Adjacent work: PDF receipts, encrypted blob+share mock, NATS tunnel, SHA256 Zapier action

Around remaining blockers (Zapier login, live Verae): generate PDF receipts
without extra deps; AES-256-GCM object store with tenant isolation and share
tokens; scripts/nats-tunnel.sh to NS1; SHA256 Hash Text local Zapier action;
scripts/test-offline.sh for the no-login suite.

Learned: other-tenant object GET is 403; share token is the mock unwrap path.

docs/01-product/features-a-m.md

@@ -9,10 +9,10 @@ Source: [workspace-brief.md](../00-sources/workspace-brief.md). Owners after com
 | c | Register SHA256 or return original timestamp + ref | verae middleware mock + zappier `/v1/timestamp` | **Mock done** — second create returns original `jobId` + `existing: true` | Live OpenAPI still `data` only |
 | d | Lookup by SHA256 | `GET /zapier/v1/hashes/{sha256}` and zappier `/v1/hashes/{sha256}` | **Mock done** | No live Verae route |
 | e | Timestamp + public/private metadata | verae mock | Missing | No |
-| f | e + encrypted LTS binary | verae mock | Missing. Do not use zappier demo `/v1/storage` | No |
-| g | Share file/dir + decryption key | verae mock | Missing | No |
+| f | e + encrypted LTS binary | `POST/GET /zapier/v1/objects` AES-256-GCM mock | **Mock done** | No |
+| g | Share file/dir + decryption key | `POST .../share` + `GET /zapier/v1/shares/:token` | **File mock done**; directory tree still TBD | No |
 | h | Retrieve SHA256 + metadata | verae status/verify | Partial by `jobId` | `GET /api/status/{jobId}`, `GET /api/verify/{jobId}` |
-| i | Certified retrieval receipt (PDF/JSON) extra seal | `GET /zapier/v1/receipts/{jobId}?format=json` | **JSON mock done**; PDF 501 | No |
+| i | Certified retrieval receipt (PDF/JSON) extra seal | `GET /zapier/v1/receipts/{jobId}?format=json\|pdf` | **JSON + PDF mock done** | No |
 | j | Setup payment method | zappier portal reload (Stripe) | Built (prepaid reload; card-on-file TBD) | No |
 | k | Get invoices | zappier portal + admin | Built | No |
 | l | Get payment receipts | zappier invoice HTML/print | Built as invoices | No |

docs/OPEN.md

@@ -4,8 +4,8 @@ These cannot finish in this session:
 
 1. **`zapier-platform login` + `register` + `push`** — browser OAuth to your Zapier account. Follow [docs/04-activate/SETUP-ZAPIER-DEVELOPER.md](04-activate/SETUP-ZAPIER-DEVELOPER.md). After push, commit `.zapierapprc`.
 2. **Live `api.veraetime.net`** — hash lookup, metadata, receipts, LTS, share are **not** in the public OpenAPI. Mocks exist; live client refuses unknown paths.
-3. **PDF receipts** — JSON extra-seal works; PDF is 501.
-4. **Encrypted LTS + directory share (f, g)** — not implemented beyond mock timestamp metadata.
-5. **NS1 NATS public bind** — left loopback-only; use SSH tunnel (`14222`).
+3. **PDF receipts** — JSON extra-seal works; PDF is generated locally (`?format=pdf`). Legal copy/seal artwork still TBD.
+4. **Encrypted LTS + share** — mock AES-256-GCM blobs + share tokens exist (`/zapier/v1/objects`, `/zapier/v1/shares/:token`). Not live Verae/Peergos.
+5. **NS1 NATS public bind** — left loopback-only; `scripts/nats-tunnel.sh` maps `14222`.
 
 Everything else for morning Add Numbers is ready.

docs/modules/README.md

@@ -37,6 +37,7 @@ One MD file per source module.
 - [verae-zapier-middleware/debug/trace](verae-zapier-middleware/debug/trace.md)
 - [verae-zapier-middleware/errors](verae-zapier-middleware/errors.md)
 - [verae-zapier-middleware/index](verae-zapier-middleware/index.md)
+- [verae-zapier-middleware/lib/receiptPdf](verae-zapier-middleware/lib/receiptPdf.md)
 - [verae-zapier-middleware/lib/tokens](verae-zapier-middleware/lib/tokens.md)
 - [verae-zapier-middleware/middleware/authenticate](verae-zapier-middleware/middleware/authenticate.md)
 - [verae-zapier-middleware/middleware/rateLimit](verae-zapier-middleware/middleware/rateLimit.md)
@@ -47,6 +48,8 @@ One MD file per source module.
 - [verae-zapier-middleware/routes/authRoutes](verae-zapier-middleware/routes/authRoutes.md)
 - [verae-zapier-middleware/routes/hashRoutes](verae-zapier-middleware/routes/hashRoutes.md)
 - [verae-zapier-middleware/routes/index](verae-zapier-middleware/routes/index.md)
+- [verae-zapier-middleware/routes/objectRoutes](verae-zapier-middleware/routes/objectRoutes.md)
+- [verae-zapier-middleware/routes/receiptRoutes](verae-zapier-middleware/routes/receiptRoutes.md)
 - [verae-zapier-middleware/routes/statusRoutes](verae-zapier-middleware/routes/statusRoutes.md)
 - [verae-zapier-middleware/routes/tenantRoutes](verae-zapier-middleware/routes/tenantRoutes.md)
 - [verae-zapier-middleware/routes/timestampRoutes](verae-zapier-middleware/routes/timestampRoutes.md)
@@ -58,6 +61,7 @@ One MD file per source module.
 - [verae-zapier-middleware/services/timestampService](verae-zapier-middleware/services/timestampService.md)
 - [verae-zapier-middleware/services/verifyService](verae-zapier-middleware/services/verifyService.md)
 - [verae-zapier-middleware/services/webhookService](verae-zapier-middleware/services/webhookService.md)
+- [verae-zapier-middleware/store/blobs](verae-zapier-middleware/store/blobs.md)
 - [verae-zapier-middleware/store/db](verae-zapier-middleware/store/db.md)
 - [verae-zapier-middleware/store/jobWatchers](verae-zapier-middleware/store/jobWatchers.md)
 - [verae-zapier-middleware/store/tenants](verae-zapier-middleware/store/tenants.md)
@@ -69,6 +73,7 @@ One MD file per source module.
 - [verae-activate/authentication](verae-activate/authentication.md)
 - [verae-activate/creates/add_numbers](verae-activate/creates/add_numbers.md)
 - [verae-activate/creates/echo](verae-activate/creates/echo.md)
+- [verae-activate/creates/sha256](verae-activate/creates/sha256.md)
 - [verae-activate/index](verae-activate/index.md)
 - [verae-zapier/authentication](verae-zapier/authentication.md)
 - [verae-zapier/creates/add_numbers](verae-zapier/creates/add_numbers.md)

docs/modules/verae-activate/creates/sha256.md

@@ -0,0 +1,40 @@
+# `verae-activate/creates/sha256`
+
+**Package:** `verae-activate`  
+**Source:** `packages/verae-activate/creates/sha256.js`  
+**Lines:** 37
+
+## What this module is
+
+Implementation module in `verae-activate`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`key`, `noun`, `display`, `label`, `description`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `perform` | `_z, bundle` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:crypto`
+
+## Call graph (identifiers invoked)
+
+`async`, `createHash`, `update`, `digest`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-activate/index.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-activate`  
 **Source:** `packages/verae-activate/index.js`  
-**Lines:** 23
+**Lines:** 25
 
 ## What this module is
 
@@ -10,7 +10,7 @@ Implementation module in `verae-activate`. The tables below are extracted from t
 
 ## Exports
 
-`version`, `platformVersion`, `authentication`, `creates`, `addNumbers`, `echo`
+`version`, `platformVersion`, `authentication`, `creates`, `addNumbers`, `echo`, `sha256Hash`
 
 ## Types / interfaces / classes
 
@@ -25,6 +25,7 @@ _No top-level functions extracted._
 - `./authentication`
 - `./creates/add_numbers`
 - `./creates/echo`
+- `./creates/sha256`
 - `./package.json`
 - `zapier-platform-core`
 

docs/modules/verae-zapier-middleware/clients/veraeClient.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-zapier-middleware`  
 **Source:** `packages/verae-zapier-middleware/src/clients/veraeClient.js`  
-**Lines:** 351
+**Lines:** 352
 
 ## What this module is
 

docs/modules/verae-zapier-middleware/lib/receiptPdf.md

@@ -0,0 +1,41 @@
+# `verae-zapier-middleware/lib/receiptPdf`
+
+**Package:** `verae-zapier-middleware`  
+**Source:** `packages/verae-zapier-middleware/src/lib/receiptPdf.js`  
+**Lines:** 65
+
+## What this module is
+
+Implementation module in `verae-zapier-middleware`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`buildReceiptPdf`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `pdfEscape` | `s` | s: `string` | `string` | see Call graph |
+| `buildReceiptPdf` | `receipt` | receipt: `object` | `Buffer` | see Call graph |
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+`receipts`, `pdfEscape`, `replace`, `buildReceiptPdf`, `slice`, `map`, `join`, `byteLength`, `push`, `padStart`, `from`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-zapier-middleware/routes/index.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-zapier-middleware`  
 **Source:** `packages/verae-zapier-middleware/src/routes/index.js`  
-**Lines:** 36
+**Lines:** 41
 
 ## What this module is
 
@@ -30,6 +30,8 @@ _No top-level functions extracted._
 - `./webhookRoutes.js`
 - `./tenantRoutes.js`
 - `./hashRoutes.js`
+- `./receiptRoutes.js`
+- `./objectRoutes.js`
 - `../middleware/authenticate.js`
 - `../middleware/rateLimit.js`
 

docs/modules/verae-zapier-middleware/routes/objectRoutes.md

@@ -0,0 +1,50 @@
+# `verae-zapier-middleware/routes/objectRoutes`
+
+**Package:** `verae-zapier-middleware`  
+**Source:** `packages/verae-zapier-middleware/src/routes/objectRoutes.js`  
+**Lines:** 91
+
+## What this module is
+
+Implementation module in `verae-zapier-middleware`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`objectRoutes`, `publicShareRoutes`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+_No top-level functions extracted._
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `asyncHandler` | `async (req, res` |
+| `asyncHandler` | `async (req, res` |
+| `asyncHandler` | `async (req, res` |
+| `asyncHandler` | `async (req, res` |
+
+## What it imports / requires
+
+- `express`
+- `../errors.js`
+- `../store/blobs.js`
+- `../services/timestampService.js`
+
+## Call graph (identifiers invoked)
+
+`post`, `asyncHandler`, `async`, `from`, `createTimestamp`, `toString`, `slice`, `putBlob`, `status`, `json`, `get`, `readBlobPlaintext`, `createShare`, `redeemShare`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-zapier-middleware/routes/receiptRoutes.md

@@ -0,0 +1,47 @@
+# `verae-zapier-middleware/routes/receiptRoutes`
+
+**Package:** `verae-zapier-middleware`  
+**Source:** `packages/verae-zapier-middleware/src/routes/receiptRoutes.js`  
+**Lines:** 46
+
+## What this module is
+
+Implementation module in `verae-zapier-middleware`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`receiptRoutes`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+_No top-level functions extracted._
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `asyncHandler` | `async (req, res` |
+
+## What it imports / requires
+
+- `express`
+- `../errors.js`
+- `../services/timestampService.js`
+- `../lib/receiptPdf.js`
+
+## Call graph (identifiers invoked)
+
+`receipt`, `get`, `asyncHandler`, `async`, `toLowerCase`, `getJobStatus`, `toISOString`, `buildReceiptPdf`, `setHeader`, `send`, `json`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-zapier-middleware/routes/statusRoutes.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-zapier-middleware`  
 **Source:** `packages/verae-zapier-middleware/src/routes/statusRoutes.js`  
-**Lines:** 47
+**Lines:** 52
 
 ## What this module is
 

docs/modules/verae-zapier-middleware/store/blobs.md

@@ -0,0 +1,55 @@
+# `verae-zapier-middleware/store/blobs`
+
+**Package:** `verae-zapier-middleware`  
+**Source:** `packages/verae-zapier-middleware/src/store/blobs.js`  
+**Lines:** 137
+
+## What this module is
+
+Implementation module in `verae-zapier-middleware`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`decryptBlob`, `putBlob`, `getBlobRecord`, `readBlobPlaintext`, `createShare`, `redeemShare`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `ensure` | `(none)` | — | `unknown` | see Call graph |
+| `encrypt` | `plaintext, key` | plaintext: `Buffer`, key: `Buffer` | `unknown` | see Call graph |
+| `decryptBlob` | `enc, key` | key: `Buffer` | `unknown` | see Call graph |
+| `putBlob` | `{ tenantId, sha256, filename, bytes, publicMetadata = {}, privateMetadata = {} }` | params: `object`, params.tenantId: `string`, params.sha256: `string`, params.filename: `string`, params.bytes: `Buffer`, params.publicMetadata: `object`, params.privateMetadata: `object` | `unknown` | see Call graph |
+| `getBlobRecord` | `id` | — | `unknown` | see Call graph |
+| `readBlobPlaintext` | `id, tenantId` | id: `string`, tenantId: `string` | `unknown` | see Call graph |
+| `createShare` | `{ blobId, fromTenantId, label }` | — | `unknown` | see Call graph |
+| `redeemShare` | `token` | token: `string` | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `persist` | `(none)` |
+| `persist` | `(none)` |
+
+## What it imports / requires
+
+- `node:crypto`
+- `./db.js`
+
+## Call graph (identifiers invoked)
+
+`ensure`, `getStore`, `encrypt`, `randomBytes`, `createCipheriv`, `concat`, `update`, `final`, `getAuthTag`, `toString`, `decryptBlob`, `createDecipheriv`, `from`, `setAuthTag`, `putBlob`, `randomUUID`, `toISOString`, `persist`, `getBlobRecord`, `readBlobPlaintext`, `createShare`, `redeemShare`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-zapier-middleware/store/db.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-zapier-middleware`  
 **Source:** `packages/verae-zapier-middleware/src/store/db.js`  
-**Lines:** 115
+**Lines:** 117
 
 ## What this module is
 

docs/sphinx/index.rst

@@ -40,6 +40,7 @@ Verae × Zapier module reference
    modules/verae-zapier-middleware/debug/trace
    modules/verae-zapier-middleware/errors
    modules/verae-zapier-middleware/index
+   modules/verae-zapier-middleware/lib/receiptPdf
    modules/verae-zapier-middleware/lib/tokens
    modules/verae-zapier-middleware/middleware/authenticate
    modules/verae-zapier-middleware/middleware/rateLimit
@@ -50,6 +51,8 @@ Verae × Zapier module reference
    modules/verae-zapier-middleware/routes/authRoutes
    modules/verae-zapier-middleware/routes/hashRoutes
    modules/verae-zapier-middleware/routes/index
+   modules/verae-zapier-middleware/routes/objectRoutes
+   modules/verae-zapier-middleware/routes/receiptRoutes
    modules/verae-zapier-middleware/routes/statusRoutes
    modules/verae-zapier-middleware/routes/tenantRoutes
    modules/verae-zapier-middleware/routes/timestampRoutes
@@ -61,6 +64,7 @@ Verae × Zapier module reference
    modules/verae-zapier-middleware/services/timestampService
    modules/verae-zapier-middleware/services/verifyService
    modules/verae-zapier-middleware/services/webhookService
+   modules/verae-zapier-middleware/store/blobs
    modules/verae-zapier-middleware/store/db
    modules/verae-zapier-middleware/store/jobWatchers
    modules/verae-zapier-middleware/store/tenants
@@ -72,6 +76,7 @@ Verae × Zapier module reference
    modules/verae-activate/authentication
    modules/verae-activate/creates/add_numbers
    modules/verae-activate/creates/echo
+   modules/verae-activate/creates/sha256
    modules/verae-activate/index
    modules/verae-zapier/authentication
    modules/verae-zapier/creates/add_numbers

docs/sphinx/modules/verae-activate/creates/sha256.md

@@ -0,0 +1,40 @@
+# `verae-activate/creates/sha256`
+
+**Package:** `verae-activate`  
+**Source:** `packages/verae-activate/creates/sha256.js`  
+**Lines:** 37
+
+## What this module is
+
+Implementation module in `verae-activate`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`key`, `noun`, `display`, `label`, `description`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `perform` | `_z, bundle` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:crypto`
+
+## Call graph (identifiers invoked)
+
+`async`, `createHash`, `update`, `digest`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-activate/creates/sha256.rst

@@ -0,0 +1,7 @@
+verae-activate.creates.sha256
+=============================
+
+Generated API sheet for ``verae-activate/creates/sha256``.
+
+.. include:: sha256.md
+   :literal:

docs/sphinx/modules/verae-activate/index.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-activate`  
 **Source:** `packages/verae-activate/index.js`  
-**Lines:** 23
+**Lines:** 25
 
 ## What this module is
 
@@ -10,7 +10,7 @@ Implementation module in `verae-activate`. The tables below are extracted from t
 
 ## Exports
 
-`version`, `platformVersion`, `authentication`, `creates`, `addNumbers`, `echo`
+`version`, `platformVersion`, `authentication`, `creates`, `addNumbers`, `echo`, `sha256Hash`
 
 ## Types / interfaces / classes
 
@@ -25,6 +25,7 @@ _No top-level functions extracted._
 - `./authentication`
 - `./creates/add_numbers`
 - `./creates/echo`
+- `./creates/sha256`
 - `./package.json`
 - `zapier-platform-core`
 

docs/sphinx/modules/verae-zapier-middleware/clients/veraeClient.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-zapier-middleware`  
 **Source:** `packages/verae-zapier-middleware/src/clients/veraeClient.js`  
-**Lines:** 351
+**Lines:** 352
 
 ## What this module is
 

docs/sphinx/modules/verae-zapier-middleware/lib/receiptPdf.md

@@ -0,0 +1,41 @@
+# `verae-zapier-middleware/lib/receiptPdf`
+
+**Package:** `verae-zapier-middleware`  
+**Source:** `packages/verae-zapier-middleware/src/lib/receiptPdf.js`  
+**Lines:** 65
+
+## What this module is
+
+Implementation module in `verae-zapier-middleware`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`buildReceiptPdf`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `pdfEscape` | `s` | s: `string` | `string` | see Call graph |
+| `buildReceiptPdf` | `receipt` | receipt: `object` | `Buffer` | see Call graph |
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+`receipts`, `pdfEscape`, `replace`, `buildReceiptPdf`, `slice`, `map`, `join`, `byteLength`, `push`, `padStart`, `from`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-zapier-middleware/lib/receiptPdf.rst

@@ -0,0 +1,7 @@
+verae-zapier-middleware.lib.receiptPdf
+======================================
+
+Generated API sheet for ``verae-zapier-middleware/lib/receiptPdf``.
+
+.. include:: receiptPdf.md
+   :literal:

docs/sphinx/modules/verae-zapier-middleware/routes/index.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-zapier-middleware`  
 **Source:** `packages/verae-zapier-middleware/src/routes/index.js`  
-**Lines:** 36
+**Lines:** 41
 
 ## What this module is
 
@@ -30,6 +30,8 @@ _No top-level functions extracted._
 - `./webhookRoutes.js`
 - `./tenantRoutes.js`
 - `./hashRoutes.js`
+- `./receiptRoutes.js`
+- `./objectRoutes.js`
 - `../middleware/authenticate.js`
 - `../middleware/rateLimit.js`
 

docs/sphinx/modules/verae-zapier-middleware/routes/objectRoutes.md

@@ -0,0 +1,50 @@
+# `verae-zapier-middleware/routes/objectRoutes`
+
+**Package:** `verae-zapier-middleware`  
+**Source:** `packages/verae-zapier-middleware/src/routes/objectRoutes.js`  
+**Lines:** 91
+
+## What this module is
+
+Implementation module in `verae-zapier-middleware`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`objectRoutes`, `publicShareRoutes`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+_No top-level functions extracted._
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `asyncHandler` | `async (req, res` |
+| `asyncHandler` | `async (req, res` |
+| `asyncHandler` | `async (req, res` |
+| `asyncHandler` | `async (req, res` |
+
+## What it imports / requires
+
+- `express`
+- `../errors.js`
+- `../store/blobs.js`
+- `../services/timestampService.js`
+
+## Call graph (identifiers invoked)
+
+`post`, `asyncHandler`, `async`, `from`, `createTimestamp`, `toString`, `slice`, `putBlob`, `status`, `json`, `get`, `readBlobPlaintext`, `createShare`, `redeemShare`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-zapier-middleware/routes/objectRoutes.rst

@@ -0,0 +1,7 @@
+verae-zapier-middleware.routes.objectRoutes
+===========================================
+
+Generated API sheet for ``verae-zapier-middleware/routes/objectRoutes``.
+
+.. include:: objectRoutes.md
+   :literal:

docs/sphinx/modules/verae-zapier-middleware/routes/receiptRoutes.md

@@ -0,0 +1,47 @@
+# `verae-zapier-middleware/routes/receiptRoutes`
+
+**Package:** `verae-zapier-middleware`  
+**Source:** `packages/verae-zapier-middleware/src/routes/receiptRoutes.js`  
+**Lines:** 46
+
+## What this module is
+
+Implementation module in `verae-zapier-middleware`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`receiptRoutes`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+_No top-level functions extracted._
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `asyncHandler` | `async (req, res` |
+
+## What it imports / requires
+
+- `express`
+- `../errors.js`
+- `../services/timestampService.js`
+- `../lib/receiptPdf.js`
+
+## Call graph (identifiers invoked)
+
+`receipt`, `get`, `asyncHandler`, `async`, `toLowerCase`, `getJobStatus`, `toISOString`, `buildReceiptPdf`, `setHeader`, `send`, `json`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-zapier-middleware/routes/receiptRoutes.rst

@@ -0,0 +1,7 @@
+verae-zapier-middleware.routes.receiptRoutes
+============================================
+
+Generated API sheet for ``verae-zapier-middleware/routes/receiptRoutes``.
+
+.. include:: receiptRoutes.md
+   :literal:

docs/sphinx/modules/verae-zapier-middleware/routes/statusRoutes.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-zapier-middleware`  
 **Source:** `packages/verae-zapier-middleware/src/routes/statusRoutes.js`  
-**Lines:** 47
+**Lines:** 52
 
 ## What this module is
 

docs/sphinx/modules/verae-zapier-middleware/store/blobs.md

@@ -0,0 +1,55 @@
+# `verae-zapier-middleware/store/blobs`
+
+**Package:** `verae-zapier-middleware`  
+**Source:** `packages/verae-zapier-middleware/src/store/blobs.js`  
+**Lines:** 137
+
+## What this module is
+
+Implementation module in `verae-zapier-middleware`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`decryptBlob`, `putBlob`, `getBlobRecord`, `readBlobPlaintext`, `createShare`, `redeemShare`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `ensure` | `(none)` | — | `unknown` | see Call graph |
+| `encrypt` | `plaintext, key` | plaintext: `Buffer`, key: `Buffer` | `unknown` | see Call graph |
+| `decryptBlob` | `enc, key` | key: `Buffer` | `unknown` | see Call graph |
+| `putBlob` | `{ tenantId, sha256, filename, bytes, publicMetadata = {}, privateMetadata = {} }` | params: `object`, params.tenantId: `string`, params.sha256: `string`, params.filename: `string`, params.bytes: `Buffer`, params.publicMetadata: `object`, params.privateMetadata: `object` | `unknown` | see Call graph |
+| `getBlobRecord` | `id` | — | `unknown` | see Call graph |
+| `readBlobPlaintext` | `id, tenantId` | id: `string`, tenantId: `string` | `unknown` | see Call graph |
+| `createShare` | `{ blobId, fromTenantId, label }` | — | `unknown` | see Call graph |
+| `redeemShare` | `token` | token: `string` | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `persist` | `(none)` |
+| `persist` | `(none)` |
+
+## What it imports / requires
+
+- `node:crypto`
+- `./db.js`
+
+## Call graph (identifiers invoked)
+
+`ensure`, `getStore`, `encrypt`, `randomBytes`, `createCipheriv`, `concat`, `update`, `final`, `getAuthTag`, `toString`, `decryptBlob`, `createDecipheriv`, `from`, `setAuthTag`, `putBlob`, `randomUUID`, `toISOString`, `persist`, `getBlobRecord`, `readBlobPlaintext`, `createShare`, `redeemShare`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-zapier-middleware/store/blobs.rst

@@ -0,0 +1,7 @@
+verae-zapier-middleware.store.blobs
+===================================
+
+Generated API sheet for ``verae-zapier-middleware/store/blobs``.
+
+.. include:: blobs.md
+   :literal:

docs/sphinx/modules/verae-zapier-middleware/store/db.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-zapier-middleware`  
 **Source:** `packages/verae-zapier-middleware/src/store/db.js`  
-**Lines:** 115
+**Lines:** 117
 
 ## What this module is