How iamgodofall/capkit works
CapKit is a local-first TypeScript library for issuing scoped, expiring HMAC-signed capabilities, checking YAML policies, verifying tokens, and producing signed audit receipts. The demo shows an agent authorization workflow; it simulates the protected action rather than integrating with an external platform. Source excerpts support the demo’s direct API calls and the policy loader’s file/YAML reads; no persistent audit store or external service is shown.
Main entry points: agent-example.ts Demo workflow · policy.ts Policy load and check · index.ts Library exports · capability.ts Capability issue and verify
Components 10
Public API
- Library exports
src/index.ts
Authorization
- Capability issue and verify
src/capability.ts - Policy load and check
src/policy.ts
Audit
- Signed audit receipt
src/capability.ts
Other components
- AI agent
- Demo workflow
demo/agent-example.ts - Demo policy
demo/policy.yaml - Node filesystem
- js-yaml parser
- Node crypto
Connections 12
- AI agent → Demo workflow: requests authorization
- Demo workflow → Library exports: invokes API
- Library exports → Capability issue and verify: exports
- Library exports → Policy load and check: exports
- Demo workflow → Policy load and check: loads and checks
- Policy load and check → Node filesystem: reads file
- Policy load and check → js-yaml parser: parses YAML
- Policy load and check → Demo policy: reads policy
- Demo workflow → Capability issue and verify: issues and verifies
- Capability issue and verify → Node crypto: signs and verifies
- Demo workflow → Signed audit receipt: requests receipt
- Signed audit receipt → Node crypto: signs receipt