === key)) return;
+		this.items.push({
+			step,
+			field,
+			message,
+			...target ? { target } : {},
+			fix: fixFor(field, target)
+		});
+	}
+};
+const VAT_COUNTRIES = new Set([
+	"GB",
+	"DE",
+	"FR",
+	"IT",
+	"ES",
+	"NL",
+	"BE",
+	"AT",
+	"SE",
+	"DK",
+	"FI",
+	"NO",
+	"CH",
+	"PL",
+	"CZ",
+	"HU",
+	"RO",
+	"BG",
+	"HR",
+	"SI",
+	"SK",
+	"EE",
+	"LV",
+	"LT",
+	"MT",
+	"CY",
+	"LU",
+	"IE",
+	"PT",
+	"GR"
+]);
+function primaryEntity(entities) {
+	return entities.find((e) => e.primary === true) ?? entities[0];
+}
+function onboardingContact(owners) {
+	return owners.find((o) => o.onboarding_contact === true);
+}
+function primaryBankAccount(snapshot) {
+	const explicit = snapshot.bankAccounts.find((a) => a.primary === true);
+	if (explicit) return explicit;
+	const entity = primaryEntity(snapshot.entities);
+	return entity ? snapshot.bankAccounts.find((a) => a.entity_id === entity.id) : void 0;
+}
+function entityCountry(entity) {
+	return String(entity.country_iso || entity.registered_address?.["country_code"] || "").toUpperCase();
+}
+function checkEntity(c, step, entity, target) {
+	const value = (attr) => entity[attr];
+	const nested = {
+		province: "state",
+		country_iso: "country_code"
+	};
+	const address = (attr) => filled(value(attr)) ? value(attr) : entity.registered_address?.[nested[attr] ?? attr];
+	for (const [attr, message] of [
+		["legal_name", "Legal company name is required"],
+		["classification", "Business type is required"],
+		["registration_number", "Business registration number is required"],
+		["date_of_incorporation", "Date of incorporation is required"],
+		["phone", "Phone number is required"],
+		["website", "Website is required"],
+		["primary_mcc", "Primary MCC is required"]
+	]) if (!filled(value(attr))) c.add(step, `entity.${attr}`, message, target);
+	for (const [attr, message] of [
+		["address1", "Street address is required"],
+		["city", "City is required"],
+		["province", "State/Province is required"],
+		["postal_code", "Postal code is required"],
+		["country_iso", "Country is required"]
+	]) if (!filled(address(attr))) c.add(step, `entity.${attr}`, message, target);
+	const country = entityCountry(entity);
+	if (!filled(value("business_identification_number"))) c.add(step, "entity.business_identification_number", country === "US" ? "Employer Identification Number (EIN) is required" : VAT_COUNTRIES.has(country) ? "VAT ID is required" : "Business tax ID is required", target);
+	const files = [
+		["business_registration_certificate", "Business registration certificate is required"],
+		["business_license", "Business license is required"],
+		["articles_of_incorporation", "Articles of incorporation is required"]
+	];
+	if (country === "US") files.push(["w_9", "W-9 is required for US entities"]);
+	for (const [base, message] of files) if (!filled(value(`${base}_file_url`))) c.add(step, `entity.${base}`, message, target);
+	const website = String(value("website") ?? "").trim();
+	if (website && !/^https?:\/\//.test(website)) c.add(step, "entity.website", "Website must start with http:// or https://", target);
+	const phone = String(value("phone") ?? "").trim();
+	if (phone && !/^[\d\s\-+()]{8,}$/.test(phone)) c.add(step, "entity.phone", "Phone number must have at least 8 digits", target);
+}
+function checkBank(c, account, target) {
+	const step = "bank-accounts";
+	for (const [attr, message] of [
+		["bank_name", "Bank name is required"],
+		["holder_name", "Account holder name is required"],
+		["account_number", "Account number is required"],
+		["country_iso", "Bank country is required"],
+		["currency_iso", "Currency is required"],
+		["city", "Bank city is required"]
+	]) if (!filled(account[attr])) c.add(step, `bank.${attr}`, message, target);
+	if (!filled(account["bank_letter_or_voided_check_file_url"])) c.add(step, "bank.bank_letter_or_voided_check", "Bank letter or voided check is required", target);
+	const country = String(account.country_iso ?? "").toUpperCase();
+	if (country === "US") {
+		if (!filled(account["routing_number"])) c.add(step, "bank.routing_number", "Routing number is required for US accounts", target);
+	} else if (country) {
+		if (!filled(account["swift_bic"])) c.add(step, "bank.swift_bic", "SWIFT/BIC is required outside the US", target);
+	} else c.add(step, "bank.routing_number", "Routing number (US) or SWIFT/BIC (elsewhere) is required once the country is set", target);
+	if (!(filled(account["last_3_months_bank_statements_file_url"]) || hasFiles(account.last_3_months_bank_statements))) c.add(step, "bank.last_3_months_bank_statements", "Last 3 months of bank statements are required", target);
+}
+function checkOwner(c, step, owner, target) {
+	for (const [attr, message] of [
+		["full_name", "Full name is required"],
+		["work_email", "Work email is required"],
+		["date_of_birth", "Date of birth is required"],
+		["place_of_birth", "Place of birth is required"],
+		["nationality", "Nationality is required"],
+		["country_iso", "Country of residence is required"],
+		["street_address", "Street address is required"],
+		["city", "City is required"],
+		["state", "State/Province is required"],
+		["postcode", "Postcode is required"],
+		["phone", "Phone number is required"],
+		["identification_number", "Identification number is required"],
+		["position", "Job title is required"]
+	]) if (!filled(owner[attr])) c.add(step, `owner.${attr}`, message, target);
+	const email = String(owner["work_email"] ?? "").trim();
+	if (email && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) c.add(step, "owner.work_email", "Work email is not a valid address", target);
+	const ids = Array.isArray(owner.government_issued_ids) ? owner.government_issued_ids : [];
+	if (ids.length === 0) c.add(step, "owner.government_issued_ids", "Government-issued ID is required", target);
+	else {
+		const type = ids[0]?.file_type;
+		if ((type === "license" || type === "national_id") && ids.length === 1) c.add(step, "owner.government_issued_ids", `Upload both the front and back of the ${type === "license" ? "driver's license" : "national ID"}`, target);
+	}
+	if (!filled(owner["proof_of_residence_file_url"])) c.add(step, "owner.proof_of_residence", "Proof of residence is required", target);
+	if (owner.is_beneficial_owner === true) {
+		const raw = String(owner.percent_ownership ?? "").trim();
+		const pct = raw === "" ? NaN : Number.parseFloat(raw);
+		if (raw === "") c.add(step, "owner.percent_ownership", "Ownership percentage is required for a beneficial owner", target);
+		else if (Number.isNaN(pct) || pct < 25 || pct > 100) c.add(step, "owner.percent_ownership", "A beneficial owner must own between 25% and 100%", target);
+	}
+}
+const POLICY_FIELDS = [
+	"terms_and_conditions",
+	"refund_or_return_policy",
+	"privacy_policy"
+];
+const MLM_DOCUMENTS = [
+	"distributor_policies",
+	"sample_distributor_agreement",
+	"business_opportunity_disclosures",
+	"income_disclosure_statement",
+	"fulfillment_agreement",
+	"manufacturing_agreement"
+];
+const ALWAYS_TEXT = [
+	"company_description",
+	"management_stability",
+	"uses_third_party_accounting",
+	"has_compliance_officer",
+	"compliance_officer_responsibilities",
+	"distributor_monitoring_policies",
+	"suspicious_activity_escalation_process",
+	"retains_outside_legal_counsel",
+	"investigations_description",
+	"negative_media_events",
+	"bbb_rating",
+	"trustpilot_rating",
+	"projected_annual_sales_volume",
+	"average_order_value"
+];
+const MLM_TEXT = [
+	"mlm_ownership_structure",
+	"commission_payment_method",
+	"commission_payment_channels",
+	"commission_payment_countries",
+	"recruiter_commission_for_recruiting",
+	"all_distributors_can_profit",
+	"provides_average_compensation_report",
+	"distributor_identification_requirements",
+	"distributor_pii_collected",
+	"distributor_due_diligence",
+	"distributor_country_restrictions",
+	"distributor_decline_termination_reasons",
+	"distributor_cross_border_sales",
+	"distributor_training_description"
+];
+const HEALTH_TEXT = [
+	"is_product_manufacturer",
+	"marketing_methods_description",
+	"cancellation_methods_description",
+	"scientific_studies_description",
+	"health_product_lawsuit_history"
+];
+const FINANCIAL_FILES = [
+	"balance_sheet_year1",
+	"balance_sheet_year2",
+	"income_statement_year1",
+	"income_statement_year2",
+	"cash_flow_year1",
+	"cash_flow_year2"
+];
+function linkOrFile(u, field) {
+	const obj = u[field] ?? {};
+	return filled(obj.link) || filled(obj.file_url) || filled(u[`${field}_file_url`]);
+}
+function checkUnderwriting(c, u) {
+	const step = "underwriting";
+	const isMlm = u["company_is_mlm"] === true;
+	const add = (attr, message = "This field is required") => c.add(step, `underwriting.${attr}`, message);
+	for (const attr of ALWAYS_TEXT) if (!filled(u[attr])) add(attr);
+	if (typeof u["financials_audited"] !== "boolean") add("financials_audited");
+	for (const base of FINANCIAL_FILES) if (!filled(u[`${base}_file_url`])) add(base);
+	const cit = String(u["cit_share_percentage"] ?? "").trim();
+	const mit = String(u["mit_share_percentage"] ?? "").trim();
+	if (!cit) add("cit_share_percentage", "% one-time purchases (CIT) is required");
+	if (!mit) add("mit_share_percentage", "% subscriptions (MIT) is required");
+	if (cit && mit) {
+		const citN = Number.parseFloat(cit);
+		const mitN = Number.parseFloat(mit);
+		if (Number.isNaN(citN) || citN < 0 || citN > 100) add("cit_share_percentage", "CIT must be between 0 and 100");
+		if (Number.isNaN(mitN) || mitN < 0 || mitN > 100) add("mit_share_percentage", "MIT must be between 0 and 100");
+		if (!Number.isNaN(citN) && !Number.isNaN(mitN) && Math.abs(citN + mitN - 100) > .01) add("cit_share_percentage", "CIT and MIT must total 100");
+	}
+	for (const field of POLICY_FIELDS) if (!linkOrFile(u, field)) add(field, "A URL or an uploaded file is required");
+	if (isMlm) {
+		for (const attr of MLM_TEXT) if (!filled(u[attr])) add(attr);
+		if (!filled(u["mlm_ownership_structure_file_url"])) add("mlm_ownership_structure_file", "An ownership chart is required");
+		for (const field of MLM_DOCUMENTS) if (!linkOrFile(u, field)) add(field, "A URL or an uploaded file is required");
+		if (!hasFiles(u["compensation_plan"]) && !filled(u["compensation_plan_file_url"])) add("compensation_plan", "Compensation plan is required");
+		for (const attr of [
+			"revenue_from_recruiting_percentage",
+			"revenue_from_website_percentage",
+			"retail_sales_outside_downline_percentage"
+		]) {
+			const raw = String(u[attr] ?? "").trim();
+			if (raw) {
+				const n = Number.parseFloat(raw);
+				if (Number.isNaN(n) || n < 0 || n > 100) add(attr, "Must be a number between 0 and 100");
+			}
+		}
+	}
+	if (u["sells_health_supplements"] === true) {
+		for (const attr of HEALTH_TEXT) if (!filled(u[attr])) add(attr);
+		if (!(INGREDIENT_IDS.some(({ id }) => u[`contains_${id}`] === true) || u["contains_none_listed"] === true)) add("contains_none_listed", "Set one contains_* field, or contains_none_listed=true");
+		for (const { id, label } of INGREDIENT_IDS) if (u[`contains_${id}`] === true && !filled(u[`${id}_product_names`])) add(`${id}_product_names`, `List the products containing ${label}`);
+		if (!(DISEASE_CLAIM_IDS.some(({ id }) => u[`claims_${id}_treatment`] === true) || u["claims_no_diseases"] === true)) add("claims_no_diseases", "Set one claims_* field, or claims_no_diseases=true");
+		for (const { id, label } of DISEASE_CLAIM_IDS) if (u[`claims_${id}_treatment`] === true && !filled(u[`${id}_treatment_products`])) add(`${id}_treatment_products`, `List the products claiming to treat ${label}`);
+	}
+}
+/** Every required field still missing, in form order. */
+function missingFields(snapshot) {
+	const c = new Collector();
+	const info = snapshot.info ?? {};
+	for (const key of [
+		"beneficial_individual_owner",
+		"beneficial_business_owner",
+		"other_legal_entities",
+		"user_has_authority",
+		"user_is_signatory"
+	]) if (typeof info[key] !== "boolean") c.add("business-type", `info.${key}`, "Answer true or false");
+	if (info.beneficial_individual_owner === true && typeof info.user_is_owner !== "boolean") c.add("business-type", "info.user_is_owner", "Answer true or false");
+	const primary = primaryEntity(snapshot.entities);
+	checkEntity(c, "business-info", primary ?? {}, primary ? { entity: primary.id } : void 0);
+	for (const entity of snapshot.entities) if (entity !== primary) checkEntity(c, "legal-entities", entity, { entity: entity.id });
+	const primaryAccount = primaryBankAccount(snapshot);
+	checkBank(c, primaryAccount ?? {}, primaryAccount ? { bank: primaryAccount.id } : void 0);
+	for (const account of snapshot.bankAccounts) if (account !== primaryAccount) checkBank(c, account, { bank: account.id });
+	const contact = onboardingContact(snapshot.owners);
+	checkOwner(c, "personal-info", contact ?? {}, contact ? { owner: contact.id } : void 0);
+	for (const owner of snapshot.owners) if (owner !== contact) checkOwner(c, "relevant-persons", owner, { owner: owner.id });
+	const countries = info.countries_info ?? [];
+	const entityIds = new Set(snapshot.entities.map((e) => e.id));
+	if (countries.length === 0) c.add("countries", "country.<ISO>.currency", "Add at least one country the company sells in");
+	for (const entry of countries) {
+		const iso = entry.country_iso;
+		if (!filled(entry.currency)) c.add("countries", `country.${iso}.currency`, "Currency is required");
+		if (!filled(entry.settlement_currency)) c.add("countries", `country.${iso}.settlement_currency`, "Settlement currency is required");
+		if (!entry.entity_id || !entityIds.has(entry.entity_id)) c.add("countries", `country.${iso}.entity_id`, "Choose the legal entity that sells there");
+		if (entry.entity_legally_registered !== true) c.add("countries", `country.${iso}.entity_legally_registered`, "Confirm the entity is legally registered there (true)");
+	}
+	checkUnderwriting(c, info.underwriting_info ?? {});
+	return c.items;
+}
+function termsAgreed(snapshot) {
+	return snapshot.info.terms_and_conditions_info?.terms_and_conditions_agreed === true;
+}
+/** Same rule the server uses to call the form submitted. */
+function isSubmitted(snapshot) {
+	if (!termsAgreed(snapshot)) return false;
+	const steps = snapshot.info.onboarding_steps ?? {};
+	return SERVER_STEP_KEYS.every((key) => Number(steps[key]) === 100);
+}
+function statusOf(snapshot) {
+	if (isSubmitted(snapshot)) return "submitted";
+	const info = snapshot.info;
+	return snapshot.entities.length > 0 || snapshot.bankAccounts.length > 0 || snapshot.owners.length > 0 || typeof info.beneficial_individual_owner === "boolean" || Object.keys(info.underwriting_info ?? {}).length > 0 ? "in_progress" : "not_started";
+}
+function stepReports(snapshot, missing) {
+	return STEPS.map((step) => {
+		const count = step.id === "terms-and-conditions" ? termsAgreed(snapshot) ? 0 : 1 : missing.filter((m) => m.step === step.id).length;
+		return {
+			id: step.id,
+			name: step.name,
+			complete: count === 0,
+			missing: count
+		};
+	});
+}
+//#endregion
+//#region src/types.ts
+var OnboardingError = class extends Error {
+	constructor(message, details) {
+		super(message);
+		this.details = details;
+		this.name = "OnboardingError";
+	}
+};
+//#endregion
+//#region src/api.ts
+const readLocalFile = async (path) => {
+	let bytes;
+	try {
+		bytes = await readFile(path);
+	} catch {
+		throw new OnboardingError(`Can't read ${path}.`);
+	}
+	return {
+		name: basename(path),
+		bytes
+	};
+};
+/** The company the token acts for. */
+async function currentCompanyId(client) {
+	const me = await client.get("/api/company/v1/companies/me");
+	const id = me.data?.company?.id ?? me.company?.id;
+	if (typeof id !== "number") throw new OnboardingError("Couldn't tell which company this token belongs to.");
+	return id;
+}
+const base = (companyId) => `/api/companies/${companyId}`;
+/**
+* The admin's onboarding form for the environment the CLI talks to: the
+* admin host sits beside the API host (api.fluid.app → admin.fluid.app,
+* api.fluid-staging.app → admin.fluid-staging.app). Null for an API host
+* that doesn't follow that pattern, such as a local server.
+*/
+function onboardingFormUrl(apiBase = process.env["FLUID_API_BASE"] ?? "https://api.fluid.app") {
+	try {
+		const url = new URL(apiBase);
+		if (!url.hostname.startsWith("api.")) return null;
+		return `${url.protocol}//admin.${url.hostname.slice(4)}/settings/onboarding`;
+	} catch {
+		return null;
+	}
+}
+/** Where a person submits: the form's URL, or where to find it. */
+function onboardingFormLocation() {
+	return onboardingFormUrl() ?? `Settings > Onboarding in the admin`;
+}
+/**
+* Whether the token is a person's sign-in. Submitting records who accepted
+* the terms, so it needs one: `fluid login` with email does, while a company
+* API token has no person behind it and `/api/me` refuses it.
+*/
+async function signedInAsPerson(client) {
+	try {
+		await client.get("/api/me");
+		return true;
+	} catch (error) {
+		const status = error.status;
+		if (status === 401 || status === 403) return false;
+		throw error;
+	}
+}
+async function loadSnapshot(client, companyId) {
+	const [info, entities, banks, owners] = await Promise.all([
+		client.get(`${base(companyId)}/onboarding_info`),
+		client.get(`${base(companyId)}/entities`),
+		client.get(`${base(companyId)}/bank_accounts`),
+		client.get(`${base(companyId)}/owners`)
+	]);
+	return {
+		companyId,
+		info: info.company.onboarding_info ?? {},
+		version: info.company.onboarding_info_version ?? null,
+		entities: entities.entities ?? [],
+		bankAccounts: banks.bank_accounts ?? [],
+		owners: owners.owners ?? []
+	};
+}
+async function termsUrl(client, companyId) {
+	try {
+		return (await client.get(`${base(companyId)}/onboarding_info/terms_and_conditions`)).terms_and_conditions?.url ?? null;
+	} catch {
+		return null;
+	}
+}
+/** Per-processor progress after submission. Null when the token can't read
+*  payment accounts. */
+async function providerStatuses(client, companyId) {
+	try {
+		const res = await client.get(`${base(companyId)}/payments_status`);
+		return [...res.providers?.psps ?? [], ...res.providers?.apms ?? []].map((p) => ({
+			name: p.display_name ?? p.integration_class ?? "unknown",
+			type: p.provider_type ?? null,
+			onboardingStatus: p.onboarding_status ?? null,
+			timeEstimate: p.onboarding_time_estimate ?? null
+		}));
+	} catch (error) {
+		const status = error.status;
+		if (status === 401 || status === 403) return null;
+		throw error;
+	}
+}
+const CONTENT_TYPES = {
+	".pdf": "application/pdf",
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".heic": "image/heic",
+	".webp": "image/webp",
+	".doc": "application/msword",
+	".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
+};
+/** Upload one document. Returns the stored reference; the signed URL is
+*  never printed. */
+async function uploadDocument(client, companyId, file, documentType) {
+	if (file.bytes.byteLength > 10485760) throw new OnboardingError(`${file.name} is over the 10 MB upload limit.`);
+	const form = new FormData();
+	const type = CONTENT_TYPES[extname(file.name).toLowerCase()] ?? "application/octet-stream";
+	form.append("file", new Blob([new Uint8Array(file.bytes)], { type }), file.name);
+	form.append("document_type", documentType);
+	const res = await client.requestWithFormData(`${base(companyId)}/onboarding_info/upload_document`, form, { method: "POST" });
+	return {
+		file_url: res.url,
+		file_name: res.filename || file.name
+	};
+}
+function parseTarget(flag, raw) {
+	if (raw === void 0) return void 0;
+	if (raw === "new") return "new";
+	const id = Number(raw);
+	if (!Number.isInteger(id) || id <= 0) throw new OnboardingError(`${flag} takes a record id or "new".`);
+	return id;
+}
+function findOr(records, id, label) {
+	const found = records.find((r) => r.id === id);
+	if (!found) throw new OnboardingError(`No ${label} with id ${id}. Run \`fluid payments onboarding show\` for the ids.`);
+	return found;
+}
+const DOCUMENT_TYPES = {
+	government_issued_ids: "government_id",
+	mlm_ownership_structure_file: "organizational_chart",
+	refund_or_return_policy: "refund_return_policy",
+	sample_distributor_agreement: "distributor_agreement",
+	income_disclosure_statement: "income_disclosure"
+};
+const documentTypeOf = (attr) => DOCUMENT_TYPES[attr] ?? attr.replace(/_year\d$/, "").replace(/_file$/, "");
+/**
+* Save a plan. Order matters: an entity first, because bank accounts,
+* people, and countries default to the primary entity; the onboarding info
+* last, carrying the revision it was read at.
+*/
+async function applyPlan(client, snapshot, plan, targets, readLocal = readLocalFile) {
+	const companyId = snapshot.companyId;
+	const saved = [];
+	const filesFor = (group) => plan.files.filter((f) => f.field.group === group);
+	const entityTouched = Object.keys(plan.entity).length > 0 || filesFor("entity").length > 0;
+	const bankTouched = Object.keys(plan.bank).length > 0 || filesFor("bank").length > 0;
+	const ownerTouched = Object.keys(plan.owner).length > 0 || filesFor("owner").length > 0;
+	let entity;
+	if (targets.entity !== "new" && targets.entity !== void 0) entity = findOr(snapshot.entities, targets.entity, "entity");
+	else if (targets.entity === void 0) entity = primaryEntity(snapshot.entities);
+	if (entityTouched && !entity && typeof plan.entity["legal_name"] !== "string") throw new OnboardingError("Creating an entity needs entity.legal_name.");
+	let bank;
+	if (targets.bank !== "new" && targets.bank !== void 0) bank = findOr(snapshot.bankAccounts, targets.bank, "bank account");
+	else if (targets.bank === void 0) bank = primaryBankAccount(snapshot);
+	let owner;
+	if (targets.owner !== "new" && targets.owner !== void 0) owner = findOr(snapshot.owners, targets.owner, "person");
+	else if (targets.owner === void 0) owner = onboardingContact(snapshot.owners);
+	if (ownerTouched && !owner && typeof plan.owner["full_name"] !== "string") throw new OnboardingError("Adding a person needs owner.full_name.");
+	if (plan.files.filter((f) => f.key === "owner.government_issued_ids").length > 0 && !targets.idType) throw new OnboardingError("Uploading a government ID needs --id-type passport, license, or national_id.");
+	const willHaveEntity = entity !== void 0 || entityTouched || snapshot.entities.length > 0;
+	const entityFirst = (what) => new OnboardingError(`Add the legal entity first (--set entity.legal_name=...), then ${what}.`);
+	if (bankTouched && !bank && plan.bank["entity_id"] === void 0 && !willHaveEntity) throw entityFirst("add a bank account");
+	if (ownerTouched && !owner && plan.owner["entity_id"] === void 0 && !willHaveEntity) throw entityFirst("add a person");
+	const existingCountries = snapshot.info.countries_info ?? [];
+	const newIsos = Object.keys(plan.countries).filter((iso) => !existingCountries.some((c) => c.country_iso === iso));
+	if (newIsos.some((iso) => plan.countries[iso]?.["entity_id"] === void 0) && !willHaveEntity) throw entityFirst("add a country");
+	const catalogue = newIsos.length > 0 ? await listCountries(client) : [];
+	for (const iso of newIsos) if (!catalogue.some((c) => c.iso.toUpperCase() === iso)) throw new OnboardingError(`${iso} isn't a country Fluid knows. Run \`fluid payments onboarding options countries\`.`);
+	const entityPatch = { ...plan.entity };
+	const bankPatch = { ...plan.bank };
+	const ownerPatch = { ...plan.owner };
+	const underwritingPatch = { ...plan.underwriting };
+	const existingUnderwriting = snapshot.info.underwriting_info ?? {};
+	const patches = {
+		entity: {
+			patch: entityPatch,
+			existing: entity ?? {}
+		},
+		bank: {
+			patch: bankPatch,
+			existing: bank ?? {}
+		},
+		owner: {
+			patch: ownerPatch,
+			existing: owner ?? {}
+		},
+		underwriting: {
+			patch: underwritingPatch,
+			existing: existingUnderwriting
+		}
+	};
+	for (const [attr, link] of Object.entries(plan.underwritingLinks)) underwritingPatch[attr] = {
+		...underwritingPatch[attr] ?? existingUnderwriting[attr] ?? {},
+		link
+	};
+	for (const file of plan.files) {
+		const attr = attributeOf(file.key);
+		const target = patches[file.field.group];
+		if (!target) continue;
+		const ref = await uploadDocument(client, companyId, await readLocal(file.path), documentTypeOf(attr));
+		if (file.field.type === "file") {
+			target.patch[`${attr}_file_url`] = ref.file_url;
+			target.patch[`${attr}_file_name`] = ref.file_name;
+		} else if (file.field.type === "link_or_file") {
+			const current = target.patch[attr] ?? target.existing[attr] ?? {};
+			target.patch[attr] = {
+				...current,
+				...ref
+			};
+		} else {
+			const item = attr === "government_issued_ids" ? {
+				...ref,
+				file_type: targets.idType
+			} : ref;
+			let current = target.patch[attr] ?? (targets.replaceFiles ? [] : target.existing[attr]) ?? [];
+			if (attr === "government_issued_ids" && current.some((c) => c.file_type !== targets.idType)) current = [];
+			target.patch[attr] = [...current, item];
+		}
+	}
+	try {
+		if (entityTouched) if (entity) {
+			entity = (await client.put(`${base(companyId)}/entities/${entity.id}`, { entity: entityPatch })).entity ?? entity;
+			saved.push({
+				record: "entity",
+				id: entity.id,
+				action: "updated"
+			});
+		} else {
+			if (snapshot.entities.length === 0 && entityPatch["primary"] === void 0) entityPatch["primary"] = true;
+			entity = (await client.post(`${base(companyId)}/entities`, { entity: entityPatch })).entity;
+			saved.push({
+				record: "entity",
+				id: entity?.id ?? null,
+				action: "created"
+			});
+		}
+		const defaultEntityId = (entity ?? primaryEntity(snapshot.entities))?.id;
+		const needEntity = (what) => {
+			if (defaultEntityId === void 0) throw new OnboardingError(`Add the legal entity first (--set entity.legal_name=...), then ${what}.`);
+			return defaultEntityId;
+		};
+		if (bankTouched) if (bank) {
+			const res = await client.put(`${base(companyId)}/bank_accounts/${bank.id}`, { bank_account: bankPatch });
+			saved.push({
+				record: "bank",
+				id: res.bank_account?.id ?? bank.id,
+				action: "updated"
+			});
+		} else {
+			bankPatch["entity_id"] ??= needEntity("add a bank account");
+			if (snapshot.bankAccounts.length === 0 && bankPatch["primary"] === void 0) bankPatch["primary"] = true;
+			const res = await client.post(`${base(companyId)}/bank_accounts`, { bank_account: bankPatch });
+			saved.push({
+				record: "bank",
+				id: res.bank_account?.id ?? null,
+				action: "created"
+			});
+		}
+		if (ownerTouched) if (owner) {
+			const res = await client.put(`${base(companyId)}/owners/${owner.id}`, { owner: ownerPatch });
+			saved.push({
+				record: "owner",
+				id: res.owner?.id ?? owner.id,
+				action: "updated"
+			});
+		} else {
+			ownerPatch["entity_id"] ??= needEntity("add a person");
+			if (!onboardingContact(snapshot.owners) && ownerPatch["onboarding_contact"] === void 0) ownerPatch["onboarding_contact"] = true;
+			const res = await client.post(`${base(companyId)}/owners`, { owner: ownerPatch });
+			saved.push({
+				record: "owner",
+				id: res.owner?.id ?? null,
+				action: "created"
+			});
+		}
+		const info = { ...plan.info };
+		if (Object.keys(underwritingPatch).length > 0) info["underwriting_info"] = underwritingPatch;
+		if (Object.keys(plan.countries).length > 0) info["countries_info"] = mergeCountries(existingCountries, catalogue, plan.countries, () => needEntity("add a country"));
+		if (Object.keys(info).length > 0) {
+			await putInfo(client, snapshot, info);
+			saved.push({
+				record: "onboarding_info",
+				id: null,
+				action: "updated"
+			});
+		}
+	} catch (error) {
+		if (saved.length === 0) throw error;
+		throw partialSave(saved, error);
+	}
+	return saved;
+}
+/** A write failed after earlier ones in the same `set` were saved. Say
+*  exactly what was kept, so a retry doesn't create a record twice. */
+function partialSave(saved, error) {
+	const body = error.body;
+	const reason = typeof body?.["error_message"] === "string" ? body["error_message"] : error instanceof Error ? error.message : String(error);
+	return new OnboardingError(`Partly saved: ${saved.map((r) => `${r.record}${r.id !== null ? ` ${r.id}` : ""} ${r.action}`).join(", ")}. The next write failed: ${reason} Run \`fluid payments onboarding show\`, then retry only what's still missing, targeting created records by id rather than with "new".`, {
+		saved,
+		failure: {
+			...typeof error.status === "number" ? { status: error.status } : {},
+			...body?.["errors"] !== void 0 ? { errors: body["errors"] } : {}
+		}
+	});
+}
+async function listCountries(client) {
+	const res = await client.get("/api/countries");
+	return Array.isArray(res) ? res : res.countries ?? [];
+}
+function mergeCountries(existing, catalogue, changes, defaultEntity) {
+	const merged = existing.map((c) => ({ ...c }));
+	for (const [iso, change] of Object.entries(changes)) {
+		let entry = merged.find((c) => c.country_iso === iso);
+		if (!entry) {
+			const country = catalogue.find((c) => c.iso.toUpperCase() === iso);
+			if (!country) throw new OnboardingError(`${iso} isn't a country Fluid knows. Run \`fluid payments onboarding options countries\`.`);
+			entry = {
+				country_id: country.id,
+				country_iso: iso,
+				entity_id: typeof change["entity_id"] === "number" ? change["entity_id"] : defaultEntity(),
+				currency: country.currency_code ?? "",
+				settlement_currency: "",
+				entity_legally_registered: false
+			};
+			merged.push(entry);
+		}
+		Object.assign(entry, change);
+	}
+	return merged;
+}
+async function putInfo(client, snapshot, info) {
+	try {
+		await client.put(`${base(snapshot.companyId)}/onboarding_info`, {
+			...snapshot.version !== null ? { onboarding_info_version: snapshot.version } : {},
+			onboarding_info: info
+		});
+	} catch (error) {
+		if (error.status === 409) throw new OnboardingError("Someone else changed the onboarding form since it was read. Run the command again.");
+		throw error;
+	}
+}
+/** The step keys the admin app records as complete, in its own spelling. */
+const COMPLETED_STEP_KEYS = [
+	"basic_info",
+	"business_info",
+	"legal_entities",
+	"bank_accounts_i",
+	"bank_accounts_ii",
+	"personal_info",
+	"relevant_persons",
+	"countries",
+	"compliance",
+	"terms_and_conditions"
+];
+/** Refuse while required fields are missing, naming each one. */
+function assertComplete(snapshot) {
+	const missing = missingFields(snapshot);
+	if (missing.length > 0) throw new OnboardingError(`${missing.length} required field(s) are still missing. Run \`fluid payments onboarding show\`.`, missing.map((m) => ({
+		field: m.field,
+		...m.target ? { target: m.target } : {},
+		message: m.message
+	})));
+}
+/**
+* Submit: mark every step complete and accept the terms, which is the
+* moment the server counts the form as submitted. Refuses while anything is
+* missing.
+*/
+async function submitOnboarding(client, snapshot) {
+	if (isSubmitted(snapshot)) return "already_submitted";
+	assertComplete(snapshot);
+	const steps = Object.fromEntries(SERVER_STEP_KEYS.map((key) => [key, 100]));
+	steps["terms_and_conditions"] = 100;
+	await putInfo(client, snapshot, {
+		onboarding_steps: steps,
+		kyc_flow_current_step: "terms_and_conditions",
+		kyc_flow_completed_steps: COMPLETED_STEP_KEYS.join(","),
+		terms_and_conditions_info: { terms_and_conditions_agreed: true }
+	});
+	return "submitted";
+}
+async function removeRecord(client, snapshot, record, id) {
+	const companyId = snapshot.companyId;
+	if (record === "country") {
+		const iso = id.toUpperCase();
+		const existing = snapshot.info.countries_info ?? [];
+		if (!existing.some((c) => c.country_iso === iso)) throw new OnboardingError(`${iso} isn't on the form.`);
+		await putInfo(client, snapshot, { countries_info: existing.filter((c) => c.country_iso !== iso) });
+		return {
+			removed: "country",
+			id: iso
+		};
+	}
+	const numeric = Number(id);
+	if (!Number.isInteger(numeric) || numeric <= 0) throw new OnboardingError(`"${id}" isn't a record id.`);
+	const path = {
+		entity: "entities",
+		bank: "bank_accounts",
+		owner: "owners"
+	}[record];
+	const list = {
+		entity: snapshot.entities,
+		bank: snapshot.bankAccounts,
+		owner: snapshot.owners
+	}[record];
+	findOr(list, numeric, record === "bank" ? "bank account" : record === "owner" ? "person" : "entity");
+	await client.delete(`${base(companyId)}/${path}/${numeric}`);
+	return {
+		removed: record,
+		id: String(numeric)
+	};
+}
+const OPTION_LISTS = [
+	"business-types",
+	"mcc-codes",
+	"countries",
+	"currencies"
+];
+async function listOptions(client, list, country) {
+	switch (list) {
+		case "business-types": return (await client.get("/api/business_types", country ? { country_code: country.toUpperCase() } : void 0)).business_types ?? [];
+		case "mcc-codes": return (await client.get("/api/mcc_codes")).mcc_codes ?? [];
+		case "countries": return (await listCountries(client)).map((c) => ({
+			iso: c.iso,
+			name: c.name ?? null,
+			currency: c.currency_code ?? null
+		}));
+		case "currencies": return (await client.get("/api/currencies")).currencies ?? [];
+	}
+}
+//#endregion
+//#region src/mask.ts
+/** Keep only the last four characters, e.g. `*****6789`. Short values and
+*  dates are hidden entirely. */
+function maskValue(value) {
+	if (value === null || value === void 0 || value === "") return value;
+	const text = String(value);
+	if (/^\d{4}-\d{2}-\d{2}/.test(text)) return "****-**-**";
+	const visible = text.replace(/[^A-Za-z0-9]/g, "");
+	if (visible.length <= 4) return "****";
+	return `${"*".repeat(Math.min(visible.length - 4, 8))}${visible.slice(-4)}`;
+}
+/** Mask a value when its `--set` key is a sensitive field. */
+function maskFor(key, value) {
+	return isSensitive(key) ? maskValue(value) : value;
+}
+//#endregion
+//#region src/assign.ts
+function emptyPlan() {
+	return {
+		info: {},
+		underwriting: {},
+		underwritingLinks: {},
+		entity: {},
+		bank: {},
+		owner: {},
+		countries: {},
+		files: []
+	};
+}
+function isEmptyPlan(plan) {
+	return plan.files.length === 0 && [
+		plan.info,
+		plan.underwriting,
+		plan.underwritingLinks,
+		plan.entity,
+		plan.bank,
+		plan.owner,
+		plan.countries
+	].every((part) => Object.keys(part).length === 0);
+}
+function splitAssignment(raw, flag) {
+	const eq = raw.indexOf("=");
+	if (eq <= 0) throw new OnboardingError(`${flag} expects key=value, got "${raw.split("=")[0]}".`);
+	return [raw.slice(0, eq).trim(), raw.slice(eq + 1)];
+}
+const unknownKey = (key) => new OnboardingError(`Unknown field "${key}". Run \`fluid payments onboarding fields\` for the list.`);
+/** Coerce a raw string to the field's type. Never quotes a sensitive value
+*  back in an error. */
+function coerce(field, key, raw) {
+	const value = raw.trim();
+	const bad = (expected) => new OnboardingError(`${key} must be ${expected}${field.sensitive ? "" : `, got "${value}"`}.`);
+	switch (field.type) {
+		case "boolean":
+			if (/^(true|yes)$/i.test(value)) return true;
+			if (/^(false|no)$/i.test(value)) return false;
+			throw bad("true or false");
+		case "number":
+		case "percent": {
+			const n = Number(value);
+			if (value === "" || Number.isNaN(n)) throw bad("a number");
+			if (field.type === "percent" && (n < 0 || n > 100)) throw bad("between 0 and 100");
+			return field.sendAsText ? String(n) : n;
+		}
+		case "mcc": {
+			const n = Number(value);
+			if (!Number.isInteger(n) || n <= 0) throw bad("an MCC value from `options mcc-codes`");
+			return n;
+		}
+		case "country":
+			if (!/^[A-Za-z]{2}$/.test(value)) throw bad("a two-letter country code");
+			return value.toUpperCase();
+		case "currency":
+			if (!/^[A-Za-z]{3}$/.test(value)) throw bad("a three-letter currency code");
+			return value.toUpperCase();
+		case "date":
+			if (!/^\d{4}-\d{2}-\d{2}$/.test(value) || Number.isNaN(Date.parse(value))) throw bad("a date as YYYY-MM-DD");
+			return value;
+		case "email":
+			if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) throw bad("an email address");
+			return value;
+		case "url":
+			if (!/^https?:\/\/\S+$/.test(value)) throw bad("a URL starting with http:// or https://");
+			return value;
+		case "phone":
+			if (!/^[\d\s\-+()]{8,}$/.test(value)) throw bad("a phone number with at least 8 digits");
+			return value;
+		case "enum":
+			if (!field.options?.includes(value)) throw bad(`one of ${field.options?.join(", ")}`);
+			return value;
+		case "yes_no":
+			if (!/^(yes|no)\b/i.test(value)) throw bad("\"Yes\", \"No\", or \"Yes - details\"");
+			return value;
+		case "file":
+		case "files":
+		case "link_or_file": throw new OnboardingError(`${key} is a document. Upload it with --file ${key}=<path>.`);
+		default:
+			if (value === "") throw bad("non-empty");
+			return value;
+	}
+}
+/** Parse `--set` and `--file` flags into a plan. */
+function buildPlan(sets, files) {
+	const plan = emptyPlan();
+	for (const raw of sets) {
+		const [key, value] = splitAssignment(raw, "--set");
+		const link = /^underwriting\.(\w+)\.link$/.exec(key);
+		if (link) {
+			if (fieldFor(`underwriting.${link[1]}`)?.type !== "link_or_file") throw unknownKey(key);
+			const url = value.trim();
+			if (!/^https?:\/\/\S+$/.test(url)) throw new OnboardingError(`${key} must be a URL starting with http:// or https://.`);
+			plan.underwritingLinks[link[1]] = url;
+			continue;
+		}
+		const field = fieldFor(key);
+		if (!field) throw unknownKey(key);
+		const coerced = coerce(field, key, value);
+		const country = /^country\.([A-Za-z]{2})\.(\w+)$/.exec(key);
+		if (country) {
+			const iso = country[1].toUpperCase();
+			(plan.countries[iso] ??= {})[country[2]] = coerced;
+			continue;
+		}
+		const group = field.group;
+		plan[group][attributeOf(key)] = coerced;
+	}
+	for (const raw of files) {
+		const [key, path] = splitAssignment(raw, "--file");
+		const field = fieldFor(key);
+		if (!field || ![
+			"file",
+			"files",
+			"link_or_file"
+		].includes(field.type)) throw new OnboardingError(field ? `${key} isn't a document; use --set.` : `Unknown document "${key}". Run \`fluid payments onboarding fields\`.`);
+		if (!path.trim()) throw new OnboardingError(`--file ${key} needs a path.`);
+		plan.files.push({
+			key,
+			field,
+			path: path.trim()
+		});
+	}
+	return plan;
+}
+function parseIdType(raw) {
+	if (raw === void 0) return void 0;
+	if (!ID_TYPES.includes(raw)) throw new OnboardingError(`--id-type must be one of ${ID_TYPES.join(", ")}.`);
+	return raw;
+}
+/** What `set` changed, safe to print: sensitive values masked, documents by
+*  file name only. */
+function describePlan(plan) {
+	const out = {};
+	const add = (group, part) => {
+		for (const [attr, value] of Object.entries(part)) {
+			const key = `${group}.${attr}`;
+			out[key] = maskFor(key, value);
+		}
+	};
+	add("info", plan.info);
+	add("underwriting", plan.underwriting);
+	for (const [attr, url] of Object.entries(plan.underwritingLinks)) out[`underwriting.${attr}.link`] = url;
+	add("entity", plan.entity);
+	add("bank", plan.bank);
+	add("owner", plan.owner);
+	for (const [iso, part] of Object.entries(plan.countries)) add(`country.${iso}`, part);
+	for (const file of plan.files) {
+		const name = file.path.split(/[\\/]/).pop();
+		const prior = out[file.key];
+		out[file.key] = prior ? [prior, `uploaded ${name}`].flat() : `uploaded ${name}`;
+	}
+	return out;
+}
+//#endregion
+//#region src/summary.ts
+function summarize(snapshot) {
+	const missing = missingFields(snapshot);
+	const status = statusOf(snapshot);
+	return {
+		companyId: snapshot.companyId,
+		status,
+		submitted: status === "submitted",
+		termsAgreed: termsAgreed(snapshot),
+		readyToSubmit: missing.length === 0 && status !== "submitted",
+		missingCount: missing.length,
+		steps: stepReports(snapshot, missing),
+		missing,
+		records: {
+			entities: snapshot.entities.map((e) => ({
+				id: e.id,
+				legal_name: e.legal_name ?? null,
+				primary: e.primary === true,
+				status: e.status ?? null,
+				country_iso: e.country_iso ?? null,
+				business_identification_number: maskValue(e["business_identification_number"] ?? null)
+			})),
+			bankAccounts: snapshot.bankAccounts.map((b) => ({
+				id: b.id,
+				entity_id: b.entity_id,
+				bank_name: b["bank_name"] ?? null,
+				primary: b.primary === true,
+				country_iso: b.country_iso ?? null,
+				currency_iso: b["currency_iso"] ?? null,
+				account_number: maskValue(b["account_number"] ?? null)
+			})),
+			people: snapshot.owners.map((o) => ({
+				id: o.id,
+				entity_id: o.entity_id ?? null,
+				full_name: o.full_name ?? null,
+				position: o["position"] ?? null,
+				onboarding_contact: o.onboarding_contact === true,
+				is_beneficial_owner: o.is_beneficial_owner === true,
+				percent_ownership: o.percent_ownership ?? null
+			})),
+			countries: (snapshot.info.countries_info ?? []).map((c) => ({
+				country_iso: c.country_iso,
+				currency: c.currency,
+				settlement_currency: c.settlement_currency,
+				entity_id: c.entity_id,
+				entity_legally_registered: c.entity_legally_registered
+			}))
+		}
+	};
+}
+//#endregion
+//#region src/walk.ts
+const slotKey = (slot) => `${slot.field}|${JSON.stringify(slot.target ?? {})}`;
+const stepName = (id) => STEPS.find((s) => s.id === id)?.name ?? id;
+const fromMissing = (m) => ({
+	field: m.field,
+	...m.target ? { target: m.target } : {},
+	reason: m.message
+});
+function recordFor(snapshot, slot) {
+	const group = slot.field.split(".")[0];
+	const t = slot.target ?? {};
+	if (group === "entity") return t.entity ? snapshot.entities.find((e) => e.id === t.entity) : primaryEntity(snapshot.entities);
+	if (group === "bank") return t.bank ? snapshot.bankAccounts.find((b) => b.id === t.bank) : primaryBankAccount(snapshot);
+	if (group === "owner") return t.owner ? snapshot.owners.find((o) => o.id === t.owner) : onboardingContact(snapshot.owners);
+}
+/** The saved value for a slot, or undefined when there's none. */
+function savedValue(snapshot, slot) {
+	const [group, ...path] = slot.field.split(".");
+	const info = snapshot.info ?? {};
+	let node;
+	if (group === "info") node = info;
+	else if (group === "underwriting") node = info.underwriting_info ?? {};
+	else if (group === "country") {
+		const iso = path.shift()?.toUpperCase();
+		node = (info.countries_info ?? []).find((c) => c.country_iso === iso);
+	} else node = recordFor(snapshot, slot);
+	for (const part of path) {
+		if (node === null || typeof node !== "object") return void 0;
+		node = node[part];
+	}
+	return node === null || node === "" ? void 0 : node;
+}
+/** A saved value as one short line, masked when sensitive. */
+function display(key, value) {
+	if (value === void 0) return void 0;
+	const masked = maskFor(key, value);
+	if (typeof masked === "boolean") return masked ? "Yes" : "No";
+	if (Array.isArray(masked)) return masked.map((v) => display(key, v) ?? "").filter(Boolean).join(", ");
+	if (masked && typeof masked === "object") {
+		const ref = masked;
+		return ref.link ?? ref.file_name ?? void 0;
+	}
+	return String(masked);
+}
+function optionSource(api, snapshot, field) {
+	switch (field.type) {
+		case "country": return async () => (await listCountries(api)).map((c) => ({
+			title: c.name ? `${c.name} (${c.iso})` : c.iso,
+			value: c.iso
+		}));
+		case "currency": return async () => (await listOptions(api, "currencies")).filter((c) => c.code).map((c) => ({
+			title: `${c.code} — ${c.name ?? ""}`,
+			value: c.code
+		}));
+		case "mcc": return async () => (await listOptions(api, "mcc-codes")).filter((c) => c.value !== void 0).map((c) => ({
+			title: `${c.name} (${c.value})`,
+			value: String(c.value)
+		}));
+		case "business_type": {
+			const country = primaryEntity(snapshot.entities)?.country_iso ?? void 0;
+			return async () => (await listOptions(api, "business-types", country ?? void 0)).filter((c) => c.value).map((c) => ({
+				title: c.name ?? c.value,
+				value: c.value
+			}));
+		}
+		default: return;
+	}
+}
+const TYPE_HINTS = {
+	date: "YYYY-MM-DD",
+	percent: "0 to 100",
+	email: "name@example.com",
+	url: "https://…",
+	phone: "with country code",
+	yes_no: "Yes, No, or \"Yes - details\"",
+	file: "path to the file",
+	files: "path to the file",
+	link_or_file: "a https:// link or a file path"
+};
+async function questionFor(slot, field, current, options, section, canGoBack) {
+	const base = {
+		section,
+		message: field.label,
+		current,
+		canGoBack
+	};
+	if (field.type === "boolean") return {
+		...base,
+		kind: "select",
+		choices: [{
+			title: "Yes",
+			value: "true"
+		}, {
+			title: "No",
+			value: "false"
+		}]
+	};
+	if (field.type === "enum" && field.options) return {
+		...base,
+		kind: "select",
+		choices: field.options.map((o) => ({
+			title: o,
+			value: o
+		}))
+	};
+	if (options && options.length > 0) return {
+		...base,
+		kind: "search",
+		choices: options,
+		hint: "type to filter"
+	};
+	const hint = [TYPE_HINTS[field.type], slot.reason].filter(Boolean).join(" · ");
+	return {
+		...base,
+		kind: field.sensitive ? "secret" : "text",
+		...hint ? { hint } : {}
+	};
+}
+async function walkOnboarding(deps, opts = {}) {
+	const { api, companyId, prompter } = deps;
+	let snapshot = await loadSnapshot(api, companyId);
+	const history = [];
+	const skipped = /* @__PURE__ */ new Set();
+	const optionCache = /* @__PURE__ */ new Map();
+	let focus = opts.step;
+	let forced;
+	let answered = 0;
+	let submitted = false;
+	let submitUrl;
+	prompter.note(NAV_HELP);
+	const options = async (field) => {
+		const source = optionSource(api, snapshot, field);
+		if (!source) return void 0;
+		const cacheKey = field.type === "business_type" ? `${field.type}:${primaryEntity(snapshot.entities)?.country_iso ?? ""}` : field.type;
+		if (!optionCache.has(cacheKey)) try {
+			optionCache.set(cacheKey, await source());
+		} catch {
+			optionCache.set(cacheKey, []);
+		}
+		return optionCache.get(cacheKey);
+	};
+	const countryChoices = async () => {
+		if (!optionCache.has("country-pick")) try {
+			optionCache.set("country-pick", (await listCountries(api)).map((c) => ({
+				title: c.name ? `${c.name} (${c.iso})` : c.iso,
+				value: c.iso
+			})));
+		} catch {
+			optionCache.set("country-pick", []);
+		}
+		return optionCache.get("country-pick");
+	};
+	const goBack = () => {
+		const previous = history.pop();
+		if (!previous) {
+			prompter.note("This is the first question.");
+			return false;
+		}
+		skipped.delete(slotKey(previous));
+		forced = previous;
+		return true;
+	};
+	/** Save one answer. False (after saying why) when it was refused. */
+	const save = async (slot, field, raw) => {
+		const value = raw.trim();
+		let idType;
+		try {
+			let plan;
+			if (field.type === "link_or_file" && /^https?:\/\//i.test(value)) plan = buildPlan([`${slot.field}.link=${value}`], []);
+			else if ([
+				"file",
+				"files",
+				"link_or_file"
+			].includes(field.type)) {
+				plan = buildPlan([], [`${slot.field}=${value}`]);
+				if (slot.field === "owner.government_issued_ids") {
+					const choice = await prompter.menu("Which kind of ID is it?", ID_TYPES.map((t) => ({
+						title: t.replace("_", " "),
+						value: t
+					})));
+					if (!choice) return false;
+					idType = choice;
+				}
+			} else plan = buildPlan([`${slot.field}=${value}`], []);
+			await applyPlan(api, snapshot, plan, {
+				entity: slot.target?.entity,
+				bank: slot.target?.bank,
+				owner: slot.target?.owner,
+				idType
+			}, deps.readLocal);
+		} catch (error) {
+			prompter.note(`Not saved: ${error instanceof Error ? error.message : String(error)}`);
+			return false;
+		}
+		snapshot = await loadSnapshot(api, companyId);
+		return true;
+	};
+	/** Pick a field (and a record, when there are several) in a step. */
+	const pickInStep = async (step) => {
+		const slots = FIELDS.filter((f) => f.step === step && !f.key.includes("<ISO>")).map((f) => ({ field: f.key }));
+		for (const country of snapshot.info.countries_info ?? []) for (const f of FIELDS.filter((x) => x.step === step && x.key.includes("<ISO>"))) slots.push({ field: f.key.replace("<ISO>", country.country_iso) });
+		if (slots.length === 0) {
+			prompter.note(`${stepName(step)} has nothing to change here.`);
+			return null;
+		}
+		const group = slots[0].field.split(".")[0];
+		let target;
+		const records = group === "entity" ? snapshot.entities : group === "bank" ? snapshot.bankAccounts : group === "owner" ? snapshot.owners : [];
+		if (records.length > 1) {
+			const id = await prompter.menu("Which one?", records.map((r) => ({
+				title: String(r.legal_name ?? r.full_name ?? r.country_iso ?? `#${r.id}`),
+				value: String(r.id)
+			})));
+			if (!id) return null;
+			target = { [group]: Number(id) };
+		}
+		const choice = await prompter.menu(`${stepName(step)}: which answer?`, slots.map((s, i) => {
+			const def = fieldFor(s.field);
+			const saved = display(s.field, savedValue(snapshot, {
+				...s,
+				target
+			}));
+			return {
+				title: `${def.label}${saved ? ` — ${saved}` : " — (empty)"}`,
+				value: String(i)
+			};
+		}));
+		if (choice === null) return null;
+		return {
+			...slots[Number(choice)],
+			...target ? { target } : {}
+		};
+	};
+	/** The menu: jump to a step, change an answer, submit, or stop. */
+	const openMenu = async () => {
+		const missing = missingFields(snapshot);
+		const action = await prompter.menu("What next?", [
+			{
+				title: "Continue",
+				value: "continue"
+			},
+			{
+				title: "Back to the previous question",
+				value: "back",
+				disabled: history.length === 0
+			},
+			{
+				title: "Go to a step",
+				value: "step"
+			},
+			{
+				title: "Add a country",
+				value: "country"
+			},
+			{
+				title: "Submit",
+				value: "submit",
+				disabled: missing.length > 0
+			},
+			{
+				title: "Stop for now (answers are saved)",
+				value: "quit"
+			}
+		]);
+		if (action === null || action === "quit") return "quit";
+		if (action === "back") return goBack() ? "moved" : "stay";
+		if (action === "country") {
+			forced = { field: "country.<ISO>.currency" };
+			return "moved";
+		}
+		if (action === "step") {
+			const step = await prompter.menu("Which step?", STEPS.filter((s) => s.id !== "terms-and-conditions").map((s) => {
+				const left = missing.filter((m) => m.step === s.id).length;
+				return {
+					title: `${left === 0 ? "✓" : `${left} left`}  ${s.name}`,
+					value: s.id
+				};
+			}));
+			if (step) {
+				if (missing.filter((m) => m.step === step && !skipped.has(slotKey(fromMissing(m)))).length > 0) {
+					focus = step;
+					return "moved";
+				}
+				const slot = await pickInStep(step);
+				if (slot) {
+					forced = slot;
+					return "moved";
+				}
+			}
+		}
+		if (action === "submit" && await offerSubmit()) return "quit";
+		return "stay";
+	};
+	/** True when the walk is over: submitted, or handed to the admin form. */
+	const offerSubmit = async () => {
+		if (!await signedInAsPerson(api)) {
+			submitUrl = onboardingFormUrl() ?? void 0;
+			prompter.note(`Everything is filled in. Submitting records the person who accepts Fluid's terms, so a person has to submit at ${onboardingFormLocation()}, or sign in with \`fluid login\` and run this again.`);
+			return true;
+		}
+		const url = await termsUrl(api, companyId);
+		if (await prompter.menu(`Submitting accepts Fluid's payments terms & conditions for the company${url ? ` (${url})` : ""}.`, [{
+			title: "I've read the terms. Submit",
+			value: "submit"
+		}, {
+			title: "Not now",
+			value: "later"
+		}]) !== "submit") return false;
+		try {
+			await submitOnboarding(api, snapshot);
+		} catch (error) {
+			const status = error.status;
+			if (typeof status === "number" && status >= 500) {
+				submitUrl = onboardingFormUrl() ?? void 0;
+				prompter.note(`The API couldn't record the acceptance. Submit at ${onboardingFormLocation()}.`);
+				return true;
+			}
+			throw error;
+		}
+		snapshot = await loadSnapshot(api, companyId);
+		submitted = true;
+		prompter.note("Submitted. Fluid's team will review it.");
+		return true;
+	};
+	for (;;) {
+		const missing = missingFields(snapshot);
+		let slot = forced;
+		forced = void 0;
+		if (!slot) {
+			const open = missing.filter((m) => !skipped.has(slotKey(fromMissing(m))));
+			let pool = focus ? open.filter((m) => m.step === focus) : open;
+			if (focus && pool.length === 0) {
+				prompter.note(`${stepName(focus)} is done.`);
+				focus = void 0;
+				pool = open;
+			}
+			slot = pool[0] ? fromMissing(pool[0]) : void 0;
+		}
+		if (!slot) {
+			if (missing.length === 0) {
+				const choice = await prompter.menu("Every required answer is in.", [
+					{
+						title: "Submit",
+						value: "submit"
+					},
+					{
+						title: "Change an answer",
+						value: "menu"
+					},
+					{
+						title: "Stop for now",
+						value: "quit"
+					}
+				]);
+				if (choice === "submit" && await offerSubmit()) break;
+				if (choice === "menu" && await openMenu() !== "quit") continue;
+				if (choice === "submit") continue;
+				break;
+			}
+			const choice = await prompter.menu(`${skipped.size} skipped question(s) left.`, [
+				{
+					title: "Go through the skipped questions",
+					value: "again"
+				},
+				{
+					title: "Menu…",
+					value: "menu"
+				},
+				{
+					title: "Stop for now",
+					value: "quit"
+				}
+			]);
+			if (choice === "again") {
+				skipped.clear();
+				continue;
+			}
+			if (choice === "menu" && await openMenu() !== "quit") continue;
+			break;
+		}
+		if (slot.field.includes("<ISO>")) {
+			const existing = new Set((snapshot.info.countries_info ?? []).map((c) => c.country_iso.toUpperCase()));
+			const countries = (await countryChoices()).filter((c) => !existing.has(c.value));
+			const reply = await prompter.ask({
+				section: stepName("countries"),
+				message: "Which country do you sell in? (add more any time with ? → Add a country)",
+				kind: countries.length > 0 ? "search" : "text",
+				...countries.length > 0 ? {
+					choices: countries,
+					hint: "type to filter"
+				} : { hint: "two-letter code, e.g. US" },
+				canGoBack: history.length > 0
+			});
+			if ("nav" in reply) {
+				if (reply.nav === "quit") break;
+				if (reply.nav === "back") {
+					if (!goBack()) forced = slot;
+				} else if (reply.nav === "skip") {
+					skipped.add(slotKey(slot));
+					history.push(slot);
+				} else {
+					const after = await openMenu();
+					if (after === "quit") break;
+					if (after === "stay") forced = slot;
+				}
+				continue;
+			}
+			const iso = reply.value.trim().toUpperCase();
+			if (!/^[A-Z]{2}$/.test(iso)) {
+				prompter.note("Pick a country, or type its two-letter code.");
+				forced = slot;
+				continue;
+			}
+			if (existing.has(iso)) {
+				prompter.note(`${iso} is already on the form. To change it, open the menu and go to the Countries step.`);
+				forced = slot;
+				continue;
+			}
+			forced = {
+				...slot,
+				field: slot.field.replace("<ISO>", iso)
+			};
+			continue;
+		}
+		const field = fieldFor(slot.field);
+		if (!field) {
+			skipped.add(slotKey(slot));
+			continue;
+		}
+		const step = field.step;
+		const left = missing.filter((m) => m.step === step).length;
+		const current = display(slot.field, savedValue(snapshot, slot));
+		const question = await questionFor(slot, field, current, await options(field), `${stepName(step)}${left > 0 ? ` · ${left} left` : ""}`, history.length > 0);
+		const reply = await prompter.ask(question);
+		if ("nav" in reply) {
+			if (reply.nav === "quit") break;
+			if (reply.nav === "back") {
+				if (!goBack()) forced = slot;
+				continue;
+			}
+			if (reply.nav === "skip") {
+				skipped.add(slotKey(slot));
+				history.push(slot);
+				continue;
+			}
+			const after = await openMenu();
+			if (after === "quit") break;
+			if (after === "stay") forced = slot;
+			continue;
+		}
+		if (reply.value.trim() === "") {
+			if (current !== void 0) history.push(slot);
+			else {
+				prompter.note("Type an answer, or > to skip.");
+				forced = slot;
+			}
+			continue;
+		}
+		if (await save(slot, field, reply.value)) {
+			answered += 1;
+			history.push(slot);
+		} else forced = slot;
+	}
+	const after = summarize(snapshot);
+	return {
+		answered,
+		skipped: [...skipped].map((k) => k.split("|")[0]),
+		status: after.status,
+		readyToSubmit: after.readyToSubmit,
+		missingCount: after.missingCount,
+		submitted,
+		...submitUrl ? { submitUrl } : {}
+	};
+}
+//#endregion
+//#region src/index.ts
+async function client(ctx) {
+	return await ctx.getClient();
+}
+/**
+* Changes to the onboarding form need an explicit yes. Scripts and agents
+* pass `--yes`; an interactive terminal is asked. With neither, nothing runs.
+*/
+async function confirmChange(question, yes, interactive = Boolean(process.stdin.isTTY)) {
+	if (yes) return;
+	if (!interactive) throw new OnboardingError(`${question} Pass --yes to confirm.`);
+	if (!(await prompts({
+		type: "confirm",
+		name: "ok",
+		message: question,
+		initial: false
+	})).ok) throw new OnboardingError("Cancelled.");
+}
+/**
+* Print a failure as JSON on stderr and exit non-zero. The API's error body
+* names fields and reasons, never the submitted values, so its `errors` are
+* passed through as `details`.
+*/
+function fail(err, write = (t) => process.stderr.write(t)) {
+	const status = typeof err.status === "number" ? err.status : void 0;
+	const body = err.body;
+	const apiDetail = body && (body["errors"] ?? body["error"] ?? body["error_message"]);
+	const message = typeof body?.["error_message"] === "string" ? body["error_message"] : typeof apiDetail === "string" ? apiDetail : err instanceof Error ? err.message : String(err);
+	const details = err instanceof OnboardingError && err.details !== void 0 ? err.details : apiDetail && typeof apiDetail === "object" ? apiDetail : void 0;
+	write(JSON.stringify({
+		error: message,
+		...status ? { status } : {},
+		...details !== void 0 ? { details } : {}
+	}) + "\n");
+	process.exitCode = 1;
+}
+function run(action) {
+	return action().catch((err) => fail(err));
+}
+const collect = (value, previous = []) => [...previous, value];
+const GROUPS = [
+	"info",
+	"entity",
+	"bank",
+	"owner",
+	"country",
+	"underwriting"
+];
+function registerOnboardingCommands(parent, ctx) {
+	const onboarding = parent.command("onboarding").description("Payments onboarding (KYC): see what's missing, fill it in, and submit");
+	onboarding.command("show").description("Status, each step, the required fields still missing, and the records on the form (sensitive values masked)").option("--step <id>", `Only list what's missing in one step: ${STEPS.map((s) => s.id).join(", ")}`).action((opts) => run(async () => {
+		if (opts.step && !STEPS.some((s) => s.id === opts.step)) throw new OnboardingError(`--step must be one of ${STEPS.map((s) => s.id).join(", ")}.`);
+		const api = await client(ctx);
+		const companyId = await currentCompanyId(api);
+		const summary = summarize(await loadSnapshot(api, companyId));
+		const missing = opts.step ? summary.missing.filter((m) => m.step === opts.step) : summary.missing;
+		ctx.output({
+			...summary,
+			missing,
+			termsUrl: summary.termsAgreed ? void 0 : await termsUrl(api, companyId),
+			providers: summary.submitted ? await providerStatuses(api, companyId) : void 0
+		});
+	}));
+	onboarding.command("fields").description("The full field schema: keys for --set/--file, types, options, and when each is required").option("--group <group>", `Only one group: ${GROUPS.join(", ")}`).option("--required", "Only fields that are always or conditionally required", false).action((opts) => run(async () => {
+		if (opts.group && !GROUPS.includes(opts.group)) throw new OnboardingError(`--group must be one of ${GROUPS.join(", ")}.`);
+		const fields = FIELDS.filter((f) => (!opts.group || f.group === opts.group) && (!opts.required || f.required !== "optional"));
+		ctx.output({
+			steps: STEPS,
+			targets: {
+				entity: "--entity <id|new>; defaults to the primary legal entity, created if there is none",
+				bank: "--bank <id|new>; defaults to the primary bank account, created if there is none",
+				owner: "--owner <id|new>; defaults to the onboarding contact (you), created if there is none",
+				country: "country.<ISO>.<field>, e.g. country.US.currency=USD; adds the country if it's new"
+			},
+			documents: {
+				flag: "--file <key>=<path>",
+				maxBytes: MAX_UPLOAD_BYTES,
+				multiFile: "files-type documents add to what's there; pass --replace-files to start over",
+				governmentIdTypes: ID_TYPES,
+				linkOrFile: "link_or_file documents take a URL with --set <key>.link=<url> or a file with --file"
+			},
+			fields
+		});
+	}));
+	onboarding.command("options <list>").description(`Values for choice fields: ${OPTION_LISTS.join(", ")}`).option("--country <iso>", "business-types: the types for one country").action((list, opts) => run(async () => {
+		if (!OPTION_LISTS.includes(list)) throw new OnboardingError(`List must be one of ${OPTION_LISTS.join(", ")}.`);
+		ctx.output(await listOptions(await client(ctx), list, opts.country));
+	}));
+	onboarding.command("set").description("Save fields and upload documents, then print what's still missing (changes live data)").option("--set <key=value>", "A field from `fields`, e.g. entity.legal_name=Acme Inc (repeatable)", collect, []).option("--file <key=path>", "Upload a document, e.g. entity.business_license=./license.pdf (repeatable)", collect, []).option("--entity <id|new>", "Which legal entity entity.* fields go to").option("--bank <id|new>", "Which bank account bank.* fields go to").option("--owner <id|new>", "Which person owner.* fields go to").option("--id-type <type>", `Government ID type for owner.government_issued_ids: ${ID_TYPES.join(", ")}`).option("--replace-files", "Replace a multi-file document's files instead of adding to them", false).option("--yes", "Confirm without a prompt", false).action((opts) => run(async () => {
+		const plan = buildPlan(opts.set, opts.file);
+		if (isEmptyPlan(plan)) throw new OnboardingError("Pass fields with --set key=value or documents with --file key=path.");
+		const targets = {
+			entity: parseTarget("--entity", opts.entity),
+			bank: parseTarget("--bank", opts.bank),
+			owner: parseTarget("--owner", opts.owner),
+			idType: parseIdType(opts.idType),
+			replaceFiles: opts.replaceFiles
+		};
+		const api = await client(ctx);
+		const companyId = await currentCompanyId(api);
+		const snapshot = await loadSnapshot(api, companyId);
+		await confirmChange(`Save ${opts.set.length + opts.file.length} onboarding change(s) for company ${companyId}?`, opts.yes);
+		const saved = await applyPlan(api, snapshot, plan, targets);
+		const after = summarize(await loadSnapshot(api, companyId));
+		ctx.output({
+			saved,
+			changed: describePlan(plan),
+			status: after.status,
+			readyToSubmit: after.readyToSubmit,
+			missingCount: after.missingCount,
+			steps: after.steps,
+			missing: after.missing
+		});
+	}));
+	onboarding.command("walk").description("Answer the form question by question in the terminal: go back, skip, jump to a step, or change an answer; each answer is saved as you go (changes live data)").option("--step <id>", `Start at a step: ${STEPS.map((s) => s.id).join(", ")}`).action((opts) => run(async () => {
+		assertInteractive("`show` to see what's missing and `set` to fill it in");
+		const step = opts.step;
+		if (step && !STEPS.some((s) => s.id === step)) throw new OnboardingError(`Unknown step "${step}". Use one of: ${STEPS.map((s) => s.id).join(", ")}.`);
+		const api = await client(ctx);
+		const companyId = await currentCompanyId(api);
+		ctx.output(await walkOnboarding({
+			api,
+			companyId,
+			prompter: terminalPrompter()
+		}, { step }));
+	}));
+	onboarding.command("remove <record> <id>").description("Remove a legal entity, bank account, or person by id, or a country by ISO code (changes live data)").option("--yes", "Confirm without a prompt", false).action((record, id, opts) => run(async () => {
+		const records = [
+			"entity",
+			"bank",
+			"owner",
+			"country"
+		];
+		if (!records.includes(record)) throw new OnboardingError(`Record must be one of ${records.join(", ")}.`);
+		const api = await client(ctx);
+		const snapshot = await loadSnapshot(api, await currentCompanyId(api));
+		await confirmChange(`Remove ${record} ${id} from the onboarding form?`, opts.yes);
+		ctx.output(await removeRecord(api, snapshot, record, id));
+	}));
+	onboarding.command("submit").description("Accept Fluid's terms and submit the form for review; refused while anything is missing (changes live data)").option("--accept-terms", "Accept Fluid's payments terms & conditions for the company (required)", false).option("--yes", "Confirm without a prompt", false).action((opts) => run(async () => {
+		const api = await client(ctx);
+		const companyId = await currentCompanyId(api);
+		const snapshot = await loadSnapshot(api, companyId);
+		if (summarize(snapshot).submitted) {
+			ctx.output({
+				status: "submitted",
+				alreadySubmitted: true,
+				providers: await providerStatuses(api, companyId)
+			});
+			return;
+		}
+		assertComplete(snapshot);
+		if (!await signedInAsPerson(api)) {
+			ctx.output({
+				status: "ready_to_submit",
+				submitted: false,
+				submitUrl: onboardingFormUrl(),
+				submitAt: onboardingFormLocation(),
+				reason: "Every required field is filled in. Submitting records the person who accepts Fluid's terms, so a person has to submit: open the form at submitAt and submit there, or sign in with `fluid login` (email) and run this again."
+			});
+			return;
+		}
+		if (!opts.acceptTerms) {
+			const url = await termsUrl(api, companyId);
+			throw new OnboardingError(`Submitting accepts Fluid's payments terms & conditions for the company${url ? ` (${url})` : ""}. Read them, then pass --accept-terms.`);
+		}
+		await confirmChange(`Accept the terms and submit payments onboarding for company ${companyId}?`, opts.yes);
+		try {
+			await submitOnboarding(api, snapshot);
+		} catch (error) {
+			const status = error.status;
+			if (typeof status === "number" && status >= 500) throw new OnboardingError(`The API couldn't record the acceptance. Submit from the onboarding form instead: ${onboardingFormLocation()}`);
+			throw error;
+		}
+		ctx.output({
+			status: "submitted",
+			submitted: true,
+			providers: await providerStatuses(api, companyId)
+		});
+	}));
+}
+const plugin = {
+	name: "@fluid-app/fluid-cli-payments",
+	version: "0.1.0",
+	register(ctx) {
+		ctx.program.addCommand(createDomainCommand("payments", "Payments onboarding: what's missing, fill it in, and submit", registerOnboardingCommands));
+	}
+};
+//#endregion
+export { confirmChange, plugin as default, fail, registerOnboardingCommands };
+
+//# sourceMappingURL=index.mjs.map