V6 one-install Stripe API front door over 12 bounded feature packs. The visible root grows from 36 to 96 operations while preserving every established operation ID, route, argument, entity, risk, approval, pagination, and cache contract; the only compatibility hardening is lossless parsing for unsafe JSON integers. Dependencies bring the installed family to 610 of 619 official public GA operations; 9 exact deprecated or unsupported request/response-media routes remain fail-closed. New calls pin Stripe-Version 2026-06-24.dahlia, require approval for every mutation, keep reads uncached, and require caller-owned Idempotency-Key values for POST retries. Expand and Stripe-Account are omitted, form writes use bounded closed typed subsets, v2 JSON stays verbatim, and unsafe response integers remain exact strings. Basic credentials come only from the enrolled Stripe connection. Secret-capable direct responses are labelled and never bundled into workflows. Stripe control-plane records are not claimed as user-work Sources.