meaning of FAPI2 requirements around publishing discovery data

[jogu]

What does the 'and' here mean:

shall distribute discovery metadata (such as the authorization endpoint) via the metadata document as specified in [OIDD] and [RFC8414];

Does it mean a server has to publish both?

Currently the conformance tests check:

1. if openid connect is enabled, only openid-configuration is checked
2. if openid connect is not enabled, only oauth-authorization-server is checked

Given the 'and' I'm not actually sure this is correct and if server's are expected to publish in both locations?

Discussed a bit on today's WG call.