diff --git a/manifest.config.ts b/manifest.config.ts
index fd7a5bb..2c38099 100644
--- a/manifest.config.ts
+++ b/manifest.config.ts
@@ -101,7 +101,7 @@ export const plugins: readonly PluginDefinition[] = [
   },
   {
     name: 'mercator',
-    version: '0.3.2',
+    version: '0.3.3',
     codexVersionSuffix: 'codex.20260929120000',
     description: 'Discover, quote, and run paid API workflows through one secure MCP connection. Connect a Tempo Wallet once; no local CLI or wallet setup.',
     displayName: 'Mercator',
diff --git a/plugins/mercator/.claude-plugin/plugin.json b/plugins/mercator/.claude-plugin/plugin.json
index 9e04d61..3bb8096 100644
--- a/plugins/mercator/.claude-plugin/plugin.json
+++ b/plugins/mercator/.claude-plugin/plugin.json
@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "mercator",
   "displayName": "Mercator",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Discover, quote, and run paid API workflows through one secure MCP connection. Connect a Tempo Wallet once; no local CLI or wallet setup.",
   "author": {
     "name": "Tempo"
diff --git a/plugins/mercator/.codex-plugin/plugin.json b/plugins/mercator/.codex-plugin/plugin.json
index 962159c..4dc183a 100644
--- a/plugins/mercator/.codex-plugin/plugin.json
+++ b/plugins/mercator/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "mercator",
-  "version": "0.3.2+codex.20260929120000",
+  "version": "0.3.3+codex.20260929120000",
   "description": "Discover, quote, and run paid API workflows through one secure MCP connection. Connect a Tempo Wallet once; no local CLI or wallet setup.",
   "homepage": "https://mercator.sh/",
   "repository": "https://github.com/tempoxyz/plugins",
diff --git a/plugins/mercator/.cursor-plugin/plugin.json b/plugins/mercator/.cursor-plugin/plugin.json
index e168031..b063d2d 100644
--- a/plugins/mercator/.cursor-plugin/plugin.json
+++ b/plugins/mercator/.cursor-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "mercator",
   "displayName": "Mercator",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Discover, quote, and run paid API workflows through one secure MCP connection. Connect a Tempo Wallet once; no local CLI or wallet setup.",
   "author": {
     "name": "Tempo"
diff --git a/plugins/mercator/plugin.json b/plugins/mercator/plugin.json
index c496cac..ebe8966 100644
--- a/plugins/mercator/plugin.json
+++ b/plugins/mercator/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "mercator",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Discover, quote, and run paid API workflows through one secure MCP connection. Connect a Tempo Wallet once; no local CLI or wallet setup.",
   "homepage": "https://mercator.sh/",
   "repository": "https://github.com/tempoxyz/plugins",
diff --git a/plugins/mercator/skills/mercator-setup/SKILL.md b/plugins/mercator/skills/mercator-setup/SKILL.md
index 4180c9a..d01e772 100644
--- a/plugins/mercator/skills/mercator-setup/SKILL.md
+++ b/plugins/mercator/skills/mercator-setup/SKILL.md
@@ -11,6 +11,14 @@ paid job or a local payment wallet.
 
 ## Connect or repair
 
+- **Diet Mercator (`https://mercator.sh/diet/mcp`):** keep this separate endpoint; do not use
+  the main wallet installer or request Tempo keys. Handle its connection-only OAuth in the
+  user's agent host and retain client/access/refresh state there. A hosted OAuth client can
+  handle its own validated redirect response; it does not need a callback on the user's device.
+  Follow [Diet setup](https://mercator.sh/docs#diet-mercator) for compatible Link clients and
+  the official Link CLI Balance-policy setup link. Ordinary card-checkout support alone does
+  not establish SPT support. Complete the Balance-policy steps below before calling automatic
+  payments ready.
 - Identify the user's app and mode first; ask if unclear. Do not infer local terminal access
   from the agent's ability to run commands in a sandbox.
 - **Claude Desktop chat or claude.ai:** direct the user to **Customize → Connectors → Add custom
@@ -46,6 +54,21 @@ curl -fsSL https://mercator.sh/install.sh | sh
 
 ## Verify and recover
 
+- For Diet, check the compatible Link client's authentication, Balance availability and spending
+  authority separately. Use the official Link CLI setup/payment skills when the host can run it;
+  inspect command schemas and reuse existing authorization rather than creating duplicate grants.
+  Keep payment credentials inside that host. A native Link connection may expose only card checkout.
+- Include policy setup in Diet onboarding when the user wants automatic Balance payments. Ask for
+  a finite per-purchase limit, explain that it is not a total task budget, and present the correct
+  app's official Link policy page for user review and approval. Reuse a verified existing policy;
+  never assume one exists from successful login. An approval-policy read `403` is inconclusive on
+  the tested CLI app, not proof of Stripe enablement or of missing authority. If authority cannot
+  be verified, guide the user to review the policy page. Do not invent public-key/client pairs,
+  enable authority for the user, or fall back to a card when Balance was requested.
+- After user approval, use the client's policy-based payment option (`--use-approval-policy` in
+  Link CLI) for authorized purchases within both the policy and task budget. Setup alone does
+  not authorize a paid acceptance test. Keep credentials for later requests and refresh normally;
+  cancellation stops without a purchase or repeated login attempts.
 - If an embedded browser cannot use the user's passkey, use **Continue in another browser** on
   Mercator's approval page. For an unreachable localhost callback, return the one-time completion
   link shown after approval to the same client. Use the client's documented code input or port
diff --git a/registry/mercator/server.json b/registry/mercator/server.json
index 0c0ffad..8678130 100644
--- a/registry/mercator/server.json
+++ b/registry/mercator/server.json
@@ -3,7 +3,7 @@
   "name": "xyz.tempo/mercator",
   "title": "Mercator",
   "description": "Discover, quote, and run fresh external research and API workflows.",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "remotes": [
     {
       "type": "streamable-http",
diff --git a/skills.lock.json b/skills.lock.json
index 3f61aaa..58e0244 100644
--- a/skills.lock.json
+++ b/skills.lock.json
@@ -27,8 +27,8 @@
       "repo": "tempoxyz/mercator",
       "path": "skills/mercator-setup",
       "ref": "main",
-      "commit": "598f247026fbe99d87e10ccf1cef914918eb5389",
-      "digest": "sha256:d7c7f672a8327800a09086604f508253b3a452689b338e7b337e5ec674a1d8d4",
+      "commit": "4d40690cb51e1571ca0d0037c082151cc95ed286",
+      "digest": "sha256:03c5a4ae3c1686032357b1b3d299e8f4303f5bac9d284fd5fe66d0f8d116ea13",
       "dest": "plugins/mercator/skills/mercator-setup"
     },
     {
diff --git a/test/fixtures/golden/gemini/mercator/gemini-extension.json b/test/fixtures/golden/gemini/mercator/gemini-extension.json
index d24780b..c7cddf5 100644
--- a/test/fixtures/golden/gemini/mercator/gemini-extension.json
+++ b/test/fixtures/golden/gemini/mercator/gemini-extension.json
@@ -1,6 +1,6 @@
 {
   "name": "mercator",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Discover, quote, and run paid API workflows through one secure MCP connection. Connect a Tempo Wallet once; no local CLI or wallet setup.",
   "mcpServers": {
     "mercator": {
diff --git a/test/fixtures/golden/manifests/plugins/mercator/.claude-plugin/plugin.json b/test/fixtures/golden/manifests/plugins/mercator/.claude-plugin/plugin.json
index 9e04d61..3bb8096 100644
--- a/test/fixtures/golden/manifests/plugins/mercator/.claude-plugin/plugin.json
+++ b/test/fixtures/golden/manifests/plugins/mercator/.claude-plugin/plugin.json
@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "mercator",
   "displayName": "Mercator",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Discover, quote, and run paid API workflows through one secure MCP connection. Connect a Tempo Wallet once; no local CLI or wallet setup.",
   "author": {
     "name": "Tempo"
diff --git a/test/fixtures/golden/manifests/plugins/mercator/.codex-plugin/plugin.json b/test/fixtures/golden/manifests/plugins/mercator/.codex-plugin/plugin.json
index 962159c..4dc183a 100644
--- a/test/fixtures/golden/manifests/plugins/mercator/.codex-plugin/plugin.json
+++ b/test/fixtures/golden/manifests/plugins/mercator/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "mercator",
-  "version": "0.3.2+codex.20260929120000",
+  "version": "0.3.3+codex.20260929120000",
   "description": "Discover, quote, and run paid API workflows through one secure MCP connection. Connect a Tempo Wallet once; no local CLI or wallet setup.",
   "homepage": "https://mercator.sh/",
   "repository": "https://github.com/tempoxyz/plugins",
diff --git a/test/fixtures/golden/manifests/plugins/mercator/.cursor-plugin/plugin.json b/test/fixtures/golden/manifests/plugins/mercator/.cursor-plugin/plugin.json
index e168031..b063d2d 100644
--- a/test/fixtures/golden/manifests/plugins/mercator/.cursor-plugin/plugin.json
+++ b/test/fixtures/golden/manifests/plugins/mercator/.cursor-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "mercator",
   "displayName": "Mercator",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Discover, quote, and run paid API workflows through one secure MCP connection. Connect a Tempo Wallet once; no local CLI or wallet setup.",
   "author": {
     "name": "Tempo"
diff --git a/test/fixtures/golden/manifests/plugins/mercator/plugin.json b/test/fixtures/golden/manifests/plugins/mercator/plugin.json
index c496cac..ebe8966 100644
--- a/test/fixtures/golden/manifests/plugins/mercator/plugin.json
+++ b/test/fixtures/golden/manifests/plugins/mercator/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "mercator",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Discover, quote, and run paid API workflows through one secure MCP connection. Connect a Tempo Wallet once; no local CLI or wallet setup.",
   "homepage": "https://mercator.sh/",
   "repository": "https://github.com/tempoxyz/plugins",
diff --git a/test/fixtures/golden/manifests/registry/mercator/server.json b/test/fixtures/golden/manifests/registry/mercator/server.json
index 0c0ffad..8678130 100644
--- a/test/fixtures/golden/manifests/registry/mercator/server.json
+++ b/test/fixtures/golden/manifests/registry/mercator/server.json
@@ -3,7 +3,7 @@
   "name": "xyz.tempo/mercator",
   "title": "Mercator",
   "description": "Discover, quote, and run fresh external research and API workflows.",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "remotes": [
     {
       "type": "streamable-http",