@paypal/paypal-js

7689364: Add v6 types for updateClientToken() on the SDK instance

051a03e: Increase the v6 loadCoreSdkScript per-attempt script load timeout from 30 seconds to 60 seconds so slow networks have more time to load the Core SDK script before the load is reported as timed out.

83e6ca1: Only treat a v6 SDK on the window namespace as a loaded V6 core script, so a v5 SDK already on window.paypal no longer resolves loadCoreSdkScript after a failed or timed out load.

89827ba: Resolve V6 core script loading when the SDK namespace is available but the script load event is not observed before the timeout.

adc91b9: Prevent V6 Core SDK timeout retries from evaluating two in-flight script responses. Explicit script errors still retry, while slow requests now wait up to 30 seconds on the original script instead of inserting another one.

5f61e1d: Updates the v6 script loader with the following changes:

934c705: Consolidate protype pollution proerty guard with a helper function.

d4bc19a: Add new fundingSource attribute to OnApproveData types for V6

cb9899e: Expand the v6 eligibility FundingSource type to include supported local payment methods.

a6997f0: Added name as a valid field to existing Card Fields types

39f147e: Guard the environment option against prototype pollution in validateArguments().

processOptions() already read environment via Object.prototype.hasOwnProperty.call(), but validateArguments() (v5 loadScript) and the v6 loadCoreSdkScript validator still destructured it directly, so a polluted Object.prototype.environment was picked up before those guards ran. On the v5 path a junk value would throw and break loadScript() entirely; on the v6 path a polluted "sandbox" value would pass validation and silently load the sandbox SDK. Both validators now use an own-property check so inherited values are ignored.

24ccc6a: Make onApprove genuinely optional on PayPalOneTimePaymentSessionOptions (and its PayLaterOneTimePaymentSessionOptions / PayPalCreditOneTimePaymentSessionOptions aliases).

The type intersected BasePaymentSessionOptions — where onApprove is required — and re-declared onApprove? without Omit-ing it from the base first. In a TypeScript intersection a property is optional only if it is optional in every constituent, so the ? had no effect and onApprove was required in practice (#1020). Because the presentation mode is only chosen later at .start() (a separate call) and redirect flows legitimately have no in-page approval callback, core cannot require onApprove. It is now re-added as optional via Omit<BasePaymentSessionOptions, "onApprove">, mirroring SavePaymentSessionOptions.

eb54388: Emit a nested dist/v6/esm/package.json with {"type":"module"} so the v6 ESM bundle is correctly signaled as an ES module.

The v6 build outputs ESM syntax into .js files, but the package has no root "type":"module" (it can't — that would relabel the v5 CJS bundles). Under Node's resolution rules those .js files therefore default to CommonJS, so a native ESM import of @paypal/paypal-js/sdk-v6 triggers a MODULE_TYPELESS_PACKAGE_JSON warning plus a reparse penalty on modern Node, and fails to load outright on older Node or loaders without ESM syntax detection. The nested marker scopes the ESM declaration to the v6 directory only, leaving the v5 CJS artifacts untouched.

6b10c2b: A breaking change that removes PayPal's homegrown ApplePaySession browser-global typing from the v6 types.

@paypal/paypal-js/sdk-v6 no longer declares a stripped ApplePaySession class or augments the global Window interface with ApplePaySession. That augmentation conflicted with the community @types/applepayjs package (TS2717 / TS2687), and because it shipped through the sdk-v6 barrel it landed in every consumer's compilation — even projects that never use Apple Pay.

c3b5dbe: Update the v6 Google Pay types for 3D Secure (SCA) support.

GooglePayOneTimePaymentSession.initiatePayerAction changes from the previous no-op
placeholder to its real signature — initiatePayerAction(options: { orderId: string }): Promise<InitiatePayerActionResponse> — which resolves with the 3DS liabilityShift and
rejects if the buyer cancels or authentication fails.

Adds and exports three supporting types: LiabilityShiftType
("UNKNOWN" | "NO" | "YES" | "POSSIBLE"), InitiatePayerActionOptions, and
InitiatePayerActionResponse.

be48634: Add TypeScript types for the v6 local payment methods (LPM) components. LPMPaymentsInstance and the LPMComponents union are now exported from @paypal/paypal-js/sdk-v6, and SdkInstance/Components/CreateInstanceOptions recognize LPM component names (e.g. "ideal-payments", "bancontact-payments") so createInstance returns the LPM methods when an LPM component is requested.

SdkInstance now narrows the LPM methods it exposes to only the components actually requested — for example createInstance({ components: ["ideal-payments"] }) now types createIdealOneTimePaymentSession only, instead of surfacing all 50 LPM session-creation methods as optional. This is powered by a new single-source-of-truth LPMComponentToSessionMethod map (also exported) and an LPMInstanceFor<T> helper type, which replace the previous positionally-aligned LPMComponents/LPMSessionMethodName unions.

Remove optional chaining (?) from LPMInstanceFor<T> methods since requested LPM components are guaranteed to exist at runtime on the SDK instance.

d9c0200: Narrow PayPalMessagesSession.fetchContent to return Promise<MessageContent> (previously Promise<MessageContent | null>). The evergreen SDK never resolves to null — on an API error it returns an empty sentinel MessageContent (empty messageItems) so the <paypal-message> element recognizes the error state and collapses. Existing === null checks against the result become dead code but continue to compile.

09f2994: Fix incomplete prototype-pollution protection in processOptions. The environment option was still read via destructuring, which reads through the prototype chain, so Object.prototype.environment = "sandbox" could downgrade a production checkout to the sandbox SDK URL. environment is now read with a hasOwnProperty guard, matching the existing sdkBaseUrl protection.