gdc-sdk-node-ts 2.7.7 → 2.7.8

package/README.md

@@ -704,6 +704,17 @@ modules below.
   `recipient`, never a portal alias
 - vital-sign helpers
 
+### Composition provenance in clinical Bundles
+
+A document Bundle keeps `Composition.author` (who created the content) separate
+from `Composition.attester` (the registered personal or professional assignment
+that submitted/attested it). For a member or professional, the protected BFF
+profile selects only `owner` or `creator`; a `RelatedPerson` or
+`PractitionerRole` may be both author and attester when that actor created the
+content. DIDComm sender and signing keys remain audit/transport identities.
+See [Clinical writes from a Node BFF](./docs/101-BFF_CLINICAL_WRITES.md) and the
+[gateway authorship contract](https://github.com/Global-DataCare/gwtemplate-node-ts/blob/main/docs/01-OVERVIEW-AND-GUIDES/101-01.N-AUTHENTICATED-CLINICAL-AUTHOR.md).
+
 ### Node runtime client
 
 - [`NodeHttpClient`](src/node-runtime-client.ts)

package/dist/server-profile-session.d.ts

@@ -1,7 +1,7 @@
 import type { JWK } from 'gdc-common-utils-ts/models/jwk';
 import type { ActorKind } from 'gdc-common-utils-ts/models/actor-session';
 import type { LegalOrganizationVerificationTransactionInput } from 'gdc-common-utils-ts/utils/legal-organization-verification-transaction';
-import { type AppInfo, type ConfidentialStorageProfile, type PollOptions, type SubmitAndPollResult, type ClinicalCreatorBinding, type ClinicalCreatorIpsExport } from 'gdc-sdk-core-ts';
+import { type AppInfo, type ConfidentialStorageProfile, type PollOptions, type SubmitAndPollResult, type ClinicalCreatorBinding, type ClinicalCreatorIpsExport, type ClinicalSourceAuthorSelection } from 'gdc-sdk-core-ts';
 import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
 import { IndividualControllerSdk } from './orchestration/individual-controller-sdk.js';
 import { ProfessionalSdk } from './orchestration/professional-sdk.js';
@@ -343,6 +343,8 @@ export declare class ServerProfileSessionManager {
     exportClinicalCreatorIps(input: Readonly<{
         ownerId: string;
         profileId: string;
+        /** Closed BFF choice: content owner or authenticated registered creator. */
+        sourceAuthor?: ClinicalSourceAuthorSelection;
     }>): Promise<ClinicalCreatorIpsExport>;
     enroll(input: ServerProfileEnrollmentInput): Promise<ServerProfileRecord>;
     /**
@@ -435,7 +437,11 @@ export declare class ServerProfileSessionManager {
     private now;
 }
 /**
- * Exports the stable FHIR IPS creator attached to a server profile. Direct
- * writes continue to use `profile.actorDid`; this function is export-only.
+ * Exports the stable FHIR IPS creator attached to a server profile. The
+ * optional closed selection determines whether the owner or the authenticated
+ * registered creator authored the content. DIDComm sender and signing keys
+ * remain transport/audit evidence and never become FHIR provenance.
  */
-export declare function exportServerProfileClinicalCreatorIps(profile: ServerProfileRecord): ClinicalCreatorIpsExport;
+export declare function exportServerProfileClinicalCreatorIps(profile: ServerProfileRecord, options?: Readonly<{
+    sourceAuthor?: ClinicalSourceAuthorSelection;
+}>): ClinicalCreatorIpsExport;

package/dist/server-profile-session.js

@@ -30,7 +30,7 @@ export class ServerProfileSessionManager {
      * profile without exposing its protected wallet material to the portal.
      */
     async exportClinicalCreatorIps(input) {
-        return exportServerProfileClinicalCreatorIps(await this.requireOwnedProfile(input.ownerId, input.profileId));
+        return exportServerProfileClinicalCreatorIps(await this.requireOwnedProfile(input.ownerId, input.profileId), { sourceAuthor: input.sourceAuthor });
     }
     async enroll(input) {
         requireEnrollment(input);
@@ -829,16 +829,19 @@ function requireBase64UrlSeed32(seed) {
     }
 }
 /**
- * Exports the stable FHIR IPS creator attached to a server profile. Direct
- * writes continue to use `profile.actorDid`; this function is export-only.
+ * Exports the stable FHIR IPS creator attached to a server profile. The
+ * optional closed selection determines whether the owner or the authenticated
+ * registered creator authored the content. DIDComm sender and signing keys
+ * remain transport/audit evidence and never become FHIR provenance.
  */
-export function exportServerProfileClinicalCreatorIps(profile) {
+export function exportServerProfileClinicalCreatorIps(profile, options = {}) {
     if (!profile.clinicalCreatorBinding) {
         throw new Error('Server profile has no clinical creator binding.');
     }
     return resolveClinicalCreatorIpsExport({
         bindings: [profile.clinicalCreatorBinding],
         evidence: { actorDid: profile.actorDid },
+        sourceAuthor: options.sourceAuthor,
     });
 }
 function bindClinicalCreatorChannels(binding, channel) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.7.7",
+  "version": "2.7.8",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,8 +38,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.8.6",
-    "gdc-sdk-core-ts": "2.5.5"
+    "gdc-common-utils-ts": "2.8.7",
+    "gdc-sdk-core-ts": "2.5.6"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",