# `Attesto.CredentialIssuerMetadata`
[🔗](https://github.com/XukuLLC/attesto/blob/v2.1.0/lib/attesto/credential_issuer_metadata.ex#L1)

OID4VCI Credential Issuer Metadata
(`draft-ietf-oauth-openid4vci` §11.2).

Build the JSON document a wallet fetches from
`/.well-known/openid-credential-issuer` to discover the Credential Issuer's
credential endpoint, supported credential configurations, and optional
issuance capabilities.

This module is the pure, conn-free, HTTP-free half of that endpoint. It
returns a string-keyed map ready to serialise as JSON; serving the document
is the host's concern. Nil values are omitted so the document advertises
only capabilities the host provides. Unknown options and unknown fields in
credential configurations are ignored.

`signed/2` produces the optional signed JWT representation of the document
(OID4VCI §11.2.2), served when a wallet requests `Accept: application/jwt`.

# `build`

```elixir
@spec build(keyword()) :: %{required(String.t()) => term()}
```

Build the OID4VCI Credential Issuer Metadata document.

Required options:

  * `:credential_issuer` - the Credential Issuer Identifier URL.
  * `:credential_endpoint` - the URL of the credential endpoint.
  * `:credential_configurations_supported` - a non-empty map from
    credential-configuration IDs to configuration maps.

Optional options are `:authorization_servers`, `:nonce_endpoint`,
`:deferred_credential_endpoint`, `:notification_endpoint`,
`:credential_response_encryption`, `:batch_credential_issuance`, and
`:display`. Each is included only when supplied with a non-`nil` value.

Configuration maps are normalized to the supported OID4VCI members and
their nil values are omitted. A `format` is required for every
configuration. `vct` is additionally required for `vc+sd-jwt` and
`dc+sd-jwt` configurations.

# `signed`

```elixir
@spec signed(
  %{required(String.t()) => term()},
  keyword()
) :: String.t()
```

Represent a metadata document as a signed JWT (OID4VCI §11.2.2).

Served when a wallet requests signed metadata with `Accept: application/jwt`.
The header carries `typ: openidvci-issuer-metadata+jwt` and the issuer's public
signing key as `jwk`, so the wallet verifies the signature without a separate
key lookup. The claims are the document's members plus `iss`/`sub` (the
Credential Issuer Identifier) and `iat`.

`metadata` is a document from `build/1`. Exactly one of `:pem` or `:keystore`
is required; optional `:now` overrides the `iat` clock (unix seconds).

---

*Consult [api-reference.md](api-reference.md) for complete listing*