@whop/elements 1.2.0 → 1.4.0

package/checkout.d.cts

@@ -152,10 +152,10 @@ export interface CheckoutElementCreateOptions {
  */
 export interface ExpressCheckoutElementProps {
 	/**
-	 * Which wallets may render — a filter over what the buyer’s device actually offers. The element never shows a wallet the device, the served matrix, or the checkout’s payment method configuration cannot back, and the render order stays best-native-first whatever order this lists. An empty list renders nothing (warned in dev builds). Both wallets need the page’s domain verified as a [payment method domain](/api-reference/beta/payment-method-domains/payment-method-domain) — first-party whop.com pages are pre-approved; on any other site, register and verify the domain or the buttons stay hidden. Offering Google Pay on your own site is subject to the [Google Pay API Terms of Service](https://payments.developers.google.com/terms/sellertos).
-	 * @default ["apple_pay","google_pay"]
+	 * Which wallets may render — a filter over what the buyer’s device and the seller actually offer. The element never shows a wallet the device, the served matrix, or the checkout’s payment method configuration cannot back, and the render order stays best-native-first, with PayPal last, whatever order this lists. An empty list renders nothing (warned in dev builds). Every wallet needs the page’s domain verified as a [payment method domain](/api-reference/beta/payment-method-domains/payment-method-domain) — first-party whop.com pages are pre-approved; on any other site, register and verify the domain or the buttons stay hidden. Offering Google Pay on your own site is subject to the [Google Pay API Terms of Service](https://payments.developers.google.com/terms/sellertos).
+	 * @default ["apple_pay","google_pay","paypal_express"]
 	 */
-	wallets?: ("apple_pay" | "google_pay")[];
+	wallets?: ("apple_pay" | "google_pay" | "paypal_express")[];
 	/**
 	 * How the buttons stack. `auto` follows the element’s own container — stacked in narrow containers, side by side in wide ones; `horizontal` and `vertical` force one arrangement.
 	 * @default "auto"
@@ -193,10 +193,10 @@ export interface ExpressCheckoutElementHandle {
  */
 export interface ExpressCheckoutElementCreateOptions {
 	/**
-	 * Which wallets may render — a filter over what the buyer’s device actually offers. The element never shows a wallet the device, the served matrix, or the checkout’s payment method configuration cannot back, and the render order stays best-native-first whatever order this lists. An empty list renders nothing (warned in dev builds). Both wallets need the page’s domain verified as a [payment method domain](/api-reference/beta/payment-method-domains/payment-method-domain) — first-party whop.com pages are pre-approved; on any other site, register and verify the domain or the buttons stay hidden. Offering Google Pay on your own site is subject to the [Google Pay API Terms of Service](https://payments.developers.google.com/terms/sellertos).
-	 * @default ["apple_pay","google_pay"]
+	 * Which wallets may render — a filter over what the buyer’s device and the seller actually offer. The element never shows a wallet the device, the served matrix, or the checkout’s payment method configuration cannot back, and the render order stays best-native-first, with PayPal last, whatever order this lists. An empty list renders nothing (warned in dev builds). Every wallet needs the page’s domain verified as a [payment method domain](/api-reference/beta/payment-method-domains/payment-method-domain) — first-party whop.com pages are pre-approved; on any other site, register and verify the domain or the buttons stay hidden. Offering Google Pay on your own site is subject to the [Google Pay API Terms of Service](https://payments.developers.google.com/terms/sellertos).
+	 * @default ["apple_pay","google_pay","paypal_express"]
 	 */
-	wallets?: ("apple_pay" | "google_pay")[];
+	wallets?: ("apple_pay" | "google_pay" | "paypal_express")[];
 	/**
 	 * How the buttons stack. `auto` follows the element’s own container — stacked in narrow containers, side by side in wide ones; `horizontal` and `vertical` force one arrangement.
 	 * @default "auto"
@@ -227,7 +227,7 @@ export interface CheckoutHandle {
 	 */
 	create(name: "checkout", options?: CheckoutElementCreateOptions): CheckoutElementHandle;
 	/**
-	 * One-press Apple Pay and Google Pay buttons for a checkout — the OS payment sheet collects whatever the session still needs (the buyer's email, a phone number where the seller collects one, a shipping address for physical goods, and in Apple Pay a promo code where the seller offers entry) and one press finishes the purchase. It shares the checkout's entry slot with the full checkout element, so a handle mounts exactly one of the two: this button alone where the purchase is simple enough for a sheet to finish, or the full checkout surface for everything else. Renders only the wallets the buyer's device can actually pay with — and the checkout's own payment method configuration allows — using the served button art, and renders nothing where no wallet is available. Both wallets require the page's domain to be a verified payment method domain: first-party whop.com pages are pre-approved, and any other site must register its domain through the Payment Method Domains API before either button renders there. Offering Google Pay on your own site is subject to the Google Pay API Terms of Service. A checkout the sheet cannot honestly finish — a waitlist join, a transfer, a form question only a page can ask — refuses loudly instead of rendering a doomed button.
+	 * One-press Apple Pay, Google Pay and PayPal buttons for a checkout — the wallet collects whatever the session still needs (the buyer's email, a shipping address for physical goods, a phone number where the seller collects one in Apple Pay and Google Pay, and in Apple Pay a promo code where the seller offers entry) and one press finishes the purchase. It shares the checkout's entry slot with the full checkout element, so a handle mounts exactly one of the two: this button alone where the purchase is simple enough for a sheet to finish, or the full checkout surface for everything else. Renders only the wallets the buyer's device can actually pay with — and the checkout's own payment method configuration allows — using the served button art, and renders nothing where no wallet is available. PayPal appears on one-time purchases where the seller accepts it and opens in its own window. All three wallets require the page's domain to be a verified payment method domain: first-party whop.com pages are pre-approved, and any other site must register its domain through the Payment Method Domains API before any of these buttons renders there. Offering Google Pay on your own site is subject to the Google Pay API Terms of Service. A checkout the sheet cannot honestly finish — a waitlist join, a transfer, a form question only a page can ask — refuses loudly instead of rendering a doomed button.
 	 * Exclusive slot `entry`. Mount exactly one of: checkout | expressCheckout.
 	 */
 	create(name: "expressCheckout", options?: ExpressCheckoutElementCreateOptions): ExpressCheckoutElementHandle;

package/checkout.d.ts

@@ -152,10 +152,10 @@ export interface CheckoutElementCreateOptions {
  */
 export interface ExpressCheckoutElementProps {
 	/**
-	 * Which wallets may render — a filter over what the buyer’s device actually offers. The element never shows a wallet the device, the served matrix, or the checkout’s payment method configuration cannot back, and the render order stays best-native-first whatever order this lists. An empty list renders nothing (warned in dev builds). Both wallets need the page’s domain verified as a [payment method domain](/api-reference/beta/payment-method-domains/payment-method-domain) — first-party whop.com pages are pre-approved; on any other site, register and verify the domain or the buttons stay hidden. Offering Google Pay on your own site is subject to the [Google Pay API Terms of Service](https://payments.developers.google.com/terms/sellertos).
-	 * @default ["apple_pay","google_pay"]
+	 * Which wallets may render — a filter over what the buyer’s device and the seller actually offer. The element never shows a wallet the device, the served matrix, or the checkout’s payment method configuration cannot back, and the render order stays best-native-first, with PayPal last, whatever order this lists. An empty list renders nothing (warned in dev builds). Every wallet needs the page’s domain verified as a [payment method domain](/api-reference/beta/payment-method-domains/payment-method-domain) — first-party whop.com pages are pre-approved; on any other site, register and verify the domain or the buttons stay hidden. Offering Google Pay on your own site is subject to the [Google Pay API Terms of Service](https://payments.developers.google.com/terms/sellertos).
+	 * @default ["apple_pay","google_pay","paypal_express"]
 	 */
-	wallets?: ("apple_pay" | "google_pay")[];
+	wallets?: ("apple_pay" | "google_pay" | "paypal_express")[];
 	/**
 	 * How the buttons stack. `auto` follows the element’s own container — stacked in narrow containers, side by side in wide ones; `horizontal` and `vertical` force one arrangement.
 	 * @default "auto"
@@ -193,10 +193,10 @@ export interface ExpressCheckoutElementHandle {
  */
 export interface ExpressCheckoutElementCreateOptions {
 	/**
-	 * Which wallets may render — a filter over what the buyer’s device actually offers. The element never shows a wallet the device, the served matrix, or the checkout’s payment method configuration cannot back, and the render order stays best-native-first whatever order this lists. An empty list renders nothing (warned in dev builds). Both wallets need the page’s domain verified as a [payment method domain](/api-reference/beta/payment-method-domains/payment-method-domain) — first-party whop.com pages are pre-approved; on any other site, register and verify the domain or the buttons stay hidden. Offering Google Pay on your own site is subject to the [Google Pay API Terms of Service](https://payments.developers.google.com/terms/sellertos).
-	 * @default ["apple_pay","google_pay"]
+	 * Which wallets may render — a filter over what the buyer’s device and the seller actually offer. The element never shows a wallet the device, the served matrix, or the checkout’s payment method configuration cannot back, and the render order stays best-native-first, with PayPal last, whatever order this lists. An empty list renders nothing (warned in dev builds). Every wallet needs the page’s domain verified as a [payment method domain](/api-reference/beta/payment-method-domains/payment-method-domain) — first-party whop.com pages are pre-approved; on any other site, register and verify the domain or the buttons stay hidden. Offering Google Pay on your own site is subject to the [Google Pay API Terms of Service](https://payments.developers.google.com/terms/sellertos).
+	 * @default ["apple_pay","google_pay","paypal_express"]
 	 */
-	wallets?: ("apple_pay" | "google_pay")[];
+	wallets?: ("apple_pay" | "google_pay" | "paypal_express")[];
 	/**
 	 * How the buttons stack. `auto` follows the element’s own container — stacked in narrow containers, side by side in wide ones; `horizontal` and `vertical` force one arrangement.
 	 * @default "auto"
@@ -227,7 +227,7 @@ export interface CheckoutHandle {
 	 */
 	create(name: "checkout", options?: CheckoutElementCreateOptions): CheckoutElementHandle;
 	/**
-	 * One-press Apple Pay and Google Pay buttons for a checkout — the OS payment sheet collects whatever the session still needs (the buyer's email, a phone number where the seller collects one, a shipping address for physical goods, and in Apple Pay a promo code where the seller offers entry) and one press finishes the purchase. It shares the checkout's entry slot with the full checkout element, so a handle mounts exactly one of the two: this button alone where the purchase is simple enough for a sheet to finish, or the full checkout surface for everything else. Renders only the wallets the buyer's device can actually pay with — and the checkout's own payment method configuration allows — using the served button art, and renders nothing where no wallet is available. Both wallets require the page's domain to be a verified payment method domain: first-party whop.com pages are pre-approved, and any other site must register its domain through the Payment Method Domains API before either button renders there. Offering Google Pay on your own site is subject to the Google Pay API Terms of Service. A checkout the sheet cannot honestly finish — a waitlist join, a transfer, a form question only a page can ask — refuses loudly instead of rendering a doomed button.
+	 * One-press Apple Pay, Google Pay and PayPal buttons for a checkout — the wallet collects whatever the session still needs (the buyer's email, a shipping address for physical goods, a phone number where the seller collects one in Apple Pay and Google Pay, and in Apple Pay a promo code where the seller offers entry) and one press finishes the purchase. It shares the checkout's entry slot with the full checkout element, so a handle mounts exactly one of the two: this button alone where the purchase is simple enough for a sheet to finish, or the full checkout surface for everything else. Renders only the wallets the buyer's device can actually pay with — and the checkout's own payment method configuration allows — using the served button art, and renders nothing where no wallet is available. PayPal appears on one-time purchases where the seller accepts it and opens in its own window. All three wallets require the page's domain to be a verified payment method domain: first-party whop.com pages are pre-approved, and any other site must register its domain through the Payment Method Domains API before any of these buttons renders there. Offering Google Pay on your own site is subject to the Google Pay API Terms of Service. A checkout the sheet cannot honestly finish — a waitlist join, a transfer, a form question only a page can ask — refuses loudly instead of rendering a doomed button.
 	 * Exclusive slot `entry`. Mount exactly one of: checkout | expressCheckout.
 	 */
 	create(name: "expressCheckout", options?: ExpressCheckoutElementCreateOptions): ExpressCheckoutElementHandle;

package/index.cjs

@@ -22,18 +22,27 @@ var npm_loader_exports = {};
 __export(npm_loader_exports, {
   SDK_URL: () => SDK_URL,
   WHOP_ELEMENTS_LOCALES: () => WHOP_ELEMENTS_LOCALES,
+  contentSecurityPolicy: () => contentSecurityPolicy,
   loadWhop: () => loadWhop,
   preloadHints: () => preloadHints
 });
 module.exports = __toCommonJS(npm_loader_exports);
 
+// <define:__WHOP_ELEMENTS_API_ORIGINS__>
+var define_WHOP_ELEMENTS_API_ORIGINS_default = { production: "https://api.whop.com", sandbox: "https://sandbox-api.whop.com" };
+
 // <define:__WHOP_ELEMENTS_LOCALES__>
 var define_WHOP_ELEMENTS_LOCALES_default = ["en", "es", "zh", "nl", "pt", "de", "hu", "it", "fr", "ja", "pl", "tr"];
 
+// <define:__WHOP_ELEMENTS_PAGE_REQUIREMENTS__>
+var define_WHOP_ELEMENTS_PAGE_REQUIREMENTS_default = { wallets: { production: { sources: { "frame-src": ["https://checkout.paypal.com", "https://assets.braintreegateway.com", "https://www.paypal.com"], "script-src": ["https://pay.google.com", "https://applepay.cdn-apple.com", "https://js.braintreegateway.com", "https://www.paypal.com", "https://c.paypal.com"], "connect-src": ["https://pay.google.com", "https://google.com", "https://account.google.com", "https://www.google.com", "https://api.basistheory.com", "https://payments.braintree-api.com", "https://api.braintreegateway.com", "https://api-m.paypal.com", "https://www.paypal.com"], "img-src": ["https://www.paypalobjects.com"] }, hints: [{ rel: "preload", href: "https://pay.google.com/gp/p/js/pay.js", as: "script" }, { rel: "preload", href: "https://applepay.cdn-apple.com/jsapi/1.latest/apple-pay-sdk.js", as: "script", crossOrigin: "anonymous" }, { rel: "preload", href: "https://js.braintreegateway.com/web/3.146.0/js/paypal-checkout-v6.min.js", as: "script" }, { rel: "preload", href: "https://www.paypal.com/web-sdk/v6/core", as: "script" }, { rel: "preconnect", href: "https://api.basistheory.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://payments.braintree-api.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://api.braintreegateway.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://checkout.paypal.com" }, { rel: "preconnect", href: "https://assets.braintreegateway.com" }, { rel: "preconnect", href: "https://c.paypal.com" }, { rel: "preconnect", href: "https://api-m.paypal.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://www.paypal.com", crossOrigin: "anonymous" }] }, sandbox: { sources: { "frame-src": ["https://checkout.paypal.com", "https://assets.braintreegateway.com", "https://www.sandbox.paypal.com"], "script-src": ["https://pay.google.com", "https://applepay.cdn-apple.com", "https://js.braintreegateway.com", "https://www.sandbox.paypal.com", "https://c.paypal.com"], "connect-src": ["https://pay.google.com", "https://google.com", "https://account.google.com", "https://www.google.com", "https://api.basistheory.com", "https://payments.sandbox.braintree-api.com", "https://api.sandbox.braintreegateway.com", "https://api-m.sandbox.paypal.com", "https://www.sandbox.paypal.com"], "img-src": ["https://www.paypalobjects.com"] }, hints: [{ rel: "preload", href: "https://pay.google.com/gp/p/js/pay.js", as: "script" }, { rel: "preload", href: "https://applepay.cdn-apple.com/jsapi/1.latest/apple-pay-sdk.js", as: "script", crossOrigin: "anonymous" }, { rel: "preload", href: "https://js.braintreegateway.com/web/3.146.0/js/paypal-checkout-v6.min.js", as: "script" }, { rel: "preload", href: "https://www.sandbox.paypal.com/web-sdk/v6/core", as: "script" }, { rel: "preconnect", href: "https://api.basistheory.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://payments.sandbox.braintree-api.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://api.sandbox.braintreegateway.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://checkout.paypal.com" }, { rel: "preconnect", href: "https://assets.braintreegateway.com" }, { rel: "preconnect", href: "https://c.paypal.com" }, { rel: "preconnect", href: "https://api-m.sandbox.paypal.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://www.sandbox.paypal.com", crossOrigin: "anonymous" }] } } };
+
 // ../../packages/elements-codegen/src/cli/build/npm-loader.ts
 var ORIGIN = "https://cdn.whop.com";
 var SDK_URL = "https://cdn.whop.com/elements/amber/elements.js";
 var WHOP_ELEMENTS_LOCALES = define_WHOP_ELEMENTS_LOCALES_default;
+var API_ORIGINS = define_WHOP_ELEMENTS_API_ORIGINS_default;
+var PAGE_REQUIREMENTS = define_WHOP_ELEMENTS_PAGE_REQUIREMENTS_default;
 var TAG = "script[data-whop-elements]";
 var resolved = null;
 function withRetry(promise) {
@@ -131,9 +140,187 @@ function watch(w, script, created) {
   }
   return script.__whopReady;
 }
-function preloadHints() {
-  return [
-    { rel: "preconnect", href: ORIGIN },
-    { rel: "preload", href: SDK_URL, as: "script" }
-  ];
+function environmentOf(environment) {
+  if (environment === void 0 || environment === "production") return "production";
+  if (environment === "sandbox") return "sandbox";
+  throw new Error(`unknown environment ${JSON.stringify(environment)}: expected "production" or "sandbox"`);
+}
+function apiOrigin(environment) {
+  return API_ORIGINS[environmentOf(environment)];
+}
+function escapeAttribute(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+var PreloadHints = class extends Array {
+  // map/flatMap produce plain arrays: rendered <link> tags are not a hint list. The methods below
+  // keep hints as hints, so a narrowed list still has toLinkHeader() and friends.
+  static get [Symbol.species]() {
+    return Array;
+  }
+  filter(predicate, thisArg) {
+    return hintsFrom(super.filter(predicate, thisArg));
+  }
+  slice(start, end) {
+    return hintsFrom(super.slice(start, end));
+  }
+  concat(...items) {
+    return hintsFrom(super.concat(...items));
+  }
+  // copies sorted or reversed without Array.prototype.toSorted/toReversed, which older browsers lack.
+  toSorted(compareFn) {
+    return hintsFrom(this).sort(compareFn);
+  }
+  toReversed() {
+    const hints = hintsFrom(this);
+    hints.reverse();
+    return hints;
+  }
+  toLinkHeader() {
+    return this.map((h) => `<${h.href}>; rel=${h.rel}${h.as ? `; as=${h.as}` : ""}${h.crossOrigin ? `; crossorigin=${h.crossOrigin}` : ""}`).join(", ");
+  }
+  toHtml() {
+    return this.map((h) => `<link rel="${escapeAttribute(h.rel)}" href="${escapeAttribute(h.href)}"${h.as ? ` as="${escapeAttribute(h.as)}"` : ""}${h.crossOrigin ? ` crossorigin="${h.crossOrigin}"` : ""}>`).join("\n");
+  }
+  applyTo(headers) {
+    const value = this.toLinkHeader();
+    if (value) headers.append("Link", value);
+  }
+};
+function hintsFrom(items) {
+  const hints = new PreloadHints();
+  for (const item of items) hints.push(item);
+  return hints;
+}
+function preloadHints(options = {}) {
+  const hints = new PreloadHints();
+  const add = (hint) => {
+    if (!hints.some((h) => h.rel === hint.rel && h.href === hint.href && h.crossOrigin === hint.crossOrigin)) hints.push(hint);
+  };
+  add({ rel: "preconnect", href: ORIGIN });
+  add({ rel: "preload", href: SDK_URL, as: "script" });
+  add({ rel: "preconnect", href: apiOrigin(options.environment), crossOrigin: "anonymous" });
+  const environment = environmentOf(options.environment);
+  for (const [group, byEnvironment] of Object.entries(PAGE_REQUIREMENTS)) {
+    if (options[group] === false) continue;
+    for (const hint of byEnvironment[environment].hints) add(hint);
+  }
+  return hints;
+}
+var FALLBACKS = { "frame-src": ["child-src", "default-src"], "script-src": ["default-src"], "connect-src": ["default-src"], "img-src": ["default-src"] };
+var POLICY_HEADERS = ["Content-Security-Policy", "Content-Security-Policy-Report-Only"];
+var camelToKebab = (key) => key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`);
+var kebabToCamel = (key) => key.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+function addSources(values, sources) {
+  const out = values.filter((v) => typeof v !== "string" || v.toLowerCase() !== "'none'");
+  for (const source of sources) if (!out.includes(source)) out.push(source);
+  return out;
+}
+function mergeDirectives(directives, sources) {
+  for (const [name, list] of Object.entries(sources)) {
+    if (list.length === 0) continue;
+    const own = directives.find((d) => d.name === name);
+    const elem = name === "script-src" ? directives.find((d) => d.name === "script-src-elem") : void 0;
+    if (elem) elem.values = addSources(elem.values, list);
+    if (own) {
+      own.values = addSources(own.values, list);
+      continue;
+    }
+    const fallback = FALLBACKS[name].map((f) => directives.find((d) => d.name === f)).find((d) => d !== void 0);
+    if (fallback) directives.push({ name, values: addSources([...fallback.values], list) });
+  }
+}
+function parsePolicy(policy) {
+  const directives = [];
+  for (const part of policy.split(";")) {
+    const [name, ...values] = part.trim().split(/\s+/).filter(Boolean);
+    if (name && !directives.some((d) => d.name === name.toLowerCase())) directives.push({ name: name.toLowerCase(), values });
+  }
+  return directives;
+}
+var serializePolicy = (directives) => directives.map((d) => [d.name, ...d.values].join(" ")).join("; ");
+var HELMET_DEFAULTS = { "script-src": ["'self'"], "img-src": ["'self'", "data:"] };
+function mergeHelmetDirectives(policy, sources) {
+  const keys = Object.keys(policy);
+  const camel = keys.length > 0 && keys.every((k) => !k.includes("-"));
+  const keyOf = (name) => keys.find((k) => camelToKebab(k) === name);
+  const read = /* @__PURE__ */ new Map();
+  const valuesOf = (key) => {
+    if (key === void 0) return void 0;
+    const seen = read.get(key);
+    if (seen) return [...seen];
+    const value = policy[key];
+    const values = typeof value === "string" ? value.split(/\s+/).filter(Boolean) : value != null && typeof value[Symbol.iterator] === "function" ? [...value] : void 0;
+    if (values) read.set(key, values);
+    return values && [...values];
+  };
+  const isIterator = (value) => value != null && typeof value.next === "function" && value[Symbol.iterator]?.() === value;
+  const shaped = (key, values) => {
+    const value = policy[key];
+    if (typeof value === "string") return values.join(" ");
+    if (value instanceof Set) return new Set(values);
+    return isIterator(value) ? values.values() : values;
+  };
+  const out = { ...policy };
+  for (const [name, list] of Object.entries(sources)) {
+    if (list.length === 0) continue;
+    const ownKey = keyOf(name);
+    const own = valuesOf(ownKey);
+    const helmetDefault = ownKey !== void 0 && policy[ownKey] === null ? void 0 : HELMET_DEFAULTS[name];
+    const seed = own ?? (helmetDefault ? [...helmetDefault] : FALLBACKS[name].map((f) => valuesOf(keyOf(f))).find((v) => v !== void 0)) ?? ["'self'"];
+    const merged = addSources(seed, list);
+    const key = ownKey ?? (camel ? kebabToCamel(name) : name);
+    out[key] = shaped(key, merged);
+    if (name === "script-src") {
+      const elemKey = keyOf("script-src-elem");
+      const elem = valuesOf(elemKey);
+      if (elemKey !== void 0 && elem) out[elemKey] = shaped(elemKey, addSources(elem, list));
+    }
+  }
+  for (const [key, values] of read) if (out[key] === policy[key] && isIterator(policy[key])) out[key] = values.values();
+  return out;
+}
+var ContentSecurityPolicy = class {
+  directives;
+  constructor(directives) {
+    this.directives = Object.freeze({
+      "frame-src": Object.freeze([...directives["frame-src"]]),
+      "script-src": Object.freeze([...directives["script-src"]]),
+      "connect-src": Object.freeze([...directives["connect-src"]]),
+      "img-src": Object.freeze([...directives["img-src"]])
+    });
+  }
+  // A directive with no sources is left out: written bare, it would allow nothing.
+  toString() {
+    return serializePolicy(
+      Object.entries(this.directives).filter(([, values]) => values.length > 0).map(([name, values]) => ({ name, values: [...values] }))
+    );
+  }
+  merge(policy) {
+    if (typeof policy !== "string") return mergeHelmetDirectives(policy, this.directives);
+    return policy.split(",").map((one) => {
+      const directives = parsePolicy(one);
+      mergeDirectives(directives, this.directives);
+      return serializePolicy(directives);
+    }).join(", ");
+  }
+  applyTo(headers) {
+    for (const name of POLICY_HEADERS) {
+      const value = headers.get(name);
+      if (value !== null) headers.set(name, this.merge(value));
+    }
+  }
+  toHtml(policy) {
+    return `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(this.merge(policy))}">`;
+  }
+};
+function contentSecurityPolicy(options = {}) {
+  const directives = { "frame-src": [ORIGIN], "script-src": [ORIGIN], "connect-src": [apiOrigin(options.environment)], "img-src": [] };
+  const environment = environmentOf(options.environment);
+  for (const [group, byEnvironment] of Object.entries(PAGE_REQUIREMENTS)) {
+    if (options[group] === false) continue;
+    for (const [name, list] of Object.entries(byEnvironment[environment].sources)) {
+      for (const source of list) if (!directives[name].includes(source)) directives[name].push(source);
+    }
+  }
+  return new ContentSecurityPolicy(directives);
 }

package/index.d.cts

@@ -61,8 +61,71 @@ export type WhopLoad = Promise<WhopConstructor> & { retry(): WhopLoad };
 /** Load the hosted SDK: injects the `<script data-whop-elements>` tag once and resolves the global constructor. Safe to call any number of times: one script, one shared promise. A failed load is held, so every later call returns the same rejected promise and nothing retries on its own; call `retry()` on it to load again. */
 export declare function loadWhop(): WhopLoad;
 
-/** Resource hints (preconnect/preload) for the hosted SDK. Render them into `<head>` to start the fetch before `loadWhop()` runs. */
-export declare function preloadHints(): { rel: string; href: string; as?: string }[];
+/** One `<link>` hint: render it into `<head>`, or send the list as a `Link` header. */
+export interface PreloadHint {
+	rel: string;
+	href: string;
+	as?: string;
+	crossOrigin?: "anonymous";
+}
+
+/** Which connections `preloadHints()` warms beyond the hosted SDK. Unknown keys are ignored. */
+export interface PreloadHintsOptions {
+	/** Which environment to warm for: the Whop API, and each provider's sandbox hosts in sandbox. Defaults to production. */
+	environment?: NonNullable<WhopGlobalConfig["environment"]>;
+	/**
+	 * Apple Pay, Google Pay, and PayPal: preloads its scripts and warms the connections it opens from your page. Pass false on pages that don't show it.
+	 */
+	wallets?: boolean;
+}
+
+/** The hints `preloadHints()` returns: an array of {@link PreloadHint}, plus ways to apply it. `filter`, `slice`, `concat`, `toSorted` and `toReversed` keep these methods; `map` returns a plain array. */
+export interface WhopPreloadHints<T extends PreloadHint = PreloadHint> extends Array<T> {
+	filter<S extends T>(predicate: (value: T, index: number, array: T[]) => value is S, thisArg?: unknown): WhopPreloadHints<S>;
+	filter(predicate: (value: T, index: number, array: T[]) => unknown, thisArg?: unknown): WhopPreloadHints<T>;
+	slice(start?: number, end?: number): WhopPreloadHints<T>;
+	concat(...items: (T | ConcatArray<T>)[]): WhopPreloadHints<T>;
+	toSorted(compareFn?: (a: T, b: T) => number): WhopPreloadHints<T>;
+	toReversed(): WhopPreloadHints<T>;
+	/** The hints as one `Link` header value (servers and CDNs can turn it into 103 Early Hints). */
+	toLinkHeader(): string;
+	/** The hints as `<link>` tags, for server-rendered templates. */
+	toHtml(): string;
+	/** Append the hints to a response's `Link` header. */
+	applyTo(headers: Headers): void;
+}
+
+/** Resource hints (preconnect/preload) for the hosted SDK, the Whop API, and the scripts and connections elements use on your page. Render them into `<head>` to start the fetch before `loadWhop()` runs. */
+export declare function preloadHints(options?: PreloadHintsOptions): WhopPreloadHints;
+
+/** Which origins the policy allows. Unknown keys are ignored. */
+export interface ContentSecurityPolicyOptions {
+	/** Which environment the policy allows: the Whop API, and each provider's sandbox hosts in sandbox. Defaults to production. */
+	environment?: NonNullable<WhopGlobalConfig["environment"]>;
+	/**
+	 * Apple Pay, Google Pay, and PayPal: allows the origins it reaches from your page. Pass false on pages that don't show it.
+	 */
+	wallets?: boolean;
+}
+
+/** The Content Security Policy sources elements need on your page. Merge them into your own policy; on their own they block everything else your page loads. */
+export interface WhopContentSecurityPolicy {
+	/** The sources elements need, by directive. */
+	readonly directives: { readonly "frame-src": readonly string[]; readonly "script-src": readonly string[]; readonly "connect-src": readonly string[]; readonly "img-src": readonly string[] };
+	/** Only the sources elements need, as a policy string, leaving out a directive with none. Merge it into your own policy; used alone it blocks everything else. */
+	toString(): string;
+	/** Your policy with these sources added. A directive you don't set is left alone, except that one falling back to `default-src` starts from those values. */
+	merge(policy: string): string;
+	/** Your directives object, in helmet's shape, with these sources added. It assumes helmet's defaults (`useDefaults: true`), which fill every directive you leave out, so these directives are always written, starting from your value, else what helmet would send: `'self'` for `script-src`, `'self' data:` for `img-src`, and your `child-src` or `default-src` (else `'self'`) for the others. Other keys are returned as they were. */
+	merge<T extends Record<string, unknown>>(directives: T): T;
+	/** Merge these sources into the response's `Content-Security-Policy` (and `Content-Security-Policy-Report-Only`) headers. Does nothing to a response that sets neither. */
+	applyTo(headers: Headers): void;
+	/** Your policy, merged, as a `<meta http-equiv>` tag. A meta tag works only when it is your page's whole policy: the browser also enforces any header policy on top of it. */
+	toHtml(policy: string): string;
+}
+
+/** The Content Security Policy sources elements need on your page: the hosted frames and SDK, the Whop API, and the origins elements reach from your page. The scripts elements load for Apple Pay, Google Pay, and PayPal come from other companies and can load resources beyond these: check each provider's Content Security Policy guidance. A modal element dims the page behind it with an inline style, which a `style-src` without inline styles leaves out; the modal still works. */
+export declare function contentSecurityPolicy(options?: ContentSecurityPolicyOptions): WhopContentSecurityPolicy;
 
 /** The locales this app's elements are built with, the default locale first: exactly the values `locale` accepts. `includes()` accepts any string and narrows it to `WhopElementsLocale`, so use it to validate dynamic values; anything unlisted falls back to the default locale. */
 export declare const WHOP_ELEMENTS_LOCALES: readonly WhopElementsLocale[] & {

package/index.d.ts

@@ -61,8 +61,71 @@ export type WhopLoad = Promise<WhopConstructor> & { retry(): WhopLoad };
 /** Load the hosted SDK: injects the `<script data-whop-elements>` tag once and resolves the global constructor. Safe to call any number of times: one script, one shared promise. A failed load is held, so every later call returns the same rejected promise and nothing retries on its own; call `retry()` on it to load again. */
 export declare function loadWhop(): WhopLoad;
 
-/** Resource hints (preconnect/preload) for the hosted SDK. Render them into `<head>` to start the fetch before `loadWhop()` runs. */
-export declare function preloadHints(): { rel: string; href: string; as?: string }[];
+/** One `<link>` hint: render it into `<head>`, or send the list as a `Link` header. */
+export interface PreloadHint {
+	rel: string;
+	href: string;
+	as?: string;
+	crossOrigin?: "anonymous";
+}
+
+/** Which connections `preloadHints()` warms beyond the hosted SDK. Unknown keys are ignored. */
+export interface PreloadHintsOptions {
+	/** Which environment to warm for: the Whop API, and each provider's sandbox hosts in sandbox. Defaults to production. */
+	environment?: NonNullable<WhopGlobalConfig["environment"]>;
+	/**
+	 * Apple Pay, Google Pay, and PayPal: preloads its scripts and warms the connections it opens from your page. Pass false on pages that don't show it.
+	 */
+	wallets?: boolean;
+}
+
+/** The hints `preloadHints()` returns: an array of {@link PreloadHint}, plus ways to apply it. `filter`, `slice`, `concat`, `toSorted` and `toReversed` keep these methods; `map` returns a plain array. */
+export interface WhopPreloadHints<T extends PreloadHint = PreloadHint> extends Array<T> {
+	filter<S extends T>(predicate: (value: T, index: number, array: T[]) => value is S, thisArg?: unknown): WhopPreloadHints<S>;
+	filter(predicate: (value: T, index: number, array: T[]) => unknown, thisArg?: unknown): WhopPreloadHints<T>;
+	slice(start?: number, end?: number): WhopPreloadHints<T>;
+	concat(...items: (T | ConcatArray<T>)[]): WhopPreloadHints<T>;
+	toSorted(compareFn?: (a: T, b: T) => number): WhopPreloadHints<T>;
+	toReversed(): WhopPreloadHints<T>;
+	/** The hints as one `Link` header value (servers and CDNs can turn it into 103 Early Hints). */
+	toLinkHeader(): string;
+	/** The hints as `<link>` tags, for server-rendered templates. */
+	toHtml(): string;
+	/** Append the hints to a response's `Link` header. */
+	applyTo(headers: Headers): void;
+}
+
+/** Resource hints (preconnect/preload) for the hosted SDK, the Whop API, and the scripts and connections elements use on your page. Render them into `<head>` to start the fetch before `loadWhop()` runs. */
+export declare function preloadHints(options?: PreloadHintsOptions): WhopPreloadHints;
+
+/** Which origins the policy allows. Unknown keys are ignored. */
+export interface ContentSecurityPolicyOptions {
+	/** Which environment the policy allows: the Whop API, and each provider's sandbox hosts in sandbox. Defaults to production. */
+	environment?: NonNullable<WhopGlobalConfig["environment"]>;
+	/**
+	 * Apple Pay, Google Pay, and PayPal: allows the origins it reaches from your page. Pass false on pages that don't show it.
+	 */
+	wallets?: boolean;
+}
+
+/** The Content Security Policy sources elements need on your page. Merge them into your own policy; on their own they block everything else your page loads. */
+export interface WhopContentSecurityPolicy {
+	/** The sources elements need, by directive. */
+	readonly directives: { readonly "frame-src": readonly string[]; readonly "script-src": readonly string[]; readonly "connect-src": readonly string[]; readonly "img-src": readonly string[] };
+	/** Only the sources elements need, as a policy string, leaving out a directive with none. Merge it into your own policy; used alone it blocks everything else. */
+	toString(): string;
+	/** Your policy with these sources added. A directive you don't set is left alone, except that one falling back to `default-src` starts from those values. */
+	merge(policy: string): string;
+	/** Your directives object, in helmet's shape, with these sources added. It assumes helmet's defaults (`useDefaults: true`), which fill every directive you leave out, so these directives are always written, starting from your value, else what helmet would send: `'self'` for `script-src`, `'self' data:` for `img-src`, and your `child-src` or `default-src` (else `'self'`) for the others. Other keys are returned as they were. */
+	merge<T extends Record<string, unknown>>(directives: T): T;
+	/** Merge these sources into the response's `Content-Security-Policy` (and `Content-Security-Policy-Report-Only`) headers. Does nothing to a response that sets neither. */
+	applyTo(headers: Headers): void;
+	/** Your policy, merged, as a `<meta http-equiv>` tag. A meta tag works only when it is your page's whole policy: the browser also enforces any header policy on top of it. */
+	toHtml(policy: string): string;
+}
+
+/** The Content Security Policy sources elements need on your page: the hosted frames and SDK, the Whop API, and the origins elements reach from your page. The scripts elements load for Apple Pay, Google Pay, and PayPal come from other companies and can load resources beyond these: check each provider's Content Security Policy guidance. A modal element dims the page behind it with an inline style, which a `style-src` without inline styles leaves out; the modal still works. */
+export declare function contentSecurityPolicy(options?: ContentSecurityPolicyOptions): WhopContentSecurityPolicy;
 
 /** The locales this app's elements are built with, the default locale first: exactly the values `locale` accepts. `includes()` accepts any string and narrows it to `WhopElementsLocale`, so use it to validate dynamic values; anything unlisted falls back to the default locale. */
 export declare const WHOP_ELEMENTS_LOCALES: readonly WhopElementsLocale[] & {

package/index.js

@@ -1,10 +1,18 @@
+// <define:__WHOP_ELEMENTS_API_ORIGINS__>
+var define_WHOP_ELEMENTS_API_ORIGINS_default = { production: "https://api.whop.com", sandbox: "https://sandbox-api.whop.com" };
+
 // <define:__WHOP_ELEMENTS_LOCALES__>
 var define_WHOP_ELEMENTS_LOCALES_default = ["en", "es", "zh", "nl", "pt", "de", "hu", "it", "fr", "ja", "pl", "tr"];
 
+// <define:__WHOP_ELEMENTS_PAGE_REQUIREMENTS__>
+var define_WHOP_ELEMENTS_PAGE_REQUIREMENTS_default = { wallets: { production: { sources: { "frame-src": ["https://checkout.paypal.com", "https://assets.braintreegateway.com", "https://www.paypal.com"], "script-src": ["https://pay.google.com", "https://applepay.cdn-apple.com", "https://js.braintreegateway.com", "https://www.paypal.com", "https://c.paypal.com"], "connect-src": ["https://pay.google.com", "https://google.com", "https://account.google.com", "https://www.google.com", "https://api.basistheory.com", "https://payments.braintree-api.com", "https://api.braintreegateway.com", "https://api-m.paypal.com", "https://www.paypal.com"], "img-src": ["https://www.paypalobjects.com"] }, hints: [{ rel: "preload", href: "https://pay.google.com/gp/p/js/pay.js", as: "script" }, { rel: "preload", href: "https://applepay.cdn-apple.com/jsapi/1.latest/apple-pay-sdk.js", as: "script", crossOrigin: "anonymous" }, { rel: "preload", href: "https://js.braintreegateway.com/web/3.146.0/js/paypal-checkout-v6.min.js", as: "script" }, { rel: "preload", href: "https://www.paypal.com/web-sdk/v6/core", as: "script" }, { rel: "preconnect", href: "https://api.basistheory.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://payments.braintree-api.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://api.braintreegateway.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://checkout.paypal.com" }, { rel: "preconnect", href: "https://assets.braintreegateway.com" }, { rel: "preconnect", href: "https://c.paypal.com" }, { rel: "preconnect", href: "https://api-m.paypal.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://www.paypal.com", crossOrigin: "anonymous" }] }, sandbox: { sources: { "frame-src": ["https://checkout.paypal.com", "https://assets.braintreegateway.com", "https://www.sandbox.paypal.com"], "script-src": ["https://pay.google.com", "https://applepay.cdn-apple.com", "https://js.braintreegateway.com", "https://www.sandbox.paypal.com", "https://c.paypal.com"], "connect-src": ["https://pay.google.com", "https://google.com", "https://account.google.com", "https://www.google.com", "https://api.basistheory.com", "https://payments.sandbox.braintree-api.com", "https://api.sandbox.braintreegateway.com", "https://api-m.sandbox.paypal.com", "https://www.sandbox.paypal.com"], "img-src": ["https://www.paypalobjects.com"] }, hints: [{ rel: "preload", href: "https://pay.google.com/gp/p/js/pay.js", as: "script" }, { rel: "preload", href: "https://applepay.cdn-apple.com/jsapi/1.latest/apple-pay-sdk.js", as: "script", crossOrigin: "anonymous" }, { rel: "preload", href: "https://js.braintreegateway.com/web/3.146.0/js/paypal-checkout-v6.min.js", as: "script" }, { rel: "preload", href: "https://www.sandbox.paypal.com/web-sdk/v6/core", as: "script" }, { rel: "preconnect", href: "https://api.basistheory.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://payments.sandbox.braintree-api.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://api.sandbox.braintreegateway.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://checkout.paypal.com" }, { rel: "preconnect", href: "https://assets.braintreegateway.com" }, { rel: "preconnect", href: "https://c.paypal.com" }, { rel: "preconnect", href: "https://api-m.sandbox.paypal.com", crossOrigin: "anonymous" }, { rel: "preconnect", href: "https://www.sandbox.paypal.com", crossOrigin: "anonymous" }] } } };
+
 // ../../packages/elements-codegen/src/cli/build/npm-loader.ts
 var ORIGIN = "https://cdn.whop.com";
 var SDK_URL = "https://cdn.whop.com/elements/amber/elements.js";
 var WHOP_ELEMENTS_LOCALES = define_WHOP_ELEMENTS_LOCALES_default;
+var API_ORIGINS = define_WHOP_ELEMENTS_API_ORIGINS_default;
+var PAGE_REQUIREMENTS = define_WHOP_ELEMENTS_PAGE_REQUIREMENTS_default;
 var TAG = "script[data-whop-elements]";
 var resolved = null;
 function withRetry(promise) {
@@ -102,15 +110,194 @@ function watch(w, script, created) {
   }
   return script.__whopReady;
 }
-function preloadHints() {
-  return [
-    { rel: "preconnect", href: ORIGIN },
-    { rel: "preload", href: SDK_URL, as: "script" }
-  ];
+function environmentOf(environment) {
+  if (environment === void 0 || environment === "production") return "production";
+  if (environment === "sandbox") return "sandbox";
+  throw new Error(`unknown environment ${JSON.stringify(environment)}: expected "production" or "sandbox"`);
+}
+function apiOrigin(environment) {
+  return API_ORIGINS[environmentOf(environment)];
+}
+function escapeAttribute(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+var PreloadHints = class extends Array {
+  // map/flatMap produce plain arrays: rendered <link> tags are not a hint list. The methods below
+  // keep hints as hints, so a narrowed list still has toLinkHeader() and friends.
+  static get [Symbol.species]() {
+    return Array;
+  }
+  filter(predicate, thisArg) {
+    return hintsFrom(super.filter(predicate, thisArg));
+  }
+  slice(start, end) {
+    return hintsFrom(super.slice(start, end));
+  }
+  concat(...items) {
+    return hintsFrom(super.concat(...items));
+  }
+  // copies sorted or reversed without Array.prototype.toSorted/toReversed, which older browsers lack.
+  toSorted(compareFn) {
+    return hintsFrom(this).sort(compareFn);
+  }
+  toReversed() {
+    const hints = hintsFrom(this);
+    hints.reverse();
+    return hints;
+  }
+  toLinkHeader() {
+    return this.map((h) => `<${h.href}>; rel=${h.rel}${h.as ? `; as=${h.as}` : ""}${h.crossOrigin ? `; crossorigin=${h.crossOrigin}` : ""}`).join(", ");
+  }
+  toHtml() {
+    return this.map((h) => `<link rel="${escapeAttribute(h.rel)}" href="${escapeAttribute(h.href)}"${h.as ? ` as="${escapeAttribute(h.as)}"` : ""}${h.crossOrigin ? ` crossorigin="${h.crossOrigin}"` : ""}>`).join("\n");
+  }
+  applyTo(headers) {
+    const value = this.toLinkHeader();
+    if (value) headers.append("Link", value);
+  }
+};
+function hintsFrom(items) {
+  const hints = new PreloadHints();
+  for (const item of items) hints.push(item);
+  return hints;
+}
+function preloadHints(options = {}) {
+  const hints = new PreloadHints();
+  const add = (hint) => {
+    if (!hints.some((h) => h.rel === hint.rel && h.href === hint.href && h.crossOrigin === hint.crossOrigin)) hints.push(hint);
+  };
+  add({ rel: "preconnect", href: ORIGIN });
+  add({ rel: "preload", href: SDK_URL, as: "script" });
+  add({ rel: "preconnect", href: apiOrigin(options.environment), crossOrigin: "anonymous" });
+  const environment = environmentOf(options.environment);
+  for (const [group, byEnvironment] of Object.entries(PAGE_REQUIREMENTS)) {
+    if (options[group] === false) continue;
+    for (const hint of byEnvironment[environment].hints) add(hint);
+  }
+  return hints;
+}
+var FALLBACKS = { "frame-src": ["child-src", "default-src"], "script-src": ["default-src"], "connect-src": ["default-src"], "img-src": ["default-src"] };
+var POLICY_HEADERS = ["Content-Security-Policy", "Content-Security-Policy-Report-Only"];
+var camelToKebab = (key) => key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`);
+var kebabToCamel = (key) => key.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+function addSources(values, sources) {
+  const out = values.filter((v) => typeof v !== "string" || v.toLowerCase() !== "'none'");
+  for (const source of sources) if (!out.includes(source)) out.push(source);
+  return out;
+}
+function mergeDirectives(directives, sources) {
+  for (const [name, list] of Object.entries(sources)) {
+    if (list.length === 0) continue;
+    const own = directives.find((d) => d.name === name);
+    const elem = name === "script-src" ? directives.find((d) => d.name === "script-src-elem") : void 0;
+    if (elem) elem.values = addSources(elem.values, list);
+    if (own) {
+      own.values = addSources(own.values, list);
+      continue;
+    }
+    const fallback = FALLBACKS[name].map((f) => directives.find((d) => d.name === f)).find((d) => d !== void 0);
+    if (fallback) directives.push({ name, values: addSources([...fallback.values], list) });
+  }
+}
+function parsePolicy(policy) {
+  const directives = [];
+  for (const part of policy.split(";")) {
+    const [name, ...values] = part.trim().split(/\s+/).filter(Boolean);
+    if (name && !directives.some((d) => d.name === name.toLowerCase())) directives.push({ name: name.toLowerCase(), values });
+  }
+  return directives;
+}
+var serializePolicy = (directives) => directives.map((d) => [d.name, ...d.values].join(" ")).join("; ");
+var HELMET_DEFAULTS = { "script-src": ["'self'"], "img-src": ["'self'", "data:"] };
+function mergeHelmetDirectives(policy, sources) {
+  const keys = Object.keys(policy);
+  const camel = keys.length > 0 && keys.every((k) => !k.includes("-"));
+  const keyOf = (name) => keys.find((k) => camelToKebab(k) === name);
+  const read = /* @__PURE__ */ new Map();
+  const valuesOf = (key) => {
+    if (key === void 0) return void 0;
+    const seen = read.get(key);
+    if (seen) return [...seen];
+    const value = policy[key];
+    const values = typeof value === "string" ? value.split(/\s+/).filter(Boolean) : value != null && typeof value[Symbol.iterator] === "function" ? [...value] : void 0;
+    if (values) read.set(key, values);
+    return values && [...values];
+  };
+  const isIterator = (value) => value != null && typeof value.next === "function" && value[Symbol.iterator]?.() === value;
+  const shaped = (key, values) => {
+    const value = policy[key];
+    if (typeof value === "string") return values.join(" ");
+    if (value instanceof Set) return new Set(values);
+    return isIterator(value) ? values.values() : values;
+  };
+  const out = { ...policy };
+  for (const [name, list] of Object.entries(sources)) {
+    if (list.length === 0) continue;
+    const ownKey = keyOf(name);
+    const own = valuesOf(ownKey);
+    const helmetDefault = ownKey !== void 0 && policy[ownKey] === null ? void 0 : HELMET_DEFAULTS[name];
+    const seed = own ?? (helmetDefault ? [...helmetDefault] : FALLBACKS[name].map((f) => valuesOf(keyOf(f))).find((v) => v !== void 0)) ?? ["'self'"];
+    const merged = addSources(seed, list);
+    const key = ownKey ?? (camel ? kebabToCamel(name) : name);
+    out[key] = shaped(key, merged);
+    if (name === "script-src") {
+      const elemKey = keyOf("script-src-elem");
+      const elem = valuesOf(elemKey);
+      if (elemKey !== void 0 && elem) out[elemKey] = shaped(elemKey, addSources(elem, list));
+    }
+  }
+  for (const [key, values] of read) if (out[key] === policy[key] && isIterator(policy[key])) out[key] = values.values();
+  return out;
+}
+var ContentSecurityPolicy = class {
+  directives;
+  constructor(directives) {
+    this.directives = Object.freeze({
+      "frame-src": Object.freeze([...directives["frame-src"]]),
+      "script-src": Object.freeze([...directives["script-src"]]),
+      "connect-src": Object.freeze([...directives["connect-src"]]),
+      "img-src": Object.freeze([...directives["img-src"]])
+    });
+  }
+  // A directive with no sources is left out: written bare, it would allow nothing.
+  toString() {
+    return serializePolicy(
+      Object.entries(this.directives).filter(([, values]) => values.length > 0).map(([name, values]) => ({ name, values: [...values] }))
+    );
+  }
+  merge(policy) {
+    if (typeof policy !== "string") return mergeHelmetDirectives(policy, this.directives);
+    return policy.split(",").map((one) => {
+      const directives = parsePolicy(one);
+      mergeDirectives(directives, this.directives);
+      return serializePolicy(directives);
+    }).join(", ");
+  }
+  applyTo(headers) {
+    for (const name of POLICY_HEADERS) {
+      const value = headers.get(name);
+      if (value !== null) headers.set(name, this.merge(value));
+    }
+  }
+  toHtml(policy) {
+    return `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(this.merge(policy))}">`;
+  }
+};
+function contentSecurityPolicy(options = {}) {
+  const directives = { "frame-src": [ORIGIN], "script-src": [ORIGIN], "connect-src": [apiOrigin(options.environment)], "img-src": [] };
+  const environment = environmentOf(options.environment);
+  for (const [group, byEnvironment] of Object.entries(PAGE_REQUIREMENTS)) {
+    if (options[group] === false) continue;
+    for (const [name, list] of Object.entries(byEnvironment[environment].sources)) {
+      for (const source of list) if (!directives[name].includes(source)) directives[name].push(source);
+    }
+  }
+  return new ContentSecurityPolicy(directives);
 }
 export {
   SDK_URL,
   WHOP_ELEMENTS_LOCALES,
+  contentSecurityPolicy,
   loadWhop,
   preloadHints
 };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@whop/elements",
-	"version": "1.2.0",
+	"version": "1.4.0",
 	"description": "Whop Elements — vanilla-js loader + types. Loads the hosted SDK and exposes the typed WhopElements factory.",
 	"keywords": [
 		"checkout",
@@ -97,5 +97,5 @@
 			}
 		}
 	},
-	"whopElementsApiHash": "2b14d0c22a80bdf6595a304c0c3f516a3c4978e44a77ee608ad640a377b4bca8"
+	"whopElementsApiHash": "597d8fc784a33c8b760b0afab305d906f9d79cdaa04ebc7f7b3fc2f4de73400c"
 }

package/payments.d.cts

@@ -39,10 +39,6 @@ export type PaymentsOptions = (
 		 * Wallet availability override for deterministic previews. Live checkouts probe the host.
 		 */
 		previewWalletAvailability?: WalletAvailability;
-		/**
-		 * Checkout session updated when a buyer signs in. Pass its `chs_`-prefixed `id` and `client_secret`. Without them, sign-in succeeds but the session does not record the buyer.
-		 */
-		checkoutSession?: { id: string; clientSecret: string; };
 		/**
 		 * Runs when the grouped loading state changes. The value is `true` while any mounted element is still loading.
 		 */
@@ -89,10 +85,6 @@ export type PaymentsOptions = (
 		 * Wallet availability override for deterministic previews. Live checkouts probe the host.
 		 */
 		previewWalletAvailability?: WalletAvailability;
-		/**
-		 * Checkout session updated when a buyer signs in. Pass its `chs_`-prefixed `id` and `client_secret`. Without them, sign-in succeeds but the session does not record the buyer.
-		 */
-		checkoutSession?: { id: string; clientSecret: string; };
 		/**
 		 * Runs when the grouped loading state changes. The value is `true` while any mounted element is still loading.
 		 */
@@ -143,10 +135,6 @@ export type PaymentsOptions = (
 		 * Wallet availability override for deterministic previews. Live checkouts probe the host.
 		 */
 		previewWalletAvailability?: WalletAvailability;
-		/**
-		 * Checkout session updated when a buyer signs in. Pass its `chs_`-prefixed `id` and `client_secret`. Without them, sign-in succeeds but the session does not record the buyer.
-		 */
-		checkoutSession?: { id: string; clientSecret: string; };
 		/**
 		 * Runs when the grouped loading state changes. The value is `true` while any mounted element is still loading.
 		 */
@@ -197,10 +185,6 @@ export type PaymentsOptions = (
 		 * Wallet availability override for deterministic previews. Live checkouts probe the host.
 		 */
 		previewWalletAvailability?: WalletAvailability;
-		/**
-		 * Checkout session updated when a buyer signs in. Pass its `chs_`-prefixed `id` and `client_secret`. Without them, sign-in succeeds but the session does not record the buyer.
-		 */
-		checkoutSession?: { id: string; clientSecret: string; };
 		/**
 		 * Runs when the grouped loading state changes. The value is `true` while any mounted element is still loading.
 		 */
@@ -1030,7 +1014,7 @@ export interface PaymentRequestResourceOptions {
 	 */
 	requestPayerPhone?: boolean;
 	/**
-	 * Ask the sheet for a shipping address (and offer `shippingOptions` when given).
+	 * Ask the sheet for a shipping address (and offer `shippingOptions` when given). PayPal always asks for an address, since it is the address tax is computed on, and returns it as `shipping` only when this is set.
 	 * @default false
 	 */
 	requestShipping?: boolean;
@@ -1049,34 +1033,34 @@ export interface PaymentRequestResourceOptions {
 }
 
 /**
- * A minted "paymentRequest" resource — returned by `whop.payments.paymentRequest.create()`. Low-level Apple Pay or Google Pay sheet for custom buttons, express checkout, and shipping callbacks. Wallet tiles automate this flow through `payments.createConfirmationToken`. Await `canMakePayment()` to check availability and prime the sheet, then call `show(type)` synchronously in the user-interaction handler. The resolved `ctok` is a `ctok_`-prefixed confirmation token. Confirm it server-side like an element-minted token.
+ * A minted "paymentRequest" resource — returned by `whop.payments.paymentRequest.create()`. Low-level Apple Pay, Google Pay, or PayPal sheet for custom buttons, express checkout, and shipping callbacks. Wallet tiles automate this flow through `payments.createConfirmationToken`. Await `canMakePayment()` to check availability and prime the wallet, then call `show(type)` synchronously in the user-interaction handler. The resolved `ctok` is a `ctok_`-prefixed confirmation token. Confirm it server-side like an element-minted token. A PayPal token charges at most the total PayPal showed the buyer.
  * @see https://docs.whop.com/elements/latest/payments/paymentRequest
  */
 export interface PaymentRequestResource {
 	/**
-	 * Returns availability for each wallet when the account offers it, the device supports it, and this page's origin is approved for the account (first-party whop.com pages are pre-approved; a merchant page needs its domain registered and verified as a [payment method domain](/api-reference/beta/payment-method-domains/payment-method-domain), and offering Google Pay there is subject to the [Google Pay API Terms of Service](https://payments.developers.google.com/terms/sellertos)). Apple Pay on non-WebKit browsers is the desktop iPhone-handoff flow, so mobile devices there report it unavailable — native Apple Pay on iOS browsers is unaffected. `order` ranks the wallets by which sheet is native to the browser — Apple Pay first on Safari, Google Pay first elsewhere — so express buttons can stack best-first. This primes `show()`. Always await it first.
+	 * Returns availability for each wallet when the account offers it, the device supports it, and this page's origin is approved for the account (first-party whop.com pages are pre-approved; a merchant page needs its domain registered and verified as a [payment method domain](/api-reference/beta/payment-method-domains/payment-method-domain), and offering Google Pay there is subject to the [Google Pay API Terms of Service](https://payments.developers.google.com/terms/sellertos)). Apple Pay on non-WebKit browsers is the desktop iPhone-handoff flow, so mobile devices there report it unavailable — native Apple Pay on iOS browsers is unaffected. `order` ranks the wallets by which sheet is native to the browser — Apple Pay first on Safari, Google Pay first elsewhere, PayPal last — so express buttons can stack best-first. `payPal` reports PayPal where the account offers it in this currency, the amount is within PayPal's limits, the request neither sets `setupFutureUsage` nor asks for the payer's phone, PayPal's scripts load on this page, and this page's origin is approved for the account like the other wallets'. A page with a Content Security Policy must allow PayPal's hosts, which `contentSecurityPolicy()` includes. A page that already loads PayPal's own v5 JavaScript SDK reports `payPal: false`. This primes `show()`. Always await it first.
 	 */
 	canMakePayment: () => Promise<WalletAvailability>;
 	/**
-	 * Open the selected wallet sheet after awaiting `canMakePayment()`. Apple requires session creation within the gesture stack. Pass `email` when your page already collected one — the sheet takes it and never asks for a second. With `requestPayerEmail: false`, passing one is required, and the sheet refuses to open without it because confirmation tokens require an email.
+	 * Open the selected wallet after awaiting `canMakePayment()`, synchronously in the press: Apple requires session creation within the gesture stack, and PayPal opens its window there — a pop-up on desktop, PayPal's in-page window when the pop-up is blocked and on mobile. Pass `email` when your page already collected one — the wallet takes it and never asks for a second. With `requestPayerEmail: false`, passing one is required, and the wallet refuses to open without it because confirmation tokens require an email.
 	 * Call synchronously during user activation. Await prerequisites first because browsers revoke activation across asynchronous steps.
 	 */
-	show: (type: "apple_pay" | "google_pay", provided?: { email?: string | undefined; } | undefined) => Promise<PaymentRequestResult>;
+	show: (type: "apple_pay" | "google_pay" | "paypal_express", provided?: { email?: string | undefined; } | undefined) => Promise<PaymentRequestResult>;
 	/**
-	 * The sheet's shipping address changed (redacted pre-authorization: city/state/postal/country only). An error in the answer that names a `field` (`city`, `state`, `postal_code`, `country`) marks that field in Apple Pay; Google Pay shows the message alone.
-	 * Call `updateWith(…)` exactly once per event or the flow waits until the vendor times out.
+	 * The sheet's shipping address changed (redacted pre-authorization: city/state/postal/country only). An error in the answer that names a `field` (`city`, `state`, `postal_code`, `country`) marks that field in Apple Pay; Google Pay shows the message alone. PayPal fires it with the address the buyer picks, and an error naming a `field` refuses that part of the address inside PayPal.
+	 * Call `updateWith(…)` exactly once per event. A handler that throws or rejects before calling it fails that update right away.
 	 * Returns the unsubscribe function.
 	 */
 	onShippingAddressChange(handler: (ev: ShippingAddressChangeEvent) => void): () => void;
 	/**
-	 * The buyer picked a shipping option. Amount-only contract: `updateWith` carries amount/lineItems/shippingOptions/errors.
-	 * Call `updateWith(…)` exactly once per event or the flow waits until the vendor times out.
+	 * The buyer picked a shipping option. Amount-only contract: `updateWith` carries amount/lineItems/shippingOptions/errors. Apple Pay has no error slot for a shipping option: an answer with `errors` keeps the last accepted total, and the first error's message shows when the buyer taps Pay, until they pick an option your handler accepts. Google Pay shows the message when the option is picked.
+	 * Call `updateWith(…)` exactly once per event. A handler that throws or rejects before calling it fails that update right away.
 	 * Returns the unsubscribe function.
 	 */
 	onShippingOptionChange(handler: (ev: ShippingOptionChangeEvent) => void): () => void;
 	/**
-	 * Fires at sheet open and on card switches with the selected card's redacted billing address (city/state/postal/country only) — reprice the total for the address the charge taxes off. Answer `updateWith({ amount })` in minor units, or `updateWith({})` to keep the current total. Every event is answered exactly once: a slow, thrown, or superseded handler answers keep-current.
-	 * Call `updateWith(…)` exactly once per event or the flow waits until the vendor times out.
+	 * Fires at sheet open and on card switches with the selected card's redacted billing address (city/state/postal/country only) — reprice the total for the address the charge taxes off. Answer `updateWith({ amount })` in minor units, `updateWith({})` to keep the current total, or `updateWith({ errors })` to refuse the card. Every event is answered exactly once: a handler that throws, rejects, or doesn't answer within 10 seconds refuses the card, so the buyer picks another one. PayPal fires it with each shipping address the buyer picks in PayPal, which is the address its token bills and taxes on, and a refusal there refuses that address inside PayPal.
+	 * Call `updateWith(…)` exactly once per event. A handler that throws or rejects before calling it fails that update right away.
 	 * Returns the unsubscribe function.
 	 */
 	onBillingAddressChange(handler: (ev: BillingAddressChangeEvent) => void): () => void;
@@ -1086,7 +1070,7 @@ export interface PaymentRequestResource {
 	 */
 	onConfirmationToken(handler: (ev: PaymentRequestResult) => void): () => void;
 	/**
-	 * The buyer dismissed the sheet.
+	 * The buyer dismissed the sheet or closed PayPal.
 	 * Returns the unsubscribe function.
 	 */
 	onCancel(handler: () => void): () => void;
@@ -1154,7 +1138,7 @@ export interface PaymentsStatics {
 	 */
 	handleNextAction: (input: { clientSecret: string; returnUrl?: string | undefined; pollIntervalMs?: number | undefined; }) => Promise<{ status: string; redirected: boolean; lastPaymentError: { code?: string | null | undefined; decline_code?: string | null | undefined; message?: string | null | undefined; } | null; }>;
 	/**
-	 * Low-level Apple Pay or Google Pay sheet for custom buttons, express checkout, and shipping callbacks. Wallet tiles automate this flow through `payments.createConfirmationToken`. Await `canMakePayment()` to check availability and prime the sheet, then call `show(type)` synchronously in the user-interaction handler. The resolved `ctok` is a `ctok_`-prefixed confirmation token. Confirm it server-side like an element-minted token.
+	 * Low-level Apple Pay, Google Pay, or PayPal sheet for custom buttons, express checkout, and shipping callbacks. Wallet tiles automate this flow through `payments.createConfirmationToken`. Await `canMakePayment()` to check availability and prime the wallet, then call `show(type)` synchronously in the user-interaction handler. The resolved `ctok` is a `ctok_`-prefixed confirmation token. Confirm it server-side like an element-minted token. A PayPal token charges at most the total PayPal showed the buyer.
 	 * Mint with `whop.payments.paymentRequest.create(options)` — nothing needs to be mounted.
 	 */
 	paymentRequest: { create(options: PaymentRequestResourceOptions): PaymentRequestResource };
@@ -1167,10 +1151,11 @@ export interface PaymentsStatics {
 export interface WalletAvailability {
 	applePay: boolean;
 	googlePay: boolean;
+	payPal?: boolean | undefined;
 	/**
-	 * The wallets ranked by which sheet is native to this browser — Apple Pay first on WebKit, Google Pay first everywhere else — so express buttons can stack best-first. Absent on consumer-stated availability (previews) and on wires that predate it. An inline union, not payment-request's WalletSheetType: that module already imports this one.
+	 * The wallets ranked by which sheet is native to this browser — Apple Pay first on WebKit, Google Pay first everywhere else, PayPal last — so express buttons can stack best-first. Absent on consumer-stated availability (previews) and on wires that predate it. An inline union, not payment-request's WalletSheetType: that module already imports this one.
 	 */
-	order?: ("apple_pay" | "google_pay")[] | undefined;
+	order?: ("apple_pay" | "google_pay" | "paypal_express")[] | undefined;
 }
 
 /**
@@ -1228,7 +1213,7 @@ export interface PaymentRequestResult {
 	 * Confirmation token ID, prefixed `ctok_`. Confirm it server-side with your secret key.
 	 */
 	ctok: string;
-	type: "apple_pay" | "google_pay";
+	type: "apple_pay" | "google_pay" | "paypal_express";
 	payer: { email?: string | undefined; name?: string | undefined; phone?: string | undefined; country?: string | undefined; };
 	shipping: { address?: PaymentRequestAddress | undefined; option?: PaymentRequestShippingOption | undefined; } | null;
 }

package/payments.d.ts

@@ -39,10 +39,6 @@ export type PaymentsOptions = (
 		 * Wallet availability override for deterministic previews. Live checkouts probe the host.
 		 */
 		previewWalletAvailability?: WalletAvailability;
-		/**
-		 * Checkout session updated when a buyer signs in. Pass its `chs_`-prefixed `id` and `client_secret`. Without them, sign-in succeeds but the session does not record the buyer.
-		 */
-		checkoutSession?: { id: string; clientSecret: string; };
 		/**
 		 * Runs when the grouped loading state changes. The value is `true` while any mounted element is still loading.
 		 */
@@ -89,10 +85,6 @@ export type PaymentsOptions = (
 		 * Wallet availability override for deterministic previews. Live checkouts probe the host.
 		 */
 		previewWalletAvailability?: WalletAvailability;
-		/**
-		 * Checkout session updated when a buyer signs in. Pass its `chs_`-prefixed `id` and `client_secret`. Without them, sign-in succeeds but the session does not record the buyer.
-		 */
-		checkoutSession?: { id: string; clientSecret: string; };
 		/**
 		 * Runs when the grouped loading state changes. The value is `true` while any mounted element is still loading.
 		 */
@@ -143,10 +135,6 @@ export type PaymentsOptions = (
 		 * Wallet availability override for deterministic previews. Live checkouts probe the host.
 		 */
 		previewWalletAvailability?: WalletAvailability;
-		/**
-		 * Checkout session updated when a buyer signs in. Pass its `chs_`-prefixed `id` and `client_secret`. Without them, sign-in succeeds but the session does not record the buyer.
-		 */
-		checkoutSession?: { id: string; clientSecret: string; };
 		/**
 		 * Runs when the grouped loading state changes. The value is `true` while any mounted element is still loading.
 		 */
@@ -197,10 +185,6 @@ export type PaymentsOptions = (
 		 * Wallet availability override for deterministic previews. Live checkouts probe the host.
 		 */
 		previewWalletAvailability?: WalletAvailability;
-		/**
-		 * Checkout session updated when a buyer signs in. Pass its `chs_`-prefixed `id` and `client_secret`. Without them, sign-in succeeds but the session does not record the buyer.
-		 */
-		checkoutSession?: { id: string; clientSecret: string; };
 		/**
 		 * Runs when the grouped loading state changes. The value is `true` while any mounted element is still loading.
 		 */
@@ -1030,7 +1014,7 @@ export interface PaymentRequestResourceOptions {
 	 */
 	requestPayerPhone?: boolean;
 	/**
-	 * Ask the sheet for a shipping address (and offer `shippingOptions` when given).
+	 * Ask the sheet for a shipping address (and offer `shippingOptions` when given). PayPal always asks for an address, since it is the address tax is computed on, and returns it as `shipping` only when this is set.
 	 * @default false
 	 */
 	requestShipping?: boolean;
@@ -1049,34 +1033,34 @@ export interface PaymentRequestResourceOptions {
 }
 
 /**
- * A minted "paymentRequest" resource — returned by `whop.payments.paymentRequest.create()`. Low-level Apple Pay or Google Pay sheet for custom buttons, express checkout, and shipping callbacks. Wallet tiles automate this flow through `payments.createConfirmationToken`. Await `canMakePayment()` to check availability and prime the sheet, then call `show(type)` synchronously in the user-interaction handler. The resolved `ctok` is a `ctok_`-prefixed confirmation token. Confirm it server-side like an element-minted token.
+ * A minted "paymentRequest" resource — returned by `whop.payments.paymentRequest.create()`. Low-level Apple Pay, Google Pay, or PayPal sheet for custom buttons, express checkout, and shipping callbacks. Wallet tiles automate this flow through `payments.createConfirmationToken`. Await `canMakePayment()` to check availability and prime the wallet, then call `show(type)` synchronously in the user-interaction handler. The resolved `ctok` is a `ctok_`-prefixed confirmation token. Confirm it server-side like an element-minted token. A PayPal token charges at most the total PayPal showed the buyer.
  * @see https://docs.whop.com/elements/latest/payments/paymentRequest
  */
 export interface PaymentRequestResource {
 	/**
-	 * Returns availability for each wallet when the account offers it, the device supports it, and this page's origin is approved for the account (first-party whop.com pages are pre-approved; a merchant page needs its domain registered and verified as a [payment method domain](/api-reference/beta/payment-method-domains/payment-method-domain), and offering Google Pay there is subject to the [Google Pay API Terms of Service](https://payments.developers.google.com/terms/sellertos)). Apple Pay on non-WebKit browsers is the desktop iPhone-handoff flow, so mobile devices there report it unavailable — native Apple Pay on iOS browsers is unaffected. `order` ranks the wallets by which sheet is native to the browser — Apple Pay first on Safari, Google Pay first elsewhere — so express buttons can stack best-first. This primes `show()`. Always await it first.
+	 * Returns availability for each wallet when the account offers it, the device supports it, and this page's origin is approved for the account (first-party whop.com pages are pre-approved; a merchant page needs its domain registered and verified as a [payment method domain](/api-reference/beta/payment-method-domains/payment-method-domain), and offering Google Pay there is subject to the [Google Pay API Terms of Service](https://payments.developers.google.com/terms/sellertos)). Apple Pay on non-WebKit browsers is the desktop iPhone-handoff flow, so mobile devices there report it unavailable — native Apple Pay on iOS browsers is unaffected. `order` ranks the wallets by which sheet is native to the browser — Apple Pay first on Safari, Google Pay first elsewhere, PayPal last — so express buttons can stack best-first. `payPal` reports PayPal where the account offers it in this currency, the amount is within PayPal's limits, the request neither sets `setupFutureUsage` nor asks for the payer's phone, PayPal's scripts load on this page, and this page's origin is approved for the account like the other wallets'. A page with a Content Security Policy must allow PayPal's hosts, which `contentSecurityPolicy()` includes. A page that already loads PayPal's own v5 JavaScript SDK reports `payPal: false`. This primes `show()`. Always await it first.
 	 */
 	canMakePayment: () => Promise<WalletAvailability>;
 	/**
-	 * Open the selected wallet sheet after awaiting `canMakePayment()`. Apple requires session creation within the gesture stack. Pass `email` when your page already collected one — the sheet takes it and never asks for a second. With `requestPayerEmail: false`, passing one is required, and the sheet refuses to open without it because confirmation tokens require an email.
+	 * Open the selected wallet after awaiting `canMakePayment()`, synchronously in the press: Apple requires session creation within the gesture stack, and PayPal opens its window there — a pop-up on desktop, PayPal's in-page window when the pop-up is blocked and on mobile. Pass `email` when your page already collected one — the wallet takes it and never asks for a second. With `requestPayerEmail: false`, passing one is required, and the wallet refuses to open without it because confirmation tokens require an email.
 	 * Call synchronously during user activation. Await prerequisites first because browsers revoke activation across asynchronous steps.
 	 */
-	show: (type: "apple_pay" | "google_pay", provided?: { email?: string | undefined; } | undefined) => Promise<PaymentRequestResult>;
+	show: (type: "apple_pay" | "google_pay" | "paypal_express", provided?: { email?: string | undefined; } | undefined) => Promise<PaymentRequestResult>;
 	/**
-	 * The sheet's shipping address changed (redacted pre-authorization: city/state/postal/country only). An error in the answer that names a `field` (`city`, `state`, `postal_code`, `country`) marks that field in Apple Pay; Google Pay shows the message alone.
-	 * Call `updateWith(…)` exactly once per event or the flow waits until the vendor times out.
+	 * The sheet's shipping address changed (redacted pre-authorization: city/state/postal/country only). An error in the answer that names a `field` (`city`, `state`, `postal_code`, `country`) marks that field in Apple Pay; Google Pay shows the message alone. PayPal fires it with the address the buyer picks, and an error naming a `field` refuses that part of the address inside PayPal.
+	 * Call `updateWith(…)` exactly once per event. A handler that throws or rejects before calling it fails that update right away.
 	 * Returns the unsubscribe function.
 	 */
 	onShippingAddressChange(handler: (ev: ShippingAddressChangeEvent) => void): () => void;
 	/**
-	 * The buyer picked a shipping option. Amount-only contract: `updateWith` carries amount/lineItems/shippingOptions/errors.
-	 * Call `updateWith(…)` exactly once per event or the flow waits until the vendor times out.
+	 * The buyer picked a shipping option. Amount-only contract: `updateWith` carries amount/lineItems/shippingOptions/errors. Apple Pay has no error slot for a shipping option: an answer with `errors` keeps the last accepted total, and the first error's message shows when the buyer taps Pay, until they pick an option your handler accepts. Google Pay shows the message when the option is picked.
+	 * Call `updateWith(…)` exactly once per event. A handler that throws or rejects before calling it fails that update right away.
 	 * Returns the unsubscribe function.
 	 */
 	onShippingOptionChange(handler: (ev: ShippingOptionChangeEvent) => void): () => void;
 	/**
-	 * Fires at sheet open and on card switches with the selected card's redacted billing address (city/state/postal/country only) — reprice the total for the address the charge taxes off. Answer `updateWith({ amount })` in minor units, or `updateWith({})` to keep the current total. Every event is answered exactly once: a slow, thrown, or superseded handler answers keep-current.
-	 * Call `updateWith(…)` exactly once per event or the flow waits until the vendor times out.
+	 * Fires at sheet open and on card switches with the selected card's redacted billing address (city/state/postal/country only) — reprice the total for the address the charge taxes off. Answer `updateWith({ amount })` in minor units, `updateWith({})` to keep the current total, or `updateWith({ errors })` to refuse the card. Every event is answered exactly once: a handler that throws, rejects, or doesn't answer within 10 seconds refuses the card, so the buyer picks another one. PayPal fires it with each shipping address the buyer picks in PayPal, which is the address its token bills and taxes on, and a refusal there refuses that address inside PayPal.
+	 * Call `updateWith(…)` exactly once per event. A handler that throws or rejects before calling it fails that update right away.
 	 * Returns the unsubscribe function.
 	 */
 	onBillingAddressChange(handler: (ev: BillingAddressChangeEvent) => void): () => void;
@@ -1086,7 +1070,7 @@ export interface PaymentRequestResource {
 	 */
 	onConfirmationToken(handler: (ev: PaymentRequestResult) => void): () => void;
 	/**
-	 * The buyer dismissed the sheet.
+	 * The buyer dismissed the sheet or closed PayPal.
 	 * Returns the unsubscribe function.
 	 */
 	onCancel(handler: () => void): () => void;
@@ -1154,7 +1138,7 @@ export interface PaymentsStatics {
 	 */
 	handleNextAction: (input: { clientSecret: string; returnUrl?: string | undefined; pollIntervalMs?: number | undefined; }) => Promise<{ status: string; redirected: boolean; lastPaymentError: { code?: string | null | undefined; decline_code?: string | null | undefined; message?: string | null | undefined; } | null; }>;
 	/**
-	 * Low-level Apple Pay or Google Pay sheet for custom buttons, express checkout, and shipping callbacks. Wallet tiles automate this flow through `payments.createConfirmationToken`. Await `canMakePayment()` to check availability and prime the sheet, then call `show(type)` synchronously in the user-interaction handler. The resolved `ctok` is a `ctok_`-prefixed confirmation token. Confirm it server-side like an element-minted token.
+	 * Low-level Apple Pay, Google Pay, or PayPal sheet for custom buttons, express checkout, and shipping callbacks. Wallet tiles automate this flow through `payments.createConfirmationToken`. Await `canMakePayment()` to check availability and prime the wallet, then call `show(type)` synchronously in the user-interaction handler. The resolved `ctok` is a `ctok_`-prefixed confirmation token. Confirm it server-side like an element-minted token. A PayPal token charges at most the total PayPal showed the buyer.
 	 * Mint with `whop.payments.paymentRequest.create(options)` — nothing needs to be mounted.
 	 */
 	paymentRequest: { create(options: PaymentRequestResourceOptions): PaymentRequestResource };
@@ -1167,10 +1151,11 @@ export interface PaymentsStatics {
 export interface WalletAvailability {
 	applePay: boolean;
 	googlePay: boolean;
+	payPal?: boolean | undefined;
 	/**
-	 * The wallets ranked by which sheet is native to this browser — Apple Pay first on WebKit, Google Pay first everywhere else — so express buttons can stack best-first. Absent on consumer-stated availability (previews) and on wires that predate it. An inline union, not payment-request's WalletSheetType: that module already imports this one.
+	 * The wallets ranked by which sheet is native to this browser — Apple Pay first on WebKit, Google Pay first everywhere else, PayPal last — so express buttons can stack best-first. Absent on consumer-stated availability (previews) and on wires that predate it. An inline union, not payment-request's WalletSheetType: that module already imports this one.
 	 */
-	order?: ("apple_pay" | "google_pay")[] | undefined;
+	order?: ("apple_pay" | "google_pay" | "paypal_express")[] | undefined;
 }
 
 /**
@@ -1228,7 +1213,7 @@ export interface PaymentRequestResult {
 	 * Confirmation token ID, prefixed `ctok_`. Confirm it server-side with your secret key.
 	 */
 	ctok: string;
-	type: "apple_pay" | "google_pay";
+	type: "apple_pay" | "google_pay" | "paypal_express";
 	payer: { email?: string | undefined; name?: string | undefined; phone?: string | undefined; country?: string | undefined; };
 	shipping: { address?: PaymentRequestAddress | undefined; option?: PaymentRequestShippingOption | undefined; } | null;
 }

package/wallet.d.cts

@@ -1730,7 +1730,7 @@ export interface BreakdownElementCreateOptions {
 	/**
 	 * A balance row or its matching bar segment was clicked. The host can open details for `available`, `pending`, `reserve`, or `debt`.
 	 */
-	onBreakdownSelected?: ((payload: { category: "available" | "pending" | "reserve" | "debt"; }) => void);
+	onBreakdownSelected?: ((payload: { category: "available" | "debt" | "pending" | "reserve"; }) => void);
 	/**
 	 * Runs after the loading skeleton first paints and before `onReady`.
 	 */
@@ -2828,6 +2828,38 @@ export interface Money {
 	display_decimals: number;
 }
 
+/**
+ * Declared from the app's `UserProfilePicture`, referenced by a host-capability surface.
+ */
+export interface UserProfilePicture {
+	/**
+	 * Avatar image URL. Always present — a generated placeholder when the user set no picture.
+	 */
+	url: string;
+}
+
+/**
+ * Declared from the app's `UserSummary`, referenced by a host-capability surface.
+ */
+export interface UserSummary {
+	/**
+	 * User ID, prefixed `user_`.
+	 */
+	id: string;
+	/**
+	 * Public username.
+	 */
+	username: string;
+	/**
+	 * Display name.
+	 */
+	name: string | null;
+	/**
+	 * Avatar wrapper; its `url` is always present, using a generated placeholder when the user set no picture.
+	 */
+	profile_picture: UserProfilePicture;
+}
+
 /**
  * Declared from the app's `LedgerActivity`, referenced by a host-capability surface.
  */
@@ -2840,7 +2872,7 @@ export interface LedgerActivity {
 	/**
 	 * The ledger line category this activity was posted under.
 	 */
-	line_type: "platform_balance_transfer_outgoing" | "payment_gross" | "withdrawal" | "topup" | "payment_dispute" | "payment_revshare" | "card_spend_authorization" | "airdrop" | "onchain_swap_target" | "cashback" | "account_settlement" | "ad_budget_release" | "ad_campaign_budget" | "ad_publisher_payout" | "ad_publisher_payout_received" | "ad_spend_charge" | "affiliate_fee" | "airdrop_link_created" | "airdrop_link_redeemed" | "airdrop_link_returned" | "airdrop_reversal" | "application_fee" | "application_fee_payout" | "balance_reservation" | "balance_reservation_reversal" | "bank_transfer" | "billing_percentage_fee" | "buyer_fee" | "card_interchange" | "card_load_deposit" | "card_load_transfer" | "card_spend_authorization_void" | "card_spend_refund" | "card_unload_deposit" | "card_unload_transfer" | "cashback_funding" | "company_referral" | "connected_account_negative_balance" | "cross_border_percentage_fee" | "currency_conversion_incoming" | "currency_conversion_outgoing" | "dispute_alert_fee" | "dispute_hold_adjustment" | "dispute_representment_fee" | "economic_intelligence_percentage_fee" | "external_card_load_deposit" | "fraud_prevention_fee" | "fx_percentage_fee" | "high_risk_merchant_fee" | "installment_default" | "internal_balance_transfer_incoming" | "internal_balance_transfer_outgoing" | "internal_withdrawal" | "internal_withdrawal_complete" | "internal_withdrawal_fee" | "internal_withdrawal_fee_reversal" | "internal_withdrawal_in_transit" | "internal_withdrawal_in_transit_reversal" | "internal_withdrawal_markup_fee" | "internal_withdrawal_markup_fee_payout" | "internal_withdrawal_markup_fee_payout_reversal" | "internal_withdrawal_markup_fee_reversal" | "internal_withdrawal_reversal" | "legacy_crypto_payment" | "legacy_payment" | "legacy_payment_refund" | "license_sale" | "license_sale_commission" | "license_sale_revenue" | "marketplace_affiliate_fee" | "misc_purchase" | "misc_refund" | "misc_reversal" | "onboarding_reward" | "onchain_deposit" | "onchain_swap_source" | "onchain_wallet_transfer_incoming" | "onchain_wallet_transfer_outgoing" | "onchain_withdrawal" | "orchestration_percentage_fee" | "partner_grant_reward" | "passthrough_gmv" | "payment_dispute_adjustment" | "payment_dispute_fee" | "payment_dispute_reversal" | "payment_gross_reversal" | "payment_processing_fixed_fee" | "payment_processing_percentage_fee" | "payment_referral" | "payment_referral_refund" | "payment_referral_reversal" | "payment_refund" | "payment_refund_reversal" | "payment_revshare_payout" | "payment_revshare_refund" | "payment_revshare_reversal" | "payout_fee" | "platform_affiliate_payment" | "platform_affiliate_payment_reversal" | "platform_balance_payment" | "platform_balance_payment_refund" | "platform_balance_transfer_fee" | "platform_balance_transfer_incoming" | "platform_covered_dispute" | "platform_credits_granted" | "platform_credits_payment" | "platform_credits_payment_refund" | "platform_earning" | "platform_markup_fee" | "platform_markup_fee_payout" | "promo_reversal" | "referral_bonus" | "resolution_center_refund" | "revshare_percentage_fee" | "sales_tax_fee" | "sales_tax_remittance" | "sales_tax_remittance_reversal" | "software_rental_revshare" | "software_rental_transaction" | "stripe_domestic_processing_fee" | "stripe_international_processing_fee" | "swap_fee" | "three_ds_fixed_fee" | "topup_fee" | "topup_reversal" | "treasury_payin" | "whop_processing_fee" | "withdrawal_clawback" | "withdrawal_clawback_reversal" | "withdrawal_fee" | "withdrawal_fee_reversal" | "withdrawal_markup_fee" | "withdrawal_markup_fee_payout" | "withdrawal_markup_fee_payout_reversal" | "withdrawal_markup_fee_reversal" | "withdrawal_reclassification" | "withdrawal_reversal" | "withdrawal_topup_adjustment" | "deposit" | "wallet_transfer_incoming" | "wallet_transfer_outgoing" | "swap_source" | "swap_target";
+	line_type: "platform_balance_transfer_outgoing" | "payment_gross" | "withdrawal" | "topup" | "payment_dispute" | "payment_revshare" | "card_spend_authorization" | "airdrop" | "onchain_swap_target" | "cashback" | "account_settlement" | "ad_budget_release" | "ad_campaign_budget" | "ad_publisher_payout" | "ad_publisher_payout_received" | "ad_spend_charge" | "affiliate_fee" | "airdrop_link_created" | "airdrop_link_redeemed" | "airdrop_link_returned" | "airdrop_reversal" | "application_fee" | "application_fee_payout" | "balance_reservation" | "balance_reservation_reversal" | "bank_transfer" | "billing_percentage_fee" | "buyer_fee" | "card_interchange" | "card_load_deposit" | "card_load_transfer" | "card_spend_authorization_void" | "card_spend_refund" | "card_unload_deposit" | "card_unload_transfer" | "cashback_funding" | "company_referral" | "connected_account_negative_balance" | "cross_border_percentage_fee" | "currency_conversion_incoming" | "currency_conversion_outgoing" | "dispute_alert_fee" | "dispute_hold_adjustment" | "dispute_representment_fee" | "economic_intelligence_percentage_fee" | "external_card_load_deposit" | "fraud_prevention_fee" | "fx_percentage_fee" | "high_risk_merchant_fee" | "installment_default" | "internal_balance_transfer_incoming" | "internal_balance_transfer_outgoing" | "internal_withdrawal" | "internal_withdrawal_complete" | "internal_withdrawal_fee" | "internal_withdrawal_fee_reversal" | "internal_withdrawal_in_transit" | "internal_withdrawal_in_transit_reversal" | "internal_withdrawal_markup_fee" | "internal_withdrawal_markup_fee_payout" | "internal_withdrawal_markup_fee_payout_reversal" | "internal_withdrawal_markup_fee_reversal" | "internal_withdrawal_reversal" | "legacy_crypto_payment" | "legacy_payment" | "legacy_payment_refund" | "license_sale" | "license_sale_commission" | "license_sale_revenue" | "marketplace_affiliate_fee" | "misc_purchase" | "misc_refund" | "misc_reversal" | "onboarding_reward" | "onchain_deposit" | "onchain_swap_source" | "onchain_wallet_transfer_incoming" | "onchain_wallet_transfer_outgoing" | "onchain_withdrawal" | "orchestration_percentage_fee" | "partner_grant_reward" | "passthrough_gmv" | "payment_dispute_adjustment" | "payment_dispute_fee" | "payment_dispute_reversal" | "payment_gross_reversal" | "payment_processing_fixed_fee" | "payment_processing_percentage_fee" | "payment_referral" | "payment_referral_refund" | "payment_referral_reversal" | "payment_refund" | "payment_refund_reversal" | "payment_revshare_payout" | "payment_revshare_refund" | "payment_revshare_reversal" | "payout_fee" | "platform_affiliate_payment" | "platform_affiliate_payment_reversal" | "platform_balance_payment" | "platform_balance_payment_refund" | "platform_balance_transfer_fee" | "platform_balance_transfer_incoming" | "platform_covered_dispute" | "platform_credits_granted" | "platform_credits_payment" | "platform_credits_payment_refund" | "platform_earning" | "platform_markup_fee" | "platform_markup_fee_payout" | "promo_reversal" | "referral_bonus" | "resolution_center_refund" | "revshare_percentage_fee" | "sales_tax_fee" | "sales_tax_remittance" | "sales_tax_remittance_reversal" | "software_rental_revshare" | "software_rental_transaction" | "stripe_domestic_processing_fee" | "stripe_international_processing_fee" | "swap_fee" | "three_ds_fixed_fee" | "topup_fee" | "topup_reversal" | "treasury_payin" | "whop_processing_fee" | "withdrawal_clawback" | "withdrawal_clawback_reversal" | "withdrawal_fee" | "withdrawal_fee_reversal" | "withdrawal_markup_fee" | "withdrawal_markup_fee_payout" | "withdrawal_markup_fee_payout_reversal" | "withdrawal_markup_fee_reversal" | "withdrawal_reclassification" | "withdrawal_reversal" | "withdrawal_topup_adjustment" | "psp_payment_receivable" | "ad_spend_purchase" | "psp_refund_payable" | "passthrough_gmv_offset" | "aggregated_fee" | "sales_tax_collected" | "sales_tax_collected_reversal" | "sales_tax_remitted" | "dispute_hold_blocked" | "psp_dispute_payable" | "withdrawal_payable" | "withdrawal_payable_reversal" | "payout_receivable" | "clawback_receivable" | "clawback_receivable_reversal" | "treasury_payin_receivable" | "onchain_deposit_offset" | "onchain_withdrawal_offset" | "trading_account_withdrawal" | "trading_account_withdrawal_offset" | "trading_account_deposit" | "trading_account_deposit_offset" | "onchain_swap_offset" | "whop_swap_fee_received" | "internal_withdrawal_payable" | "internal_withdrawal_payable_reversal" | "external_card_load_offset" | "card_spend_authorization_hold" | "card_spend_capture" | "card_spend_capture_offset" | "card_spend_authorization_void_release" | "card_spend_refund_offset" | "cashback_expense" | "card_interchange_receivable" | "balance_reservation_hold" | "balance_reservation_release" | "bad_debt_offset" | "bad_debt_expense" | "connected_account_clawback" | "payment_referral_payable" | "application_fee_payable" | "airdrop_expense" | "airdrop_expense_reversal" | "airdrop_link_funded" | "airdrop_link_canceled" | "airdrop_link_claimed" | "ad_funding_disbursement" | "ads_card_spread" | "ad_network_cost" | "ad_spend_margin" | "ad_income_expense" | "ad_income_receipt" | "ad_network_settlement" | "ad_balance_funding_receipt" | "fx_gain_loss" | "fx_markup" | "payment_receivable_settlement" | "platform_earning_settlement" | "platform_earning_unreconciled_clearing" | "payment_receivable_clearing" | "payment_receivable_reversal" | "payment_unreconciled_clearing" | "payment_unreconciled_reversal" | "settlement_shortfall_loss" | "fx_settlement_gain_loss" | "settlement_rounding_variance" | "psp_payout_settlement" | "psp_payout_deposit" | "psp_payout_receivable" | "psp_payout_receivable_clearing" | "payout_unreconciled_clearing" | "psp_currency_conversion_outgoing" | "psp_currency_conversion_incoming" | "psp_currency_conversion_receivable" | "psp_currency_conversion_receivable_clearing" | "psp_fx_adjustment" | "refund_settlement" | "refund_settlement_reversal" | "refund_payable_clearing" | "refund_payable_reversal" | "refund_unreconciled_clearing" | "refund_unreconciled_reversal" | "psp_account_debit" | "payment_refund_fee" | "dispute_settlement" | "dispute_settlement_reversal" | "dispute_payable_clearing" | "dispute_payable_reversal" | "dispute_unreconciled_clearing" | "dispute_unreconciled_reversal" | "psp_reserve_hold" | "psp_reserve_release" | "psp_dispute_fee" | "psp_dispute_alert_fee" | "psp_refund_fee" | "psp_account_updater_fee" | "psp_adjusted_processing_fee" | "psp_authentication_fee" | "psp_commission_fee" | "psp_fixed_fee" | "psp_gateway_fee" | "psp_interchange_fee" | "psp_invoice_tax_fee" | "psp_markup_fee" | "psp_network_token_fee" | "psp_optimization_fee" | "psp_payment_method_fee" | "psp_payout_fee" | "psp_processing_fee" | "psp_risk_fee" | "psp_scheme_fee" | "psp_variable_fee" | "psp_billing_fee" | "psp_tax_service_fee" | "psp_connect_fee" | "external_account_connection_fee" | "psp_external_account_connection_fee" | "psp_invoicing_fee" | "psp_terminal_fee" | "treasury_fee" | "psp_treasury_fee" | "accelerated_settlement_fee" | "psp_accelerated_settlement_fee" | "psp_receivable_pooled" | "psp_pool_settlement" | "psp_pool_clearing" | "psp_pool_refund_settlement" | "psp_pool_refund_clearing" | "psp_correction" | "psp_payin_settlement" | "psp_payin_clearing" | "psp_bank_pull_settlement" | "psp_bank_pull_clearing" | "psp_pool_dispute_settlement" | "psp_payout_consolidation" | "psp_withholding_tax" | "psp_payout_settlement_reversal" | "psp_transfer_settlement" | "psp_transfer_settlement_reversal" | "psp_collection_settlement" | "payout_subsidy" | "withdrawal_payable_clearing" | "withdrawal_payable_clearing_reversal" | "identity_verification_fee" | "psp_identity_verification_fee" | "tax_filing_fee" | "psp_tax_filing_fee" | "psp_service_fee" | "recipient_wallet_load" | "psp_recipient_wallet_load" | "dispute_management_fee" | "psp_dispute_management_fee" | "psp_clawback_settlement" | "psp_clawback_settlement_reversal" | "clawback_receivable_settlement" | "clawback_receivable_settlement_reversal" | "clawback_fee" | "psp_clawback_fee" | "deposit" | "wallet_transfer_incoming" | "wallet_transfer_outgoing" | "swap_source" | "swap_target";
 	/**
 	 * Signed amount in the currency's smallest precision units.
 	 */
@@ -2868,7 +2900,7 @@ export interface LedgerActivity {
 	/**
 	 * Source of this ledger activity. Platform markup fees use object platform_fee and the ledger activity ID.
 	 */
-	source: { object: string; id: string; fee_kind?: "transfer" | "card_spend" | "deposit" | "swap" | "payout" | null | undefined; status?: string | null | undefined; payment_amount?: Money | null | undefined; payment_method_type?: string | null | undefined; payment_processor?: string | null | undefined; card_brand?: string | null | undefined; reason?: string | null | undefined; notes?: string | null | undefined; risk_review_hold?: boolean | null | undefined; claim_url?: string | null | undefined; amount_float?: number | null | undefined; created_at?: string | null | undefined; estimated_arrival?: string | null | undefined; payer_name?: string | null | undefined; payout_token_nickname?: string | null | undefined; tx_hash?: string | null | undefined; sender_address?: string | null | undefined; chain?: string | null | undefined; from_amount?: string | null | undefined; from_currency?: string | null | undefined; to_amount?: string | null | undefined; to_currency?: string | null | undefined; payout_destination?: { payer_name?: string | null | undefined; icon_url?: string | null | undefined; } | null | undefined; [key: string]: unknown; } | null;
+	source: { object: string; id: string; fee_kind?: "transfer" | "card_spend" | "deposit" | "swap" | "payout" | null | undefined; status?: string | null | undefined; payment_amount?: Money | null | undefined; payment_method_type?: string | null | undefined; payment_processor?: string | null | undefined; card_brand?: string | null | undefined; reason?: string | null | undefined; notes?: string | null | undefined; risk_review_hold?: boolean | null | undefined; claim_url?: string | null | undefined; amount_float?: number | null | undefined; payout_amount?: Money | null | undefined; fee_amount?: Money | null | undefined; fee_type?: "exclusive" | "inclusive" | null | undefined; created_by_user?: UserSummary | null | undefined; trace_code?: string | null | undefined; created_at?: string | null | undefined; estimated_arrival?: string | null | undefined; payer_name?: string | null | undefined; payout_token_nickname?: string | null | undefined; tx_hash?: string | null | undefined; sender_address?: string | null | undefined; chain?: string | null | undefined; from_amount?: string | null | undefined; from_currency?: string | null | undefined; to_amount?: string | null | undefined; to_currency?: string | null | undefined; payout_destination?: { payer_name?: string | null | undefined; icon_url?: string | null | undefined; } | null | undefined; [key: string]: unknown; } | null;
 	/**
 	 * Payment related to this ledger activity. Included when rich resource hydration is enabled and the movement is tied to a payment.
 	 */

package/wallet.d.ts

@@ -1730,7 +1730,7 @@ export interface BreakdownElementCreateOptions {
 	/**
 	 * A balance row or its matching bar segment was clicked. The host can open details for `available`, `pending`, `reserve`, or `debt`.
 	 */
-	onBreakdownSelected?: ((payload: { category: "available" | "pending" | "reserve" | "debt"; }) => void);
+	onBreakdownSelected?: ((payload: { category: "available" | "debt" | "pending" | "reserve"; }) => void);
 	/**
 	 * Runs after the loading skeleton first paints and before `onReady`.
 	 */
@@ -2828,6 +2828,38 @@ export interface Money {
 	display_decimals: number;
 }
 
+/**
+ * Declared from the app's `UserProfilePicture`, referenced by a host-capability surface.
+ */
+export interface UserProfilePicture {
+	/**
+	 * Avatar image URL. Always present — a generated placeholder when the user set no picture.
+	 */
+	url: string;
+}
+
+/**
+ * Declared from the app's `UserSummary`, referenced by a host-capability surface.
+ */
+export interface UserSummary {
+	/**
+	 * User ID, prefixed `user_`.
+	 */
+	id: string;
+	/**
+	 * Public username.
+	 */
+	username: string;
+	/**
+	 * Display name.
+	 */
+	name: string | null;
+	/**
+	 * Avatar wrapper; its `url` is always present, using a generated placeholder when the user set no picture.
+	 */
+	profile_picture: UserProfilePicture;
+}
+
 /**
  * Declared from the app's `LedgerActivity`, referenced by a host-capability surface.
  */
@@ -2840,7 +2872,7 @@ export interface LedgerActivity {
 	/**
 	 * The ledger line category this activity was posted under.
 	 */
-	line_type: "platform_balance_transfer_outgoing" | "payment_gross" | "withdrawal" | "topup" | "payment_dispute" | "payment_revshare" | "card_spend_authorization" | "airdrop" | "onchain_swap_target" | "cashback" | "account_settlement" | "ad_budget_release" | "ad_campaign_budget" | "ad_publisher_payout" | "ad_publisher_payout_received" | "ad_spend_charge" | "affiliate_fee" | "airdrop_link_created" | "airdrop_link_redeemed" | "airdrop_link_returned" | "airdrop_reversal" | "application_fee" | "application_fee_payout" | "balance_reservation" | "balance_reservation_reversal" | "bank_transfer" | "billing_percentage_fee" | "buyer_fee" | "card_interchange" | "card_load_deposit" | "card_load_transfer" | "card_spend_authorization_void" | "card_spend_refund" | "card_unload_deposit" | "card_unload_transfer" | "cashback_funding" | "company_referral" | "connected_account_negative_balance" | "cross_border_percentage_fee" | "currency_conversion_incoming" | "currency_conversion_outgoing" | "dispute_alert_fee" | "dispute_hold_adjustment" | "dispute_representment_fee" | "economic_intelligence_percentage_fee" | "external_card_load_deposit" | "fraud_prevention_fee" | "fx_percentage_fee" | "high_risk_merchant_fee" | "installment_default" | "internal_balance_transfer_incoming" | "internal_balance_transfer_outgoing" | "internal_withdrawal" | "internal_withdrawal_complete" | "internal_withdrawal_fee" | "internal_withdrawal_fee_reversal" | "internal_withdrawal_in_transit" | "internal_withdrawal_in_transit_reversal" | "internal_withdrawal_markup_fee" | "internal_withdrawal_markup_fee_payout" | "internal_withdrawal_markup_fee_payout_reversal" | "internal_withdrawal_markup_fee_reversal" | "internal_withdrawal_reversal" | "legacy_crypto_payment" | "legacy_payment" | "legacy_payment_refund" | "license_sale" | "license_sale_commission" | "license_sale_revenue" | "marketplace_affiliate_fee" | "misc_purchase" | "misc_refund" | "misc_reversal" | "onboarding_reward" | "onchain_deposit" | "onchain_swap_source" | "onchain_wallet_transfer_incoming" | "onchain_wallet_transfer_outgoing" | "onchain_withdrawal" | "orchestration_percentage_fee" | "partner_grant_reward" | "passthrough_gmv" | "payment_dispute_adjustment" | "payment_dispute_fee" | "payment_dispute_reversal" | "payment_gross_reversal" | "payment_processing_fixed_fee" | "payment_processing_percentage_fee" | "payment_referral" | "payment_referral_refund" | "payment_referral_reversal" | "payment_refund" | "payment_refund_reversal" | "payment_revshare_payout" | "payment_revshare_refund" | "payment_revshare_reversal" | "payout_fee" | "platform_affiliate_payment" | "platform_affiliate_payment_reversal" | "platform_balance_payment" | "platform_balance_payment_refund" | "platform_balance_transfer_fee" | "platform_balance_transfer_incoming" | "platform_covered_dispute" | "platform_credits_granted" | "platform_credits_payment" | "platform_credits_payment_refund" | "platform_earning" | "platform_markup_fee" | "platform_markup_fee_payout" | "promo_reversal" | "referral_bonus" | "resolution_center_refund" | "revshare_percentage_fee" | "sales_tax_fee" | "sales_tax_remittance" | "sales_tax_remittance_reversal" | "software_rental_revshare" | "software_rental_transaction" | "stripe_domestic_processing_fee" | "stripe_international_processing_fee" | "swap_fee" | "three_ds_fixed_fee" | "topup_fee" | "topup_reversal" | "treasury_payin" | "whop_processing_fee" | "withdrawal_clawback" | "withdrawal_clawback_reversal" | "withdrawal_fee" | "withdrawal_fee_reversal" | "withdrawal_markup_fee" | "withdrawal_markup_fee_payout" | "withdrawal_markup_fee_payout_reversal" | "withdrawal_markup_fee_reversal" | "withdrawal_reclassification" | "withdrawal_reversal" | "withdrawal_topup_adjustment" | "deposit" | "wallet_transfer_incoming" | "wallet_transfer_outgoing" | "swap_source" | "swap_target";
+	line_type: "platform_balance_transfer_outgoing" | "payment_gross" | "withdrawal" | "topup" | "payment_dispute" | "payment_revshare" | "card_spend_authorization" | "airdrop" | "onchain_swap_target" | "cashback" | "account_settlement" | "ad_budget_release" | "ad_campaign_budget" | "ad_publisher_payout" | "ad_publisher_payout_received" | "ad_spend_charge" | "affiliate_fee" | "airdrop_link_created" | "airdrop_link_redeemed" | "airdrop_link_returned" | "airdrop_reversal" | "application_fee" | "application_fee_payout" | "balance_reservation" | "balance_reservation_reversal" | "bank_transfer" | "billing_percentage_fee" | "buyer_fee" | "card_interchange" | "card_load_deposit" | "card_load_transfer" | "card_spend_authorization_void" | "card_spend_refund" | "card_unload_deposit" | "card_unload_transfer" | "cashback_funding" | "company_referral" | "connected_account_negative_balance" | "cross_border_percentage_fee" | "currency_conversion_incoming" | "currency_conversion_outgoing" | "dispute_alert_fee" | "dispute_hold_adjustment" | "dispute_representment_fee" | "economic_intelligence_percentage_fee" | "external_card_load_deposit" | "fraud_prevention_fee" | "fx_percentage_fee" | "high_risk_merchant_fee" | "installment_default" | "internal_balance_transfer_incoming" | "internal_balance_transfer_outgoing" | "internal_withdrawal" | "internal_withdrawal_complete" | "internal_withdrawal_fee" | "internal_withdrawal_fee_reversal" | "internal_withdrawal_in_transit" | "internal_withdrawal_in_transit_reversal" | "internal_withdrawal_markup_fee" | "internal_withdrawal_markup_fee_payout" | "internal_withdrawal_markup_fee_payout_reversal" | "internal_withdrawal_markup_fee_reversal" | "internal_withdrawal_reversal" | "legacy_crypto_payment" | "legacy_payment" | "legacy_payment_refund" | "license_sale" | "license_sale_commission" | "license_sale_revenue" | "marketplace_affiliate_fee" | "misc_purchase" | "misc_refund" | "misc_reversal" | "onboarding_reward" | "onchain_deposit" | "onchain_swap_source" | "onchain_wallet_transfer_incoming" | "onchain_wallet_transfer_outgoing" | "onchain_withdrawal" | "orchestration_percentage_fee" | "partner_grant_reward" | "passthrough_gmv" | "payment_dispute_adjustment" | "payment_dispute_fee" | "payment_dispute_reversal" | "payment_gross_reversal" | "payment_processing_fixed_fee" | "payment_processing_percentage_fee" | "payment_referral" | "payment_referral_refund" | "payment_referral_reversal" | "payment_refund" | "payment_refund_reversal" | "payment_revshare_payout" | "payment_revshare_refund" | "payment_revshare_reversal" | "payout_fee" | "platform_affiliate_payment" | "platform_affiliate_payment_reversal" | "platform_balance_payment" | "platform_balance_payment_refund" | "platform_balance_transfer_fee" | "platform_balance_transfer_incoming" | "platform_covered_dispute" | "platform_credits_granted" | "platform_credits_payment" | "platform_credits_payment_refund" | "platform_earning" | "platform_markup_fee" | "platform_markup_fee_payout" | "promo_reversal" | "referral_bonus" | "resolution_center_refund" | "revshare_percentage_fee" | "sales_tax_fee" | "sales_tax_remittance" | "sales_tax_remittance_reversal" | "software_rental_revshare" | "software_rental_transaction" | "stripe_domestic_processing_fee" | "stripe_international_processing_fee" | "swap_fee" | "three_ds_fixed_fee" | "topup_fee" | "topup_reversal" | "treasury_payin" | "whop_processing_fee" | "withdrawal_clawback" | "withdrawal_clawback_reversal" | "withdrawal_fee" | "withdrawal_fee_reversal" | "withdrawal_markup_fee" | "withdrawal_markup_fee_payout" | "withdrawal_markup_fee_payout_reversal" | "withdrawal_markup_fee_reversal" | "withdrawal_reclassification" | "withdrawal_reversal" | "withdrawal_topup_adjustment" | "psp_payment_receivable" | "ad_spend_purchase" | "psp_refund_payable" | "passthrough_gmv_offset" | "aggregated_fee" | "sales_tax_collected" | "sales_tax_collected_reversal" | "sales_tax_remitted" | "dispute_hold_blocked" | "psp_dispute_payable" | "withdrawal_payable" | "withdrawal_payable_reversal" | "payout_receivable" | "clawback_receivable" | "clawback_receivable_reversal" | "treasury_payin_receivable" | "onchain_deposit_offset" | "onchain_withdrawal_offset" | "trading_account_withdrawal" | "trading_account_withdrawal_offset" | "trading_account_deposit" | "trading_account_deposit_offset" | "onchain_swap_offset" | "whop_swap_fee_received" | "internal_withdrawal_payable" | "internal_withdrawal_payable_reversal" | "external_card_load_offset" | "card_spend_authorization_hold" | "card_spend_capture" | "card_spend_capture_offset" | "card_spend_authorization_void_release" | "card_spend_refund_offset" | "cashback_expense" | "card_interchange_receivable" | "balance_reservation_hold" | "balance_reservation_release" | "bad_debt_offset" | "bad_debt_expense" | "connected_account_clawback" | "payment_referral_payable" | "application_fee_payable" | "airdrop_expense" | "airdrop_expense_reversal" | "airdrop_link_funded" | "airdrop_link_canceled" | "airdrop_link_claimed" | "ad_funding_disbursement" | "ads_card_spread" | "ad_network_cost" | "ad_spend_margin" | "ad_income_expense" | "ad_income_receipt" | "ad_network_settlement" | "ad_balance_funding_receipt" | "fx_gain_loss" | "fx_markup" | "payment_receivable_settlement" | "platform_earning_settlement" | "platform_earning_unreconciled_clearing" | "payment_receivable_clearing" | "payment_receivable_reversal" | "payment_unreconciled_clearing" | "payment_unreconciled_reversal" | "settlement_shortfall_loss" | "fx_settlement_gain_loss" | "settlement_rounding_variance" | "psp_payout_settlement" | "psp_payout_deposit" | "psp_payout_receivable" | "psp_payout_receivable_clearing" | "payout_unreconciled_clearing" | "psp_currency_conversion_outgoing" | "psp_currency_conversion_incoming" | "psp_currency_conversion_receivable" | "psp_currency_conversion_receivable_clearing" | "psp_fx_adjustment" | "refund_settlement" | "refund_settlement_reversal" | "refund_payable_clearing" | "refund_payable_reversal" | "refund_unreconciled_clearing" | "refund_unreconciled_reversal" | "psp_account_debit" | "payment_refund_fee" | "dispute_settlement" | "dispute_settlement_reversal" | "dispute_payable_clearing" | "dispute_payable_reversal" | "dispute_unreconciled_clearing" | "dispute_unreconciled_reversal" | "psp_reserve_hold" | "psp_reserve_release" | "psp_dispute_fee" | "psp_dispute_alert_fee" | "psp_refund_fee" | "psp_account_updater_fee" | "psp_adjusted_processing_fee" | "psp_authentication_fee" | "psp_commission_fee" | "psp_fixed_fee" | "psp_gateway_fee" | "psp_interchange_fee" | "psp_invoice_tax_fee" | "psp_markup_fee" | "psp_network_token_fee" | "psp_optimization_fee" | "psp_payment_method_fee" | "psp_payout_fee" | "psp_processing_fee" | "psp_risk_fee" | "psp_scheme_fee" | "psp_variable_fee" | "psp_billing_fee" | "psp_tax_service_fee" | "psp_connect_fee" | "external_account_connection_fee" | "psp_external_account_connection_fee" | "psp_invoicing_fee" | "psp_terminal_fee" | "treasury_fee" | "psp_treasury_fee" | "accelerated_settlement_fee" | "psp_accelerated_settlement_fee" | "psp_receivable_pooled" | "psp_pool_settlement" | "psp_pool_clearing" | "psp_pool_refund_settlement" | "psp_pool_refund_clearing" | "psp_correction" | "psp_payin_settlement" | "psp_payin_clearing" | "psp_bank_pull_settlement" | "psp_bank_pull_clearing" | "psp_pool_dispute_settlement" | "psp_payout_consolidation" | "psp_withholding_tax" | "psp_payout_settlement_reversal" | "psp_transfer_settlement" | "psp_transfer_settlement_reversal" | "psp_collection_settlement" | "payout_subsidy" | "withdrawal_payable_clearing" | "withdrawal_payable_clearing_reversal" | "identity_verification_fee" | "psp_identity_verification_fee" | "tax_filing_fee" | "psp_tax_filing_fee" | "psp_service_fee" | "recipient_wallet_load" | "psp_recipient_wallet_load" | "dispute_management_fee" | "psp_dispute_management_fee" | "psp_clawback_settlement" | "psp_clawback_settlement_reversal" | "clawback_receivable_settlement" | "clawback_receivable_settlement_reversal" | "clawback_fee" | "psp_clawback_fee" | "deposit" | "wallet_transfer_incoming" | "wallet_transfer_outgoing" | "swap_source" | "swap_target";
 	/**
 	 * Signed amount in the currency's smallest precision units.
 	 */
@@ -2868,7 +2900,7 @@ export interface LedgerActivity {
 	/**
 	 * Source of this ledger activity. Platform markup fees use object platform_fee and the ledger activity ID.
 	 */
-	source: { object: string; id: string; fee_kind?: "transfer" | "card_spend" | "deposit" | "swap" | "payout" | null | undefined; status?: string | null | undefined; payment_amount?: Money | null | undefined; payment_method_type?: string | null | undefined; payment_processor?: string | null | undefined; card_brand?: string | null | undefined; reason?: string | null | undefined; notes?: string | null | undefined; risk_review_hold?: boolean | null | undefined; claim_url?: string | null | undefined; amount_float?: number | null | undefined; created_at?: string | null | undefined; estimated_arrival?: string | null | undefined; payer_name?: string | null | undefined; payout_token_nickname?: string | null | undefined; tx_hash?: string | null | undefined; sender_address?: string | null | undefined; chain?: string | null | undefined; from_amount?: string | null | undefined; from_currency?: string | null | undefined; to_amount?: string | null | undefined; to_currency?: string | null | undefined; payout_destination?: { payer_name?: string | null | undefined; icon_url?: string | null | undefined; } | null | undefined; [key: string]: unknown; } | null;
+	source: { object: string; id: string; fee_kind?: "transfer" | "card_spend" | "deposit" | "swap" | "payout" | null | undefined; status?: string | null | undefined; payment_amount?: Money | null | undefined; payment_method_type?: string | null | undefined; payment_processor?: string | null | undefined; card_brand?: string | null | undefined; reason?: string | null | undefined; notes?: string | null | undefined; risk_review_hold?: boolean | null | undefined; claim_url?: string | null | undefined; amount_float?: number | null | undefined; payout_amount?: Money | null | undefined; fee_amount?: Money | null | undefined; fee_type?: "exclusive" | "inclusive" | null | undefined; created_by_user?: UserSummary | null | undefined; trace_code?: string | null | undefined; created_at?: string | null | undefined; estimated_arrival?: string | null | undefined; payer_name?: string | null | undefined; payout_token_nickname?: string | null | undefined; tx_hash?: string | null | undefined; sender_address?: string | null | undefined; chain?: string | null | undefined; from_amount?: string | null | undefined; from_currency?: string | null | undefined; to_amount?: string | null | undefined; to_currency?: string | null | undefined; payout_destination?: { payer_name?: string | null | undefined; icon_url?: string | null | undefined; } | null | undefined; [key: string]: unknown; } | null;
 	/**
 	 * Payment related to this ledger activity. Included when rich resource hydration is enabled and the movement is tied to a payment.
 	 */