Add independent PayPal hosted binding mode

shared/flow-capabilities.js

@@ -378,24 +378,31 @@
       const requestedPlusAccountAccessStrategy = normalizePlusAccountAccessStrategy(
         options?.plusAccountAccessStrategy ?? state?.plusAccountAccessStrategy
       );
+      const basePlusAccountAccessStrategies = [
+        PLUS_ACCOUNT_ACCESS_STRATEGY_OAUTH,
+        PLUS_ACCOUNT_ACCESS_STRATEGY_CPA_CODEX_SESSION,
+        PLUS_ACCOUNT_ACCESS_STRATEGY_SUB2API_CODEX_SESSION,
+      ];
       const availablePlusAccountAccessStrategies = activeFlowId === 'openai'
         && Boolean(flowState.supportsPlusMode)
         && Boolean(runtimeLocks.plusModeEnabled)
         && effectiveSignupMethod === SIGNUP_METHOD_EMAIL
-        ? (
-          Array.isArray(targetState.supportedPlusAccountAccessStrategies)
-            && targetState.supportedPlusAccountAccessStrategies.length > 0
-            ? targetState.supportedPlusAccountAccessStrategies.slice()
-            : [PLUS_ACCOUNT_ACCESS_STRATEGY_OAUTH]
-        )
+        ? (runtimeLocks.accountContribution
+          ? [PLUS_ACCOUNT_ACCESS_STRATEGY_SUB2API_CODEX_SESSION]
+          : basePlusAccountAccessStrategies)
         : [PLUS_ACCOUNT_ACCESS_STRATEGY_OAUTH];
-      const effectivePlusAccountAccessStrategy = availablePlusAccountAccessStrategies.includes(requestedPlusAccountAccessStrategy)
+      const effectivePlusAccountAccessStrategy = runtimeLocks.accountContribution
+        && runtimeLocks.plusModeEnabled
+        && effectiveSignupMethod === SIGNUP_METHOD_EMAIL
+        ? PLUS_ACCOUNT_ACCESS_STRATEGY_SUB2API_CODEX_SESSION
+        : availablePlusAccountAccessStrategies.includes(requestedPlusAccountAccessStrategy)
         ? requestedPlusAccountAccessStrategy
         : PLUS_ACCOUNT_ACCESS_STRATEGY_OAUTH;
       const canEditPlusAccountAccessStrategy = activeFlowId === 'openai'
         && Boolean(flowState.supportsPlusMode)
         && Boolean(runtimeLocks.plusModeEnabled)
         && effectiveSignupMethod === SIGNUP_METHOD_EMAIL
+        && !runtimeLocks.accountContribution
         && availablePlusAccountAccessStrategies.length > 1;
       const visibleGroupIds = typeof flowRegistryApi.getVisibleGroupIds === 'function'
         && isRegisteredFlowId(activeFlowId)

shared/settings-schema.js

@@ -105,8 +105,11 @@
             },
             plus: {
               plusModeEnabled: false,
-              plusPaymentMethod: 'paypal',
+              plusPaymentMethod: 'paypal-hosted',
               plusAccountAccessStrategy: 'oauth',
+              hostedCheckoutVerificationUrl: '',
+              hostedCheckoutPhoneNumber: '',
+              plusHostedCheckoutOauthDelaySeconds: 3,
             },
             autoRun: {
               stepExecutionRange: {
@@ -317,6 +320,24 @@
                 ?? nested?.flows?.openai?.plus?.plusAccountAccessStrategy
                 ?? defaults.flows.openai.plus.plusAccountAccessStrategy
               ),
+              hostedCheckoutVerificationUrl: String(
+                input?.hostedCheckoutVerificationUrl
+                ?? nested?.flows?.openai?.plus?.hostedCheckoutVerificationUrl
+                ?? defaults.flows.openai.plus.hostedCheckoutVerificationUrl
+              ).trim(),
+              hostedCheckoutPhoneNumber: String(
+                input?.hostedCheckoutPhoneNumber
+                ?? nested?.flows?.openai?.plus?.hostedCheckoutPhoneNumber
+                ?? defaults.flows.openai.plus.hostedCheckoutPhoneNumber
+              ).trim(),
+              plusHostedCheckoutOauthDelaySeconds: (() => {
+                const numeric = Number(
+                  input?.plusHostedCheckoutOauthDelaySeconds
+                  ?? nested?.flows?.openai?.plus?.plusHostedCheckoutOauthDelaySeconds
+                  ?? defaults.flows.openai.plus.plusHostedCheckoutOauthDelaySeconds
+                );
+                return Math.min(120, Math.max(0, Math.floor(Number.isFinite(numeric) ? numeric : defaults.flows.openai.plus.plusHostedCheckoutOauthDelaySeconds)));
+              })(),
             },
             autoRun: {
               stepExecutionRange: normalizeStepExecutionRangeEntry(
@@ -456,6 +477,9 @@
       next.plusModeEnabled = openaiState.plus.plusModeEnabled;
       next.plusPaymentMethod = openaiState.plus.plusPaymentMethod;
       next.plusAccountAccessStrategy = openaiState.plus.plusAccountAccessStrategy;
+      next.hostedCheckoutVerificationUrl = openaiState.plus.hostedCheckoutVerificationUrl;
+      next.hostedCheckoutPhoneNumber = openaiState.plus.hostedCheckoutPhoneNumber;
+      next.plusHostedCheckoutOauthDelaySeconds = openaiState.plus.plusHostedCheckoutOauthDelaySeconds;
       next.mailProvider = normalizedState.services.email.provider;
       next.ipProxyEnabled = normalizedState.services.proxy.enabled;
       next.ipProxyService = normalizedState.services.proxy.provider;