@iyulab/chat-components 0.11.2 → 0.11.5

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## [0.11.5] - 2026-08-31
+
+### Security
+
+- **`UMarkedBlock` rendered unsanitized markdown output.** `marked` dropped
+  its built-in `sanitize` option in v5 and leaves that entirely to the
+  consumer; this component piped `marked`'s output straight into
+  `unsafeHTML()` without ever making that call. Raw HTML embedded in
+  markdown source (`<img onerror>`, `<script>`) ran verbatim, and
+  `javascript:`/`data:`/`vbscript:` hrefs in ordinary links, images, and
+  autolinks passed through untouched. Table cells hit the same gap
+  through a second path (`renderTable`'s inline parser call was missing
+  its options, silently falling back to `marked`'s unconfigured default
+  renderer). Fenced-code-block content had the same problem one layer
+  down — it reached `unsafeHTML()` unescaped even though a comment
+  already claimed otherwise.
+  Fixed by adding renderer overrides built on this package's existing
+  HTML/href sanitizers (no new dependency) and closing both bypass
+  paths.
+
+## [0.11.4] - 2026-08-27
+
+### Fixed
+
+- **`u-ref-card-group`'s previous/next buttons and `u-file-block`'s preview
+  close button had no accessible name.** All three are icon-only controls;
+  without an explicit label a screen reader announced them as unnamed
+  buttons. They now carry a localized `aria-label` (English and Korean).
+
+## [0.11.3] - 2026-08-25
+
+### Fixed
+
+- **Pin `marked-katex-extension` to `5.1.10`.** Versions `5.1.11`/`5.1.12` publish their `types`
+  field pointing at raw TypeScript source instead of compiled declarations (`./src/index.ts`
+  instead of `./src/index.d.ts`). Under a strict `tsconfig.json` (`noImplicitReturns`,
+  `noUnusedParameters`) with `moduleResolution: "bundler"`, that source file itself fails
+  typecheck — for this package's own CI, and for any downstream project that installs it fresh
+  and typechecks with similarly strict settings. No newer patched release exists yet, so the
+  range is pinned exact instead of `^5.1.10`; it will widen again once upstream fixes the
+  regression.
+
 ## [0.11.2] - 2026-08-07
 
 ### Fixed

package/dist/_virtual/{_@oxc-project_runtime@0.143.0 → _@oxc-project_runtime@0.147.0}/helpers/esm/decorate.js

@@ -1,4 +1,4 @@
-//#region \0@oxc-project+runtime@0.143.0/helpers/esm/decorate.js
+//#region \0@oxc-project+runtime@0.147.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

package/dist/_virtual/{_@oxc-project_runtime@0.143.0 → _@oxc-project_runtime@0.147.0}/helpers/esm/decorateMetadata.js

@@ -1,4 +1,4 @@
-//#region \0@oxc-project+runtime@0.143.0/helpers/esm/decorateMetadata.js
+//#region \0@oxc-project+runtime@0.147.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }

package/dist/components/blocks/UCodeBlock.js

@@ -1,6 +1,6 @@
 import { styles } from "./UCodeBlock.styles.js";
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import { html } from "lit";
 import { customElement, property } from "lit/decorators.js";
 import { unsafeHTML } from "lit/directives/unsafe-html.js";

package/dist/components/blocks/UElementBlock.js

@@ -1,5 +1,5 @@
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import { UDataElement } from "../UDataElement.js";
 import { styles } from "./UElementBlock.styles.js";
 import { html, nothing } from "lit";

package/dist/components/blocks/UFileBlock.js

@@ -1,5 +1,6 @@
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
+import { messages } from "../../utilities/messages.js";
 import { styles } from "./UFileBlock.styles.js";
 import { html, nothing } from "lit";
 import { customElement, property, state } from "lit/decorators.js";
@@ -80,7 +81,7 @@ var UFileBlock = class UFileBlock extends UElement {
         <div class="preview-overlay" @click=${this.closePreview}>
           <header class="preview-header">
             <span class="preview-name">${this.name}</span>
-            <button class="preview-close" @click=${this.closePreview}>
+            <button class="preview-close" aria-label=${messages.text("closePreview")} @click=${this.closePreview}>
               <u-icon lib="internal" name="x"></u-icon>
             </button>
           </header>

package/dist/components/blocks/UMarkedBlock.d.ts

@@ -7,6 +7,15 @@ import { ReferenceCitation } from '../../types/References.js';
  * 주의:
  * - refs로 삽입되는 커스텀 태그(u-ref-*)는 속성/내용을 모두 escape하여 XSS를 방지합니다.
  * - 코드블록 내부는 HTML을 전부 텍스트로 취급(escape)하며, refs 태그는 통째 제거합니다.
+ * - 마크다운 소스에 섞인 원시 HTML(html 토큰, 블록/인라인 공통)은 렌더하지 않고
+ *   텍스트로 escape합니다 — marked는 v5부터 sanitize 옵션을 제거했고 그 판단을
+ *   소비자에게 위임하므로, 이 컴포넌트가 직접 책임집니다.
+ * - 마크다운 링크/이미지(`[..](href)`, `![..](src)`, autolink)의 href/src는
+ *   `escapeHtmlHref`로 protocol을 검사합니다(javascript:/data:/vbscript: 차단) —
+ *   marked 자신은 URL을 encodeURI할 뿐 protocol을 걸러내지 않습니다.
+ * - 테이블 셀 인라인 콘텐츠(renderTable)도 위 두 규칙과 같은 렌더러 설정을 공유합니다
+ *   — `Parser.parseInline`을 옵션 없이 호출하면 기본(비-sanitize) 렌더러로 되돌아가므로
+ *   반드시 `this.parser.defaults`를 함께 넘겨야 합니다.
  * - 인덱스 기반 삽입(ref.endIndex)이 깨지지 않도록 "normalize(제로폭 제거)"를 insertRefs 전에 1회 수행합니다.
  */
 export declare class UMarkedBlock extends UElement {
@@ -32,8 +41,27 @@ export declare class UMarkedBlock extends UElement {
     /**
      * 테이블은 JSON 데이터로 변환하여 별도의 컴포넌트로 렌더링합니다.
      * 셀 내부의 인라인 마크다운(볼드, 코드, br 등)도 HTML로 변환합니다.
+     *
+     * `Parser.parseInline`은 옵션을 생략하면 marked 기본(비-sanitize) 렌더러로
+     * 돌아가 이 컴포넌트의 `html`/`link`/`image` 오버라이드를 건너뛴다 — 셀 안의
+     * 원시 HTML이나 `javascript:` 링크가 그대로 통과하는 별도 XSS 경로가 되므로,
+     * 반드시 `this.parser.defaults`(우리 렌더러가 병합된 설정)를 함께 넘긴다.
      */
     private renderTable;
+    /**
+     * 마크다운 소스에 섞인 원시 HTML(블록/인라인 공통 — marked는 두 경우 모두
+     * 같은 `html` 렌더러 훅을 쓴다)을 렌더하지 않고 텍스트로 escape합니다.
+     * marked v5+는 sanitize 옵션을 제거하고 이 판단을 소비자에게 위임했다.
+     */
+    private renderHtml;
+    /**
+     * 마크다운 링크의 href는 `escapeHtmlHref`로 protocol을 검사합니다
+     * (javascript:/data:/vbscript: 등은 `#`로 무력화). marked 기본 렌더러는
+     * URL을 encodeURI할 뿐 protocol을 걸러내지 않는다.
+     */
+    private renderLink;
+    /** 마크다운 이미지의 src도 `renderLink`와 동일하게 protocol을 검사합니다. */
+    private renderImage;
     /**
      * 인용/출처 참조객체가 있을때 ref 태그 HTML을 this.placeholder에 보관하고
      * 마크다운 문자열의 해당 위치에 주석 플레이스홀더를 삽입합니다.

package/dist/components/blocks/UMarkedBlock.js

@@ -1,7 +1,7 @@
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import "./UCodeBlock.js";
-import { escapeHtmlText, stripZeroWidth } from "../../utilities/sanitizers.js";
+import { escapeHtmlAttr, escapeHtmlHref, escapeHtmlText, stripZeroWidth } from "../../utilities/sanitizers.js";
 import { HtmlBuilder } from "../../utilities/HtmlBuilder.js";
 import { UElementBlock } from "./UElementBlock.js";
 import "../references/URefTag.js";
@@ -27,7 +27,10 @@ var UMarkedBlock = class UMarkedBlock extends UElement {
 			silent: true,
 			renderer: {
 				code: (token) => this.renderCode(token),
-				table: (token) => this.renderTable(token)
+				table: (token) => this.renderTable(token),
+				html: (token) => this.renderHtml(token),
+				link: (token) => this.renderLink(token),
+				image: (token) => this.renderImage(token)
 			}
 		}).use(markedKatex({ output: "mathml" }));
 		this.placeholder = new HtmlPlaceholder();
@@ -77,20 +80,25 @@ var UMarkedBlock = class UMarkedBlock extends UElement {
 	renderCode(token) {
 		const lang = token.lang ?? "plaintext";
 		if (lang === "block-json") return UElementBlock.buildHTML(token.text, { loading: this.streaming });
-		const safeText = this.removeRefs(token.text);
+		const safeText = escapeHtmlText(this.removeRefs(token.text));
 		return HtmlBuilder.build("u-code-block", { lang }, safeText);
 	}
 	/**
 	* 테이블은 JSON 데이터로 변환하여 별도의 컴포넌트로 렌더링합니다.
 	* 셀 내부의 인라인 마크다운(볼드, 코드, br 등)도 HTML로 변환합니다.
+	*
+	* `Parser.parseInline`은 옵션을 생략하면 marked 기본(비-sanitize) 렌더러로
+	* 돌아가 이 컴포넌트의 `html`/`link`/`image` 오버라이드를 건너뛴다 — 셀 안의
+	* 원시 HTML이나 `javascript:` 링크가 그대로 통과하는 별도 XSS 경로가 되므로,
+	* 반드시 `this.parser.defaults`(우리 렌더러가 병합된 설정)를 함께 넘긴다.
 	*/
 	renderTable(token) {
 		const headers = token.header.map((h) => ({
-			text: h.tokens ? Parser.parseInline(h.tokens) : h.text,
+			text: h.tokens ? Parser.parseInline(h.tokens, this.parser.defaults) : h.text,
 			align: h.align
 		}));
 		const rows = token.rows.map((row) => row.map((cell) => ({
-			text: cell.tokens ? Parser.parseInline(cell.tokens) : cell.text,
+			text: cell.tokens ? Parser.parseInline(cell.tokens, this.parser.defaults) : cell.text,
 			align: cell.align
 		})));
 		return UTableBlock.buildHTML({
@@ -99,6 +107,33 @@ var UMarkedBlock = class UMarkedBlock extends UElement {
 		});
 	}
 	/**
+	* 마크다운 소스에 섞인 원시 HTML(블록/인라인 공통 — marked는 두 경우 모두
+	* 같은 `html` 렌더러 훅을 쓴다)을 렌더하지 않고 텍스트로 escape합니다.
+	* marked v5+는 sanitize 옵션을 제거하고 이 판단을 소비자에게 위임했다.
+	*/
+	renderHtml(token) {
+		return escapeHtmlText(token.text);
+	}
+	/**
+	* 마크다운 링크의 href는 `escapeHtmlHref`로 protocol을 검사합니다
+	* (javascript:/data:/vbscript: 등은 `#`로 무력화). marked 기본 렌더러는
+	* URL을 encodeURI할 뿐 protocol을 걸러내지 않는다.
+	*/
+	renderLink(token) {
+		const text = token.tokens ? Parser.parseInline(token.tokens, this.parser.defaults) : token.text;
+		let out = `<a href="${escapeHtmlHref(token.href)}"`;
+		if (token.title) out += ` title="${escapeHtmlAttr(token.title)}"`;
+		out += `>${text}</a>`;
+		return out;
+	}
+	/** 마크다운 이미지의 src도 `renderLink`와 동일하게 protocol을 검사합니다. */
+	renderImage(token) {
+		let out = `<img src="${escapeHtmlHref(token.href)}" alt="${escapeHtmlAttr(token.text)}"`;
+		if (token.title) out += ` title="${escapeHtmlAttr(token.title)}"`;
+		out += `>`;
+		return out;
+	}
+	/**
 	* 인용/출처 참조객체가 있을때 ref 태그 HTML을 this.placeholder에 보관하고
 	* 마크다운 문자열의 해당 위치에 주석 플레이스홀더를 삽입합니다.
 	*/

package/dist/components/blocks/URefBlock.js

@@ -1,5 +1,5 @@
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import "../references/URefCard.js";
 import { styles } from "./URefBlock.styles.js";
 import { html } from "lit";

package/dist/components/blocks/UTableBlock.d.ts

@@ -1,7 +1,15 @@
 import { UDataElement } from '../UDataElement.js';
-/** 테이블 셀 데이터 타입 */
+/**
+ * 테이블 셀 데이터 타입
+ *
+ * ⚠`text`는 렌더링 시 `unsafeHTML()`로 그대로 주입되는 **신뢰된 HTML 마크업**입니다
+ * (일반 텍스트가 아닙니다) — `UMarkedBlock`이 마크다운 인라인 렌더러(자체 XSS 방어
+ * 포함: 원시 HTML escape, `javascript:`/`data:` 링크 차단)를 거쳐 채우는 것을
+ * 전제로 합니다. 이 컴포넌트를 직접 구동하는 소비자가 정화되지 않은 외부 문자열을
+ * `text`에 넣으면 XSS로 이어질 수 있습니다 — 반드시 사전에 sanitize할 것.
+ */
 export interface TableCell {
-    /** 셀에 표시할 텍스트 내용 */
+    /** 셀에 표시할 (이미 안전 처리된) HTML 마크업 */
     text: string;
     /** 셀 내용의 정렬 방식. 기본값은 "left" */
     align: "left" | "center" | "right" | null;

package/dist/components/blocks/UTableBlock.js

@@ -1,5 +1,5 @@
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import { UDataElement } from "../UDataElement.js";
 import { styles } from "./UTableBlock.styles.js";
 import { html } from "lit";

package/dist/components/blocks/UTextBlock.js

@@ -1,5 +1,5 @@
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import { styles } from "./UTextBlock.styles.js";
 import { html } from "lit";
 import { customElement, property, query } from "lit/decorators.js";

package/dist/components/message/UMessage.js

@@ -1,5 +1,5 @@
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import { styles } from "./UMessage.styles.js";
 import { html } from "lit";
 import { customElement, property } from "lit/decorators.js";

package/dist/components/prompt/UPrompt.js

@@ -1,5 +1,5 @@
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import "../blocks/UFileBlock.js";
 import { styles } from "./UPrompt.styles.js";
 import { html } from "lit";

package/dist/components/references/URefCard.js

@@ -1,5 +1,5 @@
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import { UDataElement } from "../UDataElement.js";
 import { styles } from "./URefCard.styles.js";
 import { html } from "lit";

package/dist/components/references/URefCardGroup.js

@@ -1,5 +1,6 @@
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
+import { messages } from "../../utilities/messages.js";
 import { URefCard } from "./URefCard.js";
 import { styles } from "./URefCardGroup.styles.js";
 import { html } from "lit";
@@ -20,15 +21,17 @@ var URefCardGroup = class URefCardGroup extends UElement {
 		return html`
       <div class="header" ?hidden=${this.cards.length <= 1}>
         <button class="nav-button"
+          aria-label=${messages.text("previousReference")}
           @click=${this.handlePreviousButtonClick}>
           <u-icon lib="internal" name="chevron-left"></u-icon>
         </button>
-        
+
         <span class="page-indicator">
           ${this.currentIndex + 1} / ${this.cards.length}
         </span>
-        
+
         <button class="nav-button"
+          aria-label=${messages.text("nextReference")}
           @click=${this.handleNextButtonClick}>
           <u-icon lib="internal" name="chevron-right"></u-icon>
         </button>

package/dist/components/references/URefTag.js

@@ -1,5 +1,5 @@
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import { styles } from "./URefTag.styles.js";
 import { html } from "lit";
 import { customElement, property } from "lit/decorators.js";

package/dist/components-extra/UChartBlock.js

@@ -1,5 +1,5 @@
-import __decorateMetadata from "../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import { messages } from "../utilities/messages.js";
 import { styles } from "./UChartBlock.styles.js";
 import { html, nothing } from "lit";

package/dist/components-extra/UImagesBlock.js

@@ -1,5 +1,5 @@
-import __decorateMetadata from "../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import { styles } from "./UImagesBlock.styles.js";
 import { html, nothing } from "lit";
 import { customElement, property, state } from "lit/decorators.js";

package/dist/components-extra/UMapBlock.js

@@ -1,5 +1,5 @@
-import __decorateMetadata from "../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import { styles } from "./UMapBlock.styles.js";
 import { html, nothing } from "lit";
 import { customElement, property } from "lit/decorators.js";

package/dist/components-extra/UVideoBlock.js

@@ -1,5 +1,5 @@
-import __decorateMetadata from "../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../_virtual/_@oxc-project_runtime@0.143.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../_virtual/_@oxc-project_runtime@0.147.0/helpers/esm/decorate.js";
 import { styles } from "./UVideoBlock.styles.js";
 import { html, nothing } from "lit";
 import { customElement, property } from "lit/decorators.js";

package/dist/utilities/messages.d.ts

@@ -5,5 +5,5 @@
  * 이 리포가 채택한 표준이 *"영어 기본 **+ 레지스트리**"* 이기 때문이다 — 영어 리터럴만으로는
  * 한국어 앱이 그 문구를 되돌릴 방법이 없다. 다음 문자열은 여기로 온다.
  */
-export type ChatMessageKey = 'canvasUnavailable';
-export declare const messages: import('@iyulab/components/dist/utilities/Locale.js').LocaleNamespace<"canvasUnavailable">;
+export type ChatMessageKey = 'canvasUnavailable' | 'previousReference' | 'nextReference' | 'closePreview';
+export declare const messages: import('@iyulab/components/dist/utilities/Locale.js').LocaleNamespace<ChatMessageKey>;

package/dist/utilities/messages.js

@@ -1,7 +1,17 @@
 import { Locale } from "@iyulab/components/dist/utilities/Locale.js";
 //#region src/utilities/messages.ts
 var messages = Locale.namespace("@iyulab/chat-components");
-messages.register("en", { canvasUnavailable: "Canvas 2D context is unavailable." });
-messages.register("ko", { canvasUnavailable: "Canvas 2D context를 가져올 수 없습니다." });
+messages.register("en", {
+	canvasUnavailable: "Canvas 2D context is unavailable.",
+	previousReference: "Previous reference",
+	nextReference: "Next reference",
+	closePreview: "Close preview"
+});
+messages.register("ko", {
+	canvasUnavailable: "Canvas 2D context를 가져올 수 없습니다.",
+	previousReference: "이전 참조",
+	nextReference: "다음 참조",
+	closePreview: "미리보기 닫기"
+});
 //#endregion
 export { messages };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@iyulab/chat-components",
   "description": "llm chat components for building chat interfaces",
-  "version": "0.11.2",
+  "version": "0.11.5",
   "author": "iyulab",
   "license": "MIT",
   "keywords": [
@@ -51,6 +51,7 @@
     "./react/*": "./dist/react/*"
   },
   "scripts": {
+    "preversion": "node ../../scripts/preversion-check.mjs",
     "start": "vite",
     "build": "npm run typecheck && eslint && vite build",
     "test": "vitest run",
@@ -65,7 +66,7 @@
     "katex": "^0.17.0",
     "lit": "^3.3.3",
     "marked": "^18.0.6",
-    "marked-katex-extension": "^5.1.10"
+    "marked-katex-extension": "5.1.10"
   },
   "peerDependencies": {
     "@lit/react": ">=1.0.8",

package/skills/iyulab-chat-components/references/components/code-block.md

@@ -36,3 +36,23 @@ Syntax-highlighted code block powered by Highlight.js. Shows a language label an
 | Name | Description |
 |------|-------------|
 | *(default, hidden)* | Code text injected directly as content; updates `value` on `slotchange` |
+
+## CSS Custom Properties
+
+Highlight.js syntax theme — light values shown, dark auto-applies via `light-dark()`.
+
+| Property | Description |
+|----------|-------------|
+| `--hljs-background-color` | Code block background |
+| `--hljs-text-color` | Default text color |
+| `--hljs-keyword-color` | Keywords |
+| `--hljs-string-color` | Strings |
+| `--hljs-comment-color` | Comments |
+| `--hljs-entity-color` | Function/class names |
+| `--hljs-entity-tag-color` | HTML/XML tag names |
+| `--hljs-constant-color` | Constants and numbers |
+| `--hljs-variable-color` | Variables and template literals |
+| `--hljs-markup-heading-color` | Markdown headings |
+| `--hljs-markup-list-color` | Markdown list bullets |
+| `--hljs-addition-color` / `--hljs-addition-bg-color` | Diff addition text / background |
+| `--hljs-deletion-color` / `--hljs-deletion-bg-color` | Diff deletion text / background |

package/skills/iyulab-chat-components/references/components/marked-block.md

@@ -42,6 +42,21 @@ Tracks a `streaming` state internally (resets a 1500ms idle timer on every `valu
 | `value` | `string` | `undefined` | Markdown text to render |
 | `refs` | `ReferenceCitation[]` | `undefined` | Citation list. `u-ref-tag` elements are automatically inserted at `startIndex`/`endIndex` positions |
 
+## CSS Custom Properties
+
+Vendored from GitHub's markdown theme — light values shown, dark auto-applies via
+`light-dark()`.
+
+| Property | Description |
+|----------|-------------|
+| `--fgColor-default` / `--fgColor-muted` / `--fgColor-accent` | Body text / secondary text / link color |
+| `--bgColor-default` / `--bgColor-muted` / `--bgColor-neutral-muted` / `--bgColor-attention-muted` | Body / code+table-stripe / hr+badge / warning-callout background |
+| `--borderColor-default` / `--borderColor-muted` / `--borderColor-neutral-muted` | Table and blockquote border weights |
+| `--focus-outlineColor` | Link focus outline |
+| `--fontStack-monospace` | Inline code and code-fence font stack |
+| `--base-size-4` / `-8` / `-16` / `-24` / `-40` | Spacing scale used throughout (margins, padding, gaps) |
+| `--base-text-weight-normal` / `-medium` / `-semibold` | Font-weight scale (body / table header / heading) |
+
 ## ReferenceCitation Type
 
 ```ts