sync: monorepo @ validator 0.4.2 / validation-types 0.1.5

Snapshot of medvertical/records monorepo state, exported via
oss:export-validator. Tracks the npm publication of:

  @records-fhir/validator@0.4.2
  @records-fhir/validation-types@0.1.5

Run npm i @records-fhir/validator@0.4.2 for the matching
distribution. The conformance evidence in conformance-results/
matches the published tarball.

Author: records-bot

README.md

@@ -47,7 +47,7 @@ jobs:
 For production CI, pin an immutable patch tag:
 
 ```yaml
-- uses: medvertical/records-fhir-validator@v0.4.1
+- uses: medvertical/records-fhir-validator@v0.4.2
   with:
     paths: resources/**/*.json
     profile-url: http://hl7.org/fhir/StructureDefinition/Patient
@@ -60,7 +60,7 @@ Action pinning:
 | Goal | Pin in `uses:` | Notes |
 |---|---|---|
 | Latest stable in current major | `medvertical/records-fhir-validator@v0` | Floating tag, force-moved on stable releases only |
-| Exact released version | `medvertical/records-fhir-validator@v0.4.1` | Immutable consumer tag |
+| Exact released version | `medvertical/records-fhir-validator@v0.4.2` | Immutable consumer tag |
 | Bit-exact reproducibility | `medvertical/records-fhir-validator@<commit-sha>` | Best for audit and forensics |
 
 The `validator-v<semver>` tag is the npm mirror/release-page tag. Use
@@ -69,7 +69,7 @@ The `validator-v<semver>` tag is the npm mirror/release-page tag. Use
 ### npm Package
 
 ```sh
-npm install @records-fhir/validator@0.4.1 @records-fhir/validation-types@0.1.5
+npm install @records-fhir/validator@0.4.2 @records-fhir/validation-types@0.1.5
 ```
 
 Run the CLI against one file or a folder:
@@ -139,7 +139,7 @@ includes `file`, `resourceType`, `profileUrl`, and `issues`. With
 
 ## What Is Included
 
-- `@records-fhir/validator` 0.4.1 - Apache-2.0 validation engine.
+- `@records-fhir/validator` 0.4.2 - Apache-2.0 validation engine.
 - `@records-fhir/validation-types` 0.1.5 - Apache-2.0 validation-domain types.
 - Composite GitHub Action at repository root.
 - Standalone examples under `packages/validator/examples/`.

packages/validation-types/src/fix-suggestions/catalog-core.ts

@@ -98,6 +98,11 @@ export const CATALOG_CORE: Record<string, FixSuggestion> = {
         why: 'The resource cannot be parsed as valid JSON.',
         fix: 'Check for syntax errors: missing quotes, commas, brackets, or trailing commas.',
     },
+    'structural-invalid-format': {
+        why: 'The primitive value does not match the FHIR format for its declared type.',
+        fix: 'Use the FHIR primitive format expected by the element, such as adding seconds and a timezone for dateTime values.',
+        example: 'Use 2026-05-15T11:59:02Z instead of 2026-05-15T11:59:02',
+    },
     'structural-unknown-element': {
         why: 'This element is not defined in the FHIR specification for this resource type.',
         fix: 'Remove the unknown element, or use an extension if custom data is needed.',
@@ -198,8 +203,8 @@ export const CATALOG_CORE: Record<string, FixSuggestion> = {
         fix: 'Use just the version number without ETag wrapper.',
     },
     'metadata-version-id-same-as-id': {
-        why: 'versionId and resource id serve different purposes.',
-        fix: 'Use a separate version identifier, typically sequential numbers.',
+        why: 'versionId and resource id serve different purposes, but matching values are not a FHIR conformance error.',
+        fix: 'Informational only. Keep it if your server intentionally starts versioning at the logical id value.',
     },
     'metadata-version-id-very-high': {
         why: 'Unusually high versionId may indicate timestamp-based versioning.',

packages/validation-types/src/fix-suggestions/catalog-misc.ts

@@ -126,8 +126,8 @@ export const CATALOG_MISC: Record<string, FixSuggestion> = {
         fix: 'Add enableBehavior ("all" or "any") when item has multiple enableWhen conditions.',
     },
     'questionnaire-invariant-que-5': {
-        why: 'Questionnaire invariant que-5: only "coding" and "quantity" items can have answerOption.',
-        fix: 'Set item.type to choice/open-choice or remove the answerOption.',
+        why: 'Questionnaire invariant que-5: only answer-capable Questionnaire item types can have answerOption or answerValueSet.',
+        fix: 'Set item.type to a compatible answer type such as choice/open-choice, coding, decimal, integer, date, dateTime, time, string, or quantity; otherwise remove the answer source.',
     },
     'questionnaire-invariant-que-6': {
         why: 'Questionnaire invariant que-6: required items must have items or initial.',

packages/validation-types/src/validation/__tests__/mii-2026-preset.test.ts

@@ -2,6 +2,10 @@ import { describe, expect, it } from 'vitest';
 import {
   createEhds2026ValidationSettings,
   createMii2026ValidationSettings,
+  FHIR_CORE_EXTENSION_PACKAGE_SET,
+  FHIR_CORE_EXTENSION_PACKAGE_VERSIONS,
+  FHIR_CORE_TERMINOLOGY_PACKAGE_SET,
+  FHIR_CORE_TERMINOLOGY_PACKAGE_VERSIONS,
   HL7_EU_EHDS_2026_PACKAGE_SET,
   HL7_EU_EHDS_2026_PACKAGE_VERSIONS,
   HL7_EU_EPS_XTEHR_REFERENCE_PACKAGE,
@@ -10,6 +14,28 @@ import {
 } from '../index';
 
 describe('MII 2026 validation preset', () => {
+  it('pins core terminology packages for deterministic local binding checks', () => {
+    expect(FHIR_CORE_TERMINOLOGY_PACKAGE_SET)
+      .toHaveLength(Object.keys(FHIR_CORE_TERMINOLOGY_PACKAGE_VERSIONS).length);
+    expect(FHIR_CORE_TERMINOLOGY_PACKAGE_SET).toContainEqual({
+      id: 'hl7.terminology.r5',
+      version: '7.1.0'
+    });
+  });
+
+  it('pins core extension packages for deterministic local extension checks', () => {
+    expect(FHIR_CORE_EXTENSION_PACKAGE_SET)
+      .toHaveLength(Object.keys(FHIR_CORE_EXTENSION_PACKAGE_VERSIONS).length);
+    expect(FHIR_CORE_EXTENSION_PACKAGE_SET).toContainEqual({
+      id: 'hl7.fhir.uv.extensions.r4',
+      version: '5.3.0'
+    });
+    expect(FHIR_CORE_EXTENSION_PACKAGE_SET).toContainEqual({
+      id: 'hl7.fhir.uv.extensions.r5',
+      version: '5.3.0'
+    });
+  });
+
   it('keeps the package pin set in sync with the version map', () => {
     expect(MII_2026_PACKAGE_SET).toHaveLength(Object.keys(MII_2026_PACKAGE_VERSIONS).length);
     expect(MII_2026_PACKAGE_SET).toContainEqual({

packages/validation-types/src/validation/defaults/ig-packages.ts

@@ -9,6 +9,24 @@ export interface FhirPackagePin {
   version: string;
 }
 
+export const FHIR_CORE_TERMINOLOGY_PACKAGE_VERSIONS = {
+  'hl7.terminology.r4': '7.1.0',
+  'hl7.terminology.r5': '7.1.0',
+} as const;
+
+export const FHIR_CORE_TERMINOLOGY_PACKAGE_SET: FhirPackagePin[] = Object.entries(
+  FHIR_CORE_TERMINOLOGY_PACKAGE_VERSIONS
+).map(([id, version]) => ({ id, version }));
+
+export const FHIR_CORE_EXTENSION_PACKAGE_VERSIONS = {
+  'hl7.fhir.uv.extensions.r4': '5.3.0',
+  'hl7.fhir.uv.extensions.r5': '5.3.0',
+} as const;
+
+export const FHIR_CORE_EXTENSION_PACKAGE_SET: FhirPackagePin[] = Object.entries(
+  FHIR_CORE_EXTENSION_PACKAGE_VERSIONS
+).map(([id, version]) => ({ id, version }));
+
 export const MII_2026_PACKAGE_VERSIONS = {
   'de.basisprofil.r4': '1.5.4',
   'de.medizininformatikinitiative.kerndatensatz.meta': '2026.0.0',

packages/validation-types/src/validation/index.ts

@@ -141,6 +141,10 @@ export {
   DEFAULT_CACHE_CONFIG,
   createEhds2026ValidationSettings,
   createMii2026ValidationSettings,
+  FHIR_CORE_EXTENSION_PACKAGE_SET,
+  FHIR_CORE_EXTENSION_PACKAGE_VERSIONS,
+  FHIR_CORE_TERMINOLOGY_PACKAGE_SET,
+  FHIR_CORE_TERMINOLOGY_PACKAGE_VERSIONS,
   HL7_EU_EHDS_2026_PACKAGE_SET,
   HL7_EU_EHDS_2026_PACKAGE_VERSIONS,
   HL7_EU_EPS_XTEHR_REFERENCE_PACKAGE,

packages/validation-types/src/validation/settings-defaults.ts

@@ -13,6 +13,10 @@ export type {
   Mii2026ValidationSettingsOverrides,
 } from './defaults/ig-packages';
 export {
+  FHIR_CORE_EXTENSION_PACKAGE_VERSIONS,
+  FHIR_CORE_EXTENSION_PACKAGE_SET,
+  FHIR_CORE_TERMINOLOGY_PACKAGE_VERSIONS,
+  FHIR_CORE_TERMINOLOGY_PACKAGE_SET,
   MII_2026_PACKAGE_VERSIONS,
   MII_2026_PACKAGE_SET,
   HL7_EU_EHDS_2026_PACKAGE_VERSIONS,

packages/validation-types/src/validation/settings-schema.ts

@@ -155,6 +155,9 @@ export const TerminologyResolutionSchema = z.object({
         validateCodes: z.boolean(),
         cacheResults: z.boolean(),
         cacheTTLSeconds: z.number(),
+        requestTimeoutMs: z.number().optional(),
+        slowResponseThresholdMs: z.number().optional(),
+        maxRemoteCodeSystemValidations: z.number().optional(),
     }).optional(),
     twoPhaseExpansion: z.object({
         enabled: z.boolean(),

packages/validation-types/src/validation/settings.ts

@@ -78,6 +78,7 @@ export interface AdvisorRuleMatch {
   code?: string | string[];
   path?: string | string[];
   message?: string;
+  messageRegex?: string | string[];
   aspect?: string | string[];
   severity?: string;
   profile?: string;
@@ -202,6 +203,12 @@ export interface ValidationSettings {
       cacheResults: boolean;
       /** Cache expiration in seconds (default: 3600) */
       cacheTTLSeconds: number;
+      /** Per-request timeout for remote terminology operations. */
+      requestTimeoutMs?: number;
+      /** Open the remote terminology circuit after repeated slow responses. */
+      slowResponseThresholdMs?: number;
+      /** Cap direct remote CodeSystem validations per validator instance. */
+      maxRemoteCodeSystemValidations?: number;
     };
 
     /**

packages/validator/CHANGELOG.md

@@ -12,6 +12,40 @@ ship together; package-only changes are noted under each release.
 
 No unreleased changes yet.
 
+## [0.4.2] — 2026-07-05
+
+Patch release for validator architecture boundaries, evidence policy, and
+maintainability after the 0.4.1 evidence release.
+
+### Added
+
+- Added stable `host` and `conformance` package surfaces for embedding and
+  evidence tooling, keeping repository consumers off deprecated implementation
+  subpaths.
+- Added `dedupeIssuesWithTrace()` so duplicate-suppression decisions expose the
+  named policy rule that removed an issue.
+- Added an explicit FHIR Schema runtime policy export that keeps the graph path
+  evidence-only until Java/reference and dual-path gates justify promotion.
+
+### Changed
+
+- Hardened public-export and mirror-import architecture guards so new internal
+  validator exports or repository imports fail fast.
+- Split terminology remote CodeSystem budget handling out of the API client and
+  kept the fail-open budget reason traceable.
+- Split remote CodeSystem budget aggregation tests into focused coverage.
+
+### Documentation
+
+- Documented validator fallback, fail-open, fail-closed, legacy compatibility,
+  and release-gate guardrails.
+
+### Verification
+
+- Verified with merged PR #252 CI, main CI, validator build, OSS boundary audit,
+  OSS package smoke, architecture guards, focused Vitest suites, and npm publish
+  dry-run.
+
 ## [0.4.1] — 2026-07-01
 
 Patch release for the standalone validator evidence lanes and MII reference