@idp.global/catalog 3.4.0 → 3.5.0

package/dist_ts_web/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@idp.global/catalog',
-    version: '3.4.0',
+    version: '3.5.0',
     description: 'Web component catalog for idp.global, based on the v5 Apple-system design language.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfd2ViLzAwX2NvbW1pdGluZm9fZGF0YS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRztJQUN4QixJQUFJLEVBQUUscUJBQXFCO0lBQzNCLE9BQU8sRUFBRSxPQUFPO0lBQ2hCLFdBQVcsRUFBRSxxRkFBcUY7Q0FDbkcsQ0FBQSJ9

package/dist_ts_web/elements/idp-sso-connection-form.d.ts

@@ -8,6 +8,7 @@ export interface IIdpSsoConnectionItem {
     displayName: string;
     status: 'active' | 'disabled';
     emailDomains: string[];
+    domainVerifications?: IIdpSsoDomainVerificationItem[];
     entityId: string;
     ssoUrl: string;
     certificateCount: number;
@@ -18,6 +19,14 @@ export interface IIdpSsoConnectionItem {
         orgRoles: string[];
     }[];
 }
+export interface IIdpSsoDomainVerificationItem {
+    domain: string;
+    status: 'pending' | 'verified';
+    dnsTxtName: string;
+    dnsTxtValue: string;
+    lastCheckedAt?: number;
+    verifiedAt?: number;
+}
 export interface IIdpSsoSpDetails {
     spEntityId: string;
     acsUrl: string;
@@ -47,6 +56,10 @@ export interface IIdpSsoStatusEventDetail {
 export interface IIdpSsoDeleteEventDetail {
     connectionId: string;
 }
+export interface IIdpSsoVerifyDomainEventDetail {
+    connectionId: string;
+    domain: string;
+}
 declare global {
     interface HTMLElementTagNameMap {
         'idp-sso-connection-form': IdpSsoConnectionForm;

package/dist_ts_web/elements/idp-sso-connection-form.js

@@ -137,6 +137,21 @@ let IdpSsoConnectionForm = (() => {
                 displayName: 'Okta (acme.com)',
                 status: 'active',
                 emailDomains: ['acme.com', 'acme.io'],
+                domainVerifications: [
+                    {
+                        domain: 'acme.com',
+                        status: 'verified',
+                        dnsTxtName: '_idp-global-verification.acme.com',
+                        dnsTxtValue: 'idp-global-verification=verified-example',
+                        verifiedAt: Date.now(),
+                    },
+                    {
+                        domain: 'acme.io',
+                        status: 'pending',
+                        dnsTxtName: '_idp-global-verification.acme.io',
+                        dnsTxtValue: 'idp-global-verification=pending-example',
+                    },
+                ],
                 entityId: 'http://www.okta.com/exk9examples',
                 ssoUrl: 'https://acme.okta.com/app/xyz/sso/saml',
                 certificateCount: 1,
@@ -273,6 +288,40 @@ let IdpSsoConnectionForm = (() => {
         gap: 6px;
         margin-top: 8px;
       }
+      .domain-list {
+        display: flex;
+        flex-direction: column;
+        gap: 8px;
+        margin-top: 10px;
+      }
+      .domain-proof {
+        padding: 10px 12px;
+        border: 1px solid var(--idp-border);
+        border-radius: 9px;
+        background: var(--idp-muted);
+      }
+      .domain-proof-head {
+        display: flex;
+        align-items: center;
+        gap: 8px;
+      }
+      .domain-proof-head .table-action {
+        margin-left: auto;
+      }
+      .dns-record {
+        display: grid;
+        grid-template-columns: minmax(72px, auto) 1fr;
+        gap: 4px 10px;
+        margin-top: 8px;
+        font-size: 11px;
+      }
+      .dns-record-key {
+        color: var(--idp-muted-fg);
+      }
+      .dns-record-value {
+        font-family: var(--idp-mono, ui-monospace, monospace);
+        overflow-wrap: anywhere;
+      }
       .row-actions {
         display: flex;
         gap: 6px;
@@ -457,6 +506,7 @@ let IdpSsoConnectionForm = (() => {
             return target?.value ?? '';
         }
         renderConnectionRow(connectionArg) {
+            const domainVerifications = connectionArg.domainVerifications;
             return html `
       <div class="row">
         <div class="row-head">
@@ -492,8 +542,51 @@ let IdpSsoConnectionForm = (() => {
           </div>
         </div>
         <div class="row-meta">${connectionArg.entityId} · ${connectionArg.ssoUrl} · ${connectionArg.certificateCount} cert${connectionArg.certificateCount === 1 ? '' : 's'}</div>
+        ${domainVerifications
+                ? html `
+              <div class="domain-list">
+                ${domainVerifications.map((verificationArg) => html `
+                  <div class="domain-proof">
+                    <div class="domain-proof-head">
+                      <idp-badge variant=${verificationArg.status === 'verified' ? 'ok' : 'outline'}>
+                        @${verificationArg.domain} ${verificationArg.status}
+                      </idp-badge>
+                      ${verificationArg.status === 'pending'
+                    ? html `
+                            <button
+                              class="table-action"
+                              aria-label=${`Verify DNS for ${verificationArg.domain}`}
+                              @click=${() => this.dispatchEvent(new CustomEvent('idp-sso-verify-domain', {
+                        detail: { connectionId: connectionArg.id, domain: verificationArg.domain },
+                        bubbles: true,
+                        composed: true,
+                    }))}
+                            >
+                              Verify DNS
+                            </button>
+                          `
+                    : html ``}
+                    </div>
+                    ${verificationArg.status === 'pending' && verificationArg.dnsTxtName && verificationArg.dnsTxtValue
+                    ? html `
+                          <div class="dns-record">
+                            <span class="dns-record-key">TXT name</span>
+                            <span class="dns-record-value">${verificationArg.dnsTxtName}</span>
+                            <span class="dns-record-key">TXT value</span>
+                            <span class="dns-record-value">${verificationArg.dnsTxtValue}</span>
+                          </div>
+                        `
+                    : html ``}
+                  </div>
+                `)}
+              </div>
+            `
+                : html `
+              <div class="chip-row">
+                ${connectionArg.emailDomains.map((domainArg) => html `<idp-badge variant="accent">@${domainArg}</idp-badge>`)}
+              </div>
+            `}
         <div class="chip-row">
-          ${connectionArg.emailDomains.map((domainArg) => html `<idp-badge variant="accent">@${domainArg}</idp-badge>`)}
           ${connectionArg.groupMappings.map((mappingArg) => html `<idp-badge variant="outline">${mappingArg.idpGroup} → ${mappingArg.orgRoles.join(', ')}</idp-badge>`)}
         </div>
       </div>
@@ -600,7 +693,8 @@ let IdpSsoConnectionForm = (() => {
             <div class="title">SAML single sign-on</div>
             <div class="muted">
               Let members sign in through your organisation's identity provider. Users entering a
-              matching email domain are routed to your IdP automatically.
+              verified email domain are routed to your IdP automatically. Add the shown DNS TXT
+              record and verify ownership before account linking or just-in-time provisioning starts.
             </div>
           </div>
           ${!this.formOpen
@@ -634,4 +728,4 @@ let IdpSsoConnectionForm = (() => {
     return IdpSsoConnectionForm = _classThis;
 })();
 export { IdpSsoConnectionForm };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWRwLXNzby1jb25uZWN0aW9uLWZvcm0uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c193ZWIvZWxlbWVudHMvaWRwLXNzby1jb25uZWN0aW9uLWZvcm0udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLE9BQU8sRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLEdBQUcsRUFBdUIsTUFBTSw2QkFBNkIsQ0FBQztBQUMxSCxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDL0MsT0FBTyxnQkFBZ0IsQ0FBQztBQUN4QixPQUFPLGlCQUFpQixDQUFDO0FBQ3pCLE9BQU8sZUFBZSxDQUFDO0FBQ3ZCLE9BQU8sZ0JBQWdCLENBQUM7SUFnRFgsb0JBQW9COzRCQURoQyxhQUFhLENBQUMseUJBQXlCLENBQUM7Ozs7c0JBQ0MsV0FBVzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztvQ0FBbkIsU0FBUSxXQUFXOzs7O3VDQTZCbEQsUUFBUSxDQUFDLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDO3FDQUd6QixRQUFRLENBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUM7b0NBRzFCLEtBQUssRUFBRTtxQ0FHUCxLQUFLLEVBQUU7MkNBR1AsS0FBSyxFQUFFOzRDQUdQLEtBQUssRUFBRTsyQ0FHUCxLQUFLLEVBQUU7d0NBR1AsS0FBSyxFQUFFO3NDQUdQLEtBQUssRUFBRTsyQ0FHUCxLQUFLLEVBQUU7Z0RBR1AsS0FBSyxFQUFFOzRDQUdQLEtBQUssRUFBRTs2Q0FHUCxLQUFLLEVBQUU7cUNBR1AsS0FBSyxFQUFFO1lBdENSLHNMQUFnQixXQUFXLDZCQUFYLFdBQVcsaUdBQStCO1lBRzFELGdMQUFnQixTQUFTLDZCQUFULFNBQVMsNkZBQWlDO1lBRzFELDZLQUFpQixRQUFRLDZCQUFSLFFBQVEsMkZBQVM7WUFHbEMsZ0xBQWlCLFNBQVMsNkJBQVQsU0FBUyw2RkFBUztZQUduQyxrTUFBaUIsZUFBZSw2QkFBZixlQUFlLHlHQUFNO1lBR3RDLHFNQUFpQixnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBTTtZQUd2QyxrTUFBaUIsZUFBZSw2QkFBZixlQUFlLHlHQUFNO1lBR3RDLHlMQUFpQixZQUFZLDZCQUFaLFlBQVksbUdBQU07WUFHbkMsbUxBQWlCLFVBQVUsNkJBQVYsVUFBVSwrRkFBTTtZQUdqQyxrTUFBaUIsZUFBZSw2QkFBZixlQUFlLHlHQUFNO1lBR3RDLGlOQUFpQixvQkFBb0IsNkJBQXBCLG9CQUFvQixtSEFBK0M7WUFHcEYscU1BQWlCLGdCQUFnQiw2QkFBaEIsZ0JBQWdCLDJHQUFZO1lBRzdDLHdNQUFpQixpQkFBaUIsNkJBQWpCLGlCQUFpQiw2R0FBTTtZQUd4QyxnTEFBaUIsU0FBUyw2QkFBVCxTQUFTLDZGQUFNO1lBckVsQyw2S0F3Z0JDOzs7O1FBdmdCUSxNQUFNLENBQUMsSUFBSSxHQUFHLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQTs7O3FCQUdaO1lBQ1gsVUFBVSxFQUFFLDRDQUE0QztZQUN4RCxNQUFNLEVBQUUsb0NBQW9DO1lBQzVDLFdBQVcsRUFBRSw0Q0FBNEM7WUFDekQsV0FBVyxFQUFFLDRCQUE0QjtTQUN0Qjt1QkFDTjtZQUNiO2dCQUNFLEVBQUUsRUFBRSxRQUFRO2dCQUNaLFdBQVcsRUFBRSxpQkFBaUI7Z0JBQzlCLE1BQU0sRUFBRSxRQUFRO2dCQUNoQixZQUFZLEVBQUUsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDO2dCQUNyQyxRQUFRLEVBQUUsa0NBQWtDO2dCQUM1QyxNQUFNLEVBQUUsd0NBQXdDO2dCQUNoRCxnQkFBZ0IsRUFBRSxDQUFDO2dCQUNuQixnQkFBZ0IsRUFBRSxjQUFjO2dCQUNoQyxlQUFlLEVBQUUsQ0FBQyxRQUFRLENBQUM7Z0JBQzNCLGFBQWEsRUFBRSxDQUFDLEVBQUUsUUFBUSxFQUFFLGFBQWEsRUFBRSxRQUFRLEVBQUUsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO2FBQ3RFO1NBQ3lCOzs7R0FHakMsQ0FBQztRQUNLLE1BQU0sQ0FBQyxVQUFVLEdBQUcsQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDO1FBRzNELG1GQUF1RCxFQUFFLEVBQUM7UUFBMUQsSUFBZ0IsV0FBVyxpREFBK0I7UUFBMUQsSUFBZ0IsV0FBVyx1REFBK0I7UUFHMUQseUlBQXFELElBQUksR0FBQztRQUExRCxJQUFnQixTQUFTLCtDQUFpQztRQUExRCxJQUFnQixTQUFTLHFEQUFpQztRQUcxRCxxSUFBNEIsS0FBSyxHQUFDO1FBQWxDLElBQWlCLFFBQVEsOENBQVM7UUFBbEMsSUFBaUIsUUFBUSxvREFBUztRQUdsQyxzSUFBNkIsS0FBSyxHQUFDO1FBQW5DLElBQWlCLFNBQVMsK0NBQVM7UUFBbkMsSUFBaUIsU0FBUyxxREFBUztRQUduQyxtSkFBbUMsRUFBRSxHQUFDO1FBQXRDLElBQWlCLGVBQWUscURBQU07UUFBdEMsSUFBaUIsZUFBZSwyREFBTTtRQUd0QywySkFBb0MsRUFBRSxHQUFDO1FBQXZDLElBQWlCLGdCQUFnQixzREFBTTtRQUF2QyxJQUFpQixnQkFBZ0IsNERBQU07UUFHdkMsMEpBQW1DLEVBQUUsR0FBQztRQUF0QyxJQUFpQixlQUFlLHFEQUFNO1FBQXRDLElBQWlCLGVBQWUsMkRBQU07UUFHdEMsbUpBQWdDLEVBQUUsR0FBQztRQUFuQyxJQUFpQixZQUFZLGtEQUFNO1FBQW5DLElBQWlCLFlBQVksd0RBQU07UUFHbkMsNElBQThCLEVBQUUsR0FBQztRQUFqQyxJQUFpQixVQUFVLGdEQUFNO1FBQWpDLElBQWlCLFVBQVUsc0RBQU07UUFHakMsb0pBQW1DLEVBQUUsR0FBQztRQUF0QyxJQUFpQixlQUFlLHFEQUFNO1FBQXRDLElBQWlCLGVBQWUsMkRBQU07UUFHdEMsbUtBQThFLEtBQUssR0FBQztRQUFwRixJQUFpQixvQkFBb0IsMERBQStDO1FBQXBGLElBQWlCLG9CQUFvQixnRUFBK0M7UUFHcEYsZ0tBQW9DLFFBQVEsR0FBQztRQUE3QyxJQUFpQixnQkFBZ0Isc0RBQVk7UUFBN0MsSUFBaUIsZ0JBQWdCLDREQUFZO1FBRzdDLDhKQUFxQyxFQUFFLEdBQUM7UUFBeEMsSUFBaUIsaUJBQWlCLHVEQUFNO1FBQXhDLElBQWlCLGlCQUFpQiw2REFBTTtRQUd4QywrSUFBNkIsRUFBRSxHQUFDO1FBQWhDLElBQWlCLFNBQVMsK0NBQU07UUFBaEMsSUFBaUIsU0FBUyxxREFBTTtRQUV6QixNQUFNLENBQUMsTUFBTSxHQUFHO1lBQ3JCLEdBQUcsZ0JBQWdCO1lBQ25CLEdBQUcsQ0FBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0tBb0xGO1NBQ0YsQ0FBQztRQUVNLGtCQUFrQixDQUFDLE1BQWM7WUFDdkMsT0FBTyxNQUFNO2lCQUNWLEtBQUssQ0FBQyxJQUFJLENBQUM7aUJBQ1gsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUM7aUJBQ2hDLE1BQU0sQ0FBQyxPQUFPLENBQUM7aUJBQ2YsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUU7Z0JBQ2YsTUFBTSxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUNsRCxPQUFPO29CQUNMLFFBQVEsRUFBRSxDQUFDLFNBQVMsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUU7b0JBQ2xDLFFBQVEsRUFBRSxDQUFDLFNBQVMsSUFBSSxFQUFFLENBQUM7eUJBQ3hCLEtBQUssQ0FBQyxHQUFHLENBQUM7eUJBQ1YsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUM7eUJBQ2hDLE1BQU0sQ0FBQyxPQUFPLENBQUM7aUJBQ25CLENBQUM7WUFDSixDQUFDLENBQUM7aUJBQ0QsTUFBTSxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxVQUFVLENBQUMsUUFBUSxJQUFJLFVBQVUsQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ25GLENBQUM7UUFFTyxTQUFTLENBQUMsTUFBYztZQUM5QixPQUFPLE1BQU07aUJBQ1YsS0FBSyxDQUFDLEdBQUcsQ0FBQztpQkFDVixHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztpQkFDbEMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3JCLENBQUM7UUFFTyxZQUFZO1lBQ2xCLElBQUksQ0FBQyxTQUFTLEdBQUcsRUFBRSxDQUFDO1lBQ3BCLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDaEQsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO1lBQ3ZHLElBQUksQ0FBQyxXQUFXLElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDOUMsSUFBSSxDQUFDLFNBQVMsR0FBRywwREFBMEQsQ0FBQztnQkFDNUUsT0FBTztZQUNULENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBNkI7Z0JBQ3ZDLFdBQVc7Z0JBQ1gsWUFBWTtnQkFDWixnQkFBZ0IsRUFBRSxJQUFJLENBQUMsb0JBQW9CO2dCQUMzQyxlQUFlLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUM7Z0JBQ3RELGFBQWEsRUFBRSxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDO2FBQy9ELENBQUM7WUFDRixJQUFJLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDbkIsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDMUMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDdEMsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDaEQsSUFBSSxDQUFDLFFBQVEsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO29CQUN6QyxJQUFJLENBQUMsU0FBUyxHQUFHLDZFQUE2RSxDQUFDO29CQUMvRixPQUFPO2dCQUNULENBQUM7Z0JBQ0QsTUFBTSxDQUFDLEdBQUcsR0FBRyxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsbUJBQW1CLEVBQUUsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1lBQ3hFLENBQUM7aUJBQU0sQ0FBQztnQkFDTixNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsZUFBZSxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUNoRCxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7b0JBQ2pCLElBQUksQ0FBQyxTQUFTLEdBQUcsdURBQXVELENBQUM7b0JBQ3pFLE9BQU87Z0JBQ1QsQ0FBQztnQkFDRCxNQUFNLENBQUMsV0FBVyxHQUFHLFdBQVcsQ0FBQztZQUNuQyxDQUFDO1lBQ0QsSUFBSSxDQUFDLGFBQWEsQ0FDaEIsSUFBSSxXQUFXLENBQTJCLGdCQUFnQixFQUFFO2dCQUMxRCxNQUFNO2dCQUNOLE9BQU8sRUFBRSxJQUFJO2dCQUNiLFFBQVEsRUFBRSxJQUFJO2FBQ2YsQ0FBQyxDQUNILENBQUM7WUFDRixJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDbkIsQ0FBQztRQUVPLFNBQVM7WUFDZixJQUFJLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQztZQUN0QixJQUFJLENBQUMsU0FBUyxHQUFHLEtBQUssQ0FBQztZQUN2QixJQUFJLENBQUMsZUFBZSxHQUFHLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUMsZ0JBQWdCLEdBQUcsRUFBRSxDQUFDO1lBQzNCLElBQUksQ0FBQyxlQUFlLEdBQUcsRUFBRSxDQUFDO1lBQzFCLElBQUksQ0FBQyxZQUFZLEdBQUcsRUFBRSxDQUFDO1lBQ3ZCLElBQUksQ0FBQyxVQUFVLEdBQUcsRUFBRSxDQUFDO1lBQ3JCLElBQUksQ0FBQyxlQUFlLEdBQUcsRUFBRSxDQUFDO1lBQzFCLElBQUksQ0FBQyxvQkFBb0IsR0FBRyxLQUFLLENBQUM7WUFDbEMsSUFBSSxDQUFDLGdCQUFnQixHQUFHLFFBQVEsQ0FBQztZQUNqQyxJQUFJLENBQUMsaUJBQWlCLEdBQUcsRUFBRSxDQUFDO1lBQzVCLElBQUksQ0FBQyxTQUFTLEdBQUcsRUFBRSxDQUFDO1FBQ3RCLENBQUM7UUFFTyxTQUFTLENBQUMsUUFBZTtZQUMvQixNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsWUFBWSxFQUFFLENBQUMsQ0FBQyxDQUErRCxDQUFDO1lBQ3hHLE9BQU8sTUFBTSxFQUFFLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDN0IsQ0FBQztRQUVPLG1CQUFtQixDQUFDLGFBQW9DO1lBQzlELE9BQU8sSUFBSSxDQUFBOzs7O2NBSUQsYUFBYSxDQUFDLFdBQVc7aUNBQ04sYUFBYSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsU0FBUyxJQUFJLGFBQWEsQ0FBQyxNQUFNOzJDQUNsRSxhQUFhLENBQUMsZ0JBQWdCOzs7Ozt1QkFLbEQsR0FBRyxFQUFFLENBQ1osSUFBSSxDQUFDLGFBQWEsQ0FDaEIsSUFBSSxXQUFXLENBQTJCLGdCQUFnQixFQUFFO2dCQUMxRCxNQUFNLEVBQUU7b0JBQ04sWUFBWSxFQUFFLGFBQWEsQ0FBQyxFQUFFO29CQUM5QixNQUFNLEVBQUUsYUFBYSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsUUFBUTtpQkFDbEU7Z0JBQ0QsT0FBTyxFQUFFLElBQUk7Z0JBQ2IsUUFBUSxFQUFFLElBQUk7YUFDZixDQUFDLENBQ0g7O2dCQUVELGFBQWEsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFFBQVE7Ozs7dUJBSWpELEdBQUcsRUFBRSxDQUNaLElBQUksQ0FBQyxhQUFhLENBQ2hCLElBQUksV0FBVyxDQUEyQixnQkFBZ0IsRUFBRTtnQkFDMUQsTUFBTSxFQUFFLEVBQUUsWUFBWSxFQUFFLGFBQWEsQ0FBQyxFQUFFLEVBQUU7Z0JBQzFDLE9BQU8sRUFBRSxJQUFJO2dCQUNiLFFBQVEsRUFBRSxJQUFJO2FBQ2YsQ0FBQyxDQUNIOzs7Ozs7Z0NBTWUsYUFBYSxDQUFDLFFBQVEsTUFBTSxhQUFhLENBQUMsTUFBTSxNQUFNLGFBQWEsQ0FBQyxnQkFBZ0IsUUFBUSxhQUFhLENBQUMsZ0JBQWdCLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEdBQUc7O1lBRS9KLGFBQWEsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUEsZ0NBQWdDLFNBQVMsY0FBYyxDQUFDO1lBQzFHLGFBQWEsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUMvQixDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFBLGdDQUFnQyxVQUFVLENBQUMsUUFBUSxNQUFNLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQzFIOzs7S0FHTixDQUFDO1FBQ0osQ0FBQztRQUVPLFVBQVU7WUFDaEIsT0FBTyxJQUFJLENBQUE7Ozs7OztxQkFNTSxJQUFJLENBQUMsZUFBZTtxQkFDcEIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGVBQWUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7OztxQkFLdEUsSUFBSSxDQUFDLGdCQUFnQjtxQkFDckIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGdCQUFnQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7OztVQUdsRixJQUFJLENBQUMsU0FBUztnQkFDZCxDQUFDLENBQUMsSUFBSSxDQUFBOzs7OzsyQkFLVyxJQUFJLENBQUMsWUFBWTsyQkFDakIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7OzsyQkFLbkUsSUFBSSxDQUFDLFVBQVU7MkJBQ2YsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7Ozs7OzJCQU9qRSxJQUFJLENBQUMsZUFBZTsyQkFDcEIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGVBQWUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7YUFHcEY7Z0JBQ0gsQ0FBQyxDQUFDLElBQUksQ0FBQTs7Ozs7OzJCQU1XLElBQUksQ0FBQyxlQUFlOzJCQUNwQixDQUFDLFFBQWUsRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsZUFBZSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7OzthQUdwRjs2Q0FDZ0MsR0FBRyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsU0FBUyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUN6RSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLENBQUMsbURBQW1EOzs7Ozs7dUJBTXRGLElBQUksQ0FBQyxvQkFBb0I7d0JBQ3hCLENBQUMsUUFBZSxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBcUMsQ0FBQzs7Ozs7Ozs7OztxQkFVbEgsSUFBSSxDQUFDLGdCQUFnQjtxQkFDckIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGdCQUFnQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7Ozs7Ozs7OztxQkFTdkUsSUFBSSxDQUFDLGlCQUFpQjtxQkFDdEIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7OztVQUduRixJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUEsc0JBQXNCLElBQUksQ0FBQyxTQUFTLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFBLEVBQUU7O3lEQUUzQixHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFOzBEQUNyQixHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFOzs7S0FHOUUsQ0FBQztRQUNKLENBQUM7UUFFTSxNQUFNO1lBQ1gsT0FBTyxJQUFJLENBQUE7Ozs7Ozs7Ozs7WUFVSCxDQUFDLElBQUksQ0FBQyxRQUFRO2dCQUNkLENBQUMsQ0FBQyxJQUFJLENBQUEsaURBQWlELEdBQUcsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsOEJBQThCO2dCQUNqSCxDQUFDLENBQUMsSUFBSSxDQUFBLEVBQUU7O1VBRVYsSUFBSSxDQUFDLFNBQVM7Z0JBQ2QsQ0FBQyxDQUFDLElBQUksQ0FBQTs7aUZBRWlFLElBQUksQ0FBQyxTQUFTLENBQUMsVUFBVTs0RUFDOUIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNO2dGQUNqQixJQUFJLENBQUMsU0FBUyxDQUFDLFdBQVc7O2FBRTdGO2dCQUNILENBQUMsQ0FBQyxJQUFJLENBQUEsRUFBRTtVQUNSLElBQUksQ0FBQyxXQUFXLENBQUMsTUFBTTtnQkFDdkIsQ0FBQyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsYUFBYSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsbUJBQW1CLENBQUMsYUFBYSxDQUFDLENBQUM7Z0JBQ2xGLENBQUMsQ0FBQyxJQUFJLENBQUEsa0RBQWtEO1VBQ3hELElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFBLEVBQUU7O0tBRS9DLENBQUM7UUFDSixDQUFDOzs7Ozs7WUF2Z0JVLHVEQUFvQjs7Ozs7U0FBcEIsb0JBQW9CIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWRwLXNzby1jb25uZWN0aW9uLWZvcm0uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c193ZWIvZWxlbWVudHMvaWRwLXNzby1jb25uZWN0aW9uLWZvcm0udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLE9BQU8sRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLEdBQUcsRUFBdUIsTUFBTSw2QkFBNkIsQ0FBQztBQUMxSCxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDL0MsT0FBTyxnQkFBZ0IsQ0FBQztBQUN4QixPQUFPLGlCQUFpQixDQUFDO0FBQ3pCLE9BQU8sZUFBZSxDQUFDO0FBQ3ZCLE9BQU8sZ0JBQWdCLENBQUM7SUErRFgsb0JBQW9COzRCQURoQyxhQUFhLENBQUMseUJBQXlCLENBQUM7Ozs7c0JBQ0MsV0FBVzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztvQ0FBbkIsU0FBUSxXQUFXOzs7O3VDQTRDbEQsUUFBUSxDQUFDLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDO3FDQUd6QixRQUFRLENBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUM7b0NBRzFCLEtBQUssRUFBRTtxQ0FHUCxLQUFLLEVBQUU7MkNBR1AsS0FBSyxFQUFFOzRDQUdQLEtBQUssRUFBRTsyQ0FHUCxLQUFLLEVBQUU7d0NBR1AsS0FBSyxFQUFFO3NDQUdQLEtBQUssRUFBRTsyQ0FHUCxLQUFLLEVBQUU7Z0RBR1AsS0FBSyxFQUFFOzRDQUdQLEtBQUssRUFBRTs2Q0FHUCxLQUFLLEVBQUU7cUNBR1AsS0FBSyxFQUFFO1lBdENSLHNMQUFnQixXQUFXLDZCQUFYLFdBQVcsaUdBQStCO1lBRzFELGdMQUFnQixTQUFTLDZCQUFULFNBQVMsNkZBQWlDO1lBRzFELDZLQUFpQixRQUFRLDZCQUFSLFFBQVEsMkZBQVM7WUFHbEMsZ0xBQWlCLFNBQVMsNkJBQVQsU0FBUyw2RkFBUztZQUduQyxrTUFBaUIsZUFBZSw2QkFBZixlQUFlLHlHQUFNO1lBR3RDLHFNQUFpQixnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBTTtZQUd2QyxrTUFBaUIsZUFBZSw2QkFBZixlQUFlLHlHQUFNO1lBR3RDLHlMQUFpQixZQUFZLDZCQUFaLFlBQVksbUdBQU07WUFHbkMsbUxBQWlCLFVBQVUsNkJBQVYsVUFBVSwrRkFBTTtZQUdqQyxrTUFBaUIsZUFBZSw2QkFBZixlQUFlLHlHQUFNO1lBR3RDLGlOQUFpQixvQkFBb0IsNkJBQXBCLG9CQUFvQixtSEFBK0M7WUFHcEYscU1BQWlCLGdCQUFnQiw2QkFBaEIsZ0JBQWdCLDJHQUFZO1lBRzdDLHdNQUFpQixpQkFBaUIsNkJBQWpCLGlCQUFpQiw2R0FBTTtZQUd4QyxnTEFBaUIsU0FBUyw2QkFBVCxTQUFTLDZGQUFNO1lBcEZsQyw2S0F3bUJDOzs7O1FBdm1CUSxNQUFNLENBQUMsSUFBSSxHQUFHLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQTs7O3FCQUdaO1lBQ1gsVUFBVSxFQUFFLDRDQUE0QztZQUN4RCxNQUFNLEVBQUUsb0NBQW9DO1lBQzVDLFdBQVcsRUFBRSw0Q0FBNEM7WUFDekQsV0FBVyxFQUFFLDRCQUE0QjtTQUN0Qjt1QkFDTjtZQUNiO2dCQUNFLEVBQUUsRUFBRSxRQUFRO2dCQUNaLFdBQVcsRUFBRSxpQkFBaUI7Z0JBQzlCLE1BQU0sRUFBRSxRQUFRO2dCQUNoQixZQUFZLEVBQUUsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDO2dCQUNyQyxtQkFBbUIsRUFBRTtvQkFDbkI7d0JBQ0UsTUFBTSxFQUFFLFVBQVU7d0JBQ2xCLE1BQU0sRUFBRSxVQUFVO3dCQUNsQixVQUFVLEVBQUUsbUNBQW1DO3dCQUMvQyxXQUFXLEVBQUUsMENBQTBDO3dCQUN2RCxVQUFVLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRTtxQkFDdkI7b0JBQ0Q7d0JBQ0UsTUFBTSxFQUFFLFNBQVM7d0JBQ2pCLE1BQU0sRUFBRSxTQUFTO3dCQUNqQixVQUFVLEVBQUUsa0NBQWtDO3dCQUM5QyxXQUFXLEVBQUUseUNBQXlDO3FCQUN2RDtpQkFDRjtnQkFDRCxRQUFRLEVBQUUsa0NBQWtDO2dCQUM1QyxNQUFNLEVBQUUsd0NBQXdDO2dCQUNoRCxnQkFBZ0IsRUFBRSxDQUFDO2dCQUNuQixnQkFBZ0IsRUFBRSxjQUFjO2dCQUNoQyxlQUFlLEVBQUUsQ0FBQyxRQUFRLENBQUM7Z0JBQzNCLGFBQWEsRUFBRSxDQUFDLEVBQUUsUUFBUSxFQUFFLGFBQWEsRUFBRSxRQUFRLEVBQUUsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO2FBQ3RFO1NBQ3lCOzs7R0FHakMsQ0FBQztRQUNLLE1BQU0sQ0FBQyxVQUFVLEdBQUcsQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDO1FBRzNELG1GQUF1RCxFQUFFLEVBQUM7UUFBMUQsSUFBZ0IsV0FBVyxpREFBK0I7UUFBMUQsSUFBZ0IsV0FBVyx1REFBK0I7UUFHMUQseUlBQXFELElBQUksR0FBQztRQUExRCxJQUFnQixTQUFTLCtDQUFpQztRQUExRCxJQUFnQixTQUFTLHFEQUFpQztRQUcxRCxxSUFBNEIsS0FBSyxHQUFDO1FBQWxDLElBQWlCLFFBQVEsOENBQVM7UUFBbEMsSUFBaUIsUUFBUSxvREFBUztRQUdsQyxzSUFBNkIsS0FBSyxHQUFDO1FBQW5DLElBQWlCLFNBQVMsK0NBQVM7UUFBbkMsSUFBaUIsU0FBUyxxREFBUztRQUduQyxtSkFBbUMsRUFBRSxHQUFDO1FBQXRDLElBQWlCLGVBQWUscURBQU07UUFBdEMsSUFBaUIsZUFBZSwyREFBTTtRQUd0QywySkFBb0MsRUFBRSxHQUFDO1FBQXZDLElBQWlCLGdCQUFnQixzREFBTTtRQUF2QyxJQUFpQixnQkFBZ0IsNERBQU07UUFHdkMsMEpBQW1DLEVBQUUsR0FBQztRQUF0QyxJQUFpQixlQUFlLHFEQUFNO1FBQXRDLElBQWlCLGVBQWUsMkRBQU07UUFHdEMsbUpBQWdDLEVBQUUsR0FBQztRQUFuQyxJQUFpQixZQUFZLGtEQUFNO1FBQW5DLElBQWlCLFlBQVksd0RBQU07UUFHbkMsNElBQThCLEVBQUUsR0FBQztRQUFqQyxJQUFpQixVQUFVLGdEQUFNO1FBQWpDLElBQWlCLFVBQVUsc0RBQU07UUFHakMsb0pBQW1DLEVBQUUsR0FBQztRQUF0QyxJQUFpQixlQUFlLHFEQUFNO1FBQXRDLElBQWlCLGVBQWUsMkRBQU07UUFHdEMsbUtBQThFLEtBQUssR0FBQztRQUFwRixJQUFpQixvQkFBb0IsMERBQStDO1FBQXBGLElBQWlCLG9CQUFvQixnRUFBK0M7UUFHcEYsZ0tBQW9DLFFBQVEsR0FBQztRQUE3QyxJQUFpQixnQkFBZ0Isc0RBQVk7UUFBN0MsSUFBaUIsZ0JBQWdCLDREQUFZO1FBRzdDLDhKQUFxQyxFQUFFLEdBQUM7UUFBeEMsSUFBaUIsaUJBQWlCLHVEQUFNO1FBQXhDLElBQWlCLGlCQUFpQiw2REFBTTtRQUd4QywrSUFBNkIsRUFBRSxHQUFDO1FBQWhDLElBQWlCLFNBQVMsK0NBQU07UUFBaEMsSUFBaUIsU0FBUyxxREFBTTtRQUV6QixNQUFNLENBQUMsTUFBTSxHQUFHO1lBQ3JCLEdBQUcsZ0JBQWdCO1lBQ25CLEdBQUcsQ0FBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztLQXNORjtTQUNGLENBQUM7UUFFTSxrQkFBa0IsQ0FBQyxNQUFjO1lBQ3ZDLE9BQU8sTUFBTTtpQkFDVixLQUFLLENBQUMsSUFBSSxDQUFDO2lCQUNYLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDO2lCQUNoQyxNQUFNLENBQUMsT0FBTyxDQUFDO2lCQUNmLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFO2dCQUNmLE1BQU0sQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFDbEQsT0FBTztvQkFDTCxRQUFRLEVBQUUsQ0FBQyxTQUFTLElBQUksRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFO29CQUNsQyxRQUFRLEVBQUUsQ0FBQyxTQUFTLElBQUksRUFBRSxDQUFDO3lCQUN4QixLQUFLLENBQUMsR0FBRyxDQUFDO3lCQUNWLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDO3lCQUNoQyxNQUFNLENBQUMsT0FBTyxDQUFDO2lCQUNuQixDQUFDO1lBQ0osQ0FBQyxDQUFDO2lCQUNELE1BQU0sQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLFFBQVEsSUFBSSxVQUFVLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNuRixDQUFDO1FBRU8sU0FBUyxDQUFDLE1BQWM7WUFDOUIsT0FBTyxNQUFNO2lCQUNWLEtBQUssQ0FBQyxHQUFHLENBQUM7aUJBQ1YsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7aUJBQ2xDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNyQixDQUFDO1FBRU8sWUFBWTtZQUNsQixJQUFJLENBQUMsU0FBUyxHQUFHLEVBQUUsQ0FBQztZQUNwQixNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsZUFBZSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2hELE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztZQUN2RyxJQUFJLENBQUMsV0FBVyxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQzlDLElBQUksQ0FBQyxTQUFTLEdBQUcsMERBQTBELENBQUM7Z0JBQzVFLE9BQU87WUFDVCxDQUFDO1lBQ0QsTUFBTSxNQUFNLEdBQTZCO2dCQUN2QyxXQUFXO2dCQUNYLFlBQVk7Z0JBQ1osZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLG9CQUFvQjtnQkFDM0MsZUFBZSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDO2dCQUN0RCxhQUFhLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQzthQUMvRCxDQUFDO1lBQ0YsSUFBSSxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7Z0JBQ25CLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQzFDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQ3RDLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQ2hELElBQUksQ0FBQyxRQUFRLElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztvQkFDekMsSUFBSSxDQUFDLFNBQVMsR0FBRyw2RUFBNkUsQ0FBQztvQkFDL0YsT0FBTztnQkFDVCxDQUFDO2dCQUNELE1BQU0sQ0FBQyxHQUFHLEdBQUcsRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLG1CQUFtQixFQUFFLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUN4RSxDQUFDO2lCQUFNLENBQUM7Z0JBQ04sTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDaEQsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO29CQUNqQixJQUFJLENBQUMsU0FBUyxHQUFHLHVEQUF1RCxDQUFDO29CQUN6RSxPQUFPO2dCQUNULENBQUM7Z0JBQ0QsTUFBTSxDQUFDLFdBQVcsR0FBRyxXQUFXLENBQUM7WUFDbkMsQ0FBQztZQUNELElBQUksQ0FBQyxhQUFhLENBQ2hCLElBQUksV0FBVyxDQUEyQixnQkFBZ0IsRUFBRTtnQkFDMUQsTUFBTTtnQkFDTixPQUFPLEVBQUUsSUFBSTtnQkFDYixRQUFRLEVBQUUsSUFBSTthQUNmLENBQUMsQ0FDSCxDQUFDO1lBQ0YsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ25CLENBQUM7UUFFTyxTQUFTO1lBQ2YsSUFBSSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUM7WUFDdEIsSUFBSSxDQUFDLFNBQVMsR0FBRyxLQUFLLENBQUM7WUFDdkIsSUFBSSxDQUFDLGVBQWUsR0FBRyxFQUFFLENBQUM7WUFDMUIsSUFBSSxDQUFDLGdCQUFnQixHQUFHLEVBQUUsQ0FBQztZQUMzQixJQUFJLENBQUMsZUFBZSxHQUFHLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUMsWUFBWSxHQUFHLEVBQUUsQ0FBQztZQUN2QixJQUFJLENBQUMsVUFBVSxHQUFHLEVBQUUsQ0FBQztZQUNyQixJQUFJLENBQUMsZUFBZSxHQUFHLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUMsb0JBQW9CLEdBQUcsS0FBSyxDQUFDO1lBQ2xDLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxRQUFRLENBQUM7WUFDakMsSUFBSSxDQUFDLGlCQUFpQixHQUFHLEVBQUUsQ0FBQztZQUM1QixJQUFJLENBQUMsU0FBUyxHQUFHLEVBQUUsQ0FBQztRQUN0QixDQUFDO1FBRU8sU0FBUyxDQUFDLFFBQWU7WUFDL0IsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLFlBQVksRUFBRSxDQUFDLENBQUMsQ0FBK0QsQ0FBQztZQUN4RyxPQUFPLE1BQU0sRUFBRSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQzdCLENBQUM7UUFFTyxtQkFBbUIsQ0FBQyxhQUFvQztZQUM5RCxNQUFNLG1CQUFtQixHQUFHLGFBQWEsQ0FBQyxtQkFBbUIsQ0FBQztZQUM5RCxPQUFPLElBQUksQ0FBQTs7OztjQUlELGFBQWEsQ0FBQyxXQUFXO2lDQUNOLGFBQWEsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLFNBQVMsSUFBSSxhQUFhLENBQUMsTUFBTTsyQ0FDbEUsYUFBYSxDQUFDLGdCQUFnQjs7Ozs7dUJBS2xELEdBQUcsRUFBRSxDQUNaLElBQUksQ0FBQyxhQUFhLENBQ2hCLElBQUksV0FBVyxDQUEyQixnQkFBZ0IsRUFBRTtnQkFDMUQsTUFBTSxFQUFFO29CQUNOLFlBQVksRUFBRSxhQUFhLENBQUMsRUFBRTtvQkFDOUIsTUFBTSxFQUFFLGFBQWEsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLFFBQVE7aUJBQ2xFO2dCQUNELE9BQU8sRUFBRSxJQUFJO2dCQUNiLFFBQVEsRUFBRSxJQUFJO2FBQ2YsQ0FBQyxDQUNIOztnQkFFRCxhQUFhLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxRQUFROzs7O3VCQUlqRCxHQUFHLEVBQUUsQ0FDWixJQUFJLENBQUMsYUFBYSxDQUNoQixJQUFJLFdBQVcsQ0FBMkIsZ0JBQWdCLEVBQUU7Z0JBQzFELE1BQU0sRUFBRSxFQUFFLFlBQVksRUFBRSxhQUFhLENBQUMsRUFBRSxFQUFFO2dCQUMxQyxPQUFPLEVBQUUsSUFBSTtnQkFDYixRQUFRLEVBQUUsSUFBSTthQUNmLENBQUMsQ0FDSDs7Ozs7O2dDQU1lLGFBQWEsQ0FBQyxRQUFRLE1BQU0sYUFBYSxDQUFDLE1BQU0sTUFBTSxhQUFhLENBQUMsZ0JBQWdCLFFBQVEsYUFBYSxDQUFDLGdCQUFnQixLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHO1VBQ2pLLG1CQUFtQjtnQkFDbkIsQ0FBQyxDQUFDLElBQUksQ0FBQTs7a0JBRUUsbUJBQW1CLENBQUMsR0FBRyxDQUFDLENBQUMsZUFBZSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUE7OzsyQ0FHeEIsZUFBZSxDQUFDLE1BQU0sS0FBSyxVQUFVLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsU0FBUzsyQkFDeEUsZUFBZSxDQUFDLE1BQU0sSUFBSSxlQUFlLENBQUMsTUFBTTs7d0JBRW5ELGVBQWUsQ0FBQyxNQUFNLEtBQUssU0FBUztvQkFDcEMsQ0FBQyxDQUFDLElBQUksQ0FBQTs7OzJDQUdhLGtCQUFrQixlQUFlLENBQUMsTUFBTSxFQUFFO3VDQUM5QyxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUMvQixJQUFJLFdBQVcsQ0FBaUMsdUJBQXVCLEVBQUU7d0JBQ3ZFLE1BQU0sRUFBRSxFQUFFLFlBQVksRUFBRSxhQUFhLENBQUMsRUFBRSxFQUFFLE1BQU0sRUFBRSxlQUFlLENBQUMsTUFBTSxFQUFFO3dCQUMxRSxPQUFPLEVBQUUsSUFBSTt3QkFDYixRQUFRLEVBQUUsSUFBSTtxQkFDZixDQUFDLENBQ0g7Ozs7MkJBSUo7b0JBQ0gsQ0FBQyxDQUFDLElBQUksQ0FBQSxFQUFFOztzQkFFVixlQUFlLENBQUMsTUFBTSxLQUFLLFNBQVMsSUFBSSxlQUFlLENBQUMsVUFBVSxJQUFJLGVBQWUsQ0FBQyxXQUFXO29CQUNqRyxDQUFDLENBQUMsSUFBSSxDQUFBOzs7NkRBR2lDLGVBQWUsQ0FBQyxVQUFVOzs2REFFMUIsZUFBZSxDQUFDLFdBQVc7O3lCQUUvRDtvQkFDSCxDQUFDLENBQUMsSUFBSSxDQUFBLEVBQUU7O2lCQUViLENBQUM7O2FBRUw7Z0JBQ0gsQ0FBQyxDQUFDLElBQUksQ0FBQTs7a0JBRUUsYUFBYSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQSxnQ0FBZ0MsU0FBUyxjQUFjLENBQUM7O2FBRS9HOztZQUVELGFBQWEsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUMvQixDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFBLGdDQUFnQyxVQUFVLENBQUMsUUFBUSxNQUFNLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQzFIOzs7S0FHTixDQUFDO1FBQ0osQ0FBQztRQUVPLFVBQVU7WUFDaEIsT0FBTyxJQUFJLENBQUE7Ozs7OztxQkFNTSxJQUFJLENBQUMsZUFBZTtxQkFDcEIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGVBQWUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7OztxQkFLdEUsSUFBSSxDQUFDLGdCQUFnQjtxQkFDckIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGdCQUFnQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7OztVQUdsRixJQUFJLENBQUMsU0FBUztnQkFDZCxDQUFDLENBQUMsSUFBSSxDQUFBOzs7OzsyQkFLVyxJQUFJLENBQUMsWUFBWTsyQkFDakIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7OzsyQkFLbkUsSUFBSSxDQUFDLFVBQVU7MkJBQ2YsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7Ozs7OzJCQU9qRSxJQUFJLENBQUMsZUFBZTsyQkFDcEIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGVBQWUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDOzs7YUFHcEY7Z0JBQ0gsQ0FBQyxDQUFDLElBQUksQ0FBQTs7Ozs7OzJCQU1XLElBQUksQ0FBQyxlQUFlOzJCQUNwQixDQUFDLFFBQWUsRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsZUFBZSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7OzthQUdwRjs2Q0FDZ0MsR0FBRyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsU0FBUyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUN6RSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLENBQUMsbURBQW1EOzs7Ozs7dUJBTXRGLElBQUksQ0FBQyxvQkFBb0I7d0JBQ3hCLENBQUMsUUFBZSxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBcUMsQ0FBQzs7Ozs7Ozs7OztxQkFVbEgsSUFBSSxDQUFDLGdCQUFnQjtxQkFDckIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGdCQUFnQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7Ozs7Ozs7OztxQkFTdkUsSUFBSSxDQUFDLGlCQUFpQjtxQkFDdEIsQ0FBQyxRQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7OztVQUduRixJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUEsc0JBQXNCLElBQUksQ0FBQyxTQUFTLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFBLEVBQUU7O3lEQUUzQixHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFOzBEQUNyQixHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFOzs7S0FHOUUsQ0FBQztRQUNKLENBQUM7UUFFTSxNQUFNO1lBQ1gsT0FBTyxJQUFJLENBQUE7Ozs7Ozs7Ozs7O1lBV0gsQ0FBQyxJQUFJLENBQUMsUUFBUTtnQkFDZCxDQUFDLENBQUMsSUFBSSxDQUFBLGlEQUFpRCxHQUFHLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDLDhCQUE4QjtnQkFDakgsQ0FBQyxDQUFDLElBQUksQ0FBQSxFQUFFOztVQUVWLElBQUksQ0FBQyxTQUFTO2dCQUNkLENBQUMsQ0FBQyxJQUFJLENBQUE7O2lGQUVpRSxJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVU7NEVBQzlCLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTTtnRkFDakIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxXQUFXOzthQUU3RjtnQkFDSCxDQUFDLENBQUMsSUFBSSxDQUFBLEVBQUU7VUFDUixJQUFJLENBQUMsV0FBVyxDQUFDLE1BQU07Z0JBQ3ZCLENBQUMsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLGFBQWEsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLGFBQWEsQ0FBQyxDQUFDO2dCQUNsRixDQUFDLENBQUMsSUFBSSxDQUFBLGtEQUFrRDtVQUN4RCxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQSxFQUFFOztLQUUvQyxDQUFDO1FBQ0osQ0FBQzs7Ozs7O1lBdm1CVSx1REFBb0I7Ozs7O1NBQXBCLG9CQUFvQiJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idp.global/catalog",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "private": false,
   "description": "Web component catalog for idp.global, based on the v5 Apple-system design language.",
   "exports": {
@@ -23,7 +23,7 @@
     "@git.zone/tsbundle": "^2.11.0",
     "@git.zone/tswatch": "^3.3.5",
     "@push.rocks/projectinfo": "^5.1.0",
-    "@types/node": "^25.9.0"
+    "@types/node": "^25.9.4"
   },
   "files": [
     "ts_web/**/*",

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@idp.global/catalog',
-  version: '3.4.0',
+  version: '3.5.0',
   description: 'Web component catalog for idp.global, based on the v5 Apple-system design language.'
 }

package/ts_web/elements/idp-sso-connection-form.ts

@@ -10,6 +10,7 @@ export interface IIdpSsoConnectionItem {
   displayName: string;
   status: 'active' | 'disabled';
   emailDomains: string[];
+  domainVerifications?: IIdpSsoDomainVerificationItem[];
   entityId: string;
   ssoUrl: string;
   certificateCount: number;
@@ -18,6 +19,15 @@ export interface IIdpSsoConnectionItem {
   groupMappings: { idpGroup: string; orgRoles: string[] }[];
 }
 
+export interface IIdpSsoDomainVerificationItem {
+  domain: string;
+  status: 'pending' | 'verified';
+  dnsTxtName: string;
+  dnsTxtValue: string;
+  lastCheckedAt?: number;
+  verifiedAt?: number;
+}
+
 export interface IIdpSsoSpDetails {
   spEntityId: string;
   acsUrl: string;
@@ -44,6 +54,11 @@ export interface IIdpSsoDeleteEventDetail {
   connectionId: string;
 }
 
+export interface IIdpSsoVerifyDomainEventDetail {
+  connectionId: string;
+  domain: string;
+}
+
 declare global {
   interface HTMLElementTagNameMap {
     'idp-sso-connection-form': IdpSsoConnectionForm;
@@ -67,6 +82,21 @@ export class IdpSsoConnectionForm extends DeesElement {
             displayName: 'Okta (acme.com)',
             status: 'active',
             emailDomains: ['acme.com', 'acme.io'],
+            domainVerifications: [
+              {
+                domain: 'acme.com',
+                status: 'verified',
+                dnsTxtName: '_idp-global-verification.acme.com',
+                dnsTxtValue: 'idp-global-verification=verified-example',
+                verifiedAt: Date.now(),
+              },
+              {
+                domain: 'acme.io',
+                status: 'pending',
+                dnsTxtName: '_idp-global-verification.acme.io',
+                dnsTxtValue: 'idp-global-verification=pending-example',
+              },
+            ],
             entityId: 'http://www.okta.com/exk9examples',
             ssoUrl: 'https://acme.okta.com/app/xyz/sso/saml',
             certificateCount: 1,
@@ -204,6 +234,40 @@ export class IdpSsoConnectionForm extends DeesElement {
         gap: 6px;
         margin-top: 8px;
       }
+      .domain-list {
+        display: flex;
+        flex-direction: column;
+        gap: 8px;
+        margin-top: 10px;
+      }
+      .domain-proof {
+        padding: 10px 12px;
+        border: 1px solid var(--idp-border);
+        border-radius: 9px;
+        background: var(--idp-muted);
+      }
+      .domain-proof-head {
+        display: flex;
+        align-items: center;
+        gap: 8px;
+      }
+      .domain-proof-head .table-action {
+        margin-left: auto;
+      }
+      .dns-record {
+        display: grid;
+        grid-template-columns: minmax(72px, auto) 1fr;
+        gap: 4px 10px;
+        margin-top: 8px;
+        font-size: 11px;
+      }
+      .dns-record-key {
+        color: var(--idp-muted-fg);
+      }
+      .dns-record-value {
+        font-family: var(--idp-mono, ui-monospace, monospace);
+        overflow-wrap: anywhere;
+      }
       .row-actions {
         display: flex;
         gap: 6px;
@@ -395,6 +459,7 @@ export class IdpSsoConnectionForm extends DeesElement {
   }
 
   private renderConnectionRow(connectionArg: IIdpSsoConnectionItem): TemplateResult {
+    const domainVerifications = connectionArg.domainVerifications;
     return html`
       <div class="row">
         <div class="row-head">
@@ -436,8 +501,53 @@ export class IdpSsoConnectionForm extends DeesElement {
           </div>
         </div>
         <div class="row-meta">${connectionArg.entityId} · ${connectionArg.ssoUrl} · ${connectionArg.certificateCount} cert${connectionArg.certificateCount === 1 ? '' : 's'}</div>
+        ${domainVerifications
+          ? html`
+              <div class="domain-list">
+                ${domainVerifications.map((verificationArg) => html`
+                  <div class="domain-proof">
+                    <div class="domain-proof-head">
+                      <idp-badge variant=${verificationArg.status === 'verified' ? 'ok' : 'outline'}>
+                        @${verificationArg.domain} ${verificationArg.status}
+                      </idp-badge>
+                      ${verificationArg.status === 'pending'
+                        ? html`
+                            <button
+                              class="table-action"
+                              aria-label=${`Verify DNS for ${verificationArg.domain}`}
+                              @click=${() => this.dispatchEvent(
+                                new CustomEvent<IIdpSsoVerifyDomainEventDetail>('idp-sso-verify-domain', {
+                                  detail: { connectionId: connectionArg.id, domain: verificationArg.domain },
+                                  bubbles: true,
+                                  composed: true,
+                                }),
+                              )}
+                            >
+                              Verify DNS
+                            </button>
+                          `
+                        : html``}
+                    </div>
+                    ${verificationArg.status === 'pending' && verificationArg.dnsTxtName && verificationArg.dnsTxtValue
+                      ? html`
+                          <div class="dns-record">
+                            <span class="dns-record-key">TXT name</span>
+                            <span class="dns-record-value">${verificationArg.dnsTxtName}</span>
+                            <span class="dns-record-key">TXT value</span>
+                            <span class="dns-record-value">${verificationArg.dnsTxtValue}</span>
+                          </div>
+                        `
+                      : html``}
+                  </div>
+                `)}
+              </div>
+            `
+          : html`
+              <div class="chip-row">
+                ${connectionArg.emailDomains.map((domainArg) => html`<idp-badge variant="accent">@${domainArg}</idp-badge>`)}
+              </div>
+            `}
         <div class="chip-row">
-          ${connectionArg.emailDomains.map((domainArg) => html`<idp-badge variant="accent">@${domainArg}</idp-badge>`)}
           ${connectionArg.groupMappings.map(
             (mappingArg) => html`<idp-badge variant="outline">${mappingArg.idpGroup} → ${mappingArg.orgRoles.join(', ')}</idp-badge>`,
           )}
@@ -548,7 +658,8 @@ export class IdpSsoConnectionForm extends DeesElement {
             <div class="title">SAML single sign-on</div>
             <div class="muted">
               Let members sign in through your organisation's identity provider. Users entering a
-              matching email domain are routed to your IdP automatically.
+              verified email domain are routed to your IdP automatically. Add the shown DNS TXT
+              record and verify ownership before account linking or just-in-time provisioning starts.
             </div>
           </div>
           ${!this.formOpen