API keys

import { createKavach } from 'kavachos';

const kavach = await createKavach({
  database: { provider: 'sqlite', url: 'kavach.db' },
  apiKeys: { 
    prefix: 'kos_',          // default
    defaultExpiryDays: 90,   // default: 365
  }, 
});

const { key, apiKey } = await kavach.apiKeys.create({
  userId: 'user_abc',
  name: 'CI deploy token',
  permissions: ['agents:read', 'agents:create'], 
  expiresAt: new Date('2026-01-01'),  // optional, falls back to defaultExpiryDays
});

// key = 'kos_a3f8c2e1...', the full secret, returned once only
// apiKey.id, apiKey.prefix, apiKey.permissions, apiKey.expiresAt

const result = await kavach.apiKeys.validate('kos_a3f8c2e1...');
if (result) {
  // result.userId, result.permissions, result.keyId
}

// All keys for a user (no secrets exposed)
const keys = await kavach.apiKeys.list('user_abc');

// Revoke by key ID
await kavach.apiKeys.revoke('key_...');

const { key, apiKey } = await kavach.apiKeys.rotate('key_...');
// key = new full secret, store it now