Milestone 0: import zappier billing, Verae middleware, and Zapier research

Compose-ready workspace: packages/zappier (rate card, portal, Stripe),
packages/verae-zapier-middleware (timestamp + NATS), packages/verae-zapier
(CLI app), vendor/zapier-platform, and research/zapier vendor corpus.

Gate 0 structure checks pass. Product code and research are not yet wired.

vendor/zapier-platform/example-apps/session-auth/authentication.js

@@ -0,0 +1,61 @@
+'use strict';
+
+// You want to make a request to an endpoint that is either specifically designed
+// to test auth, or one that every user will have access to. eg: `/me`.
+// By returning the entire request object, you have access to the request and
+// response data for testing purposes. Your connection label can access any data
+// from the returned response using the `json.` prefix. eg: `{{json.username}}`.
+const test = (z, bundle) =>
+  z.request({ url: 'https://auth-json-server.zapier-staging.com/me' });
+
+const getSessionKey = async (z, bundle) => {
+  const response = await z.request({
+    url: 'https://httpbin.zapier-tooling.com/post',
+    method: 'POST',
+    body: {
+      username: bundle.authData.username,
+      password: bundle.authData.password,
+    },
+  });
+
+  // If you're using core v9.x or older, you should call response.throwForStatus()
+  // or verify response.status === 200 before you continue.
+  return {
+    // FIXME: The `|| "secret"` below is just for demo purposes, you should remove it.
+    sessionKey: response.data.sessionKey || 'secret',
+  };
+};
+
+module.exports = {
+  // "session" auth exchanges user data for a different session token (that may be
+  // periodically refreshed")
+  type: 'session',
+  sessionConfig: { perform: getSessionKey },
+
+  // Define any input app's auth requires here. The user will be prompted to enter
+  // this info when they connect their account.
+  fields: [
+    { key: 'username', label: 'Username', required: true },
+    {
+      key: 'password',
+      label: 'Password',
+      required: true,
+
+      // this lets the user enter masked data
+      type: 'password',
+    },
+  ],
+
+  // The test method allows Zapier to verify that the credentials a user provides
+  // are valid. We'll execute this method whenever a user connects their account for
+  // the first time.
+  test,
+
+  // This template string can access all the data returned from the auth test. If
+  // you return the test object, you'll access the returned data with a label like
+  // `{{json.X}}`. If you return `response.data` from your test, then your label can
+  // be `{{X}}`. This can also be a function that returns a label. That function has
+  // the standard args `(z, bundle)` and data returned from the test can be accessed
+  // in `bundle.inputData.X`.
+  connectionLabel: '{{json.username}}',
+};