@loafmarkets/ui 0.1.409 → 0.1.411

package/dist/index.d.mts

@@ -57,6 +57,23 @@ interface PortfolioSummaryProps extends React$1.HTMLAttributes<HTMLDivElement> {
 }
 declare const PortfolioSummary: React$1.ForwardRefExoticComponent<PortfolioSummaryProps & React$1.RefAttributes<HTMLDivElement>>;
 
+/**
+ * The market maker's real state for this market — never decorative:
+ *   active  → green (quoting both sides)
+ *   reduced → gold  (one-sided / throttled)
+ *   free    → red   (not quoting — peer-to-peer only)
+ *   unknown → grey  (no status from the API; NEVER a fabricated green)
+ * Same vocabulary as the consuming app's liquidityDotState() SSOT, which maps the
+ * API `liquidity.status` ('active' | 'limited' | 'inactive').
+ */
+type LoafLiquidityDotState = "active" | "reduced" | "free" | "unknown";
+interface LoafLiquidityBadgeProps extends React$1.HTMLAttributes<HTMLSpanElement> {
+    isGlowing?: boolean;
+    /** Market-maker state driving the dot colour. Omitted → grey "unknown". */
+    status?: LoafLiquidityDotState;
+}
+declare const LoafLiquidityBadge: React$1.ForwardRefExoticComponent<LoafLiquidityBadgeProps & React$1.RefAttributes<HTMLSpanElement>>;
+
 type OrderbookSide = "ask" | "bid";
 type OrderbookLevel = {
     price: number;
@@ -105,6 +122,13 @@ interface OrderbookProps extends React$1.HTMLAttributes<HTMLDivElement> {
      * a custom `rightHeader` is supplied.
      */
     onLoafLiquidityClick?: () => void;
+    /**
+     * Market-maker state for THIS market, driving the Loaf Liquidity badge dot.
+     * Consumers map the API `liquidity.status` ('active' | 'limited' | 'inactive')
+     * through their liquidityDotState() SSOT. Omitted → grey "unknown" — the dot is
+     * never a decorative green.
+     */
+    liquidityStatus?: LoafLiquidityDotState;
     /** Given a trade's txHash, returns the full explorer URL to link to. Defaults to Sepolia Etherscan. */
     tradeExplorerUrl?: (txHash: string) => string;
     /** Override the number of visible price levels per side (default 5). */
@@ -329,11 +353,6 @@ type TradeConfirmationModalProps = {
 };
 declare function TradeConfirmationModal({ isOpen, onClose, onConfirm, orderDetails, className, estimatedFeeUsd: _estimatedFeeUsd, estimatedFeeBps: _estimatedFeeBps, totalWithFeesUsd, confirmDisabled, confirmLoading, rememberChoiceChecked, rememberChoiceLabel, onRememberChoiceChange, }: TradeConfirmationModalProps): React$1.ReactElement | null;
 
-interface LoafLiquidityBadgeProps extends React$1.HTMLAttributes<HTMLSpanElement> {
-    isGlowing?: boolean;
-}
-declare const LoafLiquidityBadge: React$1.ForwardRefExoticComponent<LoafLiquidityBadgeProps & React$1.RefAttributes<HTMLSpanElement>>;
-
 type LoafLiquidityLogoProps = {
     onClick?: () => void;
     isGlowing?: boolean;
@@ -1356,4 +1375,4 @@ declare function extractSparkline(candles: ReadonlyArray<{
 }>, maxPoints?: number): number[];
 declare const SparklineChart: React__default.NamedExoticComponent<SparklineChartProps>;
 
-export { type ActivityTabId, AssetSelectorBar, type AssetSelectorBarProps, type AssetSelectorMetric, Badge, type BadgeProps, Button, type ButtonProps, Card, CardContent, type CardContentProps, CardDescription, type CardDescriptionProps, CardFooter, type CardFooterProps, CardHeader, type CardHeaderProps, type CardProps, CardTitle, type CardTitleProps, ContactPopup, type ContactPopupProps, type FinancialItem, type FundWalletParams, type FundWalletResult, Header, type HeaderNavItem, type HeaderPortfolioData, type HeaderProps, type HousePositionOrderbook, type HousePositionPendingOrder, HousePositionSlider, HousePositionSliderMobile, type HousePositionSliderMobileOrderPayload, type HousePositionSliderMobileOrderbook, type HousePositionSliderMobileProps, type HousePositionSliderOrderPayload, type HousePositionSliderProps, type InspectionSlot, LoafLiquidityBadge, LoafLiquidityLogo, type LoafLiquidityLogoProps, LoginPopup, type LoginPopupProps, MobileTradeNav, type MobileTradeNavItem, type MobileTradeNavProps, type OfferStatus, OfferingProgressCard, type OfferingProgressCardProps, OnboardingGuide, type OnboardingGuideProps, Orderbook, type OrderbookLevel, type OrderbookProps, type OrderbookSide, type OrderbookTrade, type OverviewImage, type OverviewResponse, OwnerBooking, type OwnerBookingProps, PaymentPopup, type PaymentPopupProps, PortfolioActivityPanel, type PortfolioActivityPanelProps, type PortfolioPosition, PortfolioSummary, type PortfolioSummaryProps, PriceChart, type PriceChartCandle, type PriceChartProps, type PriceChartRange, type PropertyAddressOption, PropertyBuy, PropertyCompareBar, type PropertyCompareBarProps, PropertyDocuments, type PropertyGalleryHotspot, type PropertyGalleryImage, PropertyHeroHeader, type PropertyHeroHeaderProps, PropertyHistory, type PropertyInfoItem, PropertyInspectionTimes, PropertyMediaRow, type PropertyMediaRowProps, type PropertyNewsItem, type PropertyNewsType, PropertyNewsUpdates, type PropertyNewsUpdatesProps, type PropertyOffer, PropertyOffers, type PropertyOffersProps, PropertyOverview, type PropertyOverviewProps, PropertyPhotoGallery, type PropertyPriceSummary, PropertySubheader, type PropertySubheaderAction, type PropertySubheaderProps, type PropertySubheaderTab, PropertyTour, type PropertyTourProps, PropertyValuation, type PropertyValuationProps, type PropertyValueSummary, type PurchaseFeedItem, type SelectorItem, SiteFooter, Skeleton, type SkeletonProps, SlideDigit, SparklineChart, type SparklineChartProps, type ToastData, ToastProvider, type ToastVariant, TradeConfirmationModal, type TradeConfirmationModalDetails, type TradeConfirmationModalProps, TradingSlider, type TradingSliderProps, type YourOrder, type YourOrderSide, YourOrders, type YourOrdersProps, badgeVariants, buttonVariants, extractSparkline, hasPendingActivity, useAdaptivePolling, useToast };
+export { type ActivityTabId, AssetSelectorBar, type AssetSelectorBarProps, type AssetSelectorMetric, Badge, type BadgeProps, Button, type ButtonProps, Card, CardContent, type CardContentProps, CardDescription, type CardDescriptionProps, CardFooter, type CardFooterProps, CardHeader, type CardHeaderProps, type CardProps, CardTitle, type CardTitleProps, ContactPopup, type ContactPopupProps, type FinancialItem, type FundWalletParams, type FundWalletResult, Header, type HeaderNavItem, type HeaderPortfolioData, type HeaderProps, type HousePositionOrderbook, type HousePositionPendingOrder, HousePositionSlider, HousePositionSliderMobile, type HousePositionSliderMobileOrderPayload, type HousePositionSliderMobileOrderbook, type HousePositionSliderMobileProps, type HousePositionSliderOrderPayload, type HousePositionSliderProps, type InspectionSlot, LoafLiquidityBadge, type LoafLiquidityDotState, LoafLiquidityLogo, type LoafLiquidityLogoProps, LoginPopup, type LoginPopupProps, MobileTradeNav, type MobileTradeNavItem, type MobileTradeNavProps, type OfferStatus, OfferingProgressCard, type OfferingProgressCardProps, OnboardingGuide, type OnboardingGuideProps, Orderbook, type OrderbookLevel, type OrderbookProps, type OrderbookSide, type OrderbookTrade, type OverviewImage, type OverviewResponse, OwnerBooking, type OwnerBookingProps, PaymentPopup, type PaymentPopupProps, PortfolioActivityPanel, type PortfolioActivityPanelProps, type PortfolioPosition, PortfolioSummary, type PortfolioSummaryProps, PriceChart, type PriceChartCandle, type PriceChartProps, type PriceChartRange, type PropertyAddressOption, PropertyBuy, PropertyCompareBar, type PropertyCompareBarProps, PropertyDocuments, type PropertyGalleryHotspot, type PropertyGalleryImage, PropertyHeroHeader, type PropertyHeroHeaderProps, PropertyHistory, type PropertyInfoItem, PropertyInspectionTimes, PropertyMediaRow, type PropertyMediaRowProps, type PropertyNewsItem, type PropertyNewsType, PropertyNewsUpdates, type PropertyNewsUpdatesProps, type PropertyOffer, PropertyOffers, type PropertyOffersProps, PropertyOverview, type PropertyOverviewProps, PropertyPhotoGallery, type PropertyPriceSummary, PropertySubheader, type PropertySubheaderAction, type PropertySubheaderProps, type PropertySubheaderTab, PropertyTour, type PropertyTourProps, PropertyValuation, type PropertyValuationProps, type PropertyValueSummary, type PurchaseFeedItem, type SelectorItem, SiteFooter, Skeleton, type SkeletonProps, SlideDigit, SparklineChart, type SparklineChartProps, type ToastData, ToastProvider, type ToastVariant, TradeConfirmationModal, type TradeConfirmationModalDetails, type TradeConfirmationModalProps, TradingSlider, type TradingSliderProps, type YourOrder, type YourOrderSide, YourOrders, type YourOrdersProps, badgeVariants, buttonVariants, extractSparkline, hasPendingActivity, useAdaptivePolling, useToast };

package/dist/index.d.ts

@@ -57,6 +57,23 @@ interface PortfolioSummaryProps extends React$1.HTMLAttributes<HTMLDivElement> {
 }
 declare const PortfolioSummary: React$1.ForwardRefExoticComponent<PortfolioSummaryProps & React$1.RefAttributes<HTMLDivElement>>;
 
+/**
+ * The market maker's real state for this market — never decorative:
+ *   active  → green (quoting both sides)
+ *   reduced → gold  (one-sided / throttled)
+ *   free    → red   (not quoting — peer-to-peer only)
+ *   unknown → grey  (no status from the API; NEVER a fabricated green)
+ * Same vocabulary as the consuming app's liquidityDotState() SSOT, which maps the
+ * API `liquidity.status` ('active' | 'limited' | 'inactive').
+ */
+type LoafLiquidityDotState = "active" | "reduced" | "free" | "unknown";
+interface LoafLiquidityBadgeProps extends React$1.HTMLAttributes<HTMLSpanElement> {
+    isGlowing?: boolean;
+    /** Market-maker state driving the dot colour. Omitted → grey "unknown". */
+    status?: LoafLiquidityDotState;
+}
+declare const LoafLiquidityBadge: React$1.ForwardRefExoticComponent<LoafLiquidityBadgeProps & React$1.RefAttributes<HTMLSpanElement>>;
+
 type OrderbookSide = "ask" | "bid";
 type OrderbookLevel = {
     price: number;
@@ -105,6 +122,13 @@ interface OrderbookProps extends React$1.HTMLAttributes<HTMLDivElement> {
      * a custom `rightHeader` is supplied.
      */
     onLoafLiquidityClick?: () => void;
+    /**
+     * Market-maker state for THIS market, driving the Loaf Liquidity badge dot.
+     * Consumers map the API `liquidity.status` ('active' | 'limited' | 'inactive')
+     * through their liquidityDotState() SSOT. Omitted → grey "unknown" — the dot is
+     * never a decorative green.
+     */
+    liquidityStatus?: LoafLiquidityDotState;
     /** Given a trade's txHash, returns the full explorer URL to link to. Defaults to Sepolia Etherscan. */
     tradeExplorerUrl?: (txHash: string) => string;
     /** Override the number of visible price levels per side (default 5). */
@@ -329,11 +353,6 @@ type TradeConfirmationModalProps = {
 };
 declare function TradeConfirmationModal({ isOpen, onClose, onConfirm, orderDetails, className, estimatedFeeUsd: _estimatedFeeUsd, estimatedFeeBps: _estimatedFeeBps, totalWithFeesUsd, confirmDisabled, confirmLoading, rememberChoiceChecked, rememberChoiceLabel, onRememberChoiceChange, }: TradeConfirmationModalProps): React$1.ReactElement | null;
 
-interface LoafLiquidityBadgeProps extends React$1.HTMLAttributes<HTMLSpanElement> {
-    isGlowing?: boolean;
-}
-declare const LoafLiquidityBadge: React$1.ForwardRefExoticComponent<LoafLiquidityBadgeProps & React$1.RefAttributes<HTMLSpanElement>>;
-
 type LoafLiquidityLogoProps = {
     onClick?: () => void;
     isGlowing?: boolean;
@@ -1356,4 +1375,4 @@ declare function extractSparkline(candles: ReadonlyArray<{
 }>, maxPoints?: number): number[];
 declare const SparklineChart: React__default.NamedExoticComponent<SparklineChartProps>;
 
-export { type ActivityTabId, AssetSelectorBar, type AssetSelectorBarProps, type AssetSelectorMetric, Badge, type BadgeProps, Button, type ButtonProps, Card, CardContent, type CardContentProps, CardDescription, type CardDescriptionProps, CardFooter, type CardFooterProps, CardHeader, type CardHeaderProps, type CardProps, CardTitle, type CardTitleProps, ContactPopup, type ContactPopupProps, type FinancialItem, type FundWalletParams, type FundWalletResult, Header, type HeaderNavItem, type HeaderPortfolioData, type HeaderProps, type HousePositionOrderbook, type HousePositionPendingOrder, HousePositionSlider, HousePositionSliderMobile, type HousePositionSliderMobileOrderPayload, type HousePositionSliderMobileOrderbook, type HousePositionSliderMobileProps, type HousePositionSliderOrderPayload, type HousePositionSliderProps, type InspectionSlot, LoafLiquidityBadge, LoafLiquidityLogo, type LoafLiquidityLogoProps, LoginPopup, type LoginPopupProps, MobileTradeNav, type MobileTradeNavItem, type MobileTradeNavProps, type OfferStatus, OfferingProgressCard, type OfferingProgressCardProps, OnboardingGuide, type OnboardingGuideProps, Orderbook, type OrderbookLevel, type OrderbookProps, type OrderbookSide, type OrderbookTrade, type OverviewImage, type OverviewResponse, OwnerBooking, type OwnerBookingProps, PaymentPopup, type PaymentPopupProps, PortfolioActivityPanel, type PortfolioActivityPanelProps, type PortfolioPosition, PortfolioSummary, type PortfolioSummaryProps, PriceChart, type PriceChartCandle, type PriceChartProps, type PriceChartRange, type PropertyAddressOption, PropertyBuy, PropertyCompareBar, type PropertyCompareBarProps, PropertyDocuments, type PropertyGalleryHotspot, type PropertyGalleryImage, PropertyHeroHeader, type PropertyHeroHeaderProps, PropertyHistory, type PropertyInfoItem, PropertyInspectionTimes, PropertyMediaRow, type PropertyMediaRowProps, type PropertyNewsItem, type PropertyNewsType, PropertyNewsUpdates, type PropertyNewsUpdatesProps, type PropertyOffer, PropertyOffers, type PropertyOffersProps, PropertyOverview, type PropertyOverviewProps, PropertyPhotoGallery, type PropertyPriceSummary, PropertySubheader, type PropertySubheaderAction, type PropertySubheaderProps, type PropertySubheaderTab, PropertyTour, type PropertyTourProps, PropertyValuation, type PropertyValuationProps, type PropertyValueSummary, type PurchaseFeedItem, type SelectorItem, SiteFooter, Skeleton, type SkeletonProps, SlideDigit, SparklineChart, type SparklineChartProps, type ToastData, ToastProvider, type ToastVariant, TradeConfirmationModal, type TradeConfirmationModalDetails, type TradeConfirmationModalProps, TradingSlider, type TradingSliderProps, type YourOrder, type YourOrderSide, YourOrders, type YourOrdersProps, badgeVariants, buttonVariants, extractSparkline, hasPendingActivity, useAdaptivePolling, useToast };
+export { type ActivityTabId, AssetSelectorBar, type AssetSelectorBarProps, type AssetSelectorMetric, Badge, type BadgeProps, Button, type ButtonProps, Card, CardContent, type CardContentProps, CardDescription, type CardDescriptionProps, CardFooter, type CardFooterProps, CardHeader, type CardHeaderProps, type CardProps, CardTitle, type CardTitleProps, ContactPopup, type ContactPopupProps, type FinancialItem, type FundWalletParams, type FundWalletResult, Header, type HeaderNavItem, type HeaderPortfolioData, type HeaderProps, type HousePositionOrderbook, type HousePositionPendingOrder, HousePositionSlider, HousePositionSliderMobile, type HousePositionSliderMobileOrderPayload, type HousePositionSliderMobileOrderbook, type HousePositionSliderMobileProps, type HousePositionSliderOrderPayload, type HousePositionSliderProps, type InspectionSlot, LoafLiquidityBadge, type LoafLiquidityDotState, LoafLiquidityLogo, type LoafLiquidityLogoProps, LoginPopup, type LoginPopupProps, MobileTradeNav, type MobileTradeNavItem, type MobileTradeNavProps, type OfferStatus, OfferingProgressCard, type OfferingProgressCardProps, OnboardingGuide, type OnboardingGuideProps, Orderbook, type OrderbookLevel, type OrderbookProps, type OrderbookSide, type OrderbookTrade, type OverviewImage, type OverviewResponse, OwnerBooking, type OwnerBookingProps, PaymentPopup, type PaymentPopupProps, PortfolioActivityPanel, type PortfolioActivityPanelProps, type PortfolioPosition, PortfolioSummary, type PortfolioSummaryProps, PriceChart, type PriceChartCandle, type PriceChartProps, type PriceChartRange, type PropertyAddressOption, PropertyBuy, PropertyCompareBar, type PropertyCompareBarProps, PropertyDocuments, type PropertyGalleryHotspot, type PropertyGalleryImage, PropertyHeroHeader, type PropertyHeroHeaderProps, PropertyHistory, type PropertyInfoItem, PropertyInspectionTimes, PropertyMediaRow, type PropertyMediaRowProps, type PropertyNewsItem, type PropertyNewsType, PropertyNewsUpdates, type PropertyNewsUpdatesProps, type PropertyOffer, PropertyOffers, type PropertyOffersProps, PropertyOverview, type PropertyOverviewProps, PropertyPhotoGallery, type PropertyPriceSummary, PropertySubheader, type PropertySubheaderAction, type PropertySubheaderProps, type PropertySubheaderTab, PropertyTour, type PropertyTourProps, PropertyValuation, type PropertyValuationProps, type PropertyValueSummary, type PurchaseFeedItem, type SelectorItem, SiteFooter, Skeleton, type SkeletonProps, SlideDigit, SparklineChart, type SparklineChartProps, type ToastData, ToastProvider, type ToastVariant, TradeConfirmationModal, type TradeConfirmationModalDetails, type TradeConfirmationModalProps, TradingSlider, type TradingSliderProps, type YourOrder, type YourOrderSide, YourOrders, type YourOrdersProps, badgeVariants, buttonVariants, extractSparkline, hasPendingActivity, useAdaptivePolling, useToast };

package/dist/index.js

@@ -1640,12 +1640,23 @@ var StatusDot = styled10__default.default.span`
   width: 6px;
   height: 6px;
   border-radius: 50%;
-  background: #0ecb81;
   flex-shrink: 0;
-  animation: ${breathe} 3s ease-in-out infinite;
+
+  ${({ $state }) => $state === "active" ? styled10.css`
+          background: #0ecb81;
+          animation: ${breathe} 3s ease-in-out infinite;
+        ` : $state === "reduced" ? styled10.css`
+            background: #e6c87e;
+            box-shadow: 0 0 4px rgba(240, 185, 11, 0.4);
+          ` : $state === "free" ? styled10.css`
+              background: #f6465d;
+              box-shadow: 0 0 4px rgba(246, 70, 93, 0.4);
+            ` : styled10.css`
+              background: rgba(255, 255, 255, 0.3);
+            `}
 `;
 var LoafLiquidityBadge = React5__namespace.forwardRef(
-  ({ className, isGlowing, onClick, children, ...props }, ref) => {
+  ({ className, isGlowing, status = "unknown", onClick, children, ...props }, ref) => {
     return /* @__PURE__ */ jsxRuntime.jsxs(
       LogoContainer,
       {
@@ -1656,11 +1667,11 @@ var LoafLiquidityBadge = React5__namespace.forwardRef(
         role: onClick ? "button" : void 0,
         ...props,
         children: [
-          /* @__PURE__ */ jsxRuntime.jsxs(LogoText, { children: [
+          /* @__PURE__ */ jsxRuntime.jsxs(LogoText, { className: "loaf-ll-label", children: [
             /* @__PURE__ */ jsxRuntime.jsx(LoafLogoImage, { src: Loaf_logo_Banner_default, alt: "Loaf" }),
             /* @__PURE__ */ jsxRuntime.jsx(LiquidityText, { children: children ?? "Liquidity" })
           ] }),
-          /* @__PURE__ */ jsxRuntime.jsx(StatusDot, {})
+          /* @__PURE__ */ jsxRuntime.jsx(StatusDot, { $state: status, "data-liquidity": status })
         ]
       }
     );
@@ -1907,13 +1918,21 @@ var Orderbook = React5__namespace.forwardRef(
     isLoading = false,
     onPriceClick,
     onLoafLiquidityClick,
+    liquidityStatus,
     tradeExplorerUrl,
     maxLevels,
     fillHeight = false,
     className,
     ...props
   }, ref) => {
-    const resolvedRightHeader = rightHeader ?? /* @__PURE__ */ jsxRuntime.jsx(LoafLiquidityBadge, { className: "text-[0.6rem] orderbook-ll-badge", onClick: onLoafLiquidityClick });
+    const resolvedRightHeader = rightHeader ?? /* @__PURE__ */ jsxRuntime.jsx(
+      LoafLiquidityBadge,
+      {
+        className: "text-[0.6rem] orderbook-ll-badge",
+        onClick: onLoafLiquidityClick,
+        status: liquidityStatus
+      }
+    );
     const [tab, setTabState] = React5__namespace.useState(defaultTab);
     const setTab = setTabState;
     const effectiveTab = showTradesTab ? tab : "orderbook";
@@ -2669,6 +2688,22 @@ var PropertyTour = React5__namespace.forwardRef(
   }
 );
 PropertyTour.displayName = "PropertyTour";
+
+// src/lib/isSafeUrl.ts
+var CONTROL_CHARS = /[\u0000-\u001F\u007F]/g;
+function isSafeUrl(url) {
+  if (!url) return false;
+  const cleaned = url.replace(CONTROL_CHARS, "").replace(/\\/g, "/").trim();
+  if (cleaned === "") return false;
+  if (cleaned.startsWith("//")) return false;
+  if (cleaned.startsWith("/")) return true;
+  try {
+    const { protocol } = new URL(cleaned);
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 var ITEMS_PER_PAGE = 5;
 var ITEMS_PER_PAGE_MOBILE = 5;
 var ensureAnimationsInjected = () => {
@@ -2864,7 +2899,7 @@ function NewsArticleModal({ item, onClose }) {
             ] }),
             /* @__PURE__ */ jsxRuntime.jsx("div", { style: { height: "1px", background: "rgba(255,255,255,0.08)", marginBottom: "1.25rem" } }),
             item.summary ? /* @__PURE__ */ jsxRuntime.jsx("p", { style: { fontSize: "0.875rem", color: "rgba(255,255,255,0.8)", lineHeight: 1.75, margin: 0 }, children: item.summary }) : /* @__PURE__ */ jsxRuntime.jsx("p", { style: { fontSize: "0.8rem", color: "rgba(255,255,255,0.35)", fontStyle: "italic", margin: 0 }, children: "Summary not available for this article." }),
-            item.url && /* @__PURE__ */ jsxRuntime.jsx("div", { style: { marginTop: "1.25rem", paddingTop: "1rem", borderTop: "1px solid rgba(255,255,255,0.08)" }, children: /* @__PURE__ */ jsxRuntime.jsxs(
+            item.url && isSafeUrl(item.url) && /* @__PURE__ */ jsxRuntime.jsx("div", { style: { marginTop: "1.25rem", paddingTop: "1rem", borderTop: "1px solid rgba(255,255,255,0.08)" }, children: /* @__PURE__ */ jsxRuntime.jsxs(
               "a",
               {
                 href: item.url,
@@ -6640,6 +6675,16 @@ var PropertySubheader = React5__namespace.forwardRef(
   }
 );
 PropertySubheader.displayName = "PropertySubheader";
+
+// src/lib/isTrustedTransakOrigin.ts
+function isTrustedTransakOrigin(eventOrigin, widgetUrl) {
+  if (!widgetUrl) return false;
+  try {
+    return eventOrigin === new URL(widgetUrl).origin;
+  } catch {
+    return false;
+  }
+}
 var DEFAULT_LOGO_SRC = Loaf_logo_Banner_default;
 var DEFAULT_LOGO_ALT = "Loaf";
 var OTP_INPUT_LENGTH = 6;
@@ -6780,7 +6825,7 @@ var LoginPopup = ({
   React5.useEffect(() => {
     if (!transakWidgetUrl) return;
     const handleTransakMessage = (event) => {
-      if (!event.origin.includes("transak.com") && !event.origin.includes("global.transak.com")) {
+      if (!isTrustedTransakOrigin(event.origin, transakWidgetUrl)) {
         return;
       }
       try {
@@ -12297,7 +12342,7 @@ function PropertyDocuments({ documentsData, highlightDocument, onClearHighlight
   const [previewTitle, setPreviewTitle] = React5.useState(null);
   const backendDocuments = Array.isArray(documentsData?.documents) ? documentsData.documents : [];
   const liveDocs = backendDocuments.filter(
-    (d) => Boolean(d.documentUrl) && LIVE_TITLE_PATTERNS.some((rx) => rx.test(d.title))
+    (d) => Boolean(d.documentUrl) && isSafeUrl(d.documentUrl) && LIVE_TITLE_PATTERNS.some((rx) => rx.test(d.title))
   );
   const comingSoonDocs = COMING_SOON_TITLES.filter(
     (title) => !liveDocs.some((d) => d.title.toLowerCase().includes(title.toLowerCase()) || title.toLowerCase().includes(d.title.toLowerCase()))