From a10aa4c6058ae93be8e5febf0c8d0eb44926ec12 Mon Sep 17 00:00:00 2001
From: vvillait88 <vvillait88@yahoo.com>
Date: Sat, 3 Oct 2026 15:28:48 -0700
Subject: [PATCH 1/2] Remove the unlock guidance: agent-guide, README and the
 integration notes describe the passphrase as env-only

---
 README.md                   | 10 ++++------
 package.json                |  2 +-
 src/commands/agent-guide.ts |  9 ++++-----
 tests/integration/README.md |  6 ++----
 4 files changed, 11 insertions(+), 16 deletions(-)

diff --git a/README.md b/README.md
index d42e560..cd0ddde 100644
--- a/README.md
+++ b/README.md
@@ -50,7 +50,7 @@ agentscore-pay pay POST https://merchant.example/api --chain tempo -d '...' --ma
 
 ## Agents (scripting)
 
-For LLM tool-loop agents, run `agentscore-pay agent-guide` (add `--json` for parseable output). It prints the structured how-to: golden path (init → discover → balance → check → dry-run → pay), testnet path, funding, auxiliary commands (`unlock`, `limits`, `whoami`, `history`), pitfalls, and exit-code branching. The same notes also surface in `agentscore-pay <command> --help` for `check` and `pay`.
+For LLM tool-loop agents, run `agentscore-pay agent-guide` (add `--json` for parseable output). It prints the structured how-to: golden path (init → discover → balance → check → dry-run → pay), testnet path, funding, auxiliary commands (`limits`, `whoami`, `history`), pitfalls, and exit-code branching. The same notes also surface in `agentscore-pay <command> --help` for `check` and `pay`.
 
 ### Output formats
 
@@ -281,7 +281,6 @@ Each row below is a subcommand of `agentscore-pay`, invoke as `agentscore-pay <c
 | `limits show \| set \| clear` | Persistent per-call / daily / per-merchant USD spending limits |
 | `config get [key] \| set <k> <v> \| unset <k> \| path` | Read/write `~/.agentscore/config.json` (e.g. `config set preferred_chains tempo,base`) |
 | `discover [--search q] [--chain c] [--max-price N] [--limit N] [--protocol x402\|mpp\|both]` | List paid services from the x402 Bazaar (Coinbase) and MPP services directory (Tempo). Both queried in parallel by default. |
-| `unlock [--for 15m] \| --clear` | Cache passphrase to `~/.agentscore/.unlock` (mode 0600) for a bounded TTL, skip per-call prompts during a session |
 | `revoke --chain c --token <addr> --spender <addr> [--network n]` | Send `approve(spender, 0)` on EVM (base/tempo). Requires native gas. |
 
 ### Identity commands
@@ -419,15 +418,14 @@ AGENTSCORE_PAY_HOME=~/.agentscore-test agentscore-pay pay --network testnet ...
 
 ## Unlocking the keystore
 
-Three ways to satisfy the passphrase prompt, in precedence order:
+Two ways to satisfy the passphrase prompt, in precedence order:
 
 | Mechanism | Best for | Persistence |
 |---|---|---|
 | `AGENTSCORE_PAY_PASSPHRASE=<pass>` env var | Containers, CI, serverless, daemons, any non-interactive agent | Lifetime of the process / shell session |
-| `agentscore-pay unlock --for 1h` | Interactive shell session where you'll run multiple commands | Cached in `~/.agentscore/.unlock` (mode `0600`) until TTL expires (max 8h); `unlock --clear` wipes early |
 | Per-call interactive prompt | First-time setup, one-off commands | None, never written |
 
-**Env var wins** when set: it produces no on-disk artifact and is the right primitive for every agent context (CI secrets, container env, K8s secrets, Lambda config, MCP host config). When env vars aren't controllable (e.g. an interactive Claude Code session running locally), `unlock` is the fallback.
+**Env var wins** when set: it produces no on-disk artifact and is the right primitive for every agent context (CI secrets, container env, K8s secrets, Lambda config, MCP host config). There is no on-disk passphrase cache: it would hold the passphrase in cleartext beside the keystores it unlocks.
 
 **For agent authors**: prefer env var. Read it from your secret store at agent startup; don't bake it into the agent's prompt or memory. Pay's `agent-guide` command (`agentscore-pay agent-guide`) explains the precedence in its own structured output.
 
@@ -481,7 +479,7 @@ agentscore-pay fund-estimate https://agents.example.com/purchase \
 
 For **interactive humans**: any 8+ char passphrase you'll remember is fine, the scrypt-256-GCM combination is robust against offline brute force at typical human-passphrase entropy levels.
 
-For **autonomous agents**: the passphrase usually lives in `AGENTSCORE_PAY_PASSPHRASE` (env var) or `~/.agentscore/.unlock` (file). Both are filesystem/process-readable to anyone with shell access as that user, so the passphrase isn't really a separate trust boundary, it's primarily protecting the keystore against *theft of the on-disk file alone*. A long, random passphrase makes the file useless if exfiltrated:
+For **autonomous agents**: the passphrase usually lives in `AGENTSCORE_PAY_PASSPHRASE` (env var), which is process-readable to anyone with shell access as that user, so the passphrase isn't really a separate trust boundary, it's primarily protecting the keystore against *theft of the on-disk file alone*. A long, random passphrase makes the file useless if exfiltrated:
 
 ```sh
 # generate a 32-byte (256-bit) random passphrase
diff --git a/package.json b/package.json
index 3cd9a90..555c17e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@agent-score/pay",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "CLI wallet for one-shell-command agent payments across x402 (Base) and MPP (Tempo, Solana)",
   "type": "module",
   "main": "./dist/index.js",
diff --git a/src/commands/agent-guide.ts b/src/commands/agent-guide.ts
index 75cb722..38f707a 100644
--- a/src/commands/agent-guide.ts
+++ b/src/commands/agent-guide.ts
@@ -196,12 +196,11 @@ const GUIDE: AgentGuide = {
       ],
     },
     {
-      step: 'Skip the passphrase prompt with `unlock` (when env var is not an option)',
-      why: 'Each pay/wallet call decrypts the keystore and normally prompts for the passphrase. Agents can either set AGENTSCORE_PAY_PASSPHRASE in the env, or — when env vars are not controllable — run `unlock --for <ttl>` once to cache the passphrase to ~/.agentscore/.unlock for a bounded duration (max 8h).',
-      command_example: 'agentscore-pay unlock --for 1h',
+      step: 'Supply the passphrase through AGENTSCORE_PAY_PASSPHRASE',
+      why: 'Each pay/wallet call decrypts the keystore and otherwise prompts for the passphrase, which an agent cannot answer. Set AGENTSCORE_PAY_PASSPHRASE in the environment from your secret store at startup: it leaves no on-disk artifact. There is no passphrase cache: it would hold the passphrase in cleartext beside the keystores it unlocks.',
+      command_example: 'AGENTSCORE_PAY_PASSPHRASE=... agentscore-pay pay POST <url> -d \'{}\' --max-spend 5',
       notes: [
-        'Use `agentscore-pay unlock --clear` when finished to wipe the cache early.',
-        'AGENTSCORE_PAY_PASSPHRASE in env always wins over the cache and produces no on-disk artifact — prefer it in CI or any ephemeral execution context.',
+        'Read it from a secret store (CI secrets, container env, MCP host config); never put it in the agent prompt or memory.',
       ],
     },
     {
diff --git a/tests/integration/README.md b/tests/integration/README.md
index f05b81c..14134d2 100644
--- a/tests/integration/README.md
+++ b/tests/integration/README.md
@@ -20,10 +20,8 @@ can run them on a best-effort basis.
 
 - Base Sepolia USDC: https://faucet.circle.com/
 - Solana Devnet USDC: https://faucet.circle.com/
-- Tempo testnet USDC.e: contact Tempo team
+- Tempo testnet: `agentscore-pay fund --chain tempo --network testnet` mints test stablecoins directly
 
 ## What's covered
 
-- `tests/integration/balance.test.ts` — reads USDC balance on Base Sepolia and Solana Devnet
-- (future) `tests/integration/pay.test.ts` — completes a real 402 payment round-trip
-  against an x402 base demo endpoint and an MPP `solana/charge` demo endpoint on Solana Devnet
+- `tests/integration/balance.test.ts` reads USDC balance on Base Sepolia and Solana Devnet

From 38e1994bb788377ce1874736f05a6b56430079f8 Mon Sep 17 00:00:00 2001
From: vvillait88 <vvillait88@yahoo.com>
Date: Sat, 3 Oct 2026 15:30:10 -0700
Subject: [PATCH 2/2] No em-dashes in user-facing strings or docs

---
 .claude/CLAUDE.md           | 30 ++++++------
 CONTRIBUTING.md             |  2 +-
 SECURITY.md                 |  4 +-
 src/aip/agent-key.ts        | 14 +++---
 src/aip/http-signature.ts   |  2 +-
 src/aip/mint.ts             |  6 +--
 src/chains/solana.ts        |  2 +-
 src/chains/tempo.ts         |  2 +-
 src/cli.ts                  | 62 ++++++++++++------------
 src/commands/agent-guide.ts | 96 ++++++++++++++++++-------------------
 src/commands/check.ts       |  2 +-
 src/commands/fund.ts        |  2 +-
 src/commands/identity.ts    |  4 +-
 src/commands/passport.ts    |  4 +-
 src/commands/pay.ts         | 32 ++++++-------
 src/commands/qr.ts          |  2 +-
 src/commands/send.ts        |  2 +-
 src/commands/wallet.ts      |  2 +-
 src/faucets.ts              |  2 +-
 src/headers.ts              |  2 +-
 src/onramp.ts               |  4 +-
 src/passport/attach.ts      | 14 +++---
 src/passport/auth.ts        | 10 ++--
 src/passport/bootstrap.ts   |  4 +-
 src/rail-hints.ts           | 10 ++--
 src/selection.ts            |  2 +-
 src/url-security.ts         | 12 ++---
 27 files changed, 165 insertions(+), 165 deletions(-)

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index ef74712..2512fa3 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -4,7 +4,7 @@ CLI wallet for one-shell-command agent payments across x402 (Base) and MPP (Temp
 
 ## Purpose
 
-One shell command for shell-tool LLM agents to pay any 402/MPP merchant. POST body preserved through the round-trip; agent never sees a private key on the wire. Works with any 402-gated merchant — AgentScore-gated or not.
+One shell command for shell-tool LLM agents to pay any 402/MPP merchant. POST body preserved through the round-trip; agent never sees a private key on the wire. Works with any 402-gated merchant, AgentScore-gated or not.
 
 ## Architecture
 
@@ -24,16 +24,16 @@ Single-package TypeScript CLI published to npm. Runnable via `npx @agent-score/p
 | `src/commands/wallet.ts` | `wallet create/import/address/list/remove/export/show-mnemonic` |
 | `src/commands/balance.ts` | `balance` across chains |
 | `src/commands/qr.ts` | `qr` with optional amount |
-| `src/commands/fund.ts` | `fund` — receive QR + balance polling (default); `--via stripe-onramp` mints a Stripe Crypto Onramp session (base/solana mainnet only); `--quote-only` returns the Stripe price preview without minting. Tempo testnet uses programmatic mint via tempo_fundAddress. |
-| `src/onramp.ts` | API client for the AgentScore Crypto Onramp endpoints (POST /v1/onramp/sessions + POST /v1/onramp/quotes). Sends X-Client-Id + the stored passport operator_token in the body — no merchant API key required. |
-| `src/commands/pay.ts` | `pay <METHOD> <URL>` — routes to `@x402/fetch` (base) or `mppx/client` (tempo, solana via `@solana/mpp/client`). `--identity auto\|operator\|wallet` selects the identity to present (`operator` uses the stored passport operator_token; `wallet` uses the wallet address; `auto` is the default passport/wallet path). |
+| `src/commands/fund.ts` | `fund`, receive QR + balance polling (default); `--via stripe-onramp` mints a Stripe Crypto Onramp session (base/solana mainnet only); `--quote-only` returns the Stripe price preview without minting. Tempo testnet uses programmatic mint via tempo_fundAddress. |
+| `src/onramp.ts` | API client for the AgentScore Crypto Onramp endpoints (POST /v1/onramp/sessions + POST /v1/onramp/quotes). Sends X-Client-Id + the stored passport operator_token in the body, no merchant API key required. |
+| `src/commands/pay.ts` | `pay <METHOD> <URL>`, routes to `@x402/fetch` (base) or `mppx/client` (tempo, solana via `@solana/mpp/client`). `--identity auto\|operator\|wallet` selects the identity to present (`operator` uses the stored passport operator_token; `wallet` uses the wallet address; `auto` is the default passport/wallet path). |
 | `src/commands/identity.ts` | `assess`, `sessions create/get`, `credentials create/list/revoke`, `associate-wallet` (wraps `@agent-score/sdk`) |
-| `src/commands/send.ts` | `send --chain <chain> --to <addr> --amount <n> [--asset usdc\|native]` — raw transfer (no merchant / 402). Default `--asset usdc` (ERC20 transfer on EVM / SPL transferChecked + idempotent ATA on Solana). `--asset native` sends ETH/TEMPO/SOL via viem sendTransaction (EVM) or `getTransferSolInstruction` (Solana). EVM transfers confirm the on-chain receipt (`src/chains/evm-confirm.ts`) and surface a reverted tx as `transfer_reverted` instead of returning a hash for a tx that never settled. Note Tempo pays the network fee in the stablecoin itself, so a full-balance USDC send reverts (no headroom for the fee); leave a little `--amount` headroom. Works on mainnet + testnet (`--network testnet`). |
-| `src/commands/passport.ts` | `passport login/status/logout` — AgentScore Passport (buyer-side identity); stores opc_ at `~/.agentscore/passport.json`, auto-attached on `agentscore-pay <url>` settle leg |
+| `src/commands/send.ts` | `send --chain <chain> --to <addr> --amount <n> [--asset usdc\|native]`, raw transfer (no merchant / 402). Default `--asset usdc` (ERC20 transfer on EVM / SPL transferChecked + idempotent ATA on Solana). `--asset native` sends ETH/TEMPO/SOL via viem sendTransaction (EVM) or `getTransferSolInstruction` (Solana). EVM transfers confirm the on-chain receipt (`src/chains/evm-confirm.ts`) and surface a reverted tx as `transfer_reverted` instead of returning a hash for a tx that never settled. Note Tempo pays the network fee in the stablecoin itself, so a full-balance USDC send reverts (no headroom for the fee); leave a little `--amount` headroom. Works on mainnet + testnet (`--network testnet`). |
+| `src/commands/passport.ts` | `passport login/status/logout`, AgentScore Passport (buyer-side identity); stores opc_ at `~/.agentscore/passport.json`, auto-attached on `agentscore-pay <url>` settle leg |
 | `src/passport/{auth,storage,attach}.ts` | Passport login flow (mint+poll), conf-style local keystore, X-Operator-Token attach decision tree |
 | `src/progress.ts` | stderr-only structured progress events (stdout belongs to incur) |
 | `tests/` | Vitest unit tests |
-| `dist/` | tsup output — ESM only with shebang banner |
+| `dist/` | tsup output, ESM only with shebang banner |
 
 ## Chain-to-protocol routing
 
@@ -45,12 +45,12 @@ Both paths preserve POST bodies through the 402 round-trip. The CLI's passphrase
 
 ## Tooling
 
-- **Bun** — package manager. Use `bun install`, `bun run <script>`.
-- **ESLint 9** — linting. `bun run lint`.
-- **tsup** — builds ESM with `#!/usr/bin/env node` banner. `bun run build`.
-- **Vitest** — tests. `bun run test`.
-- **knip** — dead-code check. `bun run knip` (src/aip/ excluded: dormant surface kept for re-enable).
-- **Lefthook** — git hooks. Pre-commit: lint. Pre-push: typecheck.
+- **Bun**, package manager. Use `bun install`, `bun run <script>`.
+- **ESLint 9**, linting. `bun run lint`.
+- **tsup**, builds ESM with `#!/usr/bin/env node` banner. `bun run build`.
+- **Vitest**, tests. `bun run test`.
+- **knip**, dead-code check. `bun run knip` (src/aip/ excluded: dormant surface kept for re-enable).
+- **Lefthook**, git hooks. Pre-commit: lint. Pre-push: typecheck.
 
 ## Patched dependencies
 
@@ -86,14 +86,14 @@ bun run build
 1. Create a branch
 2. Make changes
 3. Lefthook runs lint on commit, typecheck on push
-4. Open a PR — CI runs automatically
+4. Open a PR, CI runs automatically
 5. Merge (squash)
 
 ## Rules
 
 - **No silent refactors**
 - **Never commit .env files or secrets**
-- **Use PRs** — never push directly to main
+- **Use PRs**, never push directly to main
 
 ## Releasing
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3938eed..0b508d6 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -15,7 +15,7 @@ Thanks for your interest in contributing! Here's how to get started.
 
 - All PRs require 1 approval before merging
 - Squash merge to `main` is the standard
-- Keep PRs focused — one feature or fix per PR
+- Keep PRs focused, one feature or fix per PR
 - Include tests for new functionality
 - Make sure CI passes before requesting review
 
diff --git a/SECURITY.md b/SECURITY.md
index 750e250..6394ad1 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -25,8 +25,8 @@ We will acknowledge receipt within 48 hours and aim to release a fix within 7 da
 
 This is a CLI wallet. The security model assumes:
 
-- The machine running the CLI is trusted — keys are encrypted at rest, but a compromised host with keyboard/memory access can recover them
+- The machine running the CLI is trusted, keys are encrypted at rest, but a compromised host with keyboard/memory access can recover them
 - The passphrase is not logged anywhere (we prompt interactively or read from `AGENTSCORE_PAY_PASSPHRASE`)
-- `wallet export` and `wallet show-mnemonic` print secret material to stdout — only run these on trusted terminals
+- `wallet export` and `wallet show-mnemonic` print secret material to stdout, only run these on trusted terminals
 
 Issues outside this scope (e.g., extracting keys from a machine you already control, upstream `@x402/fetch` / `mppx` / `viem` vulnerabilities) should be reported to the respective projects.
diff --git a/src/aip/agent-key.ts b/src/aip/agent-key.ts
index 0ae0e2a..cf4a7cb 100644
--- a/src/aip/agent-key.ts
+++ b/src/aip/agent-key.ts
@@ -1,5 +1,5 @@
 /**
- * AIP agent key — the Ed25519 keypair pay uses as the AIT `cnf` (proof-of-possession) key.
+ * AIP agent key, the Ed25519 keypair pay uses as the AIT `cnf` (proof-of-possession) key.
  *
  * One Ed25519 key, independent of payment wallets (which are chain-typed secp256k1/ed25519). The
  * public half is bound into a minted AIT's `cnf` claim; the private half signs each merchant
@@ -21,7 +21,7 @@ interface AgentKeyFile {
   version: 1;
   kind: 'aip-agent-key';
   crv: 'Ed25519';
-  /** Public x coordinate (base64url) — kept in the clear for quick public-JWK reads. */
+  /** Public x coordinate (base64url), kept in the clear for quick public-JWK reads. */
   x: string;
   /** Encrypted private scalar `d` (the 32-byte Ed25519 seed). */
   encryption: KeystoreFile['encryption'];
@@ -37,7 +37,7 @@ export interface AgentKey {
 const isNotFound = (err: unknown): boolean =>
   typeof err === 'object' && err !== null && (err as { code?: string }).code === 'ENOENT';
 
-/** True if an agent key already exists on disk. Only ENOENT means "missing" — any other
+/** True if an agent key already exists on disk. Only ENOENT means "missing", any other
  *  error (EACCES, EIO, ...) propagates so a transient failure never silently regenerates
  *  (and overwrites) the key. */
 export async function agentKeyExists(): Promise<boolean> {
@@ -62,11 +62,11 @@ async function loadAgentKey(passphrase: string): Promise<AgentKey> {
   } catch {
     throw new CliError(
       'wrong_passphrase',
-      `Could not decrypt the AIP agent key at ${agentKeyPath()} — the passphrase does not match the one the key was created with.`,
+      `Could not decrypt the AIP agent key at ${agentKeyPath()}, the passphrase does not match the one the key was created with.`,
       {
         nextSteps: {
           action: 'retry_or_regenerate_agent_key',
-          suggestion: `Retry with the passphrase the agent key was created under, or delete ${agentKeyPath()} to regenerate it — the cnf public key is re-sent on every mint, so deleting it is safe.`,
+          suggestion: `Retry with the passphrase the agent key was created under, or delete ${agentKeyPath()} to regenerate it, the cnf public key is re-sent on every mint, so deleting it is safe.`,
         },
         extra: { path: agentKeyPath() },
       },
@@ -96,7 +96,7 @@ async function createAgentKey(passphrase: string): Promise<AgentKey> {
   await mkdir(dirname(path), { recursive: true, mode: 0o700 });
   try {
     // Exclusive create: never clobber a key another process persisted between the exists
-    // check and this write — losing the create race means the other key is canonical.
+    // check and this write, losing the create race means the other key is canonical.
     await writeFile(path, JSON.stringify(file, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
   } catch (err: unknown) {
     if ((err as { code?: string } | null)?.code === 'EEXIST') return loadAgentKey(passphrase);
@@ -108,7 +108,7 @@ async function createAgentKey(passphrase: string): Promise<AgentKey> {
 
 /**
  * Load the agent key, creating + persisting one on first use. `passphrase` unlocks (or encrypts,
- * on first create) the private scalar — same passphrase model as the wallet keystore.
+ * on first create) the private scalar, same passphrase model as the wallet keystore.
  */
 export async function getOrCreateAgentKey(passphrase: string): Promise<AgentKey> {
   try {
diff --git a/src/aip/http-signature.ts b/src/aip/http-signature.ts
index 548ee1c..0ce5ca1 100644
--- a/src/aip/http-signature.ts
+++ b/src/aip/http-signature.ts
@@ -1,5 +1,5 @@
 /**
- * RFC 9421 HTTP Message Signature — the AIP proof-of-possession SIGNER (client side).
+ * RFC 9421 HTTP Message Signature, the AIP proof-of-possession SIGNER (client side).
  *
  * pay presents an Agent Identity Token (AIT) to a merchant by signing the request with the
  * Ed25519 key whose public half is bound in the token's `cnf` claim. This module produces the
diff --git a/src/aip/mint.ts b/src/aip/mint.ts
index 55d2615..14cf8cb 100644
--- a/src/aip/mint.ts
+++ b/src/aip/mint.ts
@@ -3,7 +3,7 @@
  *
  * pay sends X-Client-Id `agentscore_pay_pubclient_v1` when minting.
  * The issuer resolves the operator's verified identity from its passport/account and stamps the
- * derived compliance claims (id_verified, age bands, jurisdiction, sanctions) — pay does NOT and
+ * derived compliance claims (id_verified, age bands, jurisdiction, sanctions), pay does NOT and
  * cannot assert those. pay supplies only the operator_token, the agent cnf public key, and an
  * honest `trust_level` reflecting whether a human is at the terminal.
  *
@@ -17,7 +17,7 @@ import type { Ed25519PublicJwk } from './http-signature';
 const DEFAULT_BASE_URL = process.env.AGENTSCORE_BASE_URL ?? 'https://api.agentscore.com';
 const PUBLIC_CLIENT_ID = 'agentscore_pay_pubclient_v1';
 
-/** AIP trust level — the per-action human-authorization strength. `autonomous` (no human) and
+/** AIP trust level, the per-action human-authorization strength. `autonomous` (no human) and
  *  `human_present` (TTY) are inferred from terminal presence; `human_confirmed` is set only when the
  *  human explicitly confirms the intent at the terminal (requires auth.amr + intent.description). */
 export type TrustLevel = 'autonomous' | 'human_present' | 'human_confirmed';
@@ -32,7 +32,7 @@ export interface MintAitInput {
   intent?: string;
   /** Machine-readable intent actions (e.g. `['purchase']`), stamped into `intent.actions`. */
   actions?: string[];
-  /** Authentication context for `human_confirmed` — `auth.amr` (RFC 8176) MUST carry ≥1 value
+  /** Authentication context for `human_confirmed`, `auth.amr` (RFC 8176) MUST carry ≥1 value
    *  (e.g. `['user']` for a terminal confirmation). The issuer rejects human_confirmed without it. */
   auth?: { amr?: string[]; time?: number };
   baseUrl?: string;
diff --git a/src/chains/solana.ts b/src/chains/solana.ts
index 22a83cc..95beccb 100644
--- a/src/chains/solana.ts
+++ b/src/chains/solana.ts
@@ -85,7 +85,7 @@ export async function nativeBalance(ownerBase58: string, network: Network = 'mai
 }
 
 export function formatNative(raw: bigint): string {
-  // SOL has 9 decimals (lamports). Show 4 fractional digits — enough for
+  // SOL has 9 decimals (lamports). Show 4 fractional digits, enough for
   // typical fee-balance reads.
   const whole = raw / 10n ** 9n;
   const frac = raw % 10n ** 9n;
diff --git a/src/chains/tempo.ts b/src/chains/tempo.ts
index eba5bf5..e7f785c 100644
--- a/src/chains/tempo.ts
+++ b/src/chains/tempo.ts
@@ -149,7 +149,7 @@ export async function transfer(input: {
 /**
  * Calls Moderato testnet's `tempo_fundAddress` JSON-RPC method, which mints
  * test stablecoins (pathUSD, AlphaUSD, BetaUSD, ThetaUSD) to the address.
- * Testnet only — mainnet has no programmatic faucet.
+ * Testnet only, mainnet has no programmatic faucet.
  */
 export async function fundTestnet(address: string): Promise<string[]> {
   const cfg = evmConfig('tempo', 'testnet');
diff --git a/src/cli.ts b/src/cli.ts
index aa9d173..5fef3dc 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -48,7 +48,7 @@ const VERSION = typeof __VERSION__ === 'string' ? __VERSION__ : '0.0.0-dev';
 
 const chainSchema = z.enum(SUPPORTED_CHAINS).describe('Blockchain rail (base, solana, tempo)');
 const networkSchema = z.enum(SUPPORTED_NETWORKS).default('mainnet').describe('Mainnet (default) or testnet');
-const walletNameSchema = z.string().default('default').describe('Named keystore — pass a name to pick a non-default wallet');
+const walletNameSchema = z.string().default('default').describe('Named keystore, pass a name to pick a non-default wallet');
 
 function parseHeaders(values: string[] | undefined): Record<string, string> | undefined {
   if (!values || values.length === 0) return undefined;
@@ -97,7 +97,7 @@ export function isRetryable(code: string): boolean {
  * Implementation note: many call sites pass a non-async arrow (e.g.
  * `withCliErrors(() => fundEstimate({headers: parseHeaders(...)}))`) where
  * `parseHeaders` can throw a CliError synchronously while constructing the
- * args object — *before* the inner promise is returned. A naive `fn().catch`
+ * args object, *before* the inner promise is returned. A naive `fn().catch`
  * would let that sync throw propagate uncaught, reaching incur as a raw Error
  * and erasing the CliError.code. `Promise.resolve().then(fn)` defers the call
  * onto the microtask queue, so any sync throw becomes a Promise rejection
@@ -138,7 +138,7 @@ export function buildCli() {
       command: 'npx -y @agent-score/pay --mcp',
     },
     env: z.object({
-      AGENTSCORE_API_KEY: z.string().optional().describe('API key for identity tools (assess, sessions, credentials, associate-wallet). Not required for passport login/status — those use the public session endpoint.'),
+      AGENTSCORE_API_KEY: z.string().optional().describe('API key for identity tools (assess, sessions, credentials, associate-wallet). Not required for passport login/status, those use the public session endpoint.'),
       AGENTSCORE_PAY_PASSPHRASE: z.string().optional().describe('Skip the interactive passphrase prompt for keystore operations'),
       AGENTSCORE_PAY_HOME: z.string().optional().describe('Override the state dir (default: ~/.agentscore)'),
       BASE_RPC_URL: z.string().optional().describe('Override Base mainnet RPC endpoint'),
@@ -151,7 +151,7 @@ export function buildCli() {
     sync: {
       suggestions: [
         'create a wallet on every supported chain with `agentscore-pay init`',
-        'verify your AgentScore Passport once with `agentscore-pay passport login` — pay then auto-attaches X-Operator-Token to every gated merchant',
+        'verify your AgentScore Passport once with `agentscore-pay passport login`, pay then auto-attaches X-Operator-Token to every gated merchant',
         'discover paid services with `agentscore-pay discover --search <query>`',
         'probe a 402 endpoint with `agentscore-pay check <url> -X POST -d <body>`',
         'pay an endpoint with `agentscore-pay pay POST <url> -d <body> --max-spend 5`',
@@ -186,7 +186,7 @@ export function buildCli() {
           cta: {
             description: 'Next steps:',
             commands: [
-              { command: 'passport login', description: 'Verify identity once — required for AgentScore-gated merchants. Skipped automatically for unregulated ones. ~30 seconds in browser, no money needed.' },
+              { command: 'passport login', description: 'Verify identity once, required for AgentScore-gated merchants. Skipped automatically for unregulated ones. ~30 seconds in browser, no money needed.' },
               { command: 'fund', options: { chain: true }, description: 'Print a receive QR + poll for the deposit' },
               { command: 'balance', description: 'Confirm wallet balances' },
               { command: 'discover', description: 'Browse paid services in the x402 + MPP ecosystem' },
@@ -238,7 +238,7 @@ export function buildCli() {
     }),
     examples: [
       { args: { key: '0xYOUR_PRIVATE_KEY' }, options: { chain: 'base' }, description: 'Import an EVM private key (replace 0xYOUR_PRIVATE_KEY)' },
-      { options: { mnemonic: "'twelve or twenty-four word phrase here'" }, description: 'Import a BIP-39 mnemonic — quote it (derives all three chains)' },
+      { options: { mnemonic: "'twelve or twenty-four word phrase here'" }, description: 'Import a BIP-39 mnemonic, quote it (derives all three chains)' },
     ],
     run({ args, options }) {
       return withCliErrors(async () => {
@@ -277,8 +277,8 @@ export function buildCli() {
     // prompt injection reaches irreversible key disclosure or fund movement, and
     // any secret returned lands in the transcript and the model provider's logs.
     mcp: false,
-    description: 'Print the stored BIP-39 mnemonic. DANGER — only run in a trusted environment.',
-    hint: 'The mnemonic restores every chain wallet — anyone with this phrase can drain your funds. Never paste it into chat, logs, or unencrypted storage.',
+    description: 'Print the stored BIP-39 mnemonic. DANGER, only run in a trusted environment.',
+    hint: 'The mnemonic restores every chain wallet, anyone with this phrase can drain your funds. Never paste it into chat, logs, or unencrypted storage.',
     outputPolicy: 'agent-only',
     options: z.object({
       danger: z.boolean().optional().describe('Acknowledge the risk of printing the mnemonic'),
@@ -313,7 +313,7 @@ export function buildCli() {
     // prompt injection reaches irreversible key disclosure or fund movement, and
     // any secret returned lands in the transcript and the model provider's logs.
     mcp: false,
-    description: 'Decrypt and print a private key. DANGER — only run if you trust the surrounding environment.',
+    description: 'Decrypt and print a private key. DANGER, only run if you trust the surrounding environment.',
     hint: 'The exported key gives full control of the wallet to anyone who reads it. Pipe to an encrypted store; never to a shared shell history.',
     outputPolicy: 'agent-only',
     options: z.object({
@@ -341,7 +341,7 @@ export function buildCli() {
     // prompt injection reaches irreversible key disclosure or fund movement, and
     // any secret returned lands in the transcript and the model provider's logs.
     mcp: false,
-    description: 'Delete a keystore. DANGER — irrecoverable unless you have the BIP-39 mnemonic backup.',
+    description: 'Delete a keystore. DANGER, irrecoverable unless you have the BIP-39 mnemonic backup.',
     hint: 'No undo. Run `wallet show-mnemonic --danger` first if you want to be able to restore.',
     options: z.object({
       chain: chainSchema,
@@ -412,7 +412,7 @@ export function buildCli() {
   cli.command('fund', {
     description:
       'Fund the wallet. Default: print receive QR + poll balance (works for any chain via external wallet/exchange). With --via stripe-onramp: mint a Stripe Crypto Onramp session for card-funding (base + solana mainnet only). Tempo testnet uses programmatic mint via tempo_fundAddress.',
-    hint: 'Default flow works on any chain (receive QR + poll). For Stripe Crypto Onramp, pass --via stripe-onramp --amount <USD>; pay never auto-opens a browser — click the printed hosted URL yourself.',
+    hint: 'Default flow works on any chain (receive QR + poll). For Stripe Crypto Onramp, pass --via stripe-onramp --amount <USD>; pay never auto-opens a browser, click the printed hosted URL yourself.',
     options: z.object({
       chain: chainSchema,
       network: networkSchema,
@@ -495,7 +495,7 @@ export function buildCli() {
     }),
     alias: { method: 'X', data: 'd', header: 'H' },
     examples: [
-      { args: { url: 'https://merchant.example/api' }, description: 'GET probe — assumes the merchant gates GET requests' },
+      { args: { url: 'https://merchant.example/api' }, description: 'GET probe, assumes the merchant gates GET requests' },
       { args: { url: 'https://merchant.example/api' }, options: { method: 'POST', data: "'{}'" }, description: 'POST probe with body (quote the JSON)' },
     ],
     run({ args, options }) {
@@ -520,7 +520,7 @@ export function buildCli() {
     // prompt injection reaches irreversible key disclosure or fund movement, and
     // any secret returned lands in the transcript and the model provider's logs.
     mcp: false,
-    description: 'Raw transfer to an arbitrary address on Base, Tempo, or Solana. Default --asset usdc; --asset native sends gas (ETH on Base, TEMPO on Tempo, SOL on Solana). No merchant, no 402 handshake — just on-chain.',
+    description: 'Raw transfer to an arbitrary address on Base, Tempo, or Solana. Default --asset usdc; --asset native sends gas (ETH on Base, TEMPO on Tempo, SOL on Solana). No merchant, no 402 handshake, just on-chain.',
     hint: 'Both flavors require native gas in the signer wallet (gas pays the on-chain write, regardless of which asset is being transferred). x402/MPP payments are gasless; raw transfers are not.',
     options: z.object({
       chain: chainSchema,
@@ -715,11 +715,11 @@ export function buildCli() {
   // ── check ───────────────────────────────────────────────────────────────────
   cli.command('check', {
     description: 'Probe a URL for a 402 response and show accepted rails without paying',
-    hint: 'Always probe with the same method + body you intend to pay with — most paid endpoints only respond 402 to POST + JSON.',
+    hint: 'Always probe with the same method + body you intend to pay with, most paid endpoints only respond 402 to POST + JSON.',
     args: z.object({ url: z.string() }),
     options: z.object({
       method: z.string().default('GET').describe('HTTP method'),
-      data: z.string().optional().describe('Request body — quote JSON values, e.g. -d \'{"k":"v"}\''),
+      data: z.string().optional().describe('Request body, quote JSON values, e.g. -d \'{"k":"v"}\''),
       header: z.array(z.string()).optional().describe("Additional header (repeatable, 'Name: value')"),
     }),
     alias: { method: 'X', data: 'd', header: 'H' },
@@ -833,7 +833,7 @@ export function buildCli() {
       'Check a wallet or operator against a compliance policy. Pass --address (wallet) or --operator-token (credential).',
     hint: 'Requires AGENTSCORE_API_KEY (or --api-key).',
     options: z.object({
-      address: z.string().optional().describe('Wallet address — EVM (0x...) or Solana (base58)'),
+      address: z.string().optional().describe('Wallet address, EVM (0x...) or Solana (base58)'),
       operatorToken: z.string().optional().describe('Operator credential (opc_...) for non-wallet identity'),
       chain: z.string().optional().describe('Optional chain filter'),
       requireKyc: z.boolean().optional().describe('Require KYC verification to allow'),
@@ -877,7 +877,7 @@ export function buildCli() {
     description: 'Identity verification sessions (requires API key)',
   });
   sessions.command('create', {
-    description: 'Create an identity verification session — returns verify_url + poll credentials',
+    description: 'Create an identity verification session, returns verify_url + poll credentials',
     options: z.object({
       address: z.string().optional().describe('Pre-associate session with a known wallet'),
       operatorToken: z.string().optional().describe('Refresh KYC for an existing operator credential'),
@@ -910,7 +910,7 @@ export function buildCli() {
     },
   });
   sessions.command('get', {
-    description: 'Poll a verification session — returns operator_token when status becomes verified',
+    description: 'Poll a verification session, returns operator_token when status becomes verified',
     args: z.object({ id: z.string().describe('Session ID (sess_...)') }),
     options: z.object({
       pollSecret: z.string().optional().describe('Poll secret returned from sessions create'),
@@ -925,7 +925,7 @@ export function buildCli() {
         if (result.status !== 'verified' || !result.operator_token) return c.ok(result);
         return c.ok(result, {
           cta: {
-            description: 'Verified — use the operator_token to retry the original gated request:',
+            description: 'Verified, use the operator_token to retry the original gated request:',
             commands: [
               { command: 'pay', description: 'Re-run the merchant request with -H "X-Operator-Token: <operator_token>"' },
               { command: 'associate-wallet', description: 'After paying, attribute the signer wallet to this operator credential' },
@@ -942,8 +942,8 @@ export function buildCli() {
     description: 'Operator credentials (opc_...) for non-wallet agent identity (requires API key)',
   });
   credentials.command('create', {
-    description: 'Create an operator credential. Run `credentials list` first — reuse beats creating.',
-    hint: 'Returned credential is shown ONCE. Store it securely — there is no recovery flow.',
+    description: 'Create an operator credential. Run `credentials list` first, reuse beats creating.',
+    hint: 'Returned credential is shown ONCE. Store it securely, there is no recovery flow.',
     options: z.object({
       label: z.string().optional().describe('Label for the credential (e.g., "claude-code")'),
       ttlDays: z.coerce.number().optional().describe('Time to live in days (default 1, max 365)'),
@@ -1008,7 +1008,7 @@ export function buildCli() {
   // ── passport group (AgentScore identity, browser-redirect login) ────────────
   const passport = Cli.create('passport', {
     description:
-      'AgentScore Passport — buyer-side identity (KYC + verified facts). Stores a 24h access token + 90d refresh credential locally; auto-attached to merchant requests on settle. Pay rotates the access token silently in the background — the user re-verifies in browser only when the refresh credential also expires (~90 days).',
+      'AgentScore Passport, buyer-side identity (KYC + verified facts). Stores a 24h access token + 90d refresh credential locally; auto-attached to merchant requests on settle. Pay rotates the access token silently in the background, the user re-verifies in browser only when the refresh credential also expires (~90 days).',
   });
   passport.command('login', {
     description:
@@ -1019,7 +1019,7 @@ export function buildCli() {
       timeoutSeconds: z.coerce.number().optional().describe('Polling timeout (default 3600s)'),
     }),
     examples: [
-      { description: 'Cold-start login — opens verify URL, polls until verified' },
+      { description: 'Cold-start login, opens verify URL, polls until verified' },
     ],
     run(c) {
       return withCliErrors(async () => {
@@ -1038,7 +1038,7 @@ export function buildCli() {
           cta: {
             description: 'Passport active. Next steps:',
             commands: [
-              { command: 'pay', description: 'Make a payment — pay auto-attaches X-Operator-Token to merchant requests' },
+              { command: 'pay', description: 'Make a payment, pay auto-attaches X-Operator-Token to merchant requests' },
               { command: 'passport status', description: 'View verified facts + expiry at any time' },
             ],
           },
@@ -1047,7 +1047,7 @@ export function buildCli() {
     },
   });
   passport.command('status', {
-    description: 'Show stored AgentScore Passport — token prefix, access-token expiry, refresh availability, and days until the user has to re-verify in browser.',
+    description: 'Show stored AgentScore Passport, token prefix, access-token expiry, refresh availability, and days until the user has to re-verify in browser.',
     options: z.object({}),
     run(c) {
       return withCliErrors(async () => {
@@ -1079,10 +1079,10 @@ export function buildCli() {
   // ── associate-wallet ────────────────────────────────────────────────────────
   cli.command('associate-wallet', {
     description:
-      'Report a wallet that paid under an operator credential — builds the cross-merchant credential↔wallet attribution profile. Fire-and-forget.',
+      'Report a wallet that paid under an operator credential, builds the cross-merchant credential↔wallet attribution profile. Fire-and-forget.',
     options: z.object({
       operatorToken: z.string().describe('Operator credential (opc_...) the agent paid under'),
-      walletAddress: z.string().describe('Wallet that signed the payment — EVM (0x...) or Solana (base58)'),
+      walletAddress: z.string().describe('Wallet that signed the payment, EVM (0x...) or Solana (base58)'),
       network: z.enum(['evm', 'solana']).describe('Network family'),
       idempotencyKey: z.string().optional().describe('Stable per-payment key (PI id, x402 tx hash, etc.)'),
       apiKey: apiKeyOpt,
@@ -1117,7 +1117,7 @@ export function buildCli() {
           cta: {
             description: 'Golden path:',
             commands: [
-              { command: 'init', description: 'First-run setup — create wallets on every chain' },
+              { command: 'init', description: 'First-run setup, create wallets on every chain' },
               { command: 'check', description: 'Probe a 402-gated URL to see accepted rails + price' },
               { command: 'pay', options: { dryRun: true, maxSpend: true }, description: 'Dry-run a payment, then drop --dry-run to settle' },
             ],
@@ -1139,7 +1139,7 @@ export interface ServeCliOptions {
 /**
  * Wraps `cli.serve` to enrich the wire envelope on CliError-driven failures.
  *
- * incur's error renderer surfaces only `code`, `message`, and `retryable` —
+ * incur's error renderer surfaces only `code`, `message`, and `retryable`,
  * `extra` and `nextSteps` from CliError are silently discarded. We capture
  * the originating CliError in `pendingError`, let incur run, then if a
  * CliError fired we discard incur's error output and re-emit our own
@@ -1193,7 +1193,7 @@ export async function serveCli(
     // of its own output (token count, byte slice). Enrichment would replace
     // that rendering with a synthesized envelope, breaking the agent's
     // expectation that `--token-count` returns a number and `--token-limit`
-    // returns a truncated slice. Pass through verbatim — incur already
+    // returns a truncated slice. Pass through verbatim, incur already
     // applied the correct treatment to its error rendering.
     const tokenFlag =
       effectiveArgv.includes('--token-count') ||
@@ -1201,7 +1201,7 @@ export async function serveCli(
       effectiveArgv.includes('--token-offset');
 
     // Human-TTY context (interactive terminal, no explicit format/full-output):
-    // preserve incur's `formatHumanError` rendering — the friendly one-line
+    // preserve incur's `formatHumanError` rendering, the friendly one-line
     // `Error (code): message` shape humans expect at a terminal. Enrichment
     // here would replace it with a multi-line TOON dump, which is a regression
     // for humans without giving them anything they need (extras are for
diff --git a/src/commands/agent-guide.ts b/src/commands/agent-guide.ts
index 38f707a..6dce53c 100644
--- a/src/commands/agent-guide.ts
+++ b/src/commands/agent-guide.ts
@@ -1,8 +1,8 @@
 /**
- * `agent-guide` — structured how-to-use guidance for LLM agents wiring pay into a tool loop.
+ * `agent-guide`, structured how-to-use guidance for LLM agents wiring pay into a tool loop.
  *
  * Plain text in TTY mode (human/agent reads it line-by-line), structured JSON in `--json` mode
- * (programmatic parsing — agents that prefer JSON can ingest the same content).
+ * (programmatic parsing, agents that prefer JSON can ingest the same content).
  */
 interface GuideStep {
   step: string;
@@ -23,11 +23,11 @@ interface ErrorEnvelopeContract {
   shape: {
     code: 'machine-readable error code (e.g. config_error, no_wallet, multi_rail_candidates)';
     message: 'human-readable error message';
-    retryable: 'boolean — true for transient codes (network_error, rpc_error, session_timeout)';
+    retryable: 'boolean, true for transient codes (network_error, rpc_error, session_timeout)';
     extra: 'optional object with structured recovery context per error code (e.g. valid_keys, chain, held_chains, balance_usdc, verify_url, session_id, poll_secret)';
-    next_steps: 'optional { action: string, suggestion?: string } — deterministic recovery action slug + optional human-readable suggestion';
+    next_steps: 'optional { action: string, suggestion?: string }, deterministic recovery action slug + optional human-readable suggestion';
   };
-  full_output_shape: 'with --full-output, the wire envelope is { ok: false, error: {...}, meta: { command, duration } } — fields above nest under `error`';
+  full_output_shape: 'with --full-output, the wire envelope is { ok: false, error: {...}, meta: { command, duration } }, fields above nest under `error`';
   human_tty_shape: 'when stdout is a TTY and no --format/--json/--full-output is set, errors render as a friendly one-liner: `Error (code): message` (no extras, no next_steps). Pass --json or pipe to get the structured envelope.';
 }
 
@@ -58,7 +58,7 @@ const GUIDE: AgentGuide = {
       why: 'Creates the AES-encrypted keystore + a wallet on each chain (base, solana, tempo). Skip if the wallet already exists at ~/.agentscore.',
       command_example: 'agentscore-pay init --json',
       notes: [
-        'Without a wallet pay cannot sign payments. `init` is idempotent — safe to call repeatedly; it skips chains that already have a keystore.',
+        'Without a wallet pay cannot sign payments. `init` is idempotent, safe to call repeatedly; it skips chains that already have a keystore.',
         'Set AGENTSCORE_PAY_PASSPHRASE in env to skip the interactive passphrase prompt during agent runs.',
       ],
     },
@@ -68,15 +68,15 @@ const GUIDE: AgentGuide = {
       command_example: 'agentscore-pay passport login --json',
       notes: [
         'No API key required. ~30 seconds in browser. No money needed for this step.',
-        'Token lifecycle: access token = 24h (auto-rotated via the refresh_token, which is 90d). Pay refreshes silently on the next call after access expires — no agent action required. Re-verify in browser is needed only when both have expired, i.e. when the agent has been offline for ~90 days.',
-'If you skip step 1 and a merchant 403 mid-purchase forces inline bootstrap from a merchant-supplied session (verify_url + session_id + poll_secret in the 403 body), the resulting Passport carries an access token but no refresh_token — that path re-verifies after 24h. Bootstrap-from-stored-expiry (pay falling through to `passport login` after a fully-expired stored Passport) still mints a refresh-bearing pair. Doing `passport login` first up front avoids both edge cases and gets the 90-day silent-refresh UX.',
+        'Token lifecycle: access token = 24h (auto-rotated via the refresh_token, which is 90d). Pay refreshes silently on the next call after access expires, no agent action required. Re-verify in browser is needed only when both have expired, i.e. when the agent has been offline for ~90 days.',
+'If you skip step 1 and a merchant 403 mid-purchase forces inline bootstrap from a merchant-supplied session (verify_url + session_id + poll_secret in the 403 body), the resulting Passport carries an access token but no refresh_token, that path re-verifies after 24h. Bootstrap-from-stored-expiry (pay falling through to `passport login` after a fully-expired stored Passport) still mints a refresh-bearing pair. Doing `passport login` first up front avoids both edge cases and gets the 90-day silent-refresh UX.',
         'Caller-supplied `-H "X-Operator-Token: ..."` always wins over the stored Passport. Use `--skip-passport` for explicit-anonymous traffic.',
-        'When pay needs to re-verify (refresh failed AND access expired): in a non-TTY context (agent, --json, MCP, scripted) pay throws `code: passport_login_required` with `next_steps.action: passport_login` immediately rather than blocking on a browser flow. Run `agentscore-pay passport login` interactively to mint a fresh pair, then re-run the original command. In a human TTY, pay drives the inline browser-redirect flow itself and prints `Open this URL to renew:` on stderr — surface the URL verbatim if you proxy it; do not fabricate one.',
+        'When pay needs to re-verify (refresh failed AND access expired): in a non-TTY context (agent, --json, MCP, scripted) pay throws `code: passport_login_required` with `next_steps.action: passport_login` immediately rather than blocking on a browser flow. Run `agentscore-pay passport login` interactively to mint a fresh pair, then re-run the original command. In a human TTY, pay drives the inline browser-redirect flow itself and prints `Open this URL to renew:` on stderr, surface the URL verbatim if you proxy it; do not fabricate one.',
       ],
     },
     {
       step: '2. (Optional) Discover merchants with `discover`',
-      why: 'Lists x402/MPP services from the x402 Bazaar (Coinbase) + MPP services directory (Tempo) — works against any merchant, AgentScore-gated or not.',
+      why: 'Lists x402/MPP services from the x402 Bazaar (Coinbase) + MPP services directory (Tempo), works against any merchant, AgentScore-gated or not.',
       command_example: 'agentscore-pay discover --json',
       notes: [
         'Use --search, --chain, --max-price, --protocol to narrow. Returns rail metadata (network, payTo, asset, price) per service.',
@@ -85,12 +85,12 @@ const GUIDE: AgentGuide = {
     },
     {
       step: '3. Confirm funds with `balance`',
-      why: 'Pay rejects with exit code 3 when the chosen chain has insufficient USDC. Check first to avoid wasted round-trips. Each row also surfaces the wallet\'s native-gas balance (ETH on Base, the Tempo native token on Tempo, SOL on Solana) — needed for raw on-chain operations like `send` and `revoke`.',
+      why: 'Pay rejects with exit code 3 when the chosen chain has insufficient USDC. Check first to avoid wasted round-trips. Each row also surfaces the wallet\'s native-gas balance (ETH on Base, the Tempo native token on Tempo, SOL on Solana), needed for raw on-chain operations like `send` and `revoke`.',
       command_example: 'agentscore-pay balance --json',
       notes: [
         'Pass --network testnet to check testnet balances (Base Sepolia, Solana devnet, Tempo testnet).',
         'If a chain is empty, run `agentscore-pay fund --chain <chain>` for a receive QR (mainnet) or testnet faucet/programmatic mint.',
-        'Each row includes `usdc`, `native` (gas balance), and `native_symbol`. x402/MPP payments are gasless from the agent perspective; `send` and `revoke` are not — they need a non-zero `native` balance to write on-chain.',
+        'Each row includes `usdc`, `native` (gas balance), and `native_symbol`. x402/MPP payments are gasless from the agent perspective; `send` and `revoke` are not, they need a non-zero `native` balance to write on-chain.',
       ],
     },
     {
@@ -98,13 +98,13 @@ const GUIDE: AgentGuide = {
       why: 'Confirms the merchant returns a 402, parses the accepted rails + price, and tells you which chain you should pay from. No funds move.',
       command_example: 'agentscore-pay check <URL> -X POST -d \'{"key":"value"}\' --json',
       notes: [
-        'Use the same HTTP method + body you intend to use for the paid request. Most paid endpoints require POST + JSON body — a GET probe will return 404/405 from those merchants.',
-        'pay sets `Content-Type: application/json` automatically when -d is present. DO NOT also pass `-H \'content-type: application/json\'` — that is redundant. Pay dedupes case-insensitively but the cleanest invocation omits the redundant header.',
+        'Use the same HTTP method + body you intend to use for the paid request. Most paid endpoints require POST + JSON body, a GET probe will return 404/405 from those merchants.',
+        'pay sets `Content-Type: application/json` automatically when -d is present. DO NOT also pass `-H \'content-type: application/json\'`, that is redundant. Pay dedupes case-insensitively but the cleanest invocation omits the redundant header.',
       ],
     },
     {
       step: '5. Dry-run the payment before paying real money',
-      why: 'Shows the rail pay would select, the signer wallet, the balance, and the body it would send — without signing or sending. Catches misconfigurations cheaply.',
+      why: 'Shows the rail pay would select, the signer wallet, the balance, and the body it would send, without signing or sending. Catches misconfigurations cheaply.',
       command_example: 'agentscore-pay pay POST <URL> -d \'{...}\' --chain <base|solana|tempo> --max-spend 0.05 --dry-run --json',
       notes: [
         'Always pass --max-spend with a reasonable upper bound. pay rejects payments above this USD amount with exit code 4.',
@@ -117,7 +117,7 @@ const GUIDE: AgentGuide = {
       command_example: 'agentscore-pay pay POST <URL> -d \'{...}\' --chain <chain> --max-spend 0.05 --json',
       notes: [
         'On success, pay prints the merchant\'s response body to stdout. In --json mode you also get tx hash, settlement details, and merchant headers (e.g. payment-response).',
-        'Exit code 0 = success. Non-zero codes are listed below — agents should branch on them.',
+        'Exit code 0 = success. Non-zero codes are listed below, agents should branch on them.',
         'Tunables: `--timeout <s>` aborts the merchant request after N seconds (default 60). `--retries <n>` retries transient network errors (default 0; per-scheme nonces prevent double-spend).',
       ],
     },
@@ -125,11 +125,11 @@ const GUIDE: AgentGuide = {
 
   testnet_path: [
     {
-      step: 'Develop against testnets first — same code path, no real money',
-      why: 'Every command accepts `--network testnet`. The wallet has separate testnet balances per chain (Base Sepolia, Solana devnet, Tempo testnet — chain id 42431). Pay routes to the correct facilitator + RPC automatically based on --network.',
+      step: 'Develop against testnets first, same code path, no real money',
+      why: 'Every command accepts `--network testnet`. The wallet has separate testnet balances per chain (Base Sepolia, Solana devnet, Tempo testnet, chain id 42431). Pay routes to the correct facilitator + RPC automatically based on --network.',
       command_example: 'agentscore-pay pay POST <URL> --chain base --network testnet -d \'{...}\' --max-spend 1 --json',
       notes: [
-        'Mainnet is the default for every command. Pass `--network testnet` to switch (or `agentscore-pay config set preferred-chains` does NOT cover network — pass per-call).',
+        'Mainnet is the default for every command. Pass `--network testnet` to switch (or `agentscore-pay config set preferred-chains` does NOT cover network, pass per-call).',
         'Testnet endpoints are scarce in the public bazaar today. Most production merchants only run on mainnet. Stand up your own `@agent-score/commerce` or `x402` server in testnet mode for end-to-end smoke.',
       ],
     },
@@ -138,7 +138,7 @@ const GUIDE: AgentGuide = {
   funding: [
     {
       step: 'Get TESTNET USDC for free with `faucet`',
-      why: 'Tempo testnet supports programmatic minting via `tempo_fundAddress` JSON-RPC — no signup, immediate. Base Sepolia + Solana devnet point you at the standard faucet URLs (and copy the address to clipboard).',
+      why: 'Tempo testnet supports programmatic minting via `tempo_fundAddress` JSON-RPC, no signup, immediate. Base Sepolia + Solana devnet point you at the standard faucet URLs (and copy the address to clipboard).',
       command_example: 'agentscore-pay faucet --chain tempo --network testnet --json',
       notes: [
         'Tempo testnet: pay calls the RPC and your wallet is funded in seconds. No browser visit needed.',
@@ -146,13 +146,13 @@ const GUIDE: AgentGuide = {
       ],
     },
     {
-      step: 'Get MAINNET USDC with `fund` (external wallet — default)',
+      step: 'Get MAINNET USDC with `fund` (external wallet, default)',
       why: '`fund` prints a receive QR for the wallet address and polls balance until USDC lands. The user funds from any source they prefer (CEX withdrawal, another wallet, fiat onramp). Works on every chain.',
       command_example: 'agentscore-pay fund --chain base --json',
       notes: [
-        'Tempo TESTNET via `fund` calls the same programmatic mint as `faucet` — free, immediate, no browser. `fund --chain tempo --network testnet` works without prompts.',
-        'All mainnet networks behave the same: receive QR + balance poll. The user picks the funding source — CEX, another wallet, or any third-party onramp that supports the destination chain.',
-        'Use `fund-estimate <URL>` to compute "how many calls does my current balance cover for this merchant" — useful before deciding whether to top up.',
+        'Tempo TESTNET via `fund` calls the same programmatic mint as `faucet`, free, immediate, no browser. `fund --chain tempo --network testnet` works without prompts.',
+        'All mainnet networks behave the same: receive QR + balance poll. The user picks the funding source, CEX, another wallet, or any third-party onramp that supports the destination chain.',
+        'Use `fund-estimate <URL>` to compute "how many calls does my current balance cover for this merchant", useful before deciding whether to top up.',
       ],
     },
     {
@@ -160,7 +160,7 @@ const GUIDE: AgentGuide = {
       why: '`fund --via stripe-onramp --quote-only --amount <USD>` returns the destination USDC amount + network/transaction fees + source-total (USD inclusive of fees) WITHOUT minting a session. Use to show the user the real cost before they decide.',
       command_example: 'agentscore-pay fund --chain base --via stripe-onramp --amount 25 --quote-only --json',
       notes: [
-        'Read-only call — no Stripe session is minted, no wallet binding occurs. Safe to call repeatedly.',
+        'Read-only call, no Stripe session is minted, no wallet binding occurs. Safe to call repeatedly.',
         'No passport login required (quotes are public Stripe pricing). Returns `status: "quote_only"` + a `quote` object containing destination_amount, source_total_amount, network_fee_monetary, transaction_fee_monetary.',
         'Then run the same command WITHOUT --quote-only to mint the session and start the onramp flow.',
       ],
@@ -171,10 +171,10 @@ const GUIDE: AgentGuide = {
       command_example: 'agentscore-pay fund --chain base --via stripe-onramp --amount 25 --json',
       notes: [
         'BASE + SOLANA mainnet only (Stripe Crypto Onramp coverage). Tempo + all testnets fall back to the default external-wallet flow.',
-        'US + EU buyers only. Outside those regions, the API returns `region_not_supported` with `agent_instructions.action: use_alternative_funding_method` — switch to default `fund` (no --via).',
-        'pay NEVER auto-opens a browser. The CLI emits `onramp_session_created` on stderr with the hosted `crypto.link.com` URL; the user clicks/scans it. Agents must NOT pick this method on the user\'s behalf without consent — surface the option (ideally after `--quote-only`), let the user choose.',
+        'US + EU buyers only. Outside those regions, the API returns `region_not_supported` with `agent_instructions.action: use_alternative_funding_method`, switch to default `fund` (no --via).',
+        'pay NEVER auto-opens a browser. The CLI emits `onramp_session_created` on stderr with the hosted `crypto.link.com` URL; the user clicks/scans it. Agents must NOT pick this method on the user\'s behalf without consent, surface the option (ideally after `--quote-only`), let the user choose.',
         'Stripe collects KYC fresh per session for first-time users; Stripe Link short-circuits for returning buyers (opaque to pay).',
-        'Requires a prior `agentscore-pay passport login` — the API resolves the session to the agent\'s account via the stored operator_token.',
+        'Requires a prior `agentscore-pay passport login`, the API resolves the session to the agent\'s account via the stored operator_token.',
       ],
     },
   ],
@@ -182,7 +182,7 @@ const GUIDE: AgentGuide = {
   auxiliary: [
     {
       step: 'Raw transfer to an arbitrary address with `send`',
-      why: 'Different from `pay <url>` — no merchant, no 402 handshake, just an on-chain transfer from the local wallet to the destination. Default `--asset usdc` sends USDC (ERC20 on Base/Tempo, SPL on Solana). `--asset native` sends gas tokens (ETH on Base, TEMPO on Tempo, SOL on Solana). Works on mainnet AND testnets (pass `--network testnet`).',
+      why: 'Different from `pay <url>`, no merchant, no 402 handshake, just an on-chain transfer from the local wallet to the destination. Default `--asset usdc` sends USDC (ERC20 on Base/Tempo, SPL on Solana). `--asset native` sends gas tokens (ETH on Base, TEMPO on Tempo, SOL on Solana). Works on mainnet AND testnets (pass `--network testnet`).',
       command_example: 'agentscore-pay send --chain base --to 0xRecipient --amount 5 --json',
       notes: [
         'Requires native gas in the signer wallet for BOTH flavors: gas pays the on-chain write itself, regardless of which asset is being transferred. x402/MPP payments are gasless from the agent perspective; raw transfers are not.',
@@ -214,23 +214,23 @@ const GUIDE: AgentGuide = {
     },
     {
       step: 'Inspect full wallet state with `whoami`',
-      why: 'Single call returns wallets per chain, balances, and active config preferences in one JSON payload — useful for an agent to ground itself before deciding what to do next.',
+      why: 'Single call returns wallets per chain, balances, and active config preferences in one JSON payload, useful for an agent to ground itself before deciding what to do next.',
       command_example: 'agentscore-pay whoami --json',
     },
     {
       step: 'Audit past payments with `history`',
-      why: 'Every successful pay call appends to ~/.agentscore/history.jsonl. `history --json` returns timestamp, chain, signer, url, status, price, tx_hash — useful for retro/debug or surfacing "this merchant was already paid".',
+      why: 'Every successful pay call appends to ~/.agentscore/history.jsonl. `history --json` returns timestamp, chain, signer, url, status, price, tx_hash, useful for retro/debug or surfacing "this merchant was already paid".',
       command_example: 'agentscore-pay history --json --limit 20',
     },
     {
       step: 'Inspect / renew the stored Passport with `passport status` / `passport login`',
-      why: 'After the initial `passport login` (golden-path step 1), most flows are zero-touch — silent refresh keeps the token fresh. Use `passport status` to inspect what\'s saved; re-run `passport login` only when the agent has been offline beyond the refresh window (i.e. when `silent_refresh_available` is false).',
+      why: 'After the initial `passport login` (golden-path step 1), most flows are zero-touch, silent refresh keeps the token fresh. Use `passport status` to inspect what\'s saved; re-run `passport login` only when the agent has been offline beyond the refresh window (i.e. when `silent_refresh_available` is false).',
       command_example: 'agentscore-pay passport status --json',
       notes: [
-        '`passport status` returns `{ authenticated, operator_token_prefix, expires_at, expires_in_days, expired, silent_refresh_available, refresh_expires_at, refresh_expires_in_days }`. The access fields (`expires_*`) are short-lived (~24h) and rotate silently; do not surface "expires in 0 days" to the user as an actionable warning. The refresh fields (`refresh_expires_*`) are the meaningful re-verify horizon — that\'s when the user actually has to do something.',
+        '`passport status` returns `{ authenticated, operator_token_prefix, expires_at, expires_in_days, expired, silent_refresh_available, refresh_expires_at, refresh_expires_in_days }`. The access fields (`expires_*`) are short-lived (~24h) and rotate silently; do not surface "expires in 0 days" to the user as an actionable warning. The refresh fields (`refresh_expires_*`) are the meaningful re-verify horizon, that\'s when the user actually has to do something.',
         '`silent_refresh_available: true` means pay will rotate the access token automatically on the next call when it expires; agent has nothing to do. `silent_refresh_available: false` (legacy passport, or merchant-mint cold-start without refresh_token) means the next access expiry forces a verify-URL prompt.',
         'Caller-supplied `-H "X-Operator-Token: ..."` always wins over the stored Passport, so existing scripts keep working.',
-        'Non-AgentScore merchants ignore the header — auto-attach is harmless on those endpoints.',
+        'Non-AgentScore merchants ignore the header, auto-attach is harmless on those endpoints.',
         'Use `--skip-passport` on `agentscore-pay <url>` for explicit-anonymous traffic.',
       ],
     },
@@ -239,11 +239,11 @@ const GUIDE: AgentGuide = {
   pitfalls: [
     {
       step: 'Pitfall: passing -H \'content-type: ...\' alongside -d',
-      why: 'Historically caused duplicated Content-Type headers (`application/json, application/json`), which strict body-parsers reject as malformed. Now deduped case-insensitively, but the cleanest invocation just omits the redundant header — pay sets it for you.',
+      why: 'Historically caused duplicated Content-Type headers (`application/json, application/json`), which strict body-parsers reject as malformed. Now deduped case-insensitively, but the cleanest invocation just omits the redundant header, pay sets it for you.',
     },
     {
       step: 'Pitfall: probing with GET when the merchant requires POST',
-      why: 'Many MPP/x402 merchants only respond with 402 to the same method + body shape they expect for paid traffic. A bare GET on a POST-only endpoint returns 404/405, looking like "no payment required" — but the endpoint really is paid.',
+      why: 'Many MPP/x402 merchants only respond with 402 to the same method + body shape they expect for paid traffic. A bare GET on a POST-only endpoint returns 404/405, looking like "no payment required", but the endpoint really is paid.',
     },
     {
       step: 'Pitfall: skipping --max-spend',
@@ -255,7 +255,7 @@ const GUIDE: AgentGuide = {
     },
     {
       step: 'Pitfall: assuming non-spec-compliant 402 bodies will parse',
-      why: 'A few merchants return 402 with custom JSON shapes that omit standard `accepts[]` / `WWW-Authenticate`. `check` reports 402 detected but rails not parsed — pay cannot construct a payment without the rail metadata. File an issue with the merchant.',
+      why: 'A few merchants return 402 with custom JSON shapes that omit standard `accepts[]` / `WWW-Authenticate`. `check` reports 402 detected but rails not parsed, pay cannot construct a payment without the rail metadata. File an issue with the merchant.',
     },
   ],
 
@@ -274,28 +274,28 @@ const GUIDE: AgentGuide = {
         'Merchant returned a 403 with bootstrap fields (verify_url + session_id + poll_secret) and the agent has no usable stored Passport. Only thrown in non-TTY contexts; a human TTY drives the inline browser flow instead. Symmetric to passport_login_required but covers the cold-start case where the agent never logged in to begin with.',
       next_action: 'passport_login',
       recovery:
-        'Recommended: run `agentscore-pay passport login` first — mints a portable refresh-bearing Passport that satisfies any AgentScore-gated merchant going forward, no per-merchant re-verify. Alternative: surface `extra.verify_url` to the user verbatim; completing it issues a one-shot 24h token tied to that merchant\'s session (no refresh_token, so the next AgentScore-gated merchant will hit the same flow again).',
+        'Recommended: run `agentscore-pay passport login` first, mints a portable refresh-bearing Passport that satisfies any AgentScore-gated merchant going forward, no per-merchant re-verify. Alternative: surface `extra.verify_url` to the user verbatim; completing it issues a one-shot 24h token tied to that merchant\'s session (no refresh_token, so the next AgentScore-gated merchant will hit the same flow again).',
     },
     {
       cli_code: 'config_error',
       thrown_when:
         'AGENTSCORE_API_KEY missing (getClient throws directly with action=set_api_key); OR API key invalid/expired (generic 401 → action=check_api_key); OR operator_token expired/revoked (TokenExpiredError → action=reauth, exposes verify_url + session_id + poll_secret in extra); OR operator_token unrecognized (InvalidCredentialError → action=switch_token_or_restart_session).',
-      next_action: 'See envelope.next_steps.action — set_api_key / check_api_key / reauth / switch_token_or_restart_session',
+      next_action: 'See envelope.next_steps.action, set_api_key / check_api_key / reauth / switch_token_or_restart_session',
       recovery:
         'For reauth: run `agentscore-pay passport login` to mint a fresh operator_token (no API key needed), or use the verify_url + session_id + poll_secret from extra to drive the verify/poll flow manually. For switch_token_or_restart_session: use a different stored operator_token, or run `passport login`. For check_api_key / set_api_key: confirm AGENTSCORE_API_KEY is valid and set in env; key issues will not reauth-fix via passport.',
     },
     {
       cli_code: 'insufficient_balance',
-      thrown_when: 'PaymentRequiredError — the requested endpoint is not enabled for the API key\'s account (HTTP 402).',
+      thrown_when: 'PaymentRequiredError, the requested endpoint is not enabled for the API key\'s account (HTTP 402).',
       next_action: 'upgrade_plan',
-      recovery: 'Surface the suggestion to the user. See https://www.agentscore.com/pricing — agent retry will not fix this.',
+      recovery: 'Surface the suggestion to the user. See https://www.agentscore.com/pricing, agent retry will not fix this.',
     },
     {
       cli_code: 'quota_exceeded',
-      thrown_when: 'QuotaExceededError — account-level cap hit (HTTP 429 quota_exceeded).',
+      thrown_when: 'QuotaExceededError, account-level cap hit (HTTP 429 quota_exceeded).',
       next_action: 'upgrade_plan',
       recovery:
-        'Do NOT retry — agent retry will not fix this. Surface to the user with https://www.agentscore.com/pricing. Use AssessResponse.quota on success responses to monitor approach-to-cap proactively (warn at 80%, alert at 95%) before hitting this state.',
+        'Do NOT retry, agent retry will not fix this. Surface to the user with https://www.agentscore.com/pricing. Use AssessResponse.quota on success responses to monitor approach-to-cap proactively (warn at 80%, alert at 95%) before hitting this state.',
     },
     {
       cli_code: 'network_error',
@@ -303,7 +303,7 @@ const GUIDE: AgentGuide = {
         'RateLimitedError (per-second cap, HTTP 429 rate_limited), TimeoutError (request timed out), or generic httpx.HTTPError (DNS / network / 5xx) wrapped by the SDK.',
       next_action: 'retry_with_backoff',
       recovery:
-        'Retry once with backoff (5–30s typical, longer if Retry-After header was present). If sustained, surface to user with AgentScore\'s status page or support contact — pay calls api.agentscore.com directly, no merchant in the loop here.',
+        'Retry once with backoff (5–30s typical, longer if Retry-After header was present). If sustained, surface to user with AgentScore\'s status page or support contact, pay calls api.agentscore.com directly, no merchant in the loop here.',
     },
     {
       cli_code: 'merchant_error',
@@ -320,12 +320,12 @@ const GUIDE: AgentGuide = {
     shape: {
       code: 'machine-readable error code (e.g. config_error, no_wallet, multi_rail_candidates)',
       message: 'human-readable error message',
-      retryable: 'boolean — true for transient codes (network_error, rpc_error, session_timeout)',
+      retryable: 'boolean, true for transient codes (network_error, rpc_error, session_timeout)',
       extra: 'optional object with structured recovery context per error code (e.g. valid_keys, chain, held_chains, balance_usdc, verify_url, session_id, poll_secret)',
-      next_steps: 'optional { action: string, suggestion?: string } — deterministic recovery action slug + optional human-readable suggestion',
+      next_steps: 'optional { action: string, suggestion?: string }, deterministic recovery action slug + optional human-readable suggestion',
     },
     full_output_shape:
-      'with --full-output, the wire envelope is { ok: false, error: {...}, meta: { command, duration } } — fields above nest under `error`',
+      'with --full-output, the wire envelope is { ok: false, error: {...}, meta: { command, duration } }, fields above nest under `error`',
     human_tty_shape:
       'when stdout is a TTY and no --format/--json/--full-output is set, errors render as a friendly one-liner: `Error (code): message` (no extras, no next_steps). Pass --json or pipe to get the structured envelope.',
   },
@@ -342,7 +342,7 @@ const GUIDE: AgentGuide = {
   json_mode:
     'Every command emits structured data. Pass --json (or --format json/yaml/md/jsonl) to lock the format; ' +
     'TOON is the default in non-TTY (agent) contexts (token-efficient). Errors emit `{code, message, retryable, extra?, next_steps?}` ' +
-    'on stdout (same channel as success — branch on `code` presence). Use --filter-output for dot-path pruning, ' +
+    'on stdout (same channel as success, branch on `code` presence). Use --filter-output for dot-path pruning, ' +
     '--token-limit/--token-offset for paginated output, --full-output for the full envelope, and `agentscore-pay --mcp` to expose every command as MCP tools over stdio.',
 };
 
diff --git a/src/commands/check.ts b/src/commands/check.ts
index 77482ee..de2c118 100644
--- a/src/commands/check.ts
+++ b/src/commands/check.ts
@@ -59,7 +59,7 @@ function normalizeX402(body: unknown): RailSummary[] {
   return accepts.map((a) => {
     const chain = chainFromNetworkId(a.network);
     // x402 v1 uses `maxAmountRequired`; v2 uses `amount`. Decimals is never carried
-    // at the top level — extra.decimals is best-effort, otherwise canonical USDC = 6,
+    // at the top level, extra.decimals is best-effort, otherwise canonical USDC = 6,
     // unknown asset = leave price_usd undefined rather than displaying a wrong value.
     const declaredDecimals = a.extra?.decimals;
     const decimals = declaredDecimals ?? (chain && isKnownUSDC(a.asset, chain) ? 6 : null);
diff --git a/src/commands/fund.ts b/src/commands/fund.ts
index c0b83eb..48d67d8 100644
--- a/src/commands/fund.ts
+++ b/src/commands/fund.ts
@@ -189,7 +189,7 @@ export async function fund(input: FundInput): Promise<FundResult> {
       const seconds = POLL_INTERVAL_MS / 1000;
       process.stderr.write(
         `\nOpen Stripe Crypto Onramp in your browser:\n  ${session.hosted_url}\n\n${ascii}\n` +
-          `Polling ${input.chain} balance every ${seconds}s (timeout ${minutes}m). The CLI does NOT auto-open the browser — click or scan the URL above to start the onramp flow.\n\n`,
+          `Polling ${input.chain} balance every ${seconds}s (timeout ${minutes}m). The CLI does NOT auto-open the browser, click or scan the URL above to start the onramp flow.\n\n`,
       );
     }
 
diff --git a/src/commands/identity.ts b/src/commands/identity.ts
index e7e55ce..3278f45 100644
--- a/src/commands/identity.ts
+++ b/src/commands/identity.ts
@@ -79,7 +79,7 @@ function wrapApiError(err: unknown): never {
     throw new CliError('quota_exceeded', 'AgentScore account quota exceeded.', {
       nextSteps: {
         action: 'upgrade_plan',
-        suggestion: 'Your account has reached its cap. Surface to the user — agent retry will not fix this. See https://www.agentscore.com/pricing.',
+        suggestion: 'Your account has reached its cap. Surface to the user, agent retry will not fix this. See https://www.agentscore.com/pricing.',
       },
       extra: { code: err.code, status: err.status },
     });
@@ -97,7 +97,7 @@ function wrapApiError(err: unknown): never {
     });
   }
   if (err instanceof AgentScoreError) {
-    // 401 with no specific subclass (rare — most 401s subclass to TokenExpiredError or
+    // 401 with no specific subclass (rare, most 401s subclass to TokenExpiredError or
     // InvalidCredentialError above). Treat as auth-config issue.
     if (err.status === 401) {
       throw new CliError('config_error', `AgentScore auth error: ${err.message}`, {
diff --git a/src/commands/passport.ts b/src/commands/passport.ts
index 1a29326..ebf02a3 100644
--- a/src/commands/passport.ts
+++ b/src/commands/passport.ts
@@ -12,7 +12,7 @@ export interface PassportLoginInput {
   baseUrl?: string;
   /** Override fetch (testing). */
   fetch?: typeof globalThis.fetch;
-  /** Hook invoked once with the verify URL — terminal prints it for the user. */
+  /** Hook invoked once with the verify URL, terminal prints it for the user. */
   onVerifyUrl?: (verifyUrl: string) => void;
   /** Hook invoked on each poll iteration. */
   onPoll?: (info: { attempt: number; status: string }) => void;
@@ -27,7 +27,7 @@ export interface PassportLoginOutput {
   expires_in_days: number;
   /** Whether the passport has a refresh_token (i.e. silent refresh is available). */
   silent_refresh_available: boolean;
-  /** Refresh-token expiry — when the user actually has to re-verify in browser. Absent for legacy / merchant-mint passports. */
+  /** Refresh-token expiry, when the user actually has to re-verify in browser. Absent for legacy / merchant-mint passports. */
   refresh_expires_at?: string;
   /** Days until the user has to re-verify in browser. Absent when refresh isn't available. */
   refresh_expires_in_days?: number;
diff --git a/src/commands/pay.ts b/src/commands/pay.ts
index e5f1f7e..726c3f5 100644
--- a/src/commands/pay.ts
+++ b/src/commands/pay.ts
@@ -28,7 +28,7 @@ type IdentityMode = 'auto' | 'operator' | 'wallet';
 /** Parse a URL into the RFC 9421 covered components an AIT signature binds. Exported for tests. */
 export function requestDescriptor(url: string, method: string): AipRequestDescriptor {
   const u = new URL(url);
-  // RFC 9421 @path is the absolute path ONLY — the query string is the separate @query component,
+  // RFC 9421 @path is the absolute path ONLY, the query string is the separate @query component,
   // which AIP's minimum covered set omits. The verifier reconstructs @path as pathname (query
   // stripped), so signing pathname+search would make PoP fail for every query-bearing URL.
   return { method: method.toUpperCase(), authority: u.host, path: u.pathname };
@@ -162,7 +162,7 @@ export async function pay(input: PayInput): Promise<PayResult> {
         },
       );
     }
-    process.stderr.write('Stored Passport has expired — re-verifying (KYC stays valid, this is a one-click renewal)...\n');
+    process.stderr.write('Stored Passport has expired, re-verifying (KYC stays valid, this is a one-click renewal)...\n');
     let printedVerifyUrl = false;
     const renewal = await bootstrapFromExpiry({
       onVerifyUrl: (verifyUrl) => {
@@ -182,12 +182,12 @@ export async function pay(input: PayInput): Promise<PayResult> {
   }
 
   // `--identity operator` is an explicit choice of the operator_token model. With no caller
-  // token and no attached Passport, fail fast — silently downgrading to the wallet header would
+  // token and no attached Passport, fail fast, silently downgrading to the wallet header would
   // present a different identity than the one the caller asked for.
   if (identityMode === 'operator' && !callerOperatorToken && passportAttach.kind !== 'attached') {
     throw new CliError(
       'passport_login_required',
-      'Identity mode `operator` needs a stored operator credential, and none was found — refusing to fall back to wallet identity.',
+      'Identity mode `operator` needs a stored operator credential, and none was found, refusing to fall back to wallet identity.',
       {
         nextSteps: {
           action: 'passport_login',
@@ -255,7 +255,7 @@ export async function pay(input: PayInput): Promise<PayResult> {
   if (input.body !== undefined) init.body = input.body;
   // Auto-inject X-Wallet-Address ONLY when the caller hasn't already chosen an identity
   // header. If the agent passed X-Operator-Token, layering X-Wallet-Address on top makes
-  // the merchant's gate evaluate BOTH identities — and unlinked wallets without their
+  // the merchant's gate evaluate BOTH identities, and unlinked wallets without their
   // own KYC will fail compliance even though the operator_token is fully verified.
   const userHeaderKeys = userHeaderKeysAll;
   const userSpecifiedIdentity =
@@ -286,7 +286,7 @@ export async function pay(input: PayInput): Promise<PayResult> {
     });
   }
   if (passportAttach.expiringSoon) {
-    process.stderr.write(`Passport expires soon — run \`agentscore-pay passport login\` to renew before ${new Date(passportAttach.passport!.expires_at).toISOString()}.\n`);
+    process.stderr.write(`Passport expires soon, run \`agentscore-pay passport login\` to renew before ${new Date(passportAttach.passport!.expires_at).toISOString()}.\n`);
   }
   // Note: kind === 'expired' on the live path was already handled inline above.
   // Dry-run doesn't drive reauth; the user can see kind: 'expired' in the dry-run output.
@@ -347,7 +347,7 @@ export async function pay(input: PayInput): Promise<PayResult> {
   let text = await res.text();
   let parsed = tryParseJson(text);
 
-  // Cold-start bootstrap on 403 — when a merchant gate auto-mints a verification
+  // Cold-start bootstrap on 403, when a merchant gate auto-mints a verification
   // session for us and surfaces it in the deny body. Drives the inline browser-
   // redirect flow once, then RETRIES the original payment with X-Operator-Token
   // attached + (when present) the merchant's order_id merged into the body so
@@ -368,7 +368,7 @@ export async function pay(input: PayInput): Promise<PayResult> {
     // non-TTY agents shouldn't block ~1h on the inline browser flow. Surface
     // a structured envelope with the merchant-supplied verify_url + session
     // fields so the agent can either run `passport login` interactively
-    // (recommended — mints a refresh-bearing Passport that prevents this
+    // (recommended, mints a refresh-bearing Passport that prevents this
     // round-trip on subsequent calls) or proxy the merchant URL out-of-band.
     if (!process.stdout.isTTY) {
       throw new CliError(
@@ -378,7 +378,7 @@ export async function pay(input: PayInput): Promise<PayResult> {
           nextSteps: {
             action: 'passport_login',
             suggestion:
-              'Recommended: run `agentscore-pay passport login` interactively to mint a fresh access + refresh credential, then re-run this command — the new credential lasts ~90 days and prevents this round-trip on subsequent merchants. Alternative: surface the merchant-supplied verify_url to the user; completing it issues a one-shot 24h token tied to this merchant\'s session.',
+              'Recommended: run `agentscore-pay passport login` interactively to mint a fresh access + refresh credential, then re-run this command, the new credential lasts ~90 days and prevents this round-trip on subsequent merchants. Alternative: surface the merchant-supplied verify_url to the user; completing it issues a one-shot 24h token tied to this merchant\'s session.',
           },
           extra: {
             verify_url: bootstrapFields.verify_url,
@@ -390,7 +390,7 @@ export async function pay(input: PayInput): Promise<PayResult> {
         },
       );
     }
-    process.stderr.write('Merchant requires identity verification — bootstrapping inline...\n');
+    process.stderr.write('Merchant requires identity verification, bootstrapping inline...\n');
     let printedVerifyUrl = false;
     const renewal = await bootstrapFromMerchantSession(bootstrapFields, {
       onVerifyUrl: (verifyUrl) => {
@@ -403,7 +403,7 @@ export async function pay(input: PayInput): Promise<PayResult> {
     process.stderr.write(`Passport saved (expires ${new Date(renewal.passport.expires_at).toISOString()}). Retrying payment with X-Operator-Token...\n`);
 
     // The retry attaches the freshly-minted durable Passport token; same
-    // transport guard as the primary path — never put the bearer credential on
+    // transport guard as the primary path, never put the bearer credential on
     // a cleartext target (the cold-start first attempt may have carried no
     // token, so input.url hasn't necessarily been asserted yet).
     assertCredentialTarget(input.url);
@@ -419,7 +419,7 @@ export async function pay(input: PayInput): Promise<PayResult> {
       }
     }
 
-    // Rebuild init for the retry — fresh signal, fresh headers (with the new opc).
+    // Rebuild init for the retry, fresh signal, fresh headers (with the new opc).
     const retryController = new AbortController();
     const retryTimer = setTimeout(() => retryController.abort(), timeoutSeconds * 1000);
     const retryInit: RequestInit = { method: input.method, signal: retryController.signal };
@@ -537,7 +537,7 @@ function resolveDecimals(declared: number | undefined, asset: string | undefined
   if (isKnownUSDC(asset, chain)) return 6;
   throw new CliError(
     'merchant_spec_violation',
-    `Merchant 402 omitted 'decimals' for unrecognized asset ${asset ?? '(none)'} on ${chain}. Refusing to pay — guessing decimals risks orders-of-magnitude mis-billing.`,
+    `Merchant 402 omitted 'decimals' for unrecognized asset ${asset ?? '(none)'} on ${chain}. Refusing to pay, guessing decimals risks orders-of-magnitude mis-billing.`,
     {
       nextSteps: {
         action: 'contact_merchant',
@@ -574,7 +574,7 @@ async function payViaX402(
     client.register(cfg.network as `${string}:${string}`, evmClient);
     client.registerV1(cfg.network as `${string}:${string}`, evmClient);
   } else {
-    throw new CliError('unsupported_rail', `x402 path called on chain ${wallet.chain} — only Base is supported under x402; Tempo and Solana go through MPP.`);
+    throw new CliError('unsupported_rail', `x402 path called on chain ${wallet.chain}, only Base is supported under x402; Tempo and Solana go through MPP.`);
   }
 
   const host = safeHost(input.url);
@@ -645,7 +645,7 @@ async function payViaMpp(
     const signer = (await createX402Signer(wallet, network)) as Parameters<typeof solanaCharge>[0]['signer'];
     methods = [solanaCharge({ signer, rpcUrl: cfg.rpcUrl })];
   } else {
-    throw new CliError('unsupported_rail', `MPP path called on chain ${wallet.chain} — only Tempo and Solana are supported under MPP.`);
+    throw new CliError('unsupported_rail', `MPP path called on chain ${wallet.chain}, only Tempo and Solana are supported under MPP.`);
   }
   // Same redirect guard as the x402 path when the credential rides on the request.
   const baseFetch = guardRedirects ? createSecureFetch() : fetch;
@@ -679,7 +679,7 @@ async function payViaMpp(
 
 /**
  * Stable per-invocation idempotency key. Hashes the request shape (url + method + body +
- * signer) so all retries within `withRetries` reuse the same key — merchants that honor
+ * signer) so all retries within `withRetries` reuse the same key, merchants that honor
  * X-Idempotency-Key (Stripe-pattern dedup) won't double-charge if a payment settled but
  * the network response was lost.
  */
diff --git a/src/commands/qr.ts b/src/commands/qr.ts
index ecbfa9d..eae5a02 100644
--- a/src/commands/qr.ts
+++ b/src/commands/qr.ts
@@ -33,7 +33,7 @@ export async function qr(input: QrInput): Promise<QrResult> {
         ? solanaChain.qrUri(ks.address, input.amountUsd, network)
         : tempoChain.qrUri(ks.address, input.amountUsd, network);
 
-  // Capture QR ascii into a string instead of printing to stdout — caller decides
+  // Capture QR ascii into a string instead of printing to stdout, caller decides
   // whether to render it (TTY) or pass it through structured output (JSON/TOON).
   const ascii_qr = await new Promise<string>((resolve) => {
     qrcode.generate(uri, { small: true }, (q) => resolve(q));
diff --git a/src/commands/send.ts b/src/commands/send.ts
index 166285e..ad84efa 100644
--- a/src/commands/send.ts
+++ b/src/commands/send.ts
@@ -1,5 +1,5 @@
 /**
- * `agentscore-pay send` — raw USDC transfer to an arbitrary recipient.
+ * `agentscore-pay send`, raw USDC transfer to an arbitrary recipient.
  *
  * Different from `pay <url>`: there is no merchant, no 402 handshake, no
  * MPP receipt. Just an on-chain transfer of USDC from the local wallet
diff --git a/src/commands/wallet.ts b/src/commands/wallet.ts
index f9ee5ba..6ed8e32 100644
--- a/src/commands/wallet.ts
+++ b/src/commands/wallet.ts
@@ -116,7 +116,7 @@ async function walletCreateMnemonic(chain?: Chain): Promise<WalletCreateResult>
   const chains = chain ? [chain] : [...SUPPORTED_CHAINS];
   for (const c of chains) {
     if (await keystoreExists(c)) {
-      throw new CliError('wallet_exists', `Keystore for ${c} already exists — can't mint new mnemonic-derived key.`, {
+      throw new CliError('wallet_exists', `Keystore for ${c} already exists, can't mint new mnemonic-derived key.`, {
         nextSteps: {
           action: 'remove_then_create',
           suggestion: `Delete ${keystorePath(c)} and try again.`,
diff --git a/src/faucets.ts b/src/faucets.ts
index 0bf2913..003da5b 100644
--- a/src/faucets.ts
+++ b/src/faucets.ts
@@ -8,5 +8,5 @@ export function faucetUrls(chain: Chain, network: Network): string[] {
 }
 
 export function tempoFaucetNote(): string {
-  return 'Tempo testnet USDC.e: run `agentscore-pay fund --chain tempo --network testnet` — programmatically mints all 4 test stablecoins (pathUSD, AlphaUSD, BetaUSD, ThetaUSD) via the `tempo_fundAddress` JSON-RPC method. Free, no signup, no API key.';
+  return 'Tempo testnet USDC.e: run `agentscore-pay fund --chain tempo --network testnet`, programmatically mints all 4 test stablecoins (pathUSD, AlphaUSD, BetaUSD, ThetaUSD) via the `tempo_fundAddress` JSON-RPC method. Free, no signup, no API key.';
 }
diff --git a/src/headers.ts b/src/headers.ts
index 246e5f5..b394c77 100644
--- a/src/headers.ts
+++ b/src/headers.ts
@@ -5,7 +5,7 @@
  *
  * Without this dedupe step, `Object.assign({Content-Type: 'application/json'}, {'content-type': 'application/json'})`
  * keeps BOTH keys and `fetch` sends them as a comma-joined value (`application/json, application/json`),
- * which strict body-parsers (Express's, etc.) reject — silently breaking POSTs against any merchant
+ * which strict body-parsers (Express's, etc.) reject, silently breaking POSTs against any merchant
  * whose server doesn't tolerate the duplicate.
  */
 export function mergeHeaders(
diff --git a/src/onramp.ts b/src/onramp.ts
index 6c5faeb..192e581 100644
--- a/src/onramp.ts
+++ b/src/onramp.ts
@@ -6,7 +6,7 @@
  * resolves to their account.
  *
  * The hosted_url returned points at Stripe's hosted onramp (crypto.link.com).
- * The CLI never auto-opens a browser — emit the URL on stderr and let the
+ * The CLI never auto-opens a browser, emit the URL on stderr and let the
  * user click it from their terminal.
  */
 
@@ -139,7 +139,7 @@ export async function createOnrampSession(input: CreateOnrampSessionInput): Prom
 
 /**
  * Fetch a Stripe Crypto Onramp price preview without committing to a session.
- * No passport credential needed — quotes are public pricing information.
+ * No passport credential needed, quotes are public pricing information.
  */
 export async function getOnrampQuote(input: CreateOnrampQuoteInput): Promise<OnrampQuoteResponse> {
   const baseUrl = (input.baseUrl ?? ONRAMP_BASE_URL).replace(/\/+$/, '');
diff --git a/src/passport/attach.ts b/src/passport/attach.ts
index 7eba9d5..1aa8210 100644
--- a/src/passport/attach.ts
+++ b/src/passport/attach.ts
@@ -10,7 +10,7 @@ import { isExpired, loadPassport, type Passport } from './storage';
 
 /**
  * Proactive-refresh trigger window. Fire silent refresh when the access
- * token is within this window of expiry, even if it hasn't expired yet —
+ * token is within this window of expiry, even if it hasn't expired yet,
  * gives clock-skew + on-the-wire-latency headroom so a token doesn't
  * expire between attach and merchant validation. Distinct from the
  * reactive case (access already expired), which always attempts refresh
@@ -26,7 +26,7 @@ export interface AttachResult {
   /**
    * Informational warning that the *user* needs to re-verify in browser
    * soon. False when a refresh_token is still comfortably valid (pay
-   * will rotate silently — no user action). True only when access is
+   * will rotate silently, no user action). True only when access is
    * near expiry AND refresh is unavailable or also near expiry.
    */
   expiringSoon?: boolean;
@@ -35,12 +35,12 @@ export interface AttachResult {
 export interface AttachInput {
   /** Set to true to skip attach entirely (caller is doing explicit-anonymous). */
   skipPassport?: boolean;
-  /** Caller-supplied X-Operator-Token already present on the request — don't override. */
+  /** Caller-supplied X-Operator-Token already present on the request, don't override. */
   callerSuppliedOperatorToken?: string;
   /**
    * The merchant request URL the credential would be attached to. When provided
    * and NOT credential-safe (non-https, except loopback http for dev), attach
-   * refuses — returns `kind: 'insecure_target'` and never surfaces the
+   * refuses, returns `kind: 'insecure_target'` and never surfaces the
    * operator_token. Omit when resolving the passport for a use that does NOT put
    * the bearer token on the wire (e.g. minting an @authority-bound AIP token).
    */
@@ -66,7 +66,7 @@ export async function attachPassport(input: AttachInput = {}): Promise<AttachRes
   // Credential-transport guard: never put the bearer operator_token on a
   // cleartext (or otherwise non-https) merchant URL. Loopback http is the dev
   // carve-out (handled inside isCredentialSafeUrl). Returning before load/refresh
-  // avoids surfacing — or even rotating — the credential for an unsafe target.
+  // avoids surfacing, or even rotating, the credential for an unsafe target.
   if (input.targetUrl !== undefined && !isCredentialSafeUrl(input.targetUrl)) {
     return { kind: 'insecure_target' };
   }
@@ -83,7 +83,7 @@ export async function attachPassport(input: AttachInput = {}): Promise<AttachRes
 
   // Try silent refresh in two cases:
   //   - Reactive: access has already expired but refresh_token is still
-  //     valid (the dominant real-world case — agent comes back after the
+  //     valid (the dominant real-world case, agent comes back after the
   //     24h access TTL but well within the 90d refresh TTL).
   //   - Proactive: access within REFRESH_THRESHOLD_MS of expiry; rotates
   //     before the merchant sees a near-expired token.
@@ -107,7 +107,7 @@ export async function attachPassport(input: AttachInput = {}): Promise<AttachRes
 
   // `expiringSoon` is the signal that the *user* needs to take action
   // (re-verify in browser). With a refresh_token still comfortably valid,
-  // pay rotates silently and the user has nothing to do — don't print the
+  // pay rotates silently and the user has nothing to do, don't print the
   // misleading "run passport login" warning. Only set it when access is
   // near expiry AND refresh is unavailable / also near expiry.
   const refreshWillSaveUs =
diff --git a/src/passport/auth.ts b/src/passport/auth.ts
index e25c1c9..4afe33c 100644
--- a/src/passport/auth.ts
+++ b/src/passport/auth.ts
@@ -21,7 +21,7 @@ export interface PassportLoginInput {
   baseUrl?: string;
   /** Override fetch (testing). */
   fetch?: typeof globalThis.fetch;
-  /** Hook called once with the verify URL — terminal prints it for the user. */
+  /** Hook called once with the verify URL, terminal prints it for the user. */
   onVerifyUrl?: (verifyUrl: string) => void;
   /** Hook called on every poll iteration (for a TTY spinner / progress event). */
   onPoll?: (info: { attempt: number; status: string }) => void;
@@ -64,7 +64,7 @@ export interface PassportResumeInput {
   verifyUrl: string;
   /**
    * Optional poll URL from the merchant 403. Accepted for forward-compat but
-   * its HOST IS NEVER TRUSTED — the poll always targets the trusted AgentScore
+   * its HOST IS NEVER TRUSTED, the poll always targets the trusted AgentScore
    * base (see passportResume). Only the session id (passed separately) is used.
    */
   pollUrl?: string;
@@ -164,7 +164,7 @@ async function pollAndStore(input: {
   }
 
   throw new CliError('passport_verification_timeout', 'Passport verification timed out.', {
-    nextSteps: { action: 'retry_login', suggestion: 'Run `agentscore-pay passport login` again — sessions stay alive for 1 hour by default; you can resume the same session URL if it has not expired.' },
+    nextSteps: { action: 'retry_login', suggestion: 'Run `agentscore-pay passport login` again, sessions stay alive for 1 hour by default; you can resume the same session URL if it has not expired.' },
     extra: { session_id: input.sessionId, verify_url: input.verifyUrl },
   });
 }
@@ -267,7 +267,7 @@ async function mintPublicSession(input: {
 /**
  * Poll a session minted via the public endpoint. The /v1/sessions/{id} GET path
  * is the same for merchant + public sessions (gated by X-Poll-Secret), so we
- * don't need a separate SDK method — but since we're not constructing an
+ * don't need a separate SDK method, but since we're not constructing an
  * authenticated client here, we hit it via raw fetch.
  */
 async function pollPublicSession(input: {
@@ -277,7 +277,7 @@ async function pollPublicSession(input: {
   fetch: typeof globalThis.fetch;
 }): Promise<SessionPollResponse> {
   // The X-Poll-Secret header rides this request and undici forwards custom headers across
-  // cross-origin redirects — same origin-pinning as the credentialed legs above.
+  // cross-origin redirects, same origin-pinning as the credentialed legs above.
   const fetchImpl = createSecureFetch({ fetch: input.fetch });
   const response = await fetchImpl(
     `${input.baseUrl}/v1/sessions/${encodeURIComponent(input.sessionId)}`,
diff --git a/src/passport/bootstrap.ts b/src/passport/bootstrap.ts
index 5b7fc66..7de0835 100644
--- a/src/passport/bootstrap.ts
+++ b/src/passport/bootstrap.ts
@@ -2,7 +2,7 @@ import { passportLogin, passportResume, type PassportLoginResult } from './auth'
 
 /**
  * Inline session acquisition during an `agentscore-pay <url>` settle leg when the agent
- * has no usable Passport — either resuming a merchant-supplied session
+ * has no usable Passport, either resuming a merchant-supplied session
  * surfaced in a 403 or minting a fresh one after the stored Passport expired.
  */
 
@@ -39,7 +39,7 @@ export function detectMerchantBootstrap(
 }
 
 export interface BootstrapHooks {
-  /** Hook called once with the verify URL — terminal prints it for the user. */
+  /** Hook called once with the verify URL, terminal prints it for the user. */
   onVerifyUrl?: (verifyUrl: string) => void;
   /** Hook called on every poll iteration. */
   onPoll?: (info: { attempt: number; status: string }) => void;
diff --git a/src/rail-hints.ts b/src/rail-hints.ts
index 660b64b..7674fde 100644
--- a/src/rail-hints.ts
+++ b/src/rail-hints.ts
@@ -12,25 +12,25 @@ export interface RailHint {
 const HINTS: Record<string, RailHint> = {
   'eip155:1': {
     name: 'Ethereum mainnet (x402)',
-    description: 'x402 on Ethereum L1 — not natively supported by agentscore-pay; gas typically makes micropayments uneconomical.',
+    description: 'x402 on Ethereum L1, not natively supported by agentscore-pay; gas typically makes micropayments uneconomical.',
     docs_url: 'https://x402.org',
   },
   'eip155:137': {
     name: 'Polygon (x402)',
-    description: 'x402 on Polygon — not natively supported by agentscore-pay.',
+    description: 'x402 on Polygon, not natively supported by agentscore-pay.',
     docs_url: 'https://polygon.technology',
   },
   'eip155:42161': {
     name: 'Arbitrum (x402)',
-    description: 'x402 on Arbitrum — not natively supported by agentscore-pay.',
+    description: 'x402 on Arbitrum, not natively supported by agentscore-pay.',
     docs_url: 'https://x402.org',
   },
   'eip155:10': {
     name: 'Optimism (x402)',
-    description: 'x402 on Optimism — not natively supported by agentscore-pay.',
+    description: 'x402 on Optimism, not natively supported by agentscore-pay.',
     docs_url: 'https://x402.org',
   },
-  // Single canonical entry for Stripe SPT — the lookup function below maps any rail name
+  // Single canonical entry for Stripe SPT, the lookup function below maps any rail name
   // starting with `stripe` (`stripe`, `stripe-spt`, `stripe/charge`, Stripe-flavored
   // schemes) to this hint, so we don't need duplicate entries per spelling variant.
   stripe: {
diff --git a/src/selection.ts b/src/selection.ts
index e0c5e0a..95e8737 100644
--- a/src/selection.ts
+++ b/src/selection.ts
@@ -41,7 +41,7 @@ async function listHeldCandidates(
 ): Promise<Candidate[]> {
   // When the caller already knows which chain it wants (e.g. `agentscore-pay pay --chain tempo`),
   // skip the balance fetch on every other chain. Without this, we hit each chain's
-  // RPC even for an explicit override — and the public Solana mainnet endpoint
+  // RPC even for an explicit override, and the public Solana mainnet endpoint
   // (40 req/10s per IP) bubbles transient 429s back as `rpc_error: solana mainnet
   // RPC call failed` on legitimate tempo / base settles.
   const chains = filterChain ? [filterChain] : [...SUPPORTED_CHAINS];
diff --git a/src/url-security.ts b/src/url-security.ts
index 9c2895e..2c0906e 100644
--- a/src/url-security.ts
+++ b/src/url-security.ts
@@ -6,7 +6,7 @@ import { CliError } from './errors';
  * The durable Passport credential is a long-lived bearer secret. It must ONLY
  * ever travel:
  *   1. over `https:` (never cleartext), and
- *   2. to the exact host the user targeted — never silently forwarded to a
+ *   2. to the exact host the user targeted, never silently forwarded to a
  *      redirect target the merchant chose.
  *
  * On Node/undici a cross-origin `30x` strips `Authorization` and `Cookie` from
@@ -30,8 +30,8 @@ export function isLoopbackHost(hostname: string): boolean {
 /**
  * True when it is safe to attach the bearer credential to a request for `url`:
  * the scheme is https, OR it is a loopback host over http (dev). Returns false
- * (rather than throwing) so callers that only need a yes/no — e.g. the dry-run
- * planner deciding whether to show the header — can branch without a try/catch.
+ * (rather than throwing) so callers that only need a yes/no, e.g. the dry-run
+ * planner deciding whether to show the header, can branch without a try/catch.
  * Unparseable URLs are unsafe.
  */
 export function isCredentialSafeUrl(url: string): boolean {
@@ -77,7 +77,7 @@ export function assertCredentialTarget(url: string): void {
 /**
  * Same-origin check used to decide whether a redirect may carry the credential.
  * Both targets must be https (the dev loopback carve-out does NOT extend to
- * following redirects — a redirect is merchant-controlled and we never relax
+ * following redirects, a redirect is merchant-controlled and we never relax
  * transport security on it).
  */
 function sameSecureOrigin(from: URL, to: URL): boolean {
@@ -102,7 +102,7 @@ export interface SecureFetchOptions {
  *
  * Pass this as the `fetch` to x402/MPP client wrappers so every request they
  * make on the credentialed path (initial 402 probe + the post-payment settle)
- * is guarded — the wrappers own the fetch loop, so guarding at the fetch layer
+ * is guarded, the wrappers own the fetch loop, so guarding at the fetch layer
  * is the only place that covers both legs.
  */
 export function createSecureFetch(opts: SecureFetchOptions = {}): typeof globalThis.fetch {
@@ -121,7 +121,7 @@ export function createSecureFetch(opts: SecureFetchOptions = {}): typeof globalT
       if (!isRedirect(res.status)) return res;
 
       const location = res.headers.get('location');
-      if (!location) return res; // 3xx with no Location — nothing to follow, hand it back.
+      if (!location) return res; // 3xx with no Location, nothing to follow, hand it back.
 
       let target: URL;
       try {