JWT sessions

import { createKavach } from 'kavachos';
import { jwtSession } from 'kavachos/auth';

const kavach = await createKavach({
  database: { provider: 'sqlite', url: 'kavach.db' },
  plugins: [
    jwtSession({
      secret: process.env.JWT_SECRET, // min 32 chars for HS256
      accessTokenTtl: 900,            // 15 minutes
      refreshTokenTtl: 604800,        // 7 days
      issuer: 'https://myapp.com',
      audience: 'https://api.myapp.com',
    }),
  ],
});

const { accessToken, refreshToken, expiresIn } = await kavach.jwt.createSession({
  userId: user.id,
  email: user.email,
  name: user.name,
  claims: { role: 'admin' }, // custom claims
});

const payload = await kavach.jwt.verifyAccessToken(accessToken);
// { sub: 'user-123', email: '...', role: 'admin', exp: ..., iss: '...' }

const { accessToken: newAccess, refreshToken: newRefresh } = await kavach.jwt.refreshSession(refreshToken);
// Old refresh token is revoked (rotation)

await kavach.jwt.revokeSession(refreshToken);
await kavach.jwt.revokeAllSessions(userId);