xsd

type Assertion struct {
	// Test is the compiled XPath 2.0 expression.
	Test *xpath.Compiled
	// Source is the expression as written, for diagnostics.
	Source string
	// XPathDefaultNamespace is the namespace unprefixed element names in
	// the test resolve to.
	XPathDefaultNamespace string
}

type AttributeDecl struct {
	Name       xdm.QName
	Type       *SimpleType
	Scope      Scope
	Constraint *ValueConstraint
	// contains filtered or unexported fields
}

type AttributeGroupDef struct {
	Name              xdm.QName
	AttributeUses     []*AttributeUse
	AttributeWildcard *Wildcard
	// contains filtered or unexported fields
}

type AttributeUse struct {
	Required   bool
	Decl       *AttributeDecl
	Constraint *ValueConstraint

	// Inheritable is the XSD 1.1 {inheritable}: the attribute is visible to
	// conditional type assignment on descendant elements, not only on the
	// element carrying it. It is how a schema lets an ancestor's xml:lang
	// choose a descendant's type.
	Inheritable bool

	// Prohibited marks use="prohibited": the attribute is removed rather
	// than declared. Such a use is not part of the type's {attribute uses}
	// — it exists only so that inheritance can tell "this name was ruled
	// out" from "this name was never mentioned", which is what stops the
	// base's use being inherited straight back.
	Prohibited bool
}

type CatalogEntry struct {
	// Path locates the document within the fs.FS.
	Path string
	// Namespace is the schema's target namespace, or empty for a document
	// only ever named by location.
	Namespace string
	// Aliases are the schemaLocation spellings this document answers.
	Aliases []string
}

type CatalogResolver struct {
	// contains filtered or unexported fields
}

type CheckOptions struct {
	// LaxUPA accepts a content model in which two competing particles are
	// references to the same element declaration.
	//
	// The strict reading of §3.8.6 rejects those; Saxon and XSV accept
	// them. Schemas written against either of those processors may rely on
	// it, so this exists — but it is off by default, because the strict
	// reading is the conforming one.
	LaxUPA bool

	// Version selects the UPA rule. XSD 1.1 relaxed the constraint so that
	// an element particle competing with a wildcard is no longer an error;
	// only element-against-element and wildcard-against-wildcard remain.
	// The suite states it outright — the feature category is
	// xsd1_1-Wildcards-RelaxationOfUPA, "wildcard/element competition no
	// longer violates UPA" — and s3_10_1v04s through s3_10_1ii09s are
	// version="1.1" schemaTests expected valid for exactly that shape.
	//
	// The zero value is 1.0, which keeps the stricter rule.
	Version Version
}

type ComplexType struct {
	Name      xdm.QName
	Base      Type
	Abstract  bool
	FinalSet  DerivationSet
	Prohibits DerivationSet

	// DerivationMethod is {derivation method}: extension or restriction.
	DerivationMethod Derivation

	// Content is the {content type} discriminator; SimpleContent and
	// Particle carry the payload for the kinds that have one.
	Content       ContentKind
	SimpleContent *SimpleType
	Particle      *Particle

	AttributeUses     []*AttributeUse
	AttributeWildcard *Wildcard

	// Assertions are the XSD 1.1 <xs:assert> co-constraints on this type
	// (§3.4.1 {assertions}). They evaluate XPath 2.0 against the element
	// being validated, which is the feature that makes XSD 1.1 unavailable
	// to implementations without an XPath engine.
	Assertions []*Assertion

	// OpenContent is the XSD 1.1 {open content}, which permits elements the
	// content model does not name. Nil means the type is closed.
	OpenContent *OpenContent
	// contains filtered or unexported fields
}

type Component interface {
	// ComponentKind names the kind for error messages.
	ComponentKind() string
}

type Compositor uint8

type ContentKind uint8

type Derivation uint8

type DerivationSet uint8

type ElementDecl struct {
	Name xdm.QName
	Type Type

	Scope      Scope
	Nillable   bool
	Constraint *ValueConstraint
	Abstract   bool

	// SubstitutionGroup is the {substitution group affiliation}: the head
	// this declaration may substitute for. Only a global declaration may
	// have one (erratum E1-36 requires the head be global too).
	//
	// It is the first of SubstitutionGroups, kept as its own field because
	// almost every use has exactly one head.
	SubstitutionGroup *ElementDecl

	// SubstitutionGroups holds every head, which XSD 1.1 permits to be a
	// list where 1.0 allowed only one.
	SubstitutionGroups []*ElementDecl

	// DisallowedSubstitutions is {disallowed substitutions}, from block=.
	// It controls substitution in an instance.
	DisallowedSubstitutions DerivationSet

	// SubstitutionGroupExclusions is {substitution group exclusions}, from
	// final=. It controls what may derive from this declaration's type and
	// still substitute. Kept separate from DisallowedSubstitutions because
	// the two are consulted at different times and conflating them is a
	// classic source of wrong answers.
	SubstitutionGroupExclusions DerivationSet

	// IdentityConstraints holds the key, keyref and unique children.
	IdentityConstraints []*IdentityConstraint

	// Alternatives are the XSD 1.1 <xs:alternative> children, in order.
	// The first whose test holds selects the type; conditional type
	// assignment is the other half of what 1.1 needs XPath for.
	Alternatives []*TypeAlternative
	// contains filtered or unexported fields
}

type FacetKind uint8

type FacetSet struct {
	Length         *uint64
	MinLength      *uint64
	MaxLength      *uint64
	TotalDigits    *uint64
	FractionDigits *uint64

	// WhiteSpace is the whiteSpace facet, and Fixed records whether the
	// schema wrote fixed="true" on it. The built-in types fix it, which is
	// why a user type cannot loosen xs:token back to preserve.
	WhiteSpace      *WhiteSpace
	WhiteSpaceFixed bool

	// MinInclusive and friends hold bounds. They are stored as lexical
	// strings because the type they must be parsed against is the type
	// being defined, which is not complete while its own facets are read.
	MinInclusive *string
	MaxInclusive *string
	MinExclusive *string
	MaxExclusive *string

	// Patterns from a single derivation step are alternatives: a value
	// satisfying any one of them satisfies the step. Patterns from
	// *different* steps are conjunctive. That asymmetry is why patterns are
	// held per step rather than merged into one list.
	Patterns []*Pattern

	// Enumerations are the permitted values, lexical at this stage. An
	// empty non-nil slice is meaningful — it permits nothing — so presence
	// is tested with HasEnumeration rather than len.
	Enumerations    []string
	HasEnumerations bool

	// EnumerationQNames holds the expanded form of each enumeration value,
	// parallel to Enumerations, for a type whose value space is QNames —
	// xs:QName, xs:NOTATION and anything derived from them.
	//
	// Those two types compare by expanded name, not by spelling: Part 2
	// §3.2.18 gives xs:NOTATION the value space of the QNames of the
	// notations declared in the schema, so an instance writing "one:mp3"
	// satisfies an enumeration written "smokey:mp3" whenever both prefixes
	// bind the same URI. The prefix in the facet resolves against the
	// *schema* document's namespaces and the prefix in the instance against
	// the *instance* document's, so neither lexical form can be compared
	// against the other; the expansion has to be recorded here, where the
	// facet's own element is still in hand.
	//
	// An entry is the zero QName when the facet's prefix was not bound, and
	// is only populated for a namespace-sensitive type, so an empty slice
	// means "compare lexically" as before.
	EnumerationQNames []xdm.QName

	// Assertions are the XSD 1.1 <xs:assertion> facets. On a simple type an
	// assertion is a facet rather than a component, though it compiles the
	// same way.
	Assertions []*Assertion

	// ExplicitTimezone is the XSD 1.1 facet constraining whether a date or
	// time value carries a timezone.
	ExplicitTimezone *Timezone

	// Fixed records which facets this step wrote fixed="true" on. Part 2
	// §4.3 gives every constraining facet but pattern, enumeration and
	// assertion a {fixed} property, and "Facet Valid (Restriction)" then
	// forbids a derived type from stating a *different* value for one the
	// base fixed.
	//
	// whiteSpace keeps its own flag rather than joining this map: the
	// built-in types fix it, and they are constructed directly rather than
	// parsed, so the boolean predates any schema document.
	Fixed map[FacetKind]bool
}

type FileResolver struct {
	// Root, when set, confines resolution to a directory. A location that
	// escapes it — through "..", a symlink, or an absolute path — is
	// refused. Leaving it empty permits any readable path, which is the
	// right default for a command-line tool and the wrong one for a server.
	Root string
}

type HTTPResolver struct {
	// Client fetches remote documents. When nil, a client with Timeout is
	// used. Supplying one is the hook for a caller that needs a proxy, a
	// pinned CA set, or a transport that refuses private address ranges.
	Client *http.Client

	// Timeout bounds a single fetch. Zero means DefaultFetchTimeout.
	Timeout time.Duration

	// MaxBytes bounds a fetched document. Zero means DefaultMaxSchemaBytes.
	// A schema is not a stream, so an unbounded read is a way to be handed
	// an unbounded allocation.
	MaxBytes int64

	// AllowHost, when non-nil, reports whether a host may be fetched from.
	// It runs before the request, and it is an allowlist of *names*.
	//
	// It is not an address check and must not be relied on as one. A name it
	// admits may resolve to loopback, link-local or a private range, and a
	// name checked here may resolve to something else by the time the
	// connection is made — DNS rebinding defeats a name check by
	// construction. Returning true for "schemas.example.com" says the name is
	// permitted, not that the connection goes anywhere trustworthy.
	//
	// The addresses themselves are refused by the dialler, at the point they
	// are known — see AllowPrivateAddresses. Use AllowHost to narrow the
	// namespace and the dialler to enforce the boundary.
	AllowHost func(host string) bool

	// AllowPrivateAddresses re-permits the address ranges that are refused by
	// default: loopback, link-local (including 169.254.169.254, the cloud
	// instance metadata address), unique-local, and the RFC1918 private
	// ranges. It is off by default, so the zero value refuses them.
	//
	// The check runs in the dialler, against the IP the connection is
	// actually being made to rather than the name written in the document.
	// That placement is what makes it a guarantee: a name resolves to an
	// address only at dial time, so checking the name earlier leaves a
	// rebinding window in which the name is re-resolved to a refused address
	// after it was approved. Checking the resolved address closes it, and it
	// covers redirects and every retry for free, because each connection is
	// dialled through the same place.
	//
	// Turn it on for a caller that genuinely fetches schemas from a private
	// network — an internal mirror, or a test server on loopback. It widens
	// what the process can be made to reach by whoever writes the schema, so
	// it is opt-in rather than a default.
	AllowPrivateAddresses bool

	// Files handles locations that are not remote. When nil, a FileResolver
	// with no root is used.
	Files Resolver
}

type ICPath struct {
	// Source is the expression as written, kept for diagnostics.
	Source string
	// Alternatives are the "|"-separated branches.
	Alternatives []ICPathAlternative
}

type ICPathAlternative struct {
	// DescendantOrSelf records a leading ".//".
	DescendantOrSelf bool
	// Steps are the child-axis steps.
	Steps []ICStep
	// Attribute is the trailing "@name" step, which only a field may have
	// and only in final position.
	Attribute *xdm.QName

	// AttributeWildcard records that the attribute step was written "@*"
	// or "@prefix:*". Such a field is grammatical; whether it selects
	// exactly one node is decided per instance document, not here.
	AttributeWildcard bool
}

type ICStep struct {
	// Wildcard records "*", which matches any element name.
	Wildcard bool
	// Name is the element name when Wildcard is false.
	Name xdm.QName
}

type IdentityConstraint struct {
	Name     xdm.QName
	Kind     IdentityConstraintKind
	Selector *ICPath
	Fields   []*ICPath

	// Refer is the key or unique that a keyref points at. It is nil for
	// ICKey and ICUnique.
	Refer *IdentityConstraint
	// contains filtered or unexported fields
}

type IdentityConstraintKind uint8

type InstanceLocationPolicy struct {
	// AllowNamespace reports whether the instance may supply a location for
	// a namespace. It is consulted for every entry, and an entry it refuses
	// is ignored rather than being an error: the location is a hint, and a
	// hint this processor declines to take is not a fault in the document.
	//
	// A nil AllowNamespace allows nothing, so the zero value of this type
	// is inert. That is deliberate — a policy that did nothing but exist
	// should not be the one that opens the door.
	AllowNamespace func(namespace string) bool

	// AllowNoNamespace permits xsi:noNamespaceSchemaLocation, which names a
	// document for the absent namespace. It is separate from
	// AllowNamespace because "" is not a namespace a caller thinks about,
	// and folding it in would grant it by accident.
	AllowNoNamespace bool

	// Resolver fetches the documents the instance names. When nil the
	// schema's own resolver is used — but note that a FileResolver will
	// read whatever path the instance gives it, relative to the base, so a
	// caller following untrusted documents should supply a MapResolver or
	// an HTTPResolver with AllowHost.
	Resolver Resolver

	// MaxDocuments bounds how many documents the instance may pull in.
	// Zero means DefaultMaxDocuments.
	MaxDocuments int
}

type MapResolver struct {
	// ByLocation maps a schemaLocation to schema source.
	ByLocation map[string]string
	// ByNamespace maps a target namespace to schema source, used when an
	// import gives a namespace but no location.
	ByNamespace map[string]string
	// contains filtered or unexported fields
}

type ModelGroup struct {
	Compositor Compositor
	Particles  []*Particle
}

type ModelGroupDef struct {
	Name  xdm.QName
	Group *ModelGroup
}

type NamespaceConstraintKind uint8

type NotationDecl struct {
	Name   xdm.QName
	Public string
	System string
}

type OpenContent struct {
	Mode     OpenContentMode
	Wildcard *Wildcard
}

type OpenContentMode uint8

type Options struct {
	// Resolver locates the documents named by include, import and
	// redefine. When nil, a FileResolver with no root is used, so a schema
	// can include a file beside it but nothing is fetched over the network.
	//
	// To follow remote locations, set an HTTPResolver. That is off by
	// default because it hands control of what this process fetches to
	// whoever wrote the schema.
	Resolver Resolver

	// MaxDocuments bounds how many documents one assembly may read. A
	// schema that includes a generator of schemas would otherwise be a way
	// to spend the process. Zero means DefaultMaxDocuments.
	MaxDocuments int

	// MaxContentModelPositions bounds the number of positions in any one
	// compiled content model. A model that exceeds it is not compiled, and
	// the schema is refused with an error wrapping xdm.ErrResourceLimit —
	// the constraints on that model are then undecided, and an undecided
	// normative constraint is never reported as satisfied.
	//
	// It is the memory bound on one model: cost is flat at roughly 400
	// bytes per position, so the default of 8192 caps one model at about
	// 3.3 MB. Raising it AUTHORISES PROPORTIONAL MEMORY — a host that sets
	// 2^23 is accepting that a 2.7 KB schema may allocate 3.4 GB. See
	// DefaultMaxContentModelPositions for the measurements.
	//
	// Zero means DefaultMaxContentModelPositions.
	MaxContentModelPositions int

	// Version selects XSD 1.0 or 1.1. The zero value is 1.0, because a
	// schema written for 1.0 must not acquire 1.1's relaxations by
	// accident — 1.1 changes which schemas are legal, not only which
	// documents are.
	Version Version

	// XPathVersion selects the version of XPath the 1.1 assertions and
	// conditional type alternatives in this schema are written in.
	//
	// The zero value is XPath 2.0, which is what the specification requires:
	// XSD 1.1 defines assertions against a subset of XPath 2.0, so a schema
	// using a 3.0 construct is not portable and must not quietly work here.
	//
	// Raising it is for a host that controls its own schemas and wants the
	// later function library in an assertion — fn:parse-json or a map, say —
	// accepting that the schema is then this engine's rather than every
	// engine's. It does not affect anything but assertions and alternatives:
	// nothing else in a schema is XPath.
	XPathVersion xpath.Version

	// ParseOptions are passed to the XML parser for each schema document.
	// The zero value refuses a DOCTYPE, which is the right default: a
	// schema has no use for one and it is the entry point for entity
	// expansion attacks.
	ParseOptions xdm.ParseOptions

	// LaxUPA relaxes Unique Particle Attribution, which loading enforces,
	// to the reading Saxon and XSV take: two competing particles are
	// tolerated when both are references to the same element declaration.
	//
	// Off by default because the strict reading is the conforming one —
	// erratum E1-29 is explicit that particles at different points are
	// distinct "even if they originated from the same named model group".
	// It exists because schemas written against those processors do rely
	// on the permissive rule, and such a schema would otherwise be
	// unloadable rather than merely non-conforming.
	LaxUPA bool
}

type ParseError struct {
	// Code is the spec's error code, such as "src-element.1", or empty if
	// the fault has no code in the spec.
	Code string
	// Message describes the fault.
	Message string
	// Line and Column locate it, when the node carried a position.
	Line, Column int
	// Document names the schema document the fault is in, when that is not
	// the document the caller passed to Load. A fault in the caller's own
	// document leaves this empty: they are already looking at it, and
	// repeating its name on every line would be noise. It is set for a
	// document reached through <xs:include>, <xs:import>, <xs:redefine> or
	// <xs:override> — the case where the message otherwise describes a
	// fault in a file the reader has no reason to suspect.
	Document string
	// contains filtered or unexported fields
}

type Particle struct {
	MinOccurs int
	// MaxOccurs is Unbounded for maxOccurs="unbounded".
	MaxOccurs int
	Term      Term
	// contains filtered or unexported fields
}

type Pattern struct {
	// Source is the pattern as written, kept for diagnostics and for the
	// schema-component constraints that compare patterns textually.
	Source string
	// contains filtered or unexported fields
}

type ProcessContents uint8

type Resolver interface {
	// Resolve returns the contents of the schema document at location,
	// which is resolved relative to base when it is not absolute. The
	// namespace is the one the reference declared, or empty for an include.
	//
	// Returning a nil reader and a nil error means "no schema document" —
	// which for an include is not an error (§4.2.1), and the caller
	// distinguishes the cases.
	Resolve(namespace, location, base string) (io.ReadCloser, string, error)
}

type Schema struct {
	// Elements and the maps beside it are the global components, keyed by
	// expanded name. Local declarations are reachable only through the type
	// that contains them and are not indexed here.
	Elements        map[xdm.QName]*ElementDecl
	Attributes      map[xdm.QName]*AttributeDecl
	Types           map[xdm.QName]Type
	AttributeGroups map[xdm.QName]*AttributeGroupDef
	ModelGroups     map[xdm.QName]*ModelGroupDef
	Notations       map[xdm.QName]*NotationDecl

	// Version selects XSD 1.0 or 1.1 behaviour. It governs whether the 1.1
	// features a document may use — assertions, conditional type
	// assignment, open content — are honoured; they are always *parsed*,
	// because a schema that uses them is not made valid by pretending they
	// are absent.
	Version Version
	// contains filtered or unexported fields
}

type SchemaErrors struct {
	Errors []error
}

type Scope uint8

type SequenceMatcher struct {
	// contains filtered or unexported fields
}

type SimpleType struct {
	Name     xdm.QName
	Base     Type
	FinalSet DerivationSet
	Variety  Variety

	// Primitive is the primitive type this one erases to, for atomic
	// varieties. A primitive type is its own primitive.
	Primitive *SimpleType

	// ItemType is {item type definition}, meaningful only for VarietyList.
	ItemType *SimpleType

	// MemberTypes is {member type definitions}, meaningful only for
	// VarietyUnion. Order is significant: validation takes the *first*
	// member that accepts the value, not the best or longest match.
	MemberTypes []*SimpleType

	// Facets are the constraining facets applied at this derivation step.
	// A value must satisfy these and every ancestor's; see facet.go for how
	// they combine, which is not simply union.
	Facets *FacetSet
	// contains filtered or unexported fields
}

type Term interface {
	Component
	// contains filtered or unexported methods
}

type Timezone uint8

type Type interface {
	Component

	// TypeName is the {name} and {target namespace}. An anonymous type has
	// the zero QName, which is why this cannot simply be a field access.
	TypeName() xdm.QName

	// BaseType is {base type definition}. For xs:anyType this is xs:anyType
	// itself — a deliberate self-loop in the spec, so any walk up the base
	// chain must test for it rather than for nil.
	BaseType() Type

	// Final is {final}: the derivations this type forbids.
	Final() DerivationSet
	// contains filtered or unexported methods
}

type TypeAlternative struct {
	// Test is the compiled condition, or nil for the default alternative.
	Test *xpath.Compiled
	// Source is the condition as written.
	Source string
	// Type is the type to use when the test matches.
	Type Type
	// contains filtered or unexported fields
}

type ValidateOptions struct {
	// MaxErrors stops validation once this many failures are found. Zero
	// means DefaultMaxErrors; a negative value means no limit, as it does
	// for dtd.Options.MaxErrors. A document that is wrong in every element
	// would otherwise produce an error for each, which helps nobody and
	// costs memory proportional to the document.
	MaxErrors int

	// Annotate writes the type of each validated node into its
	// TypeAnnotation, producing the part of the PSVI that the XPath and
	// XSLT layers consume. It is off by default because it mutates the
	// tree the caller passed in.
	Annotate bool

	// SkipIDConstraints suppresses "Validation Root Valid (ID/IDREF)"
	// (§3.3.4 clause 2) — the check that ID values are unique and that
	// every IDREF resolves.
	//
	// That rule is scoped to the *document*, not to the subtree being
	// assessed, so a caller assessing a bare element has no document for it
	// to be true of. XSLT 2.0 §19.2.1.3 says so outright: when validating a
	// constructed element, "the validation rule 'Validation Root Valid
	// (ID/IDREF)' is not applied ... validation will not fail if there are
	// non-unique ID values or dangling IDREF values in the subtree being
	// validated". The same section applies it again for a document node.
	//
	// Off by default: validating a parsed document is the ordinary case and
	// there the rule does apply.
	SkipIDConstraints bool

	// MaxDepth bounds how deep validation will recurse. Zero means
	// DefaultMaxDepth; a negative value means no limit, which gives up the
	// clean error for a fatal stack overflow that recover() cannot catch.
	//
	// This is not the parser's limit. A tree can be built by a transform
	// rather than parsed, and a caller who raises xdm.ParseOptions.MaxDepth
	// to accept a deep document has not thereby agreed to let the validator
	// recurse that far — see validateElement for why exceeding it is fatal
	// rather than recoverable.
	MaxDepth int
}

type ValidationError struct {
	// Code is the spec's error code, such as "cvc-complex-type.2.4".
	Code string
	// Message describes the failure.
	Message string
	// Path is the location in the instance, as an element path.
	Path string
	// Line and Column locate it when the node carried a position.
	Line, Column int
	// Err is a sentinel this failure also is, for callers that need to
	// branch on the KIND of failure rather than on its code.
	//
	// It exists for xdm.ErrResourceLimit. A depth refusal is reported with
	// a cvc- code because that is the only vocabulary a validation result
	// has, and cvc-elt.1 then says "this document is invalid" about a
	// document that was never assessed. The code is kept -- callers and
	// the conformance suites read it -- and the sentinel carried here
	// alongside, so errors.Is can tell a refusal from a verdict. Nil on
	// every ordinary failure, which is all of them but this one.
	Err error
}

type ValidationErrors struct {
	Errors []*ValidationError
}

type ValueConstraint struct {
	// Fixed distinguishes fixed="v" from default="v".
	Fixed bool
	// Lexical is the value as written in the schema document. It is stored
	// unparsed because the type it must be parsed against is not always
	// known when the schema is read.
	Lexical string
	// Value is the parsed form, filled in once the type is resolved.
	Value *xdm.Atomic
}

type Variety uint8

type Version uint8

type WhiteSpace uint8

type Wildcard struct {
	Kind            NamespaceConstraintKind
	ProcessContents ProcessContents

	// Namespace is the excluded namespace for NSNot, or the permitted set
	// for NSEnumerated. It is unused for NSAny.
	Namespace []string

	// ExcludesAbsent records whether the absent namespace is excluded by an
	// NSNot constraint.
	//
	// The two spellings differ here and the difference is easy to miss.
	// XSD 1.0's ##other excludes unqualified names unconditionally —
	// clause 2.3 of Wildcard allows Namespace Name — whereas XSD 1.1's
	// notNamespace excludes only what it lists, so an unqualified name is
	// permitted unless ##local appears. Applying ##other's rule to
	// notNamespace rejects every unqualified attribute the wildcard was
	// written to admit.
	ExcludesAbsent bool

	// DisallowedNames is XSD 1.1's {disallowed names} (§3.10.1): specific
	// expanded names the wildcard refuses even though their namespace is
	// admitted. It is the notQName attribute, and it is what lets a schema
	// say "anything from this namespace except these".
	//
	// The namespace constraint and this set are independent tests: a name
	// matches the wildcard only if the namespace admits it *and* it is not
	// disallowed. That ordering matters because notQName may name a
	// namespace the constraint would otherwise let through, which is the
	// only reason to write it.
	DisallowedNames []xdm.QName

	// DisallowDefined is ##defined: refuse any name for which the schema
	// has a global declaration of the matching kind. It is how a schema
	// writes "anything the schema does not already know about", which is
	// the useful form of an extension wildcard — one that cannot silently
	// shadow a declared element.
	DisallowDefined bool

	// DisallowDefinedSibling is ##definedSibling: refuse any name declared
	// by some other particle in the same content model. Unlike ##defined it
	// is local, and it applies to elements only — an attribute wildcard has
	// no siblings in the sense the keyword means, and the schema for
	// schemas does not permit it there.
	DisallowDefinedSibling bool
	// contains filtered or unexported fields
}