@tula-tech/contract 0.1.1 → 0.3.0

package/dist/shared/{chunk-cce3bhet.js → chunk-5r2ka03q.js}

@@ -49,6 +49,22 @@ var ERROR_DEFINITIONS2 = {
     status: 409,
     message: 'This account has no password yet. Use "forgot password" to set one.'
   },
+  "import.unsupported_algorithm": {
+    status: 422,
+    message: "That password hash algorithm is not supported."
+  },
+  "import.hash_malformed": {
+    status: 422,
+    message: "That password hash is malformed."
+  },
+  "import.hash_parameters_too_weak": {
+    status: 422,
+    message: "That password hash is too weak to import."
+  },
+  "import.hash_parameters_too_costly": {
+    status: 422,
+    message: "That password hash is too costly to verify."
+  },
   "verification.invalid_code": { status: 422, message: "That code is incorrect." },
   "verification.expired": { status: 410, message: "That code has expired. Request a new one." },
   "verification.too_many_attempts": {
@@ -214,6 +230,182 @@ var ERROR_DEFINITIONS2 = {
     status: 400,
     message: "Signing in here needs a device key."
   },
+  "user.last_organization_manager": {
+    status: 409,
+    message: "This user is the only manager of an organization. Add another manager or delete the organization first."
+  },
+  "user.managed": {
+    status: 403,
+    message: "This account is managed by your organization. Ask your administrator to change it."
+  },
+  "organization.disabled": {
+    status: 403,
+    message: "Organizations are not enabled for this environment."
+  },
+  "organization.slug_taken": {
+    status: 409,
+    message: "An organization with that slug already exists."
+  },
+  "organization.member_exists": {
+    status: 409,
+    message: "That user is already a member of this organization."
+  },
+  "organization.last_manager": {
+    status: 409,
+    message: "An organization must keep at least one member who can manage its members."
+  },
+  "organization.role_unknown": {
+    status: 422,
+    message: "That role does not exist in this environment."
+  },
+  "organization.not_a_member": {
+    status: 403,
+    message: "You are not a member of that organization."
+  },
+  "organization.creation_disabled": {
+    status: 403,
+    message: "Creating an organization is not allowed in this environment."
+  },
+  "organization.limit_reached": {
+    status: 403,
+    message: "You have reached the number of organizations you can create."
+  },
+  "organization.personal_account_disabled": {
+    status: 409,
+    message: "An organization must be active in this environment."
+  },
+  "organization.role_exists": {
+    status: 409,
+    message: "A role with that key already exists in this environment."
+  },
+  "organization.role_in_use": {
+    status: 409,
+    message: "Members still hold this role. Give them another role first."
+  },
+  "organization.role_built_in": {
+    status: 409,
+    message: "A built-in role cannot be changed or deleted."
+  },
+  "organization.role_limit": {
+    status: 409,
+    message: "This environment has the most custom roles it can have."
+  },
+  "organization.permission_required": {
+    status: 403,
+    message: "Your role does not allow that."
+  },
+  "organization.role_not_assignable": {
+    status: 403,
+    message: "You can only invite to a role no stronger than yours."
+  },
+  "organization.invitation_exists": {
+    status: 409,
+    message: "That address already has a pending invitation."
+  },
+  "organization.invitation_not_found": {
+    status: 404,
+    message: "This invitation does not exist."
+  },
+  "organization.invitation_expired": {
+    status: 410,
+    message: "This invitation has expired."
+  },
+  "organization.invitation_revoked": {
+    status: 410,
+    message: "This invitation was withdrawn."
+  },
+  "organization.invitation_used": {
+    status: 410,
+    message: "This invitation was already used."
+  },
+  "organization.invitation_wrong_account": {
+    status: 403,
+    message: "This invitation was sent to another email address."
+  },
+  "organization.invitation_email_unverified": {
+    status: 403,
+    message: "Verify your email address to accept this invitation."
+  },
+  "organization.invitation_role_gone": {
+    status: 409,
+    message: "The role this invitation offers no longer exists."
+  },
+  "organization.domain_public": {
+    status: 422,
+    message: "A public email domain cannot be claimed by an organization."
+  },
+  "organization.domain_taken": {
+    status: 409,
+    message: "That domain is verified for an organization already."
+  },
+  "organization.domain_address_mismatch": {
+    status: 422,
+    message: "That address is not on the domain."
+  },
+  "organization.domain_limit": {
+    status: 409,
+    message: "This organization has the most domains it can have."
+  },
+  "organization.suggestion_unavailable": {
+    status: 403,
+    message: "You cannot join that organization."
+  },
+  "sso.disabled": {
+    status: 403,
+    message: "Single sign-on is not enabled for this environment."
+  },
+  "sso.connection_not_found": { status: 404, message: "No such single sign-on connection." },
+  "sso.name_taken": {
+    status: 409,
+    message: "The organization already has a connection with that name."
+  },
+  "sso.domain_taken": {
+    status: 409,
+    message: "Another active connection already serves one of those domains."
+  },
+  "sso.domain_not_verified": {
+    status: 422,
+    message: "Every domain must be one of the organization's verified domains."
+  },
+  "sso.issuer_not_allowed": {
+    status: 422,
+    message: "The issuer is not an address the server may call."
+  },
+  "sso.saml_invalid": {
+    status: 422,
+    message: "The SAML settings could not be read or are incomplete."
+  },
+  "sso.connection_in_use": {
+    status: 409,
+    message: "The connection is active; disable it before deleting it."
+  },
+  "sso.invalid_transition": {
+    status: 409,
+    message: "A connection cannot move to that status from its current one."
+  },
+  "sso.url_not_https": {
+    status: 422,
+    message: "The identity provider’s sign-in address must start with https."
+  },
+  "sso.test_required": {
+    status: 409,
+    message: "Run a passing test sign-in of the connection’s current settings before activating it."
+  },
+  "sso.test_not_found": { status: 404, message: "No such test sign-in." },
+  "sso.role_not_allowed": {
+    status: 403,
+    message: "A setup link cannot map a group to a role that holds system permissions."
+  },
+  "sso.unavailable": { status: 400, message: "Single sign-on is not available for that address." },
+  "sso.provider_error": { status: 401, message: "The identity provider did not sign you in." },
+  "sso.user_not_provisioned": {
+    status: 403,
+    message: "Your account has not been set up for this organization. Ask its administrator."
+  },
+  "sso.email_domain_mismatch": {
+    status: 403,
+    message: "Your email address is not on this connection's domains."
+  },
   rate_limited: { status: 429, message: "Too many requests. Try again shortly." },
   "request.malformed": { status: 400, message: "The request could not be read." },
   "request.too_large": { status: 413, message: "The request body is too large." },

package/dist/shared/{chunk-7yqzghgm.js → chunk-bsea97tx.js}

@@ -1,6 +1,7 @@
 // src/event-types.ts
 var ACTIVITY_TYPES2 = [
   "user.created",
+  "user.imported",
   "user.email_verified",
   "user.banned",
   "user.unbanned",
@@ -12,6 +13,7 @@ var ACTIVITY_TYPES2 = [
   "user.backup_code_used",
   "user.identity_linked",
   "user.identity_unlinked",
+  "user.sso_linked",
   "user.email_added",
   "user.passkey_added",
   "user.passkey_renamed",
@@ -44,16 +46,48 @@ var ACTIVITY_TYPES2 = [
   "native_app.created",
   "native_app.updated",
   "native_app.deleted",
+  "sso_connection.created",
+  "sso_connection.updated",
+  "sso_connection.deleted",
+  "scim_token.created",
+  "scim_token.revoked",
+  "setup_link.created",
+  "setup_link.revoked",
+  "user.scim_provisioned",
+  "user.scim_updated",
+  "scim_group.created",
+  "scim_group.updated",
+  "scim_group.deleted",
+  "organization.created",
+  "organization.updated",
+  "organization.deleted",
+  "organization_membership.added",
+  "organization_membership.role_changed",
+  "organization_membership.removed",
+  "organization_role.created",
+  "organization_role.updated",
+  "organization_role.deleted",
+  "organization_domain.claimed",
+  "organization_domain.verified",
+  "organization_domain.updated",
+  "organization_domain.removed",
+  "organization_invitation.created",
+  "organization_invitation.accepted",
+  "organization_invitation.declined",
+  "organization_invitation.revoked",
   "proposal.created",
   "proposal.approved",
+  "proposal.rejected",
   "proposal.executed",
   "proposal.failed",
+  "audit.exported",
   "sign_in_test.started",
   "sign_in_test.finished"
 ];
 var EVENT_SCHEMA_VERSION2 = 1;
 var EVENT_TARGET_TYPES2 = {
   "user.created": "user",
+  "user.imported": "user",
   "user.email_verified": "user",
   "user.banned": "user",
   "user.unbanned": "user",
@@ -66,6 +100,7 @@ var EVENT_TARGET_TYPES2 = {
   "user.identity_linked": "user",
   "user.email_added": "user",
   "user.identity_unlinked": "user",
+  "user.sso_linked": "user",
   "user.passkey_added": "user",
   "user.passkey_renamed": "user",
   "user.passkey_removed": "user",
@@ -97,10 +132,41 @@ var EVENT_TARGET_TYPES2 = {
   "native_app.created": "native_app",
   "native_app.updated": "native_app",
   "native_app.deleted": "native_app",
+  "sso_connection.created": "sso_connection",
+  "sso_connection.updated": "sso_connection",
+  "sso_connection.deleted": "sso_connection",
+  "scim_token.created": "scim_token",
+  "scim_token.revoked": "scim_token",
+  "setup_link.created": "setup_link",
+  "setup_link.revoked": "setup_link",
+  "user.scim_provisioned": "user",
+  "user.scim_updated": "user",
+  "scim_group.created": "scim_group",
+  "scim_group.updated": "scim_group",
+  "scim_group.deleted": "scim_group",
+  "organization.created": "organization",
+  "organization.updated": "organization",
+  "organization.deleted": "organization",
+  "organization_membership.added": "organization_membership",
+  "organization_membership.role_changed": "organization_membership",
+  "organization_membership.removed": "organization_membership",
+  "organization_role.created": "organization_role",
+  "organization_role.updated": "organization_role",
+  "organization_role.deleted": "organization_role",
+  "organization_domain.claimed": "organization_domain",
+  "organization_domain.verified": "organization_domain",
+  "organization_domain.updated": "organization_domain",
+  "organization_domain.removed": "organization_domain",
+  "organization_invitation.created": "organization_invitation",
+  "organization_invitation.accepted": "organization_invitation",
+  "organization_invitation.declined": "organization_invitation",
+  "organization_invitation.revoked": "organization_invitation",
   "proposal.created": "proposal",
   "proposal.approved": "proposal",
+  "proposal.rejected": "proposal",
   "proposal.executed": "proposal",
   "proposal.failed": "proposal",
+  "audit.exported": "environment",
   "sign_in_test.started": "environment",
   "sign_in_test.finished": "environment"
 };

package/dist/shared/chunk-cdg41bxh.js

@@ -0,0 +1,151 @@
+// src/organization-domain-rules.ts
+var MAX_DOMAIN_LENGTH2 = 253;
+var MAX_DOMAIN_LABEL_LENGTH2 = 63;
+var MIN_DOMAIN_LENGTH2 = 4;
+var MAX_DOMAINS_PER_ORGANIZATION2 = 10;
+var DOMAIN_VERIFICATION_LIFETIME_DAYS2 = 365;
+var DOMAIN_REMINDER_DAYS2 = [30, 7];
+var DOMAIN_REVERIFICATION_GRACE_DAYS2 = 30;
+var ORGANIZATION_DOMAIN_STATUSES2 = ["pending", "verified", "needs_reverification"];
+var ORGANIZATION_DOMAIN_MODES2 = ["suggest", "auto_join"];
+var DOMAIN_PATTERN2 = /^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+(?:[a-z]{2,}|xn--[a-z0-9-]*[a-z0-9])$/;
+var PUBLIC_EMAIL_DOMAINS2 = [
+  "gmail.com",
+  "googlemail.com",
+  "outlook.com",
+  "hotmail.com",
+  "live.com",
+  "msn.com",
+  "passport.com",
+  "icloud.com",
+  "me.com",
+  "mac.com",
+  "proton.me",
+  "protonmail.com",
+  "protonmail.ch",
+  "pm.me",
+  "aol.com",
+  "aim.com",
+  "ymail.com",
+  "rocketmail.com",
+  "duck.com",
+  "privaterelay.appleid.com",
+  "simplelogin.com",
+  "simplelogin.co",
+  "aleeas.com",
+  "slmail.me",
+  "anonaddy.com",
+  "anonaddy.me",
+  "addy.io",
+  "mozmail.com",
+  "relay.firefox.com",
+  "passmail.net",
+  "passinbox.com",
+  "mailinator.com",
+  "guerrillamail.com",
+  "guerrillamail.net",
+  "10minutemail.com",
+  "tempmail.com",
+  "temp-mail.org",
+  "yopmail.com",
+  "sharklasers.com",
+  "trashmail.com",
+  "getnada.com",
+  "maildrop.cc",
+  "mail.com",
+  "email.com",
+  "zoho.com",
+  "zohomail.com",
+  "fastmail.com",
+  "fastmail.fm",
+  "hey.com",
+  "tutanota.com",
+  "tutanota.de",
+  "tutamail.com",
+  "tuta.io",
+  "tuta.com",
+  "hushmail.com",
+  "yandex.com",
+  "yandex.ru",
+  "ya.ru",
+  "mail.ru",
+  "inbox.ru",
+  "list.ru",
+  "bk.ru",
+  "gmx.com",
+  "gmx.net",
+  "gmx.de",
+  "gmx.at",
+  "gmx.ch",
+  "web.de",
+  "freenet.de",
+  "t-online.de",
+  "posteo.de",
+  "mailbox.org",
+  "runbox.com",
+  "comcast.net",
+  "verizon.net",
+  "att.net",
+  "sbcglobal.net",
+  "bellsouth.net",
+  "cox.net",
+  "charter.net",
+  "earthlink.net",
+  "btinternet.com",
+  "virginmedia.com",
+  "sky.com",
+  "talktalk.net",
+  "orange.fr",
+  "wanadoo.fr",
+  "free.fr",
+  "laposte.net",
+  "sfr.fr",
+  "libero.it",
+  "virgilio.it",
+  "tiscali.it",
+  "wp.pl",
+  "o2.pl",
+  "onet.pl",
+  "interia.pl",
+  "seznam.cz",
+  "rediffmail.com",
+  "qq.com",
+  "163.com",
+  "126.com",
+  "sina.com",
+  "naver.com",
+  "daum.net",
+  "hanmail.net"
+];
+var PUBLIC_EMAIL_BRANDS2 = [
+  "yahoo",
+  "hotmail",
+  "outlook",
+  "live",
+  "gmail",
+  "icloud",
+  "protonmail"
+];
+var PUBLIC_DOMAINS = new Set(PUBLIC_EMAIL_DOMAINS2);
+var BRAND_PATTERN = new RegExp(`^(?:${PUBLIC_EMAIL_BRANDS2.join("|")})\\.(?:(?:co|com|net|org|ne|or|ac|gov|edu)\\.)?[a-z]{2,}$`);
+function isPublicEmailDomain2(domain) {
+  return PUBLIC_DOMAINS.has(domain) || BRAND_PATTERN.test(domain);
+}
+function domainRefusal2(domain) {
+  if (domain.length > 2 * MAX_DOMAIN_LENGTH2 || !DOMAIN_PATTERN2.test(domain)) {
+    return "grammar";
+  }
+  if (domain.length > MAX_DOMAIN_LENGTH2 || domain.length < MIN_DOMAIN_LENGTH2 || domain.split(".").some((label) => label.length > MAX_DOMAIN_LABEL_LENGTH2)) {
+    return "length";
+  }
+  return isPublicEmailDomain2(domain) ? "public" : null;
+}
+function domainOfAddress2(address) {
+  const at = address.lastIndexOf("@");
+  if (at < 1 || at === address.length - 1) {
+    return null;
+  }
+  return address.slice(at + 1);
+}
+
+export { MAX_DOMAIN_LENGTH2, MAX_DOMAIN_LABEL_LENGTH2, MIN_DOMAIN_LENGTH2, MAX_DOMAINS_PER_ORGANIZATION2, DOMAIN_VERIFICATION_LIFETIME_DAYS2, DOMAIN_REMINDER_DAYS2, DOMAIN_REVERIFICATION_GRACE_DAYS2, ORGANIZATION_DOMAIN_STATUSES2, ORGANIZATION_DOMAIN_MODES2, DOMAIN_PATTERN2, PUBLIC_EMAIL_DOMAINS2, PUBLIC_EMAIL_BRANDS2, isPublicEmailDomain2, domainRefusal2, domainOfAddress2 };

package/dist/shared/{chunk-4rb5jsfz.js → chunk-fkx6fc8e.js}

@@ -1,5 +1,15 @@
+import {
+  MAX_PERMISSION_KEY_LENGTH2,
+  ROLE_KEY_PATTERN2,
+  PERMISSION_KEY_PATTERN2
+} from "./chunk-yzgakhtb.js";
+
 // src/custom-claims.ts
 var CUSTOM_CLAIMS_CLAIM2 = "ext";
+var ORGANIZATION_ID_CLAIM2 = "org_id";
+var SSO_CONNECTION_CLAIM2 = "sso_conn";
+var ORGANIZATION_ROLE_CLAIM2 = "org_role";
+var ORGANIZATION_PERMISSIONS_CLAIM2 = "org_perms";
 var RESERVED_CLAIM_NAMES2 = [
   "iss",
   "sub",
@@ -16,9 +26,59 @@ var RESERVED_CLAIM_NAMES2 = [
   "amr",
   "sp",
   "cnf",
+  ORGANIZATION_ID_CLAIM2,
+  ORGANIZATION_ROLE_CLAIM2,
+  ORGANIZATION_PERMISSIONS_CLAIM2,
+  SSO_CONNECTION_CLAIM2,
   CUSTOM_CLAIMS_CLAIM2
 ];
 var MAX_CUSTOM_CLAIMS_BYTES2 = 1024;
+var MAX_ORGANIZATION_CLAIMS_BYTES2 = 2560;
+var MAX_ORGANIZATION_PERMISSIONS_CLAIM2 = 32;
+function organizationClaimsBytes2(claims) {
+  return utf8Length(JSON.stringify({
+    [ORGANIZATION_ID_CLAIM2]: claims.orgId,
+    [ORGANIZATION_ROLE_CLAIM2]: claims.orgRole,
+    [ORGANIZATION_PERMISSIONS_CLAIM2]: claims.orgPermissions
+  }));
+}
+var ORGANIZATION_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+function readOrganizationClaims2(claims) {
+  if (typeof claims !== "object" || claims === null) {
+    return null;
+  }
+  const record = claims;
+  const [id, role, permissions] = [
+    record[ORGANIZATION_ID_CLAIM2],
+    record[ORGANIZATION_ROLE_CLAIM2],
+    record[ORGANIZATION_PERMISSIONS_CLAIM2]
+  ];
+  if (typeof id !== "string" || !ORGANIZATION_ID_PATTERN.test(id) || typeof role !== "string" || !ROLE_KEY_PATTERN2.test(role) || !Array.isArray(permissions) || permissions.length > MAX_ORGANIZATION_PERMISSIONS_CLAIM2 || !permissions.every((permission) => typeof permission === "string" && permission.length <= MAX_PERMISSION_KEY_LENGTH2 && PERMISSION_KEY_PATTERN2.test(permission))) {
+    return null;
+  }
+  const read = Object.freeze({
+    orgId: id,
+    orgRole: role,
+    orgPermissions: Object.freeze([...permissions])
+  });
+  return organizationClaimsBytes2(read) > MAX_ORGANIZATION_CLAIMS_BYTES2 ? null : read;
+}
+function hasOrganizationAccess2(claims, check) {
+  if (!claims || typeof check !== "object" || check === null) {
+    return false;
+  }
+  const { permission, role } = check;
+  if (permission !== undefined && role !== undefined) {
+    return false;
+  }
+  if (typeof permission === "string" && permission !== "") {
+    return claims.orgPermissions.includes(permission);
+  }
+  if (typeof role === "string" && role !== "") {
+    return claims.orgRole === role;
+  }
+  return false;
+}
 var MAX_JWT_TEMPLATES2 = 10;
 var MAX_JWT_TEMPLATE_CLAIMS2 = 16;
 var MAX_CUSTOM_CLAIM_KEY_LENGTH2 = 32;
@@ -99,4 +159,4 @@ function readCustomClaims2(claims) {
   return customClaimsBytes2(read) <= MAX_CUSTOM_CLAIMS_BYTES2 ? Object.freeze(read) : null;
 }
 
-export { CUSTOM_CLAIMS_CLAIM2, RESERVED_CLAIM_NAMES2, MAX_CUSTOM_CLAIMS_BYTES2, MAX_JWT_TEMPLATES2, MAX_JWT_TEMPLATE_CLAIMS2, MAX_CUSTOM_CLAIM_KEY_LENGTH2, MAX_CUSTOM_CLAIM_CONSTANT_LENGTH2, isCustomClaimKey2, isCustomClaimValue2, customClaimsBytes2, checkCustomClaims2, readCustomClaims2 };
+export { CUSTOM_CLAIMS_CLAIM2, ORGANIZATION_ID_CLAIM2, SSO_CONNECTION_CLAIM2, ORGANIZATION_ROLE_CLAIM2, ORGANIZATION_PERMISSIONS_CLAIM2, RESERVED_CLAIM_NAMES2, MAX_CUSTOM_CLAIMS_BYTES2, MAX_ORGANIZATION_CLAIMS_BYTES2, MAX_ORGANIZATION_PERMISSIONS_CLAIM2, organizationClaimsBytes2, readOrganizationClaims2, hasOrganizationAccess2, MAX_JWT_TEMPLATES2, MAX_JWT_TEMPLATE_CLAIMS2, MAX_CUSTOM_CLAIM_KEY_LENGTH2, MAX_CUSTOM_CLAIM_CONSTANT_LENGTH2, isCustomClaimKey2, isCustomClaimValue2, customClaimsBytes2, checkCustomClaims2, readCustomClaims2 };

package/dist/shared/{chunk-pcn6ax54.js → chunk-g0ddvjqg.js}

@@ -35,44 +35,44 @@ var THEME_TOKENS2 = [
 var DEFAULT_THEME2 = {
   light: {
     background: "#ffffff",
-    surface: "#f5f4f0",
+    surface: "#f1efe8",
     input: "#ffffff",
-    text: "#17171c",
-    textMuted: "#5c5a55",
-    primary: "#5b4cf0",
-    primaryHover: "#4a3bdc",
-    primaryText: "#ffffff",
+    text: "#1a1a18",
+    textMuted: "#5f5e5a",
+    primary: "#1a1a18",
+    primaryHover: "#3a3935",
+    primaryText: "#f1efe8",
     link: "#4a3bdc",
-    border: "#e3e0d8",
+    border: "#d9d6cb",
     borderStrong: "#8a877e",
     danger: "#b42318",
-    dangerSurface: "#fdecea",
+    dangerSurface: "#fcefec",
     success: "#1a6b3c",
-    focus: "#5b4cf0",
-    overlay: "rgba(23, 23, 28, 0.55)",
-    shadow: "0 1px 2px rgba(23, 23, 28, 0.06), 0 12px 32px rgba(23, 23, 28, 0.1)"
+    focus: "#4a3bdc",
+    overlay: "rgba(26, 26, 24, 0.55)",
+    shadow: "0 1px 2px rgba(26, 26, 24, 0.05), 0 8px 24px rgba(26, 26, 24, 0.08)"
   },
   dark: {
-    background: "#17171c",
-    surface: "#202128",
-    input: "#101014",
-    text: "#f4f4f6",
-    textMuted: "#a9a9b4",
-    primary: "#8f84ff",
-    primaryHover: "#a59cff",
-    primaryText: "#121117",
-    link: "#aaa2ff",
-    border: "#2e2f39",
-    borderStrong: "#74758a",
-    danger: "#ff8a80",
-    dangerSurface: "#3a1a1c",
-    success: "#6fd49a",
-    focus: "#aaa2ff",
+    background: "#1c1c19",
+    surface: "#232320",
+    input: "#141412",
+    text: "#f1efe8",
+    textMuted: "#b0ada2",
+    primary: "#f1efe8",
+    primaryHover: "#ffffff",
+    primaryText: "#141412",
+    link: "#a69dff",
+    border: "#34332e",
+    borderStrong: "#7a776d",
+    danger: "#ff8a7a",
+    dangerSurface: "#3a1f1b",
+    success: "#5fcb8a",
+    focus: "#a69dff",
     overlay: "rgba(0, 0, 0, 0.65)",
-    shadow: "0 1px 2px rgba(0, 0, 0, 0.4), 0 12px 32px rgba(0, 0, 0, 0.5)"
+    shadow: "0 1px 2px rgba(0, 0, 0, 0.4), 0 16px 40px rgba(0, 0, 0, 0.5)"
   },
-  radius: "12px",
-  radiusSmall: "8px",
+  radius: "10px",
+  radiusSmall: "6px",
   fontFamily: 'ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif',
   fontFamilyMono: 'ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace',
   fontSize: "0.9375rem",

package/dist/shared/{chunk-r202nxfw.js → chunk-n1jdq72m.js}

@@ -27,13 +27,17 @@ var EMAIL_TEMPLATE_KINDS2 = [
   "identity_linked",
   "identity_unlinked",
   "email_in_use",
-  "email_added"
+  "email_added",
+  "organization_domain_verification",
+  "organization_domain_expiring",
+  "organization_invitation"
 ];
 var EMAIL_TEMPLATE_PLACEHOLDERS2 = [
   "appName",
   "code",
   "link",
   "expiresInMinutes",
+  "expiresInDays",
   "device",
   "time",
   "provider",
@@ -42,6 +46,7 @@ var EMAIL_TEMPLATE_PLACEHOLDERS2 = [
 var EMAIL_TEMPLATE_DIGIT_PLACEHOLDERS2 = [
   "code",
   "expiresInMinutes",
+  "expiresInDays",
   "time",
   "backupCodesLeft"
 ];
@@ -84,7 +89,14 @@ var EMAIL_TEMPLATE_RULES2 = {
   identity_linked: { ...NOTICE, optional: ["appName", "time", "provider"] },
   identity_unlinked: { ...NOTICE, optional: ["appName", "time", "provider"] },
   email_in_use: DECOY,
-  email_added: NOTICE
+  email_added: NOTICE,
+  organization_domain_verification: CODE,
+  organization_domain_expiring: { ...NOTICE, optional: ["appName", "expiresInDays"] },
+  organization_invitation: {
+    category: "invitation",
+    required: ["link"],
+    optional: ["appName", "expiresInDays"]
+  }
 };
 var MAX_EMAIL_SUBJECT_LENGTH2 = 200;
 var MAX_EMAIL_BODY_LENGTH2 = 2000;
@@ -235,7 +247,7 @@ function fieldProblems(kind, field, text) {
   if (readsAsLink2(withStandIns(tokens))) {
     problems.push(problem("reads_as_link", "must not contain a link, an address or a domain name (put a space after a full stop)"));
   }
-  if (rules.category === "notice" && field === "subject" && /^\p{Nd}/u.test(visibleEmailText2(withLeadingStandIns(tokens)))) {
+  if (rules.category !== "code" && field === "subject" && /^\p{Nd}/u.test(visibleEmailText2(withLeadingStandIns(tokens)))) {
     problems.push(problem("leading_digit", "the subject of a notice must not start with a digit, or with a placeholder that is always a number or a time"));
   }
   return problems;
@@ -385,6 +397,9 @@ function webKindOf(value) {
   if (url.username !== "" || url.password !== "" || url.hash !== "") {
     return null;
   }
+  if (value.includes("#")) {
+    return null;
+  }
   if (url.protocol === "https:") {
     return "https";
   }