OptionalresolveTxt?: ResolveTxtDefaults to node:dns/promises.
Creates the Cognito IdP inert (no domains, not on the app client) and records it PENDING. A failure once the IdP may exist deletes it.
Withdraws the IdP from the app client, deletes it, then soft-deletes the row. An IdP already gone from Cognito counts as deleted, so a retry heals.
What the bank's IT registers CFX as, for either protocol.
saml or oidc replaces the whole configuration and must match the
connection's protocol. On an ACTIVE connection every added domain must
already carry the TXT record; a PENDING one just stores its domains.
Activates a PENDING connection once every domain carries its TXT record: the IdP takes the domains and joins the app client. A no-op when ACTIVE, which publishes again: a retry finds it there.
Bank enterprise SSO, for CFX operators: one SAML or OIDC IdP per bank in the
cfx-bankCognito pool. A connection stays PENDING, its IdP holding no domains and off the bank dashboard's app client, untilverifyfinds the TXT record on every domain. Records no activity: admin-dashboard records it.