Bind each customer to a Verae userId for hop tracing

Signup registers/binds a Verae central user and stores veraeUserId. Public access stays the zappier API key. Chain JWTs stay server-side behind tokenRef. Authz, billing, and jobs.watch carry veraeUserId.

docs/modules/zappier/admin.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/admin.ts`  
-**Lines:** 591
+**Lines:** 593
 
 ## What this module is
 

docs/modules/zappier/app.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/app.ts`  
-**Lines:** 272
+**Lines:** 278
 
 ## What this module is
 
@@ -52,7 +52,7 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 
 ## Call graph (identifiers invoked)
 
-`join`, `next`, `parse`, `status`, `json`, `buildApp`, `seeded`, `seedAdminUsersFromEnv`, `rateCard`, `getRateCard`, `tiers`, `getTiers`, `natsPublish`, `toISOString`, `express`, `use`, `load`, `setup`, `adminLoginRouter`, `adminAuth`, `adminRouter`, `static`, `async`, `import`, `toDataURL`, `portalRouter`, `get`, `apiKeyAuth`, `middleware`, `meter`, `post`, `toUpperCase`, `proxyVerae`, `toLowerCase`, `createHash`, `update`, `digest`, `randomUUID`, `set`, `isFinite`, `map`, `unshift`, `filter`, `setUTCDate`, `setUTCHours`, `summaryFor`, `find`, `applyMonthlyCredit`
+`join`, `next`, `parse`, `status`, `json`, `buildApp`, `seeded`, `seedAdminUsersFromEnv`, `rateCard`, `getRateCard`, `tiers`, `getTiers`, `list`, `find`, `natsPublish`, `toISOString`, `express`, `use`, `load`, `setup`, `adminLoginRouter`, `adminAuth`, `adminRouter`, `static`, `async`, `import`, `toDataURL`, `portalRouter`, `get`, `apiKeyAuth`, `middleware`, `meter`, `post`, `toUpperCase`, `proxyVerae`, `toLowerCase`, `createHash`, `update`, `digest`, `randomUUID`, `set`, `isFinite`, `map`, `unshift`, `filter`, `setUTCDate`, `setUTCHours`, `summaryFor`, `applyMonthlyCredit`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier/auth.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/auth.ts`  
-**Lines:** 84
+**Lines:** 87
 
 ## What this module is
 
@@ -48,7 +48,7 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 
 ## Call graph (identifiers invoked)
 
-`findByApiKey`, `findByEmail`, `list`, `save`, `constructor`, `arrays`, `map`, `find`, `toLowerCase`, `findIndex`, `push`, `apiKeyAuth`, `header`, `status`, `json`, `next`
+`id`, `findByApiKey`, `findByEmail`, `list`, `save`, `constructor`, `arrays`, `map`, `find`, `toLowerCase`, `findIndex`, `push`, `apiKeyAuth`, `header`, `status`, `json`, `next`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier/billing-nats.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/billing-nats.ts`  
-**Lines:** 130
+**Lines:** 138
 
 ## What this module is
 
@@ -29,11 +29,13 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 | `decode` | `buf: Uint8Array` | — | `unknown` | see Call graph |
 | `authzAllow` | `plane: AccessPlane,
   subject: string,
-  extra: { principal?: string; kind?: string } = {},` | — | `unknown` | see Call graph |
+  extra: { principal?: string; kind?: string; veraeUserId?: string } = {},` | — | `unknown` | see Call graph |
 | `natsStatement` | `customerId: string,
-  plane: AccessPlane = 'web',` | — | `unknown` | see Call graph |
+  plane: AccessPlane = 'web',
+  veraeUserId?: string,` | — | `unknown` | see Call graph |
 | `natsAdjust` | `payload: {
     customerId: string;
+    veraeUserId?: string;
     cents: number;
     reason: string;
     agent: string;

docs/modules/zappier/portal.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/portal.ts`  
-**Lines:** 328
+**Lines:** 337
 
 ## What this module is
 
@@ -51,10 +51,11 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 - `./credits`
 - `./statement`
 - `./billing-nats`
+- `./verae-bind`
 
 ## Call graph (identifiers invoked)
 
-`now`, `reload`, `customer`, `publicProfile`, `sessionAuth`, `header`, `startsWith`, `slice`, `get`, `list`, `find`, `status`, `json`, `next`, `save`, `portalRouter`, `post`, `trim`, `test`, `hashPassword`, `findByEmail`, `randomBytes`, `toString`, `create`, `verifyPassword`, `verifyTotp`, `use`, `delete`, `setUTCDate`, `setUTCHours`, `summaryFor`, `tiers`, `applyMonthlyCredit`, `rateCard`, `async`, `natsStatement`, `composeStatement`, `listFor`, `type`, `send`, `renderInvoiceHtml`, `generateTotpSecret`, `totpUri`, `qr`, `isInteger`, `natsPublish`, `natsAdjust`, `put`
+`now`, `reload`, `customer`, `publicProfile`, `sessionAuth`, `header`, `startsWith`, `slice`, `get`, `list`, `find`, `status`, `json`, `next`, `save`, `portalRouter`, `post`, `async`, `trim`, `test`, `hashPassword`, `findByEmail`, `randomBytes`, `toString`, `bindVeraeUser`, `create`, `verifyPassword`, `verifyTotp`, `use`, `delete`, `setUTCDate`, `setUTCHours`, `summaryFor`, `tiers`, `applyMonthlyCredit`, `rateCard`, `natsStatement`, `composeStatement`, `listFor`, `type`, `send`, `renderInvoiceHtml`, `generateTotpSecret`, `totpUri`, `qr`, `isInteger`, `natsPublish`, `natsAdjust`, `put`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
 

docs/modules/zappier/statement.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/statement.ts`  
-**Lines:** 39
+**Lines:** 41
 
 ## What this module is
 
@@ -22,6 +22,7 @@ _None extracted._
 |------|------------|---------------------|---------|-----------------------------|
 | `composeStatement` | `args: {
   customerId: string;
+  veraeUserId?: string;
   prepaidCents: number;
   credits: CreditAdjustment[];
   usage: UsageEntry[];

docs/modules/zappier/upstream.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/upstream.ts`  
-**Lines:** 46
+**Lines:** 48
 
 ## What this module is
 

docs/modules/zappier/verae-bind.md

@@ -0,0 +1,46 @@
+# `zappier/verae-bind`
+
+**Package:** `zappier`  
+**Source:** `packages/zappier/src/verae-bind.ts`  
+**Lines:** 77
+
+## What this module is
+
+Implementation module in `zappier`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`normalizeVeraeUsername`, `stableVeraeUserId`, `VeraeBind`, `bindVeraeUser`
+
+## Types / interfaces / classes
+
+| Kind | Name |
+|------|------|
+| type | `VeraeBind` |
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `normalizeVeraeUsername` | `username: string` | — | `unknown` | see Call graph |
+| `stableVeraeUserId` | `username: string` | — | `unknown` | see Call graph |
+| `mockBind` | `email: string` | — | `unknown` | see Call graph |
+| `bindVeraeUser` | `email: string` | — | `unknown` | see Call graph |
+| `login` | `username: string, pass: string` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `crypto`
+
+## Call graph (identifiers invoked)
+
+`normalizeVeraeUsername`, `trim`, `toLowerCase`, `stableVeraeUserId`, `createHash`, `update`, `digest`, `slice`, `mockBind`, `bindVeraeUser`, `replace`, `randomBytes`, `toString`, `async`, `fetch`, `stringify`, `json`, `login`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+