Performs the OID4VCI discovery flow for a Credential Issuer, routing discovery
strategy and metadata schema validation based on the IT-Wallet specification version
provided in config.
v1.0: Only .well-known/openid-federation is attempted. If federation discovery
fails, a FetchMetadataError is thrown — there is no OID4VCI fallback in v1.0.
Returns MetadataResponseV1_0 with discoveredVia: "federation".
v1.3: Federation discovery is attempted first (.well-known/openid-federation).
On failure, falls back to .well-known/openid-credential-issuer + optional
.well-known/oauth-authorization-server. Returns MetadataResponseV1_3.
v1.4: Same discovery strategy as v1.3, validated against the v1.4 metadata schema.
Returns MetadataResponseV1_4.
Well-known paths are appended relative to the full credentialIssuerUrl, preserving
any path segment (e.g. "https://issuer.example.it/v1" →
"https://issuer.example.it/v1/.well-known/...").
When federation discovery succeeds, the full entity statement claims are
preserved in openid_federation_claims.
Signature verification of the entity statement is optional: supply
callbacks.verifyJwt to enable it. When omitted, trust is derived from TLS
alone (successful retrieval from the well-known endpoint).
Performs the OID4VCI discovery flow for a Credential Issuer, routing discovery strategy and metadata schema validation based on the IT-Wallet specification version provided in
config.v1.0: Only
.well-known/openid-federationis attempted. If federation discovery fails, aFetchMetadataErroris thrown — there is no OID4VCI fallback in v1.0. ReturnsMetadataResponseV1_0withdiscoveredVia: "federation".v1.3: Federation discovery is attempted first (
.well-known/openid-federation). On failure, falls back to.well-known/openid-credential-issuer+ optional.well-known/oauth-authorization-server. ReturnsMetadataResponseV1_3.v1.4: Same discovery strategy as v1.3, validated against the v1.4 metadata schema. Returns
MetadataResponseV1_4.Well-known paths are appended relative to the full
credentialIssuerUrl, preserving any path segment (e.g."https://issuer.example.it/v1"→"https://issuer.example.it/v1/.well-known/...").When federation discovery succeeds, the full entity statement claims are preserved in
openid_federation_claims. Signature verification of the entity statement is optional: supplycallbacks.verifyJwtto enable it. When omitted, trust is derived from TLS alone (successful retrieval from the well-known endpoint).