Around remaining blockers (Zapier login, live Verae): generate PDF receipts
without extra deps; AES-256-GCM object store with tenant isolation and share
tokens; scripts/nats-tunnel.sh to NS1; SHA256 Hash Text local Zapier action;
scripts/test-offline.sh for the no-login suite.
Learned: other-tenant object GET is 403; share token is the mock unwrap path.
GET /zapier/v1/receipts/{jobId}?format=json returns a retrieval receipt
with extraSeal.event=document.retrieved. PDF format is 501 until legal
copy exists. OPEN.md lists work that needs Zapier login or live Verae.
Wait-via-NATS returns completed or pending+jobId (GATE 9). Mock SHA256
idempotent register + GET /hashes/{sha256}. Zappier commercial edge has
POST /v1/timestamp and hash-lookup. GATE 12 smoke (signup + wait) passes.
NS1 NATS is 127.0.0.1:4222 on 70.88.205.138; SSH tunnel :14222. Local
nats-server -js used for isolated tests. Activate app adds Echo Text.
Learned: JetStream on NS1 is loopback-only; do not bind 4222 public.
74 source modules documented with extracted signatures, JSDoc params,
imports, and call graphs. 10 first-class models (PriceRule through
StatusResponse) have their own MD/RST/PDF. Sphinx HTML builds from
docs/sphinx. Per-module PDFs in docs/modules-pdf and docs/models-pdf.
Middleware gates 2–6 and 10 pass on MOCK_VERAE without NATS.
Learned: RST includes are relative to the RST file; keep one PDF per
module; Add Numbers remains the only push required tomorrow.
packages/verae-activate is pushable with zapier-platform 19.1.0: local
Add Numbers (number1+number2=sum) needs no hosted API. zapier-platform
validate is clean (0 warnings). zappier POST /v1/add is a free metered
endpoint for the optional hosted path.
Tests: verae-activate 7/7, zappier 176/176, verae-zapier 5/5, middleware
gate 1 11/11. Morning steps: docs/04-activate/SETUP-ZAPIER-DEVELOPER.md
Learned: perform runs on Zapier cloud so arithmetic needs no public URL;
CLI and zapier-platform-core majors must match; do not mix zapier-sdk.
