sync: monorepo @ validator 0.4.0 / validation-types 0.1.5

Snapshot of medvertical/records monorepo state, exported via
oss:export-validator. Tracks the npm publication of:

  @records-fhir/validator@0.4.0
  @records-fhir/validation-types@0.1.5

Run npm i @records-fhir/validator@0.4.0 for the matching
distribution. The conformance evidence in conformance-results/
matches the published tarball.

Author: records-bot

README.md

@@ -46,7 +46,7 @@ jobs:
 For production CI, pin an immutable patch tag:
 
 ```yaml
-- uses: medvertical/records-fhir-validator@v0.3.0
+- uses: medvertical/records-fhir-validator@v0.4.0
   with:
     paths: resources/**/*.json
     profile-url: http://hl7.org/fhir/StructureDefinition/Patient
@@ -59,7 +59,7 @@ Action pinning:
 | Goal | Pin in `uses:` | Notes |
 |---|---|---|
 | Latest stable in current major | `medvertical/records-fhir-validator@v0` | Floating tag, force-moved on stable releases only |
-| Exact released version | `medvertical/records-fhir-validator@v0.3.0` | Immutable consumer tag |
+| Exact released version | `medvertical/records-fhir-validator@v0.4.0` | Immutable consumer tag |
 | Bit-exact reproducibility | `medvertical/records-fhir-validator@<commit-sha>` | Best for audit and forensics |
 
 The `validator-v<semver>` tag is the npm mirror/release-page tag. Use
@@ -68,7 +68,7 @@ The `validator-v<semver>` tag is the npm mirror/release-page tag. Use
 ### npm Package
 
 ```sh
-npm install @records-fhir/validator@0.3.0 @records-fhir/validation-types@0.1.5
+npm install @records-fhir/validator@0.4.0 @records-fhir/validation-types@0.1.5
 ```
 
 Run the CLI against one file or a folder:
@@ -138,7 +138,7 @@ includes `file`, `resourceType`, `profileUrl`, and `issues`. With
 
 ## What Is Included
 
-- `@records-fhir/validator` 0.3.0 - Apache-2.0 validation engine.
+- `@records-fhir/validator` 0.4.0 - Apache-2.0 validation engine.
 - `@records-fhir/validation-types` 0.1.5 - Apache-2.0 validation-domain types.
 - Composite GitHub Action at repository root.
 - Standalone examples under `packages/validator/examples/`.
@@ -257,10 +257,13 @@ Spec dispatch coverage for the measured R4 base package constraints is 100%.
 
 MII conformance is measured in a separate lane from the HL7
 `FHIR/fhir-test-cases` score. The current scoped MII-2026 reference run
-matches the official MII FHIR Validator on 241/241 measured resources from the
-refreshed MII 2026 corpus under the `mii-2026-reference` profile scope and
+was generated on 2026-05-19 against the official MII FHIR Validator container
+`mii-fhir-validator:0.0.1-alpha.7` at `http://localhost:8081`. It matches
+the reference validator on 241/241 measured resources from the refreshed MII
+2026 corpus under the `mii-2026-reference` profile scope and
 `mii-local-blaze` terminology mode, with 12 classified corpus/profile-drift
-skips.
+skips. The source-repository report is
+`conformance-results/mii-triangulation-alpha7-2026-05-19.json`.
 
 This is a scoped parity claim for the measured package-example corpus. It is
 not an MII certification claim and does not imply full site-level MII

packages/validation-types/src/validation/__tests__/settings-defaults.test.ts

@@ -15,4 +15,15 @@ describe('validation settings defaults', () => {
     expect(getDefaultValidationSettingsForVersion('R4').resourceTypes.includedTypes).toContain('Bundle');
     expect(getDefaultValidationSettingsForVersion('R5').resourceTypes.includedTypes).toContain('Bundle');
   });
+
+  it('disables imposed profile policies by default', () => {
+    expect(getDefaultValidationSettingsForVersion('R4').imposedProfiles).toEqual({
+      enabled: false,
+      policies: [],
+    });
+    expect(getDefaultValidationSettingsForVersion('R5').imposedProfiles).toEqual({
+      enabled: false,
+      policies: [],
+    });
+  });
 });

packages/validation-types/src/validation/__tests__/type-integrity.test.ts

@@ -252,6 +252,23 @@ describe('Type Integrity - DTO Serialization', () => {
       expect(result.success).toBe(false);
     });
 
+    it('accepts imposed profile policy settings updates', () => {
+      const result = safeParseSettingsUpdate({
+        imposedProfiles: {
+          enabled: true,
+          policies: [{
+            id: 'mii-patient',
+            resourceType: 'Patient',
+            profileUrl: 'https://www.medizininformatik-initiative.de/fhir/core/StructureDefinition/Patient|2025.0.1',
+            packageId: 'de.medizininformatikinitiative.kerndatensatz.person',
+            packageVersion: '2025.0.1',
+          }],
+        },
+      });
+
+      expect(result.success).toBe(true);
+    });
+
     it('does not normalize business rule aliases to custom_rule', () => {
       expect(normalizeValidationAspect('businessRule')).toBe('businessRule');
       expect(normalizeValidationAspect('business-rules')).toBe('business-rules');

packages/validation-types/src/validation/defaults/base-settings.ts

@@ -114,6 +114,10 @@ export const DEFAULT_VALIDATION_SETTINGS_R4: ValidationSettings = {
     simplifier: true,
     packageRegistry: true
   },
+  imposedProfiles: {
+    enabled: false,
+    policies: []
+  },
   advancedTerminology: DEFAULT_ADVANCED_TERMINOLOGY,
   packageDownload: {
     versionPolicy: 'prefer-stable',
@@ -225,6 +229,10 @@ export const DEFAULT_VALIDATION_SETTINGS_R5: ValidationSettings = {
     simplifier: true,
     packageRegistry: true
   },
+  imposedProfiles: {
+    enabled: false,
+    policies: []
+  },
   advancedTerminology: DEFAULT_ADVANCED_TERMINOLOGY,
   packageDownload: {
     versionPolicy: 'prefer-stable',

packages/validation-types/src/validation/dtos.ts

@@ -144,6 +144,7 @@ export interface ValidationMessageGroupDTO {
     serverId?: number; // Server ID (for single-server queries, or first seen for multi-server)
     resourceType?: string; // Primary resource type for this issue group
     resourceTypeCounts?: Record<string, number>; // Per-type resource counts (e.g. { Patient: 5, Encounter: 3 })
+    validatorPackageVersion?: string; // Validator package version observed for the affected resource/aspect results
     validationRulesetVersion?: string; // Ruleset version observed for the affected resource/aspect results
 }
 
@@ -181,6 +182,7 @@ export interface ResourceMessagesDTO {
             text: string;
             signature: string;
             createdAt: Date;
+            validatorPackageVersion?: string;
             validationRulesetVersion?: string;
         }[];
     }[];

packages/validation-types/src/validation/index.ts

@@ -111,6 +111,9 @@ export type {
   ValidationSettingsValidationResult,
   FHIRResourceTypeConfig,
   AdvancedTerminologyConfig,
+  ProfileApplicationSource,
+  ImposedProfilePolicy,
+  ImposedProfilesConfig,
   AdvisorRule,
   AdvisorRuleMatch,
   AdvisorRuleTransform

packages/validation-types/src/validation/settings-schema.ts

@@ -231,6 +231,22 @@ export const HapiConfigSchema = z.object({
     enableBestPractice: z.boolean().optional(),
 });
 
+export const ImposedProfilePolicySchema = z.object({
+    id: z.string().optional(),
+    enabled: z.boolean().optional(),
+    resourceType: z.string().min(1),
+    profileUrl: z.string().min(1),
+    label: z.string().optional(),
+    packageId: z.string().optional(),
+    packageVersion: z.string().optional(),
+    reason: z.string().optional(),
+});
+
+export const ImposedProfilesConfigSchema = z.object({
+    enabled: z.boolean(),
+    policies: z.array(ImposedProfilePolicySchema),
+});
+
 // ============================================================================
 // Main ValidationSettings Schema
 // ============================================================================
@@ -277,6 +293,7 @@ export const ValidationSettingsSchema = z.object({
         profileCachePath: z.string().optional(),
     }).optional(),
     profileSources: ProfileSourcesConfigSchema.optional(),
+    imposedProfiles: ImposedProfilesConfigSchema.optional(),
     advancedTerminology: AdvancedTerminologyConfigSchema.optional(),
     packageDownload: PackageDownloadConfigSchema.optional(),
     autoRevalidateAfterEdit: z.boolean().optional(),

packages/validation-types/src/validation/settings.ts

@@ -105,6 +105,36 @@ export interface AdvisorRule {
   enabled?: boolean;
 }
 
+export type ProfileApplicationSource =
+  | 'resource-meta'
+  | 'explicit-run'
+  | 'imposed-policy'
+  | 'structuredefinition-imposeProfile'
+  | 'base-fallback';
+
+export interface ImposedProfilePolicy {
+  /** Stable identifier used in reports and audit evidence. */
+  id?: string;
+  /** Disabled policies are kept for draft/customer-specific configurations. */
+  enabled?: boolean;
+  /** FHIR resource type to which the profile is applied. Use "*" for all. */
+  resourceType: string;
+  /** Canonical URL of the profile to validate against. */
+  profileUrl: string;
+  /** Optional human-readable label shown in UI/report contexts. */
+  label?: string;
+  /** Optional package evidence when the policy is tied to a pinned IG package. */
+  packageId?: string;
+  packageVersion?: string;
+  /** Optional explanation for why this profile is imposed. */
+  reason?: string;
+}
+
+export interface ImposedProfilesConfig {
+  enabled: boolean;
+  policies: ImposedProfilePolicy[];
+}
+
 // ============================================================================
 // Validation Settings
 // ============================================================================
@@ -231,6 +261,12 @@ export interface ValidationSettings {
    */
   profileSources?: ProfileSourcesConfig;
 
+  /**
+   * Profiles that Records should apply as validation policy even when a
+   * resource does not declare them in meta.profile.
+   */
+  imposedProfiles?: ImposedProfilesConfig;
+
   /**
    * Advanced Terminology Validation
    * Optional checks that require additional terminology server calls.
@@ -359,6 +395,7 @@ export interface ValidationSettingsUpdate {
     profileCachePath?: string;
   };
   profileSources?: ProfileSourcesConfig;
+  imposedProfiles?: Partial<ImposedProfilesConfig>;
   packageDownload?: Partial<ValidationSettings['packageDownload']>;
   autoRevalidateAfterEdit?: boolean;
   autoRevalidateOnVersionChange?: boolean;

packages/validator/CHANGELOG.md

@@ -12,6 +12,44 @@ ship together; package-only changes are noted under each release.
 
 No unreleased changes yet.
 
+## [0.4.0] — 2026-06-30
+
+Runtime slicing and evidence-gate update for the standalone validator and
+GitHub Action. Released with `@records-fhir/validation-types` 0.1.5.
+
+### Added
+
+- Added runtime support for differential-only slices that inherit slicing from
+  their base or snapshot when slice elements do not redeclare slicing locally.
+- Added local-first FHIR Schema dual-path evidence reporting with exported
+  normalization helpers for comparing Records, graph-derived validation, and
+  Java OperationOutcome baselines.
+- Added focused regression coverage for required slices, closed slicing,
+  `memberOf` prechecks, and FHIR Schema StructureDefinition merge behavior.
+
+### Changed
+
+- Merge differential and base StructureDefinition elements by slice-aware
+  identity instead of path alone, keeping same-path slices from sharing
+  cardinality or metadata by accident.
+- Normalize known equivalent closed-slicing diagnostics in the evidence lane so
+  Java pattern differences are measured without hiding real parity gaps.
+- Refresh README evidence around the current MII/ISiK triangulation signal and
+  scoped FHIR Schema dual-path status.
+
+### Fixed
+
+- Fixed required-slice detection for profiled differential-only slices where
+  the slice exists in the differential but the slicing declaration is inherited.
+- Fixed local terminology/memberOf precheck diagnostics so missing local
+  expansions produce stable validation signals without depending on remote TX
+  availability.
+
+### Verification
+
+- Verified locally with validator typecheck/build, targeted Vitest suites, MII
+  reference gate, validator performance gate, and repository lint.
+
 ## [0.3.0] — 2026-06-23
 
 Release-hardening update for the standalone validator and GitHub Action.
@@ -602,7 +640,8 @@ extracted from the Records DataOps Control Plane.
   are explicitly out of scope for this package and are not blended
   into the headline conformance score.
 
-[Unreleased]: https://github.com/medvertical/records-fhir-validator/compare/validator-v0.3.0...HEAD
+[Unreleased]: https://github.com/medvertical/records-fhir-validator/compare/validator-v0.4.0...HEAD
+[0.4.0]: https://github.com/medvertical/records-fhir-validator/compare/validator-v0.3.0...validator-v0.4.0
 [0.3.0]: https://github.com/medvertical/records-fhir-validator/compare/validator-v0.2.0...validator-v0.3.0
 [0.2.0]: https://github.com/medvertical/records-fhir-validator/compare/validator-v0.1.14...validator-v0.2.0
 [0.1.0]: https://github.com/medvertical/records-fhir-validator/releases/tag/validator-v0.1.0

packages/validator/README.md

@@ -89,7 +89,7 @@ depending on your trade-off between freshness and stability:
 | Goal | Pin in `uses:` | Notes |
 |---|---|---|
 | Always-latest within current major | `medvertical/records-fhir-validator@v0` | Force-moved on every stable release; never advances onto a prerelease |
-| Specific minor/patch (recommended for production CI) | `medvertical/records-fhir-validator@v0.3.0` | Immutable once published |
+| Specific minor/patch (recommended for production CI) | `medvertical/records-fhir-validator@v0.4.0` | Immutable once published |
 | Bit-exact reproducibility | `medvertical/records-fhir-validator@<commit-sha>` | For audit / forensic builds |
 
 The `validator-v<semver>` tag you may see on the public repo's release
@@ -494,12 +494,13 @@ constraints measured by `quality:spec-coverage`.
 
 MII conformance is measured in a separate lane from the HL7
 `FHIR/fhir-test-cases` score. The current scoped MII-2026 reference run was
-generated on 2026-05-09 against the official MII FHIR Validator container at
-`http://localhost:8080`. It matches the reference validator on 241/241 measured
-resources from the refreshed MII 2026 corpus under the `mii-2026-reference`
-profile scope and `mii-local-blaze` terminology mode, with 12 classified
-corpus/profile-drift skips. The source-repository report is
-`conformance-results/mii-triangulation-2026-05-09.json`.
+generated on 2026-05-19 against the official MII FHIR Validator container
+`mii-fhir-validator:0.0.1-alpha.7` at `http://localhost:8081`. It matches the
+reference validator on 241/241 measured resources from the refreshed MII 2026
+corpus under the `mii-2026-reference` profile scope and `mii-local-blaze`
+terminology mode, with 12 classified corpus/profile-drift skips. The
+source-repository report is
+`conformance-results/mii-triangulation-alpha7-2026-05-19.json`.
 
 This is a scoped parity claim for the measured package-example corpus. It is
 not an MII certification claim and does not imply full site-level MII
@@ -510,6 +511,57 @@ The full scope-expansion plan is tracked in
 The public `medvertical/records-fhir-validator` export includes the same
 roadmap under `docs/conformance-scope-roadmap.md`.
 
+### FHIR Schema Dual-Path Scope
+
+FHIR Schema is being evaluated as a cleaner intermediate representation for
+the same StructureDefinition semantics, not as a replacement for conformance
+evidence. The current engine remains StructureDefinition-first. The FHIR Schema
+graph path runs in parallel and is compared against both Records' current
+StructureDefinition path and Java/reference `OperationOutcome` evidence where a
+reference report exists.
+
+The current MII Observation dual-path lane covers 261 real fixtures. Of those,
+131 have Java/reference coverage and 90 reference-comparable issues after
+excluding Java informational open-slice hints and Java-implied core Observation
+profiles (`bp`, `resprate`, `vitalsigns`) that are not part of the explicit MII
+profile contract for the lane. In that scoped lane, the graph path matches 73
+normalized Java/reference issue keys and the current Records comparable issue
+lane now also matches 73 after the slice-aware FHIR Schema merge and
+closed-slicing equivalence normalization loop.
+
+Reference coverage is reported separately from graph-vs-Records correctness. The
+current attached MII HTTP reference report covers 131 fixtures and leaves 130
+reference-coverage gaps: 77 Onkologie fixtures outside the current report scope,
+47 Gematik ISiK/ICU fixtures outside that scope, 2 Person/Base fixtures outside
+that scope, and 4 fixtures without an explicit `meta.profile`. A separate local
+HL7 Java validator CLI supplement can cover the 126 profiled gaps and reduces
+the remaining reference-coverage gaps to the 4 no-profile fixtures. That CLI
+supplement is Java OperationOutcome evidence, not a replacement for the official
+MII HTTP reference validator container.
+
+The report classifies the remaining cases instead of hiding them in one score:
+46 three-way-match cases, no one-sided Graph/Java-vs-Records or
+Records/Java-vs-Graph confirmed gaps, 13 graph-only-unconfirmed cases, 13
+Records-only-unconfirmed cases, 1 both-miss-reference case, 12 intentionally
+unmapped profile-missing cases, and 4 no-profile fixture cases.
+The intentionally excluded classes are part of the evidence model: unsupported
+or unmapped corpus profiles, fixtures without an explicit profile, Java
+informational hints, and Java behavior from implicit core Observation profiles
+outside the measured MII profile contract.
+
+The graph-vs-Records delta keys are also classified into decision buckets:
+forbidden or required `code.coding` slice cardinality, Coding identity versus
+full-pattern differences, component-slice expression granularity, and one
+Records-only `focus` rule. These remain visible until Java/reference coverage
+or an explicit product decision promotes them into runtime behavior. The single
+Java-covered both-miss case is the MII spontaneous respiratory-rate fixture,
+where Java reports a required `sct` `code.coding` slice as missing while both
+TypeScript paths accept the explicit child `system`/`code` pattern.
+
+This lane is therefore an implementation-reduction and convergence signal. It
+does not broaden the public headline parity claim beyond the explicitly measured
+FHIR JSON comparison lanes.
+
 ## License
 
 Apache-2.0 for this package. The surrounding Records application remains proprietary and is licensed separately.