@algovoi/policy-binding

@algovoi/policy-binding

Additive policy-snapshot binding for the AlgoVoi substrate. Binds a content-addressed policy snapshot over an existing AlgoVoi reference — a settlement-action binding_ref (v1) or a retention_chain ref (v0/v1) — making a decision verifiable against the exact policy version in force and a policy rotation detectable by recomputation. The canonicalisation base and the underlying binding/chain are frozen; this layer only references them by hash.

Byte-for-byte identical to the Python package algovoi-policy-binding (JCS RFC 8785 via the canonicalize package + SHA-256, the same primitives as @algovoi/substrate).

policyRef       = "sha256:" + SHA-256(JCS(policyDocument))
policyBoundRef  = "sha256:" + SHA-256(JCS({ policy_ref, subject_ref }))

Install

npm install @algovoi/policy-binding@0.1.0

Use

import { policyRef, policyBoundRef } from '@algovoi/policy-binding';

const policy = { policy_id: 'aml.transfer', version: 1, max_amount: 1000, deny_jurisdictions: ['XX'] };
const pref = policyRef(policy);

// subjectRef is any AlgoVoi reference: a binding_ref, or a retention_chain ref (v0/v1)
const bindingRef = 'sha256:7dc4a2bf62b3c5eabd10fc875ff7fc10f188666f15838c4a51464cc72e80f6ca';
const pbr = policyBoundRef(bindingRef, pref);

Version-agnostic: the same call binds over retention_chain v0, v1, or a binding_ref — subjectRef is imported purely by hash.

Conformance

conformance/policy_binding_v1/ holds the canonical vectors and a standalone verify.mjs (Node + canonicalize, no package import). Recompute is the test:

node conformance/policy_binding_v1/verify.mjs

It checks positives byte-for-byte, the P→P' rotation negative on every subject, key-order invariance, and subject-binding — and the expected hashes are shared with the Python package, so a pass proves cross-language (Python/TS) parity. The subjects are the published canonical references from chopmob-cloud/algovoi-jcs-conformance-vectors.

Adoption

Pin @algovoi/policy-binding@0.1.0 (not a range), preserve the NOTICE, and run the conformance suite against the canonical vectors. To qualify for a free v0 licence key for algovoi-mandate-auditor, contact [e-mail] with your import-by-hash evidence and a copy of the NOTICE.

License

Apache-2.0. (c) 2026 AlgoVoi. Preserve the NOTICE file in any distribution.