Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

docs/modules/README.md

@@ -23,6 +23,7 @@ One MD file per source module.
 - [zappier/index](zappier/index.md)
 - [zappier/invoicing](zappier/invoicing.md)
 - [zappier/jobs/report-usage](zappier/jobs/report-usage.md)
+- [zappier/ledger](zappier/ledger.md)
 - [zappier/meter](zappier/meter.md)
 - [zappier/nats-shim.d](zappier/nats-shim.d.md)
 - [zappier/paths](zappier/paths.md)
@@ -121,6 +122,7 @@ One MD file per source module.
 - [verae-zapier-simulator/server](verae-zapier-simulator/server.md)
 - [verae-zapier-simulator/trace](verae-zapier-simulator/trace.md)
 - [zappier-account-balance/books](zappier-account-balance/books.md)
+- [zappier-account-balance/persist](zappier-account-balance/persist.md)
 - [zappier-account-balance/server](zappier-account-balance/server.md)
 - [zappier-account-balance/subjects](zappier-account-balance/subjects.md)
 - [zappier-customer-service/nats-billing](zappier-customer-service/nats-billing.md)
@@ -136,5 +138,14 @@ One MD file per source module.
 - [verae-access-web/gate](verae-access-web/gate.md)
 - [verae-access-web/server](verae-access-web/server.md)
 - [verae-access-api/server](verae-access-api/server.md)
+- [verae-access-leaf/allow](verae-access-leaf/allow.md)
 - [verae-access-leaf/server](verae-access-leaf/server.md)
 - [verae-access-zapier/server](verae-access-zapier/server.md)
+- [verae-access-staff/server](verae-access-staff/server.md)
+- [zappier-identity/ids](zappier-identity/ids.md)
+- [zappier-identity/server](zappier-identity/server.md)
+- [zappier-identity/store](zappier-identity/store.md)
+- [zappier-identity/subjects](zappier-identity/subjects.md)
+- [verae-jobs-events/server](verae-jobs-events/server.md)
+- [verae-jobs-events/subjects](verae-jobs-events/subjects.md)
+- [verae-nats-accounts/policy](verae-nats-accounts/policy.md)

docs/modules/verae-access-leaf/allow.md

@@ -0,0 +1,41 @@
+# `verae-access-leaf/allow`
+
+**Package:** `verae-access-leaf`  
+**Source:** `packages/verae-access-leaf/src/allow.js`  
+**Lines:** 29
+
+## What this module is
+
+Implementation module in `verae-access-leaf`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`leafAllowList`, `leafAllowed`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `leafAllowList` | `(none)` | — | `unknown` | see Call graph |
+| `leafAllowed` | `subject` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:fs`
+
+## Call graph (identifiers invoked)
+
+`leafAllowList`, `existsSync`, `parse`, `readFileSync`, `leafAllowed`, `some`, `endsWith`, `startsWith`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-leaf/server.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-access-leaf`  
 **Source:** `packages/verae-access-leaf/src/server.js`  
-**Lines:** 95
+**Lines:** 99
 
 ## What this module is
 
@@ -29,10 +29,11 @@ _None extracted._
 ## What it imports / requires
 
 - `node:http`
+- `./allow.js`
 
 ## Call graph (identifiers invoked)
 
-`subjects`, `replace`, `check`, `fetch`, `stringify`, `json`, `authorizedToken`, `forward`, `import`, `connect`, `split`, `publish`, `encode`, `flush`, `close`, `startNats`, `async`, `subscribe`, `parse`, `decode`, `respond`, `write`, `createServer`, `writeHead`, `end`, `push`, `concat`, `toString`, `listen`
+`subjects`, `replace`, `check`, `fetch`, `stringify`, `json`, `authorizedToken`, `forward`, `leafAllowed`, `import`, `connect`, `split`, `publish`, `encode`, `flush`, `close`, `startNats`, `async`, `subscribe`, `parse`, `decode`, `respond`, `write`, `createServer`, `writeHead`, `end`, `push`, `concat`, `toString`, `listen`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/verae-access-staff/server.md

@@ -0,0 +1,41 @@
+# `verae-access-staff/server`
+
+**Package:** `verae-access-staff`  
+**Source:** `packages/verae-access-staff/src/server.js`  
+**Lines:** 58
+
+## What this module is
+
+Implementation module in `verae-access-staff`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, extra = {}` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+
+## Call graph (identifiers invoked)
+
+`plane`, `replace`, `check`, `fetch`, `stringify`, `json`, `createServer`, `async`, `writeHead`, `end`, `match`, `push`, `parse`, `concat`, `toString`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-fleet/cli.md

@@ -50,7 +50,7 @@ _None extracted._
 
 ## Call graph (identifiers invoked)
 
-`loadFleet`, `slice`, `print`, `write`, `stringify`, `help`, `off`, `pause`, `json`, `identityFile`, `login`, `api`, `request`, `on`, `push`, `concat`, `toString`, `resolve`, `parse`, `end`, `main`, `listServices`, `padEnd`, `padStart`, `import`, `find`, `sshCheck`, `keys`, `startService`, `tick`, `start`, `startControlServer`, `async`, `stop`, `stopAll`, `exit`, `test`
+`loadFleet`, `slice`, `print`, `write`, `stringify`, `help`, `off`, `pause`, `json`, `identityFile`, `login`, `api`, `request`, `on`, `push`, `concat`, `toString`, `resolve`, `parse`, `end`, `main`, `listServices`, `padEnd`, `padStart`, `import`, `find`, `sshCheck`, `startControlServer`, `keys`, `startService`, `tick`, `start`, `async`, `stop`, `stopAll`, `exit`, `test`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/verae-fleet/machines.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-fleet`  
 **Source:** `packages/verae-fleet/src/machines.js`  
-**Lines:** 108
+**Lines:** 116
 
 ## What this module is
 
@@ -25,7 +25,7 @@ _None extracted._
 | `normalizeMachine` | `m` | — | `unknown` | see Call graph |
 | `upsertMachine` | `list, spec` | — | `unknown` | see Call graph |
 | `canHost` | `machine, serviceId, role` | — | `unknown` | see Call graph |
-| `pickMachine` | `machines, instances, serviceId, role, exclude = []` | machines: `object[]`, serviceId: `string`, role: `string` | `unknown` | see Call graph |
+| `pickMachine` | `machines, instances, serviceId, role, exclude = [], opts = {}` | machines: `object[]`, serviceId: `string`, role: `string` | `unknown` | see Call graph |
 | `saveOverlay` | `overlayPath, machines` | — | `unknown` | see Call graph |
 
 ## What it imports / requires

docs/modules/verae-fleet/server.md

@@ -34,7 +34,7 @@ _None extracted._
 
 ## Call graph (identifiers invoked)
 
-`join`, `dirname`, `fileURLToPath`, `json`, `writeHead`, `end`, `stringify`, `import`, `startControlServer`, `createServer`, `async`, `snapshot`, `reset`, `push`, `parse`, `concat`, `toString`, `run`, `listServices`, `status`, `addMachine`, `match`, `checkMachine`, `setMachineEnabled`, `reconcile`, `startService`, `stopService`, `pauseService`, `resumeService`, `fn`, `pauseInstance`, `resumeInstance`, `restartInstance`, `stopInstance`, `markUnhealthy`, `createReadStream`, `pipe`, `startsWith`, `normalize`, `existsSync`, `statSync`, `isFile`, `extname`, `toLowerCase`, `listen`, `write`
+`bind`, `join`, `dirname`, `fileURLToPath`, `json`, `writeHead`, `end`, `stringify`, `import`, `startControlServer`, `createServer`, `async`, `snapshot`, `reset`, `push`, `parse`, `concat`, `toString`, `run`, `listServices`, `status`, `addMachine`, `match`, `checkMachine`, `setMachineEnabled`, `reconcile`, `startService`, `stopService`, `pauseService`, `resumeService`, `fn`, `pauseInstance`, `resumeInstance`, `restartInstance`, `stopInstance`, `markUnhealthy`, `createReadStream`, `pipe`, `startsWith`, `normalize`, `existsSync`, `statSync`, `isFile`, `extname`, `toLowerCase`, `listen`, `write`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/verae-fleet/ssh.md

@@ -25,7 +25,7 @@ _None extracted._
 | `sshTarget` | `machine` | — | `unknown` | see Call graph |
 | `sshBaseArgs` | `machine` | — | `unknown` | see Call graph |
 | `scpBaseArgs` | `machine` | — | `unknown` | see Call graph |
-| `sshExec` | `machine, remoteCommand, { timeoutMs = 20000 } = {}` | — | `unknown` | see Call graph |
+| `sshExec` | `machine, remoteCommand, { timeoutMs = 8000 } = {}` | — | `unknown` | see Call graph |
 | `scpTo` | `machine, localFiles, remoteDir` | — | `unknown` | see Call graph |
 | `ensureRemoteRuntime` | `machine` | — | `unknown` | see Call graph |
 | `sshSpawnWorker` | `machine, { instance, env }` | — | `unknown` | see Call graph |

docs/modules/verae-fleet/supervisor.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-fleet`  
 **Source:** `packages/verae-fleet/src/supervisor.js`  
-**Lines:** 528
+**Lines:** 529
 
 ## What this module is
 

docs/modules/verae-jobs-events/server.md

@@ -0,0 +1,41 @@
+# `verae-jobs-events/server`
+
+**Package:** `verae-jobs-events`  
+**Source:** `packages/verae-jobs-events/src/server.js`  
+**Lines:** 43
+
+## What this module is
+
+Implementation module in `verae-jobs-events`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `startNats` | `(none)` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`startNats`, `import`, `connect`, `split`, `subscribe`, `parse`, `decode`, `respond`, `encode`, `stringify`, `createServer`, `writeHead`, `end`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-jobs-events/subjects.md

@@ -0,0 +1,36 @@
+# `verae-jobs-events/subjects`
+
+**Package:** `verae-jobs-events`  
+**Source:** `packages/verae-jobs-events/src/subjects.js`  
+**Lines:** 5
+
+## What this module is
+
+Implementation module in `verae-jobs-events`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`SUBJECTS`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+_No top-level functions extracted._
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+_No local call identifiers extracted._
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-nats-accounts/policy.md

@@ -0,0 +1,43 @@
+# `verae-nats-accounts/policy`
+
+**Package:** `verae-nats-accounts`  
+**Source:** `packages/verae-nats-accounts/src/policy.js`  
+**Lines:** 15
+
+## What this module is
+
+Implementation module in `verae-nats-accounts`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`loadPolicy`, `leafAllowed`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `loadPolicy` | `(none)` | — | `unknown` | see Call graph |
+| `leafAllowed` | `subject` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:fs`
+- `node:path`
+- `node:url`
+
+## Call graph (identifiers invoked)
+
+`join`, `dirname`, `fileURLToPath`, `loadPolicy`, `parse`, `readFileSync`, `leafAllowed`, `some`, `endsWith`, `startsWith`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-zapier-simulator/server.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-zapier-simulator`  
 **Source:** `packages/verae-zapier-simulator/src/server.js`  
-**Lines:** 87
+**Lines:** 88
 
 ## What this module is
 

docs/modules/zappier-account-balance/books.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier-account-balance`  
 **Source:** `packages/zappier-account-balance/src/books.js`  
-**Lines:** 100
+**Lines:** 120
 
 ## What this module is
 
@@ -36,6 +36,8 @@ Implementation module in `zappier-account-balance`. The tables below are extract
 | `recordUsage` | `entry` |
 | `recordPayment` | `entry` |
 | `statement` | `customerId` |
+| `dump` | `(none)` |
+| `load` | `raw` |
 
 ## What it imports / requires
 
@@ -43,7 +45,7 @@ _No imports detected._
 
 ## Call graph (identifiers invoked)
 
-`constructor`, `remember`, `prepaidCents`, `adjust`, `trunc`, `now`, `toString`, `random`, `slice`, `toISOString`, `unshift`, `recordUsage`, `recordPayment`, `statement`, `filter`, `match`, `handle`, `endsWith`
+`constructor`, `remember`, `prepaidCents`, `adjust`, `trunc`, `now`, `toString`, `random`, `slice`, `toISOString`, `unshift`, `recordUsage`, `recordPayment`, `statement`, `filter`, `match`, `dump`, `load`, `isArray`, `handle`, `endsWith`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier-account-balance/persist.md

@@ -0,0 +1,50 @@
+# `zappier-account-balance/persist`
+
+**Package:** `zappier-account-balance`  
+**Source:** `packages/zappier-account-balance/src/persist.js`  
+**Lines:** 29
+
+## What this module is
+
+Implementation module in `zappier-account-balance`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`booksPath`, `loadInto`, `saveFrom`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `booksPath` | `(none)` | — | `unknown` | see Call graph |
+| `loadInto` | `books` | — | `unknown` | see Call graph |
+| `saveFrom` | `books` | — | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `return` | `process.env.BOOKS_PATH ||
+    path.join(process.env.FLEET_STATE_DIR || process.cwd(` |
+
+## What it imports / requires
+
+- `node:fs`
+- `node:path`
+
+## Call graph (identifiers invoked)
+
+`booksPath`, `join`, `cwd`, `loadInto`, `existsSync`, `load`, `parse`, `readFileSync`, `saveFrom`, `mkdirSync`, `dirname`, `writeFileSync`, `stringify`, `dump`, `renameSync`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/zappier-account-balance/server.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier-account-balance`  
 **Source:** `packages/zappier-account-balance/src/server.js`  
-**Lines:** 93
+**Lines:** 101
 
 ## What this module is
 
@@ -20,6 +20,7 @@ _None extracted._
 
 | Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
 |------|------------|---------------------|---------|-----------------------------|
+| `apply` | `subject, payload` | — | `unknown` | see Call graph |
 | `startNats` | `(none)` | — | `unknown` | see Call graph |
 | `readBody` | `req` | — | `unknown` | see Call graph |
 | `reply` | `sub, fn` | — | `unknown` | see Call graph |
@@ -29,6 +30,7 @@ _None extracted._
 
 | Name | Parameters |
 |------|------------|
+| `saveFrom` | `books` |
 | `reply` | `nc.subscribe(SUBJECTS.STATEMENT_GET, { queue: SUBJECTS.QUEUE }` |
 | `reply` | `nc.subscribe(SUBJECTS.BALANCE_GET, { queue: SUBJECTS.QUEUE }` |
 | `reply` | `nc.subscribe(SUBJECTS.BALANCE_ADJUST, { queue: SUBJECTS.QUEUE }` |
@@ -38,10 +40,11 @@ _None extracted._
 - `node:http`
 - `./books.js`
 - `./subjects.js`
+- `./persist.js`
 
 ## Call graph (identifiers invoked)
 
-`startNats`, `import`, `connect`, `split`, `async`, `parse`, `decode`, `fn`, `respond`, `encode`, `stringify`, `reply`, `subscribe`, `handle`, `write`, `readBody`, `on`, `push`, `resolve`, `concat`, `toString`, `createServer`, `writeHead`, `end`, `json`, `match`, `statement`, `adjust`, `listen`
+`loadInto`, `apply`, `handle`, `saveFrom`, `startNats`, `import`, `connect`, `split`, `async`, `parse`, `decode`, `fn`, `respond`, `encode`, `stringify`, `reply`, `subscribe`, `write`, `readBody`, `on`, `push`, `resolve`, `concat`, `toString`, `createServer`, `writeHead`, `end`, `json`, `match`, `statement`, `listen`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier-identity/ids.md

@@ -0,0 +1,41 @@
+# `zappier-identity/ids`
+
+**Package:** `zappier-identity`  
+**Source:** `packages/zappier-identity/src/ids.js`  
+**Lines:** 16
+
+## What this module is
+
+Implementation module in `zappier-identity`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`stableVeraeUserId`, `bindEmail`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `stableVeraeUserId` | `username` | — | `unknown` | see Call graph |
+| `bindEmail` | `email` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:crypto`
+
+## Call graph (identifiers invoked)
+
+`stableVeraeUserId`, `trim`, `toLowerCase`, `createHash`, `update`, `digest`, `slice`, `bindEmail`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/zappier-identity/server.md

@@ -0,0 +1,53 @@
+# `zappier-identity/server`
+
+**Package:** `zappier-identity`  
+**Source:** `packages/zappier-identity/src/server.js`  
+**Lines:** 90
+
+## What this module is
+
+Implementation module in `zappier-identity`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `handleBind` | `p` | — | `unknown` | see Call graph |
+| `handleLookup` | `p` | — | `unknown` | see Call graph |
+| `startNats` | `(none)` | — | `unknown` | see Call graph |
+| `readBody` | `req` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `put` | `db, { customerId, ...bound }` |
+
+## What it imports / requires
+
+- `node:http`
+- `./ids.js`
+- `./store.js`
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`load`, `handleBind`, `bindEmail`, `put`, `handleLookup`, `startNats`, `import`, `connect`, `split`, `async`, `subscribe`, `parse`, `decode`, `respond`, `encode`, `stringify`, `readBody`, `on`, `push`, `resolve`, `concat`, `toString`, `createServer`, `writeHead`, `end`, `json`, `match`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/zappier-identity/store.md

@@ -0,0 +1,50 @@
+# `zappier-identity/store`
+
+**Package:** `zappier-identity`  
+**Source:** `packages/zappier-identity/src/store.js`  
+**Lines:** 31
+
+## What this module is
+
+Implementation module in `zappier-identity`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`load`, `save`, `put`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `load` | `(none)` | — | `unknown` | see Call graph |
+| `save` | `db` | — | `unknown` | see Call graph |
+| `put` | `db, { customerId, veraeUserId, veraeUsername }` | — | `unknown` | see Call graph |
+| `file` | `(none)` | — | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `save` | `db` |
+
+## What it imports / requires
+
+- `node:fs`
+- `node:path`
+
+## Call graph (identifiers invoked)
+
+`join`, `cwd`, `load`, `file`, `existsSync`, `parse`, `readFileSync`, `save`, `mkdirSync`, `dirname`, `writeFileSync`, `stringify`, `put`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/zappier-identity/subjects.md

@@ -0,0 +1,36 @@
+# `zappier-identity/subjects`
+
+**Package:** `zappier-identity`  
+**Source:** `packages/zappier-identity/src/subjects.js`  
+**Lines:** 6
+
+## What this module is
+
+Implementation module in `zappier-identity`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`SUBJECTS`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+_No top-level functions extracted._
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+_No local call identifiers extracted._
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/zappier/admin.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/admin.ts`  
-**Lines:** 593
+**Lines:** 597
 
 ## What this module is
 
@@ -63,10 +63,11 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 - `./accounting-export`
 - `./statement`
 - `./billing-nats`
+- `./ledger`
 
 ## Call graph (identifiers invoked)
 
-`tokens`, `adminLoginRouter`, `post`, `status`, `json`, `findByUsername`, `verifyPassword`, `randomBytes`, `toString`, `set`, `now`, `adminAuth`, `header`, `next`, `startsWith`, `slice`, `has`, `isValidRule`, `every`, `isValidTier`, `periodWindow`, `split`, `map`, `parseDate`, `trim`, `isNaN`, `getTime`, `escapeHtml`, `replace`, `toFixed`, `renderInvoiceHtml`, `dollars`, `join`, `toISOString`, `toUpperCase`, `adminRouter`, `get`, `getRateCard`, `getTiers`, `put`, `upsertEndpoint`, `delete`, `deleteEndpoint`, `upsertTier`, `deleteTier`, `list`, `randomUUID`, `save`, `find`, `isFinite`, `trunc`, `add`, `natsPublish`, `natsAdjust`, `async`, `natsStatement`, `composeStatement`, `listFor`, `type`, `send`
+`tokens`, `adminLoginRouter`, `post`, `status`, `json`, `findByUsername`, `verifyPassword`, `randomBytes`, `toString`, `set`, `now`, `adminAuth`, `header`, `next`, `startsWith`, `slice`, `has`, `isValidRule`, `every`, `isValidTier`, `periodWindow`, `split`, `map`, `parseDate`, `trim`, `isNaN`, `getTime`, `escapeHtml`, `replace`, `toFixed`, `renderInvoiceHtml`, `dollars`, `join`, `toISOString`, `toUpperCase`, `adminRouter`, `get`, `getRateCard`, `getTiers`, `put`, `upsertEndpoint`, `delete`, `deleteEndpoint`, `upsertTier`, `deleteTier`, `list`, `randomUUID`, `save`, `find`, `async`, `isFinite`, `trunc`, `add`, `ledgerAdjust`, `booksConfigured`, `natsPublish`, `ledgerStatement`, `composeStatement`, `listFor`, `type`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier/index.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/index.ts`  
-**Lines:** 42
+**Lines:** 43
 
 ## What this module is
 

docs/modules/zappier/ledger.md

@@ -0,0 +1,52 @@
+# `zappier/ledger`
+
+**Package:** `zappier`  
+**Source:** `packages/zappier/src/ledger.ts`  
+**Lines:** 51
+
+## What this module is
+
+Implementation module in `zappier`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`PrepaidRow`, `booksConfigured`, `ledgerAdjust`, `ledgerStatement`
+
+## Types / interfaces / classes
+
+| Kind | Name |
+|------|------|
+| type | `PrepaidRow` |
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `booksUrl` | `(none)` | — | `unknown` | see Call graph |
+| `booksConfigured` | `(none)` | — | `unknown` | see Call graph |
+| `ledgerAdjust` | `row: PrepaidRow, plane: AccessPlane` | — | `unknown` | see Call graph |
+| `ledgerStatement` | `customerId: string, plane: AccessPlane, veraeUserId?: string` | — | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `return` | `process.env.ACCOUNT_BALANCE_URL || ''` |
+| `return` | `await r.json(` |
+
+## What it imports / requires
+
+- `./billing-nats`
+
+## Call graph (identifiers invoked)
+
+`booksUrl`, `replace`, `booksConfigured`, `ledgerAdjust`, `natsAdjust`, `fetch`, `stringify`, `json`, `ledgerStatement`, `natsStatement`, `encodeURIComponent`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/zappier/portal.md

@@ -52,10 +52,11 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 - `./statement`
 - `./billing-nats`
 - `./verae-bind`
+- `./ledger`
 
 ## Call graph (identifiers invoked)
 
-`now`, `reload`, `customer`, `publicProfile`, `sessionAuth`, `header`, `startsWith`, `slice`, `get`, `list`, `find`, `status`, `json`, `next`, `save`, `portalRouter`, `post`, `async`, `trim`, `test`, `hashPassword`, `findByEmail`, `randomBytes`, `toString`, `bindVeraeUser`, `create`, `verifyPassword`, `verifyTotp`, `use`, `delete`, `setUTCDate`, `setUTCHours`, `summaryFor`, `tiers`, `applyMonthlyCredit`, `rateCard`, `natsStatement`, `composeStatement`, `listFor`, `type`, `send`, `renderInvoiceHtml`, `generateTotpSecret`, `totpUri`, `qr`, `isInteger`, `natsPublish`, `natsAdjust`, `put`
+`now`, `reload`, `customer`, `publicProfile`, `sessionAuth`, `header`, `startsWith`, `slice`, `get`, `list`, `find`, `status`, `json`, `next`, `save`, `portalRouter`, `post`, `async`, `trim`, `test`, `hashPassword`, `findByEmail`, `randomBytes`, `toString`, `bindVeraeUser`, `create`, `verifyPassword`, `verifyTotp`, `use`, `delete`, `setUTCDate`, `setUTCHours`, `summaryFor`, `tiers`, `applyMonthlyCredit`, `rateCard`, `ledgerStatement`, `composeStatement`, `listFor`, `type`, `send`, `renderInvoiceHtml`, `generateTotpSecret`, `totpUri`, `qr`, `isInteger`, `ledgerAdjust`, `booksConfigured`, `natsPublish`, `put`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier/verae-bind.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/verae-bind.ts`  
-**Lines:** 77
+**Lines:** 90
 
 ## What this module is
 
@@ -25,7 +25,7 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 | `normalizeVeraeUsername` | `username: string` | — | `unknown` | see Call graph |
 | `stableVeraeUserId` | `username: string` | — | `unknown` | see Call graph |
 | `mockBind` | `email: string` | — | `unknown` | see Call graph |
-| `bindVeraeUser` | `email: string` | — | `unknown` | see Call graph |
+| `bindVeraeUser` | `email: string, customerId?: string` | — | `unknown` | see Call graph |
 | `login` | `username: string, pass: string` | — | `unknown` | see Call graph |
 
 ## What it imports / requires
@@ -34,7 +34,7 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 
 ## Call graph (identifiers invoked)
 
-`normalizeVeraeUsername`, `trim`, `toLowerCase`, `stableVeraeUserId`, `createHash`, `update`, `digest`, `slice`, `mockBind`, `bindVeraeUser`, `replace`, `randomBytes`, `toString`, `async`, `fetch`, `stringify`, `json`, `login`
+`normalizeVeraeUsername`, `trim`, `toLowerCase`, `stableVeraeUserId`, `createHash`, `update`, `digest`, `slice`, `mockBind`, `bindVeraeUser`, `replace`, `fetch`, `stringify`, `json`, `randomBytes`, `toString`, `async`, `login`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/sphinx/index.rst

@@ -33,6 +33,11 @@ Markdown indexes: https://zapier.georgelambert.org/index-md.html
    repos/verae-access-api
    repos/verae-access-leaf
    repos/verae-access-zapier
+   repos/verae-access-staff
+   repos/zappier-identity
+   repos/verae-jobs-events
+   repos/verae-nats-accounts
+   repos/zapier-decisions
 
 .. toctree::
    :maxdepth: 2
@@ -59,6 +64,7 @@ Markdown indexes: https://zapier.georgelambert.org/index-md.html
    modules/zappier/index
    modules/zappier/invoicing
    modules/zappier/jobs/report-usage
+   modules/zappier/ledger
    modules/zappier/meter
    modules/zappier/nats-shim.d
    modules/zappier/paths
@@ -157,6 +163,7 @@ Markdown indexes: https://zapier.georgelambert.org/index-md.html
    modules/verae-zapier-simulator/server
    modules/verae-zapier-simulator/trace
    modules/zappier-account-balance/books
+   modules/zappier-account-balance/persist
    modules/zappier-account-balance/server
    modules/zappier-account-balance/subjects
    modules/zappier-customer-service/nats-billing
@@ -172,5 +179,14 @@ Markdown indexes: https://zapier.georgelambert.org/index-md.html
    modules/verae-access-web/gate
    modules/verae-access-web/server
    modules/verae-access-api/server
+   modules/verae-access-leaf/allow
    modules/verae-access-leaf/server
    modules/verae-access-zapier/server
+   modules/verae-access-staff/server
+   modules/zappier-identity/ids
+   modules/zappier-identity/server
+   modules/zappier-identity/store
+   modules/zappier-identity/subjects
+   modules/verae-jobs-events/server
+   modules/verae-jobs-events/subjects
+   modules/verae-nats-accounts/policy

docs/sphinx/modules/verae-access-leaf/allow.md

@@ -0,0 +1,41 @@
+# `verae-access-leaf/allow`
+
+**Package:** `verae-access-leaf`  
+**Source:** `packages/verae-access-leaf/src/allow.js`  
+**Lines:** 29
+
+## What this module is
+
+Implementation module in `verae-access-leaf`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`leafAllowList`, `leafAllowed`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `leafAllowList` | `(none)` | — | `unknown` | see Call graph |
+| `leafAllowed` | `subject` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:fs`
+
+## Call graph (identifiers invoked)
+
+`leafAllowList`, `existsSync`, `parse`, `readFileSync`, `leafAllowed`, `some`, `endsWith`, `startsWith`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-access-leaf/allow.rst

@@ -0,0 +1,7 @@
+verae-access-leaf.allow
+=======================
+
+Generated API sheet for ``verae-access-leaf/allow``.
+
+.. include:: allow.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-access-leaf/server.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-access-leaf`  
 **Source:** `packages/verae-access-leaf/src/server.js`  
-**Lines:** 95
+**Lines:** 99
 
 ## What this module is
 
@@ -29,10 +29,11 @@ _None extracted._
 ## What it imports / requires
 
 - `node:http`
+- `./allow.js`
 
 ## Call graph (identifiers invoked)
 
-`subjects`, `replace`, `check`, `fetch`, `stringify`, `json`, `authorizedToken`, `forward`, `import`, `connect`, `split`, `publish`, `encode`, `flush`, `close`, `startNats`, `async`, `subscribe`, `parse`, `decode`, `respond`, `write`, `createServer`, `writeHead`, `end`, `push`, `concat`, `toString`, `listen`
+`subjects`, `replace`, `check`, `fetch`, `stringify`, `json`, `authorizedToken`, `forward`, `leafAllowed`, `import`, `connect`, `split`, `publish`, `encode`, `flush`, `close`, `startNats`, `async`, `subscribe`, `parse`, `decode`, `respond`, `write`, `createServer`, `writeHead`, `end`, `push`, `concat`, `toString`, `listen`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/sphinx/modules/verae-access-staff/server.md

@@ -0,0 +1,41 @@
+# `verae-access-staff/server`
+
+**Package:** `verae-access-staff`  
+**Source:** `packages/verae-access-staff/src/server.js`  
+**Lines:** 58
+
+## What this module is
+
+Implementation module in `verae-access-staff`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `check` | `subject, extra = {}` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+
+## Call graph (identifiers invoked)
+
+`plane`, `replace`, `check`, `fetch`, `stringify`, `json`, `createServer`, `async`, `writeHead`, `end`, `match`, `push`, `parse`, `concat`, `toString`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-access-staff/server.rst

@@ -0,0 +1,7 @@
+verae-access-staff.server
+=========================
+
+Generated API sheet for ``verae-access-staff/server``.
+
+.. include:: server.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-fleet/cli.md

@@ -50,7 +50,7 @@ _None extracted._
 
 ## Call graph (identifiers invoked)
 
-`loadFleet`, `slice`, `print`, `write`, `stringify`, `help`, `off`, `pause`, `json`, `identityFile`, `login`, `api`, `request`, `on`, `push`, `concat`, `toString`, `resolve`, `parse`, `end`, `main`, `listServices`, `padEnd`, `padStart`, `import`, `find`, `sshCheck`, `keys`, `startService`, `tick`, `start`, `startControlServer`, `async`, `stop`, `stopAll`, `exit`, `test`
+`loadFleet`, `slice`, `print`, `write`, `stringify`, `help`, `off`, `pause`, `json`, `identityFile`, `login`, `api`, `request`, `on`, `push`, `concat`, `toString`, `resolve`, `parse`, `end`, `main`, `listServices`, `padEnd`, `padStart`, `import`, `find`, `sshCheck`, `startControlServer`, `keys`, `startService`, `tick`, `start`, `async`, `stop`, `stopAll`, `exit`, `test`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/sphinx/modules/verae-fleet/machines.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-fleet`  
 **Source:** `packages/verae-fleet/src/machines.js`  
-**Lines:** 108
+**Lines:** 116
 
 ## What this module is
 
@@ -25,7 +25,7 @@ _None extracted._
 | `normalizeMachine` | `m` | — | `unknown` | see Call graph |
 | `upsertMachine` | `list, spec` | — | `unknown` | see Call graph |
 | `canHost` | `machine, serviceId, role` | — | `unknown` | see Call graph |
-| `pickMachine` | `machines, instances, serviceId, role, exclude = []` | machines: `object[]`, serviceId: `string`, role: `string` | `unknown` | see Call graph |
+| `pickMachine` | `machines, instances, serviceId, role, exclude = [], opts = {}` | machines: `object[]`, serviceId: `string`, role: `string` | `unknown` | see Call graph |
 | `saveOverlay` | `overlayPath, machines` | — | `unknown` | see Call graph |
 
 ## What it imports / requires

docs/sphinx/modules/verae-fleet/server.md

@@ -34,7 +34,7 @@ _None extracted._
 
 ## Call graph (identifiers invoked)
 
-`join`, `dirname`, `fileURLToPath`, `json`, `writeHead`, `end`, `stringify`, `import`, `startControlServer`, `createServer`, `async`, `snapshot`, `reset`, `push`, `parse`, `concat`, `toString`, `run`, `listServices`, `status`, `addMachine`, `match`, `checkMachine`, `setMachineEnabled`, `reconcile`, `startService`, `stopService`, `pauseService`, `resumeService`, `fn`, `pauseInstance`, `resumeInstance`, `restartInstance`, `stopInstance`, `markUnhealthy`, `createReadStream`, `pipe`, `startsWith`, `normalize`, `existsSync`, `statSync`, `isFile`, `extname`, `toLowerCase`, `listen`, `write`
+`bind`, `join`, `dirname`, `fileURLToPath`, `json`, `writeHead`, `end`, `stringify`, `import`, `startControlServer`, `createServer`, `async`, `snapshot`, `reset`, `push`, `parse`, `concat`, `toString`, `run`, `listServices`, `status`, `addMachine`, `match`, `checkMachine`, `setMachineEnabled`, `reconcile`, `startService`, `stopService`, `pauseService`, `resumeService`, `fn`, `pauseInstance`, `resumeInstance`, `restartInstance`, `stopInstance`, `markUnhealthy`, `createReadStream`, `pipe`, `startsWith`, `normalize`, `existsSync`, `statSync`, `isFile`, `extname`, `toLowerCase`, `listen`, `write`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/sphinx/modules/verae-fleet/ssh.md

@@ -25,7 +25,7 @@ _None extracted._
 | `sshTarget` | `machine` | — | `unknown` | see Call graph |
 | `sshBaseArgs` | `machine` | — | `unknown` | see Call graph |
 | `scpBaseArgs` | `machine` | — | `unknown` | see Call graph |
-| `sshExec` | `machine, remoteCommand, { timeoutMs = 20000 } = {}` | — | `unknown` | see Call graph |
+| `sshExec` | `machine, remoteCommand, { timeoutMs = 8000 } = {}` | — | `unknown` | see Call graph |
 | `scpTo` | `machine, localFiles, remoteDir` | — | `unknown` | see Call graph |
 | `ensureRemoteRuntime` | `machine` | — | `unknown` | see Call graph |
 | `sshSpawnWorker` | `machine, { instance, env }` | — | `unknown` | see Call graph |

docs/sphinx/modules/verae-fleet/supervisor.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-fleet`  
 **Source:** `packages/verae-fleet/src/supervisor.js`  
-**Lines:** 528
+**Lines:** 529
 
 ## What this module is
 

docs/sphinx/modules/verae-jobs-events/server.md

@@ -0,0 +1,41 @@
+# `verae-jobs-events/server`
+
+**Package:** `verae-jobs-events`  
+**Source:** `packages/verae-jobs-events/src/server.js`  
+**Lines:** 43
+
+## What this module is
+
+Implementation module in `verae-jobs-events`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `startNats` | `(none)` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:http`
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`startNats`, `import`, `connect`, `split`, `subscribe`, `parse`, `decode`, `respond`, `encode`, `stringify`, `createServer`, `writeHead`, `end`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-jobs-events/server.rst

@@ -0,0 +1,7 @@
+verae-jobs-events.server
+========================
+
+Generated API sheet for ``verae-jobs-events/server``.
+
+.. include:: server.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-jobs-events/subjects.md

@@ -0,0 +1,36 @@
+# `verae-jobs-events/subjects`
+
+**Package:** `verae-jobs-events`  
+**Source:** `packages/verae-jobs-events/src/subjects.js`  
+**Lines:** 5
+
+## What this module is
+
+Implementation module in `verae-jobs-events`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`SUBJECTS`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+_No top-level functions extracted._
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+_No local call identifiers extracted._
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-jobs-events/subjects.rst

@@ -0,0 +1,7 @@
+verae-jobs-events.subjects
+==========================
+
+Generated API sheet for ``verae-jobs-events/subjects``.
+
+.. include:: subjects.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-nats-accounts/policy.md

@@ -0,0 +1,43 @@
+# `verae-nats-accounts/policy`
+
+**Package:** `verae-nats-accounts`  
+**Source:** `packages/verae-nats-accounts/src/policy.js`  
+**Lines:** 15
+
+## What this module is
+
+Implementation module in `verae-nats-accounts`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`loadPolicy`, `leafAllowed`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `loadPolicy` | `(none)` | — | `unknown` | see Call graph |
+| `leafAllowed` | `subject` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:fs`
+- `node:path`
+- `node:url`
+
+## Call graph (identifiers invoked)
+
+`join`, `dirname`, `fileURLToPath`, `loadPolicy`, `parse`, `readFileSync`, `leafAllowed`, `some`, `endsWith`, `startsWith`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/verae-nats-accounts/policy.rst

@@ -0,0 +1,7 @@
+verae-nats-accounts.policy
+==========================
+
+Generated API sheet for ``verae-nats-accounts/policy``.
+
+.. include:: policy.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/verae-zapier-simulator/server.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-zapier-simulator`  
 **Source:** `packages/verae-zapier-simulator/src/server.js`  
-**Lines:** 87
+**Lines:** 88
 
 ## What this module is
 

docs/sphinx/modules/zappier-account-balance/books.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier-account-balance`  
 **Source:** `packages/zappier-account-balance/src/books.js`  
-**Lines:** 100
+**Lines:** 120
 
 ## What this module is
 
@@ -36,6 +36,8 @@ Implementation module in `zappier-account-balance`. The tables below are extract
 | `recordUsage` | `entry` |
 | `recordPayment` | `entry` |
 | `statement` | `customerId` |
+| `dump` | `(none)` |
+| `load` | `raw` |
 
 ## What it imports / requires
 
@@ -43,7 +45,7 @@ _No imports detected._
 
 ## Call graph (identifiers invoked)
 
-`constructor`, `remember`, `prepaidCents`, `adjust`, `trunc`, `now`, `toString`, `random`, `slice`, `toISOString`, `unshift`, `recordUsage`, `recordPayment`, `statement`, `filter`, `match`, `handle`, `endsWith`
+`constructor`, `remember`, `prepaidCents`, `adjust`, `trunc`, `now`, `toString`, `random`, `slice`, `toISOString`, `unshift`, `recordUsage`, `recordPayment`, `statement`, `filter`, `match`, `dump`, `load`, `isArray`, `handle`, `endsWith`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/sphinx/modules/zappier-account-balance/persist.md

@@ -0,0 +1,50 @@
+# `zappier-account-balance/persist`
+
+**Package:** `zappier-account-balance`  
+**Source:** `packages/zappier-account-balance/src/persist.js`  
+**Lines:** 29
+
+## What this module is
+
+Implementation module in `zappier-account-balance`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`booksPath`, `loadInto`, `saveFrom`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `booksPath` | `(none)` | — | `unknown` | see Call graph |
+| `loadInto` | `books` | — | `unknown` | see Call graph |
+| `saveFrom` | `books` | — | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `return` | `process.env.BOOKS_PATH ||
+    path.join(process.env.FLEET_STATE_DIR || process.cwd(` |
+
+## What it imports / requires
+
+- `node:fs`
+- `node:path`
+
+## Call graph (identifiers invoked)
+
+`booksPath`, `join`, `cwd`, `loadInto`, `existsSync`, `load`, `parse`, `readFileSync`, `saveFrom`, `mkdirSync`, `dirname`, `writeFileSync`, `stringify`, `dump`, `renameSync`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/zappier-account-balance/persist.rst

@@ -0,0 +1,7 @@
+zappier-account-balance.persist
+===============================
+
+Generated API sheet for ``zappier-account-balance/persist``.
+
+.. include:: persist.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/zappier-account-balance/server.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier-account-balance`  
 **Source:** `packages/zappier-account-balance/src/server.js`  
-**Lines:** 93
+**Lines:** 101
 
 ## What this module is
 
@@ -20,6 +20,7 @@ _None extracted._
 
 | Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
 |------|------------|---------------------|---------|-----------------------------|
+| `apply` | `subject, payload` | — | `unknown` | see Call graph |
 | `startNats` | `(none)` | — | `unknown` | see Call graph |
 | `readBody` | `req` | — | `unknown` | see Call graph |
 | `reply` | `sub, fn` | — | `unknown` | see Call graph |
@@ -29,6 +30,7 @@ _None extracted._
 
 | Name | Parameters |
 |------|------------|
+| `saveFrom` | `books` |
 | `reply` | `nc.subscribe(SUBJECTS.STATEMENT_GET, { queue: SUBJECTS.QUEUE }` |
 | `reply` | `nc.subscribe(SUBJECTS.BALANCE_GET, { queue: SUBJECTS.QUEUE }` |
 | `reply` | `nc.subscribe(SUBJECTS.BALANCE_ADJUST, { queue: SUBJECTS.QUEUE }` |
@@ -38,10 +40,11 @@ _None extracted._
 - `node:http`
 - `./books.js`
 - `./subjects.js`
+- `./persist.js`
 
 ## Call graph (identifiers invoked)
 
-`startNats`, `import`, `connect`, `split`, `async`, `parse`, `decode`, `fn`, `respond`, `encode`, `stringify`, `reply`, `subscribe`, `handle`, `write`, `readBody`, `on`, `push`, `resolve`, `concat`, `toString`, `createServer`, `writeHead`, `end`, `json`, `match`, `statement`, `adjust`, `listen`
+`loadInto`, `apply`, `handle`, `saveFrom`, `startNats`, `import`, `connect`, `split`, `async`, `parse`, `decode`, `fn`, `respond`, `encode`, `stringify`, `reply`, `subscribe`, `write`, `readBody`, `on`, `push`, `resolve`, `concat`, `toString`, `createServer`, `writeHead`, `end`, `json`, `match`, `statement`, `listen`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/sphinx/modules/zappier-identity/ids.md

@@ -0,0 +1,41 @@
+# `zappier-identity/ids`
+
+**Package:** `zappier-identity`  
+**Source:** `packages/zappier-identity/src/ids.js`  
+**Lines:** 16
+
+## What this module is
+
+Implementation module in `zappier-identity`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`stableVeraeUserId`, `bindEmail`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `stableVeraeUserId` | `username` | — | `unknown` | see Call graph |
+| `bindEmail` | `email` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:crypto`
+
+## Call graph (identifiers invoked)
+
+`stableVeraeUserId`, `trim`, `toLowerCase`, `createHash`, `update`, `digest`, `slice`, `bindEmail`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/zappier-identity/ids.rst

@@ -0,0 +1,7 @@
+zappier-identity.ids
+====================
+
+Generated API sheet for ``zappier-identity/ids``.
+
+.. include:: ids.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/zappier-identity/server.md

@@ -0,0 +1,53 @@
+# `zappier-identity/server`
+
+**Package:** `zappier-identity`  
+**Source:** `packages/zappier-identity/src/server.js`  
+**Lines:** 90
+
+## What this module is
+
+Implementation module in `zappier-identity`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+_No named `export` / `module.exports` keys detected._
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `handleBind` | `p` | — | `unknown` | see Call graph |
+| `handleLookup` | `p` | — | `unknown` | see Call graph |
+| `startNats` | `(none)` | — | `unknown` | see Call graph |
+| `readBody` | `req` | — | `unknown` | see Call graph |
+| `json` | `code, obj` | — | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `put` | `db, { customerId, ...bound }` |
+
+## What it imports / requires
+
+- `node:http`
+- `./ids.js`
+- `./store.js`
+- `./subjects.js`
+
+## Call graph (identifiers invoked)
+
+`load`, `handleBind`, `bindEmail`, `put`, `handleLookup`, `startNats`, `import`, `connect`, `split`, `async`, `subscribe`, `parse`, `decode`, `respond`, `encode`, `stringify`, `readBody`, `on`, `push`, `resolve`, `concat`, `toString`, `createServer`, `writeHead`, `end`, `json`, `match`, `listen`, `write`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/zappier-identity/server.rst

@@ -0,0 +1,7 @@
+zappier-identity.server
+=======================
+
+Generated API sheet for ``zappier-identity/server``.
+
+.. include:: server.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/zappier-identity/store.md

@@ -0,0 +1,50 @@
+# `zappier-identity/store`
+
+**Package:** `zappier-identity`  
+**Source:** `packages/zappier-identity/src/store.js`  
+**Lines:** 31
+
+## What this module is
+
+Implementation module in `zappier-identity`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`load`, `save`, `put`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `load` | `(none)` | — | `unknown` | see Call graph |
+| `save` | `db` | — | `unknown` | see Call graph |
+| `put` | `db, { customerId, veraeUserId, veraeUsername }` | — | `unknown` | see Call graph |
+| `file` | `(none)` | — | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `save` | `db` |
+
+## What it imports / requires
+
+- `node:fs`
+- `node:path`
+
+## Call graph (identifiers invoked)
+
+`join`, `cwd`, `load`, `file`, `existsSync`, `parse`, `readFileSync`, `save`, `mkdirSync`, `dirname`, `writeFileSync`, `stringify`, `put`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/zappier-identity/store.rst

@@ -0,0 +1,7 @@
+zappier-identity.store
+======================
+
+Generated API sheet for ``zappier-identity/store``.
+
+.. include:: store.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/zappier-identity/subjects.md

@@ -0,0 +1,36 @@
+# `zappier-identity/subjects`
+
+**Package:** `zappier-identity`  
+**Source:** `packages/zappier-identity/src/subjects.js`  
+**Lines:** 6
+
+## What this module is
+
+Implementation module in `zappier-identity`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`SUBJECTS`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+_No top-level functions extracted._
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+_No local call identifiers extracted._
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/zappier-identity/subjects.rst

@@ -0,0 +1,7 @@
+zappier-identity.subjects
+=========================
+
+Generated API sheet for ``zappier-identity/subjects``.
+
+.. include:: subjects.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/zappier/admin.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/admin.ts`  
-**Lines:** 593
+**Lines:** 597
 
 ## What this module is
 
@@ -63,10 +63,11 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 - `./accounting-export`
 - `./statement`
 - `./billing-nats`
+- `./ledger`
 
 ## Call graph (identifiers invoked)
 
-`tokens`, `adminLoginRouter`, `post`, `status`, `json`, `findByUsername`, `verifyPassword`, `randomBytes`, `toString`, `set`, `now`, `adminAuth`, `header`, `next`, `startsWith`, `slice`, `has`, `isValidRule`, `every`, `isValidTier`, `periodWindow`, `split`, `map`, `parseDate`, `trim`, `isNaN`, `getTime`, `escapeHtml`, `replace`, `toFixed`, `renderInvoiceHtml`, `dollars`, `join`, `toISOString`, `toUpperCase`, `adminRouter`, `get`, `getRateCard`, `getTiers`, `put`, `upsertEndpoint`, `delete`, `deleteEndpoint`, `upsertTier`, `deleteTier`, `list`, `randomUUID`, `save`, `find`, `isFinite`, `trunc`, `add`, `natsPublish`, `natsAdjust`, `async`, `natsStatement`, `composeStatement`, `listFor`, `type`, `send`
+`tokens`, `adminLoginRouter`, `post`, `status`, `json`, `findByUsername`, `verifyPassword`, `randomBytes`, `toString`, `set`, `now`, `adminAuth`, `header`, `next`, `startsWith`, `slice`, `has`, `isValidRule`, `every`, `isValidTier`, `periodWindow`, `split`, `map`, `parseDate`, `trim`, `isNaN`, `getTime`, `escapeHtml`, `replace`, `toFixed`, `renderInvoiceHtml`, `dollars`, `join`, `toISOString`, `toUpperCase`, `adminRouter`, `get`, `getRateCard`, `getTiers`, `put`, `upsertEndpoint`, `delete`, `deleteEndpoint`, `upsertTier`, `deleteTier`, `list`, `randomUUID`, `save`, `find`, `async`, `isFinite`, `trunc`, `add`, `ledgerAdjust`, `booksConfigured`, `natsPublish`, `ledgerStatement`, `composeStatement`, `listFor`, `type`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/sphinx/modules/zappier/index.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/index.ts`  
-**Lines:** 42
+**Lines:** 43
 
 ## What this module is
 

docs/sphinx/modules/zappier/ledger.md

@@ -0,0 +1,52 @@
+# `zappier/ledger`
+
+**Package:** `zappier`  
+**Source:** `packages/zappier/src/ledger.ts`  
+**Lines:** 51
+
+## What this module is
+
+Implementation module in `zappier`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`PrepaidRow`, `booksConfigured`, `ledgerAdjust`, `ledgerStatement`
+
+## Types / interfaces / classes
+
+| Kind | Name |
+|------|------|
+| type | `PrepaidRow` |
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `booksUrl` | `(none)` | — | `unknown` | see Call graph |
+| `booksConfigured` | `(none)` | — | `unknown` | see Call graph |
+| `ledgerAdjust` | `row: PrepaidRow, plane: AccessPlane` | — | `unknown` | see Call graph |
+| `ledgerStatement` | `customerId: string, plane: AccessPlane, veraeUserId?: string` | — | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `return` | `process.env.ACCOUNT_BALANCE_URL || ''` |
+| `return` | `await r.json(` |
+
+## What it imports / requires
+
+- `./billing-nats`
+
+## Call graph (identifiers invoked)
+
+`booksUrl`, `replace`, `booksConfigured`, `ledgerAdjust`, `natsAdjust`, `fetch`, `stringify`, `json`, `ledgerStatement`, `natsStatement`, `encodeURIComponent`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/sphinx/modules/zappier/ledger.rst

@@ -0,0 +1,7 @@
+zappier.ledger
+==============
+
+Generated API sheet for ``zappier/ledger``.
+
+.. include:: ledger.md
+   :parser: myst_parser.sphinx_

docs/sphinx/modules/zappier/portal.md

@@ -52,10 +52,11 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 - `./statement`
 - `./billing-nats`
 - `./verae-bind`
+- `./ledger`
 
 ## Call graph (identifiers invoked)
 
-`now`, `reload`, `customer`, `publicProfile`, `sessionAuth`, `header`, `startsWith`, `slice`, `get`, `list`, `find`, `status`, `json`, `next`, `save`, `portalRouter`, `post`, `async`, `trim`, `test`, `hashPassword`, `findByEmail`, `randomBytes`, `toString`, `bindVeraeUser`, `create`, `verifyPassword`, `verifyTotp`, `use`, `delete`, `setUTCDate`, `setUTCHours`, `summaryFor`, `tiers`, `applyMonthlyCredit`, `rateCard`, `natsStatement`, `composeStatement`, `listFor`, `type`, `send`, `renderInvoiceHtml`, `generateTotpSecret`, `totpUri`, `qr`, `isInteger`, `natsPublish`, `natsAdjust`, `put`
+`now`, `reload`, `customer`, `publicProfile`, `sessionAuth`, `header`, `startsWith`, `slice`, `get`, `list`, `find`, `status`, `json`, `next`, `save`, `portalRouter`, `post`, `async`, `trim`, `test`, `hashPassword`, `findByEmail`, `randomBytes`, `toString`, `bindVeraeUser`, `create`, `verifyPassword`, `verifyTotp`, `use`, `delete`, `setUTCDate`, `setUTCHours`, `summaryFor`, `tiers`, `applyMonthlyCredit`, `rateCard`, `ledgerStatement`, `composeStatement`, `listFor`, `type`, `send`, `renderInvoiceHtml`, `generateTotpSecret`, `totpUri`, `qr`, `isInteger`, `ledgerAdjust`, `booksConfigured`, `natsPublish`, `put`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/sphinx/modules/zappier/verae-bind.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/verae-bind.ts`  
-**Lines:** 77
+**Lines:** 90
 
 ## What this module is
 
@@ -25,7 +25,7 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 | `normalizeVeraeUsername` | `username: string` | — | `unknown` | see Call graph |
 | `stableVeraeUserId` | `username: string` | — | `unknown` | see Call graph |
 | `mockBind` | `email: string` | — | `unknown` | see Call graph |
-| `bindVeraeUser` | `email: string` | — | `unknown` | see Call graph |
+| `bindVeraeUser` | `email: string, customerId?: string` | — | `unknown` | see Call graph |
 | `login` | `username: string, pass: string` | — | `unknown` | see Call graph |
 
 ## What it imports / requires
@@ -34,7 +34,7 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 
 ## Call graph (identifiers invoked)
 
-`normalizeVeraeUsername`, `trim`, `toLowerCase`, `stableVeraeUserId`, `createHash`, `update`, `digest`, `slice`, `mockBind`, `bindVeraeUser`, `replace`, `randomBytes`, `toString`, `async`, `fetch`, `stringify`, `json`, `login`
+`normalizeVeraeUsername`, `trim`, `toLowerCase`, `stableVeraeUserId`, `createHash`, `update`, `digest`, `slice`, `mockBind`, `bindVeraeUser`, `replace`, `fetch`, `stringify`, `json`, `randomBytes`, `toString`, `async`, `login`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/sphinx/repos/verae-access-staff.md

@@ -0,0 +1,7 @@
+# verae-access-staff
+
+Staff access plane for CS / sales / accounting. Credits and statement review after `verae.access.authz.check` with plane `staff`.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-access-staff
+
+Port `:3025`.

docs/sphinx/repos/verae-fleet.md

@@ -13,7 +13,7 @@ Operator control plane for Verae Time × Zapier **runtime** services:
 cd packages/verae-fleet
 npm test
 node src/cli.js list
-node src/cli.js serve    # http://127.0.0.1:3850/
+node src/cli.js serve    # http://0.0.0.0:3850/
 ```
 
 Against a running daemon:

docs/sphinx/repos/verae-jobs-events.md

@@ -0,0 +1,7 @@
+# verae-jobs-events
+
+Mailbox process for `verae.zapier.jobs.events`. Today it counts events (passthrough). Webhook routing still lives in middleware until this process takes the exclusive consumer.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-jobs-events
+
+Port `:3030`.

docs/sphinx/repos/verae-nats-accounts.md

@@ -0,0 +1,8 @@
+# verae-nats-accounts
+
+NATS **account + leaf allow-list**. Leaf nodes cannot publish `verae.billing.*`.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-nats-accounts
+
+- `policy.json` — machine-readable allow/deny (used by access-leaf).
+- `nats.conf` — sketch for a future accounts-enabled nats-server (loopback).

docs/sphinx/repos/verae-zapier-simulator.md

@@ -7,7 +7,7 @@ Use it to validate messaging and to catch errors, delays, failures, and recoveri
 ```bash
 cd packages/verae-zapier-simulator
 npm test
-npm start   # http://127.0.0.1:3847/
+npm start   # http://0.0.0.0:3847/
 ```
 
 ## What it simulates

docs/sphinx/repos/zapier-decisions.md

@@ -0,0 +1,13 @@
+# zapier-decisions
+
+Lab log of architecture decisions, actions taken, and open todos while cleaning the Verae × Zapier stack.
+
+**Forgejo:** https://git.georgelambert.org/marchon/zapier-decisions
+
+| File | What |
+|------|------|
+| [LOG.md](LOG.md) | Chronological actions |
+| [TODO.md](TODO.md) | Open items |
+| [decisions/](decisions/) | One file per decision |
+
+No runtime. Not a NATS mailbox.

docs/sphinx/repos/zappier-account-balance.md

@@ -1,6 +1,6 @@
 # zappier-account-balance
 
-Source of truth for **customer prepaid balances**. Internal traffic is **NATS request-reply**; HTTP is health plus a fallback.
+Source of truth for **customer prepaid balances** (persisted `books.json`). Internal traffic is **NATS request-reply**; HTTP is health plus a fallback. zappier-edge `balanceCents` is a cache of this book.
 
 **Forgejo:** https://git.georgelambert.org/marchon/zappier-account-balance  
 **Catalog:** https://zapier.georgelambert.org/packages/zappier-account-balance/README.pdf

docs/sphinx/repos/zappier-identity.md

@@ -0,0 +1,12 @@
+# zappier-identity
+
+Mailbox for **Verae user id bind/lookup**. Public credentials stay zappier API keys. JWTs never live here.
+
+**Forgejo:** https://git.georgelambert.org/marchon/zappier-identity
+
+| Address | Kind |
+|---------|------|
+| `verae.identity.bind` | request-reply `{ email, customerId }` |
+| `verae.identity.lookup` | request-reply `{ customerId }` or `{ veraeUserId }` |
+
+HTTP `:3026` `POST /bind` `GET /lookup/:customerId`.

packages/docs-master/modules/verae-access-staff/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-access-staff
+
+Plane `staff`. Authz then billing statement/adjust.

packages/docs-master/modules/verae-access-staff/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-access-staff
+
+Staff plane for credits and statement review.

packages/docs-master/modules/verae-jobs-events/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-jobs-events
+
+IN `verae.zapier.jobs.events` queue `jobs-events`.

packages/docs-master/modules/verae-jobs-events/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-jobs-events
+
+Mailbox for `verae.zapier.jobs.events` (passthrough + count).

packages/docs-master/modules/verae-nats-accounts/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-nats-accounts
+
+Policy only. See `policy.json`.

packages/docs-master/modules/verae-nats-accounts/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-nats-accounts
+
+INTERNAL vs LEAF. Leaf deny `verae.billing.>`.

packages/docs-master/modules/zapier-decisions/NATS.md

@@ -0,0 +1,3 @@
+# NATS — zapier-decisions
+
+None.

packages/docs-master/modules/zapier-decisions/SUMMARY.md

@@ -0,0 +1,3 @@
+# zapier-decisions
+
+Architecture decisions and action log for the lab cleanup (prepaid SoT, identity, access planes, leaf policy, fleet).

packages/docs-master/modules/zappier-identity/NATS.md

@@ -0,0 +1,3 @@
+# NATS — zappier-identity
+
+`verae.identity.bind` / `verae.identity.lookup` queue `identity`.

packages/docs-master/modules/zappier-identity/SUMMARY.md

@@ -0,0 +1,3 @@
+# zappier-identity
+
+Bind and lookup `veraeUserId`. JWTs never stored.

packages/overview/01-system.md

@@ -15,15 +15,15 @@ Verae Time proves a SHA-256 existed at a given time. Zapier lets customers regis
 | Direct customer API | `verae-access-api` `x-api-key` | HTTPS `:3022` |
 | S2S leaf | `verae-access-leaf` | NATS `verae.access.leaf.in` / HTTPS `:3023` |
 | Authz | `verae-access-authz` | `verae.access.authz.check` before any internal subject |
-| Commercial edge | `zappier-edge` portal, admin, Stripe (legacy combined) | Public HTTPS; NATS billing after authz |
+| Commercial edge | `zappier-edge` portal, admin, Stripe | Loopback `:3000`; public doors are access-* |
 | Account balance | `zappier-account-balance` prepaid SoT | NATS `verae.billing.*` + HTTP `:3010` |
 | CS / sales / accounting | `zappier-customer-service`, `zappier-sales-pricing`, `zappier-accounting-export` | Private HTTP; NATS statement/adjust |
-| Middleware HTTP | `/zapier/v1/*` job id + wait | Public HTTPS from edge only |
+| Middleware HTTP | `/zapier/v1/*` job id + wait | HTTPS from access-zapier / loopback edge |
 | NATS cluster | JetStream subjects under `verae.*` | Private; loopback or SSH tunnel |
 | Workers | poller, webhook-deliver, aggregator | NATS + HTTPS to chain or Zapier hooks |
 | Archives | WORM + tree nodes | NATS broadcast query; bloom miss = silence |
 | Chain | Verae timestamping | HTTPS `api.veraetime.net` or MOCK |
-| Control | `verae-fleet` | Operator loopback `:3850`; SSH to extra machines |
+| Control | `verae-fleet` | Operator HTTP `:3850` on `0.0.0.0`; SSH to extra machines |
 
 ## Request in one sentence
 

packages/overview/02-modules-and-repos.md

@@ -13,6 +13,11 @@ Each runtime piece is its **own git repo** on Forgejo (`git.georgelambert.org`,
 | **verae-access-api** | `packages/verae-access-api` | Direct customer API plane (not Zapier) |
 | **verae-access-leaf** | `packages/verae-access-leaf` | Server-to-server NATS leaf plane |
 | **verae-access-zapier** | `packages/verae-access-zapier` | Zapier Platform plane only |
+| **verae-access-staff** | `packages/verae-access-staff` | Staff CS/sales/accounting plane |
+| **zappier-identity** | `packages/zappier-identity` | Bind/lookup `veraeUserId` |
+| **verae-jobs-events** | `packages/verae-jobs-events` | Mailbox `verae.zapier.jobs.events` |
+| **verae-nats-accounts** | `packages/verae-nats-accounts` | INTERNAL vs LEAF subject policy |
+| **zapier-decisions** | `packages/zapier-decisions` | Decision log |
 | **zappier-account-balance** | `packages/zappier-account-balance` | NATS source of truth for prepaid balances |
 | **zappier-customer-service** | `packages/zappier-customer-service` | CS goodwill credits onto prepaid balances |
 | **zappier-sales-pricing** | `packages/zappier-sales-pricing` | Sales per-customer tier / multiplier |

packages/overview/INDEX.md

@@ -54,7 +54,7 @@ Operator console (loopback): http://127.0.0.1:3850/ · [CONSOLE.pdf](https://zap
 
 Prefix: `https://git.georgelambert.org/marchon/`
 
-overview · verae-nats-process · verae-ops · master-zapier-plan-draft · zappier-edge · verae-access-authz · verae-access-web · verae-access-api · verae-access-leaf · verae-access-zapier · verae-middleware · verae-zapier-app · verae-activate · verae-request-splitter · verae-archive-worm · verae-archive-aggregator · verae-tree-node · verae-fleet · verae-zapier-simulator · zapier-user-docs · zapier-docs-master
+overview · verae-nats-process · verae-ops · master-zapier-plan-draft · zappier-edge · verae-access-authz · verae-access-web · verae-access-api · verae-access-leaf · verae-access-zapier · verae-access-staff · zappier-identity · verae-jobs-events · verae-nats-accounts · zapier-decisions · verae-middleware · verae-zapier-app · verae-activate · verae-request-splitter · verae-archive-worm · verae-archive-aggregator · verae-tree-node · verae-fleet · verae-zapier-simulator · zapier-user-docs · zapier-docs-master
 
 ## Per-module contracts
 

packages/verae-access-leaf/src/allow.js

@@ -0,0 +1,28 @@
+import fs from 'node:fs';
+
+const FALLBACK = [
+  'verae.archive.put',
+  'verae.archive.query',
+  'verae.archive.reply.',
+  'verae.zapier.jobs.watch',
+  'verae.zapier.jobs.events',
+  'verae.zapier.webhooks.deliver',
+];
+
+export function leafAllowList() {
+  const p = process.env.NATS_POLICY_PATH;
+  if (p && fs.existsSync(p)) {
+    try {
+      return JSON.parse(fs.readFileSync(p, 'utf8')).leafAllow || FALLBACK;
+    } catch {
+      return FALLBACK;
+    }
+  }
+  return FALLBACK;
+}
+
+export function leafAllowed(subject) {
+  return leafAllowList().some((p) =>
+    p.endsWith('.') ? subject.startsWith(p) : subject === p || subject.startsWith(`${p}.`),
+  );
+}

packages/verae-access-leaf/src/server.js

@@ -5,6 +5,7 @@
  * then forwards only allowed internal subjects (archive + jobs, never billing).
  */
 import http from 'node:http';
+import { leafAllowed } from './allow.js';
 
 const PORT = Number(process.env.PORT || 3023);
 const AUTHZ = (process.env.AUTHZ_URL || 'http://127.0.0.1:3020').replace(/\/$/, '');
@@ -30,6 +31,9 @@ async function forward(body) {
     return { status: 401, body: { allow: false, reason: 'bad leaf token' } };
   }
   const target = body.target || body.subject;
+  if (!leafAllowed(target)) {
+    return { status: 403, body: { allow: false, reason: `leaf policy denies ${target}` } };
+  }
   const gate = await check(target, body.principal || 'leaf');
   if (!gate.allow) return { status: 403, body: gate };
   const url = process.env.NATS_URL;

packages/verae-access-staff/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-access-staff
+
+Plane `staff`. Authz then `verae.billing.statement.get` / `balance.adjust`.

packages/verae-access-staff/README.md

@@ -0,0 +1,7 @@
+# verae-access-staff
+
+Staff access plane for CS / sales / accounting. Credits and statement review after `verae.access.authz.check` with plane `staff`.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-access-staff
+
+Port `:3025`.

packages/verae-access-staff/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "verae-access-staff",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "description": "Staff access plane (CS/sales/accounting)",
+  "scripts": {
+    "start": "node src/server.js",
+    "test": "node --test test/*.test.js"
+  }
+}

packages/verae-access-staff/src/server.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+/** Staff access plane (CS / sales / accounting). Not Zapier, not customer API. */
+import http from 'node:http';
+
+const PORT = Number(process.env.PORT || 3025);
+const AUTHZ = (process.env.AUTHZ_URL || 'http://127.0.0.1:3020').replace(/\/$/, '');
+const BOOKS = (process.env.ACCOUNT_BALANCE_URL || 'http://127.0.0.1:3010').replace(/\/$/, '');
+const PLANE = 'staff';
+
+async function check(subject, extra = {}) {
+  const r = await fetch(`${AUTHZ}/check`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ plane: PLANE, subject, ...extra }),
+  });
+  return r.json();
+}
+
+const server = http.createServer(async (req, res) => {
+  const url = new URL(req.url || '/', `http://127.0.0.1:${PORT}`);
+  const json = (code, obj) => {
+    res.writeHead(code, { 'content-type': 'application/json' });
+    res.end(JSON.stringify(obj));
+  };
+  try {
+    if (req.method === 'GET' && url.pathname === '/health') {
+      return json(200, { ok: true, role: 'verae-access-staff', plane: PLANE });
+    }
+    const review = url.pathname.match(/^\/review\/([^/]+)$/);
+    if (req.method === 'GET' && review) {
+      const gate = await check('verae.billing.statement.get', { principal: review[1] });
+      if (!gate.allow) return json(403, gate);
+      const r = await fetch(`${BOOKS}/statement/${review[1]}`);
+      return json(r.status, { ...(await r.json()), plane: PLANE, source: 'account-balance' });
+    }
+    if (req.method === 'POST' && url.pathname === '/credits') {
+      const chunks = [];
+      for await (const c of req) chunks.push(c);
+      const body = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
+      const gate = await check('verae.billing.balance.adjust', { kind: 'credit', principal: body.agent });
+      if (!gate.allow) return json(403, gate);
+      const r = await fetch(`${BOOKS}/adjust`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ ...body, kind: 'credit' }),
+      });
+      return json(r.status, { ...(await r.json()), plane: PLANE });
+    }
+    json(404, { error: 'not found' });
+  } catch (err) {
+    json(502, { error: err.message });
+  }
+});
+
+server.listen(PORT, '0.0.0.0', () => {
+  process.stdout.write(`verae-access-staff http://0.0.0.0:${PORT}/ plane=${PLANE}\n`);
+});

packages/verae-access-staff/test/health.test.js

@@ -0,0 +1,56 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const authzRoot = path.join(root, '..', 'verae-access-authz');
+const booksRoot = path.join(root, '..', 'zappier-account-balance');
+
+test('staff plane can credit after authz; zapier cannot', async () => {
+  const authzPort = 18031;
+  const booksPort = 18032;
+  const staffPort = 18033;
+  const authz = spawn(process.execPath, ['src/server.js'], {
+    cwd: authzRoot,
+    env: { ...process.env, PORT: String(authzPort) },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  const books = spawn(process.execPath, ['src/server.js'], {
+    cwd: booksRoot,
+    env: { ...process.env, PORT: String(booksPort), BOOKS_PATH: `/tmp/staff-books-${Date.now()}.json` },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  const staff = spawn(process.execPath, ['src/server.js'], {
+    cwd: root,
+    env: {
+      ...process.env,
+      PORT: String(staffPort),
+      AUTHZ_URL: `http://127.0.0.1:${authzPort}`,
+      ACCOUNT_BALANCE_URL: `http://127.0.0.1:${booksPort}`,
+    },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((r) => setTimeout(r, 600));
+  try {
+    const h = await (await fetch(`http://127.0.0.1:${staffPort}/health`)).json();
+    assert.equal(h.plane, 'staff');
+    const add = await fetch(`http://127.0.0.1:${staffPort}/credits`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ customerId: 'c-staff', cents: 50, reason: 'test', agent: 'cs' }),
+    });
+    assert.equal(add.status, 200);
+    const deny = await fetch(`http://127.0.0.1:${authzPort}/check`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ plane: 'zapier', subject: 'verae.billing.balance.adjust' }),
+    });
+    assert.equal(deny.status, 403);
+  } finally {
+    staff.kill('SIGTERM');
+    books.kill('SIGTERM');
+    authz.kill('SIGTERM');
+  }
+});

packages/verae-fleet/README.md

@@ -13,7 +13,7 @@ Operator control plane for Verae Time × Zapier **runtime** services:
 cd packages/verae-fleet
 npm test
 node src/cli.js list
-node src/cli.js serve    # http://127.0.0.1:3850/
+node src/cli.js serve    # http://0.0.0.0:3850/
 ```
 
 Against a running daemon:

packages/verae-fleet/docs/CONSOLE.html

@@ -368,9 +368,10 @@
 <h1 class="title">Operator console</h1>
 </header>
 <h1 id="operator-console">Operator console</h1>
-<p>Loopback UI at <strong>http://127.0.0.1:3850/</strong> — Fleet, Trace
+<p>Operator UI at <strong>http://0.0.0.0:3850/</strong> (all
-(simulator), and Docs in one shell. Not a public site. NATS stays
+interfaces). Fleet, Trace (simulator), and Docs in one shell. NATS stays
-private; SSH identity files stay on disk.</p>
+private (<code>127.0.0.1:4222</code>); SSH identity files stay on
+disk.</p>
 <div class="sourceCode" id="cb1"><pre
 class="sourceCode bash"><code class="sourceCode bash"><span id="cb1-1"><a href="#cb1-1" aria-hidden="true" tabindex="-1"></a><span class="bu">cd</span> packages/verae-fleet</span>
 <span id="cb1-2"><a href="#cb1-2" aria-hidden="true" tabindex="-1"></a><span class="ex">node</span> src/cli.js serve</span></code></pre></div>

packages/verae-fleet/docs/CONSOLE.md

@@ -1,6 +1,6 @@
 # Operator console
 
-Loopback UI at **http://127.0.0.1:3850/** — Fleet, Trace (simulator), and Docs in one shell. Not a public site. NATS stays private; SSH identity files stay on disk.
+Operator UI at **http://0.0.0.0:3850/** (all interfaces). Fleet, Trace (simulator), and Docs in one shell. NATS stays private (`127.0.0.1:4222`); SSH identity files stay on disk.
 
 ```bash
 cd packages/verae-fleet

packages/verae-fleet/fleet.json

@@ -1,7 +1,7 @@
 {
   "apiVersion": "verae.fleet/v1",
   "control": {
-    "bind": "127.0.0.1",
+    "bind": "0.0.0.0",
     "port": 3850,
     "probeIntervalMs": 750,
     "unhealthyAfterMs": 2500,
@@ -20,6 +20,9 @@
     "access-api": { "min": 1, "max": 1, "keepFloor": true, "enabled": true },
     "access-leaf": { "min": 1, "max": 1, "keepFloor": true, "enabled": true },
     "access-zapier": { "min": 1, "max": 1, "keepFloor": true, "enabled": true },
+    "access-staff": { "min": 1, "max": 1, "keepFloor": true, "enabled": true },
+    "identity": { "min": 1, "max": 1, "keepFloor": true, "enabled": true },
+    "jobs-events": { "min": 1, "max": 1, "keepFloor": true, "enabled": true },
     "account-balance": { "min": 1, "max": 1, "keepFloor": true, "enabled": true },
     "customer-service": { "min": 1, "max": 1, "keepFloor": true, "enabled": true },
     "sales-pricing": { "min": 1, "max": 1, "keepFloor": true, "enabled": true },

packages/verae-fleet/services/access-leaf.json

@@ -17,6 +17,7 @@
     "PORT": "3023",
     "AUTHZ_URL": "http://127.0.0.1:3020",
     "LEAF_TOKEN": "leaf-dev-token",
+    "NATS_POLICY_PATH": "../verae-nats-accounts/policy.json",
     "NATS_URL": "nats://127.0.0.1:4222"
   },
   "nats": {

packages/verae-fleet/services/access-staff.json

@@ -0,0 +1,22 @@
+{
+  "id": "access-staff",
+  "title": "Staff access plane",
+  "kind": "http",
+  "package": "verae-access-staff",
+  "role": "access-staff",
+  "managed": true,
+  "runtime": "HTTP :3025 plane=staff",
+  "health": { "type": "http", "path": "/health", "timeoutMs": 2000 },
+  "ports": { "healthBase": 3025 },
+  "spawn": {
+    "cwd": "../verae-access-staff",
+    "command": "node",
+    "args": ["src/server.js"]
+  },
+  "env": {
+    "PORT": "3025",
+    "AUTHZ_URL": "http://127.0.0.1:3020",
+    "ACCOUNT_BALANCE_URL": "http://127.0.0.1:3010"
+  },
+  "nats": { "in": [], "out": ["verae.access.authz.check"] }
+}

packages/verae-fleet/services/identity.json

@@ -0,0 +1,24 @@
+{
+  "id": "identity",
+  "title": "Verae user-id bind/lookup",
+  "kind": "http",
+  "package": "zappier-identity",
+  "role": "identity",
+  "managed": true,
+  "runtime": "HTTP :3026 + NATS verae.identity.*",
+  "health": { "type": "http", "path": "/health", "timeoutMs": 2000 },
+  "ports": { "healthBase": 3026 },
+  "spawn": {
+    "cwd": "../zappier-identity",
+    "command": "node",
+    "args": ["src/server.js"]
+  },
+  "env": {
+    "PORT": "3026",
+    "NATS_URL": "nats://127.0.0.1:4222"
+  },
+  "nats": {
+    "in": ["verae.identity.bind", "verae.identity.lookup"],
+    "out": []
+  }
+}

packages/verae-fleet/services/jobs-events.json

@@ -0,0 +1,24 @@
+{
+  "id": "jobs-events",
+  "title": "jobs.events mailbox",
+  "kind": "http",
+  "package": "verae-jobs-events",
+  "role": "jobs-events",
+  "managed": true,
+  "runtime": "HTTP :3030 + NATS verae.zapier.jobs.events",
+  "health": { "type": "http", "path": "/health", "timeoutMs": 2000 },
+  "ports": { "healthBase": 3030 },
+  "spawn": {
+    "cwd": "../verae-jobs-events",
+    "command": "node",
+    "args": ["src/server.js"]
+  },
+  "env": {
+    "PORT": "3030",
+    "NATS_URL": "nats://127.0.0.1:4222"
+  },
+  "nats": {
+    "in": ["verae.zapier.jobs.events"],
+    "out": []
+  }
+}

packages/verae-fleet/services/zappier-edge.json

@@ -5,7 +5,7 @@
   "package": "zappier",
   "role": "zappier-edge",
   "managed": true,
-  "runtime": "HTTPS :3000 (portal, admin, meter, proxy to middleware)",
+  "runtime": "loopback :3000 (portal, admin, Stripe; public doors are access-*)",
   "health": { "type": "http", "path": "/health", "timeoutMs": 4000 },
   "ports": { "healthBase": 3000 },
   "spawn": {
@@ -15,12 +15,15 @@
   },
   "env": {
     "PORT": "3000",
+    "BIND": "127.0.0.1",
     "ZAPPIER_UPSTREAM": "http://127.0.0.1:3100",
     "CS_SERVICE_URL": "http://127.0.0.1:3011",
     "SALES_PRICING_URL": "http://127.0.0.1:3012",
     "ACCOUNTING_EXPORT_URL": "http://127.0.0.1:3013",
     "NATS_URL": "nats://127.0.0.1:4222",
-    "AUTHZ_URL": "http://127.0.0.1:3020"
+    "AUTHZ_URL": "http://127.0.0.1:3020",
+    "ACCOUNT_BALANCE_URL": "http://127.0.0.1:3010",
+    "IDENTITY_URL": "http://127.0.0.1:3026"
   },
   "nats": {
     "in": [],
@@ -32,5 +35,5 @@
       "verae.billing.balance.adjust"
     ]
   },
-  "notes": "Zapier x-api-key lands here. HTTPS to middleware. NATS billing to account-balance."
+  "notes": "Loopback only. Public Zapier traffic hits access-zapier :3024."
 }

packages/verae-fleet/src/cli.js

@@ -92,15 +92,15 @@ async function main() {
   }
   if (cmd === 'serve' || cmd === 'monitor') {
     const sup = new Supervisor({ loaded });
+    const mon = new Monitor(sup);
+    startControlServer(sup, mon);
+    print(`fleet ${cmd} pid=${process.pid}\nUI http://${loaded.control.bind || '0.0.0.0'}:${loaded.control.port}/\nSIGINT stops all managed replicas`);
     for (const id of Object.keys(loaded.services)) {
       const s = loaded.services[id];
       if (s.managed && s.enabled && s.min > 0) await sup.startService(id);
     }
-    const mon = new Monitor(sup);
     await mon.tick();
     mon.start();
-    startControlServer(sup, mon);
-    print(`fleet ${cmd} pid=${process.pid}\nUI ${BASE}/\nSIGINT stops all managed replicas`);
     process.on('SIGINT', async () => {
       mon.stop();
       await sup.stopAll();