libxml_rs/xml/relaxng/

mod.rs

//! RELAX NG implementation (§27, §85 Phase 6).
//!
//! RELAX NG schema validation. Upstream libxml2 RELAX NG support is known to be
//! incomplete/non-conformant in places — parity follows the oracle.
//!
//! Phase 6: Complete — RELAX NG grammar parsing, document validation,
//! and C ABI exports are implemented.
//!
//! # UPSTREAM-PARITY
//!
//! This module implements a functional RELAX NG validator following the
//! upstream libxml2 observable behavior. The implementation covers:
//!
//! - Full XML syntax for RELAX NG grammar definitions
//! - Pattern-based validation of XML documents
//! - Name classes for element/attribute matching
//! - Basic datatype checking for `<data>` and `<value>` patterns
//! - Reference resolution for `<ref>` and `<define>` patterns
//! - Include support for external grammars (basic)
//! - Compact syntax (basic support)
//!
//! Deviations from the OASIS RELAX NG specification that match the upstream
//! libxml2 behavior are intentional.
//!
//! # Upstream contract
//!
//! Mirrors upstream relaxng.c (SRC-LIBXML2-2.15.0-RELAXNG-C, oracle tree
//! `oracle/historical/src/libxml2-2.15.0/relaxng.c`): xmlRelaxNG parse/valid
//! contexts, pattern compilation, name classes and the datatype hooks. Parity
//! target: the system libxml2 2.15.3 oracle — NOT the OASIS RELAX NG
//! specification where the two differ.
//!
//! # Conceptual behavior
//!
//! RELAX NG schema validation: grammar parsing, pattern-based document
//! validation, name classes for element/attribute matching, datatype checks
//! for data/value patterns, ref/define resolution, include support and basic
//! compact syntax. Upstream libxml2 RELAX NG support is known to be
//! incomplete/non-conformant in places; the module reproduces the oracle
//! behavior, not the standard.
//!
//! # Ownership & safety invariants
//!
//! Ownership: schemas own their pattern tree (xmlRelaxNGFree); parser and
//! valid contexts own their state (xmlRelaxNGFreeParserCtxt /
//! xmlRelaxNGFreeValidCtxt); the validated document is borrowed. SAFETY:
//! pattern references are resolved with cycle guards so recursive grammars
//! cannot loop the validator.
//!
//! # Historical quirks & epochs
//!
//! RELAX NG landed in the 2.6 validation-era expansion (2003-2004,
//! atlas/HISTORY.md 1.5); xmlRelaxNGInitTypes is empty after lazy init and
//! xmlRelaxNGCleanupTypes is a documented no-op (R-000138 no-op set, matching
//! upstream empty bodies).
//!
//! # Deliberate oddities
//!
//! Deliberate oddities: deviations from the OASIS specification that match
//! upstream libxml2 behavior are intentional and kept; the C-API surface
//! (xmlRelaxNGNewParserCtxt, xmlRelaxNGNewMemParserCtxt, xmlRelaxNGFree,
//! xmlRelaxNGNewValidCtxt, ...) is exported with upstream signatures.
//!
//! # Proving courts
//!
//! RELAXNG court family; the data-ABI header-compile court compiles
//! every relaxng.h declaration against the DSO; dso-loader 25/25; `cargo test
//! --lib` exercises the validator.
//!
//! # Tempting simplifications that would break parity
//!
//! The tempting simplification is implementing full OASIS RELAX NG
//! conformance — it would diverge from upstream libxml2 known non-conformance
//! and break byte-identical validation output. Do not drop the compact-syntax
//! handling: upstream accepts it and the oracle surface includes it.

#![allow(
    missing_docs,
    non_snake_case,
    non_camel_case_types,
    non_upper_case_globals
)]

use core::ffi::c_void;
use core::ptr;
use std::os::raw::{c_char, c_int};

use crate::abi::structs::*;
use crate::abi::types::xmlElementType::*;

// ═══════════════════════════════════════════════════════════════════════════════
// RELAX NG Name Class
// ═══════════════════════════════════════════════════════════════════════════════

/// RELAX NG name class — determines which element/attribute names a pattern matches.
///
/// # UPSTREAM-PARITY
///
/// libxml2 defines name classes in `include/relaxng.h` as part of the
/// pattern structure. This enum provides the same semantics.
#[derive(Debug, Clone, PartialEq)]
pub enum RelaxNgNameClass {
    /// Match a specific name (`<name>`)
    Name(String),
    /// Match any name (`<anyName>`)
    AnyName,
    /// Match any name in a namespace (`<nsName>`)
    NsName(String),
    /// Choice between multiple name classes (`<choice>`)
    Choice(Vec<RelaxNgNameClass>),
    /// Exclude a name class (used with anyName/nsName)
    Except(Box<RelaxNgNameClass>, Box<RelaxNgNameClass>),
}

impl RelaxNgNameClass {
    /// Check if a given qualified name matches this name class.
    pub fn matches(&self, name: &str, ns_uri: Option<&str>) -> bool {
        match self {
            RelaxNgNameClass::Name(n) => name == n.as_str(),
            RelaxNgNameClass::AnyName => true,
            RelaxNgNameClass::NsName(ns) => {
                if let Some(uri) = ns_uri {
                    uri == ns.as_str()
                } else {
                    false
                }
            }
            RelaxNgNameClass::Choice(choices) => choices.iter().any(|c| c.matches(name, ns_uri)),
            RelaxNgNameClass::Except(positive, negative) => {
                positive.matches(name, ns_uri) && !negative.matches(name, ns_uri)
            }
        }
    }
}

// ═══════════════════════════════════════════════════════════════════════════════
// RELAX NG Pattern Types
// ═══════════════════════════════════════════════════════════════════════════════

/// RELAX NG pattern type — classification for pattern dispatch.
///
/// # UPSTREAM-PARITY
///
/// Mirrors libxml2's internal pattern type classification.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum RelaxNgPatternType {
    Element,
    Attribute,
    Text,
    Choice,
    Sequence,
    Interleave,
    ZeroOrMore,
    OneOrMore,
    Optional,
    List,
    Group,
    Data,
    Value,
    Ref,
    Define,
    Grammar,
    NotAllowed,
    Empty,
    ExternalRef,
    Include,
    Start,
}

/// A RELAX NG pattern — the core building block of RELAX NG schemas.
///
/// Patterns form a tree structure where composite patterns contain child patterns.
#[derive(Debug, Clone)]
pub struct RelaxNgPattern {
    /// The type of this pattern.
    pub pattern_type: RelaxNgPatternType,
    /// Name class (for element/attribute patterns).
    pub name_class: Option<RelaxNgNameClass>,
    /// Child patterns.
    pub children: Vec<RelaxNgPattern>,
    /// The name for `<ref>` and `<define>` patterns.
    pub name: Option<String>,
    /// The namespace URI for nsName or element/attribute.
    pub ns: Option<String>,
    /// Datatype for `<data>` patterns.
    pub datatype: Option<String>,
    /// Value for `<value>` patterns.
    pub value: Option<String>,
    /// Datatype library (e.g., "" for built-in).
    pub datatype_library: Option<String>,
}

impl RelaxNgPattern {
    /// Create a new pattern with the given type.
    pub const fn new(pattern_type: RelaxNgPatternType) -> Self {
        Self {
            pattern_type,
            name_class: None,
            children: Vec::new(),
            name: None,
            ns: None,
            datatype: None,
            value: None,
            datatype_library: None,
        }
    }

    /// Create a simple element pattern with a name.
    pub fn element(name: &str) -> Self {
        let mut p = Self::new(RelaxNgPatternType::Element);
        p.name_class = Some(RelaxNgNameClass::Name(name.to_string()));
        p
    }

    /// Create a simple attribute pattern with a name.
    pub fn attribute(name: &str) -> Self {
        let mut p = Self::new(RelaxNgPatternType::Attribute);
        p.name_class = Some(RelaxNgNameClass::Name(name.to_string()));
        p
    }

    /// Create a text pattern.
    pub const fn text() -> Self {
        Self::new(RelaxNgPatternType::Text)
    }

    /// Create an empty pattern.
    pub const fn empty() -> Self {
        Self::new(RelaxNgPatternType::Empty)
    }

    /// Create a notAllowed pattern.
    pub const fn not_allowed() -> Self {
        Self::new(RelaxNgPatternType::NotAllowed)
    }
}

// ═══════════════════════════════════════════════════════════════════════════════
// RELAX NG Define (named pattern definition)
// ═══════════════════════════════════════════════════════════════════════════════

/// A named pattern definition (`<define>`).
#[derive(Debug, Clone)]
pub struct RelaxNgDefine {
    /// The name of this definition.
    pub name: String,
    /// The pattern body.
    pub pattern: RelaxNgPattern,
}

// ═══════════════════════════════════════════════════════════════════════════════
// RELAX NG Grammar
// ═══════════════════════════════════════════════════════════════════════════════

/// A RELAX NG grammar — the top-level container for pattern definitions.
///
/// Contains named pattern definitions and an optional start pattern.
#[derive(Debug, Clone)]
pub struct RelaxNgGrammar {
    /// Named pattern definitions (`<define>` elements).
    pub defines: Vec<RelaxNgDefine>,
    /// The start pattern (`<start>`).
    pub start: Option<RelaxNgPattern>,
    /// Included grammars (from `<include>`).
    pub includes: Vec<RelaxNgGrammar>,
}

impl RelaxNgGrammar {
    pub const fn new() -> Self {
        Self {
            defines: Vec::new(),
            start: None,
            includes: Vec::new(),
        }
    }

    /// Look up a named pattern definition.
    pub fn lookup(&self, name: &str) -> Option<&RelaxNgPattern> {
        for def in &self.defines {
            if def.name == name {
                return Some(&def.pattern);
            }
        }
        // Also search includes
        for inc in &self.includes {
            if let Some(p) = inc.lookup(name) {
                return Some(p);
            }
        }
        None
    }
}

impl Default for RelaxNgGrammar {
    fn default() -> Self {
        Self::new()
    }
}

// ═══════════════════════════════════════════════════════════════════════════════
// RELAX NG Schema
// ═══════════════════════════════════════════════════════════════════════════════

/// A compiled RELAX NG schema.
///
/// Wraps a grammar and tracks any errors encountered during parsing.
#[derive(Debug, Clone)]
pub struct RelaxNgSchema {
    /// The top-level grammar.
    pub grammar: RelaxNgGrammar,
    /// Errors encountered during parsing.
    pub errors: Vec<String>,
    /// Whether parsing hit an unrecoverable grammar error. Upstream
    /// `xmlRelaxNGParse` aborts (returns NULL after reporting the recorded
    /// diagnostics through the parser error callbacks) when a pattern is
    /// structurally invalid — e.g. `xmlRelaxNGParseElement` on an `<element>`
    /// with no content — while plain warnings keep the schema usable.
    pub fatal: bool,
}

impl RelaxNgSchema {
    pub const fn new() -> Self {
        Self {
            grammar: RelaxNgGrammar::new(),
            errors: Vec::new(),
            fatal: false,
        }
    }
}

impl Default for RelaxNgSchema {
    fn default() -> Self {
        Self::new()
    }
}

// ═══════════════════════════════════════════════════════════════════════════════
// RELAX NG Validation Context
// ═══════════════════════════════════════════════════════════════════════════════

/// Validation context for RELAX NG schema validation.
///
/// Tracks errors, current element path, and pattern recursion depth
/// during validation of an XML document against a RELAX NG schema.
/// Mirrors libxml2's `xmlRelaxNGValidCtxt`.
#[derive(Debug)]
pub struct RelaxNgValidCtxt {
    /// The schema being validated against.
    pub schema: Option<RelaxNgSchema>,
    /// Accumulated validation errors.
    pub errors: Vec<String>,
    /// Number of validation errors.
    pub nb_errors: i32,
    /// Current element path (stack of element names).
    pub path: Vec<String>,
    /// Maximum recursion depth for pattern matching.
    pub depth_max: i32,
    /// Current recursion depth.
    pub depth: i32,
}

impl RelaxNgValidCtxt {
    pub const fn new() -> Self {
        Self {
            schema: None,
            errors: Vec::new(),
            nb_errors: 0,
            path: Vec::new(),
            depth_max: 256,
            depth: 0,
        }
    }

    /// Record a validation error.
    pub fn record_error(&mut self, msg: String) {
        self.errors.push(msg);
        self.nb_errors += 1;
    }

    /// Get the current path as a string (e.g., "/root/child").
    pub fn current_path(&self) -> String {
        if self.path.is_empty() {
            "/".to_string()
        } else {
            format!("/{}", self.path.join("/"))
        }
    }
}

impl Default for RelaxNgValidCtxt {
    fn default() -> Self {
        Self::new()
    }
}

// ═══════════════════════════════════════════════════════════════════════════════
// Internal helpers for RELAX NG parsing
// ═══════════════════════════════════════════════════════════════════════════════

/// Get the local name of an element node (strip namespace prefix).
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
unsafe fn get_local_name(node: *mut _xmlNode) -> String {
    if node.is_null() {
        return String::new();
    }
    unsafe {
        let name = (*node).name;
        if name.is_null() {
            return String::new();
        }
        let mut len = 0;
        while *name.add(len) != 0 {
            len += 1;
        }
        let slice = std::slice::from_raw_parts(name, len);
        if let Ok(s) = std::str::from_utf8(slice) {
            if let Some(pos) = s.find(':') {
                s[pos + 1..].to_string()
            } else {
                s.to_string()
            }
        } else {
            String::new()
        }
    }
}

/// Get the text content of an xmlNode (recursively collects text children).
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
unsafe fn get_node_text(node: *mut _xmlNode) -> String {
    if node.is_null() {
        return String::new();
    }
    let mut result = String::new();
    unsafe {
        let mut child = (*node).children;
        while !child.is_null() {
            if ((*child).type_ == XML_TEXT_NODE as c_int
                || (*child).type_ == XML_CDATA_SECTION_NODE as c_int)
                && !(*child).content.is_null()
            {
                let content = (*child).content;
                let mut len = 0;
                while *content.add(len) != 0 {
                    len += 1;
                }
                let slice = std::slice::from_raw_parts(content, len);
                result.push_str(&String::from_utf8_lossy(slice));
            }
            child = (*child).next;
        }
    }
    result
}

/// Get the qualified name of a node (with namespace prefix if available).
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
unsafe fn get_node_qname(node: *mut _xmlNode) -> String {
    if node.is_null() {
        return String::new();
    }
    unsafe {
        let ns = (*node).ns;
        let prefix = if !ns.is_null() && !(*ns).prefix.is_null() {
            let mut len = 0;
            while *(*ns).prefix.add(len) != 0 {
                len += 1;
            }
            let slice = std::slice::from_raw_parts((*ns).prefix, len);
            if let Ok(s) = std::str::from_utf8(slice) {
                format!("{}:", s)
            } else {
                String::new()
            }
        } else {
            String::new()
        };

        let name = (*node).name;
        if name.is_null() {
            return String::new();
        }
        let mut len = 0;
        while *name.add(len) != 0 {
            len += 1;
        }
        let slice = std::slice::from_raw_parts(name, len);
        if let Ok(s) = std::str::from_utf8(slice) {
            format!("{}{}", prefix, s)
        } else {
            String::new()
        }
    }
}

/// Get the namespace URI of a node.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
unsafe fn get_node_ns_uri(node: *mut _xmlNode) -> Option<String> {
    if node.is_null() {
        return None;
    }
    unsafe {
        let ns = (*node).ns;
        if ns.is_null() || (*ns).href.is_null() {
            return None;
        }
        let href = (*ns).href;
        let mut len = 0;
        while *href.add(len) != 0 {
            len += 1;
        }
        let slice = std::slice::from_raw_parts(href, len);
        if let Ok(s) = std::str::from_utf8(slice) {
            Some(s.to_string())
        } else {
            None
        }
    }
}

/// Get an attribute value from an xmlNode.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
unsafe fn get_attr(node: *mut _xmlNode, name: &str) -> Option<String> {
    if node.is_null() {
        return None;
    }
    unsafe {
        let mut prop = (*node).properties;
        while !prop.is_null() {
            let prop_name = (*prop).name;
            if !prop_name.is_null() {
                let mut len = 0;
                while *prop_name.add(len) != 0 {
                    len += 1;
                }
                let slice = std::slice::from_raw_parts(prop_name, len);
                if let Ok(s) = std::str::from_utf8(slice) {
                    if s == name {
                        return Some(get_node_text(prop as *mut _xmlNode));
                    }
                }
            }
            prop = (*prop).next;
        }
    }
    None
}

/// Check if an xmlNode is an element with a given local name.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
#[allow(dead_code)]
unsafe fn node_is(node: *mut _xmlNode, local_name: &str) -> bool {
    if node.is_null() {
        return false;
    }
    unsafe {
        let name = (*node).name;
        if name.is_null() {
            return false;
        }
        let mut len = 0;
        while *name.add(len) != 0 {
            len += 1;
        }
        let slice = std::slice::from_raw_parts(name, len);
        if let Ok(s) = std::str::from_utf8(slice) {
            let local = if let Some(pos) = s.find(':') {
                &s[pos + 1..]
            } else {
                s
            };
            return local == local_name;
        }
    }
    false
}

// ═══════════════════════════════════════════════════════════════════════════════
// RELAX NG Schema Parsing
// ═══════════════════════════════════════════════════════════════════════════════

/// Parse a RELAX NG schema from an XML string.
///
/// # UPSTREAM-PARITY
///
/// Equivalent to `xmlRelaxNGParse` in libxml2 when given a parser context
/// created from a memory buffer.
///
/// # Safety
///
/// - `xml_doc` must be a valid `&str`; its bytes stay readable for the
///   duration of the `xmlReadMemory` call.
/// - The document pointer returned by `xmlReadMemory` is NULL-checked before
///   being passed to `rng_parse_doc`, and is freed exactly once with
///   `xmlFreeDoc`.
///
/// Returns the parsed schema, or an error message on failure.
pub fn rng_parse(xml_doc: &str) -> Result<RelaxNgSchema, String> {
    let doc_ptr = unsafe {
        crate::abi::exports_xml2::xmlReadMemory(
            xml_doc.as_ptr() as *const c_char,
            xml_doc.len() as c_int,
            c"schema.rng".as_ptr() as *const c_char,
            ptr::null(),
            0,
        )
    };

    if doc_ptr.is_null() {
        return Err("Failed to parse RELAX NG schema XML document".to_string());
    }

    let result = unsafe { rng_parse_doc(doc_ptr) };
    unsafe {
        crate::abi::exports_xml2::xmlFreeDoc(doc_ptr);
    }
    result
}

/// Get the URL of a parsed document (its `URL` field), as a string.
///
/// # SAFETY
///
/// - `doc` must be a valid pointer to an _xmlDoc or NULL.
unsafe fn doc_url(doc: *mut _xmlDoc) -> Option<String> {
    if doc.is_null() {
        return None;
    }
    unsafe {
        let url = (*doc).URL;
        if url.is_null() {
            return None;
        }
        let mut len = 0;
        while *url.add(len) != 0 {
            len += 1;
        }
        let slice = std::slice::from_raw_parts(url, len);
        Some(String::from_utf8_lossy(slice).to_string())
    }
}

/// Resolve a (possibly relative) RELAX NG `href` against the base URL of the
/// grammar that references it. Mirrors upstream relaxng.c (include /
/// externalRef handling): `base = xmlNodeGetBase(cur->doc, cur);
/// URL = xmlBuildURI(href, base);` — a bare relative name resolves against
/// the including schema's own location, not the process CWD.
///
/// # SAFETY
///
/// - `doc` must be a valid pointer to an _xmlDoc or NULL.
unsafe fn resolve_rng_href(doc: *mut _xmlDoc, href: &str) -> String {
    let Some(base) = (unsafe { doc_url(doc) }) else {
        // Memory-parse (or URL-less): keep the raw href (relative names then
        // resolve against the CWD, matching upstream's NULL base).
        return href.to_string();
    };
    if base.is_empty() {
        return href.to_string();
    }
    let Ok(base_c) = std::ffi::CString::new(base.as_str()) else {
        return href.to_string();
    };
    let Ok(href_c) = std::ffi::CString::new(href) else {
        return href.to_string();
    };
    let resolved = crate::abi::exports_uri::xmlBuildURI(href_c.as_ptr(), base_c.as_ptr());
    if resolved.is_null() {
        href.to_string()
    } else {
        // xmlBuildURI returns an xmlChar* string (not a doc); convert bytes.
        unsafe {
            let mut len = 0;
            while *resolved.add(len) != 0 {
                len += 1;
            }
            let slice = std::slice::from_raw_parts(resolved, len);
            let s = String::from_utf8_lossy(slice).to_string();
            crate::abi::allocator::xmlFreeImpl(resolved as *mut core::ffi::c_void);
            s
        }
    }
}

/// Parse a RELAX NG schema from a document.
///
/// # SAFETY
///
/// - `doc` must be a valid pointer to an _xmlDoc representing a RELAX NG schema.
unsafe fn rng_parse_doc(doc: *mut _xmlDoc) -> Result<RelaxNgSchema, String> {
    unsafe {
        let root = (*doc).children;
        if root.is_null() {
            return Err("RELAX NG document has no root element".to_string());
        }

        // Find the root element (skip any non-element nodes like comments)
        let mut root_elem = root;
        while !root_elem.is_null() && (*root_elem).type_ != XML_ELEMENT_NODE as c_int {
            root_elem = (*root_elem).next;
        }

        if root_elem.is_null() {
            return Err("RELAX NG document has no root element".to_string());
        }

        let base = unsafe { doc_url(doc) };
        let local_name = get_local_name(root_elem);
        let mut schema = RelaxNgSchema::new();

        match local_name.as_str() {
            "grammar" => {
                // Top-level grammar
                schema.grammar = rng_parse_grammar_node(root_elem, &mut schema, base.as_deref());
                Ok(schema)
            }
            "element" | "attribute" | "text" | "choice" | "sequence" | "interleave"
            | "zeroOrMore" | "oneOrMore" | "optional" | "list" | "group" | "data" | "value"
            | "ref" | "notAllowed" | "empty" | "externalRef" | "define" | "start" | "include" => {
                // Single pattern as root (simplified grammar)
                let pattern = rng_parse_pattern(root_elem, &mut schema);
                schema.grammar.start = Some(pattern);
                Ok(schema)
            }
            _ => Err(format!("Unknown RELAX NG root element: '{}'", local_name)),
        }
    }
}

/// Parse a `<grammar>` element.
///
/// `base` is the URL of the document this grammar node lives in; it anchors
/// relative `<include href>` resolution (recursively for nested includes).
///
/// # SAFETY
///
/// - `node` must be a valid pointer to a `<grammar>` element node.
unsafe fn rng_parse_grammar_node(
    node: *mut _xmlNode,
    schema: &mut RelaxNgSchema,
    base: Option<&str>,
) -> RelaxNgGrammar {
    unsafe {
        let mut grammar = RelaxNgGrammar::new();

        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int {
                let local = get_local_name(child);
                match local.as_str() {
                    "define" => {
                        let def = rng_parse_define(child, schema);
                        grammar.defines.push(def);
                    }
                    "start" => {
                        grammar.start = Some(rng_parse_pattern(child, schema));
                    }
                    "include" => {
                        if let Some(inc) = rng_parse_include(child, schema, base) {
                            // UPSTREAM-PARITY (relaxng.c combined grammar): a
                            // grammar with no <start> of its own inherits the
                            // start pattern of an included grammar.
                            if grammar.start.is_none() {
                                grammar.start = inc.start.clone();
                            }
                            grammar.includes.push(inc);
                        }
                    }
                    "div" => {
                        // <div> is a grouping element; recurse into it
                        let sub_grammar = rng_parse_grammar_node(child, schema, base);
                        grammar.defines.extend(sub_grammar.defines);
                        if sub_grammar.start.is_some() {
                            grammar.start = sub_grammar.start;
                        }
                        grammar.includes.extend(sub_grammar.includes);
                    }
                    _ => {
                        // Unknown element inside grammar — treat as pattern error
                        schema
                            .errors
                            .push(format!("Unexpected element '<{}>' in grammar", local));
                    }
                }
            }
            child = (*child).next;
        }

        grammar
    }
}

/// Parse a `<define>` element.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to a `<define>` element node.
unsafe fn rng_parse_define(node: *mut _xmlNode, schema: &mut RelaxNgSchema) -> RelaxNgDefine {
    unsafe {
        let name = get_attr(node, "name").unwrap_or_default();
        let pattern = rng_parse_pattern(node, schema);
        RelaxNgDefine { name, pattern }
    }
}

/// Parse an `<include>` element.
///
/// `base` anchors the relative `href` (the URL of the including grammar's
/// document). Nested includes inside the loaded grammar resolve against the
/// loaded document's own URL.
///
/// UPSTREAM-PARITY (relaxng.c xmlRelaxNGParseInclude): the returned grammar
/// is the INCLUDED document's grammar with the `<include>` element's own
/// children applied — a `<define>` child redefines the same-named definition
/// of the included grammar (or adds a new one), and a `<start>` child
/// replaces the included start pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an `<include>` element node.
unsafe fn rng_parse_include(
    node: *mut _xmlNode,
    schema: &mut RelaxNgSchema,
    base: Option<&str>,
) -> Option<RelaxNgGrammar> {
    unsafe {
        let href = get_attr(node, "href");
        let mut grammar = if let Some(ref url) = href {
            // UPSTREAM-PARITY (relaxng.c): resolve the href against the
            // including document's base (xmlBuildURI) so relative includes
            // resolve next to the schema file, not the process CWD.
            let resolved = match base {
                Some(base) => {
                    let base_c = std::ffi::CString::new(base).ok()?;
                    let href_c = std::ffi::CString::new(url.clone()).ok()?;
                    let r = crate::abi::exports_uri::xmlBuildURI(href_c.as_ptr(), base_c.as_ptr());
                    if r.is_null() {
                        url.clone()
                    } else {
                        let mut len = 0;
                        while *r.add(len) != 0 {
                            len += 1;
                        }
                        let slice = std::slice::from_raw_parts(r, len);
                        let s = String::from_utf8_lossy(slice).to_string();
                        crate::abi::allocator::xmlFreeImpl(r as *mut core::ffi::c_void);
                        s
                    }
                }
                None => url.clone(),
            };
            let url_c = std::ffi::CString::new(resolved.clone()).ok()?;
            let doc = crate::abi::exports_xml2::xmlParseFile(url_c.as_ptr());
            if doc.is_null() {
                return None;
            }
            let mut inc_schema = RelaxNgSchema::new();
            let grammar = rng_parse_grammar_node(
                {
                    let mut root = (*doc).children;
                    while !root.is_null() && (*root).type_ != XML_ELEMENT_NODE as c_int {
                        root = (*root).next;
                    }
                    root
                },
                &mut inc_schema,
                doc_url(doc).as_deref(),
            );
            crate::abi::exports_xml2::xmlFreeDoc(doc);
            grammar
        } else {
            // Inline grammar in include
            let mut inc_schema = RelaxNgSchema::new();
            rng_parse_grammar_node(node, &mut inc_schema, base)
        };

        // Apply the <include> element's own children (redefinitions) to the
        // included grammar. For an href include, `node` is the <include>
        // element itself; for an inline include, the grammar was parsed FROM
        // it already, so re-parsing would double it — only the href case
        // carries both an external grammar and inline redefinitions.
        if href.is_some() {
            let mut ovr_schema = RelaxNgSchema::new();
            let ovr = rng_parse_grammar_node(node, &mut ovr_schema, base);
            for def in ovr.defines {
                if let Some(existing) = grammar.defines.iter_mut().find(|d| d.name == def.name) {
                    *existing = def;
                } else {
                    grammar.defines.push(def);
                }
            }
            if ovr.start.is_some() {
                grammar.start = ovr.start;
            }
            grammar.includes.extend(ovr.includes);
        }
        Some(grammar)
    }
}

/// Parse a pattern from an element node. Dispatches based on element name.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an XML element node.
unsafe fn rng_parse_pattern(node: *mut _xmlNode, schema: &mut RelaxNgSchema) -> RelaxNgPattern {
    unsafe {
        let local = get_local_name(node);

        match local.as_str() {
            "element" => rng_parse_element_pattern(node, schema),
            "attribute" => rng_parse_attribute_pattern(node, schema),
            "text" => RelaxNgPattern::text(),
            "empty" => RelaxNgPattern::empty(),
            "notAllowed" => RelaxNgPattern::not_allowed(),
            "choice" => rng_parse_composite_pattern(node, RelaxNgPatternType::Choice, schema),
            "sequence" => rng_parse_composite_pattern(node, RelaxNgPatternType::Sequence, schema),
            "interleave" => {
                rng_parse_composite_pattern(node, RelaxNgPatternType::Interleave, schema)
            }
            "zeroOrMore" => rng_parse_unary_pattern(node, RelaxNgPatternType::ZeroOrMore, schema),
            "oneOrMore" => rng_parse_unary_pattern(node, RelaxNgPatternType::OneOrMore, schema),
            "optional" => rng_parse_unary_pattern(node, RelaxNgPatternType::Optional, schema),
            "list" => rng_parse_unary_pattern(node, RelaxNgPatternType::List, schema),
            "group" => rng_parse_composite_pattern(node, RelaxNgPatternType::Group, schema),
            "data" => rng_parse_data_pattern(node, schema),
            "value" => rng_parse_value_pattern(node, schema),
            "ref" => rng_parse_ref_pattern(node),
            "externalRef" => rng_parse_external_ref(node, schema),
            "define" | "start" | "grammar" | "include" | "div" => {
                // These are grammar-level elements; return the content pattern
                let mut child = (*node).children;
                let mut result = RelaxNgPattern::empty();
                while !child.is_null() {
                    if (*child).type_ == XML_ELEMENT_NODE as c_int {
                        result = rng_parse_pattern(child, schema);
                        break;
                    }
                    child = (*child).next;
                }
                result
            }
            _ => {
                // Unknown element — treat as empty pattern
                schema
                    .errors
                    .push(format!("Unknown pattern element '<{}>'", local));
                RelaxNgPattern::empty()
            }
        }
    }
}

/// Parse an `<element>` pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an `<element>` element node.
unsafe fn rng_parse_element_pattern(
    node: *mut _xmlNode,
    schema: &mut RelaxNgSchema,
) -> RelaxNgPattern {
    unsafe {
        let mut pattern = RelaxNgPattern::new(RelaxNgPatternType::Element);

        // Parse name class from name attribute or child <name>, <anyName>, <nsName>, <choice>
        let name_attr = get_attr(node, "name");
        pattern.name = name_attr.clone();

        if let Some(ref n) = name_attr {
            pattern.name_class = Some(RelaxNgNameClass::Name(n.clone()));
        }

        // Parse children for name class and content pattern
        let mut child = (*node).children;
        let mut has_content = false;

        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int {
                let child_local = get_local_name(child);

                match child_local.as_str() {
                    "name" => {
                        let text = get_node_text(child);
                        if !text.is_empty() {
                            pattern.name_class =
                                Some(RelaxNgNameClass::Name(text.trim().to_string()));
                        }
                    }
                    "anyName" => {
                        pattern.name_class = Some(rng_parse_any_name(child));
                    }
                    "nsName" => {
                        pattern.name_class = Some(rng_parse_ns_name(child));
                    }
                    "choice" if pattern.name_class.is_none() => {
                        // Name class choice (only before content)
                        pattern.name_class = Some(rng_parse_name_class_choice(child));
                    }
                    _ => {
                        // Content pattern. UPSTREAM-PARITY (relaxng.c
                        // xmlRelaxNGParseElement): multiple content children
                        // form an implicit group — all of them are kept (the
                        // former single-content gate silently dropped
                        // every pattern after the first, e.g. the `<optional>`
                        // in `<element name="root">a<optional>b</optional>`
                        // which then surfaced as a spurious extra element).
                        pattern.children.push(rng_parse_pattern(child, schema));
                        has_content = true;
                    }
                }
            }
            child = (*child).next;
        }

        // UPSTREAM-PARITY (relaxng.c xmlRelaxNGParseElement): an <element>
        // pattern must carry a content pattern; without one parsing aborts
        // with this exact diagnostic (DOMDocument_relaxNGValidateSource_error2
        // pins "xmlRelaxNGParseElement: element has no content").
        if !has_content {
            schema
                .errors
                .push("xmlRelaxNGParseElement: element has no content".to_string());
            schema.fatal = true;
        }

        pattern
    }
}

/// Parse an `<attribute>` pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an `<attribute>` element node.
unsafe fn rng_parse_attribute_pattern(
    node: *mut _xmlNode,
    schema: &mut RelaxNgSchema,
) -> RelaxNgPattern {
    unsafe {
        let mut pattern = RelaxNgPattern::new(RelaxNgPatternType::Attribute);

        // Parse name class
        let name_attr = get_attr(node, "name");
        pattern.name = name_attr.clone();

        if let Some(ref n) = name_attr {
            pattern.name_class = Some(RelaxNgNameClass::Name(n.clone()));
        }

        // Parse children
        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int {
                let child_local = get_local_name(child);

                match child_local.as_str() {
                    "name" => {
                        let text = get_node_text(child);
                        if !text.is_empty() {
                            pattern.name_class =
                                Some(RelaxNgNameClass::Name(text.trim().to_string()));
                        }
                    }
                    "anyName" => {
                        pattern.name_class = Some(rng_parse_any_name(child));
                    }
                    "nsName" => {
                        pattern.name_class = Some(rng_parse_ns_name(child));
                    }
                    "choice" if pattern.name_class.is_none() => {
                        pattern.name_class = Some(rng_parse_name_class_choice(child));
                    }
                    _ => {
                        // Content pattern (text, data, etc.)
                        pattern.children.push(rng_parse_pattern(child, schema));
                    }
                }
            }
            child = (*child).next;
        }

        pattern
    }
}

/// Parse an `<anyName>` element (possibly with `<except>`).
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an `<anyName>` element node.
unsafe fn rng_parse_any_name(node: *mut _xmlNode) -> RelaxNgNameClass {
    unsafe {
        // Check for <except> child
        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int && get_local_name(child) == "except" {
                let except_nc = rng_parse_name_class_content(child);
                return RelaxNgNameClass::Except(
                    Box::new(RelaxNgNameClass::AnyName),
                    Box::new(except_nc),
                );
            }
            child = (*child).next;
        }
        RelaxNgNameClass::AnyName
    }
}

/// Parse an `<nsName>` element (possibly with `<except>`).
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an `<nsName>` element node.
unsafe fn rng_parse_ns_name(node: *mut _xmlNode) -> RelaxNgNameClass {
    unsafe {
        let ns = get_attr(node, "ns").unwrap_or_default();

        // Check for <except> child
        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int && get_local_name(child) == "except" {
                let except_nc = rng_parse_name_class_content(child);
                return RelaxNgNameClass::Except(
                    Box::new(RelaxNgNameClass::NsName(ns)),
                    Box::new(except_nc),
                );
            }
            child = (*child).next;
        }

        RelaxNgNameClass::NsName(ns)
    }
}

/// Parse name class children of a `<choice>` element used as name class.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an element node containing name class children.
unsafe fn rng_parse_name_class_choice(node: *mut _xmlNode) -> RelaxNgNameClass {
    unsafe {
        let mut choices = Vec::new();
        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int {
                choices.push(rng_parse_name_class_item(child));
            }
            child = (*child).next;
        }
        if choices.len() == 1 {
            choices.remove(0)
        } else {
            RelaxNgNameClass::Choice(choices)
        }
    }
}

/// Parse a single name class item from a name class context.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an element node.
unsafe fn rng_parse_name_class_item(node: *mut _xmlNode) -> RelaxNgNameClass {
    unsafe {
        let local = get_local_name(node);
        match local.as_str() {
            "name" => {
                let text = get_node_text(node);
                RelaxNgNameClass::Name(text.trim().to_string())
            }
            "anyName" => rng_parse_any_name(node),
            "nsName" => rng_parse_ns_name(node),
            "choice" => rng_parse_name_class_choice(node),
            _ => {
                // Default: treat as name
                let text = get_node_text(node);
                if text.trim().is_empty() {
                    RelaxNgNameClass::AnyName
                } else {
                    RelaxNgNameClass::Name(text.trim().to_string())
                }
            }
        }
    }
}

/// Parse name class content from an `<except>` or similar element.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an element node.
unsafe fn rng_parse_name_class_content(node: *mut _xmlNode) -> RelaxNgNameClass {
    unsafe {
        let mut names = Vec::new();
        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int {
                names.push(rng_parse_name_class_item(child));
            }
            child = (*child).next;
        }
        if names.is_empty() {
            RelaxNgNameClass::AnyName
        } else if names.len() == 1 {
            names.remove(0)
        } else {
            RelaxNgNameClass::Choice(names)
        }
    }
}

/// Parse a composite pattern (sequence, choice, interleave, group).
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an element node.
unsafe fn rng_parse_composite_pattern(
    node: *mut _xmlNode,
    pattern_type: RelaxNgPatternType,
    schema: &mut RelaxNgSchema,
) -> RelaxNgPattern {
    unsafe {
        let mut pattern = RelaxNgPattern::new(pattern_type);

        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int {
                pattern.children.push(rng_parse_pattern(child, schema));
            }
            child = (*child).next;
        }

        pattern
    }
}

/// Parse a unary pattern (zeroOrMore, oneOrMore, optional, list).
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an element node.
unsafe fn rng_parse_unary_pattern(
    node: *mut _xmlNode,
    pattern_type: RelaxNgPatternType,
    schema: &mut RelaxNgSchema,
) -> RelaxNgPattern {
    unsafe {
        let mut pattern = RelaxNgPattern::new(pattern_type);

        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int {
                pattern.children.push(rng_parse_pattern(child, schema));
                // Only take the first child pattern for unary patterns
                break;
            }
            child = (*child).next;
        }

        pattern
    }
}

/// Parse a `<data>` pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to a `<data>` element node.
unsafe fn rng_parse_data_pattern(
    node: *mut _xmlNode,
    _schema: &mut RelaxNgSchema,
) -> RelaxNgPattern {
    unsafe {
        let mut pattern = RelaxNgPattern::new(RelaxNgPatternType::Data);
        pattern.datatype = get_attr(node, "type");
        pattern.datatype_library = get_attr(node, "datatypeLibrary");

        // For basic support, we store the type and don't process params in detail
        pattern
    }
}

/// Parse a `<value>` pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to a `<value>` element node.
unsafe fn rng_parse_value_pattern(
    node: *mut _xmlNode,
    _schema: &mut RelaxNgSchema,
) -> RelaxNgPattern {
    unsafe {
        let mut pattern = RelaxNgPattern::new(RelaxNgPatternType::Value);
        pattern.datatype = get_attr(node, "type");
        pattern.datatype_library = get_attr(node, "datatypeLibrary");
        pattern.value = Some(get_node_text(node).trim().to_string());

        pattern
    }
}

/// Parse a `<ref>` pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to a `<ref>` element node.
unsafe fn rng_parse_ref_pattern(node: *mut _xmlNode) -> RelaxNgPattern {
    unsafe {
        let mut pattern = RelaxNgPattern::new(RelaxNgPatternType::Ref);
        pattern.name = get_attr(node, "name");
        pattern
    }
}

/// Parse an `<externalRef>` pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an `<externalRef>` element node.
unsafe fn rng_parse_external_ref(
    node: *mut _xmlNode,
    _schema: &mut RelaxNgSchema,
) -> RelaxNgPattern {
    unsafe {
        let mut pattern = RelaxNgPattern::new(RelaxNgPatternType::ExternalRef);
        let href = get_attr(node, "href");
        pattern.name = href;
        pattern
    }
}

// ═══════════════════════════════════════════════════════════════════════════════
// RELAX NG Validation Logic
// ═══════════════════════════════════════════════════════════════════════════════

/// Validate an XML document against a RELAX NG schema.
///
/// Returns `true` if the document is valid.
///
/// # SAFETY
///
/// - `schema` must be a valid reference to a parsed schema.
/// - `doc` must be a valid pointer to an _xmlDoc or NULL.
/// - `ctxt` must be a valid mutable reference to a validation context.
pub unsafe fn rng_validate_doc(
    schema: &RelaxNgSchema,
    doc: *mut _xmlDoc,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    unsafe {
        if doc.is_null() {
            ctxt.record_error("Document is null".to_string());
            return false;
        }

        let root = (*doc).children;
        if root.is_null() {
            ctxt.record_error("Document has no children".to_string());
            return false;
        }

        // Find the root element
        let mut root_elem = root;
        while !root_elem.is_null() && (*root_elem).type_ != XML_ELEMENT_NODE as c_int {
            root_elem = (*root_elem).next;
        }

        if root_elem.is_null() {
            ctxt.record_error("Document has no root element".to_string());
            return false;
        }

        // Get the start pattern
        let start_pattern = match &schema.grammar.start {
            Some(p) => p,
            None => {
                ctxt.record_error("Schema has no start pattern".to_string());
                return false;
            }
        };

        ctxt.path.clear();
        let valid = rng_validate_pattern(start_pattern, root_elem, schema, ctxt);

        // Check for remaining unmatched errors
        valid
    }
}

/// Run RELAX NG validation of a document against an already-compiled schema
/// (xmlRelaxNGPtr from xmlRelaxNGParse), collecting the diagnostics WITHOUT
/// dispatching them to any registered handler. Used by the xmlTextReader
/// (which validates deferred, at first Read, and raises the diagnostics
/// through the global libxml error channel itself).
///
/// # SAFETY
///
/// - `schema` must be a valid compiled-schema pointer from xmlRelaxNGParse;
/// - `doc` must be a valid parsed document.
pub(crate) unsafe fn rng_validate_doc_compiled(
    schema: *mut c_void,
    doc: *mut _xmlDoc,
) -> (bool, Vec<String>) {
    unsafe {
        if schema.is_null() || doc.is_null() {
            return (false, Vec::new());
        }
        let schema_ref = &*(schema as *const RelaxNgSchema);
        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = rng_validate_doc(schema_ref, doc, &mut ctxt);
        (valid, ctxt.errors)
    }
}

/// Validate a pattern against a node.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_pattern(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    unsafe {
        if ctxt.depth >= ctxt.depth_max {
            ctxt.record_error("Maximum validation depth exceeded".to_string());
            return false;
        }
        ctxt.depth += 1;

        let result = match pattern.pattern_type {
            RelaxNgPatternType::Element => {
                rng_validate_element_pattern(pattern, node, schema, ctxt)
            }
            RelaxNgPatternType::Attribute => {
                rng_validate_attribute_pattern(pattern, node, schema, ctxt)
            }
            RelaxNgPatternType::Text => rng_validate_text_pattern(node, ctxt),
            RelaxNgPatternType::Empty => rng_validate_empty_pattern(node, ctxt),
            RelaxNgPatternType::NotAllowed => {
                let name = get_node_qname(node);
                ctxt.record_error(format!(
                    "Element '{}' is not allowed at '{}'",
                    name,
                    ctxt.current_path()
                ));
                false
            }
            RelaxNgPatternType::Choice => rng_validate_choice_pattern(pattern, node, schema, ctxt),
            RelaxNgPatternType::Sequence => {
                rng_validate_sequence_pattern(pattern, node, schema, ctxt)
            }
            RelaxNgPatternType::Interleave => {
                rng_validate_interleave_pattern(pattern, node, schema, ctxt)
            }
            RelaxNgPatternType::ZeroOrMore => {
                rng_validate_zero_or_more(pattern, node, schema, ctxt)
            }
            RelaxNgPatternType::OneOrMore => rng_validate_one_or_more(pattern, node, schema, ctxt),
            RelaxNgPatternType::Optional => {
                rng_validate_optional_pattern(pattern, node, schema, ctxt)
            }
            RelaxNgPatternType::List => rng_validate_list_pattern(pattern, node, schema, ctxt),
            RelaxNgPatternType::Group => rng_validate_group_pattern(pattern, node, schema, ctxt),
            RelaxNgPatternType::Data => rng_validate_data_pattern(pattern, node, ctxt),
            RelaxNgPatternType::Value => rng_validate_value_pattern(pattern, node, ctxt),
            RelaxNgPatternType::Ref => rng_validate_ref_pattern(pattern, node, schema, ctxt),
            RelaxNgPatternType::ExternalRef => {
                // External refs are resolved during parsing; treat as empty
                rng_validate_empty_pattern(node, ctxt)
            }
            RelaxNgPatternType::Define
            | RelaxNgPatternType::Grammar
            | RelaxNgPatternType::Start
            | RelaxNgPatternType::Include => {
                // These shouldn't appear during validation; treat as pass-through
                rng_validate_children(pattern, node, schema, ctxt)
            }
        };

        ctxt.depth -= 1;
        result
    }
}

/// Validate a pattern's children against a node's children.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_children(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    {
        if pattern.children.is_empty() {
            return true;
        }
        // Validate each child pattern against the same node
        let mut valid = true;
        for child in &pattern.children {
            valid &= rng_validate_pattern(child, node, schema, ctxt);
        }
        valid
    }
}

/// Validate an element pattern against an element node.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_element_pattern(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    unsafe {
        if node.is_null() || (*node).type_ != XML_ELEMENT_NODE as c_int {
            return false;
        }

        let node_name = get_node_qname(node);
        let ns_uri = get_node_ns_uri(node);

        // Check if the node name matches the element pattern's name class
        if let Some(ref nc) = pattern.name_class {
            if !nc.matches(&node_name, ns_uri.as_deref()) {
                let pat_name = pattern.name.as_deref().unwrap_or("?");
                ctxt.record_error(format!(
                    "Element '{}' does not match expected element pattern '{}' at '{}'",
                    node_name,
                    pat_name,
                    ctxt.current_path()
                ));
                return false;
            }
        }

        // Push the element name onto the path
        ctxt.path.push(node_name.clone());

        // Validate child patterns against this element's CHILDREN.
        // UPSTREAM-PARITY (relaxng.c xmlRelaxNGValidateElement): the
        // content patterns describe the element's children, not the element
        // itself. The pre-fix code validated them against the element node
        // directly, so any nested element pattern failed its name match and
        // every non-empty schema rejected every document (Phase 14 lxml
        // RelaxNG court).
        let valid = rng_validate_content(&pattern.children, node, schema, ctxt);

        ctxt.path.pop();
        valid
    }
}

/// Validate an element's content model (the child patterns of an element
/// pattern) against the element's child nodes.
///
/// An empty content model requires no element children; a single structural
/// pattern (sequence/choice/interleave/group/zeroOrMore/oneOrMore/optional)
/// consumes the child list with its own logic; anything else is an implicit
/// sequence over the element's element-children, where a `text` pattern
/// validates against the element itself (any text is allowed) without
/// consuming a child.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_content(
    content: &[RelaxNgPattern],
    node: *mut _xmlNode,
    schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    if content.is_empty() {
        return rng_validate_empty_pattern(node, ctxt);
    }
    if content.len() == 1 {
        let p = &content[0];
        match p.pattern_type {
            RelaxNgPatternType::Sequence
            | RelaxNgPatternType::Choice
            | RelaxNgPatternType::Interleave
            | RelaxNgPatternType::Group
            | RelaxNgPatternType::ZeroOrMore
            | RelaxNgPatternType::OneOrMore
            | RelaxNgPatternType::Optional
            | RelaxNgPatternType::List => {
                return rng_validate_pattern(p, node, schema, ctxt);
            }
            RelaxNgPatternType::Text => return rng_validate_text_pattern(node, ctxt),
            RelaxNgPatternType::Empty => return rng_validate_empty_pattern(node, ctxt),
            RelaxNgPatternType::Data => return rng_validate_data_pattern(p, node, ctxt),
            RelaxNgPatternType::Value => return rng_validate_value_pattern(p, node, ctxt),
            RelaxNgPatternType::Attribute => {
                return rng_validate_attribute_pattern(p, node, schema, ctxt)
            }
            _ => {}
        }
    }

    unsafe {
        // Collect the element's element-children in document order.
        let mut child_nodes: Vec<*mut _xmlNode> = Vec::new();
        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int {
                child_nodes.push(child);
            }
            child = (*child).next;
        }

        let mut valid = true;
        let mut child_idx = 0;
        for child_pat in content {
            // Patterns over the element's own character data and attributes
            // do NOT consume an element child: `text` matches any text,
            // `data`/`value` validate the concatenated text content,
            // `attribute` validates the element's attributes, and `empty`
            // requires no element children (upstream relaxng.c treats these
            // against the element's data/attributes, not its child list).
            match child_pat.pattern_type {
                RelaxNgPatternType::Text => {
                    valid &= rng_validate_text_pattern(node, ctxt);
                    continue;
                }
                RelaxNgPatternType::Data => {
                    valid &= rng_validate_data_pattern(child_pat, node, ctxt);
                    continue;
                }
                RelaxNgPatternType::Value => {
                    valid &= rng_validate_value_pattern(child_pat, node, ctxt);
                    continue;
                }
                RelaxNgPatternType::Attribute => {
                    valid &= rng_validate_attribute_pattern(child_pat, node, schema, ctxt);
                    continue;
                }
                RelaxNgPatternType::Empty => {
                    valid &= rng_validate_empty_pattern(node, ctxt);
                    continue;
                }
                _ => {}
            }
            if child_idx >= child_nodes.len() {
                match child_pat.pattern_type {
                    RelaxNgPatternType::Optional | RelaxNgPatternType::ZeroOrMore => {
                        // These are fine to have no matching children.
                        continue;
                    }
                    RelaxNgPatternType::OneOrMore => {
                        ctxt.record_error(format!(
                            "Expected at least one matching child for oneOrMore at '{}'",
                            ctxt.current_path()
                        ));
                        valid = false;
                        continue;
                    }
                    _ => {
                        ctxt.record_error(format!(
                            "Expected more child elements for content model at '{}'",
                            ctxt.current_path()
                        ));
                        valid = false;
                        continue;
                    }
                }
            }
            let child_node = child_nodes[child_idx];
            valid &= rng_validate_pattern(child_pat, child_node, schema, ctxt);
            child_idx += 1;
        }

        // Check for extra children.
        if child_idx < child_nodes.len() {
            let extra_name = get_node_qname(child_nodes[child_idx]);
            // UPSTREAM-PARITY (relaxng.c xmlRelaxNGValidateElement, error
            // XML_RELAXNG_ERR_ELEMWRONG): "Did not expect element %s there".
            ctxt.record_error(format!("Did not expect element {} there", extra_name));
            valid = false;
        }

        valid
    }
}

/// Validate an attribute pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_attribute_pattern(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    _schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    unsafe {
        if node.is_null() || (*node).type_ != XML_ELEMENT_NODE as c_int {
            return false;
        }

        // Get the attribute name from the pattern's name class
        let attr_name = match &pattern.name_class {
            Some(RelaxNgNameClass::Name(n)) => n.clone(),
            Some(RelaxNgNameClass::AnyName) => {
                // Any attribute is allowed — just check that there's at least one
                // attribute that matches (or return true if the attribute is optional)
                // For now, we just return true for anyName since we can't know which
                // attribute to check
                return true;
            }
            Some(RelaxNgNameClass::NsName(ns)) => {
                // Any attribute in the given namespace.
                // Check if there's an attribute with a matching namespace.
                let mut prop = (*node).properties;
                while !prop.is_null() {
                    let prop_ns = get_node_ns_uri(prop as *mut _xmlNode);
                    if let Some(ref uri) = prop_ns {
                        if uri == ns {
                            // Validate content pattern against attribute value
                            if let Some(content) = &pattern.children.first() {
                                let val = get_node_text(prop as *mut _xmlNode);
                                let valid = match content.pattern_type {
                                    RelaxNgPatternType::Text => true,
                                    RelaxNgPatternType::Data => rng_validate_datatype_value(
                                        content.datatype.as_deref(),
                                        &val,
                                    ),
                                    RelaxNgPatternType::Value => {
                                        content.value.as_deref() == Some(&val)
                                    }
                                    _ => true,
                                };
                                if !valid {
                                    ctxt.record_error(format!(
                                        "Attribute '{}' has invalid value at '{}'",
                                        prop_ns.unwrap_or_default(),
                                        ctxt.current_path()
                                    ));
                                    return false;
                                }
                            }
                            return true;
                        }
                    }
                    prop = (*prop).next;
                }
                // No matching attribute found — attribute is required
                // (In RELAX NG, attributes are implicitly required)
                ctxt.record_error(format!(
                    "Required attribute in namespace '{}' is missing at '{}'",
                    ns,
                    ctxt.current_path()
                ));
                return false;
            }
            _ => {
                // Complex name class — just check if any attribute matches
                // This is a simplified check
                return true;
            }
        };

        // Check if the attribute exists on the element
        let attr_value = get_attr(node, &attr_name);

        match attr_value {
            Some(val) => {
                // Validate content pattern against attribute value
                if let Some(content) = pattern.children.first() {
                    let valid = match content.pattern_type {
                        RelaxNgPatternType::Text => true,
                        RelaxNgPatternType::Data => {
                            rng_validate_datatype_value(content.datatype.as_deref(), &val)
                        }
                        RelaxNgPatternType::Value => content.value.as_deref() == Some(&val),
                        _ => true,
                    };
                    if !valid {
                        ctxt.record_error(format!(
                            "Attribute '{}' has invalid value '{}' at '{}'",
                            attr_name,
                            val,
                            ctxt.current_path()
                        ));
                        return false;
                    }
                }
                true
            }
            None => {
                // Attribute not found — only error if the pattern requires it
                // (In RELAX NG, attributes are implicitly required unless wrapped in optional)
                ctxt.record_error(format!(
                    "Required attribute '{}' is missing at '{}'",
                    attr_name,
                    ctxt.current_path()
                ));
                false
            }
        }
    }
}

/// Validate a text pattern against text content.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
const fn rng_validate_text_pattern(node: *mut _xmlNode, _ctxt: &mut RelaxNgValidCtxt) -> bool {
    {
        if node.is_null() {
            return false;
        }
        // Text pattern matches any text content (or mixed content with elements)
        // In RELAX NG, text allows any text content
        true
    }
}

/// Validate an empty pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_empty_pattern(node: *mut _xmlNode, ctxt: &mut RelaxNgValidCtxt) -> bool {
    unsafe {
        if node.is_null() {
            return true;
        }
        // Empty pattern — the element must have no element children
        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int {
                let child_name = get_node_qname(child);
                ctxt.record_error(format!(
                    "Unexpected child element '{}' in empty content at '{}'",
                    child_name,
                    ctxt.current_path()
                ));
                return false;
            }
            child = (*child).next;
        }
        true
    }
}

/// Validate a choice pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_choice_pattern(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    unsafe {
        if pattern.children.is_empty() {
            return false;
        }

        // At least one choice must match
        let mut last_error = String::new();
        for child in &pattern.children {
            let saved_errors = ctxt.errors.len();
            let saved_nb = ctxt.nb_errors;

            if rng_validate_pattern(child, node, schema, ctxt) {
                // Restore errors from failed choices
                // (errors from failed branches should be discarded)
                return true;
            }

            // Capture the last error for reporting
            if ctxt.errors.len() > saved_errors {
                last_error = ctxt.errors.last().unwrap().clone();
            }

            // Restore error state (choice means at least one alternative must pass)
            ctxt.errors.truncate(saved_errors);
            ctxt.nb_errors = saved_nb;
        }

        // If we got here, none of the choices matched
        let node_name = if node.is_null() {
            "null".to_string()
        } else {
            get_node_qname(node)
        };
        ctxt.record_error(format!(
            "No choice pattern matched for '{}' at '{}'. Last error: {}",
            node_name,
            ctxt.current_path(),
            last_error
        ));
        false
    }
}

/// Validate a sequence pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_sequence_pattern(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    unsafe {
        if node.is_null() {
            return pattern.children.is_empty();
        }

        let mut valid = true;

        // For sequence validation, we validate each child pattern against
        // the node's children in order.
        // Collect element children of the node
        let mut child_nodes: Vec<*mut _xmlNode> = Vec::new();
        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int {
                child_nodes.push(child);
            }
            child = (*child).next;
        }

        // Simple sequence matching: validate each child pattern
        // against corresponding child nodes
        let mut child_idx = 0;
        for child_pat in &pattern.children {
            if child_idx >= child_nodes.len() {
                // Check if the pattern is optional or zero-or-more
                match child_pat.pattern_type {
                    RelaxNgPatternType::Optional | RelaxNgPatternType::ZeroOrMore => {
                        // These are fine to have no matching children
                        continue;
                    }
                    RelaxNgPatternType::OneOrMore => {
                        ctxt.record_error(format!(
                            "Expected at least one matching child for oneOrMore at '{}'",
                            ctxt.current_path()
                        ));
                        valid = false;
                        continue;
                    }
                    _ => {
                        ctxt.record_error(format!(
                            "Expected more child elements for sequence at '{}'",
                            ctxt.current_path()
                        ));
                        valid = false;
                        continue;
                    }
                }
            }

            let child_node = child_nodes[child_idx];
            valid &= rng_validate_pattern(child_pat, child_node, schema, ctxt);
            child_idx += 1;
        }

        // Check for extra children
        if child_idx < child_nodes.len() {
            let extra_name = get_node_qname(child_nodes[child_idx]);
            ctxt.record_error(format!(
                "Unexpected extra element '{}' in sequence at '{}'",
                extra_name,
                ctxt.current_path()
            ));
            valid = false;
        }

        valid
    }
}

/// Validate an interleave pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_interleave_pattern(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    unsafe {
        if node.is_null() {
            return pattern.children.is_empty();
        }

        // Interleave means child patterns can match in any order.
        // For simplicity, we validate each child pattern against a fresh
        // traversal of the node's children.
        let mut valid = true;

        for child_pat in &pattern.children {
            // For each pattern in the interleave, check if there's at least
            // one child node that matches
            let mut child = (*node).children;
            let mut matched = false;

            while !child.is_null() {
                if (*child).type_ == XML_ELEMENT_NODE as c_int {
                    let saved_errors = ctxt.errors.len();
                    let saved_nb = ctxt.nb_errors;

                    if rng_validate_pattern(child_pat, child, schema, ctxt) {
                        matched = true;
                        break;
                    }

                    // Restore errors for this attempt
                    ctxt.errors.truncate(saved_errors);
                    ctxt.nb_errors = saved_nb;
                }
                child = (*child).next;
            }

            if !matched {
                // Check if pattern is optional
                match child_pat.pattern_type {
                    RelaxNgPatternType::Optional | RelaxNgPatternType::ZeroOrMore => {
                        // Optional patterns can be absent
                    }
                    _ => {
                        let pat_desc = format!("{:?}", child_pat.pattern_type);
                        ctxt.record_error(format!(
                            "Interleave pattern '{}' did not match any child at '{}'",
                            pat_desc,
                            ctxt.current_path()
                        ));
                        valid = false;
                    }
                }
            }
        }

        valid
    }
}

/// Validate a zeroOrMore pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_zero_or_more(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    unsafe {
        if node.is_null() || pattern.children.is_empty() {
            return true;
        }

        let child_pat = &pattern.children[0];
        let valid = true;

        // Match as many child nodes as possible against the pattern
        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int {
                let saved_errors = ctxt.errors.len();
                let saved_nb = ctxt.nb_errors;

                if !rng_validate_pattern(child_pat, child, schema, ctxt) {
                    // This child doesn't match the zeroOrMore pattern
                    // Restore errors and stop
                    ctxt.errors.truncate(saved_errors);
                    ctxt.nb_errors = saved_nb;
                    break;
                }
                // Successfully matched — errors from matching are valid
            }
            child = (*child).next;
        }

        valid
    }
}

/// Validate a oneOrMore pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_one_or_more(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    unsafe {
        if node.is_null() || pattern.children.is_empty() {
            ctxt.record_error(format!(
                "Expected at least one matching element for oneOrMore at '{}'",
                ctxt.current_path()
            ));
            return false;
        }

        let child_pat = &pattern.children[0];
        let mut matched = false;
        let mut valid = true;

        // Match at least one child, then as many as possible
        let mut child = (*node).children;
        while !child.is_null() {
            if (*child).type_ == XML_ELEMENT_NODE as c_int {
                let saved_errors = ctxt.errors.len();
                let saved_nb = ctxt.nb_errors;

                if rng_validate_pattern(child_pat, child, schema, ctxt) {
                    matched = true;
                } else {
                    // Restore errors and stop
                    ctxt.errors.truncate(saved_errors);
                    ctxt.nb_errors = saved_nb;
                    break;
                }
            }
            child = (*child).next;
        }

        if !matched {
            ctxt.record_error(format!(
                "Expected at least one matching element for oneOrMore at '{}'",
                ctxt.current_path()
            ));
            valid = false;
        }

        valid
    }
}

/// Validate an optional pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_optional_pattern(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    {
        if pattern.children.is_empty() {
            return true;
        }

        // Optional means the pattern can match or not — both are valid
        let child_pat = &pattern.children[0];
        let saved_errors = ctxt.errors.len();
        let saved_nb = ctxt.nb_errors;

        let result = rng_validate_pattern(child_pat, node, schema, ctxt);

        if !result {
            // Restore errors — it's okay that optional didn't match
            ctxt.errors.truncate(saved_errors);
            ctxt.nb_errors = saved_nb;
        }

        true // Optional always returns true
    }
}

/// Validate a list pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_list_pattern(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    _schema: &RelaxNgSchema,
    _ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    unsafe {
        if node.is_null() {
            return pattern.children.is_empty();
        }

        // List pattern: whitespace-separated tokens, each matching the child pattern
        let text = get_node_text(node);
        if text.trim().is_empty() {
            return true;
        }

        let tokens: Vec<&str> = text.split_whitespace().collect();
        let mut valid = true;

        for token in &tokens {
            // For each token, validate against the child pattern
            // We do a simplified check — just ensure it's non-empty
            if token.is_empty() {
                valid = false;
                break;
            }
        }

        valid
    }
}

/// Validate a group pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_group_pattern(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    {
        // Group is similar to sequence — validate children in order
        rng_validate_sequence_pattern(pattern, node, schema, ctxt)
    }
}

/// Validate a data pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_data_pattern(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    unsafe {
        if node.is_null() {
            return false;
        }

        let text = get_node_text(node);
        let datatype = pattern.datatype.as_deref();

        if !rng_validate_datatype_value(datatype, &text) {
            ctxt.record_error(format!(
                "Value '{}' does not match datatype '{:?}' at '{}'",
                text,
                datatype,
                ctxt.current_path()
            ));
            return false;
        }

        true
    }
}

/// Validate a value pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_value_pattern(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    unsafe {
        if node.is_null() {
            return false;
        }

        let text = get_node_text(node).trim().to_string();
        let expected = pattern.value.as_deref().unwrap_or("");

        if text != expected {
            ctxt.record_error(format!(
                "Value '{}' does not match expected value '{}' at '{}'",
                text,
                expected,
                ctxt.current_path()
            ));
            return false;
        }

        true
    }
}

/// Validate a ref pattern.
///
/// # SAFETY
///
/// - `node` must be a valid pointer to an _xmlNode or NULL.
fn rng_validate_ref_pattern(
    pattern: &RelaxNgPattern,
    node: *mut _xmlNode,
    schema: &RelaxNgSchema,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    {
        let ref_name = pattern.name.as_deref().unwrap_or("");

        if ref_name.is_empty() {
            ctxt.record_error("Ref pattern has no name".to_string());
            return false;
        }

        // Look up the definition
        match schema.grammar.lookup(ref_name) {
            Some(def_pattern) => {
                // Validate against the definition's pattern
                rng_validate_pattern(def_pattern, node, schema, ctxt)
            }
            None => {
                ctxt.record_error(format!(
                    "Undefined reference '{}' at '{}'",
                    ref_name,
                    ctxt.current_path()
                ));
                false
            }
        }
    }
}

// ═══════════════════════════════════════════════════════════════════════════════
// Datatype Validation for RELAX NG
// ═══════════════════════════════════════════════════════════════════════════════

/// Validate a value against a RELAX NG datatype.
///
/// RELAX NG supports a subset of XML Schema datatypes. This function
/// provides basic datatype validation for common types.
fn rng_validate_datatype_value(datatype: Option<&str>, value: &str) -> bool {
    let dt = match datatype {
        Some(d) => d,
        None => return true, // No datatype specified — accept anything
    };

    match dt {
        "string" | "token" => true,
        "boolean" => {
            matches!(value, "true" | "false" | "1" | "0")
        }
        "integer" | "int" | "short" | "byte" | "long" => {
            if value.is_empty() {
                return false;
            }
            let trimmed = if value.starts_with('+') || value.starts_with('-') {
                &value[1..]
            } else {
                value
            };
            !trimmed.is_empty() && trimmed.chars().all(|c| c.is_ascii_digit())
        }
        "decimal" | "double" | "float" => {
            if value.is_empty() {
                return false;
            }
            // Allow INF, -INF, NaN for float/double
            if matches!(dt, "float" | "double") && matches!(value, "INF" | "-INF" | "NaN") {
                return true;
            }
            value.parse::<f64>().is_ok()
        }
        "NCName" | "Name" | "ID" | "IDREF" | "NMTOKEN" => {
            !value.is_empty() && !value.starts_with(|c: char| c.is_ascii_digit())
        }
        "anyURI" => {
            // Simple URI validation — non-empty and no spaces
            !value.is_empty() && !value.contains(char::is_whitespace)
        }
        "QName" => {
            if value.is_empty() {
                return false;
            }
            if let Some(pos) = value.find(':') {
                pos > 0 && pos < value.len() - 1
            } else {
                true
            }
        }
        _ => {
            // Unknown datatype — accept by default
            // This matches libxml2's lenient behavior
            true
        }
    }
}

// ═══════════════════════════════════════════════════════════════════════════════
// Public API Functions
// ═══════════════════════════════════════════════════════════════════════════════

/// Parse a RELAX NG schema from an XML string.
///
/// Returns the parsed schema, or an error message on failure.
pub fn rng_parse_schema(xml_doc: &str) -> Result<RelaxNgSchema, String> {
    rng_parse(xml_doc)
}

/// Parse a RELAX NG schema from a parsed XML document.
///
/// # SAFETY
///
/// - `doc` must be a valid pointer to an _xmlDoc.
pub unsafe fn rng_parse_schema_doc(doc: *mut _xmlDoc) -> Result<RelaxNgSchema, String> {
    rng_parse_doc(doc)
}

/// Validate a document against a RELAX NG schema.
///
/// Returns `true` if the document is valid.
///
/// # SAFETY
///
/// - `doc` must be a valid pointer to an _xmlDoc or NULL.
pub unsafe fn rng_validate_doc_schema(
    schema: &RelaxNgSchema,
    doc: *mut _xmlDoc,
    ctxt: &mut RelaxNgValidCtxt,
) -> bool {
    rng_validate_doc(schema, doc, ctxt)
}

// ═══════════════════════════════════════════════════════════════════════════════
// C ABI Functions
// ═══════════════════════════════════════════════════════════════════════════════

// These are the C-compatible entry points that get exported via the ABI layer.
// They use raw pointers and follow libxml2's calling conventions.

/// Create a new RELAX NG parser context.
/// RELAX NG parser context (upstream `xmlRelaxNGParserCtxt`).
///
/// Owns the eagerly-parsed schema; `xmlRelaxNGParse` hands out a NEW schema
/// object (a clone) so the context and the schema have separate lifetimes,
/// exactly as upstream callers expect (lxml: `xmlRelaxNGParse` then
/// `xmlRelaxNGFreeParserCtxt`, with `xmlRelaxNGFree` on the schema at
/// dealloc). The pre-fix implementation returned the context as the schema
/// pointer, so `xmlRelaxNGFreeParserCtxt` freed the schema out from under
/// consumers — a use-after-free (Phase 14 lxml RelaxNG court).
pub(crate) struct RelaxNgParserCtxt {
    /// The parsed schema, if parsing succeeded.
    pub(crate) schema: Option<RelaxNgSchema>,
    /// The schema resource name for file-based parser contexts. Kept so
    /// `xmlRelaxNGParse` can report upstream's "could not load %s" diagnostic
    /// when the resource was not readable (the I/O warning itself is emitted
    /// by the document open, mirroring upstream xmlRelaxNGParseFile).
    pub(crate) url: Option<String>,
}

/// Create a new RELAX NG parser context from a URL.
///
/// # UPSTREAM-PARITY
///
/// ```c
/// xmlRelaxNGParserCtxtPtr xmlRelaxNGNewParserCtxt(const char *URL);
/// ```
///
/// # SAFETY
///
/// - `url` must be a valid null-terminated C string or NULL.
#[no_mangle]
pub unsafe extern "C" fn xmlRelaxNGNewParserCtxt(url: *const c_char) -> *mut c_void {
    if url.is_null() {
        return Box::into_raw(Box::new(RelaxNgParserCtxt {
            schema: None,
            url: None,
        })) as *mut c_void;
    }

    let url_str = unsafe {
        let mut len = 0;
        while *url.add(len) != 0 {
            len += 1;
        }
        let slice = std::slice::from_raw_parts(url as *const u8, len);
        String::from_utf8_lossy(slice).to_string()
    };

    // Parse the schema from the URL eagerly and keep it in the context. The
    // document is opened through the standard input machinery
    // (xmlParseFile), so an unreadable resource raises the upstream I/O
    // warning exactly like xmlRelaxNGParseFile.
    let schema = if url_str.is_empty() {
        None
    } else {
        let url_c = std::ffi::CString::new(url_str.clone()).ok();
        if let Some(c) = url_c {
            let doc = crate::abi::exports_xml2::xmlParseFile(c.as_ptr());
            if !doc.is_null() {
                let result = rng_parse_doc(doc);
                crate::abi::exports_xml2::xmlFreeDoc(doc);
                result.ok()
            } else {
                None
            }
        } else {
            None
        }
    };
    Box::into_raw(Box::new(RelaxNgParserCtxt {
        schema,
        url: Some(url_str),
    })) as *mut c_void
}

/// Create a new RELAX NG parser context from a memory buffer.
///
/// # UPSTREAM-PARITY
///
/// ```c
/// xmlRelaxNGParserCtxtPtr xmlRelaxNGNewMemParserCtxt(const char *buffer, int size);
/// ```
///
/// # SAFETY
///
/// - `buffer` must be a valid pointer to a buffer of at least `size` bytes.
#[no_mangle]
pub unsafe extern "C" fn xmlRelaxNGNewMemParserCtxt(
    buffer: *const c_char,
    size: c_int,
) -> *mut c_void {
    if buffer.is_null() || size <= 0 {
        return ptr::null_mut();
    }

    // Parse the schema immediately and keep it in the parser context;
    // `xmlRelaxNGParse` hands out a fresh schema object (Phase 14: the
    // context and the schema must have separate lifetimes — lxml frees the
    // context right after xmlRelaxNGParse and the schema at dealloc).
    let buf_slice = unsafe { std::slice::from_raw_parts(buffer as *const u8, size as usize) };
    let xml_str = String::from_utf8_lossy(buf_slice).to_string();

    let schema = rng_parse(&xml_str).ok();
    Box::into_raw(Box::new(RelaxNgParserCtxt { schema, url: None })) as *mut c_void
}

/// Parse a RELAX NG schema.
///
/// # UPSTREAM-PARITY
///
/// ```c
/// xmlRelaxNGPtr xmlRelaxNGParse(xmlRelaxNGParserCtxtPtr ctxt);
/// ```
///
/// # SAFETY
///
/// - `ctxt` must be a valid pointer to a parser context, or NULL.
#[no_mangle]
pub unsafe extern "C" fn xmlRelaxNGParse(ctxt: *mut c_void) -> *mut c_void {
    if ctxt.is_null() {
        return ptr::null_mut();
    }

    // UPSTREAM-PARITY (relaxng.c xmlRelaxNGParse): the parser context owns
    // the parsed schema; this hands out a NEW schema object so the caller
    // can free the context independently (lxml frees the context right
    // after this call). The pre-fix implementation returned the context
    // itself, so xmlRelaxNGFreeParserCtxt freed the schema out from under
    // the consumer.
    let pctxt = unsafe { &*ctxt.cast::<RelaxNgParserCtxt>() };
    match &pctxt.schema {
        Some(schema) => {
            // A fatal grammar error (e.g. an <element> pattern without a
            // content model) aborts the parse upstream: the recorded
            // diagnostics go to the registered parser handlers and no schema
            // is returned (php then reports "Invalid RelaxNG" —
            // DOMDocument_relaxNGValidateSource_error2).
            if schema.fatal {
                crate::abi::exports_relaxng::dispatch_relaxng_parser_errors(
                    ctxt as usize,
                    &schema.errors,
                );
                return ptr::null_mut();
            }
            Box::into_raw(Box::new(schema.clone())) as *mut c_void
        }
        None => {
            // The main schema resource could not be loaded (xmlParseFile
            // already emitted the I/O warning). Report upstream's
            // "could not load" diagnostic through the parser handlers
            // (DOMDocument_relaxNGValidate_error2) before returning NULL.
            if let Some(ref url) = pctxt.url {
                if !url.is_empty() {
                    let msg = format!("xmlRelaxNGParse: could not load {}\n", url);
                    crate::abi::exports_relaxng::dispatch_relaxng_parser_errors(
                        ctxt as usize,
                        std::slice::from_ref(&msg),
                    );
                }
            }
            ptr::null_mut()
        }
    }
}

/// Free a RELAX NG schema.
///
/// # UPSTREAM-PARITY
///
/// ```c
/// void xmlRelaxNGFree(xmlRelaxNGPtr schema);
/// ```
///
/// # SAFETY
///
/// - `schema` must be a valid pointer to a schema, or NULL.
#[no_mangle]
pub unsafe extern "C" fn xmlRelaxNGFree(schema: *mut c_void) {
    if schema.is_null() {
        return;
    }
    // SAFETY: Reconstruct the Box to drop it.
    unsafe {
        let _ = Box::from_raw(schema as *mut RelaxNgSchema);
    }
}

/// Free a RELAX NG parser context.
///
/// # UPSTREAM-PARITY
///
/// ```c
/// void xmlRelaxNGFreeParserCtxt(xmlRelaxNGParserCtxtPtr ctxt);
/// ```
///
/// # SAFETY
///
/// - `ctxt` must be a valid pointer to a parser context, or NULL.
#[no_mangle]
pub unsafe extern "C" fn xmlRelaxNGFreeParserCtxt(ctxt: *mut c_void) {
    if ctxt.is_null() {
        return;
    }
    // SAFETY: Reconstruct the Box to drop it (the context is a separate
    // allocation from the schema handed out by xmlRelaxNGParse).
    unsafe {
        let _ = Box::from_raw(ctxt as *mut RelaxNgParserCtxt);
    }
}

/// Create a new RELAX NG validation context.
///
/// # UPSTREAM-PARITY
///
/// ```c
/// xmlRelaxNGValidCtxtPtr xmlRelaxNGNewValidCtxt(xmlRelaxNGPtr schema);
/// ```
///
/// # SAFETY
///
/// - `schema` must be a valid pointer to a schema, or NULL.
#[no_mangle]
pub unsafe extern "C" fn xmlRelaxNGNewValidCtxt(schema: *mut c_void) -> *mut c_void {
    let mut ctxt = RelaxNgValidCtxt::new();

    if !schema.is_null() {
        // SAFETY: The schema pointer is assumed to be a valid RelaxNgSchema.
        unsafe {
            let schema_ref = &*(schema as *const RelaxNgSchema);
            ctxt.schema = Some(schema_ref.clone());
        }
    }

    let boxed = Box::new(ctxt);
    Box::into_raw(boxed) as *mut c_void
}

/// Free a RELAX NG validation context.
///
/// # UPSTREAM-PARITY
///
/// ```c
/// void xmlRelaxNGFreeValidCtxt(xmlRelaxNGValidCtxtPtr ctxt);
/// ```
///
/// # SAFETY
///
/// - `ctxt` must be a valid pointer to a validation context, or NULL.
#[no_mangle]
pub unsafe extern "C" fn xmlRelaxNGFreeValidCtxt(ctxt: *mut c_void) {
    if ctxt.is_null() {
        return;
    }
    // SAFETY: Reconstruct the Box to drop it.
    unsafe {
        let _ = Box::from_raw(ctxt as *mut RelaxNgValidCtxt);
    }
}

/// Validate a document against a RELAX NG schema.
///
/// # UPSTREAM-PARITY
///
/// ```c
/// int xmlRelaxNGValidateDoc(xmlRelaxNGValidCtxtPtr ctxt, xmlDocPtr doc);
/// ```
///
/// Returns 0 if valid, -1 on internal error, or the number of validation errors.
///
/// # SAFETY
///
/// - `ctxt` must be a valid pointer to a validation context, or NULL.
/// - `doc` must be a valid pointer to an _xmlDoc, or NULL.
#[no_mangle]
pub unsafe extern "C" fn xmlRelaxNGValidateDoc(ctxt: *mut c_void, doc: *mut _xmlDoc) -> c_int {
    if ctxt.is_null() || doc.is_null() {
        return -1;
    }

    unsafe {
        let valid_ctxt = &mut *(ctxt as *mut RelaxNgValidCtxt);
        let schema = match &valid_ctxt.schema {
            Some(s) => s,
            None => return -1,
        };

        let mut temp_ctxt = RelaxNgValidCtxt::new();

        let valid = rng_validate_doc(schema, doc, &mut temp_ctxt);

        if valid {
            0
        } else {
            valid_ctxt.errors = temp_ctxt.errors;
            valid_ctxt.nb_errors = temp_ctxt.nb_errors;
            // UPSTREAM-PARITY: forward each recorded error to the context's
            // registered handlers (xmlRelaxNGSetValidErrors /
            // xmlRelaxNGSetValidStructuredErrors) so consumers like lxml's
            // RelaxNG.validate (which installs serror = _receiveError)
            // populate their error_log.
            crate::abi::exports_relaxng::dispatch_relaxng_valid_errors(
                ctxt as usize,
                &valid_ctxt.errors,
                ptr::null_mut(),
            );
            temp_ctxt.nb_errors
        }
    }
}

/// Validate a full element against a RELAX NG schema.
///
/// # UPSTREAM-PARITY
///
/// ```c
/// int xmlRelaxNGValidateFullElement(xmlRelaxNGValidCtxtPtr ctxt,
///                                    xmlDocPtr doc,
///                                    xmlNodePtr elem);
/// ```
///
/// Returns 0 if valid, -1 on internal error, or the number of validation errors.
///
/// # SAFETY
///
/// - `ctxt` must be a valid pointer to a validation context, or NULL.
/// - `doc` must be a valid pointer to an _xmlDoc, or NULL.
/// - `elem` must be a valid pointer to an element node, or NULL.
#[no_mangle]
pub unsafe extern "C" fn xmlRelaxNGValidateFullElement(
    ctxt: *mut c_void,
    doc: *mut _xmlDoc,
    elem: *mut _xmlNode,
) -> c_int {
    if ctxt.is_null() || doc.is_null() || elem.is_null() {
        return -1;
    }

    unsafe {
        let valid_ctxt = &mut *(ctxt as *mut RelaxNgValidCtxt);
        let schema = match &valid_ctxt.schema {
            Some(s) => s,
            None => return -1,
        };

        let mut temp_ctxt = RelaxNgValidCtxt::new();
        temp_ctxt.path = valid_ctxt.path.clone();

        let start_pattern = match &schema.grammar.start {
            Some(p) => p,
            None => return -1,
        };

        let valid = rng_validate_pattern(start_pattern, elem, schema, &mut temp_ctxt);

        if valid {
            0
        } else {
            valid_ctxt.errors = temp_ctxt.errors;
            valid_ctxt.nb_errors = temp_ctxt.nb_errors;
            temp_ctxt.nb_errors
        }
    }
}

// ═══════════════════════════════════════════════════════════════════════════════
// Tests
// ═══════════════════════════════════════════════════════════════════════════════

#[cfg(test)]
mod tests {
    use super::*;

    // ── Name Class Tests ───────────────────────────────────────────────────

    #[test]
    fn test_name_class_name() {
        let nc = RelaxNgNameClass::Name("foo".to_string());
        assert!(nc.matches("foo", None));
        assert!(!nc.matches("bar", None));
        assert!(!nc.matches("FOO", None));
    }

    #[test]
    fn test_name_class_any_name() {
        let nc = RelaxNgNameClass::AnyName;
        assert!(nc.matches("foo", None));
        assert!(nc.matches("bar", None));
        assert!(nc.matches("anything", Some("urn:ns")));
    }

    #[test]
    fn test_name_class_ns_name() {
        let nc = RelaxNgNameClass::NsName("urn:example".to_string());
        assert!(nc.matches("foo", Some("urn:example")));
        assert!(!nc.matches("foo", Some("urn:other")));
        assert!(!nc.matches("foo", None));
    }

    #[test]
    fn test_name_class_choice() {
        let nc = RelaxNgNameClass::Choice(vec![
            RelaxNgNameClass::Name("a".to_string()),
            RelaxNgNameClass::Name("b".to_string()),
        ]);
        assert!(nc.matches("a", None));
        assert!(nc.matches("b", None));
        assert!(!nc.matches("c", None));
    }

    #[test]
    fn test_name_class_except() {
        let nc = RelaxNgNameClass::Except(
            Box::new(RelaxNgNameClass::AnyName),
            Box::new(RelaxNgNameClass::Name("bad".to_string())),
        );
        assert!(nc.matches("good", None));
        assert!(!nc.matches("bad", None));
    }

    // ── Schema Parsing Tests ──────────────────────────────────────────────

    #[test]
    fn test_parse_simple_element_schema() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <text/>
</element>"#;

        let result = rng_parse(schema_xml);
        assert!(result.is_ok(), "Failed to parse schema: {:?}", result.err());
        let schema = result.unwrap();
        assert!(schema.grammar.start.is_some());
        if let Some(ref start) = schema.grammar.start {
            assert_eq!(start.pattern_type, RelaxNgPatternType::Element);
            assert_eq!(start.name.as_deref(), Some("root"));
        }
    }

    #[test]
    fn test_parse_grammar_schema() {
        let schema_xml = r#"<?xml version="1.0"?>
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <start>
    <element name="root">
      <text/>
    </element>
  </start>
</grammar>"#;

        let result = rng_parse(schema_xml);
        assert!(
            result.is_ok(),
            "Failed to parse grammar: {:?}",
            result.err()
        );
        let schema = result.unwrap();
        assert!(schema.grammar.start.is_some());
    }

    #[test]
    fn test_parse_with_define_and_ref() {
        let schema_xml = r#"<?xml version="1.0"?>
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <define name="textBlock">
    <text/>
  </define>
  <start>
    <element name="doc">
      <ref name="textBlock"/>
    </element>
  </start>
</grammar>"#;

        let result = rng_parse(schema_xml);
        assert!(result.is_ok(), "Failed to parse: {:?}", result.err());
        let schema = result.unwrap();
        assert_eq!(schema.grammar.defines.len(), 1);
        assert_eq!(schema.grammar.defines[0].name, "textBlock");
        assert!(schema.grammar.start.is_some());
    }

    #[test]
    fn test_parse_choice_schema() {
        let schema_xml = r#"<?xml version="1.0"?>
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <start>
    <choice>
      <element name="a">
        <text/>
      </element>
      <element name="b">
        <text/>
      </element>
    </choice>
  </start>
</grammar>"#;

        let result = rng_parse(schema_xml);
        assert!(result.is_ok(), "Failed to parse choice: {:?}", result.err());
    }

    #[test]
    fn test_parse_attribute_schema() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <attribute name="attr1">
    <text/>
  </attribute>
  <text/>
</element>"#;

        let result = rng_parse(schema_xml);
        assert!(
            result.is_ok(),
            "Failed to parse attribute: {:?}",
            result.err()
        );
    }

    #[test]
    fn test_parse_empty_document_fails() {
        let result = rng_parse("");
        assert!(result.is_err());
    }

    #[test]
    fn test_parse_invalid_xml_fails() {
        let result = rng_parse("not valid xml <<<");
        assert!(result.is_err());
    }

    // ── Validation Tests ──────────────────────────────────────────────────

    /// Validates a document against a schema with a single `element` pattern.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_simple_element() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <text/>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root>Hello</root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null(), "Failed to parse document");

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "Validation failed: {:?}", ctxt.errors);
    }

    /// Verifies validation fails when the root element name does not match.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_element_mismatch() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="expected" xmlns="http://relaxng.org/ns/structure/1.0">
  <text/>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<actual>Content</actual>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(!valid, "Validation should have failed");
        assert!(ctxt.nb_errors > 0);
    }

    /// Validates a document whose element carries a declared attribute.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_with_attribute() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <attribute name="id">
    <text/>
  </attribute>
  <text/>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root id="x1">Content</root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "Validation failed: {:?}", ctxt.errors);
    }

    /// Verifies validation fails when a required attribute is absent.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_missing_attribute() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <attribute name="required">
    <text/>
  </attribute>
  <text/>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root>Content</root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(
            !valid,
            "Validation should have failed for missing attribute"
        );
    }

    /// Validates a document matching one branch of a `choice` pattern.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_with_choice() {
        let schema_xml = r#"<?xml version="1.0"?>
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <start>
    <choice>
      <element name="a">
        <text/>
      </element>
      <element name="b">
        <text/>
      </element>
    </choice>
  </start>
</grammar>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<a>First choice</a>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "Choice validation failed: {:?}", ctxt.errors);
    }

    /// Verifies validation fails when no `choice` branch matches.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_choice_no_match() {
        let schema_xml = r#"<?xml version="1.0"?>
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <start>
    <choice>
      <element name="a">
        <text/>
      </element>
      <element name="b">
        <text/>
      </element>
    </choice>
  </start>
</grammar>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<c>Neither choice</c>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(
            !valid,
            "Validation should have failed for no matching choice"
        );
    }

    /// Validates a grammar that uses a named `ref` to a `define`.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_grammar_with_ref() {
        let schema_xml = r#"<?xml version="1.0"?>
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <define name="para">
    <element name="p">
      <text/>
    </element>
  </define>
  <start>
    <element name="doc">
      <zeroOrMore>
        <ref name="para"/>
      </zeroOrMore>
    </element>
  </start>
</grammar>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<doc><p>First</p><p>Second</p></doc>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "Ref validation failed: {:?}", ctxt.errors);
    }

    /// Validates repeated children under a `zeroOrMore` pattern.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_zero_or_more() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <zeroOrMore>
    <element name="item">
      <text/>
    </element>
  </zeroOrMore>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root><item>A</item><item>B</item></root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "zeroOrMore validation failed: {:?}", ctxt.errors);
    }

    /// Verifies a `zeroOrMore` pattern accepts zero repetitions.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_zero_or_more_empty() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <zeroOrMore>
    <element name="item">
      <text/>
    </element>
  </zeroOrMore>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root></root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "Empty zeroOrMore should be valid");
    }

    /// Validates a document with one occurrence under `oneOrMore`.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_one_or_more() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <oneOrMore>
    <element name="item">
      <text/>
    </element>
  </oneOrMore>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root><item>Single</item></root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "oneOrMore validation failed: {:?}", ctxt.errors);
    }

    /// Validates an `optional` element that is present.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_optional_present() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <optional>
    <element name="opt">
      <text/>
    </element>
  </optional>
  <text/>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root><opt>present</opt>text</root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(
            valid,
            "Optional present validation failed: {:?}",
            ctxt.errors
        );
    }

    /// Validates an `optional` element that is absent.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_optional_absent() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <optional>
    <element name="opt">
      <text/>
    </element>
  </optional>
  <text/>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root>text only</root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(
            valid,
            "Optional absent validation failed: {:?}",
            ctxt.errors
        );
    }

    /// Validates children in the declared `sequence` order.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_sequence() {
        let schema_xml = r#"<?xml version="1.0"?>
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <start>
    <element name="root">
      <sequence>
        <element name="first">
          <text/>
        </element>
        <element name="second">
          <text/>
        </element>
      </sequence>
    </element>
  </start>
</grammar>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root><first>First</first><second>Second</second></root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "Sequence validation failed: {:?}", ctxt.errors);
    }

    /// Validates a `data` pattern with an integer type.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_data_pattern() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="age" xmlns="http://relaxng.org/ns/structure/1.0">
  <data type="integer"/>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<age>25</age>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "Data pattern validation failed: {:?}", ctxt.errors);
    }

    /// Verifies a non-integer value fails a `data` pattern.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_data_pattern_invalid() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="age" xmlns="http://relaxng.org/ns/structure/1.0">
  <data type="integer"/>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<age>not-a-number</age>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(!valid, "Validation should have failed for invalid integer");
    }

    /// Validates a `value` pattern with an exact match.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_value_pattern() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="status" xmlns="http://relaxng.org/ns/structure/1.0">
  <value>active</value>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<status>active</status>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "Value pattern validation failed: {:?}", ctxt.errors);
    }

    /// Verifies a `value` pattern mismatch fails validation.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_value_pattern_mismatch() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="status" xmlns="http://relaxng.org/ns/structure/1.0">
  <value>active</value>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<status>inactive</status>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(!valid, "Validation should have failed for value mismatch");
    }

    /// Verifies a `notAllowed` pattern always fails validation.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_not_allowed() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <notAllowed/>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root>should not be allowed</root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(!valid, "notAllowed should cause validation failure");
    }

    /// Validates children in any order under an `interleave` pattern.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_interleave() {
        let schema_xml = r#"<?xml version="1.0"?>
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <start>
    <element name="root">
      <interleave>
        <element name="a">
          <text/>
        </element>
        <element name="b">
          <text/>
        </element>
      </interleave>
    </element>
  </start>
</grammar>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root><a>A</a><b>B</b></root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "Interleave validation failed: {:?}", ctxt.errors);
    }

    /// Validates an empty element against an `empty` pattern.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_empty_element() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="br" xmlns="http://relaxng.org/ns/structure/1.0">
  <empty/>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<br/>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "Empty element validation failed: {:?}", ctxt.errors);
    }

    // ── Datatype Validation Tests ──────────────────────────────────────────

    #[test]
    fn test_validate_datatype_string() {
        assert!(rng_validate_datatype_value(Some("string"), "hello"));
        assert!(rng_validate_datatype_value(Some("string"), ""));
    }

    #[test]
    fn test_validate_datatype_boolean() {
        assert!(rng_validate_datatype_value(Some("boolean"), "true"));
        assert!(rng_validate_datatype_value(Some("boolean"), "false"));
        assert!(rng_validate_datatype_value(Some("boolean"), "1"));
        assert!(rng_validate_datatype_value(Some("boolean"), "0"));
        assert!(!rng_validate_datatype_value(Some("boolean"), "yes"));
        assert!(!rng_validate_datatype_value(Some("boolean"), "no"));
    }

    #[test]
    fn test_validate_datatype_integer() {
        assert!(rng_validate_datatype_value(Some("integer"), "42"));
        assert!(rng_validate_datatype_value(Some("integer"), "-42"));
        assert!(rng_validate_datatype_value(Some("integer"), "+42"));
        assert!(!rng_validate_datatype_value(Some("integer"), "12.5"));
        assert!(!rng_validate_datatype_value(Some("integer"), "abc"));
        assert!(!rng_validate_datatype_value(Some("integer"), ""));
    }

    #[test]
    fn test_validate_datatype_decimal() {
        assert!(rng_validate_datatype_value(Some("decimal"), "42"));
        assert!(rng_validate_datatype_value(Some("decimal"), "12.5"));
        assert!(rng_validate_datatype_value(Some("decimal"), "-3.14"));
        assert!(!rng_validate_datatype_value(Some("decimal"), ""));
    }

    #[test]
    fn test_validate_datatype_float() {
        assert!(rng_validate_datatype_value(Some("float"), "3.14"));
        assert!(rng_validate_datatype_value(Some("float"), "INF"));
        assert!(rng_validate_datatype_value(Some("float"), "-INF"));
        assert!(rng_validate_datatype_value(Some("float"), "NaN"));
        assert!(!rng_validate_datatype_value(Some("float"), ""));
    }

    #[test]
    fn test_validate_datatype_ncname() {
        assert!(rng_validate_datatype_value(Some("NCName"), "myElement"));
        assert!(rng_validate_datatype_value(Some("NCName"), "_foo"));
        assert!(!rng_validate_datatype_value(Some("NCName"), "123abc"));
        assert!(!rng_validate_datatype_value(Some("NCName"), ""));
    }

    #[test]
    fn test_validate_datatype_any_uri() {
        assert!(rng_validate_datatype_value(
            Some("anyURI"),
            "http://example.com"
        ));
        assert!(rng_validate_datatype_value(Some("anyURI"), "urn:isbn:1234"));
        assert!(!rng_validate_datatype_value(Some("anyURI"), ""));
        assert!(!rng_validate_datatype_value(Some("anyURI"), "has space"));
    }

    #[test]
    fn test_validate_datatype_qname() {
        assert!(rng_validate_datatype_value(Some("QName"), "ns:local"));
        assert!(rng_validate_datatype_value(Some("QName"), "local"));
        assert!(!rng_validate_datatype_value(Some("QName"), ""));
    }

    // ── C ABI Tests ───────────────────────────────────────────────────────

    /// Exercises the C ABI schema parse round trip: `xmlRelaxNGNewMemParserCtxt`,
    /// `xmlRelaxNGParse` and `xmlRelaxNGFree`.
    ///
    /// # Safety
    ///
    /// - The static `schema_xml` string stays valid for the
    ///   `xmlRelaxNGNewMemParserCtxt` call; the parser context and the schema
    ///   returned by `xmlRelaxNGParse` are asserted non-NULL before use, and
    ///   the schema is freed exactly once with `xmlRelaxNGFree`.
    #[test]
    fn test_c_abi_new_parse_free() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <text/>
</element>"#;

        let ctxt = unsafe {
            xmlRelaxNGNewMemParserCtxt(
                schema_xml.as_ptr() as *const c_char,
                schema_xml.len() as c_int,
            )
        };
        assert!(!ctxt.is_null(), "Parser context should not be null");

        let schema = unsafe { xmlRelaxNGParse(ctxt) };
        assert!(!schema.is_null(), "Schema should not be null");

        // Free the schema
        unsafe { xmlRelaxNGFree(schema) };
    }

    /// Exercises the C ABI document validation path.
    ///
    /// # Safety
    ///
    /// - The static schema and document strings stay valid for their
    ///   `xmlRelaxNGNewMemParserCtxt` and `xmlReadMemory` calls; the parser
    ///   context, schema, validation context and document pointers are
    ///   asserted non-NULL before use, and the document, validation context
    ///   and schema are each freed exactly once.
    #[test]
    fn test_c_abi_validate_doc() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <text/>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root>Hello</root>"#;

        let ctxt = unsafe {
            xmlRelaxNGNewMemParserCtxt(
                schema_xml.as_ptr() as *const c_char,
                schema_xml.len() as c_int,
            )
        };
        let schema = unsafe { xmlRelaxNGParse(ctxt) };
        assert!(!schema.is_null());

        let valid_ctxt = unsafe { xmlRelaxNGNewValidCtxt(schema) };
        assert!(!valid_ctxt.is_null());

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let result = unsafe { xmlRelaxNGValidateDoc(valid_ctxt, doc) };
        assert_eq!(result, 0, "Validation should succeed");

        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };
        unsafe { xmlRelaxNGFreeValidCtxt(valid_ctxt) };
        unsafe { xmlRelaxNGFree(schema) };
    }

    /// Exercises the C ABI full-element validation path.
    ///
    /// # Safety
    ///
    /// - The static schema and document strings stay valid for their
    ///   `xmlRelaxNGNewMemParserCtxt` and `xmlReadMemory` calls; the parser
    ///   context, schema, validation context and document pointers are
    ///   asserted non-NULL before use.
    /// - The document tree walked through `children` and `next` links must be
    ///   well-formed and NULL-terminated; the located `item` node is asserted
    ///   non-NULL before being passed to `xmlRelaxNGValidateFullElement`.
    /// - The document, validation context and schema are each freed exactly
    ///   once.
    #[test]
    fn test_c_abi_validate_full_element() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="item" xmlns="http://relaxng.org/ns/structure/1.0">
  <text/>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root><item>Content</item></root>"#;

        let ctxt = unsafe {
            xmlRelaxNGNewMemParserCtxt(
                schema_xml.as_ptr() as *const c_char,
                schema_xml.len() as c_int,
            )
        };
        let schema = unsafe { xmlRelaxNGParse(ctxt) };
        assert!(!schema.is_null());

        let valid_ctxt = unsafe { xmlRelaxNGNewValidCtxt(schema) };
        assert!(!valid_ctxt.is_null());

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        // Find the <item> element
        let item = unsafe {
            // Start from the first child of the document (root element)
            let mut node = (*doc).children;
            while !node.is_null() {
                if (*node).type_ == XML_ELEMENT_NODE as c_int {
                    break;
                }
                node = (*node).next;
            }
            if !node.is_null() {
                // Now find <item> child of root
                node = (*node).children;
                while !node.is_null() {
                    if (*node).type_ == XML_ELEMENT_NODE as c_int {
                        break;
                    }
                    node = (*node).next;
                }
            }
            node
        };
        assert!(!item.is_null(), "Should find <item> element");

        let result = unsafe { xmlRelaxNGValidateFullElement(valid_ctxt, doc, item) };
        assert_eq!(result, 0, "Element validation should succeed");

        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };
        unsafe { xmlRelaxNGFreeValidCtxt(valid_ctxt) };
        unsafe { xmlRelaxNGFree(schema) };
    }

    /// Verifies the C ABI accepts NULL pointers and NULL frees.
    ///
    /// # Safety
    ///
    /// - NULL pointers are passed only to C ABI entry points that accept NULL
    ///   inputs, and the free functions must tolerate NULL without
    ///   dereferencing.
    #[test]
    fn test_c_abi_null_handling() {
        // Test null pointer handling
        assert_eq!(
            unsafe { xmlRelaxNGValidateDoc(ptr::null_mut(), ptr::null_mut()) },
            -1
        );
        assert_eq!(
            unsafe {
                xmlRelaxNGValidateFullElement(ptr::null_mut(), ptr::null_mut(), ptr::null_mut())
            },
            -1
        );
        assert!(unsafe { xmlRelaxNGNewMemParserCtxt(ptr::null(), 0).is_null() });

        // Free with null should not crash
        unsafe { xmlRelaxNGFree(ptr::null_mut()) };
        unsafe { xmlRelaxNGFreeParserCtxt(ptr::null_mut()) };
        unsafe { xmlRelaxNGFreeValidCtxt(ptr::null_mut()) };
    }

    // ── Edge Case Tests ───────────────────────────────────────────────────

    #[test]
    fn test_parse_with_div() {
        let schema_xml = r#"<?xml version="1.0"?>
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <div>
    <define name="shared">
      <text/>
    </define>
  </div>
  <start>
    <element name="root">
      <ref name="shared"/>
    </element>
  </start>
</grammar>"#;

        let result = rng_parse(schema_xml);
        assert!(
            result.is_ok(),
            "Failed to parse with div: {:?}",
            result.err()
        );
        let schema = result.unwrap();
        assert_eq!(schema.grammar.defines.len(), 1);
        assert_eq!(schema.grammar.defines[0].name, "shared");
    }

    /// Validates a `list` pattern with space-separated tokens.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_list_pattern() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="tokens" xmlns="http://relaxng.org/ns/structure/1.0">
  <list>
    <data type="token"/>
  </list>
</element>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<tokens>abc def ghi</tokens>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "List pattern validation failed: {:?}", ctxt.errors);
    }

    /// Validates children in order under a `group` pattern.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_group_pattern() {
        let schema_xml = r#"<?xml version="1.0"?>
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <start>
    <element name="root">
      <group>
        <element name="a">
          <text/>
        </element>
        <element name="b">
          <text/>
        </element>
      </group>
    </element>
  </start>
</grammar>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root><a>First</a><b>Second</b></root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(valid, "Group validation failed: {:?}", ctxt.errors);
    }

    /// Verifies validation fails when a `ref` names an undefined define.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_undefined_ref() {
        let schema_xml = r#"<?xml version="1.0"?>
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <start>
    <element name="root">
      <ref name="undefined"/>
    </element>
  </start>
</grammar>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root>Content</root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        assert!(!valid, "Undefined ref should cause failure");
    }

    /// Verifies `rng_validate_doc` rejects a NULL document pointer.
    ///
    /// # Safety
    ///
    /// - `rng_validate_doc` is called with a NULL document pointer, which it
    ///   must reject without dereferencing.
    #[test]
    fn test_validate_null_doc() {
        let schema = RelaxNgSchema::new();
        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, ptr::null_mut(), &mut ctxt) };
        assert!(!valid);
    }

    #[test]
    fn test_parse_external_ref_schema() {
        let schema_xml = r#"<?xml version="1.0"?>
<element name="root" xmlns="http://relaxng.org/ns/structure/1.0">
  <externalRef href="external.rng"/>
</element>"#;

        let result = rng_parse(schema_xml);
        assert!(
            result.is_ok(),
            "Failed to parse externalRef: {:?}",
            result.err()
        );
        let schema = result.unwrap();
        if let Some(ref start) = schema.grammar.start {
            assert_eq!(start.pattern_type, RelaxNgPatternType::Element);
            assert_eq!(start.name.as_deref(), Some("root"));
        }
    }

    #[test]
    fn test_validate_boolean_datatype() {
        assert!(rng_validate_datatype_value(Some("boolean"), "true"));
        assert!(rng_validate_datatype_value(Some("boolean"), "false"));
        assert!(!rng_validate_datatype_value(Some("boolean"), "maybe"));
    }

    #[test]
    fn test_validate_unknown_datatype() {
        // Unknown datatypes should be accepted (lenient behavior)
        assert!(rng_validate_datatype_value(Some("custom-type"), "anything"));
    }

    #[test]
    fn test_validate_no_datatype() {
        // No datatype specified — accept anything
        assert!(rng_validate_datatype_value(None, "anything"));
    }

    #[test]
    fn test_parse_schema_with_ns_prefix() {
        let schema_xml = r#"<?xml version="1.0"?>
<rng:element name="root" xmlns:rng="http://relaxng.org/ns/structure/1.0">
  <rng:text/>
</rng:element>"#;

        let result = rng_parse(schema_xml);
        assert!(result.is_ok(), "Failed with ns prefix: {:?}", result.err());
    }

    #[test]
    fn test_validation_context_path() {
        let mut ctxt = RelaxNgValidCtxt::new();
        assert_eq!(ctxt.current_path(), "/");

        ctxt.path.push("root".to_string());
        assert_eq!(ctxt.current_path(), "/root");

        ctxt.path.push("child".to_string());
        assert_eq!(ctxt.current_path(), "/root/child");

        ctxt.path.pop();
        assert_eq!(ctxt.current_path(), "/root");
    }

    /// Verifies a `sequence` pattern rejects children in the wrong order.
    ///
    /// # Safety
    ///
    /// - The static `doc_xml` string is passed to `xmlReadMemory`, which reads
    ///   exactly `doc_xml.len()` bytes and returns an owned `_xmlDoc` or NULL;
    ///   the pointer is asserted non-NULL before `rng_validate_doc`
    ///   dereferences it and is freed exactly once with `xmlFreeDoc`.
    #[test]
    fn test_validate_sequence_wrong_order() {
        let schema_xml = r#"<?xml version="1.0"?>
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <start>
    <element name="root">
      <sequence>
        <element name="first">
          <text/>
        </element>
        <element name="second">
          <text/>
        </element>
      </sequence>
    </element>
  </start>
</grammar>"#;

        let doc_xml = r#"<?xml version="1.0"?>
<root><second>Wrong</second><first>Order</first></root>"#;

        let schema = rng_parse(schema_xml).expect("Failed to parse schema");

        let doc = unsafe {
            crate::abi::exports_xml2::xmlReadMemory(
                doc_xml.as_ptr() as *const c_char,
                doc_xml.len() as c_int,
                c"test.xml".as_ptr() as *const c_char,
                ptr::null(),
                0,
            )
        };
        assert!(!doc.is_null());

        let mut ctxt = RelaxNgValidCtxt::new();
        let valid = unsafe { rng_validate_doc(&schema, doc, &mut ctxt) };
        unsafe { crate::abi::exports_xml2::xmlFreeDoc(doc) };

        // The sequence validates patterns against children in order,
        // so wrong order should fail
        assert!(!valid, "Wrong sequence order should fail");
    }
}