@stripe/link-cli 0.2.3 → 0.3.1

package/dist/cli.js

@@ -8704,19 +8704,19 @@ var require_range = __commonJS({
     var replaceCaret = (comp, options) => {
       debug("caret", comp, options);
       const r = options.loose ? re[t.CARETLOOSE] : re[t.CARET];
-      const z7 = options.includePrerelease ? "-0" : "";
+      const z8 = options.includePrerelease ? "-0" : "";
       return comp.replace(r, (_, M, m, p, pr) => {
         debug("caret", comp, _, M, m, p, pr);
         let ret;
         if (isX(M)) {
           ret = "";
         } else if (isX(m)) {
-          ret = `>=${M}.0.0${z7} <${+M + 1}.0.0-0`;
+          ret = `>=${M}.0.0${z8} <${+M + 1}.0.0-0`;
         } else if (isX(p)) {
           if (M === "0") {
-            ret = `>=${M}.${m}.0${z7} <${M}.${+m + 1}.0-0`;
+            ret = `>=${M}.${m}.0${z8} <${M}.${+m + 1}.0-0`;
           } else {
-            ret = `>=${M}.${m}.0${z7} <${+M + 1}.0.0-0`;
+            ret = `>=${M}.${m}.0${z8} <${+M + 1}.0.0-0`;
           }
         } else if (pr) {
           debug("replaceCaret pr", pr);
@@ -8733,9 +8733,9 @@ var require_range = __commonJS({
           debug("no pr");
           if (M === "0") {
             if (m === "0") {
-              ret = `>=${M}.${m}.${p}${z7} <${M}.${m}.${+p + 1}-0`;
+              ret = `>=${M}.${m}.${p}${z8} <${M}.${m}.${+p + 1}-0`;
             } else {
-              ret = `>=${M}.${m}.${p}${z7} <${M}.${+m + 1}.0-0`;
+              ret = `>=${M}.${m}.${p}${z8} <${M}.${+m + 1}.0-0`;
             }
           } else {
             ret = `>=${M}.${m}.${p} <${+M + 1}.0.0-0`;
@@ -9549,7 +9549,7 @@ var require_semver2 = __commonJS({
 });
 
 // src/cli.tsx
-import { Cli as Cli5 } from "incur";
+import { Cli as Cli7 } from "incur";
 import updateNotifier from "update-notifier";
 
 // ../sdk/dist/index.js
@@ -11358,7 +11358,7 @@ var Login = ({
     ] });
   }
   return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", paddingY: 1, children: [
-    /* @__PURE__ */ jsx(Box, { marginBottom: 1, children: /* @__PURE__ */ jsx(Text, { bold: true, children: "Link CLI Authentication" }) }),
+    /* @__PURE__ */ jsx(Box, { marginBottom: 1, children: /* @__PURE__ */ jsx(Text, { bold: true, children: "Authentication" }) }),
     /* @__PURE__ */ jsxs(
       Box,
       {
@@ -11432,8 +11432,62 @@ var statusOptions = z.object({
   timeout: z.coerce.number().default(300).describe("Polling timeout in seconds.")
 });
 
+// src/commands/auth/status.tsx
+import { Box as Box3, Text as Text3 } from "ink";
+import { useEffect as useEffect3, useState as useState3 } from "react";
+import { jsx as jsx3, jsxs as jsxs2 } from "react/jsx-runtime";
+var AuthStatus = ({ onComplete }) => {
+  const [checked, setChecked] = useState3(false);
+  const [authenticated, setAuthenticated] = useState3(false);
+  const [tokenPreview, setTokenPreview] = useState3("");
+  const [tokenType, setTokenType] = useState3("");
+  const [credentialsPath, setCredentialsPath] = useState3("");
+  useEffect3(() => {
+    const auth = storage.getAuth();
+    const credentialsPath2 = storage.getPath();
+    if (auth) {
+      setAuthenticated(true);
+      setTokenPreview(`${auth.access_token.substring(0, 20)}...`);
+      setTokenType(auth.token_type);
+    }
+    setCredentialsPath(credentialsPath2);
+    setChecked(true);
+    setTimeout(onComplete, 1e3);
+  }, [onComplete]);
+  if (!checked) {
+    return null;
+  }
+  if (authenticated) {
+    return /* @__PURE__ */ jsxs2(Box3, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx3(Text3, { color: "green", children: "\u2713 Authenticated" }),
+      /* @__PURE__ */ jsxs2(Box3, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsxs2(Text3, { children: [
+          "Access token: ",
+          /* @__PURE__ */ jsx3(Text3, { bold: true, children: tokenPreview })
+        ] }),
+        /* @__PURE__ */ jsxs2(Text3, { children: [
+          "Token type: ",
+          /* @__PURE__ */ jsx3(Text3, { bold: true, children: tokenType })
+        ] }),
+        /* @__PURE__ */ jsxs2(Text3, { children: [
+          "Credentials: ",
+          /* @__PURE__ */ jsx3(Text3, { bold: true, children: credentialsPath })
+        ] })
+      ] })
+    ] });
+  }
+  return /* @__PURE__ */ jsxs2(Box3, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx3(Text3, { color: "yellow", children: "\u2717 Not authenticated" }),
+    /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: 'Run "link-cli auth login" to authenticate' }),
+    /* @__PURE__ */ jsx3(Box3, { marginTop: 1, paddingX: 2, children: /* @__PURE__ */ jsxs2(Text3, { children: [
+      "Credentials: ",
+      /* @__PURE__ */ jsx3(Text3, { bold: true, children: credentialsPath })
+    ] }) })
+  ] });
+};
+
 // src/commands/auth/index.tsx
-import { jsx as jsx3 } from "react/jsx-runtime";
+import { jsx as jsx4 } from "react/jsx-runtime";
 function createAuthCli(authResource, updateInfo) {
   const cli2 = Cli.create("auth", {
     description: "Authentication commands"
@@ -11453,7 +11507,7 @@ function createAuthCli(authResource, updateInfo) {
       if (!c.agent && !c.formatExplicit) {
         return new Promise((resolve) => {
           const { waitUntilExit } = render(
-            /* @__PURE__ */ jsx3(
+            /* @__PURE__ */ jsx4(
               Login,
               {
                 authResource,
@@ -11506,7 +11560,7 @@ function createAuthCli(authResource, updateInfo) {
       if (!c.agent && !c.formatExplicit) {
         return new Promise((resolve) => {
           const { waitUntilExit } = render(
-            /* @__PURE__ */ jsx3(Logout, { authResource, onComplete: () => {
+            /* @__PURE__ */ jsx4(Logout, { authResource, onComplete: () => {
             } })
           );
           waitUntilExit().then(() => resolve(result));
@@ -11520,6 +11574,25 @@ function createAuthCli(authResource, updateInfo) {
     options: statusOptions,
     outputPolicy: "agent-only",
     async *run(c) {
+      if (!c.agent && !c.formatExplicit) {
+        return new Promise((resolve) => {
+          const { waitUntilExit } = render(
+            /* @__PURE__ */ jsx4(AuthStatus, { onComplete: () => {
+            } })
+          );
+          waitUntilExit().then(() => {
+            const auth = storage.getAuth();
+            resolve({
+              authenticated: !!auth,
+              ...auth ? {
+                access_token: `${auth.access_token.substring(0, 20)}...`,
+                token_type: auth.token_type
+              } : {},
+              credentials_path: storage.getPath()
+            });
+          });
+        });
+      }
       const opts = c.options;
       const interval = opts.interval;
       const maxAttempts = opts.maxAttempts;
@@ -11580,10 +11653,644 @@ function createAuthCli(authResource, updateInfo) {
   return cli2;
 }
 
-// src/commands/mpp/index.tsx
-import { Cli as Cli2, z as z3 } from "incur";
+// src/commands/demo/index.tsx
+import { Cli as Cli2, z as z2 } from "incur";
 import { render as render2 } from "ink";
 
+// src/commands/demo/demo-runner.tsx
+import { Box as Box8, Text as Text9, useInput as useInput4 } from "ink";
+import { useCallback, useState as useState7 } from "react";
+
+// src/utils/markdown-text.tsx
+import { Text as Text4 } from "ink";
+import { jsx as jsx5 } from "react/jsx-runtime";
+var MarkdownText = ({
+  children,
+  dimColor
+}) => {
+  const parts = tokenize(children);
+  return /* @__PURE__ */ jsx5(Text4, { dimColor, children: parts.map((part) => {
+    if (part.type === "bold") {
+      return /* @__PURE__ */ jsx5(Text4, { bold: true, children: part.text }, part.key);
+    }
+    if (part.type === "code") {
+      return /* @__PURE__ */ jsx5(Text4, { color: "yellow", children: part.text }, part.key);
+    }
+    return /* @__PURE__ */ jsx5(Text4, { children: part.text }, part.key);
+  }) });
+};
+function tokenize(input) {
+  const tokens = [];
+  const re = /\*\*([^*]+)\*\*|`([^`]+)`/g;
+  let last = 0;
+  for (; ; ) {
+    const match = re.exec(input);
+    if (match === null) break;
+    if (match.index > last) {
+      tokens.push({
+        type: "text",
+        key: `t${last}`,
+        text: input.slice(last, match.index)
+      });
+    }
+    if (match[1] !== void 0) {
+      tokens.push({ type: "bold", key: `b${match.index}`, text: match[1] });
+    } else if (match[2] !== void 0) {
+      tokens.push({
+        type: "code",
+        key: `c${match.index}`,
+        text: `\`${match[2]}\``
+      });
+    }
+    last = match.index + match[0].length;
+  }
+  if (last < input.length) {
+    tokens.push({ type: "text", key: `t${last}`, text: input.slice(last) });
+  }
+  return tokens;
+}
+
+// src/commands/spend-request/app-download-qr-codes.tsx
+import { Box as Box4, Text as Text5 } from "ink";
+import { useMemo } from "react";
+
+// src/utils/render-qr-matrix.ts
+import QRCode from "qrcode";
+function renderQrMatrix(url) {
+  const qr = QRCode.create(url, { errorCorrectionLevel: "L" });
+  const size = qr.modules.size;
+  const data = qr.modules.data;
+  const quiet = 1;
+  const total = size + quiet * 2;
+  const matrix = Array.from(
+    { length: total },
+    (_, r) => Array.from({ length: total }, (_2, c) => {
+      if (r < quiet || r >= size + quiet || c < quiet || c >= size + quiet) {
+        return false;
+      }
+      return data[(r - quiet) * size + (c - quiet)] === 1;
+    })
+  );
+  const lines = [];
+  for (let r = 0; r < total; r += 2) {
+    let line = "";
+    for (let c = 0; c < total; c++) {
+      const top = matrix[r][c];
+      const bottom = r + 1 < total ? matrix[r + 1][c] : false;
+      if (top && bottom) line += "\u2588";
+      else if (top) line += "\u2580";
+      else if (bottom) line += "\u2584";
+      else line += " ";
+    }
+    lines.push(line);
+  }
+  return lines;
+}
+
+// src/commands/spend-request/app-download-qr-codes.tsx
+import { jsx as jsx6, jsxs as jsxs3 } from "react/jsx-runtime";
+var DOWNLOAD_URL = "https://link.com/download";
+var AppDownloadQrCodes = () => {
+  const qrLines = useMemo(() => renderQrMatrix(DOWNLOAD_URL), []);
+  return /* @__PURE__ */ jsxs3(Box4, { flexDirection: "column", marginTop: 1, children: [
+    /* @__PURE__ */ jsx6(Text5, { dimColor: true, children: "Get the Link app to approve spend requests from your phone" }),
+    /* @__PURE__ */ jsxs3(Box4, { flexDirection: "column", alignItems: "flex-start", marginTop: 1, children: [
+      qrLines.map((line, i) => (
+        // biome-ignore lint/suspicious/noArrayIndexKey: stable static array
+        /* @__PURE__ */ jsx6(Text5, { children: line }, i)
+      )),
+      /* @__PURE__ */ jsx6(Text5, { dimColor: true, children: DOWNLOAD_URL })
+    ] })
+  ] });
+};
+
+// src/commands/demo/card-flow.tsx
+import { Box as Box5, Text as Text6, useInput as useInput2 } from "ink";
+import { useEffect as useEffect4, useRef, useState as useState4 } from "react";
+
+// src/utils/poll-until-approved.ts
+function pollUntilApproved(repository, id, options = {}) {
+  const pollIntervalMs = options.pollIntervalMs ?? 2e3;
+  const timeoutMs = options.timeoutMs ?? 3e5;
+  const startTime = Date.now();
+  const poll = async () => {
+    const elapsed = Date.now() - startTime;
+    if (elapsed > timeoutMs) {
+      throw new Error("Approval polling timed out");
+    }
+    const request = await repository.getSpendRequest(id);
+    if (!request) {
+      throw new Error(`Spend request ${id} not found`);
+    }
+    if (request.status !== "created" && request.status !== "pending_approval") {
+      return request;
+    }
+    options.onProgress?.(Math.floor(elapsed / 1e3));
+    await new Promise((r) => setTimeout(r, pollIntervalMs));
+    return poll();
+  };
+  return poll();
+}
+
+// src/commands/demo/constants.ts
+var DEMO_MERCHANT_NAME = "Galtee Outdoor";
+var DEMO_MERCHANT_URL = "https://galtee.stripedemos.com/en/products/prod_RtAl1kmlzvL8oj";
+var DEMO_MPP_DEV_URL = "https://mpp.dev";
+var DEMO_CLIMATE_API_URL = "https://climate.stripe.dev/api/test/contribute";
+var DEMO_CARD_AMOUNT = 12900;
+var DEMO_SPT_AMOUNT = 100;
+var DEMO_CARD_CONTEXT = "Link CLI onboarding demo: Errigal Puffer Jacket from Galtee Outdoor. Agent completing checkout using a virtual card credential.";
+var DEMO_SPT_CONTEXT = "Demo purchase: Testing the Link CLI machine payment flow by making an automated HTTP 402 payment to Stripe Climate. This demonstrates the shared payment token credential and machine payment protocol.";
+
+// src/commands/demo/content.ts
+var cardAmount = `$${(DEMO_CARD_AMOUNT / 100).toFixed(2)}`;
+var sptAmount = `$${(DEMO_SPT_AMOUNT / 100).toFixed(2)}`;
+var CARD_FLOW = {
+  title: "Flow 1: Virtual Card",
+  intro: {
+    description: `Agent buys a Errigal Puffer Jacket (${cardAmount}) with a one-time virtual card from your Link wallet. Your real card is never shared.`,
+    steps: [
+      "Select payment method",
+      `Create spend request for ${cardAmount}`,
+      "Approve in Link",
+      "Get virtual card and open checkout"
+    ],
+    prompt: "Press [Enter] to start"
+  },
+  explainPm: {
+    prompt: "Press [Enter] to create a spend request"
+  },
+  createSpend: {
+    description: `Requests ${cardAmount} from your wallet. No credentials issued until you approve.`,
+    loading: "Creating spend request..."
+  },
+  approval: {
+    description: "Open the URL to approve. CLI continues once approved.",
+    loading: "Waiting for approval...",
+    browserHint: "Press [Enter] to open in browser"
+  },
+  showCard: {
+    description: "One-time virtual card issued. Enter these at Galtee Outdoor checkout:",
+    prompt: "Press [Enter] to open Galtee Outdoor"
+  },
+  done: {
+    success: "Opened Galtee Outdoor in your browser",
+    detail: "Testmode \u2014 no real charge."
+  }
+};
+var SPT_FLOW = {
+  title: "Flow 2: Machine Payment (SPT)",
+  intro: {
+    description: "No checkout form. The server returns **HTTP 402** with a payment challenge. The link-cli creates and sends a **Shared Payment Token** (SPT) programmaticaly scoped to the business and amount.",
+    preamble: `${sptAmount} donation to Stripe Climate demonstrates:`,
+    steps: [
+      "Select payment method",
+      "Probe API \u2014 get HTTP 402 challenge and decode `network_id`",
+      "Create SPT spend request",
+      "Approve",
+      "`mpp pay` signs and retries"
+    ],
+    prompt: "Press [Enter] to start"
+  },
+  probe: {
+    description: `POST to ${DEMO_CLIMATE_API_URL} without credentials \u2014 server returns 402 with a \`WWW-Authenticate\` challenge.`,
+    loading: "Probing...",
+    detail: "Challenge contains a `network_id` \u2014 the business identifier on Stripe's network.",
+    prompt: "Press [Enter] to create a spend request"
+  },
+  createSpend: {
+    description: `Request an SPT using the decoded \`network_id\` and amount (${sptAmount}).`,
+    loading: "Creating spend request..."
+  },
+  approval: {
+    description: "Approve to issue the SPT.",
+    loading: "Waiting for approval...",
+    browserHint: "Press [Enter] to open in browser"
+  },
+  mppPay: {
+    description: "`mpp pay` retrieves the SPT, signs the challenge, retries with `Authorization: Payment`.",
+    loading: "Completing payment...",
+    prompt: "Press [Enter] to pay"
+  },
+  done: {
+    success: "Payment complete",
+    detail: `${sptAmount} donation completed via API \u2014 no forms, no browser.`
+  }
+};
+var DEMO_MENU = {
+  title: "Link CLI Demo",
+  subtitle: "See how agents use Link to make payments.",
+  question: "Which flow would you like to run?",
+  hint: "Use \u2191\u2193 to select, [Enter] to confirm",
+  options: [
+    {
+      key: "both",
+      label: "Both flows",
+      description: "Run both end-to-end."
+    },
+    {
+      key: "card",
+      label: "Virtual card",
+      description: "One-time card number for checkout forms."
+    },
+    {
+      key: "spt",
+      label: "Machine payment (SPT)",
+      description: "Pay via API \u2014 no browser, no forms."
+    }
+  ],
+  transition: "Card flow done. Next: **machine payment** \u2014 paying an API directly.",
+  transitionPrompt: "Press [Enter] to continue to Flow 2"
+};
+var ONBOARD = {
+  title: "Welcome to Link CLI",
+  subtitle: "Let agents make secure payments on your behalf.",
+  auth: {
+    alreadyLoggedIn: "Already logged in",
+    authenticated: "Authenticated",
+    clientName: "Link CLI Onboard"
+  },
+  paymentMethods: {
+    loading: "Checking payment methods...",
+    pickPrompt: "Which payment method should we use for the demo?",
+    pickHint: "Use \u2191\u2193 to select, [Enter] to confirm",
+    missing: "No payment methods in your Link wallet.",
+    missingSteps: [
+      "Open the Link app or visit link.com",
+      "Add a payment method",
+      "Press [Enter] to retry"
+    ],
+    retryPrompt: "Press [Enter] to retry"
+  },
+  appTip: {
+    title: "Get the Link app",
+    description: "Approve spend requests from your phone with push notifications.",
+    url: "https://link.com/download"
+  }
+};
+
+// src/commands/demo/card-flow.tsx
+import { Fragment, jsx as jsx7, jsxs as jsxs4 } from "react/jsx-runtime";
+function formatPmLabel(pm) {
+  return `${pm.card_details?.brand ?? pm.type} ****${pm.card_details?.last4 ?? ""}`;
+}
+function formatCardNumber(num) {
+  return num.replace(/(.{4})/g, "$1 ").trim();
+}
+function formatExpiry(month, year) {
+  return `${String(month).padStart(2, "0")}/${String(year).slice(-2)}`;
+}
+var CardFlow = ({
+  spendRequestRepo: spendRequestRepo2,
+  paymentMethodsResource,
+  paymentMethodId: initialPaymentMethodId,
+  onComplete
+}) => {
+  const [step, setStep] = useState4("intro");
+  const [paymentMethod, setPaymentMethod] = useState4(
+    null
+  );
+  const [paymentMethods, setPaymentMethods] = useState4([]);
+  const [selectedPmIndex, setSelectedPmIndex] = useState4(0);
+  const [spendRequest, setSpendRequest] = useState4(null);
+  const [error, setError] = useState4("");
+  const approvalUrl = spendRequest?.approval_url ?? "";
+  const enterResolver = useRef(null);
+  const pmResolver = useRef(null);
+  const retryChoiceResolver = useRef(null);
+  function waitForEnter() {
+    return new Promise((resolve) => {
+      enterResolver.current = resolve;
+    });
+  }
+  function waitForPmSelection() {
+    return new Promise((resolve) => {
+      pmResolver.current = resolve;
+    });
+  }
+  function waitForRetryChoice() {
+    return new Promise((resolve) => {
+      retryChoiceResolver.current = resolve;
+    });
+  }
+  useInput2((input, key) => {
+    if (step === "pick-pm") {
+      if (key.upArrow) {
+        setSelectedPmIndex((i) => i > 0 ? i - 1 : paymentMethods.length - 1);
+      } else if (key.downArrow) {
+        setSelectedPmIndex((i) => i < paymentMethods.length - 1 ? i + 1 : 0);
+      } else if (key.return && pmResolver.current) {
+        const pm = paymentMethods[selectedPmIndex];
+        const resolve = pmResolver.current;
+        pmResolver.current = null;
+        resolve(pm.id);
+      }
+    } else if (step === "approval-timeout" && retryChoiceResolver.current) {
+      if (input === "r") {
+        const resolve = retryChoiceResolver.current;
+        retryChoiceResolver.current = null;
+        resolve("retry");
+      } else if (input === "q") {
+        const resolve = retryChoiceResolver.current;
+        retryChoiceResolver.current = null;
+        resolve("exit");
+      }
+    } else if (key.return) {
+      if (enterResolver.current) {
+        const resolve = enterResolver.current;
+        enterResolver.current = null;
+        resolve();
+      } else if ((step === "await-approval" || step === "approval-timeout") && approvalUrl) {
+        openUrl(approvalUrl);
+      }
+    }
+  });
+  const started = useRef(false);
+  useEffect4(() => {
+    if (started.current) return;
+    started.current = true;
+    const run = async () => {
+      try {
+        await waitForEnter();
+        let pmId = initialPaymentMethodId;
+        if (!pmId) {
+          setStep("fetch-pm");
+          const methods = await paymentMethodsResource.listPaymentMethods();
+          if (methods.length === 0) {
+            setError(
+              "No payment methods found. Open the Link app (link.com) and add a card to your wallet, then run the demo again."
+            );
+            setStep("error");
+            onComplete({ paymentMethodId: "", success: false });
+            return;
+          }
+          if (methods.length === 1) {
+            const pm = methods[0];
+            setPaymentMethod(pm);
+            setPaymentMethods(methods);
+            pmId = pm.id;
+          } else {
+            setPaymentMethods(methods);
+            const defaultIdx = methods.findIndex((m) => m.is_default);
+            setSelectedPmIndex(defaultIdx >= 0 ? defaultIdx : 0);
+            setStep("pick-pm");
+            pmId = await waitForPmSelection();
+            const pm = methods.find((m) => m.id === pmId) ?? methods[0];
+            setPaymentMethod(pm);
+          }
+          setStep("explain-pm");
+          await waitForEnter();
+        }
+        setStep("create-spend");
+        const result = await spendRequestRepo2.createSpendRequest({
+          payment_details: pmId,
+          credential_type: "card",
+          amount: DEMO_CARD_AMOUNT,
+          context: DEMO_CARD_CONTEXT,
+          merchant_name: DEMO_MERCHANT_NAME,
+          merchant_url: DEMO_MERCHANT_URL,
+          request_approval: true,
+          test: true
+        });
+        setSpendRequest(result);
+        setStep("await-approval");
+        for (; ; ) {
+          try {
+            await pollUntilApproved(spendRequestRepo2, result.id);
+            break;
+          } catch (err) {
+            if (err.message === "Approval polling timed out") {
+              setStep("approval-timeout");
+              const choice = await waitForRetryChoice();
+              if (choice === "exit") {
+                onComplete({ paymentMethodId: pmId ?? "", success: false });
+                return;
+              }
+              setStep("await-approval");
+            } else {
+              throw err;
+            }
+          }
+        }
+        const approved = await spendRequestRepo2.getSpendRequest(result.id, {
+          include: ["card"]
+        });
+        if (approved) setSpendRequest(approved);
+        setStep("show-card");
+        await waitForEnter();
+        setStep("open-url");
+        openUrl(DEMO_MERCHANT_URL);
+        setStep("done");
+        onComplete({ paymentMethodId: pmId, success: true });
+      } catch (err) {
+        setError(err.message);
+        setStep("error");
+        onComplete({
+          paymentMethodId: paymentMethod?.id ?? "",
+          success: false
+        });
+      }
+    };
+    run();
+  }, []);
+  const pmLabel = paymentMethod ? formatPmLabel(paymentMethod) : "";
+  const card = spendRequest?.card;
+  const pastStep = (target) => {
+    const order = [
+      "intro",
+      "fetch-pm",
+      "pick-pm",
+      "explain-pm",
+      "create-spend",
+      "await-approval",
+      "show-card",
+      "open-url",
+      "done"
+    ];
+    return order.indexOf(step) > order.indexOf(target);
+  };
+  const prompt = (label = "Press [Enter] to continue") => /* @__PURE__ */ jsxs4(Text6, { dimColor: true, children: [
+    "\n",
+    ">",
+    " ",
+    label
+  ] });
+  return /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", gap: 1, children: [
+    /* @__PURE__ */ jsx7(Text6, { bold: true, color: "cyan", children: CARD_FLOW.title }),
+    /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs4(Box5, { flexDirection: "row", gap: 1, children: [
+        /* @__PURE__ */ jsx7(Text6, { color: "yellow", children: "[testmode]" }),
+        /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: DEMO_MERCHANT_URL })
+      ] }),
+      /* @__PURE__ */ jsx7(MarkdownText, { children: CARD_FLOW.intro.description }),
+      /* @__PURE__ */ jsxs4(Box5, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsx7(Text6, { children: "What happens:" }),
+        CARD_FLOW.intro.steps.map((s, i) => {
+          const doneAfter = [
+            "pick-pm",
+            "create-spend",
+            "await-approval",
+            "show-card"
+          ];
+          const activeFrom = [
+            "fetch-pm",
+            "create-spend",
+            "await-approval",
+            "show-card"
+          ];
+          const done = pastStep(doneAfter[i]);
+          const active = !done && (step === activeFrom[i] || pastStep(activeFrom[i]));
+          return done ? /* @__PURE__ */ jsxs4(Text6, { dimColor: true, strikethrough: true, children: [
+            " ",
+            i + 1,
+            ". ",
+            s
+          ] }, s) : active ? /* @__PURE__ */ jsxs4(Text6, { bold: true, color: "cyan", children: [
+            " ",
+            i + 1,
+            ". ",
+            s
+          ] }, s) : /* @__PURE__ */ jsxs4(Text6, { dimColor: true, children: [
+            " ",
+            i + 1,
+            ". ",
+            s
+          ] }, s);
+        })
+      ] }),
+      step === "intro" && prompt(CARD_FLOW.intro.prompt)
+    ] }),
+    step === "fetch-pm" && /* @__PURE__ */ jsx7(Box5, { flexDirection: "column", children: /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: "Fetching payment methods from your Link wallet..." }) }),
+    (step === "pick-pm" || step === "explain-pm") && /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", children: [
+      step === "pick-pm" && paymentMethods.length > 1 && /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", children: [
+        /* @__PURE__ */ jsx7(Text6, { children: "Which payment method should we use for the demo?" }),
+        /* @__PURE__ */ jsx7(Box5, { flexDirection: "column", marginTop: 1, children: paymentMethods.map((pm, i) => /* @__PURE__ */ jsx7(Text6, { children: i === selectedPmIndex ? /* @__PURE__ */ jsxs4(Text6, { color: "cyan", bold: true, children: [
+          ">",
+          " ",
+          formatPmLabel(pm),
+          pm.is_default ? " (default)" : ""
+        ] }) : /* @__PURE__ */ jsxs4(Text6, { dimColor: true, children: [
+          "  ",
+          formatPmLabel(pm),
+          pm.is_default ? " (default)" : ""
+        ] }) }, pm.id)) }),
+        /* @__PURE__ */ jsx7(Box5, { marginTop: 1, children: /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: "Use \u2191\u2193 to select, [Enter] to confirm" }) })
+      ] }),
+      paymentMethod && /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", children: [
+        /* @__PURE__ */ jsxs4(Text6, { color: "green", children: [
+          "\u2713 Using ",
+          /* @__PURE__ */ jsx7(Text6, { bold: true, children: pmLabel }),
+          paymentMethod.is_default ? " (default)" : ""
+        ] }),
+        step === "explain-pm" && prompt(CARD_FLOW.explainPm.prompt)
+      ] })
+    ] }),
+    step === "create-spend" && /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx7(MarkdownText, { children: CARD_FLOW.createSpend.description }),
+      /* @__PURE__ */ jsx7(Box5, { marginY: 1, children: /* @__PURE__ */ jsx7(Text6, { color: "cyan", children: CARD_FLOW.createSpend.loading }) })
+    ] }),
+    (step === "await-approval" || step === "approval-timeout") && spendRequest && /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs4(Text6, { color: "green", children: [
+        "\u2713 Spend request created (",
+        spendRequest.id,
+        ")"
+      ] }),
+      step === "await-approval" && /* @__PURE__ */ jsxs4(Fragment, { children: [
+        /* @__PURE__ */ jsx7(Text6, { children: CARD_FLOW.approval.description }),
+        /* @__PURE__ */ jsxs4(
+          Box5,
+          {
+            flexDirection: "column",
+            borderStyle: "round",
+            borderColor: "cyan",
+            paddingX: 2,
+            paddingY: 1,
+            marginTop: 1,
+            children: [
+              /* @__PURE__ */ jsxs4(Text6, { children: [
+                "Approve at:",
+                " ",
+                /* @__PURE__ */ jsx7(Text6, { bold: true, color: "cyan", children: approvalUrl })
+              ] }),
+              /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: CARD_FLOW.approval.browserHint })
+            ]
+          }
+        ),
+        /* @__PURE__ */ jsx7(Box5, { marginY: 1, children: /* @__PURE__ */ jsx7(Text6, { color: "cyan", children: CARD_FLOW.approval.loading }) })
+      ] }),
+      step === "approval-timeout" && /* @__PURE__ */ jsxs4(Fragment, { children: [
+        /* @__PURE__ */ jsx7(Text6, { color: "yellow", children: "\u26A0 Approval timed out (5 min). Still pending \u2014 you can still approve." }),
+        /* @__PURE__ */ jsxs4(
+          Box5,
+          {
+            flexDirection: "column",
+            borderStyle: "round",
+            borderColor: "yellow",
+            paddingX: 2,
+            paddingY: 1,
+            marginTop: 1,
+            children: [
+              /* @__PURE__ */ jsxs4(Text6, { children: [
+                "Approve at:",
+                " ",
+                /* @__PURE__ */ jsx7(Text6, { bold: true, color: "cyan", children: approvalUrl })
+              ] }),
+              /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: "Press [Enter] to open in browser" })
+            ]
+          }
+        ),
+        /* @__PURE__ */ jsx7(Box5, { marginTop: 1, children: /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: "r Retry polling q Quit demo" }) })
+      ] })
+    ] }),
+    (step === "show-card" || step === "open-url" || step === "done") && card && /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx7(Text6, { color: "green", children: "\u2713 Approved!" }),
+      /* @__PURE__ */ jsx7(MarkdownText, { children: CARD_FLOW.showCard.description }),
+      /* @__PURE__ */ jsx7(Box5, { flexDirection: "column", paddingX: 2, marginTop: 1, children: /* @__PURE__ */ jsxs4(Text6, { children: [
+        /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: "Number " }),
+        /* @__PURE__ */ jsx7(Text6, { bold: true, children: formatCardNumber(card.number) }),
+        "  ",
+        /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: "Exp " }),
+        /* @__PURE__ */ jsx7(Text6, { bold: true, children: formatExpiry(card.exp_month, card.exp_year) }),
+        "  ",
+        /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: "CVC " }),
+        /* @__PURE__ */ jsx7(Text6, { bold: true, children: card.cvc }),
+        card.billing_address?.postal_code && /* @__PURE__ */ jsxs4(Fragment, { children: [
+          "  ",
+          /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: "Zip " }),
+          /* @__PURE__ */ jsx7(Text6, { bold: true, children: card.billing_address.postal_code })
+        ] }),
+        card.valid_until && /* @__PURE__ */ jsxs4(Fragment, { children: [
+          "  ",
+          /* @__PURE__ */ jsxs4(Text6, { dimColor: true, children: [
+            "expires",
+            " ",
+            new Date(card.valid_until).toLocaleTimeString([], {
+              hour: "2-digit",
+              minute: "2-digit"
+            })
+          ] })
+        ] })
+      ] }) }),
+      step === "show-card" && prompt(CARD_FLOW.showCard.prompt)
+    ] }),
+    step === "done" && /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs4(Text6, { color: "green", children: [
+        "\u2713 ",
+        CARD_FLOW.done.success
+      ] }),
+      /* @__PURE__ */ jsx7(Text6, { children: CARD_FLOW.done.detail })
+    ] }),
+    step === "error" && /* @__PURE__ */ jsxs4(Text6, { color: "red", children: [
+      "Error: ",
+      error
+    ] })
+  ] });
+};
+
+// src/commands/demo/spt-flow.tsx
+import { Box as Box7, Text as Text8, useInput as useInput3 } from "ink";
+import { useEffect as useEffect6, useRef as useRef2, useState as useState6 } from "react";
+
 // src/commands/mpp/decode.ts
 import { Challenge } from "mppx";
 function getString(value, path5, required = true) {
@@ -11662,41 +12369,14 @@ function decodeStripeChallenge(challengeHeader) {
   };
 }
 
-// src/commands/mpp/decode-view.tsx
-import { Box as Box3, Text as Text3 } from "ink";
-import { jsx as jsx4, jsxs as jsxs2 } from "react/jsx-runtime";
-function DecodeChallengeView({
-  decoded
-}) {
-  return /* @__PURE__ */ jsxs2(Box3, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx4(Text3, { color: "green", children: "\u2713 Stripe challenge decoded" }),
-    /* @__PURE__ */ jsxs2(Box3, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-      /* @__PURE__ */ jsxs2(Text3, { children: [
-        "ID: ",
-        /* @__PURE__ */ jsx4(Text3, { bold: true, children: decoded.id })
-      ] }),
-      /* @__PURE__ */ jsxs2(Text3, { children: [
-        "Realm: ",
-        /* @__PURE__ */ jsx4(Text3, { bold: true, children: decoded.realm })
-      ] }),
-      /* @__PURE__ */ jsxs2(Text3, { children: [
-        "Network ID: ",
-        /* @__PURE__ */ jsx4(Text3, { bold: true, children: decoded.network_id })
-      ] }),
-      /* @__PURE__ */ jsx4(Text3, { children: "Request JSON:" }),
-      /* @__PURE__ */ jsx4(Text3, { children: JSON.stringify(decoded.request_json, null, 2) })
-    ] })
-  ] });
-}
-
 // src/commands/mpp/pay.tsx
-import { Box as Box4, Text as Text4 } from "ink";
+import { Box as Box6, Text as Text7 } from "ink";
 import Spinner2 from "ink-spinner";
 import { Credential, Method } from "mppx";
 import { Mppx, Transport } from "mppx/client";
 import { Methods as StripeMethods } from "mppx/stripe";
-import { useEffect as useEffect3, useState as useState3 } from "react";
-import { jsx as jsx5, jsxs as jsxs3 } from "react/jsx-runtime";
+import { useEffect as useEffect5, useState as useState5 } from "react";
+import { jsx as jsx8, jsxs as jsxs5 } from "react/jsx-runtime";
 function buildHeaders(data, headers) {
   const result = {};
   if (data !== void 0) {
@@ -11801,10 +12481,10 @@ function MppPay({
   repository,
   onComplete
 }) {
-  const [step, setStep] = useState3("retrieving");
-  const [result, setResult] = useState3(null);
-  const [error, setError] = useState3(null);
-  useEffect3(() => {
+  const [step, setStep] = useState5("retrieving");
+  const [result, setResult] = useState5(null);
+  const [error, setError] = useState5(null);
+  useEffect5(() => {
     (async () => {
       try {
         setStep("retrieving");
@@ -11873,54 +12553,607 @@ function MppPay({
     done: "Done"
   };
   if (error) {
-    return /* @__PURE__ */ jsxs3(Text4, { color: "red", children: [
+    return /* @__PURE__ */ jsxs5(Text7, { color: "red", children: [
       "Error: ",
       error
     ] });
   }
-  return /* @__PURE__ */ jsxs3(Box4, { flexDirection: "column", children: [
-    step !== "done" && /* @__PURE__ */ jsx5(Box4, { children: /* @__PURE__ */ jsxs3(Text4, { color: "cyan", children: [
-      /* @__PURE__ */ jsx5(Spinner2, { type: "dots" }),
+  return /* @__PURE__ */ jsxs5(Box6, { flexDirection: "column", children: [
+    step !== "done" && /* @__PURE__ */ jsx8(Box6, { children: /* @__PURE__ */ jsxs5(Text7, { color: "cyan", children: [
+      /* @__PURE__ */ jsx8(Spinner2, { type: "dots" }),
       " ",
       stepLabels[step],
       "..."
     ] }) }),
-    result && /* @__PURE__ */ jsxs3(Box4, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs3(Text4, { color: "green", children: [
+    result && /* @__PURE__ */ jsxs5(Box6, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs5(Text7, { color: "green", children: [
         "HTTP ",
         result.status
       ] }),
-      /* @__PURE__ */ jsx5(Text4, { children: result.body })
+      /* @__PURE__ */ jsx8(Text7, { children: result.body })
     ] })
   ] });
 }
 
-// src/commands/mpp/schema.ts
-import { z as z2 } from "incur";
-var payOptions = z2.object({
-  spendRequestId: z2.string().describe(
-    'Approved spend request ID with credential_type "shared_payment_token"'
-  ),
-  method: z2.string().optional().describe("HTTP method (default: GET, or POST if --data is provided)"),
-  data: z2.string().optional().describe("Request body (implies POST if --method is not set)"),
-  header: z2.array(z2.string()).default([]).describe('Request header in "Name: Value" format (repeatable)')
-});
-var decodeOptions = z2.object({
-  challenge: z2.string().describe(
-    "Raw WWW-Authenticate header value; may include multiple payment challenges"
-  )
-});
-
-// src/commands/mpp/index.tsx
-import { jsx as jsx6 } from "react/jsx-runtime";
-function createMppCli(repository) {
-  const cli2 = Cli2.create("mpp", {
-    description: "Machine payment protocol (MPP) commands"
+// src/commands/demo/spt-flow.tsx
+import { Fragment as Fragment2, jsx as jsx9, jsxs as jsxs6 } from "react/jsx-runtime";
+var SptFlow = ({
+  spendRequestRepo: spendRequestRepo2,
+  paymentMethodsResource,
+  paymentMethodId: initialPaymentMethodId,
+  onComplete
+}) => {
+  const [step, setStep] = useState6("intro");
+  const [networkId, setNetworkId] = useState6("");
+  const [paymentMethods, setPaymentMethods] = useState6([]);
+  const [selectedPmIndex, setSelectedPmIndex] = useState6(0);
+  const [spendRequest, setSpendRequest] = useState6(null);
+  const [payResult, setPayResult] = useState6(null);
+  const [error, setError] = useState6("");
+  const approvalUrl = spendRequest?.approval_url ?? "";
+  const enterResolver = useRef2(null);
+  const pmResolver = useRef2(null);
+  const retryChoiceResolver = useRef2(null);
+  function waitForEnter() {
+    return new Promise((resolve) => {
+      enterResolver.current = resolve;
+    });
+  }
+  function waitForPmSelection() {
+    return new Promise((resolve) => {
+      pmResolver.current = resolve;
+    });
+  }
+  function waitForRetryChoice() {
+    return new Promise((resolve) => {
+      retryChoiceResolver.current = resolve;
+    });
+  }
+  useInput3((input, key) => {
+    if (step === "pick-pm") {
+      if (key.upArrow) {
+        setSelectedPmIndex((i) => i > 0 ? i - 1 : paymentMethods.length - 1);
+      } else if (key.downArrow) {
+        setSelectedPmIndex((i) => i < paymentMethods.length - 1 ? i + 1 : 0);
+      } else if (key.return && pmResolver.current) {
+        const pm = paymentMethods[selectedPmIndex];
+        const resolve = pmResolver.current;
+        pmResolver.current = null;
+        resolve(pm.id);
+      }
+    } else if (step === "approval-timeout" && retryChoiceResolver.current) {
+      if (input === "r") {
+        const resolve = retryChoiceResolver.current;
+        retryChoiceResolver.current = null;
+        resolve("retry");
+      } else if (input === "q") {
+        const resolve = retryChoiceResolver.current;
+        retryChoiceResolver.current = null;
+        resolve("exit");
+      }
+    } else if (key.return) {
+      if (enterResolver.current) {
+        const resolve = enterResolver.current;
+        enterResolver.current = null;
+        resolve();
+      } else if ((step === "await-approval" || step === "approval-timeout") && approvalUrl) {
+        openUrl(approvalUrl);
+      }
+    }
+  });
+  const started = useRef2(false);
+  useEffect6(() => {
+    if (started.current) return;
+    started.current = true;
+    const run = async () => {
+      try {
+        await waitForEnter();
+        let pmId = initialPaymentMethodId;
+        if (!pmId) {
+          setStep("fetch-pm");
+          const methods = await paymentMethodsResource.listPaymentMethods();
+          if (methods.length === 0) {
+            throw new Error(
+              "No payment methods found. Open the Link app (link.com) and add a card to your wallet, then run the demo again."
+            );
+          }
+          if (methods.length === 1) {
+            pmId = methods[0].id;
+          } else {
+            setPaymentMethods(methods);
+            const defaultIdx = methods.findIndex((m) => m.is_default);
+            setSelectedPmIndex(defaultIdx >= 0 ? defaultIdx : 0);
+            setStep("pick-pm");
+            pmId = await waitForPmSelection();
+          }
+        }
+        setStep("probe");
+        const probeResponse = await fetch(DEMO_CLIMATE_API_URL, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ amount: DEMO_SPT_AMOUNT })
+        });
+        if (probeResponse.status !== 402) {
+          throw new Error(
+            `Expected 402 from ${DEMO_CLIMATE_API_URL}, got ${probeResponse.status}`
+          );
+        }
+        const wwwAuth = probeResponse.headers.get("www-authenticate") ?? "";
+        const decoded = decodeStripeChallenge(wwwAuth);
+        setNetworkId(decoded.network_id);
+        setStep("explain-402");
+        await waitForEnter();
+        setStep("create-spend");
+        const result = await spendRequestRepo2.createSpendRequest({
+          payment_details: pmId,
+          credential_type: "shared_payment_token",
+          network_id: decoded.network_id,
+          amount: DEMO_SPT_AMOUNT,
+          context: DEMO_SPT_CONTEXT,
+          request_approval: true,
+          test: true
+        });
+        setSpendRequest(result);
+        setStep("await-approval");
+        for (; ; ) {
+          try {
+            const approved = await pollUntilApproved(
+              spendRequestRepo2,
+              result.id
+            );
+            setSpendRequest(approved);
+            break;
+          } catch (err) {
+            if (err.message === "Approval polling timed out") {
+              setStep("approval-timeout");
+              const choice = await waitForRetryChoice();
+              if (choice === "exit") {
+                onComplete(false);
+                return;
+              }
+              setStep("await-approval");
+            } else {
+              throw err;
+            }
+          }
+        }
+        setStep("mpp-pay-gate");
+        await waitForEnter();
+        setStep("mpp-pay");
+        const payResponse = await runMppPay(
+          DEMO_CLIMATE_API_URL,
+          result.id,
+          "POST",
+          JSON.stringify({ amount: DEMO_SPT_AMOUNT }),
+          void 0,
+          spendRequestRepo2
+        );
+        setPayResult(payResponse);
+        setStep("done");
+        onComplete(true);
+      } catch (err) {
+        setError(err.message);
+        setStep("error");
+        onComplete(false);
+      }
+    };
+    run();
+  }, []);
+  const pastStep = (target) => {
+    const order = [
+      "intro",
+      "fetch-pm",
+      "pick-pm",
+      "probe",
+      "explain-402",
+      "create-spend",
+      "await-approval",
+      "mpp-pay-gate",
+      "mpp-pay",
+      "done"
+    ];
+    return order.indexOf(step) > order.indexOf(target);
+  };
+  const prompt = (label = "Press [Enter] to continue") => /* @__PURE__ */ jsxs6(Text8, { dimColor: true, children: [
+    "\n",
+    ">",
+    " ",
+    label
+  ] });
+  return /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", gap: 1, children: [
+    /* @__PURE__ */ jsx9(Text8, { bold: true, color: "cyan", children: SPT_FLOW.title }),
+    /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs6(Box7, { flexDirection: "row", gap: 1, children: [
+        /* @__PURE__ */ jsx9(Text8, { color: "yellow", children: "[testmode]" }),
+        /* @__PURE__ */ jsxs6(Text8, { dimColor: true, children: [
+          DEMO_CLIMATE_API_URL,
+          "  ",
+          DEMO_MPP_DEV_URL
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx9(MarkdownText, { children: SPT_FLOW.intro.description }),
+      /* @__PURE__ */ jsxs6(Box7, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsx9(Text8, { children: SPT_FLOW.intro.preamble }),
+        SPT_FLOW.intro.steps.map((s, i) => {
+          const doneAfter = [
+            "pick-pm",
+            "probe",
+            "create-spend",
+            "await-approval",
+            "mpp-pay"
+          ];
+          const activeFrom = [
+            "fetch-pm",
+            "probe",
+            "create-spend",
+            "await-approval",
+            "mpp-pay-gate"
+          ];
+          const done = pastStep(doneAfter[i]);
+          const active = !done && (step === activeFrom[i] || pastStep(activeFrom[i]));
+          const label = s.replace(/`/g, "");
+          return done ? /* @__PURE__ */ jsxs6(Text8, { dimColor: true, strikethrough: true, children: [
+            " ",
+            i + 1,
+            ". ",
+            label
+          ] }, s) : active ? /* @__PURE__ */ jsxs6(Text8, { bold: true, color: "cyan", children: [
+            " ",
+            i + 1,
+            ". ",
+            label
+          ] }, s) : /* @__PURE__ */ jsxs6(Text8, { dimColor: true, children: [
+            " ",
+            i + 1,
+            ". ",
+            label
+          ] }, s);
+        })
+      ] }),
+      step === "intro" && prompt(SPT_FLOW.intro.prompt)
+    ] }),
+    step === "fetch-pm" && /* @__PURE__ */ jsx9(Box7, { marginY: 1, children: /* @__PURE__ */ jsx9(Text8, { color: "cyan", children: "Fetching payment methods..." }) }),
+    step === "pick-pm" && paymentMethods.length > 1 && /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx9(Text8, { children: "Which payment method should we use for the demo?" }),
+      /* @__PURE__ */ jsx9(Box7, { flexDirection: "column", marginTop: 1, children: paymentMethods.map((pm, i) => /* @__PURE__ */ jsx9(Text8, { children: i === selectedPmIndex ? /* @__PURE__ */ jsxs6(Text8, { color: "cyan", bold: true, children: [
+        ">",
+        " ",
+        pm.card_details ? `${pm.card_details.brand} ****${pm.card_details.last4}` : pm.type,
+        pm.is_default ? " (default)" : ""
+      ] }) : /* @__PURE__ */ jsxs6(Text8, { dimColor: true, children: [
+        "  ",
+        pm.card_details ? `${pm.card_details.brand} ****${pm.card_details.last4}` : pm.type,
+        pm.is_default ? " (default)" : ""
+      ] }) }, pm.id)) }),
+      /* @__PURE__ */ jsx9(Box7, { marginTop: 1, children: /* @__PURE__ */ jsx9(Text8, { dimColor: true, children: "Use \u2191\u2193 to select, [Enter] to confirm" }) })
+    ] }),
+    (step === "probe" || step === "explain-402") && /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx9(MarkdownText, { children: SPT_FLOW.probe.description }),
+      step === "probe" && /* @__PURE__ */ jsx9(Box7, { marginY: 1, children: /* @__PURE__ */ jsx9(Text8, { color: "cyan", children: SPT_FLOW.probe.loading }) }),
+      step === "explain-402" && networkId && /* @__PURE__ */ jsxs6(Fragment2, { children: [
+        /* @__PURE__ */ jsx9(MarkdownText, { children: SPT_FLOW.probe.detail }),
+        /* @__PURE__ */ jsxs6(Text8, { color: "green", children: [
+          "\u2713 Got HTTP 402 \u2014 network_id: ",
+          /* @__PURE__ */ jsx9(Text8, { bold: true, children: networkId })
+        ] }),
+        prompt(SPT_FLOW.probe.prompt)
+      ] })
+    ] }),
+    step === "create-spend" && /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx9(MarkdownText, { children: SPT_FLOW.createSpend.description }),
+      /* @__PURE__ */ jsx9(Box7, { marginY: 1, children: /* @__PURE__ */ jsx9(Text8, { color: "cyan", children: SPT_FLOW.createSpend.loading }) })
+    ] }),
+    (step === "await-approval" || step === "approval-timeout") && spendRequest && /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs6(Text8, { color: "green", children: [
+        "\u2713 Spend request created (",
+        spendRequest.id,
+        ")"
+      ] }),
+      step === "await-approval" && /* @__PURE__ */ jsxs6(Fragment2, { children: [
+        /* @__PURE__ */ jsx9(Text8, { children: SPT_FLOW.approval.description }),
+        /* @__PURE__ */ jsxs6(
+          Box7,
+          {
+            flexDirection: "column",
+            borderStyle: "round",
+            borderColor: "cyan",
+            paddingX: 2,
+            paddingY: 1,
+            marginTop: 1,
+            children: [
+              /* @__PURE__ */ jsxs6(Text8, { children: [
+                "Approve at:",
+                " ",
+                /* @__PURE__ */ jsx9(Text8, { bold: true, color: "cyan", children: approvalUrl })
+              ] }),
+              /* @__PURE__ */ jsx9(Text8, { dimColor: true, children: SPT_FLOW.approval.browserHint })
+            ]
+          }
+        ),
+        /* @__PURE__ */ jsx9(Box7, { marginY: 1, children: /* @__PURE__ */ jsx9(Text8, { color: "cyan", children: SPT_FLOW.approval.loading }) })
+      ] }),
+      step === "approval-timeout" && /* @__PURE__ */ jsxs6(Fragment2, { children: [
+        /* @__PURE__ */ jsx9(Text8, { color: "yellow", children: "\u26A0 Approval timed out (5 min). Still pending \u2014 you can still approve." }),
+        /* @__PURE__ */ jsxs6(
+          Box7,
+          {
+            flexDirection: "column",
+            borderStyle: "round",
+            borderColor: "yellow",
+            paddingX: 2,
+            paddingY: 1,
+            marginTop: 1,
+            children: [
+              /* @__PURE__ */ jsxs6(Text8, { children: [
+                "Approve at:",
+                " ",
+                /* @__PURE__ */ jsx9(Text8, { bold: true, color: "cyan", children: approvalUrl })
+              ] }),
+              /* @__PURE__ */ jsx9(Text8, { dimColor: true, children: "Press [Enter] to open in browser" })
+            ]
+          }
+        ),
+        /* @__PURE__ */ jsx9(Box7, { marginTop: 1, children: /* @__PURE__ */ jsx9(Text8, { dimColor: true, children: "r Retry polling q Quit demo" }) })
+      ] })
+    ] }),
+    (step === "mpp-pay-gate" || step === "mpp-pay") && /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx9(Text8, { color: "green", children: "\u2713 Approved!" }),
+      /* @__PURE__ */ jsx9(MarkdownText, { children: SPT_FLOW.mppPay.description }),
+      step === "mpp-pay-gate" && prompt(SPT_FLOW.mppPay.prompt),
+      step === "mpp-pay" && /* @__PURE__ */ jsx9(Box7, { marginY: 1, children: /* @__PURE__ */ jsx9(Text8, { color: "cyan", children: SPT_FLOW.mppPay.loading }) })
+    ] }),
+    step === "done" && payResult && /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs6(Text8, { bold: true, color: "green", children: [
+        "\u2713 ",
+        SPT_FLOW.done.success,
+        " (HTTP ",
+        payResult.status,
+        ")"
+      ] }),
+      /* @__PURE__ */ jsx9(MarkdownText, { children: SPT_FLOW.done.detail })
+    ] }),
+    step === "error" && /* @__PURE__ */ jsxs6(Text8, { color: "red", children: [
+      "Error: ",
+      error
+    ] })
+  ] });
+};
+
+// src/commands/demo/demo-runner.tsx
+import { Fragment as Fragment3, jsx as jsx10, jsxs as jsxs7 } from "react/jsx-runtime";
+var DemoRunner = ({
+  authRepo: authRepo2,
+  spendRequestRepo: spendRequestRepo2,
+  paymentMethodsResource,
+  paymentMethodId: preselectedPmId,
+  onlyCard,
+  onlySpt,
+  onComplete
+}) => {
+  const preselected = onlyCard ? "card" : onlySpt ? "spt" : null;
+  const [choice, setChoice] = useState7(preselected);
+  const [menuIndex, setMenuIndex] = useState7(0);
+  const postAuthPhase = preselected === "spt" ? "spt-flow" : preselected ? "card-flow" : "menu";
+  const [phase, setPhase] = useState7(
+    storage.isAuthenticated() ? postAuthPhase : "auth"
+  );
+  const [paymentMethodId, setPaymentMethodId] = useState7(
+    preselectedPmId ?? ""
+  );
+  const [cardSuccess, setCardSuccess] = useState7(null);
+  const [sptSuccess, setSptSuccess] = useState7(null);
+  const runCard = choice === "card" || choice === "both";
+  const runSpt = choice === "spt" || choice === "both";
+  useInput4((_input, key) => {
+    if (phase === "menu") {
+      if (key.upArrow) {
+        setMenuIndex((i) => i > 0 ? i - 1 : DEMO_MENU.options.length - 1);
+      } else if (key.downArrow) {
+        setMenuIndex((i) => i < DEMO_MENU.options.length - 1 ? i + 1 : 0);
+      } else if (key.return) {
+        const selected = DEMO_MENU.options[menuIndex].key;
+        setChoice(selected);
+        setPhase(selected === "spt" ? "spt-flow" : "card-flow");
+      }
+    } else if (phase === "card-done" && key.return) {
+      setPhase("spt-flow");
+    }
+  });
+  const onCardComplete = useCallback(
+    (result) => {
+      setPaymentMethodId(result.paymentMethodId);
+      setCardSuccess(result.success);
+      if (!runSpt) {
+        setPhase("summary");
+        setTimeout(onComplete, 1500);
+      } else {
+        setPhase("card-done");
+      }
+    },
+    [runSpt, onComplete]
+  );
+  const onSptComplete = useCallback(
+    (success) => {
+      setSptSuccess(success);
+      setPhase("summary");
+      setTimeout(onComplete, 1500);
+    },
+    [onComplete]
+  );
+  return /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", gap: 1, children: [
+    /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx10(Text9, { bold: true, children: DEMO_MENU.title }),
+      /* @__PURE__ */ jsx10(Text9, { children: DEMO_MENU.subtitle })
+    ] }),
+    phase === "auth" && /* @__PURE__ */ jsx10(
+      Login,
+      {
+        authResource: authRepo2,
+        clientName: ONBOARD.auth.clientName,
+        onComplete: () => setPhase(postAuthPhase)
+      }
+    ),
+    phase === "menu" && /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx10(Text9, { children: DEMO_MENU.question }),
+      /* @__PURE__ */ jsx10(Box8, { flexDirection: "column", marginTop: 1, gap: 1, children: DEMO_MENU.options.map((opt, i) => /* @__PURE__ */ jsx10(Box8, { flexDirection: "column", children: i === menuIndex ? /* @__PURE__ */ jsxs7(Fragment3, { children: [
+        /* @__PURE__ */ jsxs7(Text9, { color: "cyan", bold: true, children: [
+          ">",
+          " ",
+          opt.label
+        ] }),
+        /* @__PURE__ */ jsxs7(Text9, { color: "cyan", children: [
+          "  ",
+          opt.description
+        ] })
+      ] }) : /* @__PURE__ */ jsxs7(Text9, { dimColor: true, children: [
+        "  ",
+        opt.label
+      ] }) }, opt.key)) }),
+      /* @__PURE__ */ jsx10(Box8, { marginTop: 1, children: /* @__PURE__ */ jsx10(Text9, { dimColor: true, children: DEMO_MENU.hint }) })
+    ] }),
+    runCard && phase !== "menu" && /* @__PURE__ */ jsx10(
+      CardFlow,
+      {
+        spendRequestRepo: spendRequestRepo2,
+        paymentMethodsResource,
+        paymentMethodId: preselectedPmId,
+        onComplete: onCardComplete
+      }
+    ),
+    phase === "card-done" && /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx10(Text9, { dimColor: true, children: "\u2500\u2500\u2500" }),
+      /* @__PURE__ */ jsx10(MarkdownText, { children: DEMO_MENU.transition }),
+      /* @__PURE__ */ jsxs7(Text9, { dimColor: true, children: [
+        "\n",
+        ">",
+        " ",
+        DEMO_MENU.transitionPrompt
+      ] })
+    ] }),
+    runSpt && (phase === "spt-flow" || phase === "summary") && /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", children: [
+      runCard && /* @__PURE__ */ jsx10(Text9, { dimColor: true, children: "\u2500\u2500\u2500" }),
+      /* @__PURE__ */ jsx10(
+        SptFlow,
+        {
+          spendRequestRepo: spendRequestRepo2,
+          paymentMethodsResource,
+          paymentMethodId: paymentMethodId || void 0,
+          onComplete: onSptComplete
+        }
+      )
+    ] }),
+    phase === "summary" && /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx10(Text9, { dimColor: true, children: "\u2500\u2500\u2500" }),
+      /* @__PURE__ */ jsx10(Text9, { bold: true, children: "Done!" }),
+      cardSuccess !== null && /* @__PURE__ */ jsxs7(Text9, { color: cardSuccess ? "green" : "red", children: [
+        cardSuccess ? "\u2713" : "\u2717",
+        " Virtual card flow"
+      ] }),
+      sptSuccess !== null && /* @__PURE__ */ jsxs7(Text9, { color: sptSuccess ? "green" : "red", children: [
+        sptSuccess ? "\u2713" : "\u2717",
+        " Machine payment flow"
+      ] }),
+      /* @__PURE__ */ jsx10(AppDownloadQrCodes, {})
+    ] })
+  ] });
+};
+
+// src/commands/demo/index.tsx
+import { jsx as jsx11 } from "react/jsx-runtime";
+var demoOptions = z2.object({
+  onlyCard: z2.boolean().default(false).describe("Run only the virtual card flow"),
+  onlySpt: z2.boolean().default(false).describe("Run only the machine payment (SPT) flow")
+});
+function createDemoCli(authRepo2, spendRequestRepo2, createPaymentMethodsResource) {
+  return Cli2.create("demo", {
+    description: "Run an interactive demo of both Link payment flows (virtual card + machine payment)",
+    options: demoOptions,
+    outputPolicy: "agent-only",
+    async run(c) {
+      if (c.agent || c.formatExplicit) {
+        return c.error({
+          code: "REQUIRES_TTY",
+          message: "The demo command requires an interactive terminal."
+        });
+      }
+      const paymentMethodsResource = createPaymentMethodsResource();
+      return new Promise((resolve) => {
+        const { waitUntilExit, unmount } = render2(
+          /* @__PURE__ */ jsx11(
+            DemoRunner,
+            {
+              authRepo: authRepo2,
+              spendRequestRepo: spendRequestRepo2,
+              paymentMethodsResource,
+              onlyCard: c.options.onlyCard,
+              onlySpt: c.options.onlySpt,
+              onComplete: () => unmount()
+            }
+          )
+        );
+        waitUntilExit().then(() => resolve({}));
+      });
+    }
+  });
+}
+
+// src/commands/mpp/index.tsx
+import { Cli as Cli3, z as z4 } from "incur";
+import { render as render3 } from "ink";
+
+// src/commands/mpp/decode-view.tsx
+import { Box as Box9, Text as Text10 } from "ink";
+import { jsx as jsx12, jsxs as jsxs8 } from "react/jsx-runtime";
+function DecodeChallengeView({
+  decoded
+}) {
+  return /* @__PURE__ */ jsxs8(Box9, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx12(Text10, { color: "green", children: "\u2713 Stripe challenge decoded" }),
+    /* @__PURE__ */ jsxs8(Box9, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+      /* @__PURE__ */ jsxs8(Text10, { children: [
+        "ID: ",
+        /* @__PURE__ */ jsx12(Text10, { bold: true, children: decoded.id })
+      ] }),
+      /* @__PURE__ */ jsxs8(Text10, { children: [
+        "Realm: ",
+        /* @__PURE__ */ jsx12(Text10, { bold: true, children: decoded.realm })
+      ] }),
+      /* @__PURE__ */ jsxs8(Text10, { children: [
+        "Network ID: ",
+        /* @__PURE__ */ jsx12(Text10, { bold: true, children: decoded.network_id })
+      ] }),
+      /* @__PURE__ */ jsx12(Text10, { children: "Request JSON:" }),
+      /* @__PURE__ */ jsx12(Text10, { children: JSON.stringify(decoded.request_json, null, 2) })
+    ] })
+  ] });
+}
+
+// src/commands/mpp/schema.ts
+import { z as z3 } from "incur";
+var payOptions = z3.object({
+  spendRequestId: z3.string().describe(
+    'Approved spend request ID with credential_type "shared_payment_token"'
+  ),
+  method: z3.string().optional().describe("HTTP method (default: GET, or POST if --data is provided)"),
+  data: z3.string().optional().describe("Request body (implies POST if --method is not set)"),
+  header: z3.array(z3.string()).default([]).describe('Request header in "Name: Value" format (repeatable)')
+});
+var decodeOptions = z3.object({
+  challenge: z3.string().describe(
+    "Raw WWW-Authenticate header value; may include multiple payment challenges"
+  )
+});
+
+// src/commands/mpp/index.tsx
+import { jsx as jsx13 } from "react/jsx-runtime";
+function createMppCli(repository) {
+  const cli2 = Cli3.create("mpp", {
+    description: "Machine payment protocol (MPP) commands"
   });
   cli2.command("pay", {
     description: "Complete a machine payment protocol (MPP) payment using an approved spend request",
-    args: z3.object({
-      url: z3.string().describe("URL to pay")
+    args: z4.object({
+      url: z4.string().describe("URL to pay")
     }),
     options: payOptions,
     alias: { method: "X", data: "d", header: "H" },
@@ -11944,8 +13177,8 @@ function createMppCli(repository) {
       const headers = opts.header?.length ? opts.header : void 0;
       if (!c.agent && !c.formatExplicit) {
         return new Promise((resolve) => {
-          const { waitUntilExit } = render2(
-            /* @__PURE__ */ jsx6(
+          const { waitUntilExit } = render3(
+            /* @__PURE__ */ jsx13(
               MppPay,
               {
                 url,
@@ -11991,8 +13224,8 @@ function createMppCli(repository) {
       const decoded = decodeStripeChallenge(c.options.challenge);
       if (!c.agent && !c.formatExplicit) {
         return new Promise((resolve) => {
-          const { waitUntilExit } = render2(
-            /* @__PURE__ */ jsx6(DecodeChallengeView, { decoded })
+          const { waitUntilExit } = render3(
+            /* @__PURE__ */ jsx13(DecodeChallengeView, { decoded })
           );
           waitUntilExit().then(() => resolve(decoded));
         });
@@ -12003,26 +13236,183 @@ function createMppCli(repository) {
   return cli2;
 }
 
+// src/commands/onboard/index.tsx
+import { Cli as Cli4 } from "incur";
+import { render as render4 } from "ink";
+
+// src/commands/onboard/onboard-runner.tsx
+import { Box as Box10, Text as Text11, useInput as useInput5 } from "ink";
+import { useEffect as useEffect7, useRef as useRef3, useState as useState8 } from "react";
+import { jsx as jsx14, jsxs as jsxs9 } from "react/jsx-runtime";
+var OnboardRunner = ({
+  authRepo: authRepo2,
+  spendRequestRepo: spendRequestRepo2,
+  paymentMethodsResource,
+  onComplete
+}) => {
+  const [phase, setPhase] = useState8("welcome");
+  const [authSkipped, setAuthSkipped] = useState8(false);
+  const [pmMissing, setPmMissing] = useState8(false);
+  const [error, setError] = useState8("");
+  const enterResolver = useRef3(null);
+  function waitForEnter() {
+    return new Promise((resolve) => {
+      enterResolver.current = resolve;
+    });
+  }
+  const authResolver = useRef3(null);
+  function waitForAuth() {
+    return new Promise((resolve) => {
+      authResolver.current = resolve;
+    });
+  }
+  useInput5((_input, key) => {
+    if (key.return && enterResolver.current) {
+      const resolve = enterResolver.current;
+      enterResolver.current = null;
+      resolve();
+    }
+  });
+  const started = useRef3(false);
+  useEffect7(() => {
+    if (started.current) return;
+    started.current = true;
+    const run = async () => {
+      try {
+        setPhase("auth");
+        if (storage.isAuthenticated()) {
+          setAuthSkipped(true);
+        } else {
+          setAuthSkipped(false);
+          await waitForAuth();
+        }
+        setPhase("payment-methods");
+        while (true) {
+          const methods = await paymentMethodsResource.listPaymentMethods();
+          if (methods.length > 0) break;
+          setPmMissing(true);
+          await waitForEnter();
+          setPmMissing(false);
+        }
+        setPhase("demo");
+      } catch (err) {
+        setError(err.message);
+      }
+    };
+    run();
+  }, []);
+  const pastPhase = (target) => {
+    const order = ["welcome", "auth", "payment-methods", "demo"];
+    return order.indexOf(phase) > order.indexOf(target);
+  };
+  const prompt = (label = "Press [Enter] to continue") => /* @__PURE__ */ jsxs9(Text11, { dimColor: true, children: [
+    "\n",
+    ">",
+    " ",
+    label
+  ] });
+  return /* @__PURE__ */ jsxs9(Box10, { flexDirection: "column", gap: 1, children: [
+    /* @__PURE__ */ jsxs9(Box10, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx14(Text11, { bold: true, children: ONBOARD.title }),
+      /* @__PURE__ */ jsx14(Text11, { children: ONBOARD.subtitle })
+    ] }),
+    /* @__PURE__ */ jsx14(Box10, { flexDirection: "column", children: authSkipped || pastPhase("auth") ? /* @__PURE__ */ jsxs9(Text11, { color: "green", children: [
+      "\u2713 ",
+      authSkipped ? ONBOARD.auth.alreadyLoggedIn : ONBOARD.auth.authenticated
+    ] }) : phase === "auth" && !storage.isAuthenticated() ? /* @__PURE__ */ jsx14(
+      Login,
+      {
+        authResource: authRepo2,
+        clientName: ONBOARD.auth.clientName,
+        onComplete: () => authResolver.current?.()
+      }
+    ) : null }),
+    pastPhase("auth") && /* @__PURE__ */ jsxs9(Box10, { flexDirection: "column", children: [
+      phase === "payment-methods" && !pmMissing && /* @__PURE__ */ jsx14(Text11, { color: "cyan", children: ONBOARD.paymentMethods.loading }),
+      pmMissing && /* @__PURE__ */ jsxs9(Box10, { flexDirection: "column", children: [
+        /* @__PURE__ */ jsx14(Text11, { color: "yellow", children: ONBOARD.paymentMethods.missing }),
+        /* @__PURE__ */ jsx14(Box10, { marginTop: 1, children: /* @__PURE__ */ jsxs9(Text11, { children: [
+          "Visit",
+          " ",
+          /* @__PURE__ */ jsx14(Text11, { bold: true, color: "cyan", children: "app.link.com/wallet" }),
+          " ",
+          "to add a payment method, then press [Enter] to continue."
+        ] }) }),
+        prompt(ONBOARD.paymentMethods.retryPrompt)
+      ] }),
+      pastPhase("payment-methods") && /* @__PURE__ */ jsx14(Text11, { color: "green", children: "\u2713 Payment method found" })
+    ] }),
+    phase === "demo" && /* @__PURE__ */ jsxs9(Box10, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx14(Text11, { dimColor: true, children: "\u2500\u2500\u2500" }),
+      /* @__PURE__ */ jsx14(
+        DemoRunner,
+        {
+          authRepo: authRepo2,
+          spendRequestRepo: spendRequestRepo2,
+          paymentMethodsResource,
+          onComplete
+        }
+      )
+    ] }),
+    error && /* @__PURE__ */ jsxs9(Text11, { color: "red", children: [
+      "Error: ",
+      error
+    ] })
+  ] });
+};
+
+// src/commands/onboard/index.tsx
+import { jsx as jsx15 } from "react/jsx-runtime";
+function createOnboardCli(authRepo2, spendRequestRepo2, createPaymentMethodsResource) {
+  return Cli4.create("onboard", {
+    description: "Guided setup: authenticate, verify payment methods, and demo both payment flows",
+    outputPolicy: "agent-only",
+    async run(c) {
+      if (c.agent || c.formatExplicit) {
+        return c.error({
+          code: "REQUIRES_TTY",
+          message: "The onboard command requires an interactive terminal."
+        });
+      }
+      const paymentMethodsResource = createPaymentMethodsResource();
+      return new Promise((resolve) => {
+        const { waitUntilExit, unmount } = render4(
+          /* @__PURE__ */ jsx15(
+            OnboardRunner,
+            {
+              authRepo: authRepo2,
+              spendRequestRepo: spendRequestRepo2,
+              paymentMethodsResource,
+              onComplete: () => unmount()
+            }
+          )
+        );
+        waitUntilExit().then(() => resolve({}));
+      });
+    }
+  });
+}
+
 // src/commands/payment-methods/index.tsx
-import { Cli as Cli3 } from "incur";
-import { render as render3 } from "ink";
+import { Cli as Cli5 } from "incur";
+import { render as render5 } from "ink";
 
 // src/commands/payment-methods/add.tsx
-import { Box as Box5, Text as Text5, useApp, useInput as useInput2 } from "ink";
-import { jsx as jsx7, jsxs as jsxs4 } from "react/jsx-runtime";
+import { Box as Box11, Text as Text12, useApp, useInput as useInput6 } from "ink";
+import { jsx as jsx16, jsxs as jsxs10 } from "react/jsx-runtime";
 var WALLET_URL = "https://app.link.com/wallet";
 var AddPaymentMethod = () => {
   const { exit } = useApp();
-  useInput2((_input, key) => {
+  useInput6((_input, key) => {
     if (key.return) {
       openUrl(WALLET_URL);
       exit();
     }
   });
-  return /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", paddingY: 1, children: [
-    /* @__PURE__ */ jsx7(Box5, { marginBottom: 1, children: /* @__PURE__ */ jsx7(Text5, { bold: true, children: "Add Payment Method" }) }),
-    /* @__PURE__ */ jsxs4(
-      Box5,
+  return /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", paddingY: 1, children: [
+    /* @__PURE__ */ jsx16(Box11, { marginBottom: 1, children: /* @__PURE__ */ jsx16(Text12, { bold: true, children: "Add Payment Method" }) }),
+    /* @__PURE__ */ jsxs10(
+      Box11,
       {
         flexDirection: "column",
         borderStyle: "round",
@@ -12030,12 +13420,12 @@ var AddPaymentMethod = () => {
         paddingX: 2,
         paddingY: 1,
         children: [
-          /* @__PURE__ */ jsxs4(Text5, { children: [
+          /* @__PURE__ */ jsxs10(Text12, { children: [
             "Open:",
             " ",
-            /* @__PURE__ */ jsx7(Text5, { bold: true, color: "cyan", children: WALLET_URL })
+            /* @__PURE__ */ jsx16(Text12, { bold: true, color: "cyan", children: WALLET_URL })
           ] }),
-          /* @__PURE__ */ jsx7(Text5, { dimColor: true, children: "Press Enter to open in browser" })
+          /* @__PURE__ */ jsx16(Text12, { dimColor: true, children: "Press Enter to open in browser" })
         ]
       }
     )
@@ -12043,20 +13433,20 @@ var AddPaymentMethod = () => {
 };
 
 // src/commands/payment-methods/list.tsx
-import { Box as Box6, Text as Text6 } from "ink";
+import { Box as Box12, Text as Text13 } from "ink";
 import Spinner3 from "ink-spinner";
-import { useEffect as useEffect4, useState as useState4 } from "react";
-import { jsx as jsx8, jsxs as jsxs5 } from "react/jsx-runtime";
+import { useEffect as useEffect8, useState as useState9 } from "react";
+import { jsx as jsx17, jsxs as jsxs11 } from "react/jsx-runtime";
 var PaymentMethodsList = ({
   resource,
   onComplete
 }) => {
-  const [status, setStatus] = useState4(
+  const [status, setStatus] = useState9(
     "loading"
   );
-  const [methods, setMethods] = useState4([]);
-  const [error, setError] = useState4("");
-  useEffect4(() => {
+  const [methods, setMethods] = useState9([]);
+  const [error, setError] = useState9("");
+  useEffect8(() => {
     const fetch2 = async () => {
       try {
         const result = await resource.listPaymentMethods();
@@ -12072,43 +13462,43 @@ var PaymentMethodsList = ({
     fetch2();
   }, [resource, onComplete]);
   if (status === "loading") {
-    return /* @__PURE__ */ jsx8(Box6, { children: /* @__PURE__ */ jsxs5(Text6, { color: "cyan", children: [
-      /* @__PURE__ */ jsx8(Spinner3, { type: "dots" }),
+    return /* @__PURE__ */ jsx17(Box12, { children: /* @__PURE__ */ jsxs11(Text13, { color: "cyan", children: [
+      /* @__PURE__ */ jsx17(Spinner3, { type: "dots" }),
       " Loading payment methods..."
     ] }) });
   }
   if (status === "error") {
-    return /* @__PURE__ */ jsxs5(Box6, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx8(Text6, { color: "red", children: "\u2717 Failed to load payment methods" }),
-      /* @__PURE__ */ jsx8(Text6, { color: "red", children: error })
+    return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx17(Text13, { color: "red", children: "\u2717 Failed to load payment methods" }),
+      /* @__PURE__ */ jsx17(Text13, { color: "red", children: error })
     ] });
   }
   if (methods.length === 0) {
-    return /* @__PURE__ */ jsx8(Box6, { children: /* @__PURE__ */ jsx8(Text6, { dimColor: true, children: "No payment methods found" }) });
+    return /* @__PURE__ */ jsx17(Box12, { children: /* @__PURE__ */ jsx17(Text13, { dimColor: true, children: "No payment methods found" }) });
   }
-  return /* @__PURE__ */ jsxs5(Box6, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx8(Text6, { bold: true, children: "Payment Methods" }),
-    /* @__PURE__ */ jsx8(Box6, { flexDirection: "column", marginTop: 1, children: methods.map((pm) => {
+  return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx17(Text13, { bold: true, children: "Payment Methods" }),
+    /* @__PURE__ */ jsx17(Box12, { flexDirection: "column", marginTop: 1, children: methods.map((pm) => {
       const label = pm.card_details?.brand ?? pm.bank_account_details?.bank_name ?? "Bank account";
       const last4 = pm.card_details?.last4 ?? pm.bank_account_details?.last4;
       const suffix = [pm.nickname ? `(${pm.nickname})` : ""].filter(Boolean).join(" ");
-      return /* @__PURE__ */ jsx8(Box6, { paddingX: 2, children: /* @__PURE__ */ jsxs5(Text6, { children: [
-        /* @__PURE__ */ jsx8(Text6, { dimColor: true, children: pm.id }),
+      return /* @__PURE__ */ jsx17(Box12, { paddingX: 2, children: /* @__PURE__ */ jsxs11(Text13, { children: [
+        /* @__PURE__ */ jsx17(Text13, { dimColor: true, children: pm.id }),
         "  ",
         label,
         " ****",
         last4,
         suffix ? ` ${suffix}` : "",
-        pm.is_default ? /* @__PURE__ */ jsx8(Text6, { color: "green", children: " (default)" }) : ""
+        pm.is_default ? /* @__PURE__ */ jsx17(Text13, { color: "green", children: " (default)" }) : ""
       ] }) }, pm.id);
     }) })
   ] });
 };
 
 // src/commands/payment-methods/index.tsx
-import { jsx as jsx9 } from "react/jsx-runtime";
+import { jsx as jsx18 } from "react/jsx-runtime";
 function createPaymentMethodsCli(createResource) {
-  const cli2 = Cli3.create("payment-methods", {
+  const cli2 = Cli5.create("payment-methods", {
     description: "Payment methods management commands"
   });
   cli2.command("list", {
@@ -12129,8 +13519,8 @@ function createPaymentMethodsCli(createResource) {
       const resource = createResource();
       if (!c.agent && !c.formatExplicit) {
         return new Promise((resolve) => {
-          const { waitUntilExit } = render3(
-            /* @__PURE__ */ jsx9(PaymentMethodsList, { resource, onComplete: () => {
+          const { waitUntilExit } = render5(
+            /* @__PURE__ */ jsx18(PaymentMethodsList, { resource, onComplete: () => {
             } })
           );
           waitUntilExit().then(async () => {
@@ -12158,7 +13548,7 @@ function createPaymentMethodsCli(createResource) {
       }
       if (!c.agent && !c.formatExplicit) {
         return new Promise((resolve) => {
-          const { waitUntilExit } = render3(/* @__PURE__ */ jsx9(AddPaymentMethod, {}));
+          const { waitUntilExit } = render5(/* @__PURE__ */ jsx18(AddPaymentMethod, {}));
           waitUntilExit().then(() => resolve({ url: WALLET_URL }));
         });
       }
@@ -12169,25 +13559,25 @@ function createPaymentMethodsCli(createResource) {
 }
 
 // src/commands/spend-request/index.tsx
-import { Cli as Cli4, z as z6 } from "incur";
-import { render as render4 } from "ink";
+import { Cli as Cli6, z as z7 } from "incur";
+import { render as render6 } from "ink";
 
 // src/utils/line-item-parser.ts
-import { z as z4 } from "zod";
-var LineItemSchema = z4.object({
-  name: z4.string(),
-  url: z4.string().optional(),
-  image_url: z4.string().optional(),
-  description: z4.string().optional(),
-  sku: z4.string().optional(),
-  quantity: z4.coerce.number().optional(),
-  unit_amount: z4.coerce.number().optional(),
-  product_url: z4.string().optional()
+import { z as z5 } from "zod";
+var LineItemSchema = z5.object({
+  name: z5.string(),
+  url: z5.string().optional(),
+  image_url: z5.string().optional(),
+  description: z5.string().optional(),
+  sku: z5.string().optional(),
+  quantity: z5.coerce.number().optional(),
+  unit_amount: z5.coerce.number().optional(),
+  product_url: z5.string().optional()
 }).strict();
-var TotalSchema = z4.object({
-  type: z4.string(),
-  display_text: z4.string(),
-  amount: z4.coerce.number()
+var TotalSchema = z5.object({
+  type: z5.string(),
+  display_text: z5.string(),
+  amount: z5.coerce.number()
 }).strict();
 function parseKvString(raw) {
   const result = {};
@@ -12212,7 +13602,7 @@ function parseLineItemFlag(raw) {
   try {
     return LineItemSchema.parse(obj);
   } catch (err) {
-    if (err instanceof z4.ZodError) throw formatZodError(err, "Line item");
+    if (err instanceof z5.ZodError) throw formatZodError(err, "Line item");
     throw err;
   }
 }
@@ -12221,80 +13611,26 @@ function parseTotalFlag(raw) {
   try {
     return TotalSchema.parse(obj);
   } catch (err) {
-    if (err instanceof z4.ZodError) throw formatZodError(err, "Total");
+    if (err instanceof z5.ZodError) throw formatZodError(err, "Total");
     throw err;
   }
 }
 
 // src/commands/spend-request/create.tsx
-import { Box as Box9, Text as Text9 } from "ink";
+import { Box as Box14, Text as Text15 } from "ink";
 import Spinner5 from "ink-spinner";
-import { useCallback, useEffect as useEffect6, useState as useState5 } from "react";
-
-// src/commands/spend-request/app-download-qr-codes.tsx
-import { Box as Box7, Text as Text7 } from "ink";
-import { useMemo } from "react";
-
-// src/utils/render-qr-matrix.ts
-import QRCode from "qrcode";
-function renderQrMatrix(url) {
-  const qr = QRCode.create(url, { errorCorrectionLevel: "L" });
-  const size = qr.modules.size;
-  const data = qr.modules.data;
-  const quiet = 1;
-  const total = size + quiet * 2;
-  const matrix = Array.from(
-    { length: total },
-    (_, r) => Array.from({ length: total }, (_2, c) => {
-      if (r < quiet || r >= size + quiet || c < quiet || c >= size + quiet) {
-        return false;
-      }
-      return data[(r - quiet) * size + (c - quiet)] === 1;
-    })
-  );
-  const lines = [];
-  for (let r = 0; r < total; r += 2) {
-    let line = "";
-    for (let c = 0; c < total; c++) {
-      const top = matrix[r][c];
-      const bottom = r + 1 < total ? matrix[r + 1][c] : false;
-      if (top && bottom) line += "\u2588";
-      else if (top) line += "\u2580";
-      else if (bottom) line += "\u2584";
-      else line += " ";
-    }
-    lines.push(line);
-  }
-  return lines;
-}
-
-// src/commands/spend-request/app-download-qr-codes.tsx
-import { jsx as jsx10, jsxs as jsxs6 } from "react/jsx-runtime";
-var DOWNLOAD_URL = "https://link.com/download";
-var AppDownloadQrCodes = () => {
-  const qrLines = useMemo(() => renderQrMatrix(DOWNLOAD_URL), []);
-  return /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", marginTop: 1, children: [
-    /* @__PURE__ */ jsx10(Text7, { dimColor: true, children: "New! Get the Link app to approve spend requests easily" }),
-    /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", alignItems: "flex-start", marginTop: 1, children: [
-      qrLines.map((line, i) => (
-        // biome-ignore lint/suspicious/noArrayIndexKey: stable static array
-        /* @__PURE__ */ jsx10(Text7, { children: line }, i)
-      )),
-      /* @__PURE__ */ jsx10(Text7, { dimColor: true, children: DOWNLOAD_URL })
-    ] })
-  ] });
-};
+import { useCallback as useCallback2, useEffect as useEffect10, useState as useState10 } from "react";
 
 // src/commands/spend-request/approval-waiting-view.tsx
-import { Box as Box8, Text as Text8 } from "ink";
+import { Box as Box13, Text as Text14 } from "ink";
 import Spinner4 from "ink-spinner";
-import { jsx as jsx11, jsxs as jsxs7 } from "react/jsx-runtime";
+import { jsx as jsx19, jsxs as jsxs12 } from "react/jsx-runtime";
 var ApprovalWaitingView = ({
   status,
   approvalUrl
-}) => /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", paddingY: 1, children: [
-  /* @__PURE__ */ jsxs7(
-    Box8,
+}) => /* @__PURE__ */ jsxs12(Box13, { flexDirection: "column", paddingY: 1, children: [
+  /* @__PURE__ */ jsxs12(
+    Box13,
     {
       flexDirection: "column",
       borderStyle: "round",
@@ -12302,51 +13638,25 @@ var ApprovalWaitingView = ({
       paddingX: 2,
       paddingY: 1,
       children: [
-        /* @__PURE__ */ jsxs7(Text8, { children: [
+        /* @__PURE__ */ jsxs12(Text14, { children: [
           "Approve at:",
           " ",
-          /* @__PURE__ */ jsx11(Text8, { bold: true, color: "cyan", children: approvalUrl })
+          /* @__PURE__ */ jsx19(Text14, { bold: true, color: "cyan", children: approvalUrl })
         ] }),
-        /* @__PURE__ */ jsx11(Text8, { dimColor: true, children: "Press Enter to open in browser" })
+        /* @__PURE__ */ jsx19(Text14, { dimColor: true, children: "Press Enter to open in browser" })
       ]
     }
   ),
-  /* @__PURE__ */ jsx11(AppDownloadQrCodes, {}),
-  /* @__PURE__ */ jsx11(Box8, { marginTop: 1, children: status === "polling" ? /* @__PURE__ */ jsxs7(Text8, { color: "cyan", children: [
-    /* @__PURE__ */ jsx11(Spinner4, { type: "dots" }),
+  /* @__PURE__ */ jsx19(AppDownloadQrCodes, {}),
+  /* @__PURE__ */ jsx19(Box13, { marginTop: 1, children: status === "polling" ? /* @__PURE__ */ jsxs12(Text14, { color: "cyan", children: [
+    /* @__PURE__ */ jsx19(Spinner4, { type: "dots" }),
     " Waiting for approval..."
-  ] }) : /* @__PURE__ */ jsx11(Text8, { dimColor: true, children: "Waiting..." }) })
+  ] }) : /* @__PURE__ */ jsx19(Text14, { dimColor: true, children: "Waiting..." }) })
 ] });
 
 // src/commands/spend-request/use-approval-polling.ts
-import { useInput as useInput3 } from "ink";
-import { useEffect as useEffect5 } from "react";
-
-// src/utils/poll-until-approved.ts
-function pollUntilApproved(repository, id, options = {}) {
-  const pollIntervalMs = options.pollIntervalMs ?? 2e3;
-  const timeoutMs = options.timeoutMs ?? 3e5;
-  const startTime = Date.now();
-  const poll = async () => {
-    const elapsed = Date.now() - startTime;
-    if (elapsed > timeoutMs) {
-      throw new Error("Approval polling timed out");
-    }
-    const request = await repository.getSpendRequest(id);
-    if (!request) {
-      throw new Error(`Spend request ${id} not found`);
-    }
-    if (request.status !== "created" && request.status !== "pending_approval") {
-      return request;
-    }
-    options.onProgress?.(Math.floor(elapsed / 1e3));
-    await new Promise((r) => setTimeout(r, pollIntervalMs));
-    return poll();
-  };
-  return poll();
-}
-
-// src/commands/spend-request/use-approval-polling.ts
+import { useInput as useInput7 } from "ink";
+import { useEffect as useEffect9 } from "react";
 function useApprovalPolling({
   status,
   setStatus,
@@ -12358,18 +13668,18 @@ function useApprovalPolling({
   onError
 }) {
   const isWaiting = status === "waiting" || status === "polling";
-  useInput3(
+  useInput7(
     (_input, key) => {
       if (key.return && approvalUrl) openUrl(approvalUrl);
     },
     { isActive: isWaiting }
   );
-  useEffect5(() => {
+  useEffect9(() => {
     if (status !== "waiting") return;
     const timeout = setTimeout(() => setStatus("polling"), 1e3);
     return () => clearTimeout(timeout);
   }, [status, setStatus]);
-  useEffect5(() => {
+  useEffect9(() => {
     if (status !== "polling" || !requestId) return;
     let cancelled = false;
     const poll = async () => {
@@ -12403,22 +13713,22 @@ function useApprovalPolling({
 }
 
 // src/commands/spend-request/create.tsx
-import { Fragment, jsx as jsx12, jsxs as jsxs8 } from "react/jsx-runtime";
+import { Fragment as Fragment4, jsx as jsx20, jsxs as jsxs13 } from "react/jsx-runtime";
 var CreateSpendRequest = ({
   repository,
   params,
   requestApproval = false,
   onComplete
 }) => {
-  const [status, setStatus] = useState5("creating");
-  const [request, setRequest] = useState5(null);
-  const [error, setError] = useState5("");
+  const [status, setStatus] = useState10("creating");
+  const [request, setRequest] = useState10(null);
+  const [error, setError] = useState10("");
   const approvalUrl = request?.approval_url ?? "";
-  const onSuccess = useCallback(
+  const onSuccess = useCallback2(
     (result) => setRequest(result),
     []
   );
-  const onError = useCallback((msg) => setError(msg), []);
+  const onError = useCallback2((msg) => setError(msg), []);
   useApprovalPolling({
     status,
     setStatus,
@@ -12429,7 +13739,7 @@ var CreateSpendRequest = ({
     onSuccess,
     onError
   });
-  useEffect6(() => {
+  useEffect10(() => {
     const create = async () => {
       try {
         const result = await repository.createSpendRequest(params);
@@ -12449,57 +13759,57 @@ var CreateSpendRequest = ({
     create();
   }, [repository, params, requestApproval, onComplete]);
   if (status === "creating") {
-    return /* @__PURE__ */ jsx12(Box9, { children: /* @__PURE__ */ jsxs8(Text9, { color: "cyan", children: [
-      /* @__PURE__ */ jsx12(Spinner5, { type: "dots" }),
+    return /* @__PURE__ */ jsx20(Box14, { children: /* @__PURE__ */ jsxs13(Text15, { color: "cyan", children: [
+      /* @__PURE__ */ jsx20(Spinner5, { type: "dots" }),
       " Creating spend request..."
     ] }) });
   }
   if (status === "error") {
-    return /* @__PURE__ */ jsxs8(Box9, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx12(Text9, { color: "red", children: "\u2717 Failed to create spend request" }),
-      /* @__PURE__ */ jsx12(Text9, { color: "red", children: error })
+    return /* @__PURE__ */ jsxs13(Box14, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx20(Text15, { color: "red", children: "\u2717 Failed to create spend request" }),
+      /* @__PURE__ */ jsx20(Text15, { color: "red", children: error })
     ] });
   }
   if (status === "success") {
-    return /* @__PURE__ */ jsxs8(Box9, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx12(Text9, { color: "green", children: "\u2713 Spend request created" }),
-      /* @__PURE__ */ jsxs8(Box9, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-        /* @__PURE__ */ jsxs8(Text9, { children: [
+    return /* @__PURE__ */ jsxs13(Box14, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx20(Text15, { color: "green", children: "\u2713 Spend request created" }),
+      /* @__PURE__ */ jsxs13(Box14, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsxs13(Text15, { children: [
           "ID: ",
-          /* @__PURE__ */ jsx12(Text9, { bold: true, children: request?.id })
+          /* @__PURE__ */ jsx20(Text15, { bold: true, children: request?.id })
         ] }),
-        /* @__PURE__ */ jsxs8(Text9, { children: [
+        /* @__PURE__ */ jsxs13(Text15, { children: [
           "Status: ",
-          /* @__PURE__ */ jsx12(Text9, { bold: true, children: request?.status })
+          /* @__PURE__ */ jsx20(Text15, { bold: true, children: request?.status })
         ] }),
-        /* @__PURE__ */ jsxs8(Text9, { children: [
+        /* @__PURE__ */ jsxs13(Text15, { children: [
           "Amount:",
           " ",
-          /* @__PURE__ */ jsx12(Text9, { bold: true, children: (() => {
+          /* @__PURE__ */ jsx20(Text15, { bold: true, children: (() => {
             const t = request?.totals.find((t2) => t2.type === "total");
             return t ? String(t.amount) : "N/A";
           })() })
         ] }),
-        /* @__PURE__ */ jsxs8(Text9, { children: [
+        /* @__PURE__ */ jsxs13(Text15, { children: [
           "Merchant: ",
-          /* @__PURE__ */ jsx12(Text9, { bold: true, children: request?.merchant_name })
+          /* @__PURE__ */ jsx20(Text15, { bold: true, children: request?.merchant_name })
         ] }),
-        /* @__PURE__ */ jsxs8(Text9, { children: [
+        /* @__PURE__ */ jsxs13(Text15, { children: [
           "Line Items:",
           " ",
-          /* @__PURE__ */ jsx12(Text9, { bold: true, children: request?.line_items.map((li) => li.name).join(", ") || "N/A" })
+          /* @__PURE__ */ jsx20(Text15, { bold: true, children: request?.line_items.map((li) => li.name).join(", ") || "N/A" })
         ] })
       ] }),
-      /* @__PURE__ */ jsx12(AppDownloadQrCodes, {})
+      /* @__PURE__ */ jsx20(AppDownloadQrCodes, {})
     ] });
   }
-  return /* @__PURE__ */ jsxs8(Fragment, { children: [
-    /* @__PURE__ */ jsx12(Box9, { children: /* @__PURE__ */ jsxs8(Text9, { color: "green", children: [
+  return /* @__PURE__ */ jsxs13(Fragment4, { children: [
+    /* @__PURE__ */ jsx20(Box14, { children: /* @__PURE__ */ jsxs13(Text15, { color: "green", children: [
       "\u2713 Spend request created (ID: ",
-      /* @__PURE__ */ jsx12(Text9, { bold: true, children: request?.id }),
+      /* @__PURE__ */ jsx20(Text15, { bold: true, children: request?.id }),
       ")"
     ] }) }),
-    /* @__PURE__ */ jsx12(
+    /* @__PURE__ */ jsx20(
       ApprovalWaitingView,
       {
         status,
@@ -12510,21 +13820,21 @@ var CreateSpendRequest = ({
 };
 
 // src/commands/spend-request/request-approval.tsx
-import { Box as Box10, Text as Text10 } from "ink";
+import { Box as Box15, Text as Text16 } from "ink";
 import Spinner6 from "ink-spinner";
-import { useCallback as useCallback2, useEffect as useEffect7, useState as useState6 } from "react";
-import { jsx as jsx13, jsxs as jsxs9 } from "react/jsx-runtime";
+import { useCallback as useCallback3, useEffect as useEffect11, useState as useState11 } from "react";
+import { jsx as jsx21, jsxs as jsxs14 } from "react/jsx-runtime";
 var RequestApproval = ({
   repository,
   id,
   onComplete
 }) => {
-  const [status, setStatus] = useState6("requesting");
-  const [approvalUrl, setApprovalUrl] = useState6("");
-  const [result, setResult] = useState6(null);
-  const [error, setError] = useState6("");
-  const onSuccess = useCallback2((r) => setResult(r), []);
-  const onError = useCallback2((msg) => setError(msg), []);
+  const [status, setStatus] = useState11("requesting");
+  const [approvalUrl, setApprovalUrl] = useState11("");
+  const [result, setResult] = useState11(null);
+  const [error, setError] = useState11("");
+  const onSuccess = useCallback3((r) => setResult(r), []);
+  const onError = useCallback3((msg) => setError(msg), []);
   useApprovalPolling({
     status,
     setStatus,
@@ -12535,7 +13845,7 @@ var RequestApproval = ({
     onSuccess,
     onError
   });
-  useEffect7(() => {
+  useEffect11(() => {
     const request = async () => {
       try {
         const res = await repository.requestApproval(id);
@@ -12549,45 +13859,45 @@ var RequestApproval = ({
     request();
   }, [repository, id]);
   if (status === "requesting") {
-    return /* @__PURE__ */ jsx13(Box10, { children: /* @__PURE__ */ jsxs9(Text10, { color: "cyan", children: [
-      /* @__PURE__ */ jsx13(Spinner6, { type: "dots" }),
+    return /* @__PURE__ */ jsx21(Box15, { children: /* @__PURE__ */ jsxs14(Text16, { color: "cyan", children: [
+      /* @__PURE__ */ jsx21(Spinner6, { type: "dots" }),
       " Requesting approval..."
     ] }) });
   }
   if (status === "error") {
-    return /* @__PURE__ */ jsxs9(Box10, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx13(Text10, { color: "red", children: "\u2717 Failed to request approval" }),
-      /* @__PURE__ */ jsx13(Text10, { color: "red", children: error })
+    return /* @__PURE__ */ jsxs14(Box15, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx21(Text16, { color: "red", children: "\u2717 Failed to request approval" }),
+      /* @__PURE__ */ jsx21(Text16, { color: "red", children: error })
     ] });
   }
   if (status === "success") {
-    return /* @__PURE__ */ jsxs9(Box10, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx13(Text10, { color: "green", children: "\u2713 Approval completed" }),
-      /* @__PURE__ */ jsxs9(Box10, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-        /* @__PURE__ */ jsxs9(Text10, { children: [
+    return /* @__PURE__ */ jsxs14(Box15, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx21(Text16, { color: "green", children: "\u2713 Approval completed" }),
+      /* @__PURE__ */ jsxs14(Box15, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsxs14(Text16, { children: [
           "ID: ",
-          /* @__PURE__ */ jsx13(Text10, { bold: true, children: result?.id })
+          /* @__PURE__ */ jsx21(Text16, { bold: true, children: result?.id })
         ] }),
-        /* @__PURE__ */ jsxs9(Text10, { children: [
+        /* @__PURE__ */ jsxs14(Text16, { children: [
           "Status: ",
-          /* @__PURE__ */ jsx13(Text10, { bold: true, children: result?.status })
+          /* @__PURE__ */ jsx21(Text16, { bold: true, children: result?.status })
         ] }),
-        /* @__PURE__ */ jsxs9(Text10, { children: [
+        /* @__PURE__ */ jsxs14(Text16, { children: [
           "Amount:",
           " ",
-          /* @__PURE__ */ jsx13(Text10, { bold: true, children: (() => {
+          /* @__PURE__ */ jsx21(Text16, { bold: true, children: (() => {
             const t = result?.totals.find((t2) => t2.type === "total");
             return t ? String(t.amount) : "N/A";
           })() })
         ] }),
-        /* @__PURE__ */ jsxs9(Text10, { children: [
+        /* @__PURE__ */ jsxs14(Text16, { children: [
           "Merchant: ",
-          /* @__PURE__ */ jsx13(Text10, { bold: true, children: result?.merchant_name })
+          /* @__PURE__ */ jsx21(Text16, { bold: true, children: result?.merchant_name })
         ] })
       ] })
     ] });
   }
-  return /* @__PURE__ */ jsx13(
+  return /* @__PURE__ */ jsx21(
     ApprovalWaitingView,
     {
       status,
@@ -12597,10 +13907,10 @@ var RequestApproval = ({
 };
 
 // src/commands/spend-request/retrieve.tsx
-import { Box as Box11, Text as Text11 } from "ink";
+import { Box as Box16, Text as Text17 } from "ink";
 import Spinner7 from "ink-spinner";
-import { useEffect as useEffect8, useRef, useState as useState7 } from "react";
-import { jsx as jsx14, jsxs as jsxs10 } from "react/jsx-runtime";
+import { useEffect as useEffect12, useRef as useRef4, useState as useState12 } from "react";
+import { jsx as jsx22, jsxs as jsxs15 } from "react/jsx-runtime";
 var RetrieveSpendRequest = ({
   repository,
   id,
@@ -12608,20 +13918,20 @@ var RetrieveSpendRequest = ({
   include,
   onComplete
 }) => {
-  const [phase, setPhase] = useState7("fetching");
-  const [request, setRequest] = useState7(null);
-  const [error, setError] = useState7("");
-  const [elapsed, setElapsed] = useState7(0);
-  const startTimeRef = useRef(Date.now());
-  const pollRef = useRef(null);
-  const timerRef = useRef(null);
-  useEffect8(() => {
+  const [phase, setPhase] = useState12("fetching");
+  const [request, setRequest] = useState12(null);
+  const [error, setError] = useState12("");
+  const [elapsed, setElapsed] = useState12(0);
+  const startTimeRef = useRef4(Date.now());
+  const pollRef = useRef4(null);
+  const timerRef = useRef4(null);
+  useEffect12(() => {
     return () => {
       if (pollRef.current) clearInterval(pollRef.current);
       if (timerRef.current) clearInterval(timerRef.current);
     };
   }, []);
-  useEffect8(() => {
+  useEffect12(() => {
     const fetch2 = async () => {
       try {
         const result = await repository.getSpendRequest(id, { include });
@@ -12650,7 +13960,7 @@ var RetrieveSpendRequest = ({
     };
     fetch2();
   }, [repository, id, include, onComplete]);
-  useEffect8(() => {
+  useEffect12(() => {
     if (phase !== "polling") return;
     timerRef.current = setInterval(() => {
       const secs = Math.floor((Date.now() - startTimeRef.current) / 1e3);
@@ -12689,169 +13999,169 @@ var RetrieveSpendRequest = ({
     };
   }, [phase, repository, id, include, timeout, onComplete]);
   if (phase === "fetching") {
-    return /* @__PURE__ */ jsx14(Box11, { children: /* @__PURE__ */ jsxs10(Text11, { color: "cyan", children: [
-      /* @__PURE__ */ jsx14(Spinner7, { type: "dots" }),
+    return /* @__PURE__ */ jsx22(Box16, { children: /* @__PURE__ */ jsxs15(Text17, { color: "cyan", children: [
+      /* @__PURE__ */ jsx22(Spinner7, { type: "dots" }),
       " Retrieving spend request ",
       id,
       "..."
     ] }) });
   }
   if (phase === "error") {
-    return /* @__PURE__ */ jsx14(Box11, { flexDirection: "column", children: /* @__PURE__ */ jsxs10(Text11, { color: "red", children: [
+    return /* @__PURE__ */ jsx22(Box16, { flexDirection: "column", children: /* @__PURE__ */ jsxs15(Text17, { color: "red", children: [
       "\u2717 ",
       error
     ] }) });
   }
   if (phase === "timeout") {
-    return /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs10(Text11, { color: "yellow", children: [
+    return /* @__PURE__ */ jsxs15(Box16, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs15(Text17, { color: "yellow", children: [
         "\u2717 Timed out waiting for approval after ",
         timeout,
         "s"
       ] }),
-      request && /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-        /* @__PURE__ */ jsxs10(Text11, { children: [
+      request && /* @__PURE__ */ jsxs15(Box16, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsxs15(Text17, { children: [
           "ID: ",
-          /* @__PURE__ */ jsx14(Text11, { bold: true, children: request.id })
+          /* @__PURE__ */ jsx22(Text17, { bold: true, children: request.id })
         ] }),
-        /* @__PURE__ */ jsxs10(Text11, { children: [
+        /* @__PURE__ */ jsxs15(Text17, { children: [
           "Status: ",
-          /* @__PURE__ */ jsx14(Text11, { bold: true, children: request.status })
+          /* @__PURE__ */ jsx22(Text17, { bold: true, children: request.status })
         ] })
       ] })
     ] });
   }
   if (phase === "polling") {
-    return /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx14(Box11, { children: /* @__PURE__ */ jsxs10(Text11, { color: "cyan", children: [
-        /* @__PURE__ */ jsx14(Spinner7, { type: "dots" }),
+    return /* @__PURE__ */ jsxs15(Box16, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx22(Box16, { children: /* @__PURE__ */ jsxs15(Text17, { color: "cyan", children: [
+        /* @__PURE__ */ jsx22(Spinner7, { type: "dots" }),
         " Awaiting approval... (",
         elapsed,
         "s elapsed)"
       ] }) }),
-      request?.approval_url && /* @__PURE__ */ jsx14(Box11, { marginTop: 1, paddingX: 2, children: /* @__PURE__ */ jsxs10(Text11, { dimColor: true, children: [
+      request?.approval_url && /* @__PURE__ */ jsx22(Box16, { marginTop: 1, paddingX: 2, children: /* @__PURE__ */ jsxs15(Text17, { dimColor: true, children: [
         "Approval URL: ",
-        /* @__PURE__ */ jsx14(Text11, { color: "cyan", children: request.approval_url })
+        /* @__PURE__ */ jsx22(Text17, { color: "cyan", children: request.approval_url })
       ] }) })
     ] });
   }
   if (phase === "declined") {
-    return /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx14(Text11, { color: "red", children: "\u2717 Spend request declined" }),
-      /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-        /* @__PURE__ */ jsxs10(Text11, { children: [
+    return /* @__PURE__ */ jsxs15(Box16, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx22(Text17, { color: "red", children: "\u2717 Spend request declined" }),
+      /* @__PURE__ */ jsxs15(Box16, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsxs15(Text17, { children: [
           "ID: ",
-          /* @__PURE__ */ jsx14(Text11, { bold: true, children: request?.id })
+          /* @__PURE__ */ jsx22(Text17, { bold: true, children: request?.id })
         ] }),
-        /* @__PURE__ */ jsxs10(Text11, { children: [
+        /* @__PURE__ */ jsxs15(Text17, { children: [
           "Status:",
           " ",
-          /* @__PURE__ */ jsx14(Text11, { bold: true, color: "red", children: request?.status })
+          /* @__PURE__ */ jsx22(Text17, { bold: true, color: "red", children: request?.status })
         ] }),
-        /* @__PURE__ */ jsxs10(Text11, { children: [
+        /* @__PURE__ */ jsxs15(Text17, { children: [
           "Amount:",
           " ",
-          /* @__PURE__ */ jsx14(Text11, { bold: true, children: (() => {
+          /* @__PURE__ */ jsx22(Text17, { bold: true, children: (() => {
             const t = request?.totals.find((t2) => t2.type === "total");
             return t ? String(t.amount) : "N/A";
           })() })
         ] }),
-        /* @__PURE__ */ jsxs10(Text11, { children: [
+        /* @__PURE__ */ jsxs15(Text17, { children: [
           "Merchant: ",
-          /* @__PURE__ */ jsx14(Text11, { bold: true, children: request?.merchant_name })
+          /* @__PURE__ */ jsx22(Text17, { bold: true, children: request?.merchant_name })
         ] })
       ] })
     ] });
   }
-  return /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx14(Text11, { color: "green", children: "\u2713 Spend request approved" }),
-    /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-      /* @__PURE__ */ jsxs10(Text11, { children: [
+  return /* @__PURE__ */ jsxs15(Box16, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx22(Text17, { color: "green", children: "\u2713 Spend request approved" }),
+    /* @__PURE__ */ jsxs15(Box16, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+      /* @__PURE__ */ jsxs15(Text17, { children: [
         "ID: ",
-        /* @__PURE__ */ jsx14(Text11, { bold: true, children: request?.id })
+        /* @__PURE__ */ jsx22(Text17, { bold: true, children: request?.id })
       ] }),
-      /* @__PURE__ */ jsxs10(Text11, { children: [
+      /* @__PURE__ */ jsxs15(Text17, { children: [
         "Status:",
         " ",
-        /* @__PURE__ */ jsx14(Text11, { bold: true, color: "green", children: request?.status })
+        /* @__PURE__ */ jsx22(Text17, { bold: true, color: "green", children: request?.status })
       ] }),
-      /* @__PURE__ */ jsxs10(Text11, { children: [
+      /* @__PURE__ */ jsxs15(Text17, { children: [
         "Amount:",
         " ",
-        /* @__PURE__ */ jsx14(Text11, { bold: true, children: (() => {
+        /* @__PURE__ */ jsx22(Text17, { bold: true, children: (() => {
           const t = request?.totals.find((t2) => t2.type === "total");
           return t ? String(t.amount) : "N/A";
         })() })
       ] }),
-      /* @__PURE__ */ jsxs10(Text11, { children: [
+      /* @__PURE__ */ jsxs15(Text17, { children: [
         "Merchant: ",
-        /* @__PURE__ */ jsx14(Text11, { bold: true, children: request?.merchant_name })
+        /* @__PURE__ */ jsx22(Text17, { bold: true, children: request?.merchant_name })
       ] }),
-      /* @__PURE__ */ jsxs10(Text11, { children: [
+      /* @__PURE__ */ jsxs15(Text17, { children: [
         "Line Items:",
         " ",
-        /* @__PURE__ */ jsx14(Text11, { bold: true, children: request?.line_items.map((li) => li.name).join(", ") })
+        /* @__PURE__ */ jsx22(Text17, { bold: true, children: request?.line_items.map((li) => li.name).join(", ") })
       ] }),
-      request?.shared_payment_token && /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", marginTop: 1, children: [
-        /* @__PURE__ */ jsxs10(Text11, { bold: true, children: [
+      request?.shared_payment_token && /* @__PURE__ */ jsxs15(Box16, { flexDirection: "column", marginTop: 1, children: [
+        /* @__PURE__ */ jsxs15(Text17, { bold: true, children: [
           "\x1B]8;;https://docs.stripe.com/agentic-commerce/concepts/shared-payment-tokens\x07",
           "Shared Payment Token",
           "\x1B]8;;\x07",
           ":"
         ] }),
-        /* @__PURE__ */ jsxs10(Text11, { children: [
+        /* @__PURE__ */ jsxs15(Text17, { children: [
           " ",
           "Token: ",
-          /* @__PURE__ */ jsx14(Text11, { bold: true, children: request.shared_payment_token.id })
+          /* @__PURE__ */ jsx22(Text17, { bold: true, children: request.shared_payment_token.id })
         ] })
       ] }),
-      request?.card && /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", marginTop: 1, children: [
-        /* @__PURE__ */ jsx14(Text11, { bold: true, children: "Card Details:" }),
-        /* @__PURE__ */ jsxs10(Text11, { children: [
+      request?.card && /* @__PURE__ */ jsxs15(Box16, { flexDirection: "column", marginTop: 1, children: [
+        /* @__PURE__ */ jsx22(Text17, { bold: true, children: "Card Details:" }),
+        /* @__PURE__ */ jsxs15(Text17, { children: [
           " ",
           "Number: ",
-          /* @__PURE__ */ jsx14(Text11, { bold: true, children: request?.card.number })
+          /* @__PURE__ */ jsx22(Text17, { bold: true, children: request?.card.number })
         ] }),
-        /* @__PURE__ */ jsxs10(Text11, { children: [
+        /* @__PURE__ */ jsxs15(Text17, { children: [
           " ",
           "Brand: ",
-          /* @__PURE__ */ jsx14(Text11, { bold: true, children: request?.card.brand })
+          /* @__PURE__ */ jsx22(Text17, { bold: true, children: request?.card.brand })
         ] }),
-        /* @__PURE__ */ jsxs10(Text11, { children: [
+        /* @__PURE__ */ jsxs15(Text17, { children: [
           " ",
           "Expiry:",
           " ",
-          /* @__PURE__ */ jsxs10(Text11, { bold: true, children: [
+          /* @__PURE__ */ jsxs15(Text17, { bold: true, children: [
             String(request?.card.exp_month).padStart(2, "0"),
             "/",
             request?.card.exp_year
           ] })
         ] }),
-        request?.card.cvc && /* @__PURE__ */ jsxs10(Text11, { children: [
+        request?.card.cvc && /* @__PURE__ */ jsxs15(Text17, { children: [
           " ",
           "CVC: ",
-          /* @__PURE__ */ jsx14(Text11, { bold: true, children: request.card.cvc })
+          /* @__PURE__ */ jsx22(Text17, { bold: true, children: request.card.cvc })
         ] }),
-        request?.card.valid_until && /* @__PURE__ */ jsxs10(Text11, { children: [
+        request?.card.valid_until && /* @__PURE__ */ jsxs15(Text17, { children: [
           " ",
           "Valid Until: ",
-          /* @__PURE__ */ jsx14(Text11, { bold: true, children: request.card.valid_until })
+          /* @__PURE__ */ jsx22(Text17, { bold: true, children: request.card.valid_until })
         ] }),
-        request?.card.billing_address && /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", marginTop: 1, children: [
-          /* @__PURE__ */ jsx14(Text11, { bold: true, children: " Billing Address:" }),
-          /* @__PURE__ */ jsxs10(Text11, { children: [
+        request?.card.billing_address && /* @__PURE__ */ jsxs15(Box16, { flexDirection: "column", marginTop: 1, children: [
+          /* @__PURE__ */ jsx22(Text17, { bold: true, children: " Billing Address:" }),
+          /* @__PURE__ */ jsxs15(Text17, { children: [
             "  ",
             request.card.billing_address.name
           ] }),
-          /* @__PURE__ */ jsxs10(Text11, { children: [
+          /* @__PURE__ */ jsxs15(Text17, { children: [
             "  ",
             request.card.billing_address.line1
           ] }),
-          request.card.billing_address.line2 && /* @__PURE__ */ jsxs10(Text11, { children: [
+          request.card.billing_address.line2 && /* @__PURE__ */ jsxs15(Text17, { children: [
             "  ",
             request.card.billing_address.line2
           ] }),
-          /* @__PURE__ */ jsxs10(Text11, { children: [
+          /* @__PURE__ */ jsxs15(Text17, { children: [
             "  ",
             [
               request.card.billing_address.city,
@@ -12859,7 +14169,7 @@ var RetrieveSpendRequest = ({
               request.card.billing_address.postal_code
             ].filter(Boolean).join(", ")
           ] }),
-          /* @__PURE__ */ jsxs10(Text11, { children: [
+          /* @__PURE__ */ jsxs15(Text17, { children: [
             "  ",
             request.card.billing_address.country
           ] })
@@ -12870,69 +14180,69 @@ var RetrieveSpendRequest = ({
 };
 
 // src/commands/spend-request/schema.ts
-import { z as z5 } from "incur";
-var createOptions = z5.object({
-  paymentMethodId: z5.string().describe("Payment method ID"),
-  credentialType: z5.enum(["shared_payment_token", "card"]).default("card").describe(
+import { z as z6 } from "incur";
+var createOptions = z6.object({
+  paymentMethodId: z6.string().describe("Payment method ID"),
+  credentialType: z6.enum(["shared_payment_token", "card"]).default("card").describe(
     '"card" for checkout forms/Stripe Elements; "shared_payment_token" for HTTP 402/machine payment flows'
   ),
-  networkId: z5.string().optional().describe(
+  networkId: z6.string().optional().describe(
     "Network ID (required for shared_payment_token) \u2014 use `link-cli mpp decode` to extract"
   ),
-  amount: z5.coerce.number().int().positive().max(5e4).describe("Amount in cents, max 50000 ($500.00)"),
-  currency: z5.string().length(3).default("usd").describe("Currency code"),
-  merchantName: z5.string().optional().describe(
+  amount: z6.coerce.number().int().positive().max(5e4).describe("Amount in cents, max 50000 ($500.00)"),
+  currency: z6.string().length(3).default("usd").describe("Currency code"),
+  merchantName: z6.string().optional().describe(
     "Merchant name (required for card; forbidden for shared_payment_token)"
   ),
-  merchantUrl: z5.string().optional().describe(
+  merchantUrl: z6.string().optional().describe(
     "Merchant URL (required for card; forbidden for shared_payment_token)"
   ),
-  context: z5.string().min(100).describe(
+  context: z6.string().min(100).describe(
     "Min 100 chars \u2014 describe the purchase and rationale; the user reads this when approving"
   ),
-  lineItem: z5.array(z5.union([z5.string(), z5.record(z5.string(), z5.unknown())])).default([]).describe("Line item (repeatable, key:value format)"),
-  total: z5.array(z5.union([z5.string(), z5.record(z5.string(), z5.unknown())])).default([]).describe("Total (repeatable, key:value format)"),
-  requestApproval: z5.boolean().default(true).describe("Request approval and poll until approved/denied/expired"),
-  test: z5.boolean().default(false).describe(
+  lineItem: z6.array(z6.union([z6.string(), z6.record(z6.string(), z6.unknown())])).default([]).describe("Line item (repeatable, key:value format)"),
+  total: z6.array(z6.union([z6.string(), z6.record(z6.string(), z6.unknown())])).default([]).describe("Total (repeatable, key:value format)"),
+  requestApproval: z6.boolean().default(true).describe("Request approval and poll until approved/denied/expired"),
+  test: z6.boolean().default(false).describe(
     "Use test mode (creates testmode credentials from test card data)"
   )
 });
-var retrieveOptions = z5.object({
-  timeout: z5.coerce.number().default(300).describe("Polling timeout in seconds"),
-  interval: z5.coerce.number().default(0).describe(
+var retrieveOptions = z6.object({
+  timeout: z6.coerce.number().default(300).describe("Polling timeout in seconds"),
+  interval: z6.coerce.number().default(0).describe(
     "Poll interval in seconds. When > 0, polls until status is terminal or timeout is reached, yielding status on each attempt."
   ),
-  maxAttempts: z5.coerce.number().default(0).describe("Max poll attempts. 0 = unlimited (use timeout instead)."),
-  include: z5.array(z5.string()).default([]).describe("Include extra data (repeatable, e.g. --include card)")
+  maxAttempts: z6.coerce.number().default(0).describe("Max poll attempts. 0 = unlimited (use timeout instead)."),
+  include: z6.array(z6.string()).default([]).describe("Include extra data (repeatable, e.g. --include card)")
 });
-var updateOptions = z5.object({
-  paymentMethodId: z5.string().optional().describe("Payment method ID"),
-  amount: z5.coerce.number().optional().describe("Amount in cents"),
-  merchantUrl: z5.string().optional().describe("Merchant URL"),
-  profileId: z5.string().optional().describe("Profile ID"),
-  merchantId: z5.string().optional().describe("Merchant ID"),
-  currency: z5.string().optional().describe("Currency code"),
-  lineItem: z5.array(z5.union([z5.string(), z5.record(z5.string(), z5.unknown())])).default([]).describe("Line item (repeatable, key:value format)"),
-  total: z5.array(z5.union([z5.string(), z5.record(z5.string(), z5.unknown())])).default([]).describe("Total (repeatable, key:value format)")
+var updateOptions = z6.object({
+  paymentMethodId: z6.string().optional().describe("Payment method ID"),
+  amount: z6.coerce.number().optional().describe("Amount in cents"),
+  merchantUrl: z6.string().optional().describe("Merchant URL"),
+  profileId: z6.string().optional().describe("Profile ID"),
+  merchantId: z6.string().optional().describe("Merchant ID"),
+  currency: z6.string().optional().describe("Currency code"),
+  lineItem: z6.array(z6.union([z6.string(), z6.record(z6.string(), z6.unknown())])).default([]).describe("Line item (repeatable, key:value format)"),
+  total: z6.array(z6.union([z6.string(), z6.record(z6.string(), z6.unknown())])).default([]).describe("Total (repeatable, key:value format)")
 });
 
 // src/commands/spend-request/update.tsx
-import { Box as Box12, Text as Text12 } from "ink";
+import { Box as Box17, Text as Text18 } from "ink";
 import Spinner8 from "ink-spinner";
-import { useEffect as useEffect9, useState as useState8 } from "react";
-import { jsx as jsx15, jsxs as jsxs11 } from "react/jsx-runtime";
+import { useEffect as useEffect13, useState as useState13 } from "react";
+import { jsx as jsx23, jsxs as jsxs16 } from "react/jsx-runtime";
 var UpdateSpendRequest = ({
   repository,
   id,
   params,
   onComplete
 }) => {
-  const [status, setStatus] = useState8(
+  const [status, setStatus] = useState13(
     "loading"
   );
-  const [request, setRequest] = useState8(null);
-  const [error, setError] = useState8("");
-  useEffect9(() => {
+  const [request, setRequest] = useState13(null);
+  const [error, setError] = useState13("");
+  useEffect13(() => {
     const update = async () => {
       try {
         const result = await repository.updateSpendRequest(id, params);
@@ -12948,55 +14258,55 @@ var UpdateSpendRequest = ({
     update();
   }, [repository, id, params, onComplete]);
   if (status === "loading") {
-    return /* @__PURE__ */ jsx15(Box12, { children: /* @__PURE__ */ jsxs11(Text12, { color: "cyan", children: [
-      /* @__PURE__ */ jsx15(Spinner8, { type: "dots" }),
+    return /* @__PURE__ */ jsx23(Box17, { children: /* @__PURE__ */ jsxs16(Text18, { color: "cyan", children: [
+      /* @__PURE__ */ jsx23(Spinner8, { type: "dots" }),
       " Updating spend request ",
       id,
       "..."
     ] }) });
   }
   if (status === "error") {
-    return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx15(Text12, { color: "red", children: "\u2717 Failed to update spend request" }),
-      /* @__PURE__ */ jsx15(Text12, { color: "red", children: error })
+    return /* @__PURE__ */ jsxs16(Box17, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx23(Text18, { color: "red", children: "\u2717 Failed to update spend request" }),
+      /* @__PURE__ */ jsx23(Text18, { color: "red", children: error })
     ] });
   }
-  return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx15(Text12, { color: "green", children: "\u2713 Spend request updated" }),
-    /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-      /* @__PURE__ */ jsxs11(Text12, { children: [
+  return /* @__PURE__ */ jsxs16(Box17, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx23(Text18, { color: "green", children: "\u2713 Spend request updated" }),
+    /* @__PURE__ */ jsxs16(Box17, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+      /* @__PURE__ */ jsxs16(Text18, { children: [
         "ID: ",
-        /* @__PURE__ */ jsx15(Text12, { bold: true, children: request?.id })
+        /* @__PURE__ */ jsx23(Text18, { bold: true, children: request?.id })
       ] }),
-      /* @__PURE__ */ jsxs11(Text12, { children: [
+      /* @__PURE__ */ jsxs16(Text18, { children: [
         "Status: ",
-        /* @__PURE__ */ jsx15(Text12, { bold: true, children: request?.status })
+        /* @__PURE__ */ jsx23(Text18, { bold: true, children: request?.status })
       ] }),
-      /* @__PURE__ */ jsxs11(Text12, { children: [
+      /* @__PURE__ */ jsxs16(Text18, { children: [
         "Amount:",
         " ",
-        /* @__PURE__ */ jsx15(Text12, { bold: true, children: (() => {
+        /* @__PURE__ */ jsx23(Text18, { bold: true, children: (() => {
           const t = request?.totals.find((t2) => t2.type === "total");
           return t ? String(t.amount) : "N/A";
         })() })
       ] }),
-      /* @__PURE__ */ jsxs11(Text12, { children: [
+      /* @__PURE__ */ jsxs16(Text18, { children: [
         "Merchant: ",
-        /* @__PURE__ */ jsx15(Text12, { bold: true, children: request?.merchant_name })
+        /* @__PURE__ */ jsx23(Text18, { bold: true, children: request?.merchant_name })
       ] }),
-      /* @__PURE__ */ jsxs11(Text12, { children: [
+      /* @__PURE__ */ jsxs16(Text18, { children: [
         "Line Items:",
         " ",
-        /* @__PURE__ */ jsx15(Text12, { bold: true, children: request?.line_items.map((li) => li.name).join(", ") })
+        /* @__PURE__ */ jsx23(Text18, { bold: true, children: request?.line_items.map((li) => li.name).join(", ") })
       ] })
     ] })
   ] });
 };
 
 // src/commands/spend-request/index.tsx
-import { jsx as jsx16 } from "react/jsx-runtime";
+import { jsx as jsx24 } from "react/jsx-runtime";
 function createSpendRequestCli(repository) {
-  const cli2 = Cli4.create("spend-request", {
+  const cli2 = Cli6.create("spend-request", {
     description: "Spend request management commands"
   });
   cli2.command("create", {
@@ -13074,8 +14384,8 @@ function createSpendRequestCli(repository) {
       };
       if (!c.agent && !c.formatExplicit) {
         return new Promise((resolve) => {
-          const { waitUntilExit } = render4(
-            /* @__PURE__ */ jsx16(
+          const { waitUntilExit } = render6(
+            /* @__PURE__ */ jsx24(
               CreateSpendRequest,
               {
                 repository,
@@ -13109,8 +14419,8 @@ function createSpendRequestCli(repository) {
   });
   cli2.command("update", {
     description: "Update a spend request",
-    args: z6.object({
-      id: z6.string().describe("Spend request ID")
+    args: z7.object({
+      id: z7.string().describe("Spend request ID")
     }),
     options: updateOptions,
     outputPolicy: "agent-only",
@@ -13147,8 +14457,8 @@ function createSpendRequestCli(repository) {
         );
       if (!c.agent && !c.formatExplicit) {
         return new Promise((resolve) => {
-          const { waitUntilExit } = render4(
-            /* @__PURE__ */ jsx16(
+          const { waitUntilExit } = render6(
+            /* @__PURE__ */ jsx24(
               UpdateSpendRequest,
               {
                 repository,
@@ -13169,8 +14479,8 @@ function createSpendRequestCli(repository) {
   });
   cli2.command("request-approval", {
     description: "Request approval for a spend request",
-    args: z6.object({
-      id: z6.string().describe("Spend request ID")
+    args: z7.object({
+      id: z7.string().describe("Spend request ID")
     }),
     outputPolicy: "agent-only",
     async *run(c) {
@@ -13188,8 +14498,8 @@ function createSpendRequestCli(repository) {
       const id = c.args.id;
       if (!c.agent && !c.formatExplicit) {
         return new Promise((resolve) => {
-          const { waitUntilExit } = render4(
-            /* @__PURE__ */ jsx16(
+          const { waitUntilExit } = render6(
+            /* @__PURE__ */ jsx24(
               RequestApproval,
               {
                 repository,
@@ -13218,8 +14528,8 @@ function createSpendRequestCli(repository) {
   });
   cli2.command("retrieve", {
     description: "Retrieve a spend request",
-    args: z6.object({
-      id: z6.string().describe("Spend request ID")
+    args: z7.object({
+      id: z7.string().describe("Spend request ID")
     }),
     options: retrieveOptions,
     outputPolicy: "agent-only",
@@ -13244,8 +14554,8 @@ function createSpendRequestCli(repository) {
       const include = includeArr?.length ? includeArr : void 0;
       if (!c.agent && !c.formatExplicit) {
         return new Promise((resolve) => {
-          const { waitUntilExit } = render4(
-            /* @__PURE__ */ jsx16(
+          const { waitUntilExit } = render6(
+            /* @__PURE__ */ jsx24(
               RetrieveSpendRequest,
               {
                 repository,
@@ -13603,7 +14913,7 @@ var ResourceFactory = class {
 };
 
 // src/cli.tsx
-var cliVersion = "0.2.3";
+var cliVersion = "0.3.1";
 var buildNumber = "1";
 var cliName = "@stripe/link-cli";
 var defaultHeaders = {
@@ -13617,7 +14927,7 @@ var spendRequestRepo = factory.createSpendRequestResource();
 var notifier = updateNotifier({
   pkg: { name: cliName, version: cliVersion }
 });
-var cli = Cli5.create("link-cli", {
+var cli = Cli7.create("link-cli", {
   description: "Create a secure, one-time payment credential from a Link wallet to let agents complete purchases on behalf of users.",
   version: `${cliVersion} (build ${buildNumber})`
 });
@@ -13627,6 +14937,20 @@ cli.command(
   createPaymentMethodsCli(() => factory.createPaymentMethodsResource())
 );
 cli.command(createMppCli(spendRequestRepo));
+cli.command(
+  createDemoCli(
+    authRepo,
+    spendRequestRepo,
+    () => factory.createPaymentMethodsResource()
+  )
+);
+cli.command(
+  createOnboardCli(
+    authRepo,
+    spendRequestRepo,
+    () => factory.createPaymentMethodsResource()
+  )
+);
 var isAgent = process.argv.includes("--format") || process.argv.includes("--mcp");
 if (!isAgent) {
   notifier.notify({ defer: false });