@private.me/xbind 1.2.15 → 1.2.16

package/README.md

@@ -1,7 +1,7 @@
 # @private.me/xbind
 
 ![npm version](https://img.shields.io/npm/v/@private.me/xbind)
-![version](https://img.shields.io/badge/version-1.2.15-blue)
+![version](https://img.shields.io/badge/version-1.2.16-blue)
 ![tests](https://img.shields.io/badge/tests-1245%20passing-brightgreen)
 ![TypeScript](https://img.shields.io/badge/TypeScript-strict-blue)
 ![license](https://img.shields.io/badge/license-Proprietary-blue)
@@ -12,7 +12,7 @@ Build AI agents that communicate securely using ML-DSA-65 DID identity, ML-KEM-7
 
 Part of the **Private.Me** platform—where APIs have keys, but ACIs have identity.
 
-**Version 1.1.7** — **Dependency hardening:** Vendored mldsa-wasm@0.0.4 (eliminates external dependency risk). Previous v1.1.6: CRITICAL SECURITY FIX removed deriveSharedKey() vulnerability. PLAN-3 architecture with post-quantum cryptography (ML-KEM-768, ML-DSA-65), Python SDK, and Full Control protection.
+**Version 1.2.16** — **AWS/gRPC/HTTP Error Mappings:** All 49 error codes now include protocol-specific mappings (aws, grpc, http fields) for cross-platform error translation. Previous v1.2.15: JITR Fix - POST /registry/register accepts all cryptographic keys (X25519, ML-KEM-768, ML-DSA-65), fixes KEY_AGREEMENT_FAILED errors. Agent.fromSeed() JITR now registers full identity with encryption keys.
 
 ## Install
 
@@ -205,6 +205,96 @@ Zero key management, zero cascade failures, zero bearer credentials. Cryptograph
 
 **Zero-config JITR:** Just-in-Time Registration auto-registers agents with trust registry on first use (AWS IoT JITR, OAuth DCR, MCP 2025 standards). Post-quantum cryptography (ML-KEM-768, ML-DSA-65), bilateral authorization, XorIDA split-channel delivery, Python SDK, Full Control IP protection, zero rotation, type safety with `Result<T, E>`, PLAN-3 hybrid signatures, 96 error codes.
 
+## Automatic XorIDA Split-Channel Protection
+
+xBind automatically activates information-theoretic XorIDA threshold sharing for high-risk operations. No code changes required—security is transparent.
+
+### Risk Tags (Recommended for Crypto)
+
+For cryptocurrency transactions (BTC, ETH, etc.), use explicit risk tags in your payload:
+
+```typescript
+// Low risk: 2-of-2 threshold
+await agent.send({
+  to: recipientDid,
+  payload: { amount: 0.5, currency: 'BTC', risk: 'low' }
+});
+
+// Medium risk: 2-of-3 threshold
+await agent.send({
+  to: recipientDid,
+  payload: { amount: 5.0, currency: 'ETH', risk: 'medium' }
+});
+
+// High risk: 3-of-5 threshold
+await agent.send({
+  to: recipientDid,
+  payload: { amount: 50, currency: 'BTC', risk: 'high' }
+});
+
+// Critical risk: 3-of-5 threshold
+await agent.send({
+  to: recipientDid,
+  payload: { amount: 100, currency: 'BTC', risk: 'critical' }
+});
+```
+
+### Fiat Currency Auto-Detection
+
+For fiat currencies (USD, EUR, GBP), xBind uses numeric thresholds:
+
+```typescript
+// Automatically triggers 2-of-3 (amount >= $100,000)
+await agent.send({
+  to: recipientDid,
+  payload: { amount: 500000, currency: 'USD', action: 'transfer' }
+});
+
+// Automatically triggers 3-of-5 (amount >= $1,000,000)
+await agent.send({
+  to: recipientDid,
+  payload: { amount: 2500000, currency: 'USD', action: 'transfer' }
+});
+```
+
+### Manual Security Override
+
+Override automatic detection with explicit security levels:
+
+```typescript
+// Force 2-of-3 regardless of amount/risk
+await agent.send({
+  to: recipientDid,
+  payload: data,
+  security: 'high'
+});
+
+// Force 3-of-5 for maximum security
+await agent.send({
+  to: recipientDid,
+  payload: data,
+  security: 'critical'
+});
+
+// Disable XorIDA (standard encrypted transport)
+await agent.send({
+  to: recipientDid,
+  payload: data,
+  security: 'standard'
+});
+```
+
+### Threshold Schemes
+
+| Risk Tag / Threshold | Shares | Required | Security Level |
+|---------------------|--------|----------|----------------|
+| `low` | 2 | 2 | 2-of-2 threshold |
+| `medium` / $100k-$1M | 3 | 2 | 2-of-3 threshold |
+| `high` / `critical` / >$1M | 5 | 3 | 3-of-5 threshold |
+| No tag / <$100k | — | — | Standard encrypted transport |
+
+**Key Insight:** XorIDA is information-theoretically secure. Any K-1 shares reveal zero information about the secret, even with unlimited computing power. Quantum computers cannot break XorIDA.
+
 ## Billing & Metering
 
 xBind includes usage-based billing with automated milestone notifications: