@idp.global/catalog 3.3.0 → 3.5.0

package/dist_ts_web/elements/idp-sso-connection-form.d.ts

@@ -8,6 +8,7 @@ export interface IIdpSsoConnectionItem {
     displayName: string;
     status: 'active' | 'disabled';
     emailDomains: string[];
+    domainVerifications?: IIdpSsoDomainVerificationItem[];
     entityId: string;
     ssoUrl: string;
     certificateCount: number;
@@ -18,6 +19,14 @@ export interface IIdpSsoConnectionItem {
         orgRoles: string[];
     }[];
 }
+export interface IIdpSsoDomainVerificationItem {
+    domain: string;
+    status: 'pending' | 'verified';
+    dnsTxtName: string;
+    dnsTxtValue: string;
+    lastCheckedAt?: number;
+    verifiedAt?: number;
+}
 export interface IIdpSsoSpDetails {
     spEntityId: string;
     acsUrl: string;
@@ -47,6 +56,10 @@ export interface IIdpSsoStatusEventDetail {
 export interface IIdpSsoDeleteEventDetail {
     connectionId: string;
 }
+export interface IIdpSsoVerifyDomainEventDetail {
+    connectionId: string;
+    domain: string;
+}
 declare global {
     interface HTMLElementTagNameMap {
         'idp-sso-connection-form': IdpSsoConnectionForm;

package/dist_ts_web/elements/idp-sso-connection-form.js

@@ -137,6 +137,21 @@ let IdpSsoConnectionForm = (() => {
                 displayName: 'Okta (acme.com)',
                 status: 'active',
                 emailDomains: ['acme.com', 'acme.io'],
+                domainVerifications: [
+                    {
+                        domain: 'acme.com',
+                        status: 'verified',
+                        dnsTxtName: '_idp-global-verification.acme.com',
+                        dnsTxtValue: 'idp-global-verification=verified-example',
+                        verifiedAt: Date.now(),
+                    },
+                    {
+                        domain: 'acme.io',
+                        status: 'pending',
+                        dnsTxtName: '_idp-global-verification.acme.io',
+                        dnsTxtValue: 'idp-global-verification=pending-example',
+                    },
+                ],
                 entityId: 'http://www.okta.com/exk9examples',
                 ssoUrl: 'https://acme.okta.com/app/xyz/sso/saml',
                 certificateCount: 1,
@@ -273,6 +288,40 @@ let IdpSsoConnectionForm = (() => {
         gap: 6px;
         margin-top: 8px;
       }
+      .domain-list {
+        display: flex;
+        flex-direction: column;
+        gap: 8px;
+        margin-top: 10px;
+      }
+      .domain-proof {
+        padding: 10px 12px;
+        border: 1px solid var(--idp-border);
+        border-radius: 9px;
+        background: var(--idp-muted);
+      }
+      .domain-proof-head {
+        display: flex;
+        align-items: center;
+        gap: 8px;
+      }
+      .domain-proof-head .table-action {
+        margin-left: auto;
+      }
+      .dns-record {
+        display: grid;
+        grid-template-columns: minmax(72px, auto) 1fr;
+        gap: 4px 10px;
+        margin-top: 8px;
+        font-size: 11px;
+      }
+      .dns-record-key {
+        color: var(--idp-muted-fg);
+      }
+      .dns-record-value {
+        font-family: var(--idp-mono, ui-monospace, monospace);
+        overflow-wrap: anywhere;
+      }
       .row-actions {
         display: flex;
         gap: 6px;
@@ -457,6 +506,7 @@ let IdpSsoConnectionForm = (() => {
             return target?.value ?? '';
         }
         renderConnectionRow(connectionArg) {
+            const domainVerifications = connectionArg.domainVerifications;
             return html `
       <div class="row">
         <div class="row-head">
@@ -492,8 +542,51 @@ let IdpSsoConnectionForm = (() => {
           </div>
         </div>
         <div class="row-meta">${connectionArg.entityId} · ${connectionArg.ssoUrl} · ${connectionArg.certificateCount} cert${connectionArg.certificateCount === 1 ? '' : 's'}</div>
+        ${domainVerifications
+                ? html `
+              <div class="domain-list">
+                ${domainVerifications.map((verificationArg) => html `
+                  <div class="domain-proof">
+                    <div class="domain-proof-head">
+                      <idp-badge variant=${verificationArg.status === 'verified' ? 'ok' : 'outline'}>
+                        @${verificationArg.domain} ${verificationArg.status}
+                      </idp-badge>
+                      ${verificationArg.status === 'pending'
+                    ? html `
+                            <button
+                              class="table-action"
+                              aria-label=${`Verify DNS for ${verificationArg.domain}`}
+                              @click=${() => this.dispatchEvent(new CustomEvent('idp-sso-verify-domain', {
+                        detail: { connectionId: connectionArg.id, domain: verificationArg.domain },
+                        bubbles: true,
+                        composed: true,
+                    }))}
+                            >
+                              Verify DNS
+                            </button>
+                          `
+                    : html ``}
+                    </div>
+                    ${verificationArg.status === 'pending' && verificationArg.dnsTxtName && verificationArg.dnsTxtValue
+                    ? html `
+                          <div class="dns-record">
+                            <span class="dns-record-key">TXT name</span>
+                            <span class="dns-record-value">${verificationArg.dnsTxtName}</span>
+                            <span class="dns-record-key">TXT value</span>
+                            <span class="dns-record-value">${verificationArg.dnsTxtValue}</span>
+                          </div>
+                        `
+                    : html ``}
+                  </div>
+                `)}
+              </div>
+            `
+                : html `
+              <div class="chip-row">
+                ${connectionArg.emailDomains.map((domainArg) => html `<idp-badge variant="accent">@${domainArg}</idp-badge>`)}
+              </div>
+            `}
         <div class="chip-row">
-          ${connectionArg.emailDomains.map((domainArg) => html `<idp-badge variant="accent">@${domainArg}</idp-badge>`)}
           ${connectionArg.groupMappings.map((mappingArg) => html `<idp-badge variant="outline">${mappingArg.idpGroup} → ${mappingArg.orgRoles.join(', ')}</idp-badge>`)}
         </div>
       </div>
@@ -600,7 +693,8 @@ let IdpSsoConnectionForm = (() => {
             <div class="title">SAML single sign-on</div>
             <div class="muted">
               Let members sign in through your organisation's identity provider. Users entering a
-              matching email domain are routed to your IdP automatically.
+              verified email domain are routed to your IdP automatically. Add the shown DNS TXT
+              record and verify ownership before account linking or just-in-time provisioning starts.
             </div>
           </div>
           ${!this.formOpen
@@ -634,4 +728,4 @@ let IdpSsoConnectionForm = (() => {
     return IdpSsoConnectionForm = _classThis;
 })();
 export { IdpSsoConnectionForm };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWRwLXNzby1jb25uZWN0aW9uLWZvcm0uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c193ZWIvZWxlbWVudHMvaWRwLXNzby1jb25uZWN0aW9uLWZvcm0udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLE9BQU8sRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLEdBQUcsRUFBdUIsTUFBTSw2QkFBNkIsQ0FBQztBQUMxSCxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDL0MsT0FBTyxnQkFBZ0IsQ0FBQztBQUN4QixPQUFPLGlCQUFpQixDQUFDO0FBQ3pCLE9BQU8sZUFBZSxDQUFDO0FBQ3ZCLE9BQU8sZ0JBQWdCLENBQUM7SUFnRFgsb0JBQW9COzRCQURoQyxhQUFhLENBQUMseUJBQXlCLENBQUM7Ozs7c0JBQ0MsV0FBVzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztvQ0FBbkIsU0FBUSxXQUFXOzs7O3VDQTZCbEQsUUFBUSxDQUFDLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDO3FDQUd6QixRQUFRLENBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUM7b0NBRzFCLEtBQUssRUFBRTtxQ0FHUCxLQUFLLEVBQUU7MkNBR1AsS0FBSyxFQUFFOzRDQUdQLEtBQUssRUFBRTsyQ0FHUCxLQUFLLEVBQUU7d0NBR1AsS0FBSyxFQUFFO3NDQUdQLEtBQUssRUFBRTsyQ0FHUCxLQUFLLEVBQUU7Z0RBR1AsS0FBSyxFQUFFOzRDQUdQLEtBQUssRUFBRTs2Q0FHUCxLQUFLLEVBQUU7cUNBR1AsS0FBSyxFQUFFO1lBdENSLHNMQUFnQixXQUFXLDZCQUFYLFdBQVcsaUdBQStCO1lBRzFELGdMQUFnQixTQUFTLDZCQUFULFNBQVMsNkZBQWlDO1lBRzFELDZLQUFpQixRQUFRLDZCQUFSLFFBQVEsMkZBQVM7WUFHbEMsZ0xBQWlCLFNBQVMsNkJBQVQsU0FBUyw2RkFBUztZQUduQyxrTUFBaUIsZUFBZSw2QkFBZixlQUFlLHlHQUFNO1lBR3RDLHFNQUFpQixnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBTTtZQUd2QyxrTUFBaUIsZUFBZSw2QkFBZixlQUFlLHlHQUFNO1lBR3RDLHlMQUFpQixZQUFZLDZCQUFaLFlBQVksbUdBQU07WUFHbkMsbUxBQWlCLFVBQVUsNkJBQVYsVUFBVSwrRkFBTTtZQUdqQyxrTUFBaUIsZUFBZSw2QkFBZixlQUFlLHlHQUFNO1lBR3RDLGlOQUFpQixvQkFBb0IsNkJBQXBCLG9CQUFvQixtSEFBK0M7WUFHcEYscU1BQWlCLGdCQUFnQiw2QkFBaEIsZ0JBQWdCLDJHQUFZO1lBRzdDLHdNQUFpQixpQkFBaUIsNkJBQWpCLGlCQUFpQiw2R0FBTTtZQUd4QyxnTEFBaUIsU0FBUyw2QkFBVCxTQUFTLDZGQUFNO1lBckVsQyw2S0F3Z0JDOzs7O1FBdmdCUSxNQUFNLENBQUMsSUFBSSxHQUFHLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQTs7O3FCQUdaO1lBQ1gsVUFBVSxFQUFFLDRDQUE0QztZQUN4RCxNQUFNLEVBQUUsb0NBQW9DO1lBQzVDLFdBQVcsRUFBRSw0Q0FBNEM7WUFDekQsV0FBVyxFQUFFLDRCQUE0QjtTQUN0Qjt1QkFDTjtZQUNiO2dCQUNFLEVBQUUsRUFBRSxRQUFRO2dCQUNaLFdBQVcsRUFBRSxpQkFBaUI7Z0JBQzlCLE1BQU0sRUFBRSxRQUFRO2dCQUNoQixZQUFZLEVBQUUsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDO2dCQUNyQyxRQUFRLEVBQUUsa0NBQWtDO2dCQUM1QyxNQUFNLEVBQUUsd0NBQXdDO2dCQUNoRCxnQkFBZ0IsRUFBRSxDQUFDO2dCQUNuQixnQkFBZ0IsRUFBRSxjQUFjO2dCQUNoQyxlQUFlLEVBQUUsQ0FBQyxRQUFRLENBQUM7Z0JBQzNCLGFBQWEsRUFBRSxDQUFDLEVBQUUsUUFBUSxFQUFFLGFBQWEsRUFBRSxRQUFRLEVBQUUsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO2FBQ3RFO1NBQ3lCOzs7R0FHakMsQ0FBQztRQUNLLE1BQU0sQ0FBQyxVQUFVLEdBQUcsQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDO1FBRzNELG1GQUF1RCxFQUFFLEVBQUM7UUFBMUQsSUFBZ0IsV0FBVyxpREFBK0I7UUFBMUQsSUFBZ0IsV0FBVyx1REFBK0I7UUFHMUQseUlBQXFELElBQUksR0FBQztRQUExRCxJQUFnQixTQUFTLCtDQUFpQztRQUExRCxJQUFnQixTQUFTLHFEQUFpQztRQUcxRCxxSUFBNEIsS0FBSyxHQUFDO1FBQWxDLElBQWlCLFFBQVEsOENBQVM7UUFBbEMsSUFBaUIsUUFBUSxvREFBUztRQUdsQyxzSUFBNkIsS0FBSyxHQUFDO1FBQW5DLElBQWlCLFNBQVMsK0NBQVM7UUFBbkMsSUFBaUIsU0FBUyxxREFBUztRQUduQyxtSkFBbUMsRUFBRSxHQUFDO1FBQXRDLElBQWlCLGVBQWUscURBQU07UUFBdEMsSUFBaUIsZUFBZSwyREFBTTtRQUd0QywySkFBb0MsRUFBRSxHQUFDO1FBQXZDLElBQWlCLGdCQUFnQixzREFBTTtRQUF2QyxJQUFpQixnQkFBZ0IsNERBQU07UUFHdkMsMEpBQW1DLEVBQUUsR0FBQztRQUF0QyxJQUFpQixlQUFlLHFEQUFNO1FBQXRDLElBQWlCLGVBQWUsMkRBQU07UUFHdEMsbUpBQWdDLEVBQUUsR0FBQztRQUFuQyxJQUFpQixZQUFZLGtEQUFNO1FBQW5DLElBQWlCLFlBQVksd0RBQU07UUFHbkMsNElBQThCLEVBQUUsR0FBQztRQUFqQyxJQUFpQixVQUFVLGdEQUFNO1FBQWpDLElBQWlCLFVBQVUsc0RBQU07UUFHakMsb0pBQW1DLEVBQUUsR0FBQztRQUF0QyxJQUFpQixlQUFlLHFEQUFNO1FBQXRDLElBQWlCLGVBQWUsMkRBQU07UUFHdEMsbUtBQThFLEtBQUssR0FBQztRQUFwRixJQUFpQixvQkFBb0IsMERBQStDO1FBQXBGLElBQWlCLG9CQUFvQixnRUFBK0M7UUFHcEYsZ0tBQW9DLFFBQVEsR0FBQztRQUE3QyxJQUFpQixnQkFBZ0Isc0RBQVk7UUFBN0MsSUFBaUIsZ0JBQWdCLDREQUFZO1FBRzdDLDhKQUFxQyxFQUFFLEdBQUM7UUFBeEMsSUFBaUIsaUJBQWlCLHVEQUFNO1FBQXhDLElBQWlCLGlCQUFpQiw2REFBTTtRQUd4QywrSUFBNkIsRUFBRSxHQUFDO1FBQWhDLElBQWlCLFNBQVMsK0NBQU07UUFBaEMsSUFBaUIsU0FBUyxxREFBTTtRQUV6QixNQUFNLENBQUMsTUFBTSxHQUFHO1lBQ3JCLEdBQUcsZ0JBQWdCO1lBQ25CLEdBQUcsQ0FBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0tBb0xGO1NBQ0YsQ0FBQztRQUVNLGtCQUFrQixDQUFDLE1BQWM7WUFDdkMsT0FBTyxNQUFNO2lCQUNWLEtBQUssQ0FBQyxJQUFJLENBQUM7aUJBQ1gsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUM7aUJBQ2hDLE1BQU0sQ0FBQyxPQUFPLENBQUM7aUJBQ2YsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUU7Z0JBQ2YsTUFBTSxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUNsRCxPQUFPO29CQUNMLFFBQVEsRUFBRSxDQUFDLFNBQVMsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUU7b0JBQ2xDLFFBQVEsRUFBRSxDQUFDLFNBQVMsSUFBSSxFQUFFLENBQUM7eUJBQ3hCLEtBQUssQ0FBQyxHQUFHLENBQUM7eUJBQ1YsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUM7eUJBQ2hDLE1BQU0sQ0FBQyxPQUFPLENBQUM7aUJBQ25CLENBQUM7WUFDSixDQUFDLENBQUM7aUJBQ0QsTUFBTSxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxVQUFVLENBQUMsUUFBUSxJQUFJLFVBQVUsQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ25GLENBQUM7UUFFTyxTQUFTLENBQUMsTUFBYztZQUM5QixPQUFPLE1BQU07aUJBQ1YsS0FBSyxDQUFDLEdBQUcsQ0FBQztpQkFDVixHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztpQkFDbEMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3JCLENBQUM7UUFFTyxZQUFZO1lBQ2xCLElBQUksQ0FBQyxTQUFTLEdBQUcsRUFBRSxDQUFDO1lBQ3BCLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDaEQsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO1lBQ3ZHLElBQUksQ0FBQyxXQUFXLElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDOUMsSUFBSSxDQUFDLFNBQVMsR0FBRywwREFBMEQsQ0FBQztnQkFDNUUsT0FBTztZQUNULENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBNkI7Z0JBQ3ZDLFdBQVc7Z0JBQ1gsWUFBWTtnQkFDWixnQkFBZ0IsRUFBRSxJQUFJLENBQUMsb0JBQW9CO2dCQUMzQyxlQUFlLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUM7Z0JBQ3RELGFBQWEsRUFBRSxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDO2FBQy9ELENBQUM7WUFDRixJQUFJLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDbkIsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDMUMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDdEMsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDaEQsSUFBSSxDQUFDLFFBQVEsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO29CQUN6QyxJQUFJLENBQUMsU0FBUyxHQUFHLDZFQUE2RSxDQUFDO29CQUMvRixPQUFPO2dCQUNULENBQUM7Z0JBQ0QsTUFBTSxDQUFDLEdBQUcsR0FBRyxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsbUJBQW1CLEVBQUUsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1lBQ3hFLENBQUM7aUJBQU0sQ0FBQztnQkFDTixNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsZUFBZSxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUNoRCxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7b0JBQ2pCLElBQUksQ0FBQyxTQUFTLEdBQUcsdURBQXVELENBQUM7b0JBQ3pFLE9BQU87Z0JBQ1QsQ0FBQztnQkFDRCxNQUFNLENBQUMsV0FBVyxHQUFHLFdBQVcsQ0FBQztZQUNuQyxDQUFDO1lBQ0QsSUFBSSxDQUFDLGFBQWEsQ0FDaEIsSUFBSSxXQUFXLENBQTJCLGdCQUFnQixFQUFFO2dCQUMxRCxNQUFNO2dCQUNOLE9BQU8sRUFBRSxJQUFJO2dCQUNiLFFBQVEsRUFBRSxJQUFJO2FBQ2YsQ0FBQyxDQUNILENBQUM7WUFDRixJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDbkIsQ0FBQztRQUVPLFNBQVM7WUFDZixJQUFJLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQztZQUN0QixJQUFJLENBQUMsU0FBUyxHQUFHLEtBQUssQ0FBQztZQUN2QixJQUFJLENBQUMsZUFBZSxHQUFHLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUMsZ0JBQWdCLEdBQUcsRUFBRSxDQUFDO1lBQzNCLElBQUksQ0FBQyxlQUFlLEdBQUcsRUFBRSxDQUFDO1lBQzFCLElBQUksQ0FBQyxZQUFZLEdBQUcsRUFBRSxDQUFDO1lBQ3ZCLElBQUksQ0FBQyxVQUFVLEdBQUcsRUFBRSxDQUFDO1lBQ3JCLElBQUksQ0FBQyxlQUFlLEdBQUcsRUFBRSxDQUFDO1lBQzFCLElBQUksQ0FBQyxvQkFBb0IsR0FBRyxLQUFLLENBQUM7WUFDbEMsSUFBSSxDQUFDLGdCQUFnQixHQUFHLFFBQVEsQ0FBQztZQUNqQyxJQUFJLENBQUMsaUJBQWlCLEdBQUcsRUFBRSxDQUFDO1lBQzVCLElBQUksQ0FBQyxTQUFTLEdBQUcsRUFBRSxDQUFDO1FBQ3RCLENBQUM7UUFFTyxTQUFTLENBQUMsUUFBZTtZQUMvQixNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsWUFBWSxFQUFFLENBQUMsQ0FBQyxDQUErRCxDQUFDO1lBQ3hHLE9BQU8sTUFBTSxFQUFFLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDN0IsQ0FBQztRQUVPLG1CQUFtQixDQUFDLGFBQW9DO1lBQzlELE9BQU8sSUFBSSxDQUFBOzs7O2NBSUQsYUFBYSxDQUFDLFdBQVc7aUNBQ04sYUFBYSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsU0FBUyxJQUFJLGFBQWEsQ0FBQyxNQUFNOzJDQUNsRSxhQUFhLENBQUMsZ0JBQWdCOzs7Ozt1QkFLbEQsR0FBRyxFQUFFLENBQ1osSUFBSSxDQUFDLGFBQWEsQ0FDaEIsSUFBSSxXQUFXLENBQTJCLGdCQUFnQixFQUFFO2dCQUMxRCxNQUFNLEVBQUU7b0JBQ04sWUFBWSxFQUFFLGFBQWEsQ0FBQyxFQUFFO29CQUM5QixNQUFNLEVBQUUsYUFBYSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsUUFBUTtpQkFDbEU7Z0JBQ0QsT0FBTyxFQUFFLElBQUk7Z0JBQ2IsUUFBUSxFQUFFLElBQUk7YUFDZixDQUFDLENBQ0g7O2dCQUVELGFBQWEsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFFBQVE7Ozs7dUJBSWpELEdBQUcsRUFBRSxDQUNaLElBQUksQ0FBQyxhQUFhLENBQ2hCLElBQUksV0FBVyxDQUEyQixnQkFBZ0IsRUFBRTtnQkFDMUQsTUFBTSxFQUFFLEVBQUUsWUFBWSxFQUFFLGFBQWEsQ0FBQyxFQUFFLEVBQUU7Z0JBQzFDLE9BQU8sRUFBRSxJQUFJO2dCQUNiLFFBQVEsRUFBRSxJQUFJO2FBQ2YsQ0FBQyxDQUNIOzs7Ozs7Z0NBTWUsYUFBYSxDQUFDLFFBQVEsTUFBTSxhQUFhLENBQUMsTUFBTSxNQUFNLGFBQWEsQ0FBQyxnQkFBZ0IsUUFBUSxhQUFhLENBQUMsZ0JBQWdCLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEdBQUc7O1lBRS9KLGFBQWEsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUEsZ0NBQWdDLFNBQVMsY0FBYyxDQUFDO1lBQzFHLGFBQWEsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUMvQixDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFBLGdDQUFnQyxVQUFVLENBQUMsUUFBUSxNQUFNLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQzFIOzs7S0FHTixDQUFDO1FBQ0osQ0FBQztRQUVPLFVBQVU7WUFDaEIsT0FBTyxJQUFJLENBQUE7Ozs7OztxQkFNTSxJQUFJLENBQUMsZUFBZTtxQkFDcEIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGVBQWUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7OztxQkFLdEUsSUFBSSxDQUFDLGdCQUFnQjtxQkFDckIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGdCQUFnQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7OztVQUdsRixJQUFJLENBQUMsU0FBUztnQkFDZCxDQUFDLENBQUMsSUFBSSxDQUFBOzs7OzsyQkFLVyxJQUFJLENBQUMsWUFBWTsyQkFDakIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7OzsyQkFLbkUsSUFBSSxDQUFDLFVBQVU7MkJBQ2YsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7Ozs7OzJCQU9qRSxJQUFJLENBQUMsZUFBZTsyQkFDcEIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGVBQWUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7YUFHcEY7Z0JBQ0gsQ0FBQyxDQUFDLElBQUksQ0FBQTs7Ozs7OzJCQU1XLElBQUksQ0FBQyxlQUFlOzJCQUNwQixDQUFDLFFBQWUsRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsZUFBZSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7OzthQUdwRjs2Q0FDZ0MsR0FBRyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsU0FBUyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUN6RSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLENBQUMsbURBQW1EOzs7Ozs7dUJBTXRGLElBQUksQ0FBQyxvQkFBb0I7d0JBQ3hCLENBQUMsUUFBZSxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBcUMsQ0FBQzs7Ozs7Ozs7OztxQkFVbEgsSUFBSSxDQUFDLGdCQUFnQjtxQkFDckIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGdCQUFnQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7Ozs7Ozs7OztxQkFTdkUsSUFBSSxDQUFDLGlCQUFpQjtxQkFDdEIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7OztVQUduRixJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUEsc0JBQXNCLElBQUksQ0FBQyxTQUFTLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFBLEVBQUU7O3lEQUUzQixHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFOzBEQUNyQixHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFOzs7S0FHOUUsQ0FBQztRQUNKLENBQUM7UUFFTSxNQUFNO1lBQ1gsT0FBTyxJQUFJLENBQUE7Ozs7Ozs7Ozs7WUFVSCxDQUFDLElBQUksQ0FBQyxRQUFRO2dCQUNkLENBQUMsQ0FBQyxJQUFJLENBQUEsaURBQWlELEdBQUcsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsOEJBQThCO2dCQUNqSCxDQUFDLENBQUMsSUFBSSxDQUFBLEVBQUU7O1VBRVYsSUFBSSxDQUFDLFNBQVM7Z0JBQ2QsQ0FBQyxDQUFDLElBQUksQ0FBQTs7aUZBRWlFLElBQUksQ0FBQyxTQUFTLENBQUMsVUFBVTs0RUFDOUIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNO2dGQUNqQixJQUFJLENBQUMsU0FBUyxDQUFDLFdBQVc7O2FBRTdGO2dCQUNILENBQUMsQ0FBQyxJQUFJLENBQUEsRUFBRTtVQUNSLElBQUksQ0FBQyxXQUFXLENBQUMsTUFBTTtnQkFDdkIsQ0FBQyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsYUFBYSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsbUJBQW1CLENBQUMsYUFBYSxDQUFDLENBQUM7Z0JBQ2xGLENBQUMsQ0FBQyxJQUFJLENBQUEsa0RBQWtEO1VBQ3hELElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFBLEVBQUU7O0tBRS9DLENBQUM7UUFDSixDQUFDOzs7Ozs7WUF2Z0JVLHVEQUFvQjs7Ozs7U0FBcEIsb0JBQW9CIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWRwLXNzby1jb25uZWN0aW9uLWZvcm0uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c193ZWIvZWxlbWVudHMvaWRwLXNzby1jb25uZWN0aW9uLWZvcm0udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLE9BQU8sRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLEdBQUcsRUFBdUIsTUFBTSw2QkFBNkIsQ0FBQztBQUMxSCxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDL0MsT0FBTyxnQkFBZ0IsQ0FBQztBQUN4QixPQUFPLGlCQUFpQixDQUFDO0FBQ3pCLE9BQU8sZUFBZSxDQUFDO0FBQ3ZCLE9BQU8sZ0JBQWdCLENBQUM7SUErRFgsb0JBQW9COzRCQURoQyxhQUFhLENBQUMseUJBQXlCLENBQUM7Ozs7c0JBQ0MsV0FBVzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztvQ0FBbkIsU0FBUSxXQUFXOzs7O3VDQTRDbEQsUUFBUSxDQUFDLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDO3FDQUd6QixRQUFRLENBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUM7b0NBRzFCLEtBQUssRUFBRTtxQ0FHUCxLQUFLLEVBQUU7MkNBR1AsS0FBSyxFQUFFOzRDQUdQLEtBQUssRUFBRTsyQ0FHUCxLQUFLLEVBQUU7d0NBR1AsS0FBSyxFQUFFO3NDQUdQLEtBQUssRUFBRTsyQ0FHUCxLQUFLLEVBQUU7Z0RBR1AsS0FBSyxFQUFFOzRDQUdQLEtBQUssRUFBRTs2Q0FHUCxLQUFLLEVBQUU7cUNBR1AsS0FBSyxFQUFFO1lBdENSLHNMQUFnQixXQUFXLDZCQUFYLFdBQVcsaUdBQStCO1lBRzFELGdMQUFnQixTQUFTLDZCQUFULFNBQVMsNkZBQWlDO1lBRzFELDZLQUFpQixRQUFRLDZCQUFSLFFBQVEsMkZBQVM7WUFHbEMsZ0xBQWlCLFNBQVMsNkJBQVQsU0FBUyw2RkFBUztZQUduQyxrTUFBaUIsZUFBZSw2QkFBZixlQUFlLHlHQUFNO1lBR3RDLHFNQUFpQixnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBTTtZQUd2QyxrTUFBaUIsZUFBZSw2QkFBZixlQUFlLHlHQUFNO1lBR3RDLHlMQUFpQixZQUFZLDZCQUFaLFlBQVksbUdBQU07WUFHbkMsbUxBQWlCLFVBQVUsNkJBQVYsVUFBVSwrRkFBTTtZQUdqQyxrTUFBaUIsZUFBZSw2QkFBZixlQUFlLHlHQUFNO1lBR3RDLGlOQUFpQixvQkFBb0IsNkJBQXBCLG9CQUFvQixtSEFBK0M7WUFHcEYscU1BQWlCLGdCQUFnQiw2QkFBaEIsZ0JBQWdCLDJHQUFZO1lBRzdDLHdNQUFpQixpQkFBaUIsNkJBQWpCLGlCQUFpQiw2R0FBTTtZQUd4QyxnTEFBaUIsU0FBUyw2QkFBVCxTQUFTLDZGQUFNO1lBcEZsQyw2S0F3bUJDOzs7O1FBdm1CUSxNQUFNLENBQUMsSUFBSSxHQUFHLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQTs7O3FCQUdaO1lBQ1gsVUFBVSxFQUFFLDRDQUE0QztZQUN4RCxNQUFNLEVBQUUsb0NBQW9DO1lBQzVDLFdBQVcsRUFBRSw0Q0FBNEM7WUFDekQsV0FBVyxFQUFFLDRCQUE0QjtTQUN0Qjt1QkFDTjtZQUNiO2dCQUNFLEVBQUUsRUFBRSxRQUFRO2dCQUNaLFdBQVcsRUFBRSxpQkFBaUI7Z0JBQzlCLE1BQU0sRUFBRSxRQUFRO2dCQUNoQixZQUFZLEVBQUUsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDO2dCQUNyQyxtQkFBbUIsRUFBRTtvQkFDbkI7d0JBQ0UsTUFBTSxFQUFFLFVBQVU7d0JBQ2xCLE1BQU0sRUFBRSxVQUFVO3dCQUNsQixVQUFVLEVBQUUsbUNBQW1DO3dCQUMvQyxXQUFXLEVBQUUsMENBQTBDO3dCQUN2RCxVQUFVLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRTtxQkFDdkI7b0JBQ0Q7d0JBQ0UsTUFBTSxFQUFFLFNBQVM7d0JBQ2pCLE1BQU0sRUFBRSxTQUFTO3dCQUNqQixVQUFVLEVBQUUsa0NBQWtDO3dCQUM5QyxXQUFXLEVBQUUseUNBQXlDO3FCQUN2RDtpQkFDRjtnQkFDRCxRQUFRLEVBQUUsa0NBQWtDO2dCQUM1QyxNQUFNLEVBQUUsd0NBQXdDO2dCQUNoRCxnQkFBZ0IsRUFBRSxDQUFDO2dCQUNuQixnQkFBZ0IsRUFBRSxjQUFjO2dCQUNoQyxlQUFlLEVBQUUsQ0FBQyxRQUFRLENBQUM7Z0JBQzNCLGFBQWEsRUFBRSxDQUFDLEVBQUUsUUFBUSxFQUFFLGFBQWEsRUFBRSxRQUFRLEVBQUUsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO2FBQ3RFO1NBQ3lCOzs7R0FHakMsQ0FBQztRQUNLLE1BQU0sQ0FBQyxVQUFVLEdBQUcsQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDO1FBRzNELG1GQUF1RCxFQUFFLEVBQUM7UUFBMUQsSUFBZ0IsV0FBVyxpREFBK0I7UUFBMUQsSUFBZ0IsV0FBVyx1REFBK0I7UUFHMUQseUlBQXFELElBQUksR0FBQztRQUExRCxJQUFnQixTQUFTLCtDQUFpQztRQUExRCxJQUFnQixTQUFTLHFEQUFpQztRQUcxRCxxSUFBNEIsS0FBSyxHQUFDO1FBQWxDLElBQWlCLFFBQVEsOENBQVM7UUFBbEMsSUFBaUIsUUFBUSxvREFBUztRQUdsQyxzSUFBNkIsS0FBSyxHQUFDO1FBQW5DLElBQWlCLFNBQVMsK0NBQVM7UUFBbkMsSUFBaUIsU0FBUyxxREFBUztRQUduQyxtSkFBbUMsRUFBRSxHQUFDO1FBQXRDLElBQWlCLGVBQWUscURBQU07UUFBdEMsSUFBaUIsZUFBZSwyREFBTTtRQUd0QywySkFBb0MsRUFBRSxHQUFDO1FBQXZDLElBQWlCLGdCQUFnQixzREFBTTtRQUF2QyxJQUFpQixnQkFBZ0IsNERBQU07UUFHdkMsMEpBQW1DLEVBQUUsR0FBQztRQUF0QyxJQUFpQixlQUFlLHFEQUFNO1FBQXRDLElBQWlCLGVBQWUsMkRBQU07UUFHdEMsbUpBQWdDLEVBQUUsR0FBQztRQUFuQyxJQUFpQixZQUFZLGtEQUFNO1FBQW5DLElBQWlCLFlBQVksd0RBQU07UUFHbkMsNElBQThCLEVBQUUsR0FBQztRQUFqQyxJQUFpQixVQUFVLGdEQUFNO1FBQWpDLElBQWlCLFVBQVUsc0RBQU07UUFHakMsb0pBQW1DLEVBQUUsR0FBQztRQUF0QyxJQUFpQixlQUFlLHFEQUFNO1FBQXRDLElBQWlCLGVBQWUsMkRBQU07UUFHdEMsbUtBQThFLEtBQUssR0FBQztRQUFwRixJQUFpQixvQkFBb0IsMERBQStDO1FBQXBGLElBQWlCLG9CQUFvQixnRUFBK0M7UUFHcEYsZ0tBQW9DLFFBQVEsR0FBQztRQUE3QyxJQUFpQixnQkFBZ0Isc0RBQVk7UUFBN0MsSUFBaUIsZ0JBQWdCLDREQUFZO1FBRzdDLDhKQUFxQyxFQUFFLEdBQUM7UUFBeEMsSUFBaUIsaUJBQWlCLHVEQUFNO1FBQXhDLElBQWlCLGlCQUFpQiw2REFBTTtRQUd4QywrSUFBNkIsRUFBRSxHQUFDO1FBQWhDLElBQWlCLFNBQVMsK0NBQU07UUFBaEMsSUFBaUIsU0FBUyxxREFBTTtRQUV6QixNQUFNLENBQUMsTUFBTSxHQUFHO1lBQ3JCLEdBQUcsZ0JBQWdCO1lBQ25CLEdBQUcsQ0FBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztLQXNORjtTQUNGLENBQUM7UUFFTSxrQkFBa0IsQ0FBQyxNQUFjO1lBQ3ZDLE9BQU8sTUFBTTtpQkFDVixLQUFLLENBQUMsSUFBSSxDQUFDO2lCQUNYLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDO2lCQUNoQyxNQUFNLENBQUMsT0FBTyxDQUFDO2lCQUNmLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFO2dCQUNmLE1BQU0sQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFDbEQsT0FBTztvQkFDTCxRQUFRLEVBQUUsQ0FBQyxTQUFTLElBQUksRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFO29CQUNsQyxRQUFRLEVBQUUsQ0FBQyxTQUFTLElBQUksRUFBRSxDQUFDO3lCQUN4QixLQUFLLENBQUMsR0FBRyxDQUFDO3lCQUNWLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDO3lCQUNoQyxNQUFNLENBQUMsT0FBTyxDQUFDO2lCQUNuQixDQUFDO1lBQ0osQ0FBQyxDQUFDO2lCQUNELE1BQU0sQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLFFBQVEsSUFBSSxVQUFVLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNuRixDQUFDO1FBRU8sU0FBUyxDQUFDLE1BQWM7WUFDOUIsT0FBTyxNQUFNO2lCQUNWLEtBQUssQ0FBQyxHQUFHLENBQUM7aUJBQ1YsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7aUJBQ2xDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNyQixDQUFDO1FBRU8sWUFBWTtZQUNsQixJQUFJLENBQUMsU0FBUyxHQUFHLEVBQUUsQ0FBQztZQUNwQixNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsZUFBZSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2hELE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztZQUN2RyxJQUFJLENBQUMsV0FBVyxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQzlDLElBQUksQ0FBQyxTQUFTLEdBQUcsMERBQTBELENBQUM7Z0JBQzVFLE9BQU87WUFDVCxDQUFDO1lBQ0QsTUFBTSxNQUFNLEdBQTZCO2dCQUN2QyxXQUFXO2dCQUNYLFlBQVk7Z0JBQ1osZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLG9CQUFvQjtnQkFDM0MsZUFBZSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDO2dCQUN0RCxhQUFhLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQzthQUMvRCxDQUFDO1lBQ0YsSUFBSSxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7Z0JBQ25CLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQzFDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQ3RDLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQ2hELElBQUksQ0FBQyxRQUFRLElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztvQkFDekMsSUFBSSxDQUFDLFNBQVMsR0FBRyw2RUFBNkUsQ0FBQztvQkFDL0YsT0FBTztnQkFDVCxDQUFDO2dCQUNELE1BQU0sQ0FBQyxHQUFHLEdBQUcsRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLG1CQUFtQixFQUFFLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUN4RSxDQUFDO2lCQUFNLENBQUM7Z0JBQ04sTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDaEQsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO29CQUNqQixJQUFJLENBQUMsU0FBUyxHQUFHLHVEQUF1RCxDQUFDO29CQUN6RSxPQUFPO2dCQUNULENBQUM7Z0JBQ0QsTUFBTSxDQUFDLFdBQVcsR0FBRyxXQUFXLENBQUM7WUFDbkMsQ0FBQztZQUNELElBQUksQ0FBQyxhQUFhLENBQ2hCLElBQUksV0FBVyxDQUEyQixnQkFBZ0IsRUFBRTtnQkFDMUQsTUFBTTtnQkFDTixPQUFPLEVBQUUsSUFBSTtnQkFDYixRQUFRLEVBQUUsSUFBSTthQUNmLENBQUMsQ0FDSCxDQUFDO1lBQ0YsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ25CLENBQUM7UUFFTyxTQUFTO1lBQ2YsSUFBSSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUM7WUFDdEIsSUFBSSxDQUFDLFNBQVMsR0FBRyxLQUFLLENBQUM7WUFDdkIsSUFBSSxDQUFDLGVBQWUsR0FBRyxFQUFFLENBQUM7WUFDMUIsSUFBSSxDQUFDLGdCQUFnQixHQUFHLEVBQUUsQ0FBQztZQUMzQixJQUFJLENBQUMsZUFBZSxHQUFHLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUMsWUFBWSxHQUFHLEVBQUUsQ0FBQztZQUN2QixJQUFJLENBQUMsVUFBVSxHQUFHLEVBQUUsQ0FBQztZQUNyQixJQUFJLENBQUMsZUFBZSxHQUFHLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUMsb0JBQW9CLEdBQUcsS0FBSyxDQUFDO1lBQ2xDLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxRQUFRLENBQUM7WUFDakMsSUFBSSxDQUFDLGlCQUFpQixHQUFHLEVBQUUsQ0FBQztZQUM1QixJQUFJLENBQUMsU0FBUyxHQUFHLEVBQUUsQ0FBQztRQUN0QixDQUFDO1FBRU8sU0FBUyxDQUFDLFFBQWU7WUFDL0IsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLFlBQVksRUFBRSxDQUFDLENBQUMsQ0FBK0QsQ0FBQztZQUN4RyxPQUFPLE1BQU0sRUFBRSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQzdCLENBQUM7UUFFTyxtQkFBbUIsQ0FBQyxhQUFvQztZQUM5RCxNQUFNLG1CQUFtQixHQUFHLGFBQWEsQ0FBQyxtQkFBbUIsQ0FBQztZQUM5RCxPQUFPLElBQUksQ0FBQTs7OztjQUlELGFBQWEsQ0FBQyxXQUFXO2lDQUNOLGFBQWEsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLFNBQVMsSUFBSSxhQUFhLENBQUMsTUFBTTsyQ0FDbEUsYUFBYSxDQUFDLGdCQUFnQjs7Ozs7dUJBS2xELEdBQUcsRUFBRSxDQUNaLElBQUksQ0FBQyxhQUFhLENBQ2hCLElBQUksV0FBVyxDQUEyQixnQkFBZ0IsRUFBRTtnQkFDMUQsTUFBTSxFQUFFO29CQUNOLFlBQVksRUFBRSxhQUFhLENBQUMsRUFBRTtvQkFDOUIsTUFBTSxFQUFFLGFBQWEsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLFFBQVE7aUJBQ2xFO2dCQUNELE9BQU8sRUFBRSxJQUFJO2dCQUNiLFFBQVEsRUFBRSxJQUFJO2FBQ2YsQ0FBQyxDQUNIOztnQkFFRCxhQUFhLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxRQUFROzs7O3VCQUlqRCxHQUFHLEVBQUUsQ0FDWixJQUFJLENBQUMsYUFBYSxDQUNoQixJQUFJLFdBQVcsQ0FBMkIsZ0JBQWdCLEVBQUU7Z0JBQzFELE1BQU0sRUFBRSxFQUFFLFlBQVksRUFBRSxhQUFhLENBQUMsRUFBRSxFQUFFO2dCQUMxQyxPQUFPLEVBQUUsSUFBSTtnQkFDYixRQUFRLEVBQUUsSUFBSTthQUNmLENBQUMsQ0FDSDs7Ozs7O2dDQU1lLGFBQWEsQ0FBQyxRQUFRLE1BQU0sYUFBYSxDQUFDLE1BQU0sTUFBTSxhQUFhLENBQUMsZ0JBQWdCLFFBQVEsYUFBYSxDQUFDLGdCQUFnQixLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHO1VBQ2pLLG1CQUFtQjtnQkFDbkIsQ0FBQyxDQUFDLElBQUksQ0FBQTs7a0JBRUUsbUJBQW1CLENBQUMsR0FBRyxDQUFDLENBQUMsZUFBZSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUE7OzsyQ0FHeEIsZUFBZSxDQUFDLE1BQU0sS0FBSyxVQUFVLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsU0FBUzsyQkFDeEUsZUFBZSxDQUFDLE1BQU0sSUFBSSxlQUFlLENBQUMsTUFBTTs7d0JBRW5ELGVBQWUsQ0FBQyxNQUFNLEtBQUssU0FBUztvQkFDcEMsQ0FBQyxDQUFDLElBQUksQ0FBQTs7OzJDQUdhLGtCQUFrQixlQUFlLENBQUMsTUFBTSxFQUFFO3VDQUM5QyxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUMvQixJQUFJLFdBQVcsQ0FBaUMsdUJBQXVCLEVBQUU7d0JBQ3ZFLE1BQU0sRUFBRSxFQUFFLFlBQVksRUFBRSxhQUFhLENBQUMsRUFBRSxFQUFFLE1BQU0sRUFBRSxlQUFlLENBQUMsTUFBTSxFQUFFO3dCQUMxRSxPQUFPLEVBQUUsSUFBSTt3QkFDYixRQUFRLEVBQUUsSUFBSTtxQkFDZixDQUFDLENBQ0g7Ozs7MkJBSUo7b0JBQ0gsQ0FBQyxDQUFDLElBQUksQ0FBQSxFQUFFOztzQkFFVixlQUFlLENBQUMsTUFBTSxLQUFLLFNBQVMsSUFBSSxlQUFlLENBQUMsVUFBVSxJQUFJLGVBQWUsQ0FBQyxXQUFXO29CQUNqRyxDQUFDLENBQUMsSUFBSSxDQUFBOzs7NkRBR2lDLGVBQWUsQ0FBQyxVQUFVOzs2REFFMUIsZUFBZSxDQUFDLFdBQVc7O3lCQUUvRDtvQkFDSCxDQUFDLENBQUMsSUFBSSxDQUFBLEVBQUU7O2lCQUViLENBQUM7O2FBRUw7Z0JBQ0gsQ0FBQyxDQUFDLElBQUksQ0FBQTs7a0JBRUUsYUFBYSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQSxnQ0FBZ0MsU0FBUyxjQUFjLENBQUM7O2FBRS9HOztZQUVELGFBQWEsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUMvQixDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFBLGdDQUFnQyxVQUFVLENBQUMsUUFBUSxNQUFNLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQzFIOzs7S0FHTixDQUFDO1FBQ0osQ0FBQztRQUVPLFVBQVU7WUFDaEIsT0FBTyxJQUFJLENBQUE7Ozs7OztxQkFNTSxJQUFJLENBQUMsZUFBZTtxQkFDcEIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGVBQWUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7OztxQkFLdEUsSUFBSSxDQUFDLGdCQUFnQjtxQkFDckIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGdCQUFnQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7OztVQUdsRixJQUFJLENBQUMsU0FBUztnQkFDZCxDQUFDLENBQUMsSUFBSSxDQUFBOzs7OzsyQkFLVyxJQUFJLENBQUMsWUFBWTsyQkFDakIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7OzsyQkFLbkUsSUFBSSxDQUFDLFVBQVU7MkJBQ2YsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7Ozs7OzJCQU9qRSxJQUFJLENBQUMsZUFBZTsyQkFDcEIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGVBQWUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7YUFHcEY7Z0JBQ0gsQ0FBQyxDQUFDLElBQUksQ0FBQTs7Ozs7OzJCQU1XLElBQUksQ0FBQyxlQUFlOzJCQUNwQixDQUFDLFFBQWUsRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsZUFBZSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7OzthQUdwRjs2Q0FDZ0MsR0FBRyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsU0FBUyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUN6RSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLENBQUMsbURBQW1EOzs7Ozs7dUJBTXRGLElBQUksQ0FBQyxvQkFBb0I7d0JBQ3hCLENBQUMsUUFBZSxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBcUMsQ0FBQzs7Ozs7Ozs7OztxQkFVbEgsSUFBSSxDQUFDLGdCQUFnQjtxQkFDckIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGdCQUFnQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7Ozs7Ozs7OztxQkFTdkUsSUFBSSxDQUFDLGlCQUFpQjtxQkFDdEIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7OztVQUduRixJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUEsc0JBQXNCLElBQUksQ0FBQyxTQUFTLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFBLEVBQUU7O3lEQUUzQixHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFOzBEQUNyQixHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFOzs7S0FHOUUsQ0FBQztRQUNKLENBQUM7UUFFTSxNQUFNO1lBQ1gsT0FBTyxJQUFJLENBQUE7Ozs7Ozs7Ozs7O1lBV0gsQ0FBQyxJQUFJLENBQUMsUUFBUTtnQkFDZCxDQUFDLENBQUMsSUFBSSxDQUFBLGlEQUFpRCxHQUFHLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDLDhCQUE4QjtnQkFDakgsQ0FBQyxDQUFDLElBQUksQ0FBQSxFQUFFOztVQUVWLElBQUksQ0FBQyxTQUFTO2dCQUNkLENBQUMsQ0FBQyxJQUFJLENBQUE7O2lGQUVpRSxJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVU7NEVBQzlCLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTTtnRkFDakIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxXQUFXOzthQUU3RjtnQkFDSCxDQUFDLENBQUMsSUFBSSxDQUFBLEVBQUU7VUFDUixJQUFJLENBQUMsV0FBVyxDQUFDLE1BQU07Z0JBQ3ZCLENBQUMsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLGFBQWEsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLGFBQWEsQ0FBQyxDQUFDO2dCQUNsRixDQUFDLENBQUMsSUFBSSxDQUFBLGtEQUFrRDtVQUN4RCxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQSxFQUFFOztLQUUvQyxDQUFDO1FBQ0osQ0FBQzs7Ozs7O1lBdm1CVSx1REFBb0I7Ozs7O1NBQXBCLG9CQUFvQiJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idp.global/catalog",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "private": false,
   "description": "Web component catalog for idp.global, based on the v5 Apple-system design language.",
   "exports": {
@@ -23,7 +23,7 @@
     "@git.zone/tsbundle": "^2.11.0",
     "@git.zone/tswatch": "^3.3.5",
     "@push.rocks/projectinfo": "^5.1.0",
-    "@types/node": "^25.9.0"
+    "@types/node": "^25.9.4"
   },
   "files": [
     "ts_web/**/*",

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@idp.global/catalog',
-  version: '3.3.0',
+  version: '3.5.0',
   description: 'Web component catalog for idp.global, based on the v5 Apple-system design language.'
 }

package/ts_web/elements/idp-admin-shell.ts

@@ -94,6 +94,19 @@ export interface IIdpAdminGaUserActionEventDetail {
   action: 'suspend' | 'unsuspend';
 }
 
+export interface IIdpAdminGaUserDeleteEventDetail {
+  userId: string;
+}
+
+export interface IIdpAdminAccountDeleteEventDetail {
+  password: string;
+  confirmEmail: string;
+}
+
+export interface IIdpAdminOrgExportEventDetail {
+  orgId: string;
+}
+
 export interface IIdpAdminProfileUpdateEventDetail {
   name: string;
   username: string;
@@ -1036,6 +1049,23 @@ export class IdpAdminShell extends DeesElement {
   @property({ type: Boolean })
   public accessor profileSaving = false;
 
+  /** shows the account danger zone (delete account) on the profile page */
+  @property({ type: Boolean })
+  public accessor dangerZoneEnabled = false;
+
+  /** host sets this while the delete-account request is in flight */
+  @property({ type: Boolean })
+  public accessor accountDeleting = false;
+
+  @state()
+  private accessor deleteAccountOpen = false;
+
+  @state()
+  private accessor deleteAccountPassword = '';
+
+  @state()
+  private accessor deleteAccountConfirmEmail = '';
+
   @state()
   private accessor profileDraft: { name: string; username: string; mobileNumber: string } | null = null;
 
@@ -1943,6 +1973,20 @@ export class IdpAdminShell extends DeesElement {
             : html``}
         `)}
         ${this.renderSectionCard('Account status', '', html`<div class="split-row"><div><div class="section-title">Status</div><div class="muted">Your account is currently ${status}.</div></div><idp-badge variant=${status === 'active' ? 'ok' : status === 'suspended' ? 'error' : 'warn'}>${status}</idp-badge></div>${this.globalAdmin ? html`<div class="divider"></div><div class="split-row"><div><div class="section-title">Global admin</div><div class="muted">You have platform-wide administrative access.</div></div><idp-badge variant="accent">Admin</idp-badge></div>` : html``}`)}
+        ${this.dangerZoneEnabled
+          ? this.renderSectionCard('Danger zone', 'Deleting your account locks it immediately and permanently erases it after a 7-day grace period.', html`
+              ${this.deleteAccountOpen
+                ? html`
+                    ${this.renderFormRow('Confirm your email', 'Type your account email to confirm', html`<input class="input" .value=${this.deleteAccountConfirmEmail} ?disabled=${this.accountDeleting} @input=${(eventArg: Event) => { this.deleteAccountConfirmEmail = (eventArg.target as HTMLInputElement).value; }} />`, true)}
+                    ${this.renderFormRow('Password', 'Required when your account has one', html`<input class="input" type="password" autocomplete="current-password" .value=${this.deleteAccountPassword} ?disabled=${this.accountDeleting} @input=${(eventArg: Event) => { this.deleteAccountPassword = (eventArg.target as HTMLInputElement).value; }} />`)}
+                    <div class="split-row" style="justify-content:flex-end;gap:10px;margin-top:14px">
+                      <idp-button variant="outline" shape="rect" ?disabled=${this.accountDeleting} @click=${() => { this.deleteAccountOpen = false; this.deleteAccountPassword = ''; this.deleteAccountConfirmEmail = ''; }}>Cancel</idp-button>
+                      <idp-button variant="accent" shape="rect" ?loading=${this.accountDeleting} ?disabled=${this.deleteAccountConfirmEmail.trim().toLowerCase() !== (this.user?.email || '').trim().toLowerCase()} @click=${() => this.dispatchShellEvent<IIdpAdminAccountDeleteEventDetail>('idp-admin-account-delete', { password: this.deleteAccountPassword, confirmEmail: this.deleteAccountConfirmEmail.trim() })}>Delete my account</idp-button>
+                    </div>
+                  `
+                : html`<div class="split-row"><div><div class="section-title">Delete this account</div><div class="muted">Organisations you own must be transferred or deleted first.</div></div><idp-button variant="outline" shape="rect" @click=${() => { this.deleteAccountOpen = true; }}>Delete account…</idp-button></div>`}
+            `)
+          : html``}
         ${this.delegationApps.length
           ? html`<idp-delegation-section .apps=${this.delegationApps} .delegations=${this.delegations}></idp-delegation-section>`
           : html``}
@@ -2214,6 +2258,7 @@ export class IdpAdminShell extends DeesElement {
           <button class="plain-button primary" ?disabled=${!identityChanged} @click=${() => this.submitOrgSettingsUpdate()}>Apply identity changes</button>
         `)}
         ${this.renderSectionCard('Organisation ID', 'Use this identifier when making API calls.', this.renderCodeBlock(org.id))}
+        ${this.renderSectionCard('Data export', 'Download all organisation data (members, invitations, SSO configuration, activity) as JSON. Owner only.', html`<div class="split-row"><div><div class="section-title">Export organisation data</div><div class="muted">Streams every record; token secrets and credentials are never included.</div></div><idp-button variant="outline" shape="rect" @click=${() => this.dispatchShellEvent<IIdpAdminOrgExportEventDetail>('idp-admin-org-export', { orgId: org.id })}>Export JSON</idp-button></div>`)}
         ${this.renderSectionCard('Transfer ownership', `Owner-only operation. Type ${transferConfirmText} to confirm.`, html`
           ${transferCandidates.length ? html`
             ${this.renderFormRow('New owner', 'The target user must already be an organisation member.', html`
@@ -2447,7 +2492,12 @@ export class IdpAdminShell extends DeesElement {
         html`<idp-badge variant=${statusVariant(userArg.status)}>${userArg.status}</idp-badge>`,
         userArg.isGlobalAdmin ? html`<idp-badge variant="accent">Admin</idp-badge>` : '-',
         this.formatTimeAgo(userArg.createdAt),
-        html`<button class="plain-button ghost" style="font-size:11px" @click=${() => this.dispatchShellEvent<IIdpAdminGaUserActionEventDetail>('idp-admin-ga-user-action', { userId: userArg.id, action: userArg.status === 'suspended' ? 'unsuspend' : 'suspend' })}>${userArg.status === 'suspended' ? 'Unsuspend' : 'Suspend'}</button>`,
+        html`<span style="display:inline-flex;gap:8px">
+          <button class="plain-button ghost" style="font-size:11px" @click=${() => this.dispatchShellEvent<IIdpAdminGaUserActionEventDetail>('idp-admin-ga-user-action', { userId: userArg.id, action: userArg.status === 'suspended' ? 'unsuspend' : 'suspend' })}>${userArg.status === 'suspended' ? 'Unsuspend' : 'Suspend'}</button>
+          ${userArg.status === 'suspended'
+            ? html`<button class="plain-button ghost" style="font-size:11px;color:#d70015" @click=${() => this.dispatchShellEvent<IIdpAdminGaUserDeleteEventDetail>('idp-admin-ga-user-delete', { userId: userArg.id })}>Delete permanently</button>`
+            : html``}
+        </span>`,
       ],
     }));
 

package/ts_web/elements/idp-sso-connection-form.ts

@@ -10,6 +10,7 @@ export interface IIdpSsoConnectionItem {
   displayName: string;
   status: 'active' | 'disabled';
   emailDomains: string[];
+  domainVerifications?: IIdpSsoDomainVerificationItem[];
   entityId: string;
   ssoUrl: string;
   certificateCount: number;
@@ -18,6 +19,15 @@ export interface IIdpSsoConnectionItem {
   groupMappings: { idpGroup: string; orgRoles: string[] }[];
 }
 
+export interface IIdpSsoDomainVerificationItem {
+  domain: string;
+  status: 'pending' | 'verified';
+  dnsTxtName: string;
+  dnsTxtValue: string;
+  lastCheckedAt?: number;
+  verifiedAt?: number;
+}
+
 export interface IIdpSsoSpDetails {
   spEntityId: string;
   acsUrl: string;
@@ -44,6 +54,11 @@ export interface IIdpSsoDeleteEventDetail {
   connectionId: string;
 }
 
+export interface IIdpSsoVerifyDomainEventDetail {
+  connectionId: string;
+  domain: string;
+}
+
 declare global {
   interface HTMLElementTagNameMap {
     'idp-sso-connection-form': IdpSsoConnectionForm;
@@ -67,6 +82,21 @@ export class IdpSsoConnectionForm extends DeesElement {
             displayName: 'Okta (acme.com)',
             status: 'active',
             emailDomains: ['acme.com', 'acme.io'],
+            domainVerifications: [
+              {
+                domain: 'acme.com',
+                status: 'verified',
+                dnsTxtName: '_idp-global-verification.acme.com',
+                dnsTxtValue: 'idp-global-verification=verified-example',
+                verifiedAt: Date.now(),
+              },
+              {
+                domain: 'acme.io',
+                status: 'pending',
+                dnsTxtName: '_idp-global-verification.acme.io',
+                dnsTxtValue: 'idp-global-verification=pending-example',
+              },
+            ],
             entityId: 'http://www.okta.com/exk9examples',
             ssoUrl: 'https://acme.okta.com/app/xyz/sso/saml',
             certificateCount: 1,
@@ -204,6 +234,40 @@ export class IdpSsoConnectionForm extends DeesElement {
         gap: 6px;
         margin-top: 8px;
       }
+      .domain-list {
+        display: flex;
+        flex-direction: column;
+        gap: 8px;
+        margin-top: 10px;
+      }
+      .domain-proof {
+        padding: 10px 12px;
+        border: 1px solid var(--idp-border);
+        border-radius: 9px;
+        background: var(--idp-muted);
+      }
+      .domain-proof-head {
+        display: flex;
+        align-items: center;
+        gap: 8px;
+      }
+      .domain-proof-head .table-action {
+        margin-left: auto;
+      }
+      .dns-record {
+        display: grid;
+        grid-template-columns: minmax(72px, auto) 1fr;
+        gap: 4px 10px;
+        margin-top: 8px;
+        font-size: 11px;
+      }
+      .dns-record-key {
+        color: var(--idp-muted-fg);
+      }
+      .dns-record-value {
+        font-family: var(--idp-mono, ui-monospace, monospace);
+        overflow-wrap: anywhere;
+      }
       .row-actions {
         display: flex;
         gap: 6px;
@@ -395,6 +459,7 @@ export class IdpSsoConnectionForm extends DeesElement {
   }
 
   private renderConnectionRow(connectionArg: IIdpSsoConnectionItem): TemplateResult {
+    const domainVerifications = connectionArg.domainVerifications;
     return html`
       <div class="row">
         <div class="row-head">
@@ -436,8 +501,53 @@ export class IdpSsoConnectionForm extends DeesElement {
           </div>
         </div>
         <div class="row-meta">${connectionArg.entityId} · ${connectionArg.ssoUrl} · ${connectionArg.certificateCount} cert${connectionArg.certificateCount === 1 ? '' : 's'}</div>
+        ${domainVerifications
+          ? html`
+              <div class="domain-list">
+                ${domainVerifications.map((verificationArg) => html`
+                  <div class="domain-proof">
+                    <div class="domain-proof-head">
+                      <idp-badge variant=${verificationArg.status === 'verified' ? 'ok' : 'outline'}>
+                        @${verificationArg.domain} ${verificationArg.status}
+                      </idp-badge>
+                      ${verificationArg.status === 'pending'
+                        ? html`
+                            <button
+                              class="table-action"
+                              aria-label=${`Verify DNS for ${verificationArg.domain}`}
+                              @click=${() => this.dispatchEvent(
+                                new CustomEvent<IIdpSsoVerifyDomainEventDetail>('idp-sso-verify-domain', {
+                                  detail: { connectionId: connectionArg.id, domain: verificationArg.domain },
+                                  bubbles: true,
+                                  composed: true,
+                                }),
+                              )}
+                            >
+                              Verify DNS
+                            </button>
+                          `
+                        : html``}
+                    </div>
+                    ${verificationArg.status === 'pending' && verificationArg.dnsTxtName && verificationArg.dnsTxtValue
+                      ? html`
+                          <div class="dns-record">
+                            <span class="dns-record-key">TXT name</span>
+                            <span class="dns-record-value">${verificationArg.dnsTxtName}</span>
+                            <span class="dns-record-key">TXT value</span>
+                            <span class="dns-record-value">${verificationArg.dnsTxtValue}</span>
+                          </div>
+                        `
+                      : html``}
+                  </div>
+                `)}
+              </div>
+            `
+          : html`
+              <div class="chip-row">
+                ${connectionArg.emailDomains.map((domainArg) => html`<idp-badge variant="accent">@${domainArg}</idp-badge>`)}
+              </div>
+            `}
         <div class="chip-row">
-          ${connectionArg.emailDomains.map((domainArg) => html`<idp-badge variant="accent">@${domainArg}</idp-badge>`)}
           ${connectionArg.groupMappings.map(
             (mappingArg) => html`<idp-badge variant="outline">${mappingArg.idpGroup} → ${mappingArg.orgRoles.join(', ')}</idp-badge>`,
           )}
@@ -548,7 +658,8 @@ export class IdpSsoConnectionForm extends DeesElement {
             <div class="title">SAML single sign-on</div>
             <div class="muted">
               Let members sign in through your organisation's identity provider. Users entering a
-              matching email domain are routed to your IdP automatically.
+              verified email domain are routed to your IdP automatically. Add the shown DNS TXT
+              record and verify ownership before account linking or just-in-time provisioning starts.
             </div>
           </div>
           ${!this.formOpen