@cosyte/fhir 0.0.10 → 0.1.0

package/dist/index.d.ts

@@ -359,6 +359,28 @@ interface FhirComplex {
      * read from JSON. See {@link isDroppedText}.
      */
     readonly droppedText?: true;
+    /**
+     * Set when the XML document's **root** element resolved to a vocabulary that is neither FHIR's nor
+     * none at all: `<Observation xmlns="urn:vendor">` or `<v:Observation xmlns:v="urn:vendor">`. The
+     * reader already reports that position ({@link ../xml/issues.js ISSUE_CODES.UNEXPECTED_XML_CONTENT}),
+     * but a report lives in the issue list and the issue list is not carried on the model, so a writer
+     * handed the model alone could not tell a vendor-rooted resource from one authored in FHIR.
+     *
+     * **A marker that the root named another vocabulary, NOT the vocabulary.** It is a literal `true`:
+     * the namespace URI is document content and is deliberately not kept, so nothing here can be
+     * echoed into a diagnostic and no walker gains a position. What it buys is that
+     * {@link ../xml/write.js serializeResourceXml} refuses rather than emitting a FHIR-namespaced
+     * document whose re-read carries an empty issue list.
+     *
+     * **Set at a document root and nowhere else.** An element that merely inherits a foreign namespace
+     * from its parent is flagged where the document leaves the vocabulary and is not marked here, and
+     * a root whose prefix resolves to **nothing** is not marked either: that root reads under its
+     * verbatim tag, and its XML write is refused at the tag sites on a code of its own rather than
+     * through this marker. A root declaring no
+     * namespace at all is read as FHIR, unflagged and unmarked. Absent on every conformant document
+     * and on every document read from JSON. See {@link isForeignRoot}.
+     */
+    readonly foreignRoot?: true;
 }
 /**
  * A repeating element: an ordered list of item nodes. A primitive list preserves value-absent slots
@@ -531,6 +553,35 @@ declare function isDroppedText(node: FhirNode): boolean;
  * ```
  */
 declare function isUndefinedNull(node: FhirNode): boolean;
+/**
+ * Whether the XML document's **root** element resolved to a vocabulary other than FHIR's: a vendor
+ * namespace reached by a default declaration or by a bound prefix.
+ *
+ * The reader models such a root as the FHIR resource its local name spells and reports the position,
+ * because it is schema-free and lenient and the local name is the only thing it has to go on. That
+ * report is a warning in the issue list and the model carries no issue list, so before this marker
+ * existed a caller could write the model back to XML and get a document in the FHIR namespace whose
+ * re-read said nothing at all: one round trip and a vendor document was indistinguishable from FHIR.
+ * {@link ../xml/write.js serializeResourceXml} refuses a marked model rather than emit that.
+ *
+ * **The namespace itself is NOT kept**, which is the difference between this and recovering the
+ * vocabulary. The document's own namespace URI is content, and a marker cannot leak content.
+ *
+ * `false` for a root that declares no namespace (read as FHIR on purpose), for a root whose prefix
+ * resolves to nothing (modeled under its verbatim tag, and refused by the XML writer at its tag
+ * sites rather than through this marker), for
+ * foreign content below a root, for every document read from JSON, and for every conformant document.
+ *
+ * @param node - Any model node.
+ * @returns `true` when this node is a root the XML reader read out of another vocabulary.
+ * @example
+ * ```ts
+ * import { isForeignRoot, parseResourceXml } from "@cosyte/fhir";
+ * const { resource } = parseResourceXml('<Observation xmlns="urn:vendor"><id value="o1"/></Observation>');
+ * isForeignRoot(resource); // true
+ * ```
+ */
+declare function isForeignRoot(node: FhirNode): boolean;
 /** Optional `id` / `extension` metadata for {@link primitive}. */
 interface PrimitiveMeta {
     readonly id?: string;
@@ -1423,25 +1474,40 @@ declare function serializeResource(node: FhirComplex): string;
  * {@link assertSerializable} runs in both writers, because a dropped-character-data marker has no
  * conformant encoding in either format. {@link breaksTag} governs the XML writer only, because the
  * harm is a name reaching a tag position, and JSON escapes a member name so no name reaches this
- * refusal there. {@link refuseUnserializableDivMarkup} is raised by the XML writer for the same
- * reason, at its one raw-markup site: JSON carries the string as a string.
- * {@link assertXmlSerializable}, {@link assertXmlArrayWrapper} and {@link assertXmlResourceType} are
+ * refusal there. {@link carriesUndeclarablePrefix} is XML-only for the same reason: a colon is a
+ * namespace prefix only in an XML name, and JSON spells the member name as a string.
+ * {@link refuseUnserializableDivMarkup} and {@link refuseUnboundDivPrefixes} are raised by the XML
+ * writer for the same reason, at its one raw-markup site: JSON carries the string as a string.
+ * {@link isXmlName} and {@link carriesNonXmlCharacter} are XML-only too: they are the XML 1.0 `Name`
+ * and `Char` productions, asked of what the XML writer emits as a tag name, an attribute value or a
+ * spliced `div` string, and JSON spells every one of those as a string.
+ * {@link assertXmlSerializable}, {@link assertXmlArrayWrapper}, {@link assertXmlValueChoiceWrapper}
+ * and {@link assertXmlResourceType} are
  * XML-only for the mirror-image reason: the shapes they refuse are ones the JSON writer writes, and
- * XML has no channel to write them into. {@link assertNoShadowedProperty} runs in **both** for the
- * first reason again: a
+ * XML has no channel to write them into. {@link assertXmlForeignRoot} is XML-only for a reason of its
+ * own and the difference is worth reading rather than assuming: a namespace is an XML construct, so
+ * it is the XML writer that has a vocabulary to get wrong, and `serializeResource` emits that model
+ * exactly as it always did. **That is not a claim the JSON channel keeps the flag** -- it does not,
+ * and that half is declared open rather than closed by this one.
+ * {@link assertNoShadowedProperty} runs in **both** for the first reason again: a
  * member a repeated property name shadowed falls outside both walks, which visit `properties` only,
  * and neither format has a spelling that re-reads as the ambiguity the model holds. No refusal here
  * recognises anything new or invents a value. **It is NOT true that none of them changes a document
- * that reads clean** -- `breaksTag` and {@link assertXmlResourceType} each name a document of their
- * own that reads with zero issues and is refused anyway; that clause was carried here as a universal
- * and is cut rather than reworded.
+ * that reads clean** -- `breaksTag`, {@link assertXmlResourceType} and
+ * {@link carriesUndeclarablePrefix} each name a document of their own that reads with zero issues and
+ * is refused anyway, and so do {@link refuseUnboundDivPrefixes}, {@link isXmlName} and
+ * {@link carriesNonXmlCharacter}; that clause was carried here as a universal and is cut rather than
+ * reworded.
  *
  * **This module is a list of the refusals it implements, NOT a closed account of what a writer can
  * author.** Two of the predicates deliberately live somewhere else rather than being copied here,
  * because a copy would be free to disagree with the thing it copies: `emitsOneDivElement` sits in
- * `../xml/write.js` next to the code that emits the markup, and the cardinality window
+ * `../xml/write.js` next to the code that emits the markup (and `bindsEveryPrefix`, the question that
+ * branch asks of the same parse next, sits beside it for the same reason), and the cardinality window
  * {@link assertXmlArrayWrapper} refuses on is the safety layer's own walk in `../safety/status.js`,
- * the same walk that reports it to a caller.
+ * the same walk that reports it to a caller. {@link assertXmlValueChoiceWrapper} follows that rule
+ * at the one position the safety layer's walk does not reach: its window is the value layer's own,
+ * in `../quantity/value.js`, the same call the validator and the value readout report from.
  *
  * The rest of this comment is the first refusal.
  *
@@ -1528,6 +1594,21 @@ declare const SERIALIZE_ERROR_CODES: {
      * See {@link assertXmlArrayWrapper} for the exact predicate and for what it deliberately leaves.
      */
     readonly UNSERIALIZABLE_ARRAY_WRAPPER: "UNSERIALIZABLE_ARRAY_WRAPPER";
+    /**
+     * The model carries, at a location this library already reports as an array-wrapped
+     * `Observation.value[x]` choice, a wrapper FHIR XML has no repetition to spell back: one holding
+     * fewer than two items. **XML only**: `serializeResource` writes the list back and the re-read
+     * reports the same location, so that route stays open.
+     *
+     * The same harm as {@link SERIALIZE_ERROR_CODES.UNSERIALIZABLE_ARRAY_WRAPPER}, at the position
+     * where the number is a DOSE: `{"resourceType":"Observation","status":"final","valueQuantity":
+     * [{"value":5,"system":"http://unitsofmeasure.org","code":"mg"}]}` reads with the encoding
+     * reported and no magnitude handed out, and used to come back from XML as an unambiguous 5 mg
+     * nothing had complained about.
+     *
+     * See {@link assertXmlValueChoiceWrapper} for the window and for what it deliberately leaves.
+     */
+    readonly UNSERIALIZABLE_CHOICE_WRAPPER: "UNSERIALIZABLE_CHOICE_WRAPPER";
     /**
      * The model carries, at one or more object elements, a member a repeated property name shadowed
      * ({@link ../model/node.js} `duplicates`). **Both writers**, unlike the four refusals above it:
@@ -1548,6 +1629,151 @@ declare const SERIALIZE_ERROR_CODES: {
      * See {@link assertXmlResourceType} for the window and for what it deliberately leaves.
      */
     readonly UNSERIALIZABLE_RESOURCE_TYPE: "UNSERIALIZABLE_RESOURCE_TYPE";
+    /**
+     * The model carries, at one or more elements, a root the XML reader read out of a vocabulary that
+     * resolved to something other than FHIR's. **XML only**: `serializeResource` spells a member name
+     * and never a namespace, so it emits the model exactly as it did before this refusal existed and
+     * that route stays open -- which is a statement about that writer's output, **not** a claim that
+     * the JSON channel keeps the flag. It does not, and that half is declared open.
+     *
+     * FHIR XML puts the resource in the FHIR namespace, and the writer has no vendor binding to write
+     * instead, so it emitted a document in the FHIR namespace with no trace of the one the sender
+     * wrote. That output re-reads with an **empty** issue list, so the one warning that said the
+     * document came from another vocabulary is gone after a single trip and the vendor document is
+     * indistinguishable from FHIR.
+     *
+     * See {@link assertXmlForeignRoot} for the window, the two routes weighed, and what it costs.
+     */
+    readonly UNSERIALIZABLE_FOREIGN_ROOT: "UNSERIALIZABLE_FOREIGN_ROOT";
+    /**
+     * The model holds, at one or more tag positions, a name carrying a colon. XML reads the colon as
+     * a namespace prefix, and the model carries no namespace binding for the writer to declare one
+     * with, so the document would not be namespace-well-formed. **XML only**: `serializeResource`
+     * spells a member name as a JSON string, so this refusal never reaches it and that route stays
+     * open.
+     *
+     * Written anyway, the output named a prefix nothing declared, which a conformant XML parser
+     * rejects, and a prefix rebound between siblings (`<p:x xmlns:p="urn:a"/>` beside
+     * `<p:x xmlns:p="urn:b"/>`) lost its `MIXED_XML_SPELLING` report across one write and one re-read.
+     * **Not {@link SERIALIZE_ERROR_CODES.UNSERIALIZABLE_ELEMENT_NAME}**, whose line is whether this
+     * library's own round trip survives a name: a colon-bearing name survives that round trip, so the
+     * two are different questions and keep different codes. A name that trips both keeps that one.
+     *
+     * See {@link carriesUndeclarablePrefix} for the exact predicate, its one exemption, and what it
+     * leaves.
+     */
+    readonly UNSERIALIZABLE_PREFIXED_NAME: "UNSERIALIZABLE_PREFIXED_NAME";
+    /**
+     * The model holds, at one or more `div` locations, a string the XML writer would splice in as raw
+     * markup that spells the one `div` element the property names, and whose markup names a namespace
+     * prefix, on an element or on an attribute, that no declaration inside the string binds. **XML
+     * only**: `serializeResource` carries the string as a string, so this refusal never reaches it and
+     * that route stays open.
+     *
+     * Written anyway, `<v:div>x</v:div>` put a prefix nothing declared into the output, which a
+     * conformant XML parser rejects, and this library's own re-read of that output turned the narrative
+     * into a property named `v:div`: the narrative gone after one write and one read, with no
+     * diagnostic at either end. **Not {@link SERIALIZE_ERROR_CODES.UNSERIALIZABLE_PREFIXED_NAME}**,
+     * whose published meaning is a name at a tag position, and **not
+     * {@link SERIALIZE_ERROR_CODES.UNSERIALIZABLE_DIV_MARKUP}**, whose question is which elements the
+     * string contributes: a string that fails that question keeps that code whatever prefix it names.
+     *
+     * See `bindsEveryPrefix` in `../xml/write.js` for the exact predicate and what it leaves.
+     *
+     * @example
+     * ```ts
+     * import {
+     *   FhirSerializeError,
+     *   SERIALIZE_ERROR_CODES,
+     *   parseResource,
+     *   serializeResourceXml,
+     * } from "@cosyte/fhir";
+     * const { resource } = parseResource(
+     *   '{"resourceType":"Patient","text":{"status":"generated","div":"<v:div>x</v:div>"}}',
+     * );
+     * try {
+     *   serializeResourceXml(resource);
+     * } catch (err) {
+     *   if (err instanceof FhirSerializeError && err.code === SERIALIZE_ERROR_CODES.UNSERIALIZABLE_DIV_PREFIX) {
+     *     err.locations; // ["Patient.text.div"]
+     *   }
+     * }
+     * ```
+     */
+    readonly UNSERIALIZABLE_DIV_PREFIX: "UNSERIALIZABLE_DIV_PREFIX";
+    /**
+     * The model holds, at one or more tag positions, a name that is not an XML 1.0 `Name` (production
+     * [5]): `a&b`, `1abc`, `-x`, a name carrying U+0000 or an unpaired surrogate. A conforming XML
+     * processor must reject such a document as a fatal error. **XML only**: `serializeResource` spells
+     * a member name as a JSON string, so this refusal never reaches it and that route stays open.
+     *
+     * Written anyway, `<a&b value="v"/>` was a document this library's own reader read back unchanged
+     * and a third-party parser rejected, which is why the tag-breaking refusal, whose line is this
+     * library's own round trip, never reached it. **Not
+     * {@link SERIALIZE_ERROR_CODES.UNSERIALIZABLE_ELEMENT_NAME}** and **not
+     * {@link SERIALIZE_ERROR_CODES.UNSERIALIZABLE_PREFIXED_NAME}**: a name that breaks the tag, or
+     * carries a colon, keeps the code it drew before this one existed, whether or not it is a `Name`.
+     * A name carrying a character outside `Char` is not a `Name`, so it draws this code rather than
+     * {@link SERIALIZE_ERROR_CODES.UNSERIALIZABLE_XML_CHARACTER}.
+     *
+     * See {@link isXmlName} for the exact predicate and what it leaves.
+     *
+     * @example
+     * ```ts
+     * import {
+     *   FhirSerializeError,
+     *   SERIALIZE_ERROR_CODES,
+     *   parseResource,
+     *   serializeResourceXml,
+     * } from "@cosyte/fhir";
+     * const { resource } = parseResource('{"resourceType":"Patient","1abc":"v"}');
+     * try {
+     *   serializeResourceXml(resource);
+     * } catch (err) {
+     *   if (err instanceof FhirSerializeError && err.code === SERIALIZE_ERROR_CODES.UNSERIALIZABLE_XML_NAME) {
+     *     err.locations; // ["Patient.<withheld>"]
+     *   }
+     * }
+     * ```
+     */
+    readonly UNSERIALIZABLE_XML_NAME: "UNSERIALIZABLE_XML_NAME";
+    /**
+     * The model holds, at one or more locations, a value the XML writer would emit as an attribute
+     * value (a primitive's `value`, an `id` written as an attribute, an `Extension.url`), or a `div`
+     * string it would splice in, carrying a code point outside XML 1.0 `Char` (production [2]): U+0000
+     * to U+0008, U+000B, U+000C, U+000E to U+001F, an unpaired surrogate, U+FFFE or U+FFFF. In a `div`
+     * string that includes a numeric character reference denoting one (`&#0;`), which the Legal
+     * Character constraint makes as fatal as the raw character; each reference is judged on its own, so
+     * `&#xD83D;&#xDE00;` is two unpaired surrogates, not one character. **XML only**: `serializeResource`
+     * writes these values as JSON strings, so this refusal never reaches it and that route stays open.
+     *
+     * Written anyway, a U+0000 went into the output raw and a conforming processor rejected the
+     * document. **Refused, never repaired**: a reference to a non-`Char` is itself a fatal error, and
+     * replacing or dropping the character would change a value the sender wrote, so the model is left
+     * exactly as it was and no string is returned. Raised after every other refusal, the name code
+     * included.
+     *
+     * See {@link carriesNonXmlCharacter} for the exact predicate.
+     *
+     * @example
+     * ```ts
+     * import {
+     *   FhirSerializeError,
+     *   SERIALIZE_ERROR_CODES,
+     *   parseResource,
+     *   serializeResourceXml,
+     * } from "@cosyte/fhir";
+     * const { resource } = parseResource('{"resourceType":"Patient","gender":"a\\u0000"}');
+     * try {
+     *   serializeResourceXml(resource);
+     * } catch (err) {
+     *   if (err instanceof FhirSerializeError && err.code === SERIALIZE_ERROR_CODES.UNSERIALIZABLE_XML_CHARACTER) {
+     *     err.locations; // ["Patient.gender"]
+     *   }
+     * }
+     * ```
+     */
+    readonly UNSERIALIZABLE_XML_CHARACTER: "UNSERIALIZABLE_XML_CHARACTER";
 };
 /** Discriminant union of every {@link SERIALIZE_ERROR_CODES} value. */
 type SerializeErrorCode = (typeof SERIALIZE_ERROR_CODES)[keyof typeof SERIALIZE_ERROR_CODES];
@@ -1920,6 +2146,18 @@ declare function buildBindingRegistry(extra?: readonly TerminologyBinding[]): Bi
  * With **no** service configured at all, the validator behaves as if every membership question
  * returned `"unknown"`: it never emits a false "not a member" error (fail-safe).
  *
+ * **A membership answer may declare the code-system release it was made against.** A `not-in` for an
+ * RxNorm code is an answer against one monthly RxNorm drop, not a timeless fact, so
+ * {@link CodeValidationResult} carries an optional `systemVersion`: the release the service consulted
+ * when it decided. The declaration is the **caller's own assertion** and the library verifies nothing
+ * about it, it does not fetch, parse, compare or normalise the string, and it bundles no code-system
+ * content against which it could. The declaration is **optional and additive**: a service that
+ * declares nothing is a conformant service, and the absent case is a first-class part of this
+ * contract rather than an omission, a finding derived from an undeclared answer is marked as having
+ * an undeclared release rather than left silent (see {@link ../validate/issues.js}
+ * `CodeSystemVersionRecord`), because a silence reads as "current" and that is exactly the
+ * implication a stale answer must not carry.
+ *
  * The library ships **no implementation**, wiring a real one is a consumer/`pathways` concern. This
  * module defines only the contract.
  *
@@ -1952,6 +2190,30 @@ type CodeMembership =
 interface CodeValidationResult {
     /** Whether the code is in the value set, not in it, or undecidable. */
     readonly membership: CodeMembership;
+    /**
+     * **Optional.** The code-system release this answer was made against, exactly as the service
+     * names it: an RxNorm monthly drop (`"2026-08-04"`), a SNOMED CT edition
+     * (`"http://snomed.info/sct/731000124108/version/20260301"`), a LOINC release (`"2.78"`). It is
+     * carried onto the finding the validator emits (`CODE_NOT_IN_VALUESET`) and reaches the
+     * `OperationOutcome`, so a consumer reconciling a validation report months later can tell which
+     * release the answer was made against without asking the service again.
+     *
+     * **The library verifies nothing about it.** This is the service's own assertion, preserved
+     * **exactly**: never trimmed, case-folded, parsed, truncated or substituted. The library vendors
+     * no code-system content, so it has nothing to check the string against and does not pretend to.
+     *
+     * **Declaring nothing is conformant, and is recorded rather than assumed.** Omit it (or, from
+     * untyped JavaScript, hand over a value that is not a non-blank string) and the finding is marked
+     * as having an **undeclared** release. No default, "latest" or "current" release is ever
+     * substituted, and the answer is otherwise unchanged: this field never affects `membership`,
+     * severity, or whether a finding is emitted at all.
+     *
+     * It is a code-**system** release, not a value-set version, and it must never be read from the
+     * instance being validated: a resource's own `Coding.version` is document content, and echoing it
+     * onto a finding would publish instance data through the one surface this library keeps
+     * value-free.
+     */
+    readonly systemVersion?: string;
 }
 /**
  * A pluggable terminology service, the one seam through which value-set **content** enters the
@@ -1959,7 +2221,10 @@ interface CodeValidationResult {
  *
  * An implementation MUST be **fail-safe**: when it cannot answer, it returns
  * `{ membership: "unknown" }` rather than throwing or guessing. It MUST be value-free, it receives
- * only identities ({@link CodeValidationRequest}), never a resource or a patient value.
+ * only identities ({@link CodeValidationRequest}), never a resource or a patient value. It MAY
+ * declare the code-system release an answer was made against
+ * ({@link CodeValidationResult.systemVersion}); declaring nothing is conformant and is recorded as
+ * undeclared rather than read as "current".
  *
  * @example
  * ```ts
@@ -1972,6 +2237,15 @@ interface CodeValidationResult {
  *     return { membership: ["red", "green", "blue"].includes(code) ? "in" : "not-in" };
  *   },
  * };
+ *
+ * // The same service, declaring the release each answer was made against.
+ * const dated: TerminologyService = {
+ *   validateCode({ valueSet, code }) {
+ *     if (valueSet !== "http://example.org/vs/colors") return { membership: "unknown" };
+ *     const membership = ["red", "green", "blue"].includes(code) ? "in" : "not-in";
+ *     return { membership, systemVersion: "2026-08-04" };
+ *   },
+ * };
  * ```
  */
 interface TerminologyService {
@@ -1995,13 +2269,23 @@ interface TerminologyService {
  *
  * **What ships built-in here is a named, deliberately short list:** the base `Resource` /
  * `DomainResource` elements (which are the same on every resource), plus one element table per
- * modeled resource type. The types modeled today are exactly **`Patient`** and **`Observation`**,
- * and that enumeration is the whole set, there is no third. Every other resource type is
+ * modeled resource type. Read the enumeration off {@link BUILTIN_SCHEMAS} and never off a sentence
+ * here: it is `Patient` plus the resource types this library treats as safety-critical, and a
+ * written-down list in prose is the thing that goes stale. Every other resource type is
  * "not modeled yet" and degrades safely (see {@link ./validate.js}) rather than emitting false
  * errors, which is why the set grows one fully-verified table at a time: a table missing a row R4
  * defines turns a conformant document into an unknown-element finding, so a half-entered type would
  * be worse than no entry at all. Cardinalities are cited from the R4 4.0.1 base definitions
- * (resource.html, domainresource.html, patient.html, observation.html).
+ * (resource.html, domainresource.html, patient.html, observation.html, allergyintolerance.html,
+ * condition.html, diagnosticreport.html, immunization.html, medicationrequest.html,
+ * medicationstatement.html).
+ *
+ * **Only a `required`-strength binding on a `code`-typed element is carried here**, because that is
+ * the only one this layer can decide from an enumeration alone. A `required` binding on a
+ * `CodeableConcept` (`Condition.clinicalStatus` and `AllergyIntolerance.verificationStatus` among
+ * them) is a membership question about a `Coding` inside a complex datatype, which belongs to the
+ * terminology layer; the element is carried with its cardinality and datatype and its binding is
+ * left alone. Weaker strengths (`extensible`, `preferred`, `example`) are that layer's too.
  *
  * @packageDocumentation
  */
@@ -2127,6 +2411,14 @@ declare function resolveElement(elements: Readonly<Record<string, ElementSchema>
  * {@link diagnosticFor} table, there is no code path that interpolates an instance value into a
  * message. This is the redaction chokepoint.
  *
+ * Two identities ride **beside** that text rather than through it, and neither is instance data: the
+ * invariant {@link ValidationIssue.constraint} key (a published FHIR identifier such as `"ait-1"`)
+ * and the {@link ValidationIssue.codeSystemVersion} record (the code-system release a
+ * caller-supplied terminology service declared its answer was made against, plus the explicit
+ * marker for an answer that declared none). Both are assertions made outside the document: adding
+ * one to `DIAGNOSTIC_OF`, or interpolating either into a diagnostic string, would breach the
+ * chokepoint, so neither ever does.
+ *
  * @packageDocumentation
  */
 /**
@@ -2218,6 +2510,30 @@ declare const VALIDATION_CODES: {
      * and the safety layer reads through it; this reports that the encoding was ambiguous.
      */
     readonly ARRAY_WRAPPED_SCALAR: "ARRAY_WRAPPED_SCALAR";
+    /**
+     * Safety, an `Observation.value[x]` choice element arrived wrapped in a JSON array. The same
+     * non-conformant encoding {@link VALIDATION_CODES.ARRAY_WRAPPED_SCALAR} reports (json.html
+     * §2.6.2.2 reserves the array for a repeating element), at the one position whose cardinality is
+     * decided by a choice rather than by a per-resource element table, so it needs a code of its own
+     * rather than a wider window on that one. An `error`.
+     *
+     * **Why the value readout needs its own channel.** `readObservationValue` fails safe on this
+     * shape, it reports the variant that is present and no `quantity`, so no wrong number is handed
+     * out, but "the variant is present and the magnitude is absent" reads identically to an
+     * `Observation` whose `valueQuantity` carried no `value`. A dose the sender wrote is then
+     * indistinguishable from one it did not, and this is the record that the position held content
+     * nothing here would read.
+     *
+     * **The window is `Observation.value[x]` and `Observation.component.value[x]`, at every
+     * Observation resource root the model holds**, which is the window the value readout itself reads
+     * (`../quantity/value.js`). Both are `0..1` in R4 (observation.html), so this needs no
+     * per-resource cardinality table and cannot fire on a conformant document. It is deliberately not
+     * every R4 `0..1` element: that is the per-resource model this library does not have.
+     *
+     * Value-free, the location of the choice variant, never the magnitude, unit or code inside the
+     * wrapper.
+     */
+    readonly ARRAY_WRAPPED_CHOICE: "ARRAY_WRAPPED_CHOICE";
     /**
      * Safety, the document wrote a JSON array **inside another array**. FHIR JSON uses an array for a
      * repeating element and for nothing else (json.html §2.6.2.2), so a list of lists has no meaning at
@@ -2285,17 +2601,26 @@ declare const VALIDATION_CODES: {
      */
     readonly RETRACTED_RESOURCE: "RETRACTED_RESOURCE";
     /**
-     * Safety, a named resource invariant failed (`ait-1`/`ait-2`, `con-3`/`con-4`/`con-5`,
-     * `obs-6`/`obs-7`). The specific constraint key travels in {@link ValidationIssue.constraint}, and
-     * the severity mirrors the constraint's own (`error`, except the best-practice `con-3` → `warning`).
+     * Invariant, a resource constraint failed. Three sources raise it, each with or without the
+     * others: the safety layer's named invariants (`ait-1`/`ait-2`, `con-3`/`con-4`/`con-5`,
+     * `obs-6`/`obs-7`); the base-constraint layer, which evaluates the other error-severity
+     * constraints R4 declares on the eight modeled types and their `DomainResource` / `Element` /
+     * `Extension` base (`pat-1`, `obs-3`, `con-1`, `con-2`, `imm-1`, `dom-2` to `dom-5`, `ele-1`,
+     * `ext-1`) with no profile supplied; and a supplied profile's own `constraint`s. The specific
+     * constraint key travels in {@link ValidationIssue.constraint}, and the severity mirrors the
+     * constraint's own (`error`, except a `warning` constraint such as the best-practice `con-3`).
      */
     readonly INVARIANT_VIOLATED: "INVARIANT_VIOLATED";
     /**
-     * Invariant, a profile `constraint`'s FHIRPath `expression` is **outside the bounded
+     * Invariant, a `constraint`'s FHIRPath `expression`, from a supplied profile or from the R4 base
+     * constraints the base-constraint layer evaluates, is **outside the bounded
      * engine's subset** and could not be evaluated. Always `information` (`informational`):
      * the constraint is reported **unchecked, never assumed to pass** (fail-safe), the
      * library does not claim conformance to an invariant it could not test. The constraint `key` travels
      * in {@link ValidationIssue.constraint}. Value-free (the location + key, never an instance value).
+     * A profile's verbatim copy of an R4 base constraint that the base-constraint layer decided at the
+     * same occurrence is not reported this way, because that constraint was evaluated: R4's `dom-3`
+     * on a resource with nothing contained draws nothing, with or without a profile.
      */
     readonly INVARIANT_UNCHECKED: "INVARIANT_UNCHECKED";
     /**
@@ -2341,6 +2666,11 @@ declare const VALIDATION_CODES: {
      * never an error). Emitted **only** when a service definitively answers `not-in`; with no service,
      * or an `unknown` answer, the library degrades to the content-free system checks and never
      * false-errors (fail-safe). Value-free, the coding location, never the code itself.
+     *
+     * The **only** finding that carries a {@link ValidationIssue.codeSystemVersion} record, because it
+     * is the only one a terminology service produces: the release the service declared its answer was
+     * made against, or the explicit mark that it declared none. Severity, emission and the fail-safe
+     * degrade are all independent of it.
      */
     readonly CODE_NOT_IN_VALUESET: "CODE_NOT_IN_VALUESET";
     /**
@@ -2417,6 +2747,60 @@ declare const VALIDATION_CODES: {
 };
 /** Discriminant union of every {@link VALIDATION_CODES} value. */
 type ValidationCode = (typeof VALIDATION_CODES)[keyof typeof VALIDATION_CODES];
+/**
+ * The canonical identity of the library's own code system for the **code-system release record**
+ * carried by a membership finding. It names the two-concept vocabulary in
+ * {@link CODE_SYSTEM_VERSION_RECORD_CODES} and nothing else, and it reaches an `OperationOutcome` as
+ * `issue.details.coding[0].system`.
+ *
+ * It is **this library's** canonical, not a third-party terminology identity: the known-systems
+ * registry ({@link ../terminology/systems.js}) stays a frozen set of verified external URIs and
+ * gains nothing here. Renaming this is a breaking change.
+ */
+declare const CODE_SYSTEM_VERSION_RECORD_SYSTEM = "https://cosyte.com/fhir/CodeSystem/code-system-version-record";
+/**
+ * The two-concept vocabulary that says **whether** a membership answer declared the code-system
+ * release it was made against. Frozen via `as const`; the set is snapshotted (see
+ * `test/validation-codes.test.ts`) because it is a public wire identity.
+ *
+ * The concept is deliberately separate from the release string itself: the marker rides on
+ * `issue.details.coding[0].code` and the declared release rides on `issue.details.text`, so no
+ * release a service could declare (`"undeclared"` included) can ever be mistaken for the marker.
+ */
+declare const CODE_SYSTEM_VERSION_RECORD_CODES: {
+    /** The service declared a release; the string it declared travels beside this marker. */
+    readonly DECLARED: "declared";
+    /**
+     * The service was consulted, answered definitively, and declared **no** release. It is an
+     * applicable, unanswered question, **not** "current" and not "not applicable": the marker is
+     * emitted precisely so the silence cannot be read as currency.
+     */
+    readonly UNDECLARED: "undeclared";
+};
+/** One of the {@link CODE_SYSTEM_VERSION_RECORD_CODES}. */
+type CodeSystemVersionRecordCode = (typeof CODE_SYSTEM_VERSION_RECORD_CODES)[keyof typeof CODE_SYSTEM_VERSION_RECORD_CODES];
+/**
+ * Which code-system release a membership answer was made against, as recorded on the finding.
+ *
+ * Three states, all distinguishable, which is the whole point of the type:
+ *
+ * - the field is **absent** from a {@link ValidationIssue}: no terminology service was consulted to
+ *   produce that finding, so there is no release to record (every content-free system check, every
+ *   non-terminology finding);
+ * - `{ declared: true, version }`: the service named the release, and `version` is its string
+ *   **exactly** as declared, never normalised, trimmed, truncated or substituted;
+ * - `{ declared: false }`: the service answered but named no release. The answer stands; its
+ *   currency is **unknown and said so**, rather than left to a reader to fill in with "current".
+ *
+ * The release is always the caller's own assertion. It is never read from the instance: a resource's
+ * own `Coding.version` is document content and never reaches a finding.
+ */
+type CodeSystemVersionRecord = {
+    readonly declared: true;
+    readonly version: string;
+} | {
+    readonly declared: false;
+};
 /**
  * A single value-free validation finding.
  *
@@ -2446,6 +2830,19 @@ interface ValidationIssue {
      * every non-invariant finding. It reaches the `OperationOutcome` as `issue.details.text`.
      */
     readonly constraint?: string;
+    /**
+     * Which code-system release the terminology service's answer was made against, when a service was
+     * consulted to produce this finding (today, `CODE_NOT_IN_VALUESET` and only it). `undefined` for
+     * every finding no service produced, including the content-free `CODE_SYSTEM_UNKNOWN` /
+     * `CODE_SYSTEM_UNEXPECTED` checks, which consult nothing.
+     *
+     * A declared release is the **caller's own assertion**, a public code-system release identifier on
+     * the same footing as the constraint key an invariant finding surfaces, never an instance value,
+     * so it is safe to surface. It reaches the `OperationOutcome` as `issue.details`
+     * ({@link ./operation-outcome.js}), and the `diagnostics` string stays derived from the finding
+     * code alone.
+     */
+    readonly codeSystemVersion?: CodeSystemVersionRecord;
 }
 /**
  * The value-free diagnostic line for a code, the only text that reaches an `OperationOutcome`.
@@ -2467,13 +2864,16 @@ declare function diagnosticFor(code: ValidationCode): string;
  * @param severity - The R4 severity to record (mode-dependent for some codes).
  * @param expression - The FHIRPath location of the finding, never a value.
  * @param constraint - The spec constraint key, for an invariant finding only (e.g. `"ait-1"`).
+ * @param codeSystemVersion - The code-system release record, for a finding a terminology service
+ *   produced only. Omit it for every finding no service was consulted for; passing
+ *   `{ declared: false }` is the distinct claim that a service answered and named no release.
  * @example
  * ```ts
  * import { validationIssue } from "@cosyte/fhir";
  * const issue = validationIssue("CODE_INVALID", "error", "Patient.gender");
  * ```
  */
-declare function validationIssue(code: ValidationCode, severity: ValidationSeverity, expression: string, constraint?: string): ValidationIssue;
+declare function validationIssue(code: ValidationCode, severity: ValidationSeverity, expression: string, constraint?: string, codeSystemVersion?: CodeSystemVersionRecord): ValidationIssue;
 
 /**
  * The layered structural / cardinality / value-domain validator (validation layers 1–3).
@@ -2503,6 +2903,19 @@ declare function validationIssue(code: ValidationCode, severity: ValidationSever
  * the resource types {@link ./schema.js} enumerates; other resource types validate only when the
  * caller supplies a schema.
  *
+ * **Invariants run with or without a profile.** {@link validateResource} runs the layers above and
+ * then the others in turn: the safety layer ({@link ./safety.js}), whose seven named invariants
+ * fire for every AllergyIntolerance, Condition and Observation; the base-constraint layer
+ * ({@link ./base-invariants.js}), which evaluates every other error-severity constraint R4 declares
+ * on the eight modeled types (AllergyIntolerance, Condition, DiagnosticReport, Immunization,
+ * MedicationRequest, MedicationStatement, Observation, Patient) and on their `DomainResource`,
+ * `Element` and `Extension` base, `pat-1`, `ext-1` and `ele-1` among them, with no profile supplied;
+ * and, for each supplied profile whose `type` matches, that profile's own `constraint`s
+ * ({@link ../profiles/invariants.js}). A violation both a profile and the base-constraint layer
+ * find at one occurrence is reported once, and a base constraint the base-constraint layer decides
+ * at an occurrence is never also reported unevaluated there because a profile's verbatim copy of
+ * it lies outside the subset. A resource type outside the eight draws no base-constraint finding.
+ *
  * @packageDocumentation
  */
 
@@ -2573,7 +2986,13 @@ declare function validateResource(resource: FhirComplex, options?: ValidateOptio
  *   gap rather than a path that resolves against the instance, so the outcome is spec-clean as a
  *   resource while that one element is deliberately not resolvable; and
  * - `diagnostics`, a value-free line derived **only** from the validation code (the redaction
- *   chokepoint in {@link ./issues.js}). No instance value ever reaches this resource.
+ *   chokepoint in {@link ./issues.js}). No instance value ever reaches this resource; in particular
+ *   neither identity below is interpolated into it; and
+ * - `details`, present only when the finding carries an identity asserted **outside** the document:
+ *   an invariant's constraint key (`details.text`), or a membership finding's code-system release
+ *   record (`details.coding` marks whether the caller's terminology service declared a release, and
+ *   a declared one rides verbatim in `details.text`). A resource's own `Coding.version` is never
+ *   read and never appears here.
  *
  * An `OperationOutcome.issue` is `1..*`, it must carry at least one issue. When validation found
  * nothing, {@link toOperationOutcome} emits a single `information` / `informational` "all clear"
@@ -2773,13 +3192,15 @@ declare function collectSafetyIssues(resource: FhirComplex, rt: string): Validat
  *
  * `modifierExtension` already fails closed on its own channel ({@link ./status.js}
  * `unhandledModifierExtensions`) and is deliberately NOT reported here, so one modifier extension
- * still yields one report. The other four land on the channel this module feeds.
+ * still yields one report. The other four land on the channel this module feeds, and so do three
+ * more R4 flags on the resource types this library reads a safety verdict from: a Patient's
+ * `deceased[x]` and `link`, and an Immunization's `isSubpotent`.
  *
  * ## The recognition predicate, and why it is by KEY NAME
  *
  * An occurrence is decided by key name and by literal `resourceType` equality alone: no element
- * table, no StructureDefinition, no datatype model, no sibling-key shape. Four rules and nothing
- * else is an occurrence:
+ * table, no StructureDefinition, no datatype model, no sibling-key shape. These rules and nothing
+ * else make an occurrence:
  *
  * - `comparator`: ANY object node the walk reaches that carries a member named `comparator` or
  *   `_comparator`, whatever element name it sits under, whatever the enclosing `resourceType` is,
@@ -2789,7 +3210,26 @@ declare function collectSafetyIssues(resource: FhirComplex, rt: string): Validat
  *   `resourceType` is the exact string `Patient`, top-level or contained or a Bundle entry, and
  *   nowhere else;
  * - `use`: a member named `use` or `_use` on any entry of the `identifier` array on the ROOT object
- *   of a resource whose `resourceType` is the exact string `Practitioner`, and nowhere else.
+ *   of a resource whose `resourceType` is the exact string `Practitioner`, and nowhere else. On the
+ *   eight types this library models, `use` is surfaced as a code rather than reported (see below);
+ * - `deceased`: a member whose name, less a leading `_`, begins `deceased`, on the ROOT object of a
+ *   `Patient`, and nowhere else. The element is the R4 choice `deceased[x]`, so the stem is the key:
+ *   `deceasedBoolean` and `deceasedDateTime` are the two members R4 defines, and a member it does not
+ *   define (`deceasedString`, a bare `deceased`) is reported rather than passed over, because a
+ *   choice suffix nobody expected is still the sender saying something about a death. The report
+ *   is located at the member as written, so a caller can tell the two R4 members apart;
+ * - `link`: a member named `link` or `_link` on the ROOT object of a `Patient`, and nowhere else,
+ *   reported ONCE at `link` however many entries it holds. No entry is read: `link.type` is what
+ *   says whether this record was replaced by another, and reading it would be interpreting the
+ *   modifier rather than reporting it;
+ * - `isSubpotent`: a member named `isSubpotent` or `_isSubpotent` on the ROOT object of an
+ *   `Immunization`, and nowhere else.
+ *
+ * The three gated on a Patient or an Immunization report at ANY value, `false` included, exactly as
+ * `active` does. `{"deceasedBoolean":false}` is a Patient the sender says is alive, and deciding
+ * that from the value would be reading a modifier to decide whether to report it, which opens a
+ * readable-versus-unreadable fork this channel does not have. A caller that has read the element
+ * handles the report; one that has not is refused.
  *
  * The first two OVER-REPORT by construction, and that is the trade taken rather than an oversight.
  * `{"resourceType":"Foo","x":{"comparator":"anything"}}` is an occurrence, so a non-FHIR payload
@@ -2809,8 +3249,67 @@ declare function collectSafetyIssues(resource: FhirComplex, rt: string): Validat
  * ## What a report may carry, and what a LOCATION may carry
  *
  * The element name and the location, and nothing taken from the document: no measurement value, no
- * unit, no code, no `implicitRules` URI, no name, no identifier, no free text. The element name is
- * safe by construction, being one of four literal keys this module spells.
+ * unit, no code, no `implicitRules` URI, no name, no identifier, no date, no linked record, no free
+ * text. The element name is safe by construction, being one of the literal keys this module spells
+ * ({@link ModifierElementName}).
+ *
+ * ## `MedicationRequest.intent`, which is SURFACED rather than reported
+ *
+ * R4 flags `intent` a modifier too, and it is mandatory (`1..1`), so reporting it on presence would
+ * refuse every MedicationRequest there is. It is surfaced instead, the way `status` is: at every
+ * `MedicationRequest` root, the code paired with the location of that root's `intent`
+ * ({@link IntentReport}). Only the eight codes the R4 value set defines can be surfaced
+ * ({@link MedicationRequestIntent}), matched exactly and case-sensitively, so this channel never
+ * echoes a string the document wrote. Anything else present at `intent` (a string outside the
+ * eight, a case or whitespace variant of one, a JSON `null`, a value of another JSON type, the `_`
+ * form with no value, an array wrapper, a name written twice) is not a code this library may read:
+ * nothing is surfaced for that root, its location is reported as unreadable, and that lowers the
+ * verdict. Nothing is case-folded, trimmed or mapped to a nearby code. An ABSENT `intent` surfaces
+ * nothing and refuses nothing, because a missing mandatory element is the validator's verdict.
+ *
+ * No meaning is read out of the code: whether a `proposal` is an order is the caller's question.
+ *
+ * ## `use` on Identifier, HumanName, Address and ContactPoint, which is SURFACED rather than reported
+ *
+ * R4 flags `use` a modifier on all four datatypes, so that an old or temporary identifier, name,
+ * address or contact point is not mistaken for a current one, and binds each `0..1` `use` to its
+ * own value set at required strength. It is optional and written on most real records, so reporting
+ * it on presence would refuse nearly every Patient; and refusing on WHICH code was written would be
+ * interpreting the modifier. It is surfaced instead, the way `intent` is ({@link DatatypeUseReport}):
+ * the code paired with the location of the `use` element, one pair per covered position.
+ *
+ * A covered position is an object entry (an array entry or a lone object) at one of these, below a
+ * resource root of one of the eight types in {@link USE_ROOT_TYPES} and not below a nested resource
+ * root of any type:
+ *
+ * - every member named `identifier` or `groupIdentifier`, at any depth, read as an Identifier. R4
+ *   types every element of the eight types with those names as Identifier, and `Reference.identifier`
+ *   is one too, so a Reference's identifier and an Identifier's `assigner.identifier` are covered;
+ * - on a `Patient` root: `name` (HumanName), `telecom` (ContactPoint) and `address` (Address), and
+ *   the same three on each `contact` entry. R4 types no other Patient element as one of the four.
+ *
+ * Readability is decided against the value set of the position's OWN datatype, so `temp` reads on
+ * all four and `maiden` on a HumanName only. The code is surfaced only when the document wrote
+ * exactly one `use` member holding one JSON string equal to a code of that set; anything else
+ * written there (a case or whitespace variant, the empty string, a code from a sibling set, a JSON
+ * `null`, a value of another JSON type, the `_use` form with no value, an array wrapper, the name
+ * written twice) surfaces nothing and its location is reported as unreadable, which lowers the
+ * verdict. Nothing is case-folded, trimmed or mapped to a nearby code, and no meaning is read out of
+ * a code: nothing here says an `old` entry is not current, and nothing is filtered or reordered. A
+ * position carrying neither `use` nor `_use` draws nothing.
+ *
+ * **A `Practitioner` root is outside this read, and that is the rule rather than a gap.**
+ * `Practitioner.identifier.use` keeps its own rule above, reported on presence, and a root naming
+ * `Practitioner` among its types surfaces and locates nothing here, so a Practitioner identifier is
+ * never on both channels. Every position belongs to its NEAREST enclosing resource root, so a
+ * Practitioner contained in a Patient is governed by the Practitioner rule alone.
+ *
+ * **Declared limits.** `use` on these datatypes carried as an extension VALUE (`valueIdentifier`,
+ * `valueHumanName`, `valueAddress`, `valueContactPoint`) is not read, because the member is not
+ * named `identifier`; and a nested resource root whose type is not one of the eight (a contained
+ * `Organization`'s `identifier` or `telecom`) is not read, because the position table is known only
+ * for the eight and a key-name guess inside an unmodeled resource could surface a same-named element
+ * that is not one of these datatypes.
  *
  * The location is the one place document text can reach a report, and it is bounded twice:
  *
@@ -2832,16 +3331,26 @@ declare function collectSafetyIssues(resource: FhirComplex, rt: string): Validat
  */
 
 /**
- * The modifier elements this channel reports, by their R4 element names.
+ * The modifier elements this channel reports, by their R4 element names. `deceased` names the R4
+ * choice element `deceased[x]`; the report's location carries the member as the document wrote it.
  *
  * `modifierExtension` is deliberately absent: it keeps its own fail-closed channel, so a modifier
- * extension yields one report and not two.
+ * extension yields one report and not two. `MedicationRequest.intent` is absent too: it is
+ * surfaced as a code on its own field rather than reported on presence ({@link IntentReport}).
+ *
+ * @example
+ * ```ts
+ * import { parseResource, readSafety, type ModifierElementName } from "@cosyte/fhir";
+ * const { resource } = parseResource('{"resourceType":"Patient","deceasedBoolean":true}');
+ * const names: ModifierElementName[] = readSafety(resource).modifierElements.map((r) => r.element);
+ * names; // ["deceased"]
+ * ```
  */
-type ModifierElementName = "comparator" | "implicitRules" | "active" | "use";
+type ModifierElementName = "comparator" | "implicitRules" | "active" | "use" | "deceased" | "link" | "isSubpotent";
 /**
  * One reported modifier element: which element, and where.
  *
- * Value-free by contract. `element` is one of four literal keys this library spells, never a name
+ * Value-free by contract. `element` is one of the literal keys this library spells, never a name
  * read off the document, and `location` is bounded segment by segment with its root restricted to
  * {@link MODIFIER_ELEMENT_ROOT_TYPES}.
  */
@@ -2851,6 +3360,75 @@ interface ModifierElementReport {
     /** The FHIRPath location it is present at, bounded (never a document value). */
     readonly location: string;
 }
+/**
+ * A `MedicationRequest.intent` code this library surfaces: exactly the eight concepts of the R4
+ * 4.0.1 value set the element binds to at required strength, and nothing else.
+ *
+ * @example
+ * ```ts
+ * import { parseResource, readSafety, type MedicationRequestIntent } from "@cosyte/fhir";
+ * const { resource } = parseResource('{"resourceType":"MedicationRequest","intent":"proposal"}');
+ * const codes: MedicationRequestIntent[] = readSafety(resource).intents.map((i) => i.code);
+ * codes; // ["proposal"]
+ * ```
+ */
+type MedicationRequestIntent = "proposal" | "plan" | "order" | "original-order" | "reflex-order" | "filler-order" | "instance-order" | "option";
+/**
+ * One surfaced `MedicationRequest.intent`: the code exactly as the document wrote it, and the
+ * location of the `intent` element it was read from, one per `MedicationRequest` root.
+ *
+ * The code is one of the eight {@link MedicationRequestIntent} values, matched exactly, so this
+ * carries no text the library did not spell itself. The location follows the same bound and the
+ * same root rule as {@link ModifierElementReport}'s.
+ */
+interface IntentReport {
+    /** The intent code, exactly as written. */
+    readonly code: MedicationRequestIntent;
+    /** The FHIRPath location of the `intent` element it was read from, bounded. */
+    readonly location: string;
+}
+/**
+ * A `use` code this library surfaces on an Identifier, a HumanName, an Address or a ContactPoint:
+ * the union of the four R4 4.0.1 value sets those elements bind to at required strength, and
+ * nothing else. Which of them a given position may carry is decided by that position's own
+ * datatype (IdentifierUse `usual` `official` `temp` `secondary` `old`; NameUse `usual` `official`
+ * `temp` `nickname` `anonymous` `old` `maiden`; AddressUse `home` `work` `temp` `old` `billing`;
+ * ContactPointUse `home` `work` `temp` `old` `mobile`).
+ *
+ * @example
+ * ```ts
+ * import { parseResource, readSafety, type DatatypeUseCode } from "@cosyte/fhir";
+ * const { resource } = parseResource('{"resourceType":"Patient","name":[{"use":"old"}]}');
+ * const codes: DatatypeUseCode[] = readSafety(resource).datatypeUses.map((u) => u.code);
+ * codes; // ["old"]
+ * ```
+ */
+type DatatypeUseCode = "usual" | "official" | "temp" | "secondary" | "old" | "nickname" | "anonymous" | "maiden" | "home" | "work" | "billing" | "mobile";
+/**
+ * One surfaced `use` on an Identifier, a HumanName, an Address or a ContactPoint: the code exactly
+ * as the document wrote it, and the location of the `use` element it was read from, one per covered
+ * position.
+ *
+ * The code is one of the {@link DatatypeUseCode} values of that position's own value set, matched
+ * exactly, so this carries no text the library did not spell itself. The location follows the same
+ * bound and the same root rule as {@link ModifierElementReport}'s.
+ *
+ * @example
+ * ```ts
+ * import { parseResource, readSafety, type DatatypeUseReport } from "@cosyte/fhir";
+ * const { resource } = parseResource(
+ *   '{"resourceType":"Patient","identifier":[{"use":"old","value":"S1"}]}',
+ * );
+ * const uses: readonly DatatypeUseReport[] = readSafety(resource).datatypeUses;
+ * uses; // [{ code: "old", location: "Patient.identifier[0].use" }]
+ * ```
+ */
+interface DatatypeUseReport {
+    /** The `use` code, exactly as written. */
+    readonly code: DatatypeUseCode;
+    /** The FHIRPath location of the `use` element it was read from, bounded. */
+    readonly location: string;
+}
 /**
  * The resource type names that may root a modifier-element location, which is every resource type
  * name THIS LIBRARY spells in its own source, and no other.
@@ -2859,12 +3437,16 @@ interface ModifierElementReport {
  * with different memberships and the choice decides what a location reads:
  *
  * - the seven `SAFETY_RESOURCE_TYPES` ({@link ./codes.js}), the types whose type-scoped safety
- *   elements this library surfaces;
- * - `Patient`, the one type the validator carries a built-in element table for, and one of the two
+ *   elements this library surfaces, `Immunization` and `MedicationRequest` among them;
+ * - `Patient`, the one type the validator carries a built-in element table for, and one of the
  *   types this module's own predicate gates on;
- * - `Practitioner`, the other type this module's predicate gates on;
+ * - `Practitioner`, another type this module's predicate gates on;
  * - `Bundle`, which the validator branches on by name when it checks entries.
  *
+ * The surfaced `MedicationRequest.intent` locations ({@link IntentReport}) and the unreadable ones
+ * are rooted by the same rule, since they are read by this module at the same window, and so are the
+ * surfaced and the unreadable `use` locations on the four datatypes ({@link DatatypeUseReport}).
+ *
  * The set is the union, and it is derived from source constants only. **It is never derived from
  * the input**: a type name is a member because this package wrote it down, not because a document
  * looked plausible. That is the whole property, and a "shaped like a resource type" test would
@@ -3139,11 +3721,13 @@ type NegationKind =
  * reasons given there.
  *
  * **Two groups of fields, and the difference is which question they answer.** The location channels
- * (`unhandledModifierExtensions`, `shadowedProperties`, `arrayWrappedScalars`, `nestedArrays`,
- * `droppedText`, `unreadableBooleans`, `nearMissNegationCodes`, `unreadableNegationCodes`,
- * `absenceMarkers`, `unreadableAbsenceMarkers`, `conflictingAbsenceMarkers`) and the
- * `safeToSummarize` derived from them (from all but `absenceMarkers`, which discloses rather than
- * refuses) are **document-wide**: they carry FHIRPath locations, so a nested finding has an address to name, and
+ * (`unhandledModifierExtensions`, `modifierElements`, `intents`, `datatypeUses`,
+ * `shadowedProperties`, `arrayWrappedScalars`, `nestedArrays`, `droppedText`, `unreadableBooleans`,
+ * `nearMissNegationCodes`, `unreadableNegationCodes`, `unreadableIntents`,
+ * `unreadableDatatypeUses`, `absenceMarkers`, `unreadableAbsenceMarkers`,
+ * `conflictingAbsenceMarkers`) and the `safeToSummarize` derived from them (from all but
+ * `absenceMarkers`, `intents` and `datatypeUses`, which disclose rather than refuse) are
+ * **document-wide**: they carry FHIRPath locations, so a nested finding has an address to name, and
  * `assertSafeToSummarize` refuses over a `Bundle`'s entries. The **single-valued** fields
  * (`resourceType` / `status` / `clinicalStatus` / `verificationStatus` / `doNotPerform` / `retracted`
  * / `noKnownAllergy`) answer about **the resource handed in** and nothing nested inside it, because
@@ -3240,9 +3824,20 @@ interface SafetyReadout {
      * element and where it is. R4 flags several ordinary base elements `Is Modifier: true` because
      * they change how the value beside them must be read, and this is the channel that surfaces them:
      * `comparator` wherever the walk reaches a node carrying it, `implicitRules` likewise,
-     * `Patient.active`, and `use` on a `Practitioner`'s `identifier` entries. Every one of them
-     * lowers {@link safeToSummarize}, because a bounded quantity summarized as a point value is a
-     * wrong clinical number delivered under a clean verdict.
+     * `Patient.active`, `Patient.deceased[x]` (element `deceased`, located at the member as written,
+     * `deceasedBoolean` or `deceasedDateTime`), `Patient.link` (once, at `link`, however many entries),
+     * `Immunization.isSubpotent`, and `use` on a `Practitioner`'s `identifier` entries. Every one of
+     * them lowers {@link safeToSummarize} **on presence, at any value**: a bounded quantity summarized
+     * as a point value is a wrong clinical number delivered under a clean verdict, a deceased patient
+     * or a record replaced by another is not the live record a summary would present, and a
+     * subpotent dose does not protect the way the record would otherwise say. `deceasedBoolean: false`
+     * and `isSubpotent: false` report too, as `active: true` does, because deciding from the value
+     * would be interpreting the modifier; an unreadable value (a `null`, a wrong JSON type, the `_`
+     * form alone, an array wrapper, a name written twice, a `deceased` member R4 does not define) is
+     * reported the same way and never read.
+     *
+     * `MedicationRequest.intent` is not here: it is mandatory, so it is surfaced on {@link intents}
+     * instead.
      *
      * **Distinct from {@link unhandledModifierExtensions}, and the two never double-report.** A
      * modifier EXTENSION stays on that channel and draws nothing here, so one modifier extension is
@@ -3257,6 +3852,55 @@ interface SafetyReadout {
      * did.
      */
     readonly modifierElements: readonly ModifierElementReport[];
+    /**
+     * `MedicationRequest.intent`, surfaced at **every `MedicationRequest` root** the document carries
+     * (the resource handed in, a `contained` one, a `Bundle.entry`): the code exactly as written,
+     * paired with the location of that root's `intent`, one pair per root, in walk order.
+     *
+     * R4 flags `intent` a modifier (a `proposal` is not an `order`) and makes it mandatory, so it is
+     * surfaced the way `status` is rather than refused on presence, and a readable one **does not
+     * lower {@link safeToSummarize}**. Only the eight codes of the R4 value set can appear here,
+     * matched exactly and case-sensitively, so this field carries no text the library did not spell.
+     * An `intent` that is present and not one of them is on {@link unreadableIntents} instead, and its
+     * root surfaces nothing here. A root with no `intent` at all surfaces nothing and refuses nothing:
+     * a missing mandatory element is the validator's verdict, not this readout's.
+     *
+     * No meaning is read from the code: nothing here says whether a request is in force.
+     */
+    readonly intents: readonly IntentReport[];
+    /**
+     * `use` on an Identifier, a HumanName, an Address or a ContactPoint, surfaced at **every covered
+     * position** the document carries: the code exactly as written, paired with the location of that
+     * `use` element, one pair per position, in walk order.
+     *
+     * The covered positions sit below a resource root of one of the eight types this library's safety
+     * layer models (`AllergyIntolerance`, `Condition`, `DiagnosticReport`, `Immunization`,
+     * `MedicationRequest`, `MedicationStatement`, `Observation`, `Patient`), whether that root is the
+     * resource handed in, a `contained` one or a `Bundle.entry`: every member named `identifier` or
+     * `groupIdentifier` at any depth (a Reference's identifier included), and on a `Patient` its
+     * `name`, `telecom` and `address` and the same three on each `contact` entry. A position belongs to
+     * its nearest enclosing resource root, and a root of any other type reads nothing here.
+     *
+     * R4 flags `use` a modifier on all four datatypes, so that an `old` or `temp` entry is not taken
+     * for a current one. It is optional and written on most records, so it is surfaced rather than
+     * refused on presence, and a readable one **does not lower {@link safeToSummarize}**. Only a code
+     * of the value set of the position's OWN datatype is surfaced, matched exactly, so `temp` reads on
+     * all four and `maiden` on a HumanName only, and this field carries no text the library did not
+     * spell. A `use` that is present and not one of those codes is on {@link unreadableDatatypeUses}
+     * instead. A position with no `use` surfaces nothing.
+     *
+     * **Surfaced, never interpreted.** Nothing here maps `old` or `temp` to "not current", and nothing
+     * is filtered, reordered or picked as the current entry: which entry to show is the caller's
+     * decision. `Practitioner.identifier.use` is not here: it keeps its presence rule on
+     * {@link modifierElements}. **Declared limits:** a datatype carried as an extension value
+     * (`valueIdentifier`, `valueHumanName`, `valueAddress`, `valueContactPoint`) is not read, nor is a
+     * position inside a nested resource root whose type is not one of the eight (a contained
+     * `Organization`'s `identifier` or `telecom`); and an ended `period` on an entry is a separate
+     * element this does not read.
+     *
+     * Located by the same bound and the same root rule as {@link modifierElements}.
+     */
+    readonly datatypeUses: readonly DatatypeUseReport[];
     /**
      * FHIRPath locations where the document wrote a property name more than once, so the element has
      * several values and no rule says which one the sender meant (fail-closed). Empty on every
@@ -3421,6 +4065,39 @@ interface SafetyReadout {
      * that is wholly a `CodeableConcept`.
      */
     readonly unreadableNegationCodes: readonly string[];
+    /**
+     * FHIRPath locations of a `MedicationRequest.intent` this library could not read as one of the
+     * eight R4 codes, at any `MedicationRequest` root: a string outside them (including a case or
+     * surrounding-whitespace variant of one, and the empty string), a JSON `null`, a value of another
+     * JSON type, the `_` form with no value, an array wrapper, or the name written twice.
+     *
+     * `intent` is a modifier bound to its value set at required strength, so a value outside it says
+     * something this library cannot establish, and **nothing is case-folded, trimmed or mapped to a
+     * nearby code**: the root surfaces no code on {@link intents}, its location is here, and the
+     * resource is not {@link safeToSummarize}. Value-free: the text that failed is carried nowhere.
+     *
+     * Located by the same bound and the same root rule as {@link modifierElements}. Empty for every
+     * conformant document.
+     */
+    readonly unreadableIntents: readonly string[];
+    /**
+     * FHIRPath locations of a `use` on an Identifier, a HumanName, an Address or a ContactPoint, at a
+     * covered position ({@link datatypeUses}), that this library could not read as a code of that
+     * position's own R4 value set: a string outside it (a case or surrounding-whitespace variant of a
+     * code, the empty string, or a code from a sibling set, such as `maiden` on an Identifier), a JSON
+     * `null`, a value of another JSON type, the `_use` form with no value, an array wrapper, or the
+     * name written twice.
+     *
+     * Each `use` is a modifier bound to its value set at required strength, so a value outside it says
+     * something this library cannot establish, and **nothing is case-folded, trimmed or mapped to a
+     * nearby code**: the position surfaces no code on {@link datatypeUses}, its location is here, and
+     * the resource is not {@link safeToSummarize}. Value-free: the text that failed is carried
+     * nowhere.
+     *
+     * Located by the same bound and the same root rule as {@link modifierElements}. Empty for every
+     * conformant document.
+     */
+    readonly unreadableDatatypeUses: readonly string[];
     /**
      * Every element the document declares an absence for, with the reason the sender spelled and the
      * FHIRPath location of the element it sits on. This is the read that separates "we asked and
@@ -3492,7 +4169,9 @@ interface SafetyReadout {
      * character data on an element was dropped, a boolean-valued safety element carries a written
      * value this layer cannot read, a `code`-valued negation element carries a value that spells a
      * negation code bar its case or its surrounding whitespace, such an element holds content at a
-     * position no `code` read can reach, an element declares an absence in a reason this library
+     * position no `code` read can reach, a `MedicationRequest.intent` is not one of the eight R4
+     * codes, a `use` on an Identifier, a HumanName, an Address or a ContactPoint is not a code of its
+     * datatype's R4 value set, an element declares an absence in a reason this library
      * cannot read, or an element declares an absence and carries a value. Each is a case where a
      * summary would have to assert something this library cannot establish (for the negation pair,
      * that no negation was asserted; for the absence pair, which of two contradictory answers the
@@ -3501,7 +4180,10 @@ interface SafetyReadout {
      * **A readable, non-conflicting absence marker does NOT move this**, and that exception is the
      * point of the channel rather than a hole in the rule: the declaration is read, carried and
      * addressable, so nothing about the document is unestablished. See
-     * {@link SafetyReadout.absenceMarkers}.
+     * {@link SafetyReadout.absenceMarkers}. **Nor does a readable `intent`**, which is surfaced on
+     * {@link SafetyReadout.intents} for the caller to read, **nor a readable `use`** on the four
+     * datatypes, which is surfaced on {@link SafetyReadout.datatypeUses}: `old` and `temp` included,
+     * because refusing on WHICH code was written would be interpreting the modifier.
      */
     readonly safeToSummarize: boolean;
 }
@@ -3976,11 +4658,13 @@ declare function readSafety(resource: FhirComplex): SafetyReadout;
  * was dropped, a boolean-valued safety element carries a written value outside the datatype's
  * lexical space, a `code`-valued negation element carries a value that spells a negation code bar
  * its case or its surrounding whitespace, such an element holds content at a position no `code`
- * read can reach, an element declares an absence in a reason this library cannot read, or an element
+ * read can reach, a `MedicationRequest.intent` is not one of the eight R4 codes, a `use` on an
+ * Identifier, a HumanName, an Address or a ContactPoint is not a code of its datatype's R4 value
+ * set, an element declares an absence in a reason this library cannot read, or an element
  * declares an absence and carries a value. Every way the safe move is to **refuse**, value-free,
  * carrying only the locations. A **readable, non-conflicting** absence marker is not on that list
  * and never refuses: it is a declaration the caller can now read, so summarizing over it asserts
- * nothing this library cannot establish.
+ * nothing this library cannot establish. Neither does a readable `use`, which is surfaced.
  *
  * @example
  * ```ts
@@ -4009,9 +4693,11 @@ declare class FhirSafetyError extends Error {
  * array inside an array, dropped XML element text, a boolean-valued safety element holding a written
  * value outside the datatype's lexical space, or a `code`-valued negation element holding a value
  * that spells a negation code bar its case or its surrounding whitespace, or content at a position
- * no `code` read can reach, or an element declaring an absence in a reason this library cannot read,
+ * no `code` read can reach, or a `MedicationRequest.intent` that is not one of the eight R4 codes,
+ * or a `use` on an Identifier, a HumanName, an Address or a ContactPoint that is not a code of its
+ * datatype's R4 value set, or an element declaring an absence in a reason this library cannot read,
  * or an element declaring an absence beside a value of its own. A readable, non-conflicting declared
- * absence throws nothing. This is the executable
+ * absence throws nothing, and neither does a readable `intent` or `use`. This is the executable
  * form of "carries status
  * **or refuses**": a summary helper calls it first, and never silently drops a modifier it cannot
  * honor, nor summarizes an element whose value the document left ambiguous or whose content the codec
@@ -4422,6 +5108,24 @@ interface ObservationValue {
     readonly quantity: Quantity | undefined;
     /** Additional `value[x]` variants also present (a structural ambiguity); empty in a clean resource. */
     readonly ambiguous: readonly ObservationValueType[];
+    /**
+     * The published {@link ../validate/issues.js} `ValidationCode` for the ENCODING the present
+     * variant arrived in, when FHIR JSON gives that shape no meaning at a `0..1` choice, and
+     * `undefined` otherwise, which is every conformant document.
+     *
+     * The one value it takes today is `ARRAY_WRAPPED_CHOICE`: the variant arrived wrapped in a JSON
+     * array, which json.html §2.6.2.2 reserves for a repeating element. **This is the channel that
+     * distinguishes "the sender wrote a value here and nothing read it" from "the sender wrote no
+     * value here"**, which `quantity: undefined` alone cannot: a `valueQuantity` of `[{"value":5,
+     * "code":"mg"}]` and one of `{}` both read as a present `Quantity` with no magnitude, and one of
+     * them is a 5 mg dose. It is the same code `validateResource` raises at the same location, so a
+     * caller switching on this and a caller reading the issue list see one vocabulary.
+     *
+     * **It says nothing about the value's CONTENT.** A variant that arrived the way FHIR JSON spells
+     * it and holds a shape the variant cannot carry is not this channel's business; nothing here is
+     * a general "the value was unreadable" report.
+     */
+    readonly encodingIssue: ValidationCode | undefined;
 }
 /**
  * Read the present `value[x]` variant off an Observation (or a `component`), typed by what is actually
@@ -4562,6 +5266,12 @@ declare function readMedicationDoses(resource: FhirComplex, rt: string | undefin
  *    is **not** a Quantity is `VALUE_TYPE_UNEXPECTED` (`warning`).
  * 3. **Dose units.** `MedicationRequest`/`MedicationStatement` dose quantities are UCUM-shape-checked
  *    the same way (a wrong dose unit is a prescribing hazard).
+ * 4. **The `value[x]` ENCODING, not its value.** A choice variant wrapped in a JSON array is
+ *    `ARRAY_WRAPPED_CHOICE` (`error`). The three checks above read the value and cannot see this:
+ *    a wrapper reads identically to an element the sender left out, so a 5 mg dose inside one is
+ *    indistinguishable from no dose at all. Scoped to `Observation.value[x]` and
+ *    `Observation.component.value[x]`, `0..1` in R4, so it needs no per-resource cardinality table
+ *    and cannot fire on a conformant document. Nothing is read out of the wrapper.
  *
  * **Never a false error.** The vital-signs check fires only when the element declares the vital-signs
  * category (or the vital-signs profile) **and** its own LOINC code is in the closed required-unit
@@ -4678,6 +5388,14 @@ declare function isKnownSystem(system: string): boolean;
  * `information` at most and a wrong system draws nothing, rebinding an example code can never fail
  * validation.
  *
+ * **The membership finding records which code-system release the answer was made against.** A
+ * service may declare one per answer ({@link ../terminology/service.js}
+ * `CodeValidationResult.systemVersion`); it is carried verbatim onto the finding, and an answer that
+ * declares none is marked **undeclared** rather than left silent, so a `not-in` never reads as a
+ * timeless fact when it is really an answer against one release. The record is the caller's
+ * assertion and nothing else: **the resource's own `Coding.version` is never read**, by this layer
+ * or any other, because it is document content and a finding is not a place to put document content.
+ *
  * Every finding is **value-free**: a code / severity / FHIRPath location, never a code value or a
  * resource value. The value-set identity is used only to call the service, never emitted.
  *
@@ -5021,6 +5739,16 @@ declare function collectProfileVersionIssues(resource: FhirComplex, profiles: re
  * US Core `us-core-*`, vendor invariants). Its agreement with the reference validator on the named
  * safety expressions is proven directly against {@link ../fhirpath/index.js evaluateInvariant}.
  *
+ * **What {@link collectInvariantIssues} returns does not depend on the base-constraint layer.**
+ * Called directly it reports every constraint the profile carries, the R4 base ones (`pat-1`,
+ * `ext-1`, `ele-1`, `dom-2` and the rest) included. Under `validateResource` the base-constraint
+ * layer ({@link ../validate/base-invariants.js}) evaluates those base constraints on the eight
+ * modeled types whether or not a profile is supplied, and a finding this layer makes at the same
+ * occurrence, for the same key and code, is reported once rather than twice. Where that layer
+ * decided a base constraint at an occurrence and this layer could not evaluate the profile's
+ * verbatim copy of it there (`dom-3`, whose expression lies outside the subset, over a resource
+ * with no `contained` entry), the decision stands and no `INVARIANT_UNCHECKED` is added for it.
+ *
  * @packageDocumentation
  */
 
@@ -5443,14 +6171,17 @@ declare function parseFhirPath(expression: string): Expr;
  *   `last`, `distinct`, `hasValue`, `children`, `extension`, `intersect`;
  * - **logic**, `and` / `or` / `xor` / `implies` with FHIRPath three-valued (empty-propagating) truth;
  * - **comparison / membership / union**, `=`, `!=`, `<`, `>`, `<=`, `>=`, `in`, `contains`, `|`;
- * - **type tests** on the System primitive types (`is` / `as` / `ofType` for `Boolean` / `String` /
- *   `Integer` / `Decimal`).
+ * - **type tests** (`is` / `as` / `ofType`) on the System primitive types `Boolean` / `String` /
+ *   `Integer` / `Decimal`, and on a FHIR type wherever the instance itself establishes the item's
+ *   type ({@link ./types.js}: a choice variant of the resource, the resource root, or the node's
+ *   kind), in operator and function form;
+ * - **`matches(regex)`** over a pattern in a portable subset ({@link ./matches.js}).
  *
  * A **type-qualified path head** (`Patient.name`) resolves only where the focus is a resource root
  * whose `resourceType` the qualifier names, which is the one place a generic model can check it; see
- * {@link resolveTypeQualifier}. Everything else, arithmetic, string functions, `descendants()`,
- * `resolve()`, FHIR-type `is`/`as` (a generic model carries no datatype name), and a type qualifier
- * that cannot be checked, raises {@link ./errors.js UnsupportedFhirPathError}.
+ * {@link resolveTypeQualifier}. Everything else, arithmetic, other string functions,
+ * `descendants()`, `resolve()`, a FHIR-type test the instance does not establish the answer to, and
+ * a type qualifier that cannot be checked, raises {@link ./errors.js UnsupportedFhirPathError}.
  * That is the whole safety contract: the engine **never guesses**. Refusing is not the only way not
  * to guess, and it is the expensive one, because a refusal makes a constraint *unchecked* and takes
  * a diagnostic away: an ordering comparison the generic model cannot decide (see {@link compare})
@@ -5458,9 +6189,11 @@ declare function parseFhirPath(expression: string): Expr;
  * coerces exactly as `false` does and so leaves every finding where it was.
  * `where`/`select`/`all`
  * evaluate their criteria *lazily per item*, so an unsupported sub-term inside a filter over an empty
- * collection (e.g. `contained.where(descendants()…)` on a resource with no `contained`) never fires,
- * exactly the common case that lets base constraints like `dom-3` pass without implementing their full
- * machinery.
+ * collection (e.g. `contained.where(descendants()…)` on a resource with no `contained`) never fires.
+ * R4's own `dom-3` still does not parse here as written (it calls `as()` in function form and ends
+ * in `trace()`), so the base-constraint layer ({@link ../validate/base-invariants.js}) decides it by
+ * that same reading, an empty `contained` selection making the whole filter empty, and reports it
+ * unchecked whenever something is contained.
  *
  * A constraint is **satisfied** iff {@link convertToBoolean} of the result is `true`, matching the
  * reference validator's coercion (empty → false, a single non-boolean item → true), so an unmet or
@@ -5741,12 +6474,25 @@ declare class FhirXmlError extends Error {
  * separated, exactly as before. Reading is otherwise lenient (Postel's Law): nothing here is
  * rejected. **Lenient does not mean lossless, and the two halves differ.** An element in an
  * unexpected namespace is modeled and flagged; non-whitespace character data written directly on a
- * FHIR element is **dropped** and flagged, because a FHIR element carries its value in `value=`
- * (§2.6.1) and there is no slot on the model for text. Wherever `hasStrayText` observes such text
- * the node is also **marked** ({@link ../model/node.js} `isDroppedText`), which is what the safety
- * layer reads: the flag says the position was odd, the marker says content is missing from it, and
- * only the second can stop an affirmative verdict being computed over an element the document did
- * fill in. **`hasStrayText` is the scope of both, and it is narrower than "any character data":** it
+ * FHIR element is **flagged wherever it appears**, because a FHIR element carries its value in
+ * `value=` (§2.6.1) and an element holding nothing but text has none of the three things §2.6.1 says
+ * an element SHALL have. Wherever `hasStrayText` observes such text the node is also **marked**
+ * ({@link ../model/node.js} `isDroppedText`), which is what the safety layer reads: the flag says
+ * the position was odd, the marker says the format puts no content there, and only the second can
+ * stop an affirmative verdict being computed over an element the document did fill in.
+ *
+ * **Whether that text is also READ is decided by the position, and one position reads it.** On a
+ * primitive element carrying no `value` attribute the character data is the value the sender wrote
+ * in the wrong place, so it is read as the element's lexical value ({@link elementTextValue}) as
+ * well as flagged and marked. Everywhere else it is genuinely dropped: a complex element has no
+ * value slot to read it into, and the resource-valued unwrap models the wrapped resource and nothing
+ * beside it. Reading it repairs no document and displaces no value that arrived properly - the
+ * encoding stays non-conformant, stays reported at its own position, stays marked, and both writers
+ * keep refusing the model - so the tolerance can only add a retraction, a negation or a dose that
+ * would otherwise have read as an element the sender left out.
+ *
+ * **`hasStrayText` is the scope of the flag and the marker, and it is narrower than "any character
+ * data":** it
  * tests JS `String.trim()`, whose whitespace set is wider than XML's S production and is not one
  * Unicode category: it spans U+00A0 and the Zs block, U+2028 (Zl) and U+2029 (Zp), U+FEFF (Cf), and
  * VT/FF. Character data made only of those is dropped with neither a flag nor a marker. That gap is
@@ -5783,11 +6529,14 @@ declare function parseResourceXml(input: string | XmlElement): ReadResult;
 /**
  * The XML write path: the {@link FhirNode} model → compact FHIR XML text (xml.html).
  *
- * **The output is NOT unconditionally spec-clean, and this line used to say it was.** A property name
- * carrying a prefix is written with no declaration to bind it and a name that is not a conformant XML
- * name at all is written verbatim, so `<v:x value="1"/>`, `<a&b/>` and `<1abc/>` are all emitted; a
- * conformant third-party parser rejects each. The exceptions are enumerated on
- * {@link serializeResourceXml}, with the refusals, and this header deliberately keeps no second copy.
+ * **The output is NOT unconditionally spec-clean, and this line used to say it was.** A tag name the
+ * writer writes that is not an XML 1.0 `Name` (`a&b`, `1abc`) is refused rather than written, and so
+ * is an attribute value or a spliced `div` string carrying a code point outside `Char`. A name
+ * carrying a colon is refused too, and so is a narrative `div` string whose own markup names a prefix
+ * nothing inside it binds. That is not every way a strict processor can reject the output: an element
+ * or attribute name inside a `div` string is checked for `Char` and never for `Name`, and the `div`
+ * branch carries three more counterexamples. They are enumerated on {@link serializeResourceXml},
+ * with the refusals, and this header deliberately keeps no second copy.
  *
  * The writer is the conservative half of Postel's Law, and for a model read from a conformant
  * document it emits canonical FHIR XML, the exact inverse of {@link ./read.js}:
@@ -5808,7 +6557,9 @@ declare function parseResourceXml(input: string | XmlElement): ReadResult;
  * A decimal value is emitted from its exact lexical text and never routes
  * through a JavaScript `number`. Narrative `<div>` XHTML is written back as the opaque string the
  * model carries, verbatim. Its XHTML is not validated, but the string is checked at that branch for
- * the one property splicing it in depends on ({@link emitsOneDivElement}).
+ * the two properties splicing it in depends on: that it spells the one `div` element the property
+ * names ({@link emitsOneDivElement}), and that every prefix its markup names is bound inside it
+ * ({@link bindsEveryPrefix}).
  *
  * @packageDocumentation
  */
@@ -5822,32 +6573,47 @@ declare function parseResourceXml(input: string | XmlElement): ReadResult;
  *
  * ## What this output is NOT guaranteed to be, stated rather than implied
  *
- * "Spec-clean" is a claim about the FHIR structure, not about namespace well-formedness, and the
- * gap is real for a model that carries content FHIR cannot spell. A property name carrying a
- * **prefix** is written verbatim with no declaration to bind it (`<v:x value="1"/>`), because the
- * binding was never modeled; a name that is not a conformant XML name at all is written verbatim
- * too (`<a&b/>`, `<1abc/>`). Both re-read through {@link parseResourceXml} exactly as written, and
- * both are rejected by a conformant third-party parser. They are not refused precisely because this
- * library's own round trip does survive them, and refusing would withdraw that from models it reads
- * as valid. What IS refused is the subset where nothing survives; see the `@throws` below.
+ * "Spec-clean" is a claim about the FHIR structure, and the XML 1.0 grammar for a name and a
+ * character is now held at every site this writer writes one: a tag name that is not a `Name`
+ * (`<a&b/>`, `<1abc/>`) is refused rather than written, although it re-reads through
+ * {@link parseResourceXml} exactly as written, because a conforming third-party processor must
+ * reject it; and a code point outside `Char` in an attribute value or a spliced `div` string is
+ * refused, raw or as a reference (see the `@throws` below). A name carrying a **colon** is refused
+ * on a code of its own, because the model carries no binding to declare. **What is still written,
+ * each a declared residual rather than an oversight**:
+ *
+ * - a `Name` that is not namespace-well-formed after `xml:` (`<xml:1abc/>`), since only the colon
+ *   question reads the `xml:` prefix and it exempts that prefix;
+ * - an element or attribute name inside a `div` string that is not a `Name` (`<p>` spelled `<1p>`):
+ *   the string is asked the `Char` question, never the `Name` question, which is asked at tag
+ *   positions only;
+ * - the three `div` counterexamples below, none of them a name or a character matter.
+ *
+ * The reader is unchanged and still reads `<1abc>` and `<a&b>` back, and `validateResource` still
+ * returns `valid: true` for a `string` carrying U+0000; both are separate surfaces.
  *
  * ## The `div` branch, which writes markup rather than a name
  *
  * A `div` property is written back as its own raw string, so what that string spells is markup in
  * the output. `emitsOneDivElement` is checked at that branch before the string is spliced in, and
  * the string is written only when it parses as exactly one element whose local name is `div`; a
- * string that fails raises `UNSERIALIZABLE_DIV_MARKUP` below. The shape that check exists for is
+ * string that fails raises `UNSERIALIZABLE_DIV_MARKUP` below. A string that passes is written only
+ * when every prefix its markup names is bound by a declaration inside it (`bindsEveryPrefix`); one
+ * that is not raises `UNSERIALIZABLE_DIV_PREFIX` below. A string that passes both is written only
+ * when it carries no code point outside XML 1.0 `Char`, neither raw nor denoted by a numeric
+ * character reference its parse decoded, each reference judged on its own; one that does raises
+ * `UNSERIALIZABLE_XML_CHARACTER` below, and a reference inside a comment, which is never decoded, is
+ * not one. The shape the first
+ * check exists for is
  * `<div xmlns="…xhtml">ok</div></text><code><coding>…716186003…</coding></code><text>` on an
  * `AllergyIntolerance`: it used to be spliced in whole, and the emitted document re-read with
  * `noKnownAllergy: true` and a `no-known-allergy` negation over a record that had asserted nothing,
  * with no diagnostic at either end and `readSafety` affirming it.
  *
- * **What passing that check does and does not settle, by example rather than by rule.** A string it
- * accepts contributes one element, and that element is the `div`; it is not a claim that the round
- * trip is lossless or that the output is well-formed from there. `<v:div>x</v:div>` carrying no
- * binding for `v` is accepted, and the emitted document re-reads it as a property named `v:div`
- * rather than as the narrative, which is the same unbound-prefix residual the paragraph above
- * declares for names. A comment beside the root (`<!--c--><div …/>`) is accepted and does not
+ * **What passing the three checks does and does not settle, by example rather than by rule.** A
+ * string they accept contributes one element, that element is the `div`, every prefix its markup
+ * names is bound inside it, and every character it spells or denotes is a `Char`; it is not a claim
+ * that the round trip is lossless or that the output is well-formed from there. A comment beside the root (`<!--c--><div …/>`) is accepted and does not
  * survive the re-read. `emitsOneDivElement` carries three more counterexamples, each `PRE-EXISTING`
  * and each asserted rather than argued: a depth bound this check spends from a different starting
  * depth than the re-read, an inserted namespace declaration, and an XML declaration a conformant
@@ -5923,6 +6689,103 @@ declare function parseResourceXml(input: string | XmlElement): ReadResult;
  *   case. `serializeResource` emits a non-string `resourceType` through its
  *   ordinary path, so this refusal does not reach it. See `assertXmlResourceType` for the window,
  *   which reaches every depth, and for the bound that holds only at the root.
+ * @throws {FhirSerializeError} With `UNSERIALIZABLE_FOREIGN_ROOT` if the model holds a resource whose
+ *   root the XML reader read out of a vocabulary that resolved to something other than FHIR's, by a
+ *   default declaration or by a bound prefix. FHIR XML puts the resource in the FHIR namespace and
+ *   this writer has no vendor binding to write instead, so
+ *   `<v:Observation xmlns:v="urn:vendor"><v:status value="entered-in-error"/>…</v:Observation>` came
+ *   back as `<Observation xmlns="http://hl7.org/fhir">…</Observation>` whose re-read carried an
+ *   **empty** issue list: the one warning saying the document came from elsewhere was gone after a
+ *   single trip. **Unlike most of the refusals above it this one withdraws a round trip from a
+ *   document that reads `valid: true`**, because the root flag is a warning; the cost is bounded to
+ *   this class. A root declaring no namespace at all is untouched, and one carrying a prefix bound to
+ *   nothing is outside it too, refused on `UNSERIALIZABLE_PREFIXED_NAME` below rather than on this
+ *   code. `serializeResource` emits the model exactly as it always did, so this refusal does not
+ *   reach it -- a statement about that writer's output, not a claim that the JSON channel keeps the
+ *   flag. See `assertXmlForeignRoot` for the window and for the route not taken.
+ * @throws {FhirSerializeError} With `UNSERIALIZABLE_CHOICE_WRAPPER` if the model carries an array
+ *   wrapper around an `Observation.value[x]` choice, at a location this library already reports as
+ *   `ARRAY_WRAPPED_CHOICE`, that XML has no repeated element to spell back: one holding fewer than
+ *   two items. `{"resourceType":"Observation","status":"final","valueQuantity":[{"value":5,
+ *   "system":"http://unitsofmeasure.org","code":"mg"}]}` reads with the encoding reported and no
+ *   magnitude handed out, and used to come back as `<valueQuantity><value value="5"/>…` re-reading
+ *   as an unambiguous 5 mg under an empty issue list: a **dose** a format change made confident. **A
+ *   wrapper of two or more items is left alone rather than refused**, because it writes as repeated
+ *   elements that re-read as a list and the location is reported again. Scoped to `value[x]` and
+ *   `component.value[x]`, `0..1` in R4, at every Observation resource root; the window is the value
+ *   layer's own rather than a second cardinality table. {@link serializeResource} writes the wrapper
+ *   back, so this refusal does not reach it. See `assertXmlValueChoiceWrapper`.
+ * @throws {FhirSerializeError} With `UNSERIALIZABLE_PREFIXED_NAME` if any tag position holds a name
+ *   carrying a colon, other than `xml:` followed by a local part with no colon in it. XML reads the
+ *   colon as a namespace prefix and the model carries no binding for this writer to declare one
+ *   with, so it used to write the prefix bound to nothing: `<v:x value="1"/>`, `<:x/>`, `<a:b:c/>`,
+ *   `<xmlns:x/>`, and a root read as `<v:Observation>` written back as
+ *   `<v:Observation xmlns="http://hl7.org/fhir">`. A conformant parser rejects all of them, and a
+ *   prefix rebound between siblings lost its `MIXED_XML_SPELLING` report across one write and one
+ *   re-read. **It withdraws an XML write from models that read `valid: true`**, the cost the
+ *   foreign-root refusal above already pays: a property named `p:x` reads with zero issues. Checked
+ *   at every tag position, at every depth, including a resource composed into a `contained` or a
+ *   `Bundle.entry.resource` after it was read. Raised after every refusal above, so a model carrying
+ *   one of these names beside anything above keeps the code it already reported, and a name that
+ *   both carries a colon and breaks the tag stays `UNSERIALIZABLE_ELEMENT_NAME`. **Not covered**: a
+ *   name with no colon that is not an XML 1.0 `Name`, which is refused on
+ *   `UNSERIALIZABLE_XML_NAME` below, not on this code; and the local part after `xml:`, which is
+ *   not checked for namespace well-formedness, so `<xml:1abc/>` is still written. A `div` string
+ *   whose own markup carries an unbound prefix is written by the `div` branch rather than at a tag
+ *   position, so this refusal does not reach it either; that branch refuses it on
+ *   `UNSERIALIZABLE_DIV_PREFIX`, below. {@link serializeResource} spells a member name as a JSON
+ *   string, so this refusal does not reach it and that route stays open.
+ * @throws {FhirSerializeError} With `UNSERIALIZABLE_DIV_PREFIX` if a `div` property carries a string
+ *   that passes the `UNSERIALIZABLE_DIV_MARKUP` check above and whose markup names, on an element or
+ *   on an attribute, a namespace prefix no declaration inside the string binds (`xml` is bound by
+ *   definition, and an `xmlns` or `xmlns:p` attribute is a declaration, not a prefixed name). The
+ *   branch splices the string in verbatim, so it used to write `<v:div>x</v:div>` into a document a
+ *   conformant parser rejects, and this library's re-read of that document turned the narrative into
+ *   a property named `v:div`, with no diagnostic at either end. An unbound prefix on an inner element
+ *   or an attribute (`<div xmlns="…xhtml"><v:p>x</v:p></div>`) is refused as well: the line is
+ *   namespace-well-formedness, the one the colon refusal above draws at the tag sites. **It withdraws
+ *   an XML write from models that read `valid: true`**, and for an inner prefix from a model this
+ *   library itself round-tripped, the cost that refusal already pays. A prefix a conformant document
+ *   bound on an ANCESTOR of the `div` is not refused, because the reader writes that declaration into
+ *   the string it hands back. Checked at the `div` branch at every depth, including a resource
+ *   composed into a `contained` or a `Bundle.entry.resource` after it was read, and raised after
+ *   every refusal above, so a model that also trips any of them keeps the code it already reported.
+ *   The message and the locations carry neither the string nor its prefix. {@link serializeResource}
+ *   carries the string as a string, so this refusal does not reach it and that route stays open.
+ * @throws {FhirSerializeError} With `UNSERIALIZABLE_XML_NAME` if any tag position holds a name that
+ *   is not an XML 1.0 `Name` (production [5]) and that neither breaks the tag nor carries a colon:
+ *   `a&b`, `1abc`, `-x`, `.x`, `a"b`, a name beginning U+00B7, a name carrying U+0000 or an unpaired
+ *   surrogate. Each used to be written verbatim, and this library's own reader read each back
+ *   unchanged, which is why the tag-breaking line above never reached it; a conforming processor must
+ *   reject every one. Checked at every tag position at every depth: a property name, a name inside
+ *   `contained`, `Bundle.entry.resource` or an extension, a resource-valued element's wrapper, and a
+ *   `resourceType` that names a root or a nested resource's tag, the last reported at the location of
+ *   the element wrapping it. Every position once, in walk order; a refused name's own segment renders
+ *   `WITHHELD`, and neither the message nor a location carries the name. **Refused, never repaired**:
+ *   XML has no escape for a name. **It withdraws an XML write from models that read `valid: true`**,
+ *   the cost the colon refusal above already pays: a JSON property named `1abc` reads with zero
+ *   issues. Raised after every refusal above, so a model that trips any of them keeps the code it
+ *   already reported. {@link serializeResource} spells a member name as a JSON string, so this
+ *   refusal does not reach it and that route stays open.
+ * @throws {FhirSerializeError} With `UNSERIALIZABLE_XML_CHARACTER` if a value this writer emits as an
+ *   attribute value (a primitive's `value`, an `id` written as an attribute, an `Extension.url`) or
+ *   a `div` string that passes both `div` checks above carries a code point outside XML 1.0 `Char`
+ *   (production [2]): U+0000 to U+0008, U+000B, U+000C, U+000E to U+001F, an unpaired surrogate,
+ *   U+FFFE or U+FFFF. In a `div` string a numeric character reference denoting one (`&#0;`,
+ *   `&#x1F;`) counts as the raw character does, because the Legal Character constraint makes it as
+ *   fatal; each reference is judged on its own, so two references to the halves of a surrogate pair
+ *   (`&#xD83D;&#xDE00;`) are refused although they decode to one `Char`, while `&#x1F600;` is
+ *   written. A reference inside a comment is never decoded and does not count. A U+0000 used to be
+ *   written raw into its `value` attribute. **Refused, never repaired**: the character is not written raw,
+ *   as a reference or replaced, and neither it nor its value is dropped, so the model is left as it
+ *   was. The location is the value's (`Patient.gender`, `Patient.gender.id`,
+ *   `Patient.extension[0].url`, `Patient.text.div`), every one once, in walk order; neither the
+ *   message nor a location carries the value or the character. The discouraged code points `Char`
+ *   still admits (U+007F to U+009F, U+FDD0 to U+FDEF) are written. Raised last of all, after
+ *   `UNSERIALIZABLE_XML_NAME`, so a model that trips any refusal above keeps the code it already
+ *   reported and a model carrying both a name that is not a `Name` and a character that is not a
+ *   `Char` draws the name code. {@link serializeResource} writes these values as JSON strings, so
+ *   this refusal does not reach it and that route stays open.
  * @example
  * ```ts
  * import { parseResource, serializeResourceXml } from "@cosyte/fhir";
@@ -6458,4 +7321,4 @@ declare function collectBundleIssues(resource: FhirComplex): ValidationIssue[];
  */
 declare const VERSION: string;
 
-export { ABSENCE_CODES, ALLERGY_CLINICAL_SYSTEM, ALLERGY_SUBSTANCE_VALUESET, ALLERGY_VERIFICATION_SYSTEM, type AbsenceCode, type AbsenceMarker, BINDING_STRENGTHS, BUNDLE_TYPES, type BaseResolver, type BindingRegistry, type BindingStrength, type BundleEntry, type BundleIndex, type BundleReadout, type BundleType, CONDITION_CATEGORY_SYSTEM, CONDITION_CLINICAL_SYSTEM, CONDITION_VERIFICATION_SYSTEM, CPT_SYSTEM, CVX_SYSTEM, type CodeMembership, type CodeValidationRequest, type CodeValidationResult, type Coded, type ContainedIndex, DATA_ABSENT_REASON_URL, DISCRIMINATOR_TYPES, type Derivation, type Discriminator$1 as Discriminator, type DiscriminatorType, ENTERED_IN_ERROR, type ElementBinding, type ElementConstraint, type ElementDefinition, type ElementSchema, type ElementType, type EntryProcessing, type Expr, FATAL_CODES, FHIR_XML_NAMESPACE, type FatalCode, FhirCodecError, type FhirComplex, FhirDecimal, FhirInteger64, type FhirIssue, type FhirList, type FhirNode, type FhirPrimitive, FhirProfileError, type FhirProperty, FhirSafetyError, FhirSerializeError, FhirXmlError, type FpColl, type FpItem, ICD10CM_SYSTEM, ICD9CM_SYSTEM, ISSUE_CODES, ISSUE_SEVERITIES, ISSUE_TYPES, InvalidProfileError, type InvariantOptions, type InvariantResult, type IssueCode, type IssueSeverity, type IssueType, KNOWN_MODIFIER_EXTENSION_URLS, KNOWN_SYSTEMS, LOINC_SYSTEM, type LocatedDoseQuantity, MAX_REFERENCE_DEPTH, MEDICATION_VALUESET, MODIFIER_ELEMENT_ROOT_TYPES, type ModifierElementName, type ModifierElementReport, NDC_SYSTEM, NDJSON_ERROR_CODES, NOT_DONE, NOT_TAKEN, NO_KNOWN_ALLERGY, type NdjsonError, type NdjsonErrorCode, type NdjsonOptions, type NdjsonRecord, type NegationKind, type NestedArrayChannel, type NestedArrayContent, OBSERVATION_CATEGORY_SYSTEM, OBSERVATION_VALUE_TYPES, type ObservationReferenceRange, type ObservationValue, type ObservationValueType, PATIENT_IDENTIFIER_STARTER, PRIMITIVE_TYPES, type ParsedReference, type PrimitiveMeta, type PrimitiveType, type PrimitiveValue, type ProfileConstraintSpec, type ProfileElementSpec, type ProfileOptions, type ProfileSpec, type Quantity, REFUTED, RXNORM_SYSTEM, type RawArray, type RawBool, type RawJson, type RawMember, type RawNull, type RawNumber, type RawObject, type RawString, type ReadResult, type ReferenceKind, type ReferenceResolution, type RequiredBinding, type ResourceSchema, SAFETY_RESOURCE_TYPES, SERIALIZE_ERROR_CODES, SNOMED_SCT, STARTER_PROFILES, STARTER_PROFILE_BASE_URL, type SafetyReadout, type SchemaRegistry, type SerializeErrorCode, type SliceConstraint, type SliceDefinition, type SliceMatchResult, type Slicing, type SlicingRules, type StructureDefinition, TERMINOLOGY_BINDINGS, type TerminologyBinding, type TerminologyOptions, type TerminologyService, type Token, type TokenType, type TypedValue, UCUM_SYSTEM, UNBOUNDED, type UcumShapeVerdict, UnsupportedFhirPathError, VALIDATION_CODES, VERSION, VITAL_SIGNS_CATEGORY, VITAL_SIGNS_PROFILE, VITAL_SIGN_OBSERVATION_STARTER, VITAL_SIGN_UNITS, type ValidateOptions, type ValidationCode, type ValidationIssue, type ValidationMode, type ValidationResult, type ValidationSeverity, WITHHELD, XHTML_NAMESPACE, XML_FATAL_CODES, type XmlAttribute, type XmlElement, type XmlFatalCode, type XmlNode, type XmlText, absenceMarkers, arrayWrappedScalars, assertSafeToSummarize, baseSchema, buildBindingRegistry, buildBundleIndex, buildRegistry, codeOf, codingsOf, collectBundleIssues, collectInvariantIssues, collectProfileIssues, collectProfileVersionIssues, collectQuantityIssues, collectSafetyIssues, collectTerminologyIssues, complex, conflictingAbsenceMarkers, containedIndex, convertToBoolean, decimal, decimalPrecisionAtRisk, defineProfile, diagnosticFor, droppedText, duplicateProperty, entryProcessing, evaluateInvariant, generateSnapshot, getAllProperties, getProperty, hasCodeAnySystem, hasCoding, hasContainedCycle, integer64, isAbsenceCode, isAtomicBundle, isChoice, isComplex, isDroppedText, isKnownSystem, isList, isNestedArray, isPrimitive, isPrimitiveType, isRetracted, isUndefinedNull, list, loadStructureDefinition, locateDoseQuantities, matchSlices, matchesFixed, matchesPattern, misplacedPrimitiveExtension, mixedXmlSpelling, modifierElements, nearMissNegationCodes, nestedArray, nestedArrayContent, nestedArrays, nodesEquivalent, parseFhirPath, parseNdjsonLine, parseReference, parseResource, parseResourceXml, pathExists, primitive, readBundle, readInterpretations, readMedicationDoses, readObservationValue, readQuantity, readRawJson, readRawXml, readReferenceRanges, readSafety, requiredVitalSignUnits, resolveElement, resolvePath, resolveReference, resolveSlices, resourceType, serializeResource, serializeResourceXml, shadowedProperties, snapshotElements, starterProfile, streamNdjson, toOperationOutcome, tokenize, undefinedJsonNull, unexpectedXmlContent, unhandledModifierExtensions, unknownProperty, unreadableAbsenceMarkers, unreadableBooleans, unreadableNegationCodes, validatePrimitiveValue, validateResource, validateUcumShape, validationIssue, wouldLosePrecisionAsDouble };
+export { ABSENCE_CODES, ALLERGY_CLINICAL_SYSTEM, ALLERGY_SUBSTANCE_VALUESET, ALLERGY_VERIFICATION_SYSTEM, type AbsenceCode, type AbsenceMarker, BINDING_STRENGTHS, BUNDLE_TYPES, type BaseResolver, type BindingRegistry, type BindingStrength, type BundleEntry, type BundleIndex, type BundleReadout, type BundleType, CODE_SYSTEM_VERSION_RECORD_CODES, CODE_SYSTEM_VERSION_RECORD_SYSTEM, CONDITION_CATEGORY_SYSTEM, CONDITION_CLINICAL_SYSTEM, CONDITION_VERIFICATION_SYSTEM, CPT_SYSTEM, CVX_SYSTEM, type CodeMembership, type CodeSystemVersionRecord, type CodeSystemVersionRecordCode, type CodeValidationRequest, type CodeValidationResult, type Coded, type ContainedIndex, DATA_ABSENT_REASON_URL, DISCRIMINATOR_TYPES, type DatatypeUseCode, type DatatypeUseReport, type Derivation, type Discriminator$1 as Discriminator, type DiscriminatorType, ENTERED_IN_ERROR, type ElementBinding, type ElementConstraint, type ElementDefinition, type ElementSchema, type ElementType, type EntryProcessing, type Expr, FATAL_CODES, FHIR_XML_NAMESPACE, type FatalCode, FhirCodecError, type FhirComplex, FhirDecimal, FhirInteger64, type FhirIssue, type FhirList, type FhirNode, type FhirPrimitive, FhirProfileError, type FhirProperty, FhirSafetyError, FhirSerializeError, FhirXmlError, type FpColl, type FpItem, ICD10CM_SYSTEM, ICD9CM_SYSTEM, ISSUE_CODES, ISSUE_SEVERITIES, ISSUE_TYPES, type IntentReport, InvalidProfileError, type InvariantOptions, type InvariantResult, type IssueCode, type IssueSeverity, type IssueType, KNOWN_MODIFIER_EXTENSION_URLS, KNOWN_SYSTEMS, LOINC_SYSTEM, type LocatedDoseQuantity, MAX_REFERENCE_DEPTH, MEDICATION_VALUESET, MODIFIER_ELEMENT_ROOT_TYPES, type MedicationRequestIntent, type ModifierElementName, type ModifierElementReport, NDC_SYSTEM, NDJSON_ERROR_CODES, NOT_DONE, NOT_TAKEN, NO_KNOWN_ALLERGY, type NdjsonError, type NdjsonErrorCode, type NdjsonOptions, type NdjsonRecord, type NegationKind, type NestedArrayChannel, type NestedArrayContent, OBSERVATION_CATEGORY_SYSTEM, OBSERVATION_VALUE_TYPES, type ObservationReferenceRange, type ObservationValue, type ObservationValueType, PATIENT_IDENTIFIER_STARTER, PRIMITIVE_TYPES, type ParsedReference, type PrimitiveMeta, type PrimitiveType, type PrimitiveValue, type ProfileConstraintSpec, type ProfileElementSpec, type ProfileOptions, type ProfileSpec, type Quantity, REFUTED, RXNORM_SYSTEM, type RawArray, type RawBool, type RawJson, type RawMember, type RawNull, type RawNumber, type RawObject, type RawString, type ReadResult, type ReferenceKind, type ReferenceResolution, type RequiredBinding, type ResourceSchema, SAFETY_RESOURCE_TYPES, SERIALIZE_ERROR_CODES, SNOMED_SCT, STARTER_PROFILES, STARTER_PROFILE_BASE_URL, type SafetyReadout, type SchemaRegistry, type SerializeErrorCode, type SliceConstraint, type SliceDefinition, type SliceMatchResult, type Slicing, type SlicingRules, type StructureDefinition, TERMINOLOGY_BINDINGS, type TerminologyBinding, type TerminologyOptions, type TerminologyService, type Token, type TokenType, type TypedValue, UCUM_SYSTEM, UNBOUNDED, type UcumShapeVerdict, UnsupportedFhirPathError, VALIDATION_CODES, VERSION, VITAL_SIGNS_CATEGORY, VITAL_SIGNS_PROFILE, VITAL_SIGN_OBSERVATION_STARTER, VITAL_SIGN_UNITS, type ValidateOptions, type ValidationCode, type ValidationIssue, type ValidationMode, type ValidationResult, type ValidationSeverity, WITHHELD, XHTML_NAMESPACE, XML_FATAL_CODES, type XmlAttribute, type XmlElement, type XmlFatalCode, type XmlNode, type XmlText, absenceMarkers, arrayWrappedScalars, assertSafeToSummarize, baseSchema, buildBindingRegistry, buildBundleIndex, buildRegistry, codeOf, codingsOf, collectBundleIssues, collectInvariantIssues, collectProfileIssues, collectProfileVersionIssues, collectQuantityIssues, collectSafetyIssues, collectTerminologyIssues, complex, conflictingAbsenceMarkers, containedIndex, convertToBoolean, decimal, decimalPrecisionAtRisk, defineProfile, diagnosticFor, droppedText, duplicateProperty, entryProcessing, evaluateInvariant, generateSnapshot, getAllProperties, getProperty, hasCodeAnySystem, hasCoding, hasContainedCycle, integer64, isAbsenceCode, isAtomicBundle, isChoice, isComplex, isDroppedText, isForeignRoot, isKnownSystem, isList, isNestedArray, isPrimitive, isPrimitiveType, isRetracted, isUndefinedNull, list, loadStructureDefinition, locateDoseQuantities, matchSlices, matchesFixed, matchesPattern, misplacedPrimitiveExtension, mixedXmlSpelling, modifierElements, nearMissNegationCodes, nestedArray, nestedArrayContent, nestedArrays, nodesEquivalent, parseFhirPath, parseNdjsonLine, parseReference, parseResource, parseResourceXml, pathExists, primitive, readBundle, readInterpretations, readMedicationDoses, readObservationValue, readQuantity, readRawJson, readRawXml, readReferenceRanges, readSafety, requiredVitalSignUnits, resolveElement, resolvePath, resolveReference, resolveSlices, resourceType, serializeResource, serializeResourceXml, shadowedProperties, snapshotElements, starterProfile, streamNdjson, toOperationOutcome, tokenize, undefinedJsonNull, unexpectedXmlContent, unhandledModifierExtensions, unknownProperty, unreadableAbsenceMarkers, unreadableBooleans, unreadableNegationCodes, validatePrimitiveValue, validateResource, validateUcumShape, validationIssue, wouldLosePrecisionAsDouble };