Separate Zapier, web, API, and leaf access planes with NATS authz

Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).

docs/modules/README.md

@@ -126,3 +126,12 @@ One MD file per source module.
 - [zappier-sales-pricing/server](zappier-sales-pricing/server.md)
 - [zappier-accounting-export/nats-billing](zappier-accounting-export/nats-billing.md)
 - [zappier-accounting-export/server](zappier-accounting-export/server.md)
+- [verae-access-authz/client](verae-access-authz/client.md)
+- [verae-access-authz/policy](verae-access-authz/policy.md)
+- [verae-access-authz/server](verae-access-authz/server.md)
+- [verae-access-authz/subjects](verae-access-authz/subjects.md)
+- [verae-access-web/gate](verae-access-web/gate.md)
+- [verae-access-web/server](verae-access-web/server.md)
+- [verae-access-api/server](verae-access-api/server.md)
+- [verae-access-leaf/server](verae-access-leaf/server.md)
+- [verae-access-zapier/server](verae-access-zapier/server.md)

docs/modules/verae-access-api/server.md

@@ -0,0 +1,41 @@
+# `verae-access-api/server`
+
+**Package:** `verae-access-api`  
+**Source:** `packages/verae-access-api/src/server.js`  
+**Lines:** 60
+
+## What this module is
+
+Implementation module in `verae-access-api`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, principal, extra = {}` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+
+## Call graph (identifiers invoked)
+
+`replace`, `check`, `fetch`, `stringify`, `json`, `createServer`, `async`, `writeHead`, `end`, `match`, `push`, `concat`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-authz/client.md

@@ -0,0 +1,42 @@
+# `verae-access-authz/client`
+
+**Package:** `verae-access-authz`  
+**Source:** `packages/verae-access-authz/src/client.js`  
+**Lines:** 39
+
+## What this module is
+
+Implementation module in `verae-access-authz`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`authorizeThenRequest`, `authorizeThenPublish`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `authorizeThenRequest` | `nc, sc, { plane, subject, principal, payload, timeout = 2000 }` | — | `unknown` | see Call graph |
+|  | _Call verae.access.authz.check then the internal subject. Fail closed._ | | | |
+| `authorizeThenPublish` | `nc, sc, { plane, subject, principal, payload, timeout = 2000 }` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`authorizeThenRequest`, `request`, `encode`, `stringify`, `parse`, `decode`, `authorizeThenPublish`, `publish`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-authz/policy.md

@@ -0,0 +1,42 @@
+# `verae-access-authz/policy`
+
+**Package:** `verae-access-authz`  
+**Source:** `packages/verae-access-authz/src/policy.js`  
+**Lines:** 99
+
+## What this module is
+
+Implementation module in `verae-access-authz`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`POLICY`, `authorize`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `prefixAllowed` | `allow, subject` | — | `unknown` | see Call graph |
+| `authorize` | `req` | — | `unknown` | see Call graph |
+| `deny` | `plane, subject, reason` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`workers`, `freeze`, `web`, `prefixAllowed`, `some`, `endsWith`, `startsWith`, `authorize`, `parseAddress`, `deny`, `includes`, `mismatch`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-authz/server.md

@@ -0,0 +1,44 @@
+# `verae-access-authz/server`
+
+**Package:** `verae-access-authz`  
+**Source:** `packages/verae-access-authz/src/server.js`  
+**Lines:** 84
+
+## What this module is
+
+Implementation module in `verae-access-authz`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `startNats` | `(none)` | — | `unknown` | see Call graph |
+| `readBody` | `req` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+- `./policy.js`
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`startNats`, `import`, `connect`, `split`, `subscribe`, `async`, `parse`, `decode`, `authorize`, `publish`, `encode`, `stringify`, `toISOString`, `respond`, `write`, `readBody`, `on`, `push`, `resolve`, `concat`, `toString`, `createServer`, `writeHead`, `end`, `json`, `listen`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-authz/subjects.md

@@ -0,0 +1,43 @@
+# `verae-access-authz/subjects`
+
+**Package:** `verae-access-authz`  
+**Source:** `packages/verae-access-authz/src/subjects.js`  
+**Lines:** 37
+
+## What this module is
+
+Implementation module in `verae-access-authz`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`PLANES`, `SUBJECTS`, `accessAddress`, `parseAddress`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `accessAddress` | `plane, internalSubject` | — | `unknown` | see Call graph |
+|  | _verae.billing.statement.get + plane web → verae.access.web.billing.statement.get_ | | | |
+| `parseAddress` | `subject, planeHint` | — | `unknown` | see Call graph |
+|  | _Parse an access or internal subject into { plane, internal }._ | | | |
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+`ingress`, `internal`, `freeze`, `accessAddress`, `includes`, `startsWith`, `slice`, `parseAddress`, `match`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-leaf/server.md

@@ -0,0 +1,44 @@
+# `verae-access-leaf/server`
+
+**Package:** `verae-access-leaf`  
+**Source:** `packages/verae-access-leaf/src/server.js`  
+**Lines:** 95
+
+## What this module is
+
+Implementation module in `verae-access-leaf`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, principal` | — | `unknown` | see Call graph |
+| `authorizedToken` | `got` | — | `unknown` | see Call graph |
+| `forward` | `body` | — | `unknown` | see Call graph |
+| `startNats` | `(none)` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+
+## Call graph (identifiers invoked)
+
+`subjects`, `replace`, `check`, `fetch`, `stringify`, `json`, `authorizedToken`, `forward`, `import`, `connect`, `split`, `publish`, `encode`, `flush`, `close`, `startNats`, `async`, `subscribe`, `parse`, `decode`, `respond`, `write`, `createServer`, `writeHead`, `end`, `push`, `concat`, `toString`, `listen`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-web/gate.md

@@ -0,0 +1,42 @@
+# `verae-access-web/gate`
+
+**Package:** `verae-access-web`  
+**Source:** `packages/verae-access-web/src/gate.js`  
+**Lines:** 51
+
+## What this module is
+
+Implementation module in `verae-access-web`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`PLANE`, `AUTHZ_CHECK`, `check`, `statement`, `reload`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, { principal, kind, payload } = {}` | — | `unknown` | see Call graph |
+| `statement` | `customerId, principal` | — | `unknown` | see Call graph |
+| `reload` | `customerId, cents, principal` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+`replace`, `check`, `fetch`, `stringify`, `json`, `statement`, `import`, `connect`, `split`, `request`, `encode`, `parse`, `decode`, `close`, `reload`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-web/server.md

@@ -0,0 +1,41 @@
+# `verae-access-web/server`
+
+**Package:** `verae-access-web`  
+**Source:** `packages/verae-access-web/src/server.js`  
+**Lines:** 39
+
+## What this module is
+
+Implementation module in `verae-access-web`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+- `./gate.js`
+
+## Call graph (identifiers invoked)
+
+`createServer`, `async`, `writeHead`, `end`, `stringify`, `json`, `match`, `statement`, `push`, `parse`, `concat`, `toString`, `reload`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-zapier/server.md

@@ -0,0 +1,41 @@
+# `verae-access-zapier/server`
+
+**Package:** `verae-access-zapier`  
+**Source:** `packages/verae-access-zapier/src/server.js`  
+**Lines:** 56
+
+## What this module is
+
+Implementation module in `verae-access-zapier`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, principal` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+
+## Call graph (identifiers invoked)
+
+`replace`, `check`, `fetch`, `stringify`, `json`, `createServer`, `async`, `writeHead`, `end`, `startsWith`, `push`, `concat`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/zappier-customer-service/nats-billing.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier-customer-service`  
 **Source:** `packages/zappier-customer-service/src/nats-billing.js`  
-**Lines:** 21
+**Lines:** 45
 
 ## What this module is
 
@@ -20,6 +20,7 @@ _None extracted._
 
 | Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
 |------|------------|---------------------|---------|-----------------------------|
+| `authz` | `subject, payload` | — | `unknown` | see Call graph |
 | `billingRequest` | `subject, payload` | — | `unknown` | see Call graph |
 
 ## What it imports / requires
@@ -28,7 +29,7 @@ _No imports detected._
 
 ## Call graph (identifiers invoked)
 
-`billingRequest`, `import`, `connect`, `split`, `request`, `encode`, `stringify`, `parse`, `decode`, `close`
+`authz`, `fetch`, `replace`, `stringify`, `json`, `billingRequest`, `import`, `connect`, `split`, `request`, `encode`, `parse`, `decode`, `close`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier-sales-pricing/nats-billing.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier-sales-pricing`  
 **Source:** `packages/zappier-sales-pricing/src/nats-billing.js`  
-**Lines:** 18
+**Lines:** 37
 
 ## What this module is
 
@@ -20,6 +20,7 @@ _None extracted._
 
 | Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
 |------|------------|---------------------|---------|-----------------------------|
+| `authz` | `subject` | — | `unknown` | see Call graph |
 | `billingRequest` | `subject, payload` | — | `unknown` | see Call graph |
 
 ## What it imports / requires
@@ -28,7 +29,7 @@ _No imports detected._
 
 ## Call graph (identifiers invoked)
 
-`billingRequest`, `import`, `connect`, `split`, `request`, `encode`, `stringify`, `parse`, `decode`, `close`
+`authz`, `fetch`, `replace`, `stringify`, `json`, `billingRequest`, `import`, `connect`, `split`, `request`, `encode`, `parse`, `decode`, `close`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier/admin.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/admin.ts`  
-**Lines:** 588
+**Lines:** 591
 
 ## What this module is
 

docs/modules/zappier/billing-nats.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/billing-nats.ts`  
-**Lines:** 74
+**Lines:** 130
 
 ## What this module is
 
@@ -10,12 +10,13 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 
 ## Exports
 
-`BILLING_SUBJECTS`, `BillingStatement`, `natsStatement`, `natsAdjust`, `natsPublish`
+`BILLING_SUBJECTS`, `AUTHZ_CHECK`, `AccessPlane`, `BillingStatement`, `natsStatement`, `natsAdjust`, `natsPublish`
 
 ## Types / interfaces / classes
 
 | Kind | Name |
 |------|------|
+| type | `AccessPlane` |
 | type | `BillingStatement` |
 | type | `Nc` |
 
@@ -26,15 +27,26 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 | `nc` | `(none)` | — | `unknown` | see Call graph |
 | `encode` | `obj: unknown` | — | `unknown` | see Call graph |
 | `decode` | `buf: Uint8Array` | — | `unknown` | see Call graph |
-| `natsStatement` | `customerId: string` | — | `unknown` | see Call graph |
+| `authzAllow` | `plane: AccessPlane,
+  subject: string,
+  extra: { principal?: string; kind?: string } = {},` | — | `unknown` | see Call graph |
+| `natsStatement` | `customerId: string,
+  plane: AccessPlane = 'web',` | — | `unknown` | see Call graph |
 | `natsAdjust` | `payload: {
-  customerId: string;
-  cents: number;
-  reason: string;
-  agent: string;
-  kind?: string;
-}` | — | `unknown` | see Call graph |
-| `natsPublish` | `subject: string, payload: unknown` | — | `unknown` | see Call graph |
+    customerId: string;
+    cents: number;
+    reason: string;
+    agent: string;
+    kind?: string;
+  },
+  plane: AccessPlane = 'staff',` | — | `unknown` | see Call graph |
+| `natsPublish` | `subject: string, payload: unknown, plane: AccessPlane = 'api'` | — | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `void` | `async (` |
 
 ## What it imports / requires
 
@@ -42,7 +54,7 @@ _No imports detected._
 
 ## Call graph (identifiers invoked)
 
-`unset`, `nc`, `async`, `import`, `connect`, `split`, `encode`, `stringify`, `decode`, `parse`, `natsStatement`, `request`, `natsAdjust`, `natsPublish`, `then`, `publish`
+`unset`, `nc`, `async`, `import`, `connect`, `split`, `encode`, `stringify`, `decode`, `parse`, `authzAllow`, `request`, `fetch`, `replace`, `json`, `natsStatement`, `natsAdjust`, `natsPublish`, `void`, `publish`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier/portal.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/portal.ts`  
-**Lines:** 321
+**Lines:** 328
 
 ## What this module is