[rubentalstra]

What changed and why

ihe-iti 0.0.41 on ihe-atna = "=0.2.1" (#35). FerroAUDIT now publishes the three helpers ihe-iti carried copies of: the bound on an audited exchange's record, the Debug rendering of a URL with its credential redacted, and the URL of an interaction under a FHIR base (FerroHEALTH/FerroAUDIT#8, #9, #61). FerroFED implements ihe_atna::balp::AuditRecorder for the recorders it hands to ihe-iti's clients, so it can take ihe-atna 0.2.x only once ihe-iti does.

• src/recording.rs, src/redact.rs and search::under_base are gone, and search::escape stays. Callers use ihe_atna::balp::recording, ihe_atna::redact and ihe_atna::fhir_base.
• Every profile takes ihe-atna/redact (url only), and xcpd also takes ihe-atna/recording (tokio and thiserror only). So a profile without balp or atna still compiles no audit stack.
• ihe-atna 0.2's API moves are applied: Coded::fixed, EventKind::subtypes as a Vec, an endpoint as a NetworkAddress, and the new optional fields, written empty.
• API breaks for a product:
  • ihe_iti::recording is gone. Use ihe_atna::balp::recording, whose Late is made with Late::new().
  • The audit modules' EventKind constants are now functions (query_consumer(), match_consumer(), query(), updates(), feed_kind(), subscription_*()), because an EventKind now holds a Vec.
  • The changelog names each one.

nl-generic-functions 0.0.26 on ferrohealth-smart = "=0.4.0" (#36). This takes FerroFED's lock down to one copy of ferrohealth-smart. 0.4.0's metadata module still offers only issuer_url and locations. So the three checks the Nuts grant adds stay private in nuts_auth/issuer.rs, and none is copied anywhere else:

• the exact canonical issuer text (RFC 8414 §3.3);
• every endpoint on the issuer's origin;
• the refusal of JSON that repeats a name.

The three checks are filed in FerroSMART milestone v0.5.0.

Gates run locally:

• fmt;
• clippy on the workspace with and without every feature;
• each of the twelve ihe-iti feature rows and the five nl-generic-functions rows;
• nextest, 410 tests;
• doctests and rustdoc;
• cargo-deny;
• both publish dry runs;
• the crate-version, changelog, comment-style, versions, citation, file-length and TODO guards.

No test was weakened; the test edits are the renames above.

Closes #35
Closes #36

Licensing of contributions

• I accept the terms in CONTRIBUTING.md § Licensing of contributions: I have the right to submit this work, I license it under the project licence of the version it lands in, and I grant the Licensor the relicensing right stated there.

Checklist

• Every conformance decision cites the specification (the IHE ITI Technical Framework, PIXm, PDQm, HL7 FHIR R4, HL7 v2), never memory and never another implementation.
• Rust gates pass, once the workspace has a member: cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings with and without --all-features, cargo nextest run --workspace --locked, cargo doc with RUSTDOCFLAGS=-D warnings, and cargo deny check.
• Every refusal the change adds has an asserted negative test, and no test was weakened to pass.
• Shell and workflow files are clean: shellcheck --severity=style, actionlint, zizmor --min-severity=low .github/, and the self-test of every script the change touches.
• CHANGELOG.md has an [Unreleased] entry, or the change carries the no-changelog label.
• No patient data, real identifier, key, token or password in a fixture, test or example.
• Every commit is signed.
• No AI or assistant attribution anywhere in the commits or this PR.