feat(macos): PDF Services stamp helper with dual-channel Verae auth

Implements macOS v0: verae-print stamp + install-macos PDF menu items.
Saves {name}.pdf, {name}-verae-timestamp-{RECEIPTID}.pdf, and .verae.json.
Channels: verae (api.veraetime.net JWT) and zapier (zap.verae.ai xVerae- + attachPdf).

docs/superpowers/plans/2026-10-03-print-to-verae-timestamp.md

@@ -53,7 +53,10 @@
 - [ ] Commit `feat(pdf): certificate page and embedded receipt`.
 
 ### Task 5: macOS v0 — PDF Services
-- [ ] App bundle in `~/Library/PDF Services/` calling the core; Save/Print/Both dialog.
+- [x] CLI `verae-print stamp` writes `{name}.pdf`, `{name}-verae-timestamp-{RECEIPTID}.pdf`, `{name}.verae.json`.
+- [x] Dual channel: `verae` (api.veraetime.net JWT) and `zapier` (zap.verae.ai xVerae- + attachPdf).
+- [x] `verae-print install-macos` installs PDF Services apps (Verae + Zapier).
+- [ ] Optional Save/Print/Both dialog (v0 auto-saves to `~/Documents/Verae Timestamps`).
 - [ ] Commit `feat(macos): PDF Services entry`.
 
 ### Task 6: Spool protocol + helper

docs/superpowers/specs/2026-10-03-print-to-verae-timestamp.md

@@ -26,7 +26,9 @@ Provide a "Verae Timestamp" printer on macOS, Linux, and Windows. Printing to it
 - **Embedding without breaking the hash.** If the receipt is embedded, it is appended as a PDF *incremental update* (attachment + annotation/certificate page). The original byte range is unchanged, so `sha256(first N bytes)` still matches. The receipt records `N`.
 - **Per-page hashes.** Each page is extracted as a single-page PDF (deterministic extraction via the same library/version) and hashed; the list is included in a canonical manifest whose SHA-256 is also stamped. This allows proving individual pages.
 
-## 4. Verae Timestamp API (as used today by Datacube-Fuse)
+## 4. Verae Timestamp API (dual channel)
+
+### 4.1 Verae Time (default — non-Zapier)
 
 | Call | Purpose |
 |---|---|
@@ -35,8 +37,18 @@ Provide a "Verae Timestamp" printer on macOS, Linux, and Windows. Printing to it
 | `GET {base}/api/hash/{digest}` | Look up existing stamp |
 | `POST {base}/api/verify` | Verify |
 
-- Default base: `https://api.veraetime.net`; `Authorization: Bearer <token>` from `~/.verae/auth.json` (keys `access_token` / `auth_token` / `id_token`).
-- **Open question:** endpoint/format for a downloadable certificate PDF. Until confirmed, the helper renders its own certificate page from the receipt JSON (digest, time, certificate id, verify URL, QR code).
+- Default base: `https://api.veraetime.net`
+- Auth: `Authorization: Bearer <token>` from `~/.verae/auth.properties` (keys `access_token` / `auth_token` / `id_token`)
+- Certificate PDF: render locally from receipt when the API does not return a PDF body
+
+### 4.2 Zapier / edge channel
+
+| Call | Purpose |
+|---|---|
+| `POST https://zap.verae.ai/v1/timestamp` body `{sha256, attachPdf:true, wait:true, documentName}` | Stamp + optional registration PDF |
+
+- Auth: `x-api-key: xVerae-…` (or Bearer) from Keychain / `~/.verae/xverae-token` / env `XVERAE_TOKEN`
+- Certificate PDF: decode `pdfBase64` from the JSON response (or raw PDF when `Accept: application/pdf`)
 
 ## 5. Architecture
 
@@ -60,7 +72,10 @@ App ──▶ Print │ macOS/Linux: CUPS queue "Verae Timestamp" │
 
 ### 5.1 macOS
 
-- **v0 (fast path):** PDF Services entry — "Timestamp with Verae" in the Print dialog's PDF menu. Installed to `~/Library/PDF Services/` as an app that receives the PDF path. No driver needed.
+- **v0 (fast path):** PDF Services entry — "Timestamp with Verae" in the Print dialog's PDF menu. Installed to `~/Library/PDF Services/` as an app/script that receives the PDF path. No CUPS driver needed.
+  - Default channel: **Verae Time** (`api.veraetime.net` + MCP JWT from `~/.verae/auth.properties`).
+  - Optional second menu item **Timestamp with Verae (Zapier)** or `--channel=zapier`: `zap.verae.ai` + `xVerae-` token + `attachPdf: true`.
+  - Saves to `~/Documents/Verae Timestamps/` by default (override with `--out-dir` / preference).
 - **v1:** CUPS queue with custom backend `/usr/libexec/cups/backend/verae` + PPD (or IPP Everywhere). The backend is sandboxed and cannot show UI, so it writes to `/Library/Application Support/Verae/spool/<user>/` and exits; the menu-bar helper (LaunchAgent) picks it up.
 - Signed + notarized `.pkg`.
 
@@ -85,16 +100,21 @@ A single local **IPP Everywhere printer service** (e.g. built on PAPPL or a Go I
 
 ## 6. Outputs
 
-For a job named `Contract.pdf`:
+For a print job whose document name is `Contract` (extension stripped for the stem):
 
 | File | Content |
 |---|---|
 | `Contract.pdf` | Exact captured bytes (the proven artifact) |
-| `Contract.verae.json` | Receipt: doc sha256, page sha256 list, manifest sha256, Verae response(s), time, base URL, helper version, original byte length |
-| `Contract.stamped.pdf` (optional) | Original bytes + incremental update containing certificate page and `Contract.verae.json` as attachment |
-| `Contract.certificate.pdf` (optional) | Certificate page alone (from API if available, else rendered) |
+| `Contract-verae-timestamp-{RECEIPTID}.pdf` | Verae registration / certificate PDF only |
+| `Contract.verae.json` | Receipt sidecar: doc sha256, receipt id, channel, API host, time, helper version, original byte length |
 
-Certificate page: document name, SHA-256, Verae timestamp time (UTC + local), certificate/receipt id, verify URL + QR code, page-hash list (first N, rest in attachment).
+`RECEIPTID` is the Verae receipt / certificate CID, sanitized for filenames (safe charset). Long CIDs are kept in full when under filesystem limits.
+
+**macOS v0 naming is fixed to the table above** (approved 2026-10-03). Later optional embed/combined outputs may still use `.stamped.pdf` but are out of scope for v0.
+
+Certificate PDF source by channel:
+- **Zapier channel:** `pdfBase64` from `POST https://zap.verae.ai/v1/timestamp` with `attachPdf: true`.
+- **Verae Time / default:** stamp via `api.veraetime.net`; use API/MCP registration PDF when available, otherwise render a local certificate page from the receipt JSON (document name, SHA-256, time UTC + local, receipt id, verify URL).
 
 ## 7. Settings