Add customer names on the ledger, staff session login, and exclusive jobs.events.

Account-balance stores display names and looks up by name. Edge writes
names on customer create/edit; staff UIs join from edge when needed.
New verae-staff-session issues a host cookie; department HTML redirects
when STAFF_AUTH=1. JOBS_EVENTS_EXCLUSIVE lets jobs-events own the durable
consumer. Catalog index is cards; disabled fleet machines are grey.

packages/zappier-customer-service/src/names.js

@@ -0,0 +1,25 @@
+/** Join ledger ids to zappier-edge customer display names. */
+export async function withCustomerName(st, idOrName, edge, key) {
+  const out = { ...(st || {}) };
+  if (out.name && out.customerId) return out;
+  try {
+    const r = await fetch(`${edge.replace(/\/$/, '')}/admin/api/customers`, {
+      headers: { 'x-admin-key': key },
+    });
+    const { customers } = await r.json();
+    const want = String(idOrName || out.customerId || '').toLowerCase();
+    const c = (customers || []).find(
+      (x) =>
+        x.id === idOrName ||
+        x.id === out.customerId ||
+        String(x.name || '').toLowerCase() === want,
+    );
+    if (c) {
+      out.name = c.name;
+      out.customerId = c.id;
+    }
+  } catch {
+    /* edge optional */
+  }
+  return out;
+}

packages/zappier-customer-service/src/server.js

@@ -7,6 +7,7 @@ import http from 'node:http';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { SUBJECTS, billingRequest } from './nats-billing.js';
+import { withCustomerName } from './names.js';
 
 const PUBLIC = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'public');
 
@@ -32,6 +33,16 @@ const server = http.createServer(async (req, res) => {
   };
   try {
     if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html')) {
+      if (process.env.STAFF_AUTH === '1') {
+        const login = (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3027').replace(/\/$/, '');
+        const chk = await fetch(`${login}/check`, { headers: { cookie: req.headers.cookie || '' } }).catch(() => null);
+        if (!chk || !chk.ok) {
+          const next = `http://${req.headers.host || '127.0.0.1'}/`;
+          res.writeHead(302, { location: `${login}/login?next=${encodeURIComponent(next)}` });
+          res.end();
+          return;
+        }
+      }
       res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
       res.end(fs.readFileSync(path.join(PUBLIC, 'index.html')));
       return;
@@ -41,7 +52,9 @@ const server = http.createServer(async (req, res) => {
     }
     const review = url.pathname.match(/^\/review\/([^/]+)$/);
     if (req.method === 'GET' && review) {
-      const out = await statement(review[1]);
+      const id = decodeURIComponent(review[1]);
+      const out = await statement(id);
+      out.body = await withCustomerName(out.body, id, EDGE, KEY);
       return json(out.status, out.body);
     }
     if (req.method === 'POST' && url.pathname === '/credits') {