Bind each customer to a Verae userId for hop tracing

Signup registers/binds a Verae central user and stores veraeUserId. Public access stays the zappier API key. Chain JWTs stay server-side behind tokenRef. Authz, billing, and jobs.watch carry veraeUserId.

packages/verae-zapier-middleware/test/integration/tenants.test.js

@@ -44,6 +44,8 @@ describe('tenancy', () => {
     const body = await res.json();
     assert.equal(body.tenant.plan, 'free');
     assert.ok(body.apiKey.startsWith('zmw_'));
+    assert.match(body.tenant.veraeUserId, /^vu_[0-9a-f]{16}$/);
+    assert.doesNotMatch(JSON.stringify(body), /mock-jwt|eyJhbGci/);
   });
 
   it('enterprise without contract rejected', async () => {

packages/verae-zapier-middleware/test/unit/identity.test.js

@@ -0,0 +1,27 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { stableVeraeUserId } from '../../src/lib/identity.js';
+import { issueTokenRef, resolveTokenRef } from '../../src/store/tokenRefs.js';
+import { useTempStore } from '../helpers.js';
+
+describe('verae identity', () => {
+  it('stableVeraeUserId is deterministic and not a JWT', () => {
+    const a = stableVeraeUserId('Ada@Example.com');
+    const b = stableVeraeUserId('ada@example.com');
+    assert.equal(a, b);
+    assert.match(a, /^vu_[0-9a-f]{16}$/);
+    assert.doesNotMatch(a, /eyJ/);
+  });
+
+  it('tokenRef resolves tenant and is not a Verae JWT', () => {
+    const ctx = useTempStore();
+    try {
+      const ref = issueTokenRef('tenant-1');
+      assert.match(ref, /^tref_/);
+      assert.equal(resolveTokenRef(ref), 'tenant-1');
+      assert.doesNotMatch(ref, /mock-jwt|eyJ/);
+    } finally {
+      ctx.cleanup();
+    }
+  });
+});

packages/verae-zapier-middleware/test/unit/veraeClient.test.js

@@ -18,6 +18,9 @@ describe('veraeClient mock', () => {
   it('create → wait → completed', async () => {
     const login = await veraeClient.login({ username: 'u', password: 'p' });
     assert.ok(login.token.startsWith('mock-jwt-'));
+    const again = await veraeClient.login({ username: 'u', password: 'p' });
+    assert.equal(login.user.id, again.user.id);
+    assert.match(login.user.id, /^vu_[0-9a-f]{16}$/);
 
     const { jobId } = await veraeClient.createTimestamp(login.token, {
       data: 'hello',