True when no private key was configured and the keypair was generated for this process only. Tokens signed with an ephemeral key do not survive a restart and do not validate on other instances. Downstream code should ask this rather than reading the raw config value.
StaticInstanceThe Global Object Store is a place to store global objects that need to be shared across the application. Depending on the execution environment, this could be the window object in a browser, or the global object in a node environment, or something else in other contexts. The key here is that in some cases static variables are not truly shared because it is possible that a given class might have copies of its code in multiple paths in a deployed application. This approach ensures that no matter how many code copies might exist, there is only one instance of the object in question by using the Global Object Store.
Returns the JWKS document (public key set) for the JWKS endpoint.
Initializes the keypair from a provided PEM (raw or base64-encoded) or, if none is supplied, generates an ephemeral 2048-bit RSA keypair. Idempotent.
OptionalprivateKeyPem: stringprocess environment used to decide whether the ephemeral fallback is a local-dev
default (verbose-only notice) or a production misconfiguration (warning). Defaults to process.env.
Signs a set of magic-link (or local-dev) claims and returns the compact JWT.
iat/exp are expected to already be set on the claims.
Signs a redirect binding JWT (mj_purpose = 'magic-link-redirect') that cryptographically
binds a validated redirectUrl to a specific invite's tokenHash.
Note: Expiration is intentionally omitted from the redirect binding JWT because the database
invite row's ExpiresAt (enforced atomically during RedeemInvite) is the authoritative,
mutable expiration — allowing UpdateInviteExpiry() to extend an invite without invalidating
an already-delivered &rt= parameter.
Optional_expiresAtEpochSeconds: numberVerifies a redirect binding JWT produced by SignRedirectBinding and ensures it matches
expectedTokenHash (preventing cross-invite substitution) and carries a valid http(s) URL.
Ignores JWT exp so bindings minted before an UpdateInviteExpiry() extension remain valid
while the underlying invite row is valid. Returns the bound URL or null.
Verifies a magic-link session JWT signed by this key manager (RS256, mj_magic_link === true).
Returns null if invalid, expired, or forged.
Optionaloptions: { audience?: string; issuer?: string }Protected StaticgetReturns the singleton instance of the class. If the instance does not exist, it is created and stored in the Global Object Store. If className is provided it will be used as part of the key in the Global Object Store, otherwise the actual class name will be used. NOTE: the class name used by default is the lowest level of the object hierarchy, so if you have a class that extends another class, the lowest level class name will be used.
OptionalclassName: string
Manages the RS256 keypair used to sign and publish magic-link session tokens. Singleton so the keypair (and therefore the
kid) is stable for the process lifetime — restarting with an ephemeral key invalidates outstanding sessions, which is the intended dev behavior and an acceptable production key-rotation mechanism.