Add customer names on the ledger, staff session login, and exclusive jobs.events.

Account-balance stores display names and looks up by name. Edge writes
names on customer create/edit; staff UIs join from edge when needed.
New verae-staff-session issues a host cookie; department HTML redirects
when STAFF_AUTH=1. JOBS_EVENTS_EXCLUSIVE lets jobs-events own the durable
consumer. Catalog index is cards; disabled fleet machines are grey.

packages/zappier-sales-pricing/src/names.js

@@ -0,0 +1,25 @@
+/** Join ledger ids to zappier-edge customer display names. */
+export async function withCustomerName(st, idOrName, edge, key) {
+  const out = { ...(st || {}) };
+  if (out.name && out.customerId) return out;
+  try {
+    const r = await fetch(`${edge.replace(/\/$/, '')}/admin/api/customers`, {
+      headers: { 'x-admin-key': key },
+    });
+    const { customers } = await r.json();
+    const want = String(idOrName || out.customerId || '').toLowerCase();
+    const c = (customers || []).find(
+      (x) =>
+        x.id === idOrName ||
+        x.id === out.customerId ||
+        String(x.name || '').toLowerCase() === want,
+    );
+    if (c) {
+      out.name = c.name;
+      out.customerId = c.id;
+    }
+  } catch {
+    /* edge optional */
+  }
+  return out;
+}

packages/zappier-sales-pricing/src/server.js

@@ -6,6 +6,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { SUBJECTS, billingRequest } from './nats-billing.js';
+import { withCustomerName } from './names.js';
 
 const PUBLIC = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'public');
 
@@ -36,6 +37,15 @@ const server = http.createServer(async (req, res) => {
   };
   try {
     if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html')) {
+      if (process.env.STAFF_AUTH === '1') {
+        const login = (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3027').replace(/\/$/, '');
+        const chk = await fetch(`${login}/check`, { headers: { cookie: req.headers.cookie || '' } }).catch(() => null);
+        if (!chk || !chk.ok) {
+          res.writeHead(302, { location: `${login}/login?next=${encodeURIComponent('http://' + (req.headers.host || '127.0.0.1') + '/')}` });
+          res.end();
+          return;
+        }
+      }
       res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
       res.end(fs.readFileSync(path.join(PUBLIC, 'index.html')));
       return;
@@ -45,12 +55,13 @@ const server = http.createServer(async (req, res) => {
     }
     const review = url.pathname.match(/^\/review\/([^/]+)$/);
     if (req.method === 'GET' && review) {
-      const nats = await billingRequest(SUBJECTS.STATEMENT_GET, { customerId: review[1] });
-      if (nats) return json(200, { ...nats, source: 'nats' });
-      const r = await fetch(`${BOOKS}/statement/${review[1]}`);
-      if (r.ok) return json(200, { ...(await r.json()), source: 'account-balance' });
-      const e = await edge(`/admin/api/statement/${review[1]}`);
-      return json(e.status, e.body);
+      const id = decodeURIComponent(review[1]);
+      const nats = await billingRequest(SUBJECTS.STATEMENT_GET, { customerId: id });
+      if (nats) return json(200, await withCustomerName({ ...nats, source: 'nats' }, id, EDGE, KEY));
+      const r = await fetch(`${BOOKS}/statement/${encodeURIComponent(id)}`);
+      if (r.ok) return json(200, await withCustomerName({ ...(await r.json()), source: 'account-balance' }, id, EDGE, KEY));
+      const e = await edge(`/admin/api/statement/${encodeURIComponent(id)}`);
+      return json(e.status, await withCustomerName(e.body, id, EDGE, KEY));
     }
     const quote = url.pathname.match(/^\/quotes\/([^/]+)$/);
     if (req.method === 'GET' && quote) {