Separate Zapier, web, API, and leaf access planes with NATS authz

Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).

docs/modules/README.md

@@ -126,3 +126,12 @@ One MD file per source module.
 - [zappier-sales-pricing/server](zappier-sales-pricing/server.md)
 - [zappier-accounting-export/nats-billing](zappier-accounting-export/nats-billing.md)
 - [zappier-accounting-export/server](zappier-accounting-export/server.md)
+- [verae-access-authz/client](verae-access-authz/client.md)
+- [verae-access-authz/policy](verae-access-authz/policy.md)
+- [verae-access-authz/server](verae-access-authz/server.md)
+- [verae-access-authz/subjects](verae-access-authz/subjects.md)
+- [verae-access-web/gate](verae-access-web/gate.md)
+- [verae-access-web/server](verae-access-web/server.md)
+- [verae-access-api/server](verae-access-api/server.md)
+- [verae-access-leaf/server](verae-access-leaf/server.md)
+- [verae-access-zapier/server](verae-access-zapier/server.md)

docs/modules/verae-access-api/server.md

@@ -0,0 +1,41 @@
+# `verae-access-api/server`
+
+**Package:** `verae-access-api`  
+**Source:** `packages/verae-access-api/src/server.js`  
+**Lines:** 60
+
+## What this module is
+
+Implementation module in `verae-access-api`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, principal, extra = {}` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+
+## Call graph (identifiers invoked)
+
+`replace`, `check`, `fetch`, `stringify`, `json`, `createServer`, `async`, `writeHead`, `end`, `match`, `push`, `concat`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-authz/client.md

@@ -0,0 +1,42 @@
+# `verae-access-authz/client`
+
+**Package:** `verae-access-authz`  
+**Source:** `packages/verae-access-authz/src/client.js`  
+**Lines:** 39
+
+## What this module is
+
+Implementation module in `verae-access-authz`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`authorizeThenRequest`, `authorizeThenPublish`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `authorizeThenRequest` | `nc, sc, { plane, subject, principal, payload, timeout = 2000 }` | — | `unknown` | see Call graph |
+|  | _Call verae.access.authz.check then the internal subject. Fail closed._ | | | |
+| `authorizeThenPublish` | `nc, sc, { plane, subject, principal, payload, timeout = 2000 }` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`authorizeThenRequest`, `request`, `encode`, `stringify`, `parse`, `decode`, `authorizeThenPublish`, `publish`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-authz/policy.md

@@ -0,0 +1,42 @@
+# `verae-access-authz/policy`
+
+**Package:** `verae-access-authz`  
+**Source:** `packages/verae-access-authz/src/policy.js`  
+**Lines:** 99
+
+## What this module is
+
+Implementation module in `verae-access-authz`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`POLICY`, `authorize`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `prefixAllowed` | `allow, subject` | — | `unknown` | see Call graph |
+| `authorize` | `req` | — | `unknown` | see Call graph |
+| `deny` | `plane, subject, reason` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`workers`, `freeze`, `web`, `prefixAllowed`, `some`, `endsWith`, `startsWith`, `authorize`, `parseAddress`, `deny`, `includes`, `mismatch`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-authz/server.md

@@ -0,0 +1,44 @@
+# `verae-access-authz/server`
+
+**Package:** `verae-access-authz`  
+**Source:** `packages/verae-access-authz/src/server.js`  
+**Lines:** 84
+
+## What this module is
+
+Implementation module in `verae-access-authz`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `startNats` | `(none)` | — | `unknown` | see Call graph |
+| `readBody` | `req` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+- `./policy.js`
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`startNats`, `import`, `connect`, `split`, `subscribe`, `async`, `parse`, `decode`, `authorize`, `publish`, `encode`, `stringify`, `toISOString`, `respond`, `write`, `readBody`, `on`, `push`, `resolve`, `concat`, `toString`, `createServer`, `writeHead`, `end`, `json`, `listen`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-authz/subjects.md

@@ -0,0 +1,43 @@
+# `verae-access-authz/subjects`
+
+**Package:** `verae-access-authz`  
+**Source:** `packages/verae-access-authz/src/subjects.js`  
+**Lines:** 37
+
+## What this module is
+
+Implementation module in `verae-access-authz`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`PLANES`, `SUBJECTS`, `accessAddress`, `parseAddress`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `accessAddress` | `plane, internalSubject` | — | `unknown` | see Call graph |
+|  | _verae.billing.statement.get + plane web → verae.access.web.billing.statement.get_ | | | |
+| `parseAddress` | `subject, planeHint` | — | `unknown` | see Call graph |
+|  | _Parse an access or internal subject into { plane, internal }._ | | | |
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+`ingress`, `internal`, `freeze`, `accessAddress`, `includes`, `startsWith`, `slice`, `parseAddress`, `match`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-leaf/server.md

@@ -0,0 +1,44 @@
+# `verae-access-leaf/server`
+
+**Package:** `verae-access-leaf`  
+**Source:** `packages/verae-access-leaf/src/server.js`  
+**Lines:** 95
+
+## What this module is
+
+Implementation module in `verae-access-leaf`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, principal` | — | `unknown` | see Call graph |
+| `authorizedToken` | `got` | — | `unknown` | see Call graph |
+| `forward` | `body` | — | `unknown` | see Call graph |
+| `startNats` | `(none)` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+
+## Call graph (identifiers invoked)
+
+`subjects`, `replace`, `check`, `fetch`, `stringify`, `json`, `authorizedToken`, `forward`, `import`, `connect`, `split`, `publish`, `encode`, `flush`, `close`, `startNats`, `async`, `subscribe`, `parse`, `decode`, `respond`, `write`, `createServer`, `writeHead`, `end`, `push`, `concat`, `toString`, `listen`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-web/gate.md

@@ -0,0 +1,42 @@
+# `verae-access-web/gate`
+
+**Package:** `verae-access-web`  
+**Source:** `packages/verae-access-web/src/gate.js`  
+**Lines:** 51
+
+## What this module is
+
+Implementation module in `verae-access-web`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`PLANE`, `AUTHZ_CHECK`, `check`, `statement`, `reload`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, { principal, kind, payload } = {}` | — | `unknown` | see Call graph |
+| `statement` | `customerId, principal` | — | `unknown` | see Call graph |
+| `reload` | `customerId, cents, principal` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+`replace`, `check`, `fetch`, `stringify`, `json`, `statement`, `import`, `connect`, `split`, `request`, `encode`, `parse`, `decode`, `close`, `reload`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-web/server.md

@@ -0,0 +1,41 @@
+# `verae-access-web/server`
+
+**Package:** `verae-access-web`  
+**Source:** `packages/verae-access-web/src/server.js`  
+**Lines:** 39
+
+## What this module is
+
+Implementation module in `verae-access-web`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+- `./gate.js`
+
+## Call graph (identifiers invoked)
+
+`createServer`, `async`, `writeHead`, `end`, `stringify`, `json`, `match`, `statement`, `push`, `parse`, `concat`, `toString`, `reload`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-zapier/server.md

@@ -0,0 +1,41 @@
+# `verae-access-zapier/server`
+
+**Package:** `verae-access-zapier`  
+**Source:** `packages/verae-access-zapier/src/server.js`  
+**Lines:** 56
+
+## What this module is
+
+Implementation module in `verae-access-zapier`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, principal` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+
+## Call graph (identifiers invoked)
+
+`replace`, `check`, `fetch`, `stringify`, `json`, `createServer`, `async`, `writeHead`, `end`, `startsWith`, `push`, `concat`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/zappier-customer-service/nats-billing.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier-customer-service`  
 **Source:** `packages/zappier-customer-service/src/nats-billing.js`  
-**Lines:** 21
+**Lines:** 45
 
 ## What this module is
 
@@ -20,6 +20,7 @@ _None extracted._
 
 | Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
 |------|------------|---------------------|---------|-----------------------------|
+| `authz` | `subject, payload` | — | `unknown` | see Call graph |
 | `billingRequest` | `subject, payload` | — | `unknown` | see Call graph |
 
 ## What it imports / requires
@@ -28,7 +29,7 @@ _No imports detected._
 
 ## Call graph (identifiers invoked)
 
-`billingRequest`, `import`, `connect`, `split`, `request`, `encode`, `stringify`, `parse`, `decode`, `close`
+`authz`, `fetch`, `replace`, `stringify`, `json`, `billingRequest`, `import`, `connect`, `split`, `request`, `encode`, `parse`, `decode`, `close`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier-sales-pricing/nats-billing.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier-sales-pricing`  
 **Source:** `packages/zappier-sales-pricing/src/nats-billing.js`  
-**Lines:** 18
+**Lines:** 37
 
 ## What this module is
 
@@ -20,6 +20,7 @@ _None extracted._
 
 | Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
 |------|------------|---------------------|---------|-----------------------------|
+| `authz` | `subject` | — | `unknown` | see Call graph |
 | `billingRequest` | `subject, payload` | — | `unknown` | see Call graph |
 
 ## What it imports / requires
@@ -28,7 +29,7 @@ _No imports detected._
 
 ## Call graph (identifiers invoked)
 
-`billingRequest`, `import`, `connect`, `split`, `request`, `encode`, `stringify`, `parse`, `decode`, `close`
+`authz`, `fetch`, `replace`, `stringify`, `json`, `billingRequest`, `import`, `connect`, `split`, `request`, `encode`, `parse`, `decode`, `close`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier/admin.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/admin.ts`  
-**Lines:** 588
+**Lines:** 591
 
 ## What this module is
 

docs/modules/zappier/billing-nats.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/billing-nats.ts`  
-**Lines:** 74
+**Lines:** 130
 
 ## What this module is
 
@@ -10,12 +10,13 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 
 ## Exports
 
-`BILLING_SUBJECTS`, `BillingStatement`, `natsStatement`, `natsAdjust`, `natsPublish`
+`BILLING_SUBJECTS`, `AUTHZ_CHECK`, `AccessPlane`, `BillingStatement`, `natsStatement`, `natsAdjust`, `natsPublish`
 
 ## Types / interfaces / classes
 
 | Kind | Name |
 |------|------|
+| type | `AccessPlane` |
 | type | `BillingStatement` |
 | type | `Nc` |
 
@@ -26,15 +27,26 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 | `nc` | `(none)` | — | `unknown` | see Call graph |
 | `encode` | `obj: unknown` | — | `unknown` | see Call graph |
 | `decode` | `buf: Uint8Array` | — | `unknown` | see Call graph |
-| `natsStatement` | `customerId: string` | — | `unknown` | see Call graph |
+| `authzAllow` | `plane: AccessPlane,
+  subject: string,
+  extra: { principal?: string; kind?: string } = {},` | — | `unknown` | see Call graph |
+| `natsStatement` | `customerId: string,
+  plane: AccessPlane = 'web',` | — | `unknown` | see Call graph |
 | `natsAdjust` | `payload: {
-  customerId: string;
-  cents: number;
-  reason: string;
-  agent: string;
-  kind?: string;
-}` | — | `unknown` | see Call graph |
-| `natsPublish` | `subject: string, payload: unknown` | — | `unknown` | see Call graph |
+    customerId: string;
+    cents: number;
+    reason: string;
+    agent: string;
+    kind?: string;
+  },
+  plane: AccessPlane = 'staff',` | — | `unknown` | see Call graph |
+| `natsPublish` | `subject: string, payload: unknown, plane: AccessPlane = 'api'` | — | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `void` | `async (` |
 
 ## What it imports / requires
 
@@ -42,7 +54,7 @@ _No imports detected._
 
 ## Call graph (identifiers invoked)
 
-`unset`, `nc`, `async`, `import`, `connect`, `split`, `encode`, `stringify`, `decode`, `parse`, `natsStatement`, `request`, `natsAdjust`, `natsPublish`, `then`, `publish`
+`unset`, `nc`, `async`, `import`, `connect`, `split`, `encode`, `stringify`, `decode`, `parse`, `authzAllow`, `request`, `fetch`, `replace`, `json`, `natsStatement`, `natsAdjust`, `natsPublish`, `void`, `publish`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier/portal.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/portal.ts`  
-**Lines:** 321
+**Lines:** 328
 
 ## What this module is
 

docs/sphinx/index.rst

@@ -28,6 +28,11 @@ Markdown indexes: https://zapier.georgelambert.org/index-md.html
    repos/zappier-customer-service
    repos/zappier-sales-pricing
    repos/zappier-accounting-export
+   repos/verae-access-authz
+   repos/verae-access-web
+   repos/verae-access-api
+   repos/verae-access-leaf
+   repos/verae-access-zapier
 
 .. toctree::
    :maxdepth: 2
@@ -157,3 +162,12 @@ Markdown indexes: https://zapier.georgelambert.org/index-md.html
    modules/zappier-sales-pricing/server
    modules/zappier-accounting-export/nats-billing
    modules/zappier-accounting-export/server
+   modules/verae-access-authz/client
+   modules/verae-access-authz/policy
+   modules/verae-access-authz/server
+   modules/verae-access-authz/subjects
+   modules/verae-access-web/gate
+   modules/verae-access-web/server
+   modules/verae-access-api/server
+   modules/verae-access-leaf/server
+   modules/verae-access-zapier/server

docs/sphinx/modules/verae-access-api/server.md

@@ -0,0 +1,41 @@
+# `verae-access-api/server`
+
+**Package:** `verae-access-api`  
+**Source:** `packages/verae-access-api/src/server.js`  
+**Lines:** 60
+
+## What this module is
+
+Implementation module in `verae-access-api`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, principal, extra = {}` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+
+## Call graph (identifiers invoked)
+
+`replace`, `check`, `fetch`, `stringify`, `json`, `createServer`, `async`, `writeHead`, `end`, `match`, `push`, `concat`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-access-api/server.rst

@@ -0,0 +1,7 @@
+verae-access-api.server
+=======================
+
+Generated API sheet for ``verae-access-api/server``.
+
+.. include:: server.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-access-authz/client.md

@@ -0,0 +1,42 @@
+# `verae-access-authz/client`
+
+**Package:** `verae-access-authz`  
+**Source:** `packages/verae-access-authz/src/client.js`  
+**Lines:** 39
+
+## What this module is
+
+Implementation module in `verae-access-authz`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`authorizeThenRequest`, `authorizeThenPublish`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `authorizeThenRequest` | `nc, sc, { plane, subject, principal, payload, timeout = 2000 }` | — | `unknown` | see Call graph |
+|  | _Call verae.access.authz.check then the internal subject. Fail closed._ | | | |
+| `authorizeThenPublish` | `nc, sc, { plane, subject, principal, payload, timeout = 2000 }` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`authorizeThenRequest`, `request`, `encode`, `stringify`, `parse`, `decode`, `authorizeThenPublish`, `publish`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-access-authz/client.rst

@@ -0,0 +1,7 @@
+verae-access-authz.client
+=========================
+
+Generated API sheet for ``verae-access-authz/client``.
+
+.. include:: client.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-access-authz/policy.md

@@ -0,0 +1,42 @@
+# `verae-access-authz/policy`
+
+**Package:** `verae-access-authz`  
+**Source:** `packages/verae-access-authz/src/policy.js`  
+**Lines:** 99
+
+## What this module is
+
+Implementation module in `verae-access-authz`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`POLICY`, `authorize`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `prefixAllowed` | `allow, subject` | — | `unknown` | see Call graph |
+| `authorize` | `req` | — | `unknown` | see Call graph |
+| `deny` | `plane, subject, reason` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`workers`, `freeze`, `web`, `prefixAllowed`, `some`, `endsWith`, `startsWith`, `authorize`, `parseAddress`, `deny`, `includes`, `mismatch`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-access-authz/policy.rst

@@ -0,0 +1,7 @@
+verae-access-authz.policy
+=========================
+
+Generated API sheet for ``verae-access-authz/policy``.
+
+.. include:: policy.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-access-authz/server.md

@@ -0,0 +1,44 @@
+# `verae-access-authz/server`
+
+**Package:** `verae-access-authz`  
+**Source:** `packages/verae-access-authz/src/server.js`  
+**Lines:** 84
+
+## What this module is
+
+Implementation module in `verae-access-authz`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `startNats` | `(none)` | — | `unknown` | see Call graph |
+| `readBody` | `req` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+- `./policy.js`
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`startNats`, `import`, `connect`, `split`, `subscribe`, `async`, `parse`, `decode`, `authorize`, `publish`, `encode`, `stringify`, `toISOString`, `respond`, `write`, `readBody`, `on`, `push`, `resolve`, `concat`, `toString`, `createServer`, `writeHead`, `end`, `json`, `listen`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-access-authz/server.rst

@@ -0,0 +1,7 @@
+verae-access-authz.server
+=========================
+
+Generated API sheet for ``verae-access-authz/server``.
+
+.. include:: server.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-access-authz/subjects.md

@@ -0,0 +1,43 @@
+# `verae-access-authz/subjects`
+
+**Package:** `verae-access-authz`  
+**Source:** `packages/verae-access-authz/src/subjects.js`  
+**Lines:** 37
+
+## What this module is
+
+Implementation module in `verae-access-authz`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`PLANES`, `SUBJECTS`, `accessAddress`, `parseAddress`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `accessAddress` | `plane, internalSubject` | — | `unknown` | see Call graph |
+|  | _verae.billing.statement.get + plane web → verae.access.web.billing.statement.get_ | | | |
+| `parseAddress` | `subject, planeHint` | — | `unknown` | see Call graph |
+|  | _Parse an access or internal subject into { plane, internal }._ | | | |
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+`ingress`, `internal`, `freeze`, `accessAddress`, `includes`, `startsWith`, `slice`, `parseAddress`, `match`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-access-authz/subjects.rst

@@ -0,0 +1,7 @@
+verae-access-authz.subjects
+===========================
+
+Generated API sheet for ``verae-access-authz/subjects``.
+
+.. include:: subjects.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-access-leaf/server.md

@@ -0,0 +1,44 @@
+# `verae-access-leaf/server`
+
+**Package:** `verae-access-leaf`  
+**Source:** `packages/verae-access-leaf/src/server.js`  
+**Lines:** 95
+
+## What this module is
+
+Implementation module in `verae-access-leaf`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, principal` | — | `unknown` | see Call graph |
+| `authorizedToken` | `got` | — | `unknown` | see Call graph |
+| `forward` | `body` | — | `unknown` | see Call graph |
+| `startNats` | `(none)` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+
+## Call graph (identifiers invoked)
+
+`subjects`, `replace`, `check`, `fetch`, `stringify`, `json`, `authorizedToken`, `forward`, `import`, `connect`, `split`, `publish`, `encode`, `flush`, `close`, `startNats`, `async`, `subscribe`, `parse`, `decode`, `respond`, `write`, `createServer`, `writeHead`, `end`, `push`, `concat`, `toString`, `listen`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-access-leaf/server.rst

@@ -0,0 +1,7 @@
+verae-access-leaf.server
+========================
+
+Generated API sheet for ``verae-access-leaf/server``.
+
+.. include:: server.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-access-web/gate.md

@@ -0,0 +1,42 @@
+# `verae-access-web/gate`
+
+**Package:** `verae-access-web`  
+**Source:** `packages/verae-access-web/src/gate.js`  
+**Lines:** 51
+
+## What this module is
+
+Implementation module in `verae-access-web`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`PLANE`, `AUTHZ_CHECK`, `check`, `statement`, `reload`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, { principal, kind, payload } = {}` | — | `unknown` | see Call graph |
+| `statement` | `customerId, principal` | — | `unknown` | see Call graph |
+| `reload` | `customerId, cents, principal` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+`replace`, `check`, `fetch`, `stringify`, `json`, `statement`, `import`, `connect`, `split`, `request`, `encode`, `parse`, `decode`, `close`, `reload`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-access-web/gate.rst

@@ -0,0 +1,7 @@
+verae-access-web.gate
+=====================
+
+Generated API sheet for ``verae-access-web/gate``.
+
+.. include:: gate.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-access-web/server.md

@@ -0,0 +1,41 @@
+# `verae-access-web/server`
+
+**Package:** `verae-access-web`  
+**Source:** `packages/verae-access-web/src/server.js`  
+**Lines:** 39
+
+## What this module is
+
+Implementation module in `verae-access-web`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+- `./gate.js`
+
+## Call graph (identifiers invoked)
+
+`createServer`, `async`, `writeHead`, `end`, `stringify`, `json`, `match`, `statement`, `push`, `parse`, `concat`, `toString`, `reload`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-access-web/server.rst

@@ -0,0 +1,7 @@
+verae-access-web.server
+=======================
+
+Generated API sheet for ``verae-access-web/server``.
+
+.. include:: server.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-access-zapier/server.md

@@ -0,0 +1,41 @@
+# `verae-access-zapier/server`
+
+**Package:** `verae-access-zapier`  
+**Source:** `packages/verae-access-zapier/src/server.js`  
+**Lines:** 56
+
+## What this module is
+
+Implementation module in `verae-access-zapier`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, principal` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+
+## Call graph (identifiers invoked)
+
+`replace`, `check`, `fetch`, `stringify`, `json`, `createServer`, `async`, `writeHead`, `end`, `startsWith`, `push`, `concat`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-access-zapier/server.rst

@@ -0,0 +1,7 @@
+verae-access-zapier.server
+==========================
+
+Generated API sheet for ``verae-access-zapier/server``.
+
+.. include:: server.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/zappier-customer-service/nats-billing.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier-customer-service`  
 **Source:** `packages/zappier-customer-service/src/nats-billing.js`  
-**Lines:** 21
+**Lines:** 45
 
 ## What this module is
 
@@ -20,6 +20,7 @@ _None extracted._
 
 | Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
 |------|------------|---------------------|---------|-----------------------------|
+| `authz` | `subject, payload` | — | `unknown` | see Call graph |
 | `billingRequest` | `subject, payload` | — | `unknown` | see Call graph |
 
 ## What it imports / requires
@@ -28,7 +29,7 @@ _No imports detected._
 
 ## Call graph (identifiers invoked)
 
-`billingRequest`, `import`, `connect`, `split`, `request`, `encode`, `stringify`, `parse`, `decode`, `close`
+`authz`, `fetch`, `replace`, `stringify`, `json`, `billingRequest`, `import`, `connect`, `split`, `request`, `encode`, `parse`, `decode`, `close`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/sphinx/modules/zappier-sales-pricing/nats-billing.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier-sales-pricing`  
 **Source:** `packages/zappier-sales-pricing/src/nats-billing.js`  
-**Lines:** 18
+**Lines:** 37
 
 ## What this module is
 
@@ -20,6 +20,7 @@ _None extracted._
 
 | Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
 |------|------------|---------------------|---------|-----------------------------|
+| `authz` | `subject` | — | `unknown` | see Call graph |
 | `billingRequest` | `subject, payload` | — | `unknown` | see Call graph |
 
 ## What it imports / requires
@@ -28,7 +29,7 @@ _No imports detected._
 
 ## Call graph (identifiers invoked)
 
-`billingRequest`, `import`, `connect`, `split`, `request`, `encode`, `stringify`, `parse`, `decode`, `close`
+`authz`, `fetch`, `replace`, `stringify`, `json`, `billingRequest`, `import`, `connect`, `split`, `request`, `encode`, `parse`, `decode`, `close`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/sphinx/modules/zappier/admin.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/admin.ts`  
-**Lines:** 588
+**Lines:** 591
 
 ## What this module is
 

docs/sphinx/modules/zappier/billing-nats.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/billing-nats.ts`  
-**Lines:** 74
+**Lines:** 130
 
 ## What this module is
 
@@ -10,12 +10,13 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 
 ## Exports
 
-`BILLING_SUBJECTS`, `BillingStatement`, `natsStatement`, `natsAdjust`, `natsPublish`
+`BILLING_SUBJECTS`, `AUTHZ_CHECK`, `AccessPlane`, `BillingStatement`, `natsStatement`, `natsAdjust`, `natsPublish`
 
 ## Types / interfaces / classes
 
 | Kind | Name |
 |------|------|
+| type | `AccessPlane` |
 | type | `BillingStatement` |
 | type | `Nc` |
 
@@ -26,15 +27,26 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 | `nc` | `(none)` | — | `unknown` | see Call graph |
 | `encode` | `obj: unknown` | — | `unknown` | see Call graph |
 | `decode` | `buf: Uint8Array` | — | `unknown` | see Call graph |
-| `natsStatement` | `customerId: string` | — | `unknown` | see Call graph |
+| `authzAllow` | `plane: AccessPlane,
+  subject: string,
+  extra: { principal?: string; kind?: string } = {},` | — | `unknown` | see Call graph |
+| `natsStatement` | `customerId: string,
+  plane: AccessPlane = 'web',` | — | `unknown` | see Call graph |
 | `natsAdjust` | `payload: {
-  customerId: string;
-  cents: number;
-  reason: string;
-  agent: string;
-  kind?: string;
-}` | — | `unknown` | see Call graph |
-| `natsPublish` | `subject: string, payload: unknown` | — | `unknown` | see Call graph |
+    customerId: string;
+    cents: number;
+    reason: string;
+    agent: string;
+    kind?: string;
+  },
+  plane: AccessPlane = 'staff',` | — | `unknown` | see Call graph |
+| `natsPublish` | `subject: string, payload: unknown, plane: AccessPlane = 'api'` | — | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `void` | `async (` |
 
 ## What it imports / requires
 
@@ -42,7 +54,7 @@ _No imports detected._
 
 ## Call graph (identifiers invoked)
 
-`unset`, `nc`, `async`, `import`, `connect`, `split`, `encode`, `stringify`, `decode`, `parse`, `natsStatement`, `request`, `natsAdjust`, `natsPublish`, `then`, `publish`
+`unset`, `nc`, `async`, `import`, `connect`, `split`, `encode`, `stringify`, `decode`, `parse`, `authzAllow`, `request`, `fetch`, `replace`, `json`, `natsStatement`, `natsAdjust`, `natsPublish`, `void`, `publish`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/sphinx/modules/zappier/portal.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/portal.ts`  
-**Lines:** 321
+**Lines:** 328
 
 ## What this module is
 

docs/sphinx/repos/verae-access-api.md

@@ -0,0 +1,11 @@
+# verae-access-api
+
+**Direct customer API** plane (`x-api-key`). Separate from the Zapier Platform app.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-access-api
+
+Address path: `verae.access.api.*` → `verae.access.authz.check` → `verae.billing.statement.get` / `verae.zapier.jobs.watch` (HTTPS to middleware, not a Zapier NATS client).
+
+Cannot `balance.adjust` or `archive.put`.
+
+Port `:3022`.

docs/sphinx/repos/verae-access-authz.md

@@ -0,0 +1,34 @@
+# verae-access-authz
+
+Authorization step on the NATS **address path**. Zapier is only **one** access plane. Direct web, customer API, and server-to-server leaf nodes are separate, and each is default-deny against internal subjects.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-access-authz  
+**Catalog:** https://zapier.georgelambert.org/packages/verae-access-authz/README.pdf
+
+## Address path
+
+```text
+client
+  → verae.access.<plane>.<area>.<resource>.<action>     (ingress, that plane only)
+  → verae.access.authz.check                            (allow / deny)
+  → verae.<area>.<resource>.<action>                    (internal bus)
+```
+
+Internal subjects (`verae.billing.*`, `verae.archive.*`, `verae.zapier.jobs.*`) stay stable. Planes never publish them until `authz.check` returns `allow`.
+
+| Plane | Who | May reach |
+|-------|-----|-----------|
+| `zapier` | Zapier Platform HTTPS | jobs.*, webhooks.deliver, billing.usage.recorded |
+| `web` | Customer browser portal | statement.get, balance.adjust kind=reload\|payment |
+| `api` | Customer `x-api-key` (not Zapier) | statement.get, usage.recorded, jobs.watch |
+| `leaf` | S2S NATS leaf / mTLS | archive.*, jobs.*, webhooks — **not billing** |
+| `staff` | CS / sales / admin | statement, balance.adjust (credits) |
+
+A leaf node cannot credit an account. A Zapier hop cannot read a customer statement. A browser cannot `archive.put`.
+
+```bash
+NATS_URL=nats://127.0.0.1:4222 PORT=3020 npm start
+curl -s http://127.0.0.1:3020/policy
+curl -s -X POST http://127.0.0.1:3020/check -H 'content-type: application/json' \
+  -d '{"plane":"leaf","subject":"verae.billing.balance.adjust"}'
+```

docs/sphinx/repos/verae-access-leaf.md

@@ -0,0 +1,13 @@
+# verae-access-leaf
+
+**Server-to-server leaf node** access plane. Remote machines connect as NATS leaf nodes (or POST `/forward` with a leaf token). They never get the core billing subjects.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-access-leaf
+
+```text
+remote leaf  →  verae.access.leaf.in  →  authz.check  →  verae.archive.put | jobs.*
+```
+
+Denied: `verae.billing.balance.adjust`, `verae.billing.statement.get`. A compromised WORM/leaf cannot credit customers.
+
+`LEAF_TOKEN` required. Port `:3023`. Do not publish NATS `4222` to the internet; leaf nodes use a private leafnode port / tunnel.

docs/sphinx/repos/verae-access-web.md

@@ -0,0 +1,15 @@
+# verae-access-web
+
+**Direct web** access plane. Customer browsers hit this process, not Zapier and not the NATS port.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-access-web
+
+Every NATS hop is `verae.access.web.*` → `verae.access.authz.check` → internal `verae.billing.statement.get` (reload only, not CS credits).
+
+| Route | Job |
+|-------|-----|
+| `GET /health` | `{ plane: "web" }` |
+| `GET /statement/:id` | Authz then statement |
+| `POST /reload` | Authz then `balance.adjust` kind=reload |
+
+Port `:3021`.

docs/sphinx/repos/verae-access-zapier.md

@@ -0,0 +1,9 @@
+# verae-access-zapier
+
+**Zapier is one access plane**, not the only one. This process is the Zapier HTTPS front door: timestamp/wait/hash into middleware. No customer portal, no admin, no leaf.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-access-zapier
+
+Zapier cloud never opens NATS. This process may request `verae.access.authz.check` for `verae.zapier.jobs.watch` and `verae.billing.usage.recorded` only.
+
+Port `:3024`.