Found while building cadeom's config-JWT endpoint against UOA, verified in UOA source rather than inferred from behaviour.
Three constraints enforced in schema and absent from the guide:
session.access_token_ttl_minutes is int().min(15).max(60). The 60-minute ceiling is undocumented. (long_refresh_token_ttl_days is 1–90.)org_features.org_roles must contain "owner" — a zod .refine, not mentioned anywhere.PublicRsaJwkSchema is .passthrough(), so extra JWK members are accepted; only d,p,q,dp,dq,qi,oth are rejected. The guide describes the key shape as exact members only, which is stricter than reality.
Each is only discoverable by having a config JWT rejected and reading the source.
Ask: put the numeric bounds and the required role in the config reference.
Found while building cadeom's config-JWT endpoint against UOA, verified in UOA source rather than inferred from behaviour.
Three constraints enforced in schema and absent from the guide:
session.access_token_ttl_minutesisint().min(15).max(60). The 60-minute ceiling is undocumented. (long_refresh_token_ttl_daysis 1–90.)org_features.org_rolesmust contain"owner"— a zod.refine, not mentioned anywhere.PublicRsaJwkSchemais.passthrough(), so extra JWK members are accepted; onlyd,p,q,dp,dq,qi,othare rejected. The guide describes the key shape as exact members only, which is stricter than reality.Each is only discoverable by having a config JWT rejected and reading the source.
Ask: put the numeric bounds and the required role in the config reference.