Add customer names on the ledger, staff session login, and exclusive jobs.events.

Account-balance stores display names and looks up by name. Edge writes
names on customer create/edit; staff UIs join from edge when needed.
New verae-staff-session issues a host cookie; department HTML redirects
when STAFF_AUTH=1. JOBS_EVENTS_EXCLUSIVE lets jobs-events own the durable
consumer. Catalog index is cards; disabled fleet machines are grey.

packages/zappier-accounting-export/src/names.js

@@ -0,0 +1,25 @@
+/** Join ledger ids to zappier-edge customer display names. */
+export async function withCustomerName(st, idOrName, edge, key) {
+  const out = { ...(st || {}) };
+  if (out.name && out.customerId) return out;
+  try {
+    const r = await fetch(`${edge.replace(/\/$/, '')}/admin/api/customers`, {
+      headers: { 'x-admin-key': key },
+    });
+    const { customers } = await r.json();
+    const want = String(idOrName || out.customerId || '').toLowerCase();
+    const c = (customers || []).find(
+      (x) =>
+        x.id === idOrName ||
+        x.id === out.customerId ||
+        String(x.name || '').toLowerCase() === want,
+    );
+    if (c) {
+      out.name = c.name;
+      out.customerId = c.id;
+    }
+  } catch {
+    /* edge optional */
+  }
+  return out;
+}

packages/zappier-accounting-export/src/server.js

@@ -5,6 +5,7 @@ import http from 'node:http';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { SUBJECTS, billingRequest } from './nats-billing.js';
+import { withCustomerName } from './names.js';
 
 const PORT = Number(process.env.PORT || 3013);
 const EDGE = (process.env.ZAPPIER_ADMIN_URL || 'http://127.0.0.1:3000').replace(/\/$/, '');
@@ -26,6 +27,15 @@ const server = http.createServer(async (req, res) => {
   const json = (code, obj) => send(code, 'application/json', JSON.stringify(obj));
   try {
     if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html')) {
+      if (process.env.STAFF_AUTH === '1') {
+        const login = (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3027').replace(/\/$/, '');
+        const chk = await fetch(`${login}/check`, { headers: { cookie: req.headers.cookie || '' } }).catch(() => null);
+        if (!chk || !chk.ok) {
+          res.writeHead(302, { location: `${login}/login?next=${encodeURIComponent('http://' + (req.headers.host || '127.0.0.1') + '/')}` });
+          res.end();
+          return;
+        }
+      }
       return send(200, 'text/html; charset=utf-8', fs.readFileSync(path.join(PUBLIC, 'index.html')));
     }
     if (req.method === 'GET' && url.pathname === '/health') {
@@ -33,12 +43,14 @@ const server = http.createServer(async (req, res) => {
     }
     const review = url.pathname.match(/^\/review\/([^/]+)$/);
     if (req.method === 'GET' && review) {
-      const nats = await billingRequest(SUBJECTS.STATEMENT_GET, { customerId: review[1] });
-      if (nats) return json(200, { ...nats, source: 'nats' });
-      const r = await fetch(`${BOOKS}/statement/${review[1]}`);
-      if (r.ok) return json(200, { ...(await r.json()), source: 'account-balance' });
-      const e = await edge(`/admin/api/statement/${review[1]}`);
-      return send(e.status, 'application/json', await e.text());
+      const id = decodeURIComponent(review[1]);
+      const nats = await billingRequest(SUBJECTS.STATEMENT_GET, { customerId: id });
+      if (nats) return json(200, await withCustomerName({ ...nats, source: 'nats' }, id, EDGE, KEY));
+      const r = await fetch(`${BOOKS}/statement/${encodeURIComponent(id)}`);
+      if (r.ok) return json(200, await withCustomerName({ ...(await r.json()), source: 'account-balance' }, id, EDGE, KEY));
+      const e = await edge(`/admin/api/statement/${encodeURIComponent(id)}`);
+      const body = await e.json().catch(() => ({}));
+      return json(e.status, await withCustomerName(body, id, EDGE, KEY));
     }
     const period = url.searchParams.get('period');
     const q = period ? `?period=${encodeURIComponent(period)}` : '';