@private.me/xbind 1.2.15 → 1.2.17

package/dist-standalone/errors.js

@@ -74,6 +74,13 @@ export class XBindAgentError extends XBindError {
         this.name = 'XBindAgentError';
     }
 }
+/** Billing and payment errors (subscriptions, limits, verification). */
+export class XBindBillingError extends XBindError {
+    constructor(code, message) {
+        super(code, message, `${DOC_BASE}#billing`);
+        this.name = "XBindBillingError";
+    }
+}
 /**
  * Create detailed error information for a given error code.
  *
@@ -105,6 +112,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify runtime environment supports Web Crypto API and retry key generation',
         severity: 'critical',
         docs: `${DOC_BASE}#identity`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     SIGN_FAILED: {
         message: 'Signing failed',
@@ -112,6 +122,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify private key is valid and properly imported with extractable flag',
         severity: 'high',
         docs: `${DOC_BASE}#identity`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     VERIFY_FAILED: {
         message: 'Signature verification failed',
@@ -119,6 +132,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify sender public key and message integrity before retrying',
         severity: 'critical',
         docs: `${DOC_BASE}#identity`,
+        aws: 'InvalidParameterValue',
+        grpc: 3,
+        http: 400,
     },
     INVALID_DID: {
         message: 'DID format is invalid',
@@ -127,6 +143,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Use validateDID() helper to verify format before processing',
         severity: 'high',
         docs: `${DOC_BASE}#identity`,
+        aws: 'InvalidParameterValue',
+        grpc: 3,
+        http: 400,
     },
     INVALID_KEY_LENGTH: {
         message: 'Key material has incorrect length',
@@ -134,6 +153,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify key is exactly 32 bytes and properly base64-decoded',
         severity: 'high',
         docs: `${DOC_BASE}#key-agreement`,
+        aws: 'InvalidParameterValue',
+        grpc: 3,
+        http: 400,
     },
     EXPORT_FAILED: {
         message: 'PKCS8 export failed',
@@ -141,6 +163,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Create key with extractable:true flag and verify Web Crypto API support',
         severity: 'medium',
         docs: `${DOC_BASE}#identity`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     IMPORT_FAILED: {
         message: 'PKCS8 import failed',
@@ -148,6 +173,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Validate PKCS8 format and verify key data is not corrupted',
         severity: 'high',
         docs: `${DOC_BASE}#identity`,
+        aws: 'InvalidParameterValue',
+        grpc: 3,
+        http: 400,
     },
     // Envelope
     INVALID_VERSION: {
@@ -157,6 +185,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Update SDK or request sender to use compatible version (v1-v4)',
         severity: 'high',
         docs: `${DOC_BASE}#envelope`,
+        aws: 'ValidationException',
+        grpc: 3,
+        http: 400,
     },
     INVALID_ALG: {
         message: 'Unknown encryption algorithm',
@@ -165,6 +196,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify sender uses AES-256-GCM algorithm',
         severity: 'high',
         docs: `${DOC_BASE}#envelope`,
+        aws: 'ValidationException',
+        grpc: 3,
+        http: 400,
     },
     INVALID_NONCE: {
         message: 'Nonce is missing or invalid',
@@ -173,6 +207,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify nonce is 12 bytes and properly base64-encoded',
         severity: 'critical',
         docs: `${DOC_BASE}#envelope`,
+        aws: 'ValidationException',
+        grpc: 3,
+        http: 400,
     },
     INVALID_FIELDS: {
         message: 'Required envelope fields are missing',
@@ -180,6 +217,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Validate all required envelope fields are present',
         severity: 'high',
         docs: `${DOC_BASE}#envelope`,
+        aws: 'ValidationException',
+        grpc: 3,
+        http: 400,
     },
     ENCRYPT_FAILED: {
         message: 'AES-256-GCM encryption failed',
@@ -187,6 +227,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify key is 32 bytes and nonce is 12 bytes before encryption',
         severity: 'high',
         docs: `${DOC_BASE}#envelope`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     DECRYPT_FAILED: {
         message: 'Decryption failed',
@@ -194,6 +237,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify correct key and check ciphertext integrity',
         severity: 'critical',
         docs: `${DOC_BASE}#envelope`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     PARSE_FAILED: {
         message: 'Envelope deserialization failed',
@@ -201,6 +247,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Validate JSON structure and check for data corruption',
         severity: 'high',
         docs: `${DOC_BASE}#envelope`,
+        aws: 'ValidationException',
+        grpc: 3,
+        http: 400,
     },
     // Transport
     SEND_FAILED: {
@@ -209,6 +258,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Check network connectivity and retry with exponential backoff',
         severity: 'high',
         docs: `${DOC_BASE}#transport`,
+        aws: 'ServiceUnavailable',
+        grpc: 14,
+        http: 503,
     },
     NETWORK_ERROR: {
         message: 'Network request failed',
@@ -216,6 +268,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify internet connection and implement exponential backoff retry',
         severity: 'high',
         docs: `${DOC_BASE}#transport`,
+        aws: 'ServiceUnavailable',
+        grpc: 14,
+        http: 503,
     },
     RECIPIENT_UNREACHABLE: {
         message: 'Recipient is unreachable',
@@ -224,6 +279,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify recipient is registered with xBind and online',
         severity: 'medium',
         docs: `${DOC_BASE}#transport`,
+        aws: 'ServiceUnavailable',
+        grpc: 14,
+        http: 503,
     },
     TIMEOUT: {
         message: 'Transport operation timed out',
@@ -231,6 +289,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Increase timeout threshold and check network latency',
         severity: 'medium',
         docs: `${DOC_BASE}#transport`,
+        aws: 'RequestTimeout',
+        grpc: 4,
+        http: 408,
     },
     // Registry
     NOT_FOUND: {
@@ -240,6 +301,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Ask recipient to register with xBind',
         severity: 'medium',
         docs: `${DOC_BASE}#registry`,
+        aws: 'ResourceNotFoundException',
+        grpc: 5,
+        http: 404,
     },
     ALREADY_REGISTERED: {
         message: 'Agent is already registered',
@@ -247,6 +311,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Use updateAgent() instead of registerAgent()',
         severity: 'low',
         docs: `${DOC_BASE}#registry`,
+        aws: 'ResourceAlreadyExists',
+        grpc: 6,
+        http: 409,
     },
     REVOKED: {
         message: 'Agent has been revoked from the registry',
@@ -254,6 +321,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Contact registry administrator to resolve revocation',
         severity: 'high',
         docs: `${DOC_BASE}#registry`,
+        aws: 'AccessDenied',
+        grpc: 7,
+        http: 403,
     },
     // Key agreement
     DERIVE_FAILED: {
@@ -262,6 +332,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify peer public key is valid X25519 and not corrupted',
         severity: 'high',
         docs: `${DOC_BASE}#key-agreement`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     KEM_ENCAPSULATE_FAILED: {
         message: 'ML-KEM-768 encapsulation failed',
@@ -269,6 +342,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify recipient ML-KEM-768 public key and post-quantum support',
         severity: 'high',
         docs: `${DOC_BASE}#key-agreement`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     KEM_DECAPSULATE_FAILED: {
         message: 'ML-KEM-768 decapsulation failed',
@@ -276,6 +352,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify ciphertext integrity and ML-KEM secret key',
         severity: 'high',
         docs: `${DOC_BASE}#key-agreement`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     HKDF_FAILED: {
         message: 'HKDF key derivation failed',
@@ -283,6 +362,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify shared secrets are valid and SHA-256 is available',
         severity: 'high',
         docs: `${DOC_BASE}#key-agreement`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     MLKEM_NOT_AVAILABLE: {
         message: 'ML-KEM-768 key not available',
@@ -297,6 +379,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify ML-DSA-65 secret key and post-quantum support',
         severity: 'high',
         docs: `${DOC_BASE}#identity`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     PQ_VERIFY_FAILED: {
         message: 'ML-DSA-65 verification failed',
@@ -304,6 +389,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify signer public key and signature format',
         severity: 'high',
         docs: `${DOC_BASE}#identity`,
+        aws: 'InvalidParameterValue',
+        grpc: 3,
+        http: 400,
     },
     // Split-channel
     SPLIT_FAILED: {
@@ -312,6 +400,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify threshold parameters and payload size',
         severity: 'high',
         docs: `${DOC_BASE}#split-channel`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     INSUFFICIENT_SHARES: {
         message: 'Not enough shares to reconstruct',
@@ -319,6 +410,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Collect more shares to meet threshold requirement',
         severity: 'high',
         docs: `${DOC_BASE}#split-channel`,
+        aws: 'ValidationException',
+        grpc: 3,
+        http: 400,
     },
     INCONSISTENT_SHARES: {
         message: 'Shares have mismatched group IDs or lengths',
@@ -326,6 +420,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify all shares are from the same split operation',
         severity: 'high',
         docs: `${DOC_BASE}#split-channel`,
+        aws: 'ValidationException',
+        grpc: 3,
+        http: 400,
     },
     HMAC_VERIFICATION_FAILED: {
         message: 'Share HMAC check failed',
@@ -333,6 +430,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Request fresh share from sender',
         severity: 'critical',
         docs: `${DOC_BASE}#split-channel`,
+        aws: 'UnauthorizedOperation',
+        grpc: 16,
+        http: 401,
     },
     UNPAD_FAILED: {
         message: 'Padding removal failed after reconstruction',
@@ -340,6 +440,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify reconstruction succeeded and data is valid UTF-8',
         severity: 'high',
         docs: `${DOC_BASE}#split-channel`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     INVALID_SHARE_DATA: {
         message: 'Share data is malformed',
@@ -347,6 +450,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify share is valid base64 and request correctly-formatted share',
         severity: 'high',
         docs: `${DOC_BASE}#split-channel`,
+        aws: 'ValidationException',
+        grpc: 3,
+        http: 400,
     },
     // Xchange
     XCHANGE_KEYGEN_FAILED: {
@@ -355,6 +461,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify Web Crypto API available and retry',
         severity: 'high',
         docs: `${DOC_BASE}#xchange`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     XCHANGE_ENCRYPT_FAILED: {
         message: 'Xchange bundle encryption failed',
@@ -362,6 +471,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify payload size and encryption key length',
         severity: 'high',
         docs: `${DOC_BASE}#xchange`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     XCHANGE_DECRYPT_FAILED: {
         message: 'Xchange bundle decryption failed',
@@ -369,6 +481,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify reconstruction completed and decryption key is correct',
         severity: 'high',
         docs: `${DOC_BASE}#xchange`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     INVALID_BUNDLE: {
         message: 'Xchange bundle is malformed',
@@ -376,6 +491,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify bundle size and request correctly-formed bundle',
         severity: 'high',
         docs: `${DOC_BASE}#xchange`,
+        aws: 'ValidationException',
+        grpc: 3,
+        http: 400,
     },
     // Agent (high-level)
     IDENTITY_FAILED: {
@@ -384,6 +502,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify Web Crypto API available and retry agent initialization',
         severity: 'critical',
         docs: `${DOC_BASE}#agent`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     REGISTRATION_FAILED: {
         message: 'Agent registration with trust registry failed',
@@ -391,6 +512,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify registry URL and auth token, then retry with exponential backoff',
         severity: 'high',
         docs: `${DOC_BASE}#agent`,
+        aws: 'ServiceUnavailable',
+        grpc: 14,
+        http: 503,
     },
     RECIPIENT_NOT_FOUND: {
         message: 'Recipient agent not found in registry',
@@ -399,6 +523,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Ask recipient to register with xBind',
         severity: 'medium',
         docs: `${DOC_BASE}#agent`,
+        aws: 'ResourceNotFoundException',
+        grpc: 5,
+        http: 404,
     },
     RECIPIENT_REVOKED: {
         message: 'Recipient agent has been revoked',
@@ -407,6 +534,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Inform recipient to contact registry administrator',
         severity: 'high',
         docs: `${DOC_BASE}#agent`,
+        aws: 'AccessDenied',
+        grpc: 7,
+        http: 403,
     },
     KEY_AGREEMENT_FAILED: {
         message: 'ECDH key agreement with recipient failed',
@@ -414,6 +544,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Request fresh key from recipient',
         severity: 'high',
         docs: `${DOC_BASE}#agent`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     ENVELOPE_FAILED: {
         message: 'Envelope creation failed',
@@ -421,6 +554,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify payload size and recipient DID',
         severity: 'high',
         docs: `${DOC_BASE}#agent`,
+        aws: 'InternalFailure',
+        grpc: 13,
+        http: 500,
     },
     VERIFICATION_FAILED: {
         message: 'Incoming envelope verification failed',
@@ -428,6 +564,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Verify sender is in trust registry and not revoked',
         severity: 'critical',
         docs: `${DOC_BASE}#agent`,
+        aws: 'UnauthorizedOperation',
+        grpc: 16,
+        http: 401,
     },
     REPLAY_DETECTED: {
         message: 'Duplicate nonce detected — possible replay attack',
@@ -435,6 +574,9 @@ const ERROR_DETAILS = {
         suggested_action: 'DISCARD MESSAGE and alert user to potential replay attack',
         severity: 'critical',
         docs: `${DOC_BASE}#agent`,
+        aws: 'AccessDenied',
+        grpc: 7,
+        http: 403,
     },
     SCOPE_DENIED: {
         message: 'Sender does not have permission for the requested scope',
@@ -443,6 +585,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Contact registry admin to grant permission',
         severity: 'medium',
         docs: `${DOC_BASE}#agent`,
+        aws: 'AccessDenied',
+        grpc: 7,
+        http: 403,
     },
     RECEIVER_SCOPE_DENIED: {
         message: 'Recipient does not accept messages with this scope',
@@ -451,6 +596,9 @@ const ERROR_DETAILS = {
         suggested_action: 'Ask recipient to enable scope in settings',
         severity: 'medium',
         docs: `${DOC_BASE}#agent`,
+        aws: 'AccessDenied',
+        grpc: 7,
+        http: 403,
     },
     TIMESTAMP_EXPIRED: {
         message: 'Envelope timestamp is outside the allowed window',
@@ -458,6 +606,110 @@ const ERROR_DETAILS = {
         suggested_action: 'Synchronize system clocks using NTP',
         severity: 'medium',
         docs: `${DOC_BASE}#agent`,
+        aws: 'RequestExpired',
+        grpc: 9,
+        http: 412,
+    },
+    INCOMPATIBLE_VERSION: {
+        message: 'Client version is incompatible with server',
+        hint: 'Actions: (1) Update xBind SDK to latest version, (2) Check minimum supported version in docs, (3) Verify server API version requirements, (4) Contact support if upgrade not possible',
+        suggested_action: 'Update xBind SDK to latest version',
+        severity: 'high',
+        docs: `${DOC_BASE}#agent`,
+        aws: 'ValidationException',
+        grpc: 3,
+        http: 400,
+    },
+    FEATURE_NOT_SUPPORTED: {
+        message: 'Requested feature is not supported',
+        hint: 'Actions: (1) Check feature availability in current plan, (2) Verify SDK version supports feature, (3) Review feature documentation, (4) Consider upgrading plan or SDK version',
+        suggested_action: 'Check feature availability in current plan or SDK version',
+        severity: 'medium',
+        docs: `${DOC_BASE}#agent`,
+        aws: 'ValidationException',
+        grpc: 12,
+        http: 501,
+    },
+    QUOTA_EXCEEDED: {
+        message: 'Operation quota exceeded',
+        hint: 'Actions: (1) Check current usage against plan limits, (2) Implement rate limiting and backoff, (3) Upgrade to higher tier plan, (4) Wait for quota reset period',
+        suggested_action: 'Implement rate limiting or upgrade plan',
+        severity: 'medium',
+        docs: `${DOC_BASE}#agent`,
+        aws: 'ThrottlingException',
+        grpc: 8,
+        http: 429,
+    },
+    ACCOUNT_SUSPENDED: {
+        message: 'Account has been suspended',
+        hint: 'Actions: (1) Contact support to determine suspension reason, (2) Review terms of service compliance, (3) Resolve any payment or policy issues, (4) Request account reactivation',
+        suggested_action: 'Contact support to resolve suspension',
+        severity: 'critical',
+        docs: `${DOC_BASE}#agent`,
+        aws: 'AccessDeniedException',
+        grpc: 7,
+        http: 403,
+    },
+    ACCOUNT_NOT_FOUND: {
+        message: 'Account does not exist',
+        hint: 'Actions: (1) Verify account identifier is correct, (2) Check if account was deleted, (3) Confirm registration completed successfully, (4) Create new account if needed',
+        suggested_action: 'Verify account identifier or create new account',
+        severity: 'high',
+        docs: `${DOC_BASE}#agent`,
+        aws: 'ResourceNotFoundException',
+        grpc: 5,
+        http: 404,
+    },
+    // Billing & Payment
+    BILLING_FAILURE: {
+        message: 'Billing operation failed',
+        hint: 'Actions: (1) Verify payment method is valid and not expired, (2) Check Stripe account status, (3) Review billing logs for specific error, (4) Contact support if issue persists',
+        suggested_action: 'Verify payment method and check billing logs',
+        severity: 'high',
+        docs: `${DOC_BASE}#billing`,
+        aws: 'RequestLimitExceeded',
+        grpc: 8,
+        http: 402,
+    },
+    PAYMENT_REQUIRED: {
+        message: 'Payment required to access this resource',
+        hint: 'Actions: (1) Add payment method in account settings, (2) Subscribe to appropriate tier, (3) Verify billing information is current, (4) Check account status',
+        suggested_action: 'Add payment method and subscribe to access this resource',
+        severity: 'medium',
+        docs: `${DOC_BASE}#billing`,
+        aws: 'AccessDenied',
+        grpc: 7,
+        http: 402,
+    },
+    SUBSCRIPTION_REQUIRED: {
+        message: 'Valid subscription required',
+        hint: 'Actions: (1) Subscribe to a paid tier in account settings, (2) Verify subscription is active and not expired, (3) Check billing status, (4) Review subscription features',
+        suggested_action: 'Subscribe to a paid tier to access this feature',
+        severity: 'medium',
+        docs: `${DOC_BASE}#billing`,
+        aws: 'AccessDenied',
+        grpc: 7,
+        http: 403,
+    },
+    TIER_LIMIT_EXCEEDED: {
+        message: 'Current tier usage limit exceeded',
+        hint: 'Actions: (1) Upgrade to higher tier for increased limits, (2) Check current usage vs tier limits, (3) Wait for limit reset (typically monthly), (4) Review tier comparison chart',
+        suggested_action: 'Upgrade to higher tier or wait for limit reset',
+        severity: 'medium',
+        docs: `${DOC_BASE}#billing`,
+        aws: 'RequestLimitExceeded',
+        grpc: 8,
+        http: 403,
+    },
+    VERIFICATION_REQUIRED: {
+        message: 'Account verification required',
+        hint: 'Actions: (1) Complete email verification, (2) Verify payment method, (3) Complete identity verification if required, (4) Check account verification status in settings',
+        suggested_action: 'Complete account verification steps in settings',
+        severity: 'high',
+        docs: `${DOC_BASE}#billing`,
+        aws: 'AccessDenied',
+        grpc: 7,
+        http: 403,
     },
 };
 /** Error messages keyed by code. Includes what happened and what to do next. */
@@ -519,6 +771,17 @@ const ERROR_MESSAGES = {
     SCOPE_DENIED: [XBindAgentError, 'Sender does not have permission for the requested scope. Actions: (1) Check sender scope in registry, (2) Contact admin to grant, (3) Verify scope value.'],
     RECEIVER_SCOPE_DENIED: [XBindAgentError, 'Recipient does not accept messages with this scope. Actions: (1) Check recipient receive scope settings, (2) Ask to enable scope, (3) Verify registry entry.'],
     TIMESTAMP_EXPIRED: [XBindAgentError, 'Envelope timestamp is outside the allowed window. Actions: (1) Synchronize system clocks (NTP), (2) Check time difference, (3) Verify no time drift.'],
+    INCOMPATIBLE_VERSION: [XBindAgentError, 'Client version is incompatible with server. Actions: (1) Update xBind SDK to latest version, (2) Check minimum supported version, (3) Contact support if upgrade not possible.'],
+    FEATURE_NOT_SUPPORTED: [XBindAgentError, 'Requested feature is not supported. Actions: (1) Check feature availability in plan, (2) Verify SDK version, (3) Consider upgrading plan.'],
+    QUOTA_EXCEEDED: [XBindAgentError, 'Operation quota exceeded. Actions: (1) Check usage against plan limits, (2) Implement rate limiting, (3) Upgrade plan, (4) Wait for quota reset.'],
+    ACCOUNT_SUSPENDED: [XBindAgentError, 'Account has been suspended. Actions: (1) Contact support for suspension reason, (2) Review terms compliance, (3) Resolve payment/policy issues.'],
+    ACCOUNT_NOT_FOUND: [XBindAgentError, 'Account does not exist. Actions: (1) Verify account identifier, (2) Check if account was deleted, (3) Create new account if needed.'],
+    // Billing & Payment
+    BILLING_FAILURE: [XBindBillingError, 'Billing operation failed. Actions: (1) Verify payment method is valid and not expired, (2) Check Stripe account status, (3) Review billing logs, (4) Contact support if issue persists.'],
+    PAYMENT_REQUIRED: [XBindBillingError, 'Payment required to access this resource. Actions: (1) Add payment method in account settings, (2) Subscribe to appropriate tier, (3) Verify billing information is current.'],
+    SUBSCRIPTION_REQUIRED: [XBindBillingError, 'Valid subscription required. Actions: (1) Subscribe to a paid tier in account settings, (2) Verify subscription is active and not expired, (3) Check billing status.'],
+    TIER_LIMIT_EXCEEDED: [XBindBillingError, 'Current tier usage limit exceeded. Actions: (1) Upgrade to higher tier for increased limits, (2) Check current usage vs tier limits, (3) Wait for limit reset (typically monthly).'],
+    VERIFICATION_REQUIRED: [XBindBillingError, 'Account verification required. Actions: (1) Complete email verification, (2) Verify payment method, (3) Complete identity verification if required, (4) Check account verification status in settings.'],
 };
 /**
  * Convert a string error code to a typed XBindError instance.

package/dist-standalone/security-policy.d.ts

@@ -62,10 +62,12 @@ export interface SecurityPolicy {
  * Default security policy for basic XBind.
  *
  * Rules:
- * - Transfers over $100,000: High security (3 shares, 2-of-3 threshold)
- * - Cross-entity communication: High security (3 shares, 2-of-3 threshold)
- * - Explicit 'high' override: High security (3 shares, 2-of-3 threshold)
- * - Explicit 'critical' override: Critical security (5 shares, 3-of-5 threshold)
+ * - Explicit risk tags: low → 2-of-2, medium → 2-of-3, high/critical → 3-of-5
+ * - Fiat transfers: USD/EUR/GBP >$100k → 2-of-3, >$1M → 3-of-5
+ * - Crypto transfers: Require explicit risk tag (no numeric auto-detection)
+ * - Sensitive scopes: custody/admin/settlement → 2-of-3
+ * - Cross-entity communication: 2-of-3
+ * - Explicit 'high' override: 2-of-3, 'critical' override: 3-of-5
  * - Everything else: Standard encrypted transport (V3 hybrid PQ)
  *
  * Enterprise and Government variants extend this with custom rules.
@@ -77,10 +79,12 @@ export declare class DefaultSecurityPolicy implements SecurityPolicy {
      *
      * @param options - Optional configuration
      * @param options.highValueThreshold - Amount threshold for high security (default: 100000)
+     * @param options.criticalValueThreshold - Amount threshold for critical security (default: 1000000)
      * @param options.enableXchange - Allow Xchange mode for performance (default: false)
      */
     constructor(options?: {
         readonly highValueThreshold?: number;
+        readonly criticalValueThreshold?: number;
         readonly enableXchange?: boolean;
     });
     classify(context: SecurityContext): SecurityDecision;