@volter/twin-sentry 0.1.0

package/dist/src/cli.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import { keepProcessAlive } from '@volter/world-core/lifecycle';
+// world-sentry CLI: serve the Sentry API twin (ingestion + Web API), the dashboard mirror
+// UI, or run conformance. (Conformance lives in dev-tooling; cli.ts must not import it, so
+// it's loaded lazily only when the `conformance` command is invoked.)
+import { hasFlag, optionValue } from '@volter/world-core/args';
+import { createSentryTwinServer } from "./sentry-server.js";
+import { createSentryMirrorServer } from "./sentry-mirror-ui.js";
+import { defaultDsn } from "./sentry-ingest.js";
+const [cmd, ...rest] = process.argv.slice(2);
+const port = Number(optionValue(rest, '--port', '0')) || undefined;
+const root = optionValue(rest, '--root') || undefined;
+const readOnly = hasFlag(rest, '--read-only'); // a twin accepts writes/events unless read-only
+if (cmd === 'serve') {
+    const s = await createSentryTwinServer({ readOnly, ...(root ? { root } : {}), ...(port ? { port } : {}) });
+    const origin = `http://127.0.0.1:${s.port}`;
+    process.stdout.write(`sentry twin (ingest + Web API)${readOnly ? ' [read-only]' : ''} at ${origin}\n`);
+    process.stdout.write(`  point @sentry/node at DSN: ${defaultDsn(origin)}\n`);
+    await keepProcessAlive();
+}
+else if (cmd === 'mirror') {
+    const s = await createSentryMirrorServer({ ...(root ? { root } : {}), ...(port ? { port } : {}) });
+    process.stdout.write(`sentry mirror UI (dashboard) at http://127.0.0.1:${s.port}\n`);
+    await keepProcessAlive();
+}
+else if (cmd === 'conformance') {
+    // dev-only: dynamic import so the conformance module never enters the runtime entrypoints.
+    const { checkSentryConformance } = await import("./sentry-conformance.js");
+    const report = await checkSentryConformance({ ...(root ? { root } : {}) });
+    process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    if (!report.ok)
+        process.exitCode = 1;
+}
+else {
+    process.stdout.write('Usage: world-sentry serve|mirror|conformance [--port N] [--root DIR] [--read-only]\n');
+}

package/dist/src/index.d.ts

@@ -0,0 +1,15 @@
+export { handleSentryTwinRequest } from './sentry-twin.js';
+export type { SentryRequest, SentryResponse } from './sentry-twin.js';
+export { createSentryTwinFetch, createSentryTwinServer, type SentryTwinFetchOptions } from './sentry-server.js';
+export { defaultDsn, DEFAULT_ORG, DEFAULT_PROJECT, DEFAULT_PROJECT_ID, DEFAULT_PUBLIC_KEY, ensureDefaultProject, envelopeEvents, eventCulprit, eventTitle, fingerprintText, hashFingerprint, ingestEvent, issueIdFor, normalizeFingerprintText, parseEnvelope, publicKeyFromAuthHeader, publicKeyFromDsn, resolveProjectKey, resolvePublicKey, } from './sentry-ingest.js';
+export type { IngestOutcome, ParsedEnvelope, ResolvedKey, SentryEventPayload, SentryExceptionValue, SentryFrame } from './sentry-ingest.js';
+export { computeSentrySignature, constructSentryWebhook, emitIssueAlert, listAlertRules, registerAlertRule, SentrySignatureVerificationError, verifySentrySignature, } from './sentry-events.js';
+export type { AlertTrigger, SentryWebhook, SentryWebhookAction, SentryWebhookDelivery } from './sentry-events.js';
+export { liveSentryExecute, mapIssue, mapProject, mapRelease, pullSentryIssues, pullSentryProjects, pullSentryReleases, pushSentryAction, sentryRequestForAction, syncSentryFromReal, } from './sentry-connector.js';
+export type { SentryExecute, LiveSentryOptions } from './sentry-connector.js';
+export { SENTRY_BUDGET_CEILING, SENTRY_BUDGET_MAX_RETRY_AFTER_S, SENTRY_BUDGET_WINDOW_MS, SENTRY_CALL_WEIGHTS, SENTRY_RATE_BUDGET, SentryBudget, SentryBudgetError, sentryBudgetPath, sentryCallWeight, } from './sentry-budget.js';
+export type { SentryBudgetErrorKind, SentryBudgetOptions, SentryBudgetReservation, SentryBudgetSnapshot } from './sentry-budget.js';
+export { buildSentryMirrorClient, createSentryMirrorServer, eventTags, formatCount, latestStacktrace, levelTone, sentryMirrorHtml, statusTone, timeAgo, } from './sentry-mirror-ui.js';
+export type { IssueRow, StackFrame } from './sentry-mirror-ui.js';
+import type { TwinPack } from '@volter/world-core';
+export declare const pack: TwinPack;

package/dist/src/index.js

@@ -0,0 +1,75 @@
+// @volter/twin-sentry — the Sentry twin (one vendor, one package), built on the shared
+// @volter/world-core kernel. Two API families over local event-sourced state: INGESTION (the
+// `@sentry/node` store/envelope endpoints → grouped issues) and the WEB API (/api/0/...:
+// issues, events, projects, keys/DSN, releases, deploys, orgs, teams, alert rules), plus
+// signed alert webhooks and a React dashboard mirror. No real Sentry is ever contacted.
+// (Conformance tooling lives in @volter/world-tooling, a dev dependency — not shipped here.)
+export { handleSentryTwinRequest } from "./sentry-twin.js";
+export { createSentryTwinFetch, createSentryTwinServer } from "./sentry-server.js";
+export { defaultDsn, DEFAULT_ORG, DEFAULT_PROJECT, DEFAULT_PROJECT_ID, DEFAULT_PUBLIC_KEY, ensureDefaultProject, envelopeEvents, eventCulprit, eventTitle, fingerprintText, hashFingerprint, ingestEvent, issueIdFor, normalizeFingerprintText, parseEnvelope, publicKeyFromAuthHeader, publicKeyFromDsn, resolveProjectKey, resolvePublicKey, } from "./sentry-ingest.js";
+export { computeSentrySignature, constructSentryWebhook, emitIssueAlert, listAlertRules, registerAlertRule, SentrySignatureVerificationError, verifySentrySignature, } from "./sentry-events.js";
+export { liveSentryExecute, mapIssue, mapProject, mapRelease, pullSentryIssues, pullSentryProjects, pullSentryReleases, pushSentryAction, sentryRequestForAction, syncSentryFromReal, } from "./sentry-connector.js";
+// The client-side rate budget — the fail-closed backstop `liveSentryExecute` routes every live
+// request through. The MECHANISM is the kernel's shared, vendor-agnostic `RateBudget`; what lives
+// here is Sentry's DECLARATION (window/ceiling/per-endpoint weights) plus the vendor-bound
+// bindings. Exported so an operator can inspect spend (`snapshot`) and so a caller can catch
+// `SentryBudgetError` by type; there is deliberately no export that disables the guard.
+export { SENTRY_BUDGET_CEILING, SENTRY_BUDGET_MAX_RETRY_AFTER_S, SENTRY_BUDGET_WINDOW_MS, SENTRY_CALL_WEIGHTS, SENTRY_RATE_BUDGET, SentryBudget, SentryBudgetError, sentryBudgetPath, sentryCallWeight, } from "./sentry-budget.js";
+export { buildSentryMirrorClient, createSentryMirrorServer, eventTags, formatCount, latestStacktrace, levelTone, sentryMirrorHtml, statusTone, timeAgo, } from "./sentry-mirror-ui.js";
+import { SENTRY_RATE_BUDGET as RATE_BUDGET } from "./sentry-budget.js";
+import { performSentryAction, syncSentryFromRemote } from "./sentry-connector.js";
+export const pack = {
+    // PROTOCOL 2 (docs/contributing/architecture.md#protocol-2-the-pack-is-a-plugin): the pack is a plugin — its wire, its tree, and its half of the real
+    // state system. Moved 2026-09-08. TRIAGE is what crosses to Sentry — an issue resolved, assigned, muted;
+    // everything else this twin holds is something Sentry told it.
+    protocol: '2',
+    refresh: { every: '2m', webhook: true, onDemand: { atMost: '30s' } },
+    stateSystem: { perform: performSentryAction, refresh: syncSentryFromRemote },
+    // the round trip: an organization, then a project in it — the two things a Sentry account is made of
+    // the round trip: an organization, a team in it, then a project under that team — Sentry's own create
+    // path for a project is /teams/:org/:team/projects/, not the organization
+    roundTrip: [
+        { method: 'POST', path: '/api/0/organizations/', body: { name: 'Round Trip', slug: 'round-trip' }, headers: { authorization: 'Bearer round-trip' } },
+        { method: 'POST', path: '/api/0/organizations/round-trip/teams/', body: { name: 'Round Trip', slug: 'round-trip' }, headers: { authorization: 'Bearer round-trip' } },
+        { method: 'POST', path: '/api/0/teams/round-trip/round-trip/projects/', body: { name: 'Round Trip', platform: 'node' }, headers: { authorization: 'Bearer round-trip' } },
+        // a project's slug is unique inside its org, so the create above rightly refuses a second one on a
+        // branch that already has it — the vendor's own truth. The last write is therefore the one a world
+        // repeats freely: triage on the project's own issue stream.
+        { method: 'PUT', path: '/api/0/projects/round-trip/round-trip/', body: { platform: 'node', digestsMinDelay: 60 }, headers: { authorization: 'Bearer round-trip' } },
+    ],
+    parityOrigin: 'http://twin',
+    vendor: 'sentry',
+    // The SAME object sentry-budget.ts declares at module load — one source of truth, so registering
+    // the pack and importing the connector can never arm two different ceilings.
+    rateBudget: RATE_BUDGET,
+    transport: 'rest',
+    archetype: 'crud',
+    bin: 'world-sentry',
+    resources: ['organization', 'team', 'project', 'project_key', 'issue', 'event', 'event_attachment', 'session', 'project_ownership', 'codeowners', 'project_filter', 'release', 'release_file', 'deploy', 'alert_rule', 'metric_alert', 'org_integration'],
+    specSource: 'Sentry API reference (https://docs.sentry.io/api/) — ingest store/envelope + Web API /api/0/',
+    description: 'Sentry REST twin — SDK ingestion → grouped issues, Web API, signed alert webhooks, dashboard mirror.',
+    // Adoption + interception, moved off the central maps unchanged (descriptor-first back-migration, adding-a-twin.md §3,
+    // 2026-08-31). The four canonical clients plus the further first-party @sentry
+    // framework SDKs of the same ingest surface — battery-observed: sentry was the single
+    // most-missed vendor, 13 repos, largely via these — and the whole `@sentry/` scope so a
+    // satellite package like `@sentry/cli` still detects.
+    adoption: {
+        // Sentry's official Python SDK - the one distribution behind every Python integration.
+        pypi: ['sentry-sdk'],
+        sdks: [
+            '@sentry/node', '@sentry/browser', '@sentry/react', '@sentry/nextjs',
+            '@sentry/vue', '@sentry/sveltekit', '@sentry/astro', '@sentry/remix',
+            '@sentry/electron', '@sentry/react-native',
+        ],
+        scopes: ['@sentry/'],
+        // 'APPSMITHSENTRY' — appsmith names its DSN APPSMITH_SENTRY_DSN, an app-prefixed Sentry
+        // credential for the same ingest surface (ladder classification 2026-09-02).
+        envStems: ['SENTRY', 'APPSMITHSENTRY'],
+    },
+    // sentry.io (the web/REST API) plus the per-organization DSN ingest hosts
+    // (`o<org-id>.ingest.sentry.io`), which need the suffix form.
+    hosts: [{ host: 'sentry.io' }, { suffix: '.ingest.sentry.io' }],
+    // The @sentry/node SDK POSTs to <dsn-host>/api/:projectId/envelope/; the dashboard hits
+    // /api/0/. The dev proxy forwards both prefixes to the twin and strips the sentry.io host.
+    browserRouting: { apiPathPrefix: '/api/', loaderHost: 'https://sentry.io' },
+};

package/dist/src/sentry-budget.d.ts

@@ -0,0 +1,50 @@
+import { RateBudget, type RateBudgetDeclaration, type RateBudgetOptions, type RateBudgetReservation, type RateBudgetSnapshot } from '@volter/world-core';
+/** Rolling window, in ms. Spend older than this is pruned. */
+export declare const SENTRY_BUDGET_WINDOW_MS = 60000;
+/**
+ * Weighted units allowed inside one window. 60/60s at `defaultWeight` 2 = 30 calls a minute —
+ * EXACTLY the kernel's undeclared fallback, because Sentry publishes no scalar that would justify
+ * more. See the header.
+ */
+export declare const SENTRY_BUDGET_CEILING = 60;
+/** Seconds. A `Retry-After` above this means the token is throttled hard — fail loudly, don't sleep. */
+export declare const SENTRY_BUDGET_MAX_RETRY_AFTER_S = 300;
+/** Per-call cost, keyed by `"<METHOD> <path>"`. No figure here can claim to be published. */
+export declare const SENTRY_CALL_WEIGHTS: {
+    /** `…/issues/` and `…/events/` list reads — the cursor-paginated firehose the docs say not to poll. */
+    readonly stream: 4;
+    /** Everything else: project/release/issue reads, issue updates. */
+    readonly other: 2;
+};
+/** THE PACK'S DECLARATION — pure data, the only Sentry-specific thing in the whole budget. */
+export declare const SENTRY_RATE_BUDGET: RateBudgetDeclaration;
+/**
+ * Price one call. The key is `"<METHOD> <path>"` with the query string split off, so a rule can
+ * price by method without the kernel knowing anything about Sentry. An unclassified endpoint still
+ * costs `defaultWeight` — nothing is ever free.
+ */
+export declare function sentryCallWeight(method: string, path: string): number;
+/** Where Sentry's ledger lives. Token-keyed and cwd-independent by default (limits attach to the
+ *  auth token's organization, so a cwd-scoped ledger would hand the same token a fresh allowance in
+ *  every checkout, worktree and CI matrix leg); pass `root` to opt into world-scoped accounting. */
+export declare function sentryBudgetPath(opts?: {
+    root?: string;
+    token?: string;
+} | string): string;
+/** Construction options for Sentry's budget. The vendor is fixed; everything else may only TIGHTEN. */
+export type SentryBudgetOptions = Omit<RateBudgetOptions, 'vendor'>;
+/**
+ * Sentry's budget — the shared kernel guard bound to this vendor's declaration. A real subclass,
+ * not an alias, so `budget instanceof SentryBudget` in `liveSentryExecute` means "a budget that
+ * accounts against SENTRY's ledger under SENTRY's ceiling": another vendor's `RateBudget` (with its
+ * own, possibly larger, ceiling) is NOT assignable there.
+ */
+export declare class SentryBudget extends RateBudget {
+    constructor(opts?: SentryBudgetOptions);
+}
+/** The typed refusal. One error class shared with every other vendor's budget; `err.vendor` says
+ *  which one refused, and `err.kind` says why. */
+export { RateBudgetError as SentryBudgetError } from '@volter/world-core';
+export type { RateBudgetErrorKind as SentryBudgetErrorKind } from '@volter/world-core';
+export type SentryBudgetReservation = RateBudgetReservation;
+export type SentryBudgetSnapshot = RateBudgetSnapshot;

package/dist/src/sentry-budget.js

@@ -0,0 +1,145 @@
+// Sentry's CLIENT-SIDE RATE BUDGET — the pack's DECLARATION (the numbers) plus the thin typed
+// bindings `liveSentryExecute` uses. The MECHANISM — the durable token-keyed ledger, the rolling
+// window, reserve-under-lock, the `Retry-After`/429 cooldown, fail-CLOSED on a corrupt ledger —
+// lives ONCE in the vendor-agnostic kernel (`@volter/world-core` → `rateBudget.ts`). Read that module's
+// header for the full rationale AND for the honest list of what the guard does not guarantee (an
+// injected clock or ledger path still defeats it — it guards carelessness, not malice).
+//
+// ── WHY THIS EXISTS ─────────────────────────────────────────────────────────────────────────
+// A real ~4.5-DAY vendor lockout (Figma, 2026-07-25) happened because raw API calls were made
+// outside the pack's connector — no cache, no batching, no ceiling. Discipline only binds the code
+// that follows it; a BUDGET binds the code that does not.
+//
+// ── HOW THE CEILING WAS CHOSEN: NO SCALAR IS PUBLISHED ──────────────────────────────────────
+// Sentry does NOT publish a scalar limit. From https://docs.sentry.io/api/ratelimits/ (read
+// 2026-07-26): every request is rate limited on TWO axes — a requests-per-second fixed window and a
+// concurrency cap — and "each endpoint has its own maximum number of requests and window size". No
+// figure is stated anywhere. (Plan-dependence is widely reported but is NOT on that page, so it is
+// not quoted as if it were — §9 removed an earlier quotation mark around it, 2026-07-26.) Over the limit you get
+// 429 + `Retry-After`, and every response carries `X-Sentry-Rate-Limit-Limit` / `-Remaining` /
+// `-Reset` / `-ConcurrentLimit` / `-ConcurrentRemaining`. The docs' own advice is to prefer
+// webhooks over polling.
+//
+// So this budget deliberately does NOT model the vendor's limit, and the numbers below are NOT
+// derived from one. Because there is no documented figure to justify going higher, the ceiling is
+// pinned at the kernel's own undeclared fallback in every dimension: 60 weighted units per 60s at
+// `defaultWeight` 2 — 30 calls a minute, exactly `DEFAULT_RATE_BUDGET`, with no endpoint priced
+// CHEAPER than the fallback would price it. What this declaration adds over the fallback is
+// therefore not headroom, it is RESOLUTION: the paginated firehose gets priced up.
+//
+// The one thing the guard genuinely buys here is the COOLDOWN: `X-Sentry-Rate-Limit-Remaining: 0`
+// and `Retry-After` are both read off the response and turn into a persisted refusal, so the
+// vendor's first "back off" becomes a hard client-side stop instead of a retry storm — which is the
+// only correct response to a limit whose real value you cannot know client-side.
+//
+// ── HOW THE WEIGHTS WERE CHOSEN (a judgement call, stated as one) ────────────────────────────
+// Since no per-endpoint figure is published, no weight here can claim to be arithmetic. The single
+// rule prices the ISSUE/EVENT list reads at 4 — double the default. They are the cursor-paginated
+// firehose (an org's whole event stream, page after page), they are the thing the docs single out
+// as "use webhooks instead of polling this", and they play exactly the role `/images` renders
+// played in the Figma lockout: the endpoint a pagination bug turns into hundreds of calls. At
+// weight 4 at most 15 land in a window.
+import { declareRateBudget, rateBudgetPath, rateBudgetWeight, RateBudget, } from '@volter/world-core';
+const VENDOR = 'sentry';
+/** Rolling window, in ms. Spend older than this is pruned. */
+export const SENTRY_BUDGET_WINDOW_MS = 60_000;
+/**
+ * Weighted units allowed inside one window. 60/60s at `defaultWeight` 2 = 30 calls a minute —
+ * EXACTLY the kernel's undeclared fallback, because Sentry publishes no scalar that would justify
+ * more. See the header.
+ */
+export const SENTRY_BUDGET_CEILING = 60;
+/** Seconds. A `Retry-After` above this means the token is throttled hard — fail loudly, don't sleep. */
+export const SENTRY_BUDGET_MAX_RETRY_AFTER_S = 300;
+/** Per-call cost, keyed by `"<METHOD> <path>"`. No figure here can claim to be published. */
+export const SENTRY_CALL_WEIGHTS = {
+    /** `…/issues/` and `…/events/` list reads — the cursor-paginated firehose the docs say not to poll. */
+    stream: 4,
+    /** Everything else: project/release/issue reads, issue updates. */
+    other: 2,
+};
+/** THE PACK'S DECLARATION — pure data, the only Sentry-specific thing in the whole budget. */
+export const SENTRY_RATE_BUDGET = {
+    windowMs: SENTRY_BUDGET_WINDOW_MS,
+    ceiling: SENTRY_BUDGET_CEILING,
+    defaultWeight: SENTRY_CALL_WEIGHTS.other,
+    maxRetryAfterSeconds: SENTRY_BUDGET_MAX_RETRY_AFTER_S,
+    rules: [
+        // `(/|$)` rather than a bare trailing `/`: the pricer normalizes a trailing slash away (so
+        // `…/issues/` and `…/issues` are one endpoint), and a rule insisting on the slash would miss both.
+        // (§9 finding, 2026-07-26.)
+        { match: '^GET /api/0/(projects|organizations)/[^/]+/[^/]+/(issues|events)(/|$)', weight: SENTRY_CALL_WEIGHTS.stream },
+    ],
+    reason: 'Sentry publishes NO scalar limit (docs.sentry.io/api/ratelimits, read 2026-07-26): every request ' +
+        'is limited on a requests-per-second fixed window AND a concurrency cap, "each endpoint has its ' +
+        'own maximum number of requests and window size", and no figure is stated anywhere. ' +
+        'Over it: 429 + Retry-After, with X-Sentry-Rate-Limit-Limit/-Remaining/-Reset/-ConcurrentLimit ' +
+        'headers on every response, and the docs advise webhooks over polling. Because no published ' +
+        'figure justifies going higher, the ceiling is pinned at the kernel fallback in EVERY dimension ' +
+        '— 60 units / 60s at defaultWeight 2 = 30 calls/min, and no endpoint is priced cheaper than the ' +
+        'fallback would price it; the declaration buys resolution, not headroom. The issue/event LIST ' +
+        'reads cost 4 (the cursor-paginated firehose the docs single out, and the shape a pagination bug ' +
+        'turns into hundreds of calls) — a judgement call, not a published cost, since none exists. What ' +
+        "the guard genuinely buys here is the cooldown: the vendor's first back-off signal becomes a " +
+        'persisted client-side stop instead of a retry storm.',
+};
+// Declared at module load, so merely importing this module (which `sentry-connector.ts` does) is
+// enough to arm the real ceiling. `RateBudget` reads its policy live precisely so this declaration
+// takes effect the moment it lands, and constructing through the subclass below (which imports this
+// module) is what makes the ordering a non-issue in practice.
+declareRateBudget(VENDOR, SENTRY_RATE_BUDGET);
+/**
+ * Price one call. The key is `"<METHOD> <path>"` with the query string split off, so a rule can
+ * price by method without the kernel knowing anything about Sentry. An unclassified endpoint still
+ * costs `defaultWeight` — nothing is ever free.
+ */
+export function sentryCallWeight(method, path) {
+    const { bare, query } = splitQuery(path);
+    // UPPER-CASE the method: `fetch` normalizes a known lowercase method before sending, so
+    // `execute('post', …)` really does issue a POST and must be priced as one.
+    return rateBudgetWeight(VENDOR, `${String(method).toUpperCase()} ${bare}`, query);
+}
+/**
+ * `/v1/x?a=1` -> `{ bare: '/v1/x', query: { a: '1' } }`. Rules match the path; `whenQuery*` the query.
+ *
+ * NORMALIZED, because the anchored rules are otherwise trivially evaded (§9 finding, 2026-07-26):
+ * `fetch` upper-cases a known method before sending, so `execute('post', …)` issues a real WRITE
+ * that a `^POST ` rule would price as a read; and a trailing slash makes a path miss a `$` anchor
+ * while most routers treat it as the same endpoint. Both are input variations, not attacks, and
+ * either one silently voids the "expensive endpoints are priced up" claim the ceiling rests on.
+ */
+function splitQuery(path) {
+    const at = path.indexOf('?');
+    const query = {};
+    if (at !== -1)
+        for (const [k, v] of new URLSearchParams(path.slice(at + 1)))
+            query[k] = v;
+    const raw = at === -1 ? path : path.slice(0, at);
+    // Collapse a trailing slash, but never turn the root path into the empty string.
+    const bare = raw.length > 1 && raw.endsWith('/') ? raw.replace(/\/+$/, '') : raw;
+    return { bare, query };
+}
+/** Where Sentry's ledger lives. Token-keyed and cwd-independent by default (limits attach to the
+ *  auth token's organization, so a cwd-scoped ledger would hand the same token a fresh allowance in
+ *  every checkout, worktree and CI matrix leg); pass `root` to opt into world-scoped accounting. */
+export function sentryBudgetPath(opts = {}) {
+    const o = typeof opts === 'string' ? { root: opts } : opts;
+    // VENDOR spread LAST: a loosely-typed `{ vendor: 'other', … }` slipping through (TypeScript's
+    // excess-property check only catches object literals) must not redirect this pack's ledger to
+    // another vendor's file.
+    return rateBudgetPath({ ...o, vendor: VENDOR });
+}
+/**
+ * Sentry's budget — the shared kernel guard bound to this vendor's declaration. A real subclass,
+ * not an alias, so `budget instanceof SentryBudget` in `liveSentryExecute` means "a budget that
+ * accounts against SENTRY's ledger under SENTRY's ceiling": another vendor's `RateBudget` (with its
+ * own, possibly larger, ceiling) is NOT assignable there.
+ */
+export class SentryBudget extends RateBudget {
+    constructor(opts = {}) {
+        super({ ...opts, vendor: VENDOR });
+    }
+}
+/** The typed refusal. One error class shared with every other vendor's budget; `err.vendor` says
+ *  which one refused, and `err.kind` says why. */
+export { RateBudgetError as SentryBudgetError } from '@volter/world-core';

package/dist/src/sentry-capabilities.d.ts

@@ -0,0 +1,3 @@
+import { type CapabilityReport, type CapabilitySpec } from '@volter/world-tooling';
+export declare const SENTRY_CAPABILITIES: CapabilitySpec[];
+export declare function sentryCapabilities(): Promise<CapabilityReport>;