
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@markuplint/ml-spec
Advanced tools
Foundation package providing type definitions, W3C specification algorithms, and unified API for markup language specifications.
This package serves as the foundational layer for markuplint's specification system, providing:
The canonical HTML element specification data is provided by @markuplint/html-spec, which depends on this package for type definitions and algorithmic processing.
This package serves as the foundation layer in markuplint's specification system:
@markuplint/ml-spec (Foundation Layer)
↓ provides types, algorithms, schemas
@markuplint/html-spec (Data Layer)
↓ provides HTML specification data
Framework-specific specs (Extension Layer)
↓ provide framework extensions
Core packages (Application Layer)
↓ consume specifications for validation
ElementSpec, ExtendedSpec, MLMLSpec, ARIAVersionGenerated TypeScript types (do not edit directly):
src/types/attributes.ts - Attribute specification typessrc/types/aria.ts - ARIA specification typessrc/types/permitted-structures.ts - Content model typesHTML Standard Algorithms:
src/algorithm/html/may-be-focusable.ts)src/algorithm/html/get-content-model.ts)WAI-ARIA Specification Algorithms:
dom-accessibility-api)src/algorithm/aria/get-computed-role.ts)src/algorithm/aria/is-exposed.ts)src/algorithm/aria/get-computed-aria-props.ts)src/algorithm/aria/has-required-owned-elements.ts)Specification Integration:
src/utils/get-spec-by-tag-name.ts)src/utils/resolve-version.ts)src/utils/schema-to-spec.ts)schemas/element.schema.json - Element specification schemaschemas/aria.schema.json - ARIA specification schemaschemas/content-models.schema.json - Content model schemaschemas/global-attributes.schema.json (generated) - Global attribute categoriesschemas/attributes.schema.json (generated) - Attribute definition schemagen/gen.ts - Builds generated schema files from datagen/global-attribute.data.* - Source data for global attribute categoriesgetSpecByTagName, getAttrSpecs, getRoleSpecgetContentModel, isPalpableElements, isVoidElementgetAria, getPermittedRoles, hasRequiredOwnedElementsaccnameComputation, isExposed, mayBeFocusableschemaToSpec, resolveNamespace, validateAriaVersionNote: Attribute value types are defined in @markuplint/types. The schemas here reference @markuplint/types/types.schema.json.
@markuplint/html-spec provides the canonical HTML element specification data:
index.json (48K+ lines, consolidated specification data)src/spec-*.json (individual element specifications)build.mjs → @markuplint/spec-generator → enriched with MDN/W3C data@markuplint/ml-spec (this package) provides:
@markuplint/html-spec uses to structure its dataThis separation enables:
@markuplint/html-spec) without affecting type definitions@markuplint/ml-spec) without regenerating datamarkuplint already bundles this package. If you need to install it explicitly:
npm install @markuplint/ml-spec
# or
yarn add @markuplint/ml-spec
gen/gen.ts if you need to change the structure of
AttributeJSON/GlobalAttributes (because attributes.schema.json is generated).schemas/aria.schema.json.schemas/content-models.schema.json.schemas/element.schema.json (it composes refs to the above).gen/global-attribute.data.*, then regenerate via the commands below.If you want to change the concrete HTML element data (e.g., add/update element- or attribute-level
entries), update @markuplint/html-spec (and, if necessary, @markuplint/spec-generator).
From the repository root (recommended):
yarn up:schema
or only for this package:
yarn workspace @markuplint/ml-spec run schema
This will:
gen/gen.ts to output global-attributes.schema.json and attributes.schema.jsonjson2ts into src/types/*.tsyarn up:schema doesFrom the repository root, this executes schema maintenance across packages in order:
@markuplint/typesgen/types.ts to build types.schema.json from css-tree keywords/types and
gen/specific-schema.jsontypes.schema.json → src/types.schema.ts (via json2ts)prettier/eslint) and build the package@markuplint/ml-spec (this package)gen/gen.ts to output schemas/global-attributes.schema.json and schemas/attributes.schema.jsonschemas/content-models.schema.json → src/types/permitted-structures.tsschemas/attributes.schema.json → src/types/attributes.tsschemas/aria.schema.json → src/types/aria.tsprettier/eslint)Dependency note: schemas/attributes.schema.json references
@markuplint/types/types.schema.json#/definitions/type. Updating types first ensures references stay
consistent; yarn up:schema takes care of this order.
yarn build
src/types/*.ts or schemas/attributes.schema.json directly.
Change the source schema or generator instead and re-run the generation scripts.At runtime, markuplint can merge multiple specs. The merger in
src/utils/schema-to-spec.ts follows these rules:
def.#globalAttrs.#extends from an extended spec augments the base #HTMLGlobalAttrs map.categories are merged.This enables framework-specific specs (Vue/React/Svelte, etc.) to extend the HTML spec safely.
URL, JSON, etc.) are defined in
@markuplint/types and exposed via types.schema.json.@markuplint/types (e.g.
packages/@markuplint/types/gen/specific-schema.json) and regenerate that package first. Then
regenerate this package so references stay consistent.Add a new global attribute category or items
gen/global-attribute.data.*Add a new optional field to AttributeJSON
gen/gen.ts under AttributeJSONschemas/attributes.schema.json and in
src/types/attributes.tsAdjust ARIA fields (e.g., permittedRoles variants)
schemas/aria.schema.jsonContent models describe allowed children for each element. See the JSON Schema
schemas/content-models.schema.json and the generated TS types src/types/permitted-structures.ts.
Also refer to the website docs: Rule: permitted-contents.
"#flow", "#phrasing", "#interactive", …require | optional | oneOrMore | zeroOrMore: a string, category, or nested patternschoice: 2–5 alternative pattern arraystransparent: inherits parent model filtered by selector stringExamples:
{
"contentModel": {
"contents": [{ "require": "#phrasing" }, { "optional": [{ "oneOrMore": "#interactive" }] }]
}
}
Transparent selector syntax
:model(<CATEGORY>):not(...), :has(...),
combinators, etc.:model(<CATEGORY>) matches any element belonging to the specified content category.Examples:
:not(:model(interactive))
:has(:model(interactive), a, [tabindex])
SVG categories
The following categories are available for SVG elements (see schemas/content-models.schema.json):
#SVGAnimation#SVGBasicShapes#SVGContainer#SVGDescriptive#SVGFilterPrimitive#SVGFont#SVGGradient#SVGGraphics#SVGGraphicsReferencing#SVGLightSource#SVGNeverRendered#SVGNone#SVGPaintServer#SVGRenderable#SVGShape#SVGStructural#SVGStructurallyExternal#SVGTextContent#SVGTextContentChild{
"contentModel": {
"contents": [{ "choice": [[{ "oneOrMore": "#flow" }], [{ "require": "#phrasing" }]] }]
}
}
{
"contentModel": {
"contents": [{ "transparent": ":not(:model(interactive))" }],
"conditional": [
{
"condition": "[type=button]",
"contents": [{ "require": "#phrasing" }]
}
]
}
}
MIT
FAQs
Types and schema that specs of the Markup languages for markuplint
The npm package @markuplint/ml-spec receives a total of 25,041 weekly downloads. As such, @markuplint/ml-spec popularity was classified as popular.
We found that @markuplint/ml-spec demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.