Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

packages/verae-jobs-events/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-jobs-events
+
+IN `verae.zapier.jobs.events` queue `jobs-events`.

packages/verae-jobs-events/README.md

@@ -0,0 +1,7 @@
+# verae-jobs-events
+
+Mailbox process for `verae.zapier.jobs.events`. Today it counts events (passthrough). Webhook routing still lives in middleware until this process takes the exclusive consumer.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-jobs-events
+
+Port `:3030`.

packages/verae-jobs-events/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "verae-jobs-events",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "description": "Mailbox for verae.zapier.jobs.events (passthrough)",
+  "scripts": {
+    "start": "node src/server.js",
+    "test": "node --test test/*.test.js"
+  },
+  "dependencies": {
+    "nats": "^2.28.2"
+  }
+}

packages/verae-jobs-events/src/server.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+/** Mailbox for verae.zapier.jobs.events. Passthrough: count + optional fan-out later. */
+import http from 'node:http';
+import { SUBJECTS } from './subjects.js';
+
+const PORT = Number(process.env.PORT || process.env.FLEET_HEALTH_PORT || 3030);
+const BIND = process.env.FLEET_HEALTH_BIND || '0.0.0.0';
+let processed = 0;
+let last = null;
+
+async function startNats() {
+  const url = process.env.NATS_URL;
+  if (!url) return;
+  const { connect, StringCodec } = await import('nats');
+  const nc = await connect({ servers: url.split(','), name: 'verae-jobs-events' });
+  const sc = StringCodec();
+  for await (const m of nc.subscribe(SUBJECTS.IN, { queue: SUBJECTS.QUEUE })) {
+    processed += 1;
+    try {
+      last = JSON.parse(sc.decode(m.data) || '{}');
+    } catch {
+      last = {};
+    }
+    if (m.reply) m.respond(sc.encode(JSON.stringify({ ok: true, processed })));
+  }
+}
+
+const server = http.createServer((req, res) => {
+  const url = new URL(req.url || '/', `http://127.0.0.1:${PORT}`);
+  if (url.pathname === '/health') {
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, role: 'verae-jobs-events', processed, subject: SUBJECTS.IN, lastEvent: last?.event || null }));
+    return;
+  }
+  res.writeHead(404, { 'content-type': 'application/json' });
+  res.end(JSON.stringify({ error: 'not found' }));
+});
+
+server.listen(PORT, BIND, () => {
+  process.stdout.write(`verae-jobs-events http://${BIND}:${PORT}/\n`);
+});
+startNats().catch((err) => process.stderr.write(`nats optional: ${err.message}\n`));

packages/verae-jobs-events/src/subjects.js

@@ -0,0 +1,4 @@
+export const SUBJECTS = {
+  IN: 'verae.zapier.jobs.events',
+  QUEUE: 'jobs-events',
+};

packages/verae-jobs-events/test/health.test.js

@@ -0,0 +1,23 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+test('jobs-events health', async () => {
+  const port = 18030;
+  const child = spawn(process.execPath, ['src/server.js'], {
+    cwd: root,
+    env: { ...process.env, PORT: String(port) },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((r) => setTimeout(r, 400));
+  try {
+    const h = await (await fetch(`http://127.0.0.1:${port}/health`)).json();
+    assert.equal(h.role, 'verae-jobs-events');
+  } finally {
+    child.kill('SIGTERM');
+  }
+});