@volter/twin-stripe 0.1.0 → 0.1.1

package/README.md

@@ -40,14 +40,14 @@ world-stripe conformance [--fields FILE] [--root DIR]
 `serve` defaults to `simulator` (the stack uses the twin as a writable Stripe).
 Point the real `stripe` SDK at it with `{ host, port, protocol: 'http' }`.
 
-## Four ways to use it
+## Interaction surfaces
 
-1. **Mock SDK** — *zero edits (preferred):* `STRIPE_TWIN_URL=http://127.0.0.1:PORT node --require @volter/twin/inject your-app` redirects the real `stripe` SDK from `api.stripe.com` to the twin (`cookbook/zero-edit-inject`). For the browser too: `volter-twin proxy --target <app> --map stripe=http://127.0.0.1:PORT` (browser + backend share one twin). *Or* override directly: `new Stripe(key, { host: '127.0.0.1', port: PORT, protocol: 'http' })`.
+1. **SDK/API** — *zero edits (preferred):* `STRIPE_TWIN_URL=http://127.0.0.1:PORT node --require @volter/twin/inject your-app` redirects the real `stripe` SDK from `api.stripe.com` to the twin (`cookbook/zero-edit-inject`). For the browser too: `volter-twin proxy --target <app> --map stripe=http://127.0.0.1:PORT` (browser + backend share one twin). *Or* override directly: `new Stripe(key, { host: '127.0.0.1', port: PORT, protocol: 'http' })`.
 2. **API + CLI** — `world-stripe serve` (writable) + drive with `volter-twin status|plan|refs stripe`, then push.
 3. **Read-only** — `world-stripe serve --read-only`: unlimited local reads, no rate limits; writes refuse like Stripe (4xx).
 4. **UI mirror** — `world-stripe mirror` renders a Stripe-dashboard-style view of the twin's state.
 
-(See the repo's GETTING-STARTED → "Four ways to use a twin".)
+(See Getting Started → "Twin interaction surfaces".)
 
 Stable on the twin rubric: fidelity, read/write/fork, sync, observability, event emission, and conformance are tracked with explicit coverage gaps.
 
@@ -92,8 +92,22 @@ open lifecycle gates, **customer + subscription discount delete**, **promotion-c
 family — **Reviews** (`/approve`), **Value Lists** (+ items), **Rules** — plus a **Radar
 dashboard screen** in the UI mirror.
 
-**Planned** (known-missing, will do) — **Issuing** (cardholders/cards/authorizations/
-transactions + test helpers), **Terminal** (readers/locations/connection tokens), **Treasury**
+**Issuing** (modeled) — cardholders/cards/authorizations/transactions/disputes + test helpers
+(present authorization, capture, force capture, fund_balance), including the **real-time
+authorization leg**: an endpoint enrolled for `issuing_authorization.request` receives the
+signed request event **synchronously** at present time and its JSON response
+(`{approved, amount?}`) decides the authorization within Stripe's 2-second window (timeout →
+declined `webhook_timeout`, invalid response → `webhook_error`); **spending_controls**
+(category/country allow+block lists, per_authorization/all_time/calendar-window spending
+limits) are enforced ahead of the webhook with the vendor's `spending_controls` decline
+reason; and **captures debit the issuing balance** (`balance_transaction` type
+`issuing_transaction`, `balance_type: 'issuing'`, served in `GET /v1/balance`'s `issuing`
+section). Remaining issuing gaps (authorization holds, expire/increment/reverse test
+helpers) are tracked todos in `stripe-capabilities.ts`. **Terminal**
+(locations/readers/connection tokens + process_payment_intent) is likewise modeled — the old
+"Planned" listing for both families was stale.
+
+**Planned** (known-missing, will do) — **Treasury**
 (financial accounts), **Climate**, **Financial Connections**, **Entitlements**, **Billing**
 credit grants + usage alerts, **Connect** remaining surfaces (account sessions, connected-account
 payouts, top-ups, payout reverse), **Reporting/Sigma**, the legacy **Sources** API, and
@@ -108,3 +122,23 @@ todo list — every entry not explicitly out-of-scope is a tracked gap.)
 - Real **money settlement / bank movement** (proposed — pending owner approval): actually moving
   funds is real-world infra, not the API — the payout/balance_transaction/balance *objects* and
   their lifecycle are modeled.
+
+## Rate budget — the fail-closed backstop on live calls
+
+`liveStripeExecute` is the **one place** this pack issues a live request, so every call it makes is charged
+against a persistent, fail-closed spend ledger **before** the request goes out. Past the ceiling, or
+while a `Retry-After`/429 cooldown is armed, it **throws instead of calling**. The ledger is keyed by
+vendor and a hash of the credential (limits are per credential, so it is deliberately *not*
+cwd-scoped) and persists across processes, so a fresh process does not get a fresh allowance; a
+corrupt ledger counts as a **full** window rather than zero spend. There is no option to disable it,
+and no value you can pass for `budget` that yields an unguarded client — an injected budget is
+validated by *method identity*, so a subclass or a `Proxy` that replaces `checkBudget` is refused.
+
+The declared numbers: **120 weighted units / 60s** = 2 requests/second — 2% of Stripe's documented 100/s live mode and 8% of the 25/s a sandbox key or any single endpoint gets. `POST`/`DELETE` cost 2 (not a published ratio — a judgement call about blast radius: a write creates a charge, refund or receipt e-mail and cannot be taken back) and `POST /v1/payouts` costs 5 (documented at 15 creates/second). Stripe's own window is a **second** while this one is a minute, so an intra-second burst reaches Stripe's limiter first; the 429 cooldown is the backstop for that shape.
+
+The mechanism is **shared and vendor-agnostic** — it lives in the kernel (`@volter/twin` →
+`control-plane/src/rateBudget.ts`); what lives here in [`src/stripe-budget.ts`](src/stripe-budget.ts) is this vendor's
+**declaration** (window, ceiling, per-endpoint weights, and a `reason` citing the limits above) plus
+the vendor-bound `StripeBudget`. The rule is ratified as
+[ARCHITECTURE.md](../../../ARCHITECTURE.md) **D8**, and the kernel module's header documents what the
+guard does *not* guarantee — read that before trusting it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-stripe",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Local Stripe twin \u2014 a faithful, stateful local Stripe API your real `stripe` SDK talks to unmodified. Mirror, simulate, and fork. Built on @volter/twin.",
   "keywords": [
     "twin",
@@ -53,7 +53,7 @@
     "react-dom": "^19.2.7"
   },
   "peerDependencies": {
-    "@volter/twin": "0.1.0"
+    "@volter/twin": "0.1.1"
   },
   "devDependencies": {
     "@volter/twin": "0.1.0",

package/src/cli.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import { keepProcessAlive } from '@volter/twin/lifecycle';
 // world-stripe CLI: serve the Stripe API twin, the mirror UI, or run conformance.
 import { hasFlag, optionValue } from '@volter/twin/args';
 import { createStripeTwinServer } from './stripe-server.ts';
@@ -12,11 +13,17 @@ const readOnly = hasFlag(rest, '--read-only'); // a twin accepts writes unless s
 if (cmd === 'serve') {
   const s = createStripeTwinServer({ readOnly, ...(root ? { root } : {}), ...(port ? { port } : {}) });
   process.stdout.write(`stripe twin (spec-correct API)${readOnly ? ' [read-only]' : ''} at http://127.0.0.1:${s.port}\n`);
-  await new Promise(() => {});
+  await keepProcessAlive();
 } else if (cmd === 'mirror') {
   const s = createStripeMirrorServer({ ...(root ? { root } : {}), ...(port ? { port } : {}) });
   process.stdout.write(`stripe mirror UI (dashboard) at http://127.0.0.1:${s.port}\n`);
-  await new Promise(() => {});
+  await keepProcessAlive();
+} else if (cmd === 'emit') {
+  // DELIVER: fire a signed, vendor-shaped event synthesized from twin state at the app's
+  // registered webhook endpoint(s). `emit --list` shows what's emittable right now.
+  const { runEmitCli } = await import('@volter/twin');
+  const { stripeEmitter } = await import('./stripe-emit.ts');
+  process.exit(await runEmitCli(stripeEmitter, rest));
 } else if (cmd === 'conformance') {
   // dev-only; lazy so the bin runs without @volter/twin-tooling
   const { checkStripeConformance, loadStripeKnownDeviations, loadStripeSchemas, stripeCoverage } = await import('./stripe-conformance.ts');
@@ -25,5 +32,5 @@ if (cmd === 'serve') {
   process.stdout.write(`${JSON.stringify({ ...report, coverage: stripeCoverage(schemas, { ...(root ? { root } : {}) }) }, null, 2)}\n`);
   if (!report.ok) process.exitCode = 1;
 } else {
-  process.stdout.write('Usage: world-stripe serve|mirror|conformance [--port N] [--root DIR] [--read-only]\n');
+  process.stdout.write('Usage: world-stripe serve|mirror|emit|conformance [--port N] [--root DIR] [--read-only]\n       world-stripe emit --list [--root DIR] | emit <event.type> <subject-id> [--root DIR] [--endpoint URL|we_id] [--json]\n');
 }

package/src/index.ts

@@ -4,7 +4,10 @@
 // @volter/twin-tooling, a dev dependency — not shipped in the runtime API.)
 export { handleStripeTwinRequest } from './stripe-twin.ts';
 export type { StripeRequest, StripeResponse } from './stripe-twin.ts';
-export { createStripeTwinServer } from './stripe-server.ts';
+// The serverless-ready surface: the whole serve path as a plain fetch, plus the one-line
+// Bun.serve wrapper the CLI/standalone lane uses (jira/slack are the reference packs).
+export { createStripeTwinFetch, createStripeTwinServer } from './stripe-server.ts';
+export type { StripeTwinOptions } from './stripe-server.ts';
 export { parseStripeForm } from './stripe-form.ts';
 export {
   clearStripeWebhooks,
@@ -18,6 +21,8 @@ export {
   StripeSignatureVerificationError,
 } from './stripe-events.ts';
 export type { StripeEvent, StripeEventDelivery } from './stripe-events.ts';
+// The DELIVER verb's pack side (kernel seam: @volter/twin emit.ts) — `world-stripe emit`.
+export { stripeEmitter } from './stripe-emit.ts';
 export {
   fullSyncStripe,
   liveStripeExecute,
@@ -33,15 +38,38 @@ export {
   stripeRequestForAction,
   syncStripeFromReal,
 } from './stripe-connector.ts';
-export type { StripeExecute } from './stripe-connector.ts';
+export type { StripeExecute, LiveStripeOptions } from './stripe-connector.ts';
+// The client-side rate budget — the fail-closed backstop `liveStripeExecute` routes every live
+// request through. The MECHANISM is the kernel's shared, vendor-agnostic `RateBudget`; what lives
+// here is Stripe's DECLARATION (window/ceiling/per-endpoint weights) plus the vendor-bound
+// bindings. Exported so an operator can inspect spend (`snapshot`) and so a caller can catch
+// `StripeBudgetError` by type; there is deliberately no export that disables the guard.
+export {
+  STRIPE_BUDGET_CEILING,
+  STRIPE_BUDGET_MAX_RETRY_AFTER_S,
+  STRIPE_BUDGET_WINDOW_MS,
+  STRIPE_CALL_WEIGHTS,
+  STRIPE_RATE_BUDGET,
+  StripeBudget,
+  StripeBudgetError,
+  stripeBudgetPath,
+  stripeCallWeight,
+} from './stripe-budget.ts';
+export type { StripeBudgetErrorKind, StripeBudgetOptions, StripeBudgetReservation, StripeBudgetSnapshot } from './stripe-budget.ts';
 export { buildStripeMirrorClient, createStripeMirrorServer, stripeMirrorHtml } from './stripe-mirror-ui.ts';
 
 // Registry descriptor (#1): the pack self-describes so tooling can discover it.
 // A consumer does `registerPack(pack)` after importing this package.
 import type { TwinPack } from '@volter/twin';
+import { STRIPE_RATE_BUDGET as RATE_BUDGET } from './stripe-budget.ts';
+import { stripeEmitter } from './stripe-emit.ts';
 export const pack: TwinPack = {
   vendor: 'stripe',
+  // The SAME object stripe-budget.ts declares at module load — one source of truth, so registering
+  // the pack and importing the connector can never arm two different ceilings.
+  rateBudget: RATE_BUDGET,
   transport: 'rest',
+  archetype: 'crud',
   bin: 'world-stripe',
   resources: ['charge', 'customer', 'payment_intent', 'setup_intent', 'payment_method', 'subscription', 'price', 'product', 'invoice', 'invoiceitem', 'refund'],
   specSource: 'test-fixtures/stripe-schemas.json (per-object JSON Schemas from Stripe OpenAPI)',
@@ -49,4 +77,18 @@ export const pack: TwinPack = {
   // Stripe.js calls the same-origin '/v1/…' and loads from api.stripe.com — the dev proxy
   // forwards '/v1/' to the twin and strips the absolute host so calls come back same-origin.
   browserRouting: { apiPathPrefix: '/v1/', loaderHost: 'https://api.stripe.com' },
+  // Adoption + interception: the official server SDK, the STRIPE_* credential stem, and the
+  // one live API host — declared HERE, not in the central maps (TWIN-PACK-CONTRACT exemplar;
+  // the pack-facts artifact carries them to covers/inspect-project and inject.cjs).
+  // NEXT_PRIVATE_STRIPE_* joined the stem list in the adoption-facts sweep 2026-08-31.
+  // `stripeconnect` is deliberately NOT claimed: the Connect area is unmodeled, so a repo
+  // holding only that credential is build-surface, not coverage this twin can honor.
+  adoption: {
+    // Stripe's official Python bindings.
+    pypi: ['stripe'],
+    sdks: ['stripe'], envStems: ['STRIPE', 'NEXTPRIVATESTRIPE'],
+  },
+  hosts: [{ host: 'api.stripe.com' }],
+  // DELIVER support: signed event synthesis from twin state (`world-stripe emit`).
+  emitter: stripeEmitter,
 };

package/src/stripe-budget.ts

@@ -0,0 +1,181 @@
+// Stripe's CLIENT-SIDE RATE BUDGET — the pack's DECLARATION (the numbers) plus the thin typed
+// bindings `liveStripeExecute` uses. The MECHANISM — the durable token-keyed ledger, the rolling
+// window, reserve-under-lock, the `Retry-After`/429 cooldown, fail-CLOSED on a corrupt ledger —
+// lives ONCE in the vendor-agnostic kernel (`@volter/twin` → `rateBudget.ts`). Read that module's
+// header for the full rationale AND for the honest list of what the guard does not guarantee (an
+// injected clock or ledger path still defeats it — it guards carelessness, not malice).
+//
+// ── WHY THIS EXISTS ─────────────────────────────────────────────────────────────────────────
+// A real ~4.5-DAY vendor lockout (Figma, 2026-07-25) happened because raw API calls were made
+// outside the pack's connector — no cache, no batching, no ceiling. Discipline only binds the code
+// that follows it; a BUDGET binds the code that does not. Stripe is the pack where a runaway loop
+// is not merely rude: its writes MOVE MONEY.
+//
+// ── HOW THE CEILING WAS CHOSEN ──────────────────────────────────────────────────────────────
+// Stripe DOES publish scalar limits, so this models the real thing rather than guessing. From
+// https://docs.stripe.com/rate-limits (read 2026-07-26):
+//   • live mode:                    100 requests/second
+//   • sandbox (test mode):           25 requests/second
+//   • an individual endpoint:        25 requests/second unless noted otherwise
+//   • Payouts, create:               15 requests/second
+//   • Subscriptions:                 10 new invoices per subscription per minute
+//   • Payment Intents:            1,000 update requests per PaymentIntent per hour
+// Over the limit: 429, with a `Stripe-Rate-Limited-Reason` header naming which limit was hit.
+//
+// The ceiling is 120 weighted units per 60s — 120 calls a minute, i.e. 2 requests/second at the
+// default weight. That is 2% of the live-mode 100/s and 8% of the tightest general limit (25/s,
+// which is what a sandbox key and any single endpoint get). It is more permissive than the kernel's
+// undeclared fallback (30 calls/min) precisely because those limits are documented and are one to
+// three ORDERS of magnitude higher; without them it would not be.
+//
+// It bounds the 60-second AVERAGE; it does NOT pace (the kernel refuses, it never sleeps — see its
+// header). Stripe's own window is a SECOND, so a tight loop can legitimately fire all 120 inside
+// one second here — 120 req/s, above the sandbox 25/s — and in that shape Stripe's 429 arrives
+// before this ceiling does. The backstop is then the cooldown: the guard reads the 429 off the
+// response and refuses every later call without touching Stripe. The honest claim is therefore
+// "bounds the minute, and converts Stripe's first 429 into a hard stop", not "refuses before Stripe
+// ever 429s". Pacing is the caller's job; this is the ceiling underneath it.
+//
+// ── HOW THE WEIGHTS WERE CHOSEN ─────────────────────────────────────────────────────────────
+//   • `POST` / `DELETE` cost 2. Stripe counts them the same as a read, so this is NOT a published
+//     ratio — it is a judgement call about blast radius: a write creates a charge, a refund, a
+//     subscription or a receipt e-mail, and unlike a read it cannot be taken back. Halving the rate
+//     at which a runaway loop can do that is worth the cost to a legitimate push, which is small
+//     (a push is a handful of writes).
+//   • `POST /v1/payouts` costs 5, because Stripe documents payout creation at 15/second — six times
+//     tighter than live mode's 100/s — and a payout is the single most irreversible object in the
+//     API. At weight 5 at most 24 land in a window: 0.4/s against a documented 15/s.
+import {
+  declareRateBudget,
+  rateBudgetPath,
+  rateBudgetWeight,
+  RateBudget,
+  type RateBudgetDeclaration,
+  type RateBudgetOptions,
+  type RateBudgetReservation,
+  type RateBudgetSnapshot,
+} from '@volter/twin';
+
+const VENDOR = 'stripe';
+
+/** Rolling window, in ms. Spend older than this is pruned. */
+export const STRIPE_BUDGET_WINDOW_MS = 60_000;
+
+/**
+ * Weighted units allowed inside one window. 120/60s = 120 reads a minute (2/second) — 2% of
+ * Stripe's documented live-mode 100/second and 8% of the 25/second a sandbox key or any single
+ * endpoint gets.
+ */
+export const STRIPE_BUDGET_CEILING = 120;
+
+/** Seconds. A `Retry-After` above this means the key is throttled hard — fail loudly, don't sleep. */
+export const STRIPE_BUDGET_MAX_RETRY_AFTER_S = 300;
+
+/** Per-call cost, keyed by `"<METHOD> <path>"`. See the header for what is documented vs. judged. */
+export const STRIPE_CALL_WEIGHTS = {
+  /** `POST /v1/payouts` — documented at 15 creates/second, and the most irreversible object here. */
+  payout: 5,
+  /** Any other `POST`/`DELETE` — creates charges, refunds, subscriptions, receipt e-mail. */
+  write: 2,
+  /** Reads: list/retrieve. */
+  other: 1,
+} as const;
+
+/** THE PACK'S DECLARATION — pure data, the only Stripe-specific thing in the whole budget. */
+export const STRIPE_RATE_BUDGET: RateBudgetDeclaration = {
+  windowMs: STRIPE_BUDGET_WINDOW_MS,
+  ceiling: STRIPE_BUDGET_CEILING,
+  defaultWeight: STRIPE_CALL_WEIGHTS.other,
+  maxRetryAfterSeconds: STRIPE_BUDGET_MAX_RETRY_AFTER_S,
+  rules: [
+    { match: '^POST /v1/payouts$', weight: STRIPE_CALL_WEIGHTS.payout },
+    { match: '^(POST|DELETE) ', weight: STRIPE_CALL_WEIGHTS.write },
+  ],
+  reason:
+    'Stripe documents scalar limits (docs.stripe.com/rate-limits, read 2026-07-26): 100 requests/' +
+    'second in live mode, 25/second in sandbox, 25/second for an individual endpoint unless noted, ' +
+    '15 payout creates/second, 10 new invoices per subscription per minute, 1,000 PaymentIntent ' +
+    'updates per intent per hour; over it, 429 with a Stripe-Rate-Limited-Reason header. 120 ' +
+    'weighted units / 60s is 120 reads a minute = 2 requests/second — 2% of live mode and 8% of the ' +
+    "tightest general limit. It is more permissive than the kernel's undeclared fallback (30 calls/" +
+    'min) BECAUSE those documented limits are one to three orders of magnitude higher. POST/DELETE ' +
+    'cost 2 — NOT a published ratio, a judgement call about blast radius: a write creates a charge, ' +
+    'refund or receipt e-mail and cannot be taken back. POST /v1/payouts costs 5 because Stripe ' +
+    'documents payout creation at 15/second, six times tighter than live mode. The window bounds the ' +
+    "60s AVERAGE and does not pace, and Stripe's own window is a SECOND, so an intra-second burst " +
+    "reaches Stripe's limiter first — the 429 cooldown is the backstop for that shape, not this " +
+    'ceiling.',
+};
+
+// Declared at module load, so merely importing this module (which `stripe-connector.ts` does) is
+// enough to arm the real ceiling. `RateBudget` reads its policy live precisely so this declaration
+// takes effect the moment it lands, and constructing through the subclass below (which imports this
+// module) is what makes the ordering a non-issue in practice.
+declareRateBudget(VENDOR, STRIPE_RATE_BUDGET);
+
+/**
+ * Price one call. The key is `"<METHOD> <path>"` — Stripe's executor carries filters as separate
+ * `params` rather than in the path, so there is no query string to split off here; a `?` is still
+ * handled defensively in case a caller inlines one. An unclassified endpoint costs `defaultWeight`.
+ */
+export function stripeCallWeight(method: string, path: string): number {
+  const { bare, query } = splitQuery(path);
+  // UPPER-CASE the method: `fetch` normalizes a known lowercase method before sending, so
+  // `execute('post', …)` really does issue a POST and must be priced as one.
+  return rateBudgetWeight(VENDOR, `${String(method).toUpperCase()} ${bare}`, query);
+}
+
+/**
+ * `/v1/x?a=1` -> `{ bare: '/v1/x', query: { a: '1' } }`. Rules match the path; `whenQuery*` the query.
+ *
+ * NORMALIZED, because the anchored rules are otherwise trivially evaded (§9 finding, 2026-07-26):
+ * `fetch` upper-cases a known method before sending, so `execute('post', …)` issues a real WRITE
+ * that a `^POST ` rule would price as a read; and a trailing slash makes a path miss a `$` anchor
+ * while most routers treat it as the same endpoint. Both are input variations, not attacks, and
+ * either one silently voids the "expensive endpoints are priced up" claim the ceiling rests on.
+ */
+function splitQuery(path: string): { bare: string; query: Record<string, string> } {
+  const at = path.indexOf('?');
+  const query: Record<string, string> = {};
+  if (at !== -1) for (const [k, v] of new URLSearchParams(path.slice(at + 1))) query[k] = v;
+  const raw = at === -1 ? path : path.slice(0, at);
+  // Collapse a trailing slash, but never turn the root path into the empty string.
+  const bare = raw.length > 1 && raw.endsWith('/') ? raw.replace(/\/+$/, '') : raw;
+  return { bare, query };
+}
+
+/** Where Stripe's ledger lives. Key-keyed and cwd-independent by default (limits attach to the
+ *  account behind the secret key, so a cwd-scoped ledger would hand the same key a fresh allowance
+ *  in every checkout, worktree and CI matrix leg); pass `root` for world-scoped accounting.
+ *
+ *  A live key and a test key are different strings, so they get different ledgers — which matches
+ *  Stripe, whose live and sandbox limits are separate (100/s vs 25/s). */
+export function stripeBudgetPath(opts: { root?: string; token?: string } | string = {}): string {
+  const o = typeof opts === 'string' ? { root: opts } : opts;
+  // VENDOR spread LAST: a loosely-typed `{ vendor: 'other', … }` slipping through (TypeScript's
+  // excess-property check only catches object literals) must not redirect this pack's ledger to
+  // another vendor's file.
+  return rateBudgetPath({ ...o, vendor: VENDOR });
+}
+
+/** Construction options for Stripe's budget. The vendor is fixed; everything else may only TIGHTEN. */
+export type StripeBudgetOptions = Omit<RateBudgetOptions, 'vendor'>;
+
+/**
+ * Stripe's budget — the shared kernel guard bound to this vendor's declaration. A real subclass,
+ * not an alias, so `budget instanceof StripeBudget` in `liveStripeExecute` means "a budget that
+ * accounts against STRIPE's ledger under STRIPE's ceiling": another vendor's `RateBudget` (with its
+ * own, possibly larger, ceiling) is NOT assignable there.
+ */
+export class StripeBudget extends RateBudget {
+  constructor(opts: StripeBudgetOptions = {}) {
+    super({ ...opts, vendor: VENDOR });
+  }
+}
+
+/** The typed refusal. One error class shared with every other vendor's budget; `err.vendor` says
+ *  which one refused, and `err.kind` says why. */
+export { RateBudgetError as StripeBudgetError } from '@volter/twin';
+export type { RateBudgetErrorKind as StripeBudgetErrorKind } from '@volter/twin';
+export type StripeBudgetReservation = RateBudgetReservation;
+export type StripeBudgetSnapshot = RateBudgetSnapshot;