1.4.0

Minor Changes

• 9988376: When your Apple Pay or Google Pay change handler throws or rejects, the sheet now shows an error for that change right away. A billingAddressChange handler that throws, rejects, answers with errors, or doesn't answer within 10 seconds now refuses that card, so the buyer picks another one; before, the sheet kept the current total. In PayPal, the same answers refuse the address the buyer picked. Apple Pay has no error slot for a shipping option, so a refused option keeps the last accepted total and the error shows when the buyer taps Pay. (#33706)
• 9988376: The payment request can now open PayPal. canMakePayment() reports payPal where the account offers PayPal in the request's currency, the amount is within PayPal's limits, and the page is a whop.com page or a domain verified as a payment method domain for the account, and show('paypal_express'), called synchronously in the buyer's press like Apple Pay and Google Pay, opens PayPal at the request's amount: a pop-up on desktop, PayPal's in-page window when the pop-up is blocked, and the in-page window on mobile. Each shipping address the buyer picks in PayPal fires billingAddressChange, and shippingAddressChange too with requestShipping, and the total your handlers answer is the one PayPal shows. PayPal has no billing address step of its own and may share only a country at approval, so the shipping address is what the total is taxed on; an error naming a field refuses that part of the address inside PayPal. With requestShipping, your shippingOptions appear in PayPal and the buyer's pick fires shippingOptionChange. The result arrives the same way as the other wallets, with type: 'paypal_express' and, with requestShipping, the address the buyer chose in PayPal as shipping; confirm it like the other wallets' tokens. The token pays at most the total PayPal showed the buyer, and closing PayPal rejects show() as a dismissal. PayPal pays one-time purchases and cannot collect a phone number, so a request with setupFutureUsage or requestPayerPhone reports payPal: false, as does a page that already loads PayPal's own v5 JavaScript SDK. A page with a Content Security Policy must allow www.paypal.com, c.paypal.com, api-m.paypal.com, www.paypalobjects.com, js.braintreegateway.com, assets.braintreegateway.com and *.braintree-api.com. canMakePayment() now always reports payPal, and canMakePayment().order ends with paypal_express. (#33706)
• 9988376: Express checkout can now offer a one-press PayPal button beside Apple Pay and Google Pay on one-time purchases, carts included, where the seller accepts it and the checkout does not need the buyer's phone number. PayPal opens on your page: in a pop-up on desktop, falling back to PayPal's in-page window when the pop-up is blocked, and in the in-page window on mobile. Like Apple Pay and Google Pay, it renders only on whop.com pages and on domains verified as payment method domains for the account, and a page with a Content Security Policy must allow www.paypal.com, c.paypal.com, api-m.paypal.com, www.paypalobjects.com, js.braintreegateway.com, assets.braintreegateway.com and *.braintree-api.com. The purchase finishes without leaving the page. For each address the buyer picks, PayPal shows the checkout's own total, and PayPal shares the buyer's email and that address, which is what tax is computed on and, for physical goods, the shipping address. PayPal has no promo code entry of its own; a code the checkout already holds still applies. The wallets option now accepts paypal_express and includes it by default; pass wallets to limit which buttons appear. (#33706)
• 9988376: Added contentSecurityPolicy(), which returns the sources your Content Security Policy must allow for elements, including the hosts the Apple Pay, Google Pay, and PayPal scripts reach, and merges them into your own policy string, directives object, or response headers. preloadHints() now also warms the Whop API connection and preloads the Apple Pay, Google Pay, and PayPal scripts. Pass environment: "sandbox" for the sandbox API and each provider's sandbox hosts, and wallets: false to either helper on pages that don't show Apple Pay, Google Pay, or PayPal. It still returns an array, now with toLinkHeader(), toHtml(), and applyTo(headers). (#33706)
• resource event failure answer "billingAddressChange" added (payments.paymentRequest.replyFail.billingAddressChange)
• resource event failure answer "shippingAddressChange" added (payments.paymentRequest.replyFail.shippingAddressChange)
• resource event failure answer "shippingOptionChange" added (payments.paymentRequest.replyFail.shippingOptionChange)
• page-requirement group "wallets" added (connect:https://account.google.com, connect:https://api-m.paypal.com, connect:https://api-m.sandbox.paypal.com, connect:https://api.basistheory.com, connect:https://api.braintreegateway.com, connect:https://api.sandbox.braintreegateway.com, connect:https://google.com, connect:https://pay.google.com, connect:https://payments.braintree-api.com, connect:https://payments.sandbox.braintree-api.com, connect:https://www.google.com, connect:https://www.paypal.com, connect:https://www.sandbox.paypal.com, frame:https://assets.braintreegateway.com, frame:https://checkout.paypal.com, frame:https://www.paypal.com, frame:https://www.sandbox.paypal.com, image:https://www.paypalobjects.com, script:https://applepay.cdn-apple.com, script:https://c.paypal.com, script:https://js.braintreegateway.com, script:https://pay.google.com, script:https://www.paypal.com, script:https://www.sandbox.paypal.com) (_pageRequirements.wallets)

Patch Changes

• 9988376: Keep the withdrawal payout picker within the viewport without scrolling the withdrawal modal. (#33706)
• 9988376: Card Details now keeps Whop branding visible at the bottom while card content scrolls. (#33706)