babelfhir-ts 1.5.19 → 1.5.21

package/out/src/generator/emitters/validator/validatorGenerator.js

@@ -1,163 +1,82 @@
 import { logger } from '../../../logger.js';
 import { sanitizeValueSetName } from '../valueset/valueSetGenerator.js';
 import { generateSliceValidations } from './sliceValidatorGenerator.js';
+import { generateClosedSlicingValidations } from './closedSlicingValidation.js';
 import { fhirpathModelSlug } from '../../fhir/versionContext.js';
 import { buildRequiredConstraints, buildMaxCardinalityConstraints, buildForbiddenFieldConstraintEntries, buildPatternValidations, buildChoiceTypeNarrowingValidations, } from './validatorConstraintBuilders.js';
-import { buildNestedRequiredValidations, buildFixedValueValidations, buildProhibitedFieldValidations, buildPrimitiveFormatValidations, buildStructuralTypeValidations, } from './validatorFieldBuilders.js';
+import { buildNestedRequiredValidations, buildFixedValueValidations, buildProhibitedFieldValidations, buildPrimitiveFormatValidations, buildStructuralTypeValidations, buildInlineResourceTypeValidations, INLINE_RESOURCE_SLOTS, } from './validatorFieldBuilders.js';
 import { buildBindingValidations } from './validatorBindingBuilder.js';
-import { generateBundleRefValidation, generateContainedRefValidation, generateExtensionStructuralValidation, generateBundledAggregationValidation } from './validatorTemplates.js';
+import { generateBundleRefValidation, generateContainedRefValidation, generateExtensionStructuralValidation, generateAggregationRefValidation, buildReferenceTargetTypeValidation, buildBundleEntryResolution } from './validatorTemplates.js';
+import { HELPER_NAMES } from './validatorRuntime.js';
+import { quoteFhirPathPath, normalizeCollectionTypeFilters, isBaseElementInvariant } from './validatorExpressions.js';
 const log = logger.withTag('validator');
 /**
- * Returns the content of ValidatorOptions.ts — the shared runtime options type
- * plus the element-probing helpers that every generated validateX() imports.
+ * A constraint declared on a slice applies only to that slice's members.
  *
- * The helpers exist so validators can read arbitrary child elements off an
- * open-world FHIR resource *without* widening to `any`. `any` would disable
- * checking for every downstream access, which contradicts the type safety this
- * generator promises; `at()`/`arr()` return `unknown`, so the emitted code must
- * still narrow before it can do anything with a value.
- */
-export function generateValidatorOptionsContent() {
-    return `/** Runtime options for generated FHIR validators. */
-export interface ValidatorOptions {
-  /** Terminology server URL for memberOf() evaluation (e.g. "https://tx.fhir.org/r4"). */
-  terminologyUrl?: string;
-  /** FHIR server URL for resolve() evaluation (e.g. "https://hapi.fhir.org/baseR4"). */
-  fhirServerUrl?: string;
-  /** HTTP headers keyed by server URL — used for auth with terminology or FHIR servers. */
-  httpHeaders?: Record<string, string>;
-  /** AbortSignal for cancelling long-running async evaluations. */
-  signal?: AbortSignal;
-  /** Debug tracing callback — invoked for every FHIRPath trace() call. */
-  traceFn?: (value: unknown, label: string) => void;
-}
-
-/** Property bag view of a FHIR element. Reads yield \`unknown\`, never \`any\`. */
-export type FhirNode = { readonly [key: string]: unknown };
-
-/**
- * View an arbitrary value as a property bag, for key enumeration
- * (\`Object.entries(node(x))\`) and repeated child reads.
- *
- * Non-objects become \`{}\` so callers never need a null check.
- */
-export function node(value: unknown): FhirNode {
-  return typeof value === 'object' && value !== null ? (value as FhirNode) : {};
-}
-
-/**
- * Read a (possibly nested) child element off an arbitrary FHIR value.
- *
- * Returns \`undefined\` as soon as the path leaves an object, so it is safe on
- * absent, null, primitive and array-valued intermediates alike. This is the one
- * place the untyped boundary is crossed, replacing a cast at every call site.
- *
- * @example at(resource, 'channel', 'payload', 'extension')
- */
-export function at(value: unknown, ...path: readonly string[]): unknown {
-  let current = value;
-  for (const key of path) {
-    if (typeof current !== 'object' || current === null) return undefined;
-    current = (current as FhirNode)[key];
-  }
-  return current;
-}
-
-/**
- * View an element as an iterable list of children.
- *
- * Exactly equivalent to the \`if (Array.isArray(x)) for (const c of x)\` guard it
- * replaces: non-array values (absent, null, or a scalar) yield no iterations, so
- * substituting this helper does not change which elements get validated.
- */
-export function arr(value: unknown): readonly unknown[] {
-  return Array.isArray(value) ? value : [];
-}
-
-/** A coding as read by the emitted slice, pattern and binding checks. */
-export interface CodingShape {
-  code?: string;
-  system?: string;
-  display?: string;
-  version?: string;
-}
-
-/**
- * The properties emitted element checks actually read off a FHIR element.
- *
- * Deliberately structural and all-optional: slice discriminators match on
- * \`url\`/\`code\`/\`system\`, pattern checks walk \`coding\`, and choice-type checks
- * look for \`value*\` keys. Typing the element this way keeps every access checked,
- * where a \`(item: any)\` callback parameter would switch checking off entirely.
- */
-export interface ElementShape {
-  /** Codings when the element is itself a CodeableConcept. */
-  coding?: CodingShape[];
-  /**
-   * Everything else reads as \`unknown\`.
-   *
-   * Discriminator properties are deliberately *not* declared with concrete types:
-   * a FHIR element's \`code\` may be a \`code\` primitive on one profile and a
-   * \`CodeableConcept\` on another, so committing to \`string\` would break the
-   * \`.coding\` reads (and vice versa). \`unknown\` still supports \`===\` comparisons
-   * and \`typeof\` narrowing; use \`at()\` / \`codings()\` to go deeper.
-   */
-  readonly [key: string]: unknown;
-}
-
-/**
- * Like {@link arr} but typed for element inspection, so emitted callbacks need no
- * parameter annotation and stay type-checked.
+ * The scope is derived from field.name, which carries no slice identity, so every
+ * slice's invariants were being applied to the whole base element. US Core pins
+ * Practitioner.identifier:NPI to ten digits and :NCSBN to eight, so a conformant
+ * NPI necessarily failed the NCSBN rule and we reported an error HL7 does not.
  *
- * Non-arrays yield no iterations, matching the \`Array.isArray\` guard this
- * replaces.
+ * Returns a predicate matching the value the slice pins, so the constraint reaches
+ * only its own members. Slices discriminated by something other than a scalar
+ * (a CodeableConcept's coding array, say) yield undefined and are left alone
+ * rather than guessed at.
  */
-export function elements(value: unknown): readonly ElementShape[] {
-  return Array.isArray(value) ? (value as ElementShape[]) : [];
-}
-
-/**
- * View a value as a list of codings.
- *
- * Accepts either a CodeableConcept (reads \`.coding\`) or an already-bare array of
- * Codings, which is what slice discriminators need since the same discriminator
- * path can be typed either way across profiles. Anything else yields \`[]\`.
- */
-export function codings(value: unknown): readonly CodingShape[] {
-  if (Array.isArray(value)) return value as CodingShape[];
-  const nested = at(value, 'coding');
-  if (Array.isArray(nested)) return nested as CodingShape[];
-  // A lone Coding. Elements typed Coding 0..1 are neither an array nor a
-  // CodeableConcept — AuditEvent.entity.type in R4 is the common case — and used
-  // to fall through to [], so every slice discriminated on one matched nothing.
-  // That silently disabled the whole within-slice block: the IHE audit profiles
-  // reported "No elements matched required slice" while their max/min child
-  // constraints were never evaluated at all.
-  if (value !== null && typeof value === 'object') {
-    const lone = value as CodingShape;
-    if (lone.system !== undefined || lone.code !== undefined) return [lone];
-  }
-  return [];
+function buildSliceConstraintFilter(field) {
+    const elementId = field.elementId || '';
+    if (!elementId.split('.').some(segment => segment.includes(':')))
+        return undefined;
+    const pattern = field.patternConstraint;
+    if (!pattern || typeof pattern !== 'object')
+        return undefined;
+    for (const [key, value] of Object.entries(pattern)) {
+        if (typeof value === 'string')
+            return `${key} = '${value.replace(/'/g, "\\'")}'`;
+    }
+    return undefined;
 }
-
+/** Coded types whose membership a terminology server can decide. */
+const CODED_BINDING_TYPES = new Set(['code', 'Coding', 'CodeableConcept']);
 /**
- * Hand an untyped element to a validator expecting a concrete profile type.
- *
- * Cross-profile delegation reaches its target through \`at()\`, which yields
- * \`unknown\`; the callee wants e.g. \`USCorePatient\`. \`T\` is inferred from the
- * parameter position, so the conversion needs no type import and no
- * \`Parameters<typeof validateX>[0]\` — the latter breaks outright in packages that
- * define a FHIR resource named \`Parameters\`, which shadows the utility type, and
- * it rejects array-valued fields whose element type is the delegate's.
+ * Scope a binding declared on a slice's child to that slice's members.
  *
- * Widening happens here once rather than at each call site.
+ * Task.input is sliced by `value@type` with each slice pinning a different type
+ * coding, so an unscoped check would apply one slice's ValueSet to every input —
+ * the same mistake that made US Core's NPI fail the NCSBN rule. The predicate is
+ * built from the sibling element that carries the pin.
  */
-export function asResource<T>(value: unknown): T {
-  return value as T;
-}
-`;
+function sliceScopedBindingPath(rel, field, fields) {
+    const elementId = field.elementId || '';
+    const sliceMatch = /^(.*?:[^.]+)\./.exec(elementId);
+    if (!sliceMatch)
+        return rel;
+    const sliceId = sliceMatch[1];
+    const pinned = fields.find(f => {
+        if (!f.elementId || !f.elementId.startsWith(sliceId + '.'))
+            return false;
+        const pattern = f.patternConstraint;
+        return !!pattern && Array.isArray(pattern.coding) && pattern.coding.length > 0;
+    });
+    if (!pinned?.elementId)
+        return rel;
+    const discriminatorProp = pinned.elementId.substring(sliceId.length + 1);
+    if (!discriminatorProp || discriminatorProp.includes('.'))
+        return rel;
+    const coding = pinned.patternConstraint.coding[0];
+    const system = typeof coding.system === 'string' ? coding.system : undefined;
+    const code = typeof coding.code === 'string' ? coding.code : undefined;
+    if (!code)
+        return rel;
+    const terms = [system ? `system='${system}'` : '', `code='${code}'`].filter(Boolean).join(' and ');
+    const segments = rel.split('.');
+    // rel is <base>.<leaf>; the where() goes on the repeating base element.
+    if (segments.length < 2)
+        return rel;
+    const leaf = segments.pop();
+    return `${segments.join('.')}.where(${discriminatorProp}.coding.where(${terms}).exists()).${leaf}`;
 }
-export function generateValidateProfileFunction(interfaceName, fields, valueSets, profileUrl, baseResourceType, profileUrlToName, extensionMetadata, baseDefinition, profileUrlToType) {
+export function generateValidateProfileFunction(interfaceName, fields, valueSets, profileUrl, baseResourceType, profileUrlToName, extensionMetadata, baseDefinition, profileUrlToType, datatypeProfilePins) {
     const valueSetImports = new Map();
     const validatorImports = new Map();
     // ── Collect field-level constraints ──────────────────────────────────────
@@ -176,9 +95,10 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
         else {
             fieldPath = rawName.replace(/^[^.]+\./, "").replace(/\[x\]/g, "");
         }
+        const sliceFilter = buildSliceConstraintFilter(field);
         field.constraints.forEach((constraint) => {
             if (constraint && constraint.expression) {
-                constraintsWithContext.push({ constraint, fieldPath, isChoiceType });
+                constraintsWithContext.push({ constraint, fieldPath, isChoiceType, sliceFilter });
             }
         });
     });
@@ -268,7 +188,7 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
     constraintsWithContext.push(...buildRequiredConstraints(fields, arrayFieldPaths, fieldPathMap, fieldParentMap), ...buildMaxCardinalityConstraints(fields, arrayFieldPaths, fieldParentMap), ...buildForbiddenFieldConstraintEntries(fields));
     const patternValidations = buildPatternValidations(fields, arrayFieldPaths, fieldPathMap);
     const nestedRequiredValidations = buildNestedRequiredValidations(fields, arrayFieldPaths);
-    const fixedValueValidations = buildFixedValueValidations(fields, arrayFieldPaths);
+    const fixedValueValidations = buildFixedValueValidations(fields, arrayFieldPaths, profileUrl, baseResourceType);
     const prohibitedFieldValidations = buildProhibitedFieldValidations(fields, arrayFieldPaths, fieldParentMap, baseResourceType, interfaceName);
     const bindingValidations = buildBindingValidations(fields, fieldParentMap, arrayFieldPaths, getValueSetForBinding, valueSetImports);
     // ── Synthesize memberOf() constraints for code-type non-enumerable bindings ─
@@ -284,7 +204,10 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
         if (f.sliceName)
             return false;
         const type = f.type || f.baseTypeCode;
-        if (type !== 'code')
+        // Coding and CodeableConcept are decidable by the server too; restricting this
+        // to `code` left a required binding on a CodeableConcept unchecked entirely,
+        // and the system-presence fallback passes anything that carries a system.
+        if (!type || !CODED_BINDING_TYPES.has(type))
             return false;
         const vsInfo = getValueSetForBinding(f.binding.uri);
         // Only emit when VS is unresolved or systemOnly (no enumerated codes)
@@ -292,9 +215,16 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
     })
         .forEach(f => {
         const relFull = f.name || '';
-        const fieldPath = relFull.replace(/^[^.]+\./, '').replace(/\[x\]/g, '');
+        const type = f.type || f.baseTypeCode || '';
+        let fieldPath = relFull.replace(/^[^.]+\./, '');
+        // A choice element's JSON property carries the type suffix, so stripping
+        // "[x]" alone would name a property that does not exist.
+        fieldPath = fieldPath.includes('[x]')
+            ? fieldPath.replace(/\[x\]/, type.charAt(0).toUpperCase() + type.slice(1))
+            : fieldPath;
         if (!fieldPath)
             return;
+        fieldPath = sliceScopedBindingPath(fieldPath, f, fields);
         const vsUri = (f.binding.uri || '').split('|')[0];
         const vsDisplayName = vsUri.split('/').pop() || vsUri;
         constraintsWithContext.push({
@@ -310,12 +240,18 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
     const sliceValidations = generateSliceValidations({
         fields, fieldPathMap, arrayFieldPaths, getValueSetForBinding,
         valueSetImports, profileUrl, profileName: interfaceName, baseResourceType,
-        profileUrlToName, validatorImports, extensionMetadata, profileUrlToType,
+        profileUrlToName, validatorImports, extensionMetadata, profileUrlToType, datatypeProfilePins,
     });
+    const closedSlicingValidations = generateClosedSlicingValidations(fields, profileUrl, baseResourceType);
     const primitiveFormatValidations = buildPrimitiveFormatValidations(fields);
-    const structuralTypeValidations = buildStructuralTypeValidations(fields, arrayFieldPaths);
+    const structuralTypeValidations = [
+        ...buildStructuralTypeValidations(fields, arrayFieldPaths),
+        ...buildInlineResourceTypeValidations(fields, profileUrl),
+    ];
     const choiceNarrowingValidations = buildChoiceTypeNarrowingValidations(fields, profileUrl);
     const bundleRefValidation = generateBundleRefValidation(baseResourceType);
+    const referenceTargetTypeValidation = buildReferenceTargetTypeValidation(fields, profileUrlToType);
+    const bundleEntryResolution = buildBundleEntryResolution(baseResourceType);
     const containedRefValidation = generateContainedRefValidation(baseResourceType);
     const extensionStructuralValidation = generateExtensionStructuralValidation();
     // ── Bundled aggregation reference checks ─────────────────────────────────
@@ -329,8 +265,19 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
             // Skip slices — base field already covers them
             if (field.sliceName)
                 continue;
-            const hasBundled = field.typeOptions?.some(t => t.code === 'Reference' && t.aggregation?.includes('bundled'));
-            if (!hasBundled)
+            const aggregations = new Set((field.typeOptions ?? [])
+                .filter(t => t.code === 'Reference')
+                .flatMap(t => t.aggregation ?? []));
+            let kind;
+            if (aggregations.has('bundled')) {
+                kind = 'bundled';
+            }
+            else if (aggregations.has('contained') && !aggregations.has('referenced')) {
+                // Only restrict when a contained reference is the sole option — a field
+                // that also permits 'referenced' accepts an ordinary relative reference.
+                kind = 'contained';
+            }
+            if (!kind)
                 continue;
             // Strip resource-type prefix (e.g. "Condition.encounter" → "encounter")
             const dotIdx = field.name.indexOf('.');
@@ -342,10 +289,10 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
                 const partial = field.name.substring(0, dotIdx) + '.' + segments.slice(0, i + 1).join('.');
                 return fieldArrayMap.get(partial) ?? false;
             });
-            bundledPaths.push({ segments, isArray });
+            bundledPaths.push({ segments, isArray, kind });
         }
     }
-    const bundledAggregationValidation = generateBundledAggregationValidation(bundledPaths);
+    const bundledAggregationValidation = generateAggregationRefValidation(bundledPaths);
     // ── Profiled datatype field delegation ──────────────────────────────────
     // When a non-sliced field references a profiled datatype (e.g., Bundle.signature
     // with profile cdex-signature), delegate validation to the generated validator.
@@ -372,12 +319,25 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
                 if (!delegateName || delegateName === interfaceName)
                     continue;
                 validatorImports.set(delegateName, `./${delegateName}.js`);
+                // An inline-resource slot narrowed to a concrete resource type is not a
+                // datatype: the value carries a resourceType, and handing an untyped or
+                // wrong-typed blob to a resource profile's validator reports that profile's
+                // required fields against something that is not one. HL7 rejects the
+                // resource as untyped and never descends, so it reports none of them.
+                // field.type is often the profile alias (dtr-questionnaire-adapt) rather than
+                // a resource type name, so resolve the type the profile targets.
+                const isResourceTypeName = (name) => !!name && /^[A-Z][A-Za-z]+$/.test(name);
+                const expectedResourceType = [profileUrlToType?.get(pUrl), field.baseTypeCode, fieldType]
+                    .find(isResourceTypeName);
+                const inlineResourceGuard = INLINE_RESOURCE_SLOTS.has(relPath) && expectedResourceType
+                    ? `\n      if (at(_dtEl, 'resourceType') !== '${expectedResourceType}') continue;`
+                    : '';
                 if (field.isArray) {
                     datatypeProfileDelegations.push(`
   // Profiled datatype delegation: ${relPath} → ${delegateName}
   if (resource.${relPath} && Array.isArray(resource.${relPath})) {
-    for (const _dtEl of resource.${relPath}) {
-      const _sub = await validate${delegateName}(asResource(_dtEl), options);
+    for (const _dtEl of resource.${relPath}) {${inlineResourceGuard}
+      const _sub = await validate${delegateName}(asResource(_dtEl), _delegateOptions);
       errors.push(..._sub.errors);
       warnings.push(..._sub.warnings);
     }
@@ -387,7 +347,7 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
                     datatypeProfileDelegations.push(`
   // Profiled datatype delegation: ${relPath} → ${delegateName}
   if (resource.${relPath}) {
-    const _sub = await validate${delegateName}(asResource(resource.${relPath}), options);
+    const _sub = await validate${delegateName}(asResource(resource.${relPath}), _delegateOptions);
     errors.push(..._sub.errors);
     warnings.push(..._sub.warnings);
   }`);
@@ -397,7 +357,13 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
         }
     }
     // ── Deduplicate & filter constraints ────────────────────────────────────
-    const uniqueConstraints = Array.from(new Map(constraintsWithContext.map((item) => [item.constraint.expression + "|" + item.fieldPath, item])).values());
+    const uniqueConstraints = Array.from(new Map(
+    // The slice filter is part of the identity: two slices of the same element can
+    // carry the same expression with different pinned values, and collapsing them
+    // would keep only one slice's rule.
+    constraintsWithContext.map((item) => [
+        `${item.constraint.expression}|${item.fieldPath}|${item.sliceFilter ?? ''}`, item,
+    ])).values());
     const filteredConstraints = uniqueConstraints.filter(c => {
         const expr = c.constraint.expression || "";
         const fieldPath = c.fieldPath || "";
@@ -408,6 +374,16 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
         // Filter $this on choice-type fields — fhirpath scoping differs from HL7.
         if (c.isChoiceType && /\$this\b/.test(expr))
             return false;
+        // txt-1/txt-2 (htmlChecks) are not filtered: htmlChecks is supplied through
+        // fhirpath's userInvocationTable, and as() over a collection is normalised to
+        // ofType() below.
+        //
+        // dom-3 is implemented natively in generateContainedRefValidation instead.
+        // Its FHIRPath form builds the fragment as '#'+id, so an absent id makes the
+        // predicate empty and the invariant passes where HL7 reports the resource as
+        // unreferenced. Keeping both would double-report the ones that do fire.
+        if (/'#'\s*\+\s*id\b/.test(expr))
+            return false;
         // For nested fields (depth > 1), filter only base FHIR invariants whose
         // evaluation diverges between fhirpath.js and HL7:
         //   ele-1: hasValue() or (children().count() > id.count())
@@ -415,19 +391,28 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
         // Profile-specific constraints at nested depth are allowed through —
         // the .all() wrapping handles scoping correctly for these.
         if (fieldPath && fieldPath.split('.').length > 1) {
-            const isEle1 = /^hasValue\(\)\s+or\s+\(children\(\)\.count\(\)\s*>\s*id\.count\(\)\)$/.test(expr);
-            const isExt1 = /^extension\.exists\(\)\s*!=\s*value\.exists\(\)$/.test(expr);
-            if (isEle1 || isExt1)
+            if (isBaseElementInvariant(expr))
                 return false;
         }
         return true;
     });
+    // An invariant on a recursive BackboneElement (Composition.section,
+    // Questionnaire.item, …) applies to every occurrence, not only the top-level
+    // ones. `<path>.all(…)` visits one level, so a nested element that violates the
+    // invariant goes unreported while HL7 flags it — cmp-1 on a depth-2
+    // Composition.section is the case that surfaced this. repeat() walks the whole
+    // recursion, which is the idiom FHIR's own invariants use.
+    const relativeFieldNames = new Set(fields.map(f => (f.name || '').replace(/^[^.]+\./, '')).filter(Boolean));
+    const isRecursiveElement = (path) => {
+        const lastSegment = path.split('.').pop() || '';
+        return !!lastSegment && relativeFieldNames.has(`${path}.${lastSegment}`);
+    };
     // ── Generate FHIRPath evaluation code ───────────────────────────────────
     const validationLogic = filteredConstraints
         .map((item, index) => {
         const constraint = item.constraint;
         const fieldPath = item.fieldPath;
-        let escapedExpression = (constraint.expression || '')
+        let escapedExpression = normalizeCollectionTypeFilters(constraint.expression || '')
             .replace(/\s*\n\s*/g, ' ')
             .replace(/\\/g, '\\\\')
             .replace(/"/g, '\\"');
@@ -455,13 +440,19 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
             if (!expressionRefersToField) {
                 const resourceTypePattern = /^[A-Z][a-zA-Z]+\./;
                 if (!resourceTypePattern.test(escapedExpression)) {
-                    escapedExpression = `${fieldPath}.all(${escapedExpression})`;
+                    const walkRecursion = isRecursiveElement(fieldPath)
+                        && !isBaseElementInvariant(constraint.expression || '');
+                    const navigation = item.sliceFilter
+                        ? `${quoteFhirPathPath(fieldPath)}.where(${item.sliceFilter})`
+                        : quoteFhirPathPath(fieldPath);
+                    const scope = walkRecursion ? `repeat(${navigation})` : navigation;
+                    escapedExpression = `${scope}.all(${escapedExpression})`;
                 }
             }
         }
         const needsTerminology = /\bmemberOf\b/.test(constraint.expression || '');
         let evaluateBlock = `
-    const result${index} = await fhirpath.evaluate(resource, "${escapedExpression}", { resource }, fhirpath_model, fhirpathOptions);
+    const result${index} = await fhirpath.evaluate(resource, "${escapedExpression}", { resource, rootResource: resource }, fhirpath_model, fhirpathOptions);
     if (!result${index}.every(Boolean)) {
       ${constraint.severity === "error" ? "errors" : "warnings"}.push("Constraint violation: ${escapedHuman}");
     }`;
@@ -490,7 +481,7 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
     })
         .join("\n");
     // ── Assemble final output ───────────────────────────────────────────────
-    const hasConstraints = filteredConstraints.length > 0 || sliceValidations.length > 0
+    const hasConstraints = filteredConstraints.length > 0 || sliceValidations.length > 0 || closedSlicingValidations.length > 0
         || patternValidations.length > 0 || fixedValueValidations.length > 0
         || bindingValidations.length > 0 || prohibitedFieldValidations.length > 0
         || bundleRefValidation.length > 0 || primitiveFormatValidations.length > 0
@@ -510,14 +501,22 @@ export function generateValidateProfileFunction(interfaceName, fields, valueSets
         ? `\n  // Non-DomainResource: text is not a valid property\n  if (at(resource, 'text') !== undefined) {\n    errors.push("Unrecognized property 'text'");\n  }`
         : '';
     if (!hasConstraints) {
+        const body = `${bundleEntryResolution}${referenceTargetTypeValidation}${structuralTypeValidations.join('')}${nonDomainTextCheck}${extensionStructuralValidation}${containedRefValidation}${bundledAggregationValidation}`;
+        // This path skips the shared helper import, so pull in exactly the helpers the
+        // body actually calls — importing all of them would trip no-unused-vars, and
+        // importing none breaks bodies that use at()/arr() (aggregation, text checks).
+        const usedHelpers = HELPER_NAMES.filter(name => new RegExp(`\\b${name}\\(`).test(body));
+        const helperImport = usedHelpers.length > 0
+            ? `import { ${usedHelpers.join(', ')} } from './ValidatorOptions.js';\n`
+            : '';
         return {
             code: `import type { ValidatorOptions } from './ValidatorOptions.js';
-
+${helperImport}
 export async function validate${interfaceName}(resource: ${interfaceName}, options?: ValidatorOptions): Promise<{ errors: string[]; warnings: string[] }> {
   const errors: string[] = [];
   const warnings: string[] = [];
   void options;
-${structuralTypeValidations.length > 0 ? `\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const _bRes = resource as Record<string, any>;` : ''}${structuralTypeValidations.join('')}${nonDomainTextCheck}${extensionStructuralValidation}${containedRefValidation}${bundledAggregationValidation}
+${body}
   return { errors, warnings };
 }`,
             valueSetImports
@@ -533,9 +532,11 @@ ${structuralTypeValidations.length > 0 ? `\n  // eslint-disable-next-line @types
     // `at`/`arr` are value imports: they replace the `as any` element probing that
     // would otherwise appear throughout the emitted body.
     const optionsImport = 'import type { ValidatorOptions } from \'./ValidatorOptions.js\';\n'
-        + 'import { at, arr, node, elements, codings, asResource } from \'./ValidatorOptions.js\';\n\n';
+        + `import { ${HELPER_NAMES.join(', ')}, fhirpathUserFunctions } from './ValidatorOptions.js';\n\n`;
     const fhirpathOptionsLines = [
         '    preciseMath: true,',
+        // Supplies htmlChecks(), which fhirpath.js does not implement.
+        '    userInvocationTable: fhirpathUserFunctions,',
         '    traceFn: options?.traceFn ?? (() => {}),',
         '    ...(options?.signal ? { signal: options.signal } : {}),',
         '    ...(options?.httpHeaders ? { httpHeaders: options.httpHeaders } : {}),',
@@ -562,7 +563,7 @@ ${structuralTypeValidations.length > 0 ? `\n  // eslint-disable-next-line @types
   const errors: string[] = [];
   const warnings: string[] = [];
   ${fhirpathOptionsBlock}
-  ${validationLogic}${fixedPatternValidations.join('')}${nestedRequiredValidations.join('')}${fixedValueValidations.join('')}${(bindingValidations.length > 0 || prohibitedFieldValidations.length > 0 || primitiveFormatValidations.length > 0 || choiceNarrowingValidations.length > 0 || structuralTypeValidations.length > 0) ? `\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const _bRes = resource as Record<string, any>;` : ''}${structuralTypeValidations.join('')}${prohibitedFieldValidations.join('')}${bindingValidations.join('')}${primitiveFormatValidations.join('')}${choiceNarrowingValidations.join('')}${sliceValidations.join('')}${datatypeProfileDelegations.join('')}${nonDomainTextCheck}${extensionStructuralValidation}${containedRefValidation}${bundledAggregationValidation}${bundleRefValidation}
+  ${bundleEntryResolution}${referenceTargetTypeValidation}${validationLogic}${fixedPatternValidations.join('')}${nestedRequiredValidations.join('')}${fixedValueValidations.join('')}${structuralTypeValidations.join('')}${prohibitedFieldValidations.join('')}${bindingValidations.join('')}${primitiveFormatValidations.join('')}${choiceNarrowingValidations.join('')}${sliceValidations.join('')}${closedSlicingValidations.join('')}${datatypeProfileDelegations.join('')}${nonDomainTextCheck}${extensionStructuralValidation}${containedRefValidation}${bundledAggregationValidation}${bundleRefValidation}
   return { errors, warnings };
 }`,
         valueSetImports