babelfhir-ts 1.6.7 → 1.6.9

package/README.md

@@ -46,7 +46,7 @@
 - **Type-safe extension handling** with proper slicing and nested extension support
 - **Random data builders** for testing and development (when class generation is enabled)
 - **Zero manual mapping**—consume any FHIR package or Implementation Guide directly from registries
-- **Fast and lightweight**—the CLI pulls no FHIRPath engine of its own; generated packages declare `fhirpath` as a *peer* dependency (`>=4.9.1 <6`), so the host app owns the version
+- **Fast and lightweight**—the CLI pulls no FHIRPath engine of its own; generated packages declare `fhirpath` as a *peer* dependency (`>=5.2.0 <6`), so the host app owns the version
 - **Type-safe FHIR client** — generated client extends [`@babelfhir-ts/client-r4`](https://www.npmjs.com/package/@babelfhir-ts/client-r4) / [`client-r4b`](https://www.npmjs.com/package/@babelfhir-ts/client-r4b) / [`client-r5`](https://www.npmjs.com/package/@babelfhir-ts/client-r5) with profile-specific methods (e.g., `.uSCorePatientProfile()`, `.pASClaim()`) on top of base resource accessors
 - **Install any FHIR profile as a node module**—use `babelfhir-ts install` to add Implementation Guides (FHIR Packages) directly to your project
 

package/out/src/generator/core/generatedPackageDeps.js

@@ -86,8 +86,17 @@ export const EMITTED_RANGES = {
      * Capped below 6.0.0: majors do break consumers here. 5.x added an `exports`
      * map, which is why the emitted import carries an explicit
      * `/fhir-context/<model>/index.js` filename.
+     *
+     * The floor moved to 5.2.0 with htmlChecks(). R4 writes txt-1 and txt-2 as
+     * `htmlChecks()` on Narrative.div, and an unimplemented function throws out of the
+     * whole evaluation rather than returning false — so on an older engine a resource
+     * carrying a narrative lost every other finding too, not just the narrative check.
+     * This repo supplied the function through fhirpath's userInvocationTable until
+     * 5.2.0 implemented it (HL7/fhirpath.js#147). The supplied copy is gone, so an
+     * engine below 5.2.0 would take those findings down with it: the floor is what
+     * keeps that from reaching a consumer silently.
      */
-    fhirpath: '>=4.9.1 <6.0.0',
+    fhirpath: '>=5.2.0 <6.0.0',
     /**
      * Schema runtime for `--schema zod` output.
      *
@@ -103,16 +112,43 @@ export const EMITTED_RANGES = {
     /**
      * Prefab UI runtime for `--prefab` output.
      *
-     * 0.3.0 is the floor: it introduced wire protocol 0.3, where the theme is
-     * compiled into the top-level `css` array, `stylesheets` carries external
-     * URLs, and `mode` forces a colour scheme. Emitted renderers pass `theme`
-     * and spread `PrefabAppOptions` into `PrefabApp`, so they rely on a >= 0.3
+     * 0.3.0 introduced wire protocol 0.3, where the theme is compiled into the
+     * top-level `css` array, `stylesheets` carries external URLs, and `mode`
+     * forces a colour scheme. Emitted renderers pass `theme` and spread
+     * `PrefabAppOptions` into `PrefabApp`, so they rely on a >= 0.3
      * serializer/renderer pair to apply themes. A 0.2.x renderer would silently
      * drop them.
+     *
+     * 0.3.10 is the floor because `AutoFormField` gained `options` there, and the
+     * emitted form now carries the bound ValueSet's concepts on every coded
+     * field. Below it the property is not in the type and is ignored by
+     * `autoForm`, so a required-binding field renders as free text: the form
+     * still builds, and every constraint the binding states is gone from it.
+     */
+    prefab: '^0.3.10',
+    /**
+     * Generated FHIR client base package (`@babelfhir-ts/client-<slug>`).
+     *
+     * The emitted client is a thin profile-typed layer over this package —
+     * `FhirReadClient`/`FhirWriteClient` are extended, `BundleParser` is extended —
+     * so the range here decides which transport every generated package actually
+     * runs on. `^0.2.0` on a `0.x` version resolves to `>=0.2.0 <0.3.0`, so it did
+     * not merely set a floor: it CAPPED every consumer below 0.3.0, and 0.3.0 is
+     * where the writer started parsing the `OperationOutcome` of a rejected write.
+     * On 0.2.x a failed save reports `PUT Consent/123: 400 Bad Request` and
+     * discards the server's account of why — the unresolvable reference, the failed
+     * invariant, the scope it would not accept.
+     *
+     * The cap also multiplied installs: an app depending on both a generated
+     * package and `@babelfhir-ts/client-r4@^0.3` gets 0.2.x nested under every
+     * generated package alongside its own 0.3.x, so two copies of the client (and
+     * of SmartAuth) run in one bundle.
+     *
+     * Safe to raise by construction: `fhir-client.js` is byte-identical between
+     * 0.2.6 and 0.3.2 and `index.js` only ADDS `hasId`, so nothing the emitted
+     * layer calls changed shape. Capped below 0.4.0 as usual for a 0.x line.
      */
-    prefab: '^0.3.0',
-    /** Generated FHIR client base package (`@babelfhir-ts/client-<slug>`). */
-    client: '^0.2.0',
+    client: '^0.3.2',
     /** Shared base zod schemas (`@babelfhir-ts/zod`). */
     zodBase: '^0.2.0',
     /** DICOMweb helpers (`@babelfhir-ts/dicomweb`). */

package/out/src/generator/core/utils.js

@@ -22,6 +22,37 @@ export function stripVersionFromCanonicalUrl(url) {
  * returns a string: the split form is an indexing expression, which is only
  * `string | undefined` to the compiler even though it can never be empty.
  */
+/**
+ * Whether a name is shaped like a FHIR resource type.
+ *
+ * `Resource` and `DomainResource` are excluded on purpose: they name every resource
+ * rather than one, so a check that accepts them rejects nothing.
+ */
+export function looksLikeResourceTypeName(name) {
+    if (!name)
+        return false;
+    if (name === 'Resource' || name === 'DomainResource')
+        return false;
+    return /^[A-Z][A-Za-z]+$/.test(name);
+}
+/**
+ * The resource type a profile URL constrains, or undefined when it cannot be known.
+ *
+ * The registry comes first, the URL's last segment second. Three emitters resolved
+ * this independently and two of them read the segment first, which is wrong in a way
+ * that only shows on IG profiles: the last segment of
+ * `.../StructureDefinition/MyPatientProfile` is shaped exactly like a resource type,
+ * so the heuristic answered `MyPatientProfile` while the registry knew `Patient`. The
+ * segment is a fallback for URLs the registry never saw, not a first guess.
+ */
+export function resourceTypeForProfileUrl(url, profileUrlToType) {
+    const bare = stripVersionFromCanonicalUrl(url);
+    const registered = profileUrlToType?.get(bare) ?? profileUrlToType?.get(url);
+    if (looksLikeResourceTypeName(registered))
+        return registered;
+    const lastSegment = bare.split('/').pop() ?? '';
+    return looksLikeResourceTypeName(lastSegment) ? lastSegment : undefined;
+}
 export function stripSliceSuffix(path) {
     if (!path)
         return path;

package/out/src/generator/emitters/prefab/prefabEmitter.js

@@ -28,9 +28,9 @@ function ensurePrefabDir(outputDir) {
  * Emit `prefab/<InterfaceName>Prefab.ts` for a single profile.
  * Registers the profile so {@link finalizePrefabOutput} can build the barrel.
  */
-export function writePrefabProfile(outputDir, interfaceName, fields, resourceType) {
+export function writePrefabProfile(outputDir, interfaceName, fields, resourceType, valueSets) {
     const dir = ensurePrefabDir(outputDir);
-    const { code, fieldCount } = generatePrefabRenderer(interfaceName, fields, { resourceType });
+    const { code, fieldCount } = generatePrefabRenderer(interfaceName, fields, { resourceType, valueSets });
     const filePath = path.join(dir, `${interfaceName}Prefab.ts`);
     fs.writeFileSync(filePath, code);
     let map = emittedProfiles.get(outputDir);

package/out/src/generator/emitters/prefab/prefabRenderer.js

@@ -68,6 +68,17 @@ function emitToRowBody(descriptors) {
     const lines = descriptors.map(d => `    ${d.name}: ${rowAccessor(d)},`);
     return lines.join('\n');
 }
+/**
+ * Emit an `AutoFormOption[]` literal for a bound field.
+ *
+ * The label is omitted when the concept carried no display, because prefab
+ * already falls back to the value and restating it would only make the
+ * generated file longer.
+ */
+function emitOptionsLiteral(options) {
+    const entries = options.map(o => o.label ? `{ value: ${JSON.stringify(o.value)}, label: ${JSON.stringify(o.label)} }` : `{ value: ${JSON.stringify(o.value)} }`);
+    return `[${entries.join(', ')}]`;
+}
 /** Emit `autoForm` field descriptors. */
 function emitFormFields(descriptors) {
     const lines = [];
@@ -80,6 +91,7 @@ function emitFormFields(descriptors) {
             continue;
         if (d.isArray)
             continue; // v1: scalars only
+        const options = d.enumOptions?.length ? d.enumOptions : undefined;
         let type = 'text';
         if (d.kind === 'number')
             type = 'number';
@@ -87,14 +99,13 @@ function emitFormFields(descriptors) {
             type = 'switch';
         else if (d.kind === 'date')
             type = 'date';
-        else if (d.enumValues && d.enumValues.length > 0)
+        else if (options)
             type = 'select';
         const extra = [`name: '${d.name}'`, `label: ${JSON.stringify(d.label)}`, `type: '${type}'`];
         if (d.required)
             extra.push('required: true');
-        // NOTE: @maxhealth.tech/prefab AutoFormField does not yet carry an `options`
-        // property for select inputs; the enum list is elided until the upstream
-        // type is widened. See prefab-ui#TODO.
+        if (options)
+            extra.push(`options: ${emitOptionsLiteral(options)}`);
         lines.push(`    { ${extra.join(', ')} },`);
         seen.add(d.name);
     }
@@ -206,7 +217,7 @@ function emitBrowserTitleExpr(titleDescriptor, interfaceName) {
         : `selected.dot('${titleDescriptor.name}')`;
 }
 export function generatePrefabRenderer(interfaceName, fields, options) {
-    const rawDescriptors = fields.flatMap(describeField);
+    const rawDescriptors = fields.flatMap(f => describeField(f, options?.valueSets));
     const descriptors = dedupeDescriptors(rawDescriptors);
     const resourceType = options?.resourceType;
     const tableDescriptors = pickTableDescriptors(descriptors);

package/out/src/generator/emitters/prefab/prefabTypeMapper.js

@@ -8,6 +8,8 @@
  * This module is deliberately small and data-driven so it can later be
  * extracted into a shared codegen-spec package (see design notes).
  */
+import { lookupBoundValueSet } from '../requiredBindings.js';
+import { ctx } from '../../fhir/versionContext.js';
 /** Lower-cased FHIR primitive type codes. */
 const PRIMITIVE_TEXT = new Set([
     'string', 'code', 'uri', 'url', 'canonical', 'id', 'oid', 'uuid', 'markdown', 'xhtml',
@@ -23,6 +25,29 @@ function labelFor(name) {
     const spaced = name.replace(/([A-Z])/g, ' $1').replace(/[._-]/g, ' ').trim();
     return spaced.charAt(0).toUpperCase() + spaced.slice(1);
 }
+/**
+ * Build the choice list for a bound field, or undefined when there is none to
+ * offer.
+ *
+ * The parsed ValueSet is preferred over the codes the SD parser sampled onto
+ * the binding: it carries the concept displays, and it is the whole set rather
+ * than a subset. Both paths are capped at the same `STORE_CODES` threshold the
+ * parser and the interface emitter already use to decide a ValueSet is small
+ * enough to enumerate — past it a Select stops being a usable control and the
+ * field stays a free-text input.
+ */
+function selectOptionsFor(field, valueSets) {
+    const limit = ctx().valueSetThresholds.STORE_CODES;
+    const resolved = lookupBoundValueSet(field.binding?.uri, valueSets);
+    const concepts = resolved?.valueSet.concepts;
+    if (concepts?.length && concepts.length <= limit) {
+        return concepts.map(c => ({ value: c.code, ...(c.display ? { label: c.display } : {}) }));
+    }
+    const sampled = field.binding?.codes?.filter(c => c.code).map(c => ({ value: c.code }));
+    if (sampled?.length && sampled.length <= limit)
+        return sampled;
+    return undefined;
+}
 function kindForType(fhirType) {
     if (PRIMITIVE_TEXT.has(fhirType))
         return 'text';
@@ -86,7 +111,7 @@ function kindForType(fhirType) {
  * on the typed interface. Detail views for nested backbone elements are a
  * follow-up once slicing-aware tree rendering lands.
  */
-export function describeField(field) {
+export function describeField(field, valueSets) {
     if (field.isForbidden)
         return [];
     if (!field.type)
@@ -132,7 +157,7 @@ export function describeField(field) {
                 label: labelFor(variantPropName),
                 valueSetUri: field.binding?.uri,
                 bindingStrength: field.binding?.strength,
-                enumValues: field.binding?.codes?.map(c => c.code).filter(Boolean),
+                enumOptions: selectOptionsFor(field, valueSets),
             });
         }
         return out;
@@ -158,7 +183,7 @@ export function describeField(field) {
             label: labelFor(bareName),
             valueSetUri: field.binding?.uri,
             bindingStrength: field.binding?.strength,
-            enumValues: field.binding?.codes?.map(c => c.code).filter(Boolean),
+            enumOptions: selectOptionsFor(field, valueSets),
         }];
 }
 /**

package/out/src/generator/emitters/requiredBindings.js

@@ -0,0 +1,138 @@
+/**
+ * Which required-strength ValueSet bindings are enforceable, and against what.
+ *
+ * The validator and the zod schema are compared against each other on every parity
+ * run, so they have to agree on which bindings they check. They did not: the
+ * validator walked any depth and accepted `code`, `Coding`, `CodeableConcept`,
+ * `Quantity`, `string` and `uri`, while the zod builder took only depth-1
+ * `CodeableConcept`/`Coding` and inlined the code list. Every binding below the root
+ * was reported by one side and not the other — 146 of the 285 disagreements on that
+ * board, and the single largest class by a wide margin.
+ *
+ * The rule is written down here, and the zod builder now follows it: same selection,
+ * same ValueSet resolution, same wording. The validator still carries its own copy of
+ * the filter, because its builder threads each field through path building, choice
+ * suffixing and nested-array handling that would have to move with it — a refactor
+ * worth doing on its own, against the parity board, not folded into this change.
+ * Until then this module is the statement of the rule and the zod side's single
+ * source for it; changing the validator's filter means changing both.
+ */
+import { stripVersionFromCanonicalUrl } from '../core/utils.js';
+import { sanitizeValueSetName } from './valueset/valueSetGenerator.js';
+/** Types FHIR permits a binding on. */
+const BINDABLE_TYPES = ['code', 'Coding', 'CodeableConcept', 'Quantity', 'string', 'uri'];
+/**
+ * Resolve a binding URI to its parsed ValueSet, versioned key first.
+ *
+ * A binding may cite `…/ValueSet/foo|1.0.0` while the package indexes the
+ * ValueSet under its unversioned canonical, so both keys have to be tried.
+ * Every emitter that reads concepts off a binding needs the same two lookups,
+ * which is why it lives here rather than in each of them.
+ */
+export function lookupBoundValueSet(bindingUri, valueSets) {
+    if (!bindingUri || !valueSets)
+        return undefined;
+    const direct = valueSets.get(bindingUri);
+    if (direct)
+        return { valueSet: direct, resolvedUri: bindingUri };
+    if (!bindingUri.includes('|'))
+        return undefined;
+    const strippedUri = stripVersionFromCanonicalUrl(bindingUri);
+    const stripped = valueSets.get(strippedUri);
+    return stripped ? { valueSet: stripped, resolvedUri: strippedUri } : undefined;
+}
+export function resolveRequiredBindingValueSet(bindingUri, valueSets) {
+    const resolved = lookupBoundValueSet(bindingUri, valueSets);
+    if (!resolved || !bindingUri)
+        return undefined;
+    const { valueSet: vs, resolvedUri } = resolved;
+    const displayName = resolvedUri.split('/').pop() || vs.name;
+    if (vs.concepts.length === 0) {
+        if (vs.systems && vs.systems.length > 0) {
+            return { systemOnly: true, displayName, systems: vs.systems };
+        }
+        return undefined;
+    }
+    const sanitizedName = sanitizeValueSetName(vs.name);
+    return {
+        sanitizedName,
+        displayName,
+        validatorFn: `isValid${sanitizedName}Code`,
+        importPath: `./valuesets/ValueSet-${sanitizedName}.js`,
+        uri: stripVersionFromCanonicalUrl(bindingUri),
+    };
+}
+/** The leaf kind for a bindable type, or undefined when the type carries no code. */
+export function bindingLeafKind(type) {
+    if (!type)
+        return undefined;
+    // string and uri hold the code in the element's own value, exactly like `code`.
+    if (type === 'code' || type === 'string' || type === 'uri')
+        return 'code';
+    if (type === 'Quantity')
+        return 'code';
+    if (type === 'Coding' || type === 'CodeableConcept')
+        return 'codings';
+    return undefined;
+}
+/**
+ * Select the fields whose required binding is worth checking.
+ *
+ * Mirrors what the validator's binding builder already accepted, so widening one
+ * side cannot introduce a finding the other never makes:
+ *   - required strength with a binding URI
+ *   - a bindable type
+ *   - not a slice, unless the slice name encodes a choice variant (`value[x]:valueCode`),
+ *     which maps to a concrete property
+ *   - no `[x]` above the leaf: stripping it leaves a property that does not exist
+ */
+export function selectRequiredBindingTargets(fields, rootPrefix) {
+    const targets = [];
+    const seen = new Set();
+    for (const field of fields) {
+        if (field.binding?.strength !== 'required' || !field.binding.uri)
+            continue;
+        if (field.max === 0)
+            continue;
+        if (field.sliceName) {
+            const elemId = field.elementId || field.name || '';
+            if (!elemId.includes('[x]:'))
+                continue;
+        }
+        const declaredType = field.type || field.baseTypeCode;
+        if (!declaredType || !BINDABLE_TYPES.includes(declaredType))
+            continue;
+        const kind = bindingLeafKind(declaredType);
+        if (!kind)
+            continue;
+        const relRaw = (field.name || '').replace(new RegExp(`^${rootPrefix}\\.`), '');
+        if (!relRaw || relRaw === field.name)
+            continue;
+        const segments = relRaw.split('.');
+        if (segments.slice(0, -1).some(segment => segment.includes('[x]')))
+            continue;
+        const leaf = segments[segments.length - 1];
+        if (!leaf)
+            continue;
+        // A choice leaf becomes its concrete property: value[x] + Coding → valueCoding.
+        const path = leaf.includes('[x]')
+            ? [...segments.slice(0, -1), leaf.replace('[x]', declaredType.charAt(0).toUpperCase() + declaredType.slice(1))]
+            : segments;
+        if (path.some(segment => segment.includes('[x]') || segment.includes(':')))
+            continue;
+        const key = `${path.join('.')}|${field.binding.uri}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        targets.push({ field, path, kind });
+    }
+    return targets;
+}
+/** The finding both emitters report when no coding in the element is in the ValueSet. */
+export function codingsNotInValueSetMessage(displayName, uri) {
+    return `None of the codings provided are in the value set '${displayName}' (${uri}), and a coding from this value set is required)`;
+}
+/** The finding both emitters report when a single code is not in the ValueSet. */
+export function codeNotInValueSetMessage(displayName, uri) {
+    return `does not exist in the value set '${displayName}' (${uri}), but the binding is of strength 'required'`;
+}

package/out/src/generator/emitters/validator/closedSlicingValidation.js

@@ -21,8 +21,15 @@
  * conformant resource. Enforcing those needs slice-scoped traversal and is left off
  * rather than approximated.
  */
-import { stripVersionFromCanonicalUrl } from '../../core/utils.js';
+import { resourceTypeForProfileUrl, stripVersionFromCanonicalUrl } from '../../core/utils.js';
 const CHOICE_SUFFIX = '[x]';
+/**
+ * The resource-type shape, for the *generated* guard.
+ *
+ * looksLikeResourceTypeName is the emitter-side twin; this is the same rule written
+ * for the emitted file, which has no access to our helpers.
+ */
+const RESOURCE_TYPE_SHAPE = '/^[A-Z][A-Za-z]+$/';
 /** The url an instance of this extension slice carries (pinned `url` child, else profile). */
 function instanceUrl(slice, fields) {
     const sliceElemId = (slice.elementId || slice.name).replace(/^[^.]+\./, '');
@@ -52,6 +59,38 @@ function choiceProperty(baseProp, slice) {
         return undefined;
     return `${baseProp}${code.charAt(0).toUpperCase()}${code.slice(1)}`;
 }
+/** Whether this element holds a Reference, so its slices are told apart by target. */
+function isReferenceElement(field) {
+    if (field.type === 'Reference' || field.baseTypeCode === 'Reference')
+        return true;
+    return (field.typeOptions ?? []).some(option => option.code === 'Reference');
+}
+/**
+ * The resource types a Reference slice accepts, or undefined when any target is
+ * unresolvable.
+ *
+ * A target names a profile, not a type: `.../vitals/StructureDefinition/body-weight`
+ * is an Observation, and only the package registry knows that. A core URL carries the
+ * type in its last segment. Anything left unresolved returns undefined, which takes
+ * the whole slicing out of enforcement rather than judging against a partial set.
+ */
+function referenceTargetTypes(slice, profileUrlToType) {
+    const targets = (slice.typeOptions ?? [])
+        .filter(option => option.code === 'Reference')
+        .flatMap(option => option.targetProfileUrls ?? []);
+    if (targets.length === 0)
+        return undefined;
+    const types = [];
+    for (const target of targets) {
+        // Undefined covers both an unresolvable target and one open to any resource,
+        // and either leaves the allowed set incomplete.
+        const resolved = resourceTypeForProfileUrl(target, profileUrlToType);
+        if (!resolved)
+            return undefined;
+        types.push(resolved);
+    }
+    return [...new Set(types)];
+}
 /** Classify a closed slicing, or undefined when it is not one this module enforces. */
 function classify(leaf) {
     if (leaf === 'extension' || leaf === 'modifierExtension')
@@ -74,7 +113,7 @@ function walk(segments, body) {
 /**
  * Emit closed-slicing checks for every element that introduces a closed slicing.
  */
-export function generateClosedSlicingValidations(fields, profileUrl, baseResourceType) {
+export function generateClosedSlicingValidations(fields, profileUrl, baseResourceType, profileUrlToType) {
     const out = [];
     const seen = new Set();
     for (const field of fields) {
@@ -91,7 +130,7 @@ export function generateClosedSlicingValidations(fields, profileUrl, baseResourc
         const leaf = segments.at(-1);
         if (!leaf)
             continue;
-        const kind = classify(leaf);
+        const kind = classify(leaf) ?? (isReferenceElement(field) ? 'reference-target' : undefined);
         if (!kind)
             continue;
         // A choice segment above the leaf is not a JSON property name, so the walk
@@ -104,6 +143,45 @@ export function generateClosedSlicingValidations(fields, profileUrl, baseResourc
         const fhirPath = `${baseResourceType ?? 'Resource'}.${elemId}`;
         const profileRef = profileUrl ?? (baseResourceType ?? '');
         const message = `This element does not match any known slice defined in the profile ${profileRef} and slicing is CLOSED: ${fhirPath}`;
+        if (kind === 'reference-target') {
+            // A `resolve()` discriminator tells slices apart by what the reference points
+            // at, which needs the target. The target type does not: a slicing whose slices
+            // all accept Observation cannot hold a `Patient/x`, resolvable or not, and HL7
+            // reports exactly that — vital-signs-panel.hasMember was the whole `entry`
+            // category of the vitals random-parity gap.
+            //
+            // Only the type is judged, never the identity. Reference.type when present,
+            // else the `Type/id` prefix of a relative literal reference; an absolute URL,
+            // a `urn:uuid:` or a contained `#id` yields no type and is left alone. That is
+            // narrower than the reference-target check in validatorTemplates, which stays
+            // silent on any unresolved reference: there the finding IS resolution, here the
+            // finding is slice membership, and a closed slicing rules out a wrong type
+            // without resolving anything.
+            const perSlice = slices.map(s => referenceTargetTypes(s, profileUrlToType));
+            // One unresolvable slice and the allowed set is incomplete, so a conformant
+            // member could be reported. Same all-or-nothing rule as the other two kinds.
+            if (perSlice.some(types => !types))
+                continue;
+            const allowed = [...new Set(perSlice.flat())];
+            if (allowed.length === 0)
+                continue;
+            const allowedList = `[${allowed.map(t => `"${t}"`).join(', ')}]`;
+            out.push(`
+  // Closed slicing on ${fhirPath}: only references to ${allowed.join(', ')} can match a slice${walk(segments, `
+    const _csRefType = at(_csElem, 'type');
+    const _csRefStr = at(_csElem, 'reference');
+    const _csPrefix = typeof _csRefStr === 'string' && _csRefStr.indexOf('/') > 0
+      ? _csRefStr.slice(0, _csRefStr.indexOf('/'))
+      : undefined;
+    const _csTarget = typeof _csRefType === 'string' && _csRefType.length > 0
+      ? _csRefType
+      : (typeof _csPrefix === 'string' && ${RESOURCE_TYPE_SHAPE}.test(_csPrefix) ? _csPrefix : undefined);
+    if (_csTarget !== undefined && !${allowedList}.includes(_csTarget)) {
+      errors.push("${message} (target = " + _csTarget + ")");
+    }`)}`);
+            seen.add(elemId);
+            continue;
+        }
         if (kind === 'extension-url') {
             const urls = slices.map(s => instanceUrl(s, fields)).filter((u) => !!u);
             // Every slice must be identifiable, or a conformant member gets reported.

package/out/src/generator/emitters/validator/sliceBackboneValidation.js

@@ -115,7 +115,97 @@ export function collectFixedValueSliceChildren(sliceElementId, fields, discrimin
     }
     return result;
 }
-export function generateBackboneElementValidation(slice, relPath, errorPath, sliceLabel, varName, min, fields, childFieldsWithPattern, out, profileName) {
+/**
+ * Collect fixed-value descendants one level below a slice's direct children.
+ *
+ * The pinned element of a profiled backbone slice is usually a grandchild, not a
+ * child: `component:SystolicBP.value[x]:valueQuantity.code` is fixed to `mm[Hg]`,
+ * and `collectFixedValueSliceChildren` skips it because the relative path has a dot.
+ * The root-level builder skips it too, deliberately — a pin declared on a slice
+ * must apply only to that slice's members, and it has no slice identity to filter
+ * on (see the `hasSliceQualifier` guard in validatorFieldBuilders). So nothing
+ * checked it, and HL7's `Value is '/min' but is fixed to 'mm[Hg]'` was the whole
+ * `code` category of the vitals random-parity gap.
+ *
+ * Emitted inside the matched-element loop, which is what keeps the pin scoped to
+ * the slice that declares it.
+ *
+ * Two relative shapes reach a grandchild:
+ *   `valueQuantity.code`            a plain child, then its leaf
+ *   `value[x]:valueQuantity.code`   a type slice on a choice, then its leaf
+ */
+export function collectNestedFixedValueSliceChildren(sliceElementId, fields, discriminatorProp) {
+    const result = [];
+    const seen = new Set();
+    for (const f of fields) {
+        const childId = f.elementId || f.name;
+        if (!childId.startsWith(sliceElementId + '.'))
+            continue;
+        if (f.fixedValue === undefined)
+            continue;
+        if (typeof f.fixedValue !== 'string' && typeof f.fixedValue !== 'number' && typeof f.fixedValue !== 'boolean')
+            continue;
+        const relativePath = childId.substring(sliceElementId.length + 1);
+        const parts = relativePath.split('.');
+        if (parts.length !== 2)
+            continue;
+        const [parentSegment, leafSegment] = parts;
+        if (!parentSegment || !leafSegment)
+            continue;
+        // A leaf that is itself sliced needs its own scope, and a choice leaf has no
+        // single property name to read.
+        if (leafSegment.includes(':') || leafSegment.endsWith('[x]'))
+            continue;
+        // `value[x]:valueQuantity` writes the typed property; a plain child writes itself.
+        const parentProp = parentSegment.includes('[x]:')
+            ? parentSegment.split(':')[1]
+            : parentSegment.includes(':') ? undefined : parentSegment.replace(/\[x\]$/, '');
+        if (!parentProp)
+            continue;
+        if (parentProp === discriminatorProp)
+            continue;
+        const key = `${parentProp}.${leafSegment}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        const parentField = fields.find(pf => (pf.elementId || pf.name) === `${sliceElementId}.${parentSegment}`);
+        result.push({
+            parentProp,
+            isParentArray: parentField?.isArray ?? false,
+            prop: leafSegment,
+            fixedValue: f.fixedValue,
+            elementPath: childId,
+        });
+    }
+    return result;
+}
+/** Emit the fixed-value checks for a slice's grandchildren, inside the matched-element loop. */
+export function generateNestedFixedValueChecks(nested, profileRef) {
+    return nested.map(n => {
+        const expected = typeof n.fixedValue === 'string' ? JSON.stringify(n.fixedValue) : String(n.fixedValue);
+        const display = String(n.fixedValue).replace(/"/g, '\\"');
+        const anchor = `${profileRef}#${n.elementPath}`;
+        const report = `errors.push("Value is '" + _fx.${n.prop} + "' but is fixed to '${display}' in the profile ${anchor}");`;
+        const guard = `_fx.${n.prop} !== undefined && _fx.${n.prop} !== null && String(_fx.${n.prop}) !== ${expected}`;
+        if (n.isParentArray) {
+            return `
+      for (const _fxItem of elements(at(_m, '${n.parentProp}'))) {
+        const _fx = node(_fxItem);
+        if (${guard}) {
+          ${report}
+        }
+      }`;
+        }
+        return `
+      if (_m.${n.parentProp} !== undefined && _m.${n.parentProp} !== null) {
+        const _fx = node(at(_m, '${n.parentProp}'));
+        if (${guard}) {
+          ${report}
+        }
+      }`;
+    }).join('');
+}
+export function generateBackboneElementValidation(slice, relPath, errorPath, sliceLabel, varName, min, fields, childFieldsWithPattern, out, profileName, profileUrl) {
     const sliceElementId = slice.elementId || slice.name;
     const discriminatorChild = childFieldsWithPattern.find(f => {
         const fElementId = f.elementId || f.name;
@@ -181,6 +271,7 @@ export function generateBackboneElementValidation(slice, relPath, errorPath, sli
     const resourceType = profileName || firstSegment(sliceElementId);
     const requiredChildren = collectRequiredSliceChildren(sliceElementId, fields, discriminatorProp, resourceType, relPath);
     const nestedChildren = collectNestedRequiredSliceChildren(sliceElementId, fields, discriminatorProp, resourceType, relPath);
+    const nestedFixed = collectNestedFixedValueSliceChildren(sliceElementId, fields, discriminatorProp);
     const directChecksInner = requiredChildren.map(c => c.isChoiceType
         ? `\n      if (!Object.keys(_m).some(k => k.startsWith('${c.prop}'))) {
         errors.push("${c.errorPath}: minimum required = 1, but only found 0");
@@ -210,11 +301,12 @@ export function generateBackboneElementValidation(slice, relPath, errorPath, sli
         }
       }`;
     }).join('');
+    const nestedFixedChecksInner = generateNestedFixedValueChecks(nestedFixed, profileUrl || resourceType);
     const maxChildren = collectWithinSliceMaxChildren(slice, fields);
     const maxChecksCode = generateWithinSliceMaxChecks(maxChildren, `${varName}Elements`, resourceType, relPath, sliceLabel);
-    const childChecksCode = (requiredChildren.length > 0 || nestedChildren.length > 0
+    const childChecksCode = (requiredChildren.length > 0 || nestedChildren.length > 0 || nestedFixed.length > 0
         ? `\n    for (const _matched of ${varName}Elements) {
-      const _m = node(_matched);${directChecksInner}${nestedChecksInner}
+      const _m = node(_matched);${directChecksInner}${nestedChecksInner}${nestedFixedChecksInner}
     }`
         : '') + maxChecksCode;
     const pathParts = relPath.split('.');
@@ -266,7 +358,7 @@ export function generateBackboneElementValidation(slice, relPath, errorPath, sli
  * the child .name has fixedString: "sourceIdentifier".
  * Generates: resource.parameter.filter(item => item.name === "sourceIdentifier")
  */
-export function generateFixedValueSliceValidation(slice, relPath, errorPath, sliceLabel, varName, min, fields, childFieldsWithFixedValue, out, profileName) {
+export function generateFixedValueSliceValidation(slice, relPath, errorPath, sliceLabel, varName, min, fields, childFieldsWithFixedValue, out, profileName, profileUrl) {
     const sliceElementId = slice.elementId || slice.name;
     // The caller only reaches here with a fixed-value child, but an empty list would
     // otherwise read its discriminator off undefined.
@@ -288,6 +380,7 @@ export function generateFixedValueSliceValidation(slice, relPath, errorPath, sli
     const resourceType = profileName || firstSegment(sliceElementId);
     const requiredChildren = collectRequiredSliceChildren(sliceElementId, fields, discriminatorProp, resourceType, relPath);
     const nestedChildren = collectNestedRequiredSliceChildren(sliceElementId, fields, discriminatorProp, resourceType, relPath);
+    const nestedFixed = collectNestedFixedValueSliceChildren(sliceElementId, fields, discriminatorProp);
     const fixedChildren = collectFixedValueSliceChildren(sliceElementId, fields, discriminatorProp);
     const directChecksInner = requiredChildren.map(c => c.isChoiceType
         ? `\n      if (!Object.keys(_m).some(k => k.startsWith('${c.prop}'))) {
@@ -325,11 +418,12 @@ export function generateFixedValueSliceValidation(slice, relPath, errorPath, sli
         errors.push("Value is '" + _m.${c.prop} + "' but is fixed to '${display}' in the profile ${resourceType}#${c.elementPath}");
       }`;
     }).join('');
+    const nestedFixedChecksInner = generateNestedFixedValueChecks(nestedFixed, profileUrl || resourceType);
     const maxChildren = collectWithinSliceMaxChildren(slice, fields);
     const maxChecksCode = generateWithinSliceMaxChecks(maxChildren, `${varName}Elements`, resourceType, relPath, sliceLabel);
-    const childChecksCode = (requiredChildren.length > 0 || nestedChildren.length > 0 || fixedChildren.length > 0
+    const childChecksCode = (requiredChildren.length > 0 || nestedChildren.length > 0 || fixedChildren.length > 0 || nestedFixed.length > 0
         ? `\n    for (const _matched of ${varName}Elements) {
-      const _m = node(_matched);${directChecksInner}${nestedChecksInner}${fixedChecksInner}
+      const _m = node(_matched);${directChecksInner}${nestedChecksInner}${fixedChecksInner}${nestedFixedChecksInner}
     }`
         : '') + maxChecksCode;
     // Detect if this slice is nested inside a parent array (e.g., component.code inside component[])