dev main sync

src/components/Create/Create.tsx

@@ -121,7 +121,7 @@ export const Create = () => {
     }, [address])
 
     return (
-        <div className="card">
+        <div className="card max-w-lg">
             {createElement(_consts.CREATE_SCREEN_MAP[step.screen].comp, {
                 onPrev: handleOnPrev,
                 onNext: handleOnNext,

src/components/Create/Link/Input.view.tsx

@@ -265,7 +265,7 @@ export const CreateLinkInputView = ({
     }, [_tokenValue, inputDenomination])
 
     return (
-        <div className="flex w-full flex-col items-center justify-center gap-6 text-center">
+          <div className="space-y-6 text-center">
             <div className="space-y-2">
                 <h2
                     className="max-h-[92px] w-full overflow-hidden text-h2"
@@ -277,7 +277,7 @@ export const CreateLinkInputView = ({
                           ? `Send to ${recipient.name?.endsWith('.eth') ? recipient.name : shortenAddressLong(recipient.address ?? '')}`
                           : `Send to ${recipient.name}`}
                 </h2>
-                <div className="max-w-96 text-center">
+                <div className="max-w-96 mx-auto text-center">
                     {createType === 'link' &&
                         'Deposit some crypto to the link, no need for wallet addresses. Send the link to the recipient. They will be able to claim the funds in any token on any chain from the link.'}
                     {createType === 'email_link' &&

src/utils/cashout.utils.ts

@@ -5,17 +5,35 @@ import countries from 'i18n-iso-countries'
 import { generateKeysFromString } from '@squirrel-labs/peanut-sdk'
 import { getSquidRouteRaw } from '@squirrel-labs/peanut-sdk'
 
+const ALLOWED_PARENT_DOMAINS = ['intersend.io', 'app.intersend.io']
+
+// Helper function to check if the app is running within an allowed iframe
+const isInAllowedFrame = (): boolean => {
+    if (window.location === window.parent.location) return false
+
+    // Check ancestor origins (modern browsers)
+    if (window.location.ancestorOrigins?.length) {
+        return ALLOWED_PARENT_DOMAINS.some((domain) => window.location.ancestorOrigins[0].includes(domain))
+    }
+
+    // Fallback to referrer check
+    return ALLOWED_PARENT_DOMAINS.some((domain) => document.referrer.includes(domain))
+}
+
 export const convertPersonaUrl = (url: string) => {
     const parsedUrl = new URL(url)
 
     const templateId = parsedUrl.searchParams.get('inquiry-template-id')
     const iqtToken = parsedUrl.searchParams.get('fields[iqt_token]')
     const developerId = parsedUrl.searchParams.get('fields[developer_id]')
     const referenceId = parsedUrl.searchParams.get('reference-id')
-    const origin = encodeURIComponent(window.location.origin)
+
+    // Use parent frame origin if in allowed iframe, otherwise use current origin
+    const origin = encodeURIComponent(isInAllowedFrame() ? new URL(document.referrer).origin : window.location.origin)
 
     return `https://bridge.withpersona.com/widget?environment=production&inquiry-template-id=${templateId}&fields[iqt_token=${iqtToken}&iframe-origin=${origin}&redirect-uri=${origin}&fields[developer_id]=${developerId}&reference-id=${referenceId}`
 }
+
 const fetchUser = async (accountIdentifier: string): Promise<any> => {
     const response = await fetch(`/api/peanut/user/fetch-user?accountIdentifier=${accountIdentifier}`, {
         method: 'GET',