Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

packages/verae-access-leaf/src/allow.js

@@ -0,0 +1,28 @@
+import fs from 'node:fs';
+
+const FALLBACK = [
+  'verae.archive.put',
+  'verae.archive.query',
+  'verae.archive.reply.',
+  'verae.zapier.jobs.watch',
+  'verae.zapier.jobs.events',
+  'verae.zapier.webhooks.deliver',
+];
+
+export function leafAllowList() {
+  const p = process.env.NATS_POLICY_PATH;
+  if (p && fs.existsSync(p)) {
+    try {
+      return JSON.parse(fs.readFileSync(p, 'utf8')).leafAllow || FALLBACK;
+    } catch {
+      return FALLBACK;
+    }
+  }
+  return FALLBACK;
+}
+
+export function leafAllowed(subject) {
+  return leafAllowList().some((p) =>
+    p.endsWith('.') ? subject.startsWith(p) : subject === p || subject.startsWith(`${p}.`),
+  );
+}

packages/verae-access-leaf/src/server.js

@@ -5,6 +5,7 @@
  * then forwards only allowed internal subjects (archive + jobs, never billing).
  */
 import http from 'node:http';
+import { leafAllowed } from './allow.js';
 
 const PORT = Number(process.env.PORT || 3023);
 const AUTHZ = (process.env.AUTHZ_URL || 'http://127.0.0.1:3020').replace(/\/$/, '');
@@ -30,6 +31,9 @@ async function forward(body) {
     return { status: 401, body: { allow: false, reason: 'bad leaf token' } };
   }
   const target = body.target || body.subject;
+  if (!leafAllowed(target)) {
+    return { status: 403, body: { allow: false, reason: `leaf policy denies ${target}` } };
+  }
   const gate = await check(target, body.principal || 'leaf');
   if (!gate.allow) return { status: 403, body: gate };
   const url = process.env.NATS_URL;