@loafmarkets/ui 0.1.409 → 0.1.411

package/dist/index.mjs

@@ -1615,12 +1615,23 @@ var StatusDot = styled10.span`
   width: 6px;
   height: 6px;
   border-radius: 50%;
-  background: #0ecb81;
   flex-shrink: 0;
-  animation: ${breathe} 3s ease-in-out infinite;
+
+  ${({ $state }) => $state === "active" ? css`
+          background: #0ecb81;
+          animation: ${breathe} 3s ease-in-out infinite;
+        ` : $state === "reduced" ? css`
+            background: #e6c87e;
+            box-shadow: 0 0 4px rgba(240, 185, 11, 0.4);
+          ` : $state === "free" ? css`
+              background: #f6465d;
+              box-shadow: 0 0 4px rgba(246, 70, 93, 0.4);
+            ` : css`
+              background: rgba(255, 255, 255, 0.3);
+            `}
 `;
 var LoafLiquidityBadge = React5.forwardRef(
-  ({ className, isGlowing, onClick, children, ...props }, ref) => {
+  ({ className, isGlowing, status = "unknown", onClick, children, ...props }, ref) => {
     return /* @__PURE__ */ jsxs(
       LogoContainer,
       {
@@ -1631,11 +1642,11 @@ var LoafLiquidityBadge = React5.forwardRef(
         role: onClick ? "button" : void 0,
         ...props,
         children: [
-          /* @__PURE__ */ jsxs(LogoText, { children: [
+          /* @__PURE__ */ jsxs(LogoText, { className: "loaf-ll-label", children: [
             /* @__PURE__ */ jsx(LoafLogoImage, { src: Loaf_logo_Banner_default, alt: "Loaf" }),
             /* @__PURE__ */ jsx(LiquidityText, { children: children ?? "Liquidity" })
           ] }),
-          /* @__PURE__ */ jsx(StatusDot, {})
+          /* @__PURE__ */ jsx(StatusDot, { $state: status, "data-liquidity": status })
         ]
       }
     );
@@ -1882,13 +1893,21 @@ var Orderbook = React5.forwardRef(
     isLoading = false,
     onPriceClick,
     onLoafLiquidityClick,
+    liquidityStatus,
     tradeExplorerUrl,
     maxLevels,
     fillHeight = false,
     className,
     ...props
   }, ref) => {
-    const resolvedRightHeader = rightHeader ?? /* @__PURE__ */ jsx(LoafLiquidityBadge, { className: "text-[0.6rem] orderbook-ll-badge", onClick: onLoafLiquidityClick });
+    const resolvedRightHeader = rightHeader ?? /* @__PURE__ */ jsx(
+      LoafLiquidityBadge,
+      {
+        className: "text-[0.6rem] orderbook-ll-badge",
+        onClick: onLoafLiquidityClick,
+        status: liquidityStatus
+      }
+    );
     const [tab, setTabState] = React5.useState(defaultTab);
     const setTab = setTabState;
     const effectiveTab = showTradesTab ? tab : "orderbook";
@@ -2644,6 +2663,22 @@ var PropertyTour = React5.forwardRef(
   }
 );
 PropertyTour.displayName = "PropertyTour";
+
+// src/lib/isSafeUrl.ts
+var CONTROL_CHARS = /[\u0000-\u001F\u007F]/g;
+function isSafeUrl(url) {
+  if (!url) return false;
+  const cleaned = url.replace(CONTROL_CHARS, "").replace(/\\/g, "/").trim();
+  if (cleaned === "") return false;
+  if (cleaned.startsWith("//")) return false;
+  if (cleaned.startsWith("/")) return true;
+  try {
+    const { protocol } = new URL(cleaned);
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 var ITEMS_PER_PAGE = 5;
 var ITEMS_PER_PAGE_MOBILE = 5;
 var ensureAnimationsInjected = () => {
@@ -2839,7 +2874,7 @@ function NewsArticleModal({ item, onClose }) {
             ] }),
             /* @__PURE__ */ jsx("div", { style: { height: "1px", background: "rgba(255,255,255,0.08)", marginBottom: "1.25rem" } }),
             item.summary ? /* @__PURE__ */ jsx("p", { style: { fontSize: "0.875rem", color: "rgba(255,255,255,0.8)", lineHeight: 1.75, margin: 0 }, children: item.summary }) : /* @__PURE__ */ jsx("p", { style: { fontSize: "0.8rem", color: "rgba(255,255,255,0.35)", fontStyle: "italic", margin: 0 }, children: "Summary not available for this article." }),
-            item.url && /* @__PURE__ */ jsx("div", { style: { marginTop: "1.25rem", paddingTop: "1rem", borderTop: "1px solid rgba(255,255,255,0.08)" }, children: /* @__PURE__ */ jsxs(
+            item.url && isSafeUrl(item.url) && /* @__PURE__ */ jsx("div", { style: { marginTop: "1.25rem", paddingTop: "1rem", borderTop: "1px solid rgba(255,255,255,0.08)" }, children: /* @__PURE__ */ jsxs(
               "a",
               {
                 href: item.url,
@@ -6615,6 +6650,16 @@ var PropertySubheader = React5.forwardRef(
   }
 );
 PropertySubheader.displayName = "PropertySubheader";
+
+// src/lib/isTrustedTransakOrigin.ts
+function isTrustedTransakOrigin(eventOrigin, widgetUrl) {
+  if (!widgetUrl) return false;
+  try {
+    return eventOrigin === new URL(widgetUrl).origin;
+  } catch {
+    return false;
+  }
+}
 var DEFAULT_LOGO_SRC = Loaf_logo_Banner_default;
 var DEFAULT_LOGO_ALT = "Loaf";
 var OTP_INPUT_LENGTH = 6;
@@ -6755,7 +6800,7 @@ var LoginPopup = ({
   useEffect(() => {
     if (!transakWidgetUrl) return;
     const handleTransakMessage = (event) => {
-      if (!event.origin.includes("transak.com") && !event.origin.includes("global.transak.com")) {
+      if (!isTrustedTransakOrigin(event.origin, transakWidgetUrl)) {
         return;
       }
       try {
@@ -12272,7 +12317,7 @@ function PropertyDocuments({ documentsData, highlightDocument, onClearHighlight
   const [previewTitle, setPreviewTitle] = useState(null);
   const backendDocuments = Array.isArray(documentsData?.documents) ? documentsData.documents : [];
   const liveDocs = backendDocuments.filter(
-    (d) => Boolean(d.documentUrl) && LIVE_TITLE_PATTERNS.some((rx) => rx.test(d.title))
+    (d) => Boolean(d.documentUrl) && isSafeUrl(d.documentUrl) && LIVE_TITLE_PATTERNS.some((rx) => rx.test(d.title))
   );
   const comingSoonDocs = COMING_SOON_TITLES.filter(
     (title) => !liveDocs.some((d) => d.title.toLowerCase().includes(title.toLowerCase()) || title.toLowerCase().includes(d.title.toLowerCase()))