Milestone 4: mock retrieval receipt JSON (extra seal)

GET /zapier/v1/receipts/{jobId}?format=json returns a retrieval receipt
with extraSeal.event=document.retrieved. PDF format is 501 until legal
copy exists. OPEN.md lists work that needs Zapier login or live Verae.

packages/verae-zapier-middleware/src/routes/index.js

@@ -11,6 +11,7 @@ import { statusRoutes } from './statusRoutes.js';
 import { webhookRoutes } from './webhookRoutes.js';
 import { publicTenantRoutes, adminTenantRoutes } from './tenantRoutes.js';
 import { hashRoutes } from './hashRoutes.js';
+import { receiptRoutes } from './receiptRoutes.js';
 import { authenticate } from '../middleware/authenticate.js';
 import { rateLimit } from '../middleware/rateLimit.js';
 
@@ -31,5 +32,6 @@ protectedRoutes.use('/verify', verifyRoutes);
 protectedRoutes.use('/status', statusRoutes);
 protectedRoutes.use('/webhooks', webhookRoutes);
 protectedRoutes.use('/hashes', hashRoutes);
+protectedRoutes.use('/receipts', receiptRoutes);
 
 apiRoutes.use('/v1', protectedRoutes);

packages/verae-zapier-middleware/src/routes/receiptRoutes.js

@@ -0,0 +1,43 @@
+/**
+ * Mock certified retrieval receipt (JSON). Not a payment invoice.
+ * @module routes/receiptRoutes
+ */
+
+import { Router } from 'express';
+import { asyncHandler, AppError } from '../errors.js';
+import { getJobStatus } from '../services/timestampService.js';
+
+export const receiptRoutes = Router();
+
+receiptRoutes.get(
+  '/:jobId',
+  asyncHandler(async (req, res) => {
+    const { jobId } = req.params;
+    const format = String(req.query.format || 'json').toLowerCase();
+    const status = await getJobStatus(req.auth, jobId);
+    if (status.status !== 'completed') {
+      throw new AppError('Receipt only for completed jobs', { status: 409, code: 'NOT_COMPLETE' });
+    }
+    const retrievedAt = new Date().toISOString();
+    const receipt = {
+      type: 'verae.retrieval-receipt',
+      format: 'json',
+      jobId,
+      sha256: status.sha256 ?? status.metadata?.sha256,
+      timestamp: status.completedAt ?? status.metadata?.timestamp,
+      certificate: status.result,
+      extraSeal: {
+        event: 'document.retrieved',
+        retrievedAt,
+        tenantId: req.auth.tenantId,
+      },
+    };
+    if (format === 'pdf') {
+      throw new AppError('PDF receipts not implemented; use format=json', {
+        status: 501,
+        code: 'NOT_IMPLEMENTED',
+      });
+    }
+    res.json(receipt);
+  }),
+);