@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/apps/storefront/src/lib/activity/deployVersion.ts

@@ -1,13 +1,11 @@
 /**
- * deploy.version_observed — the deploy-provenance / deploy-skew signal (card D2).
+ * deploy.version_observed — the deploy-provenance / deploy-skew signal.
  *
- * "A deployed worker version/commit was observed." This is the DERIVED signal D5's
- * query surface reads to answer *deploy skew* — is the build serving traffic the
- * pushed umbrella tip, or is a stale isolate still live? D2's job is just to make
- * `worker_commit` reliably present on server events and to EMIT this observation at
- * least once per running build; the actual "== umbrella tip?" comparison and the
- * timeline query are D5's (this module intentionally does no comparison — it has no
- * notion of what the tip is, only what THIS build is).
+ * "A deployed worker version/commit was observed." This module makes
+ * `worker_commit` reliably present on server events and EMITs this observation at
+ * least once per running build. It intentionally does NO comparison — it has no
+ * notion of what the umbrella tip is, only what THIS build is; the "== umbrella
+ * tip?" deploy-skew comparison and the timeline query live elsewhere.
  *
  * WHAT IT PRODUCES. A catalog `deploy.version_observed` event (ACTION_CATALOG:
  * actors [system|dev], source server, sinks logs+analytics+timeline). The FULL
@@ -15,24 +13,20 @@
  * never redacts — because that is where the authoritative, unscrubbed sha belongs.
  *
  * DELIBERATELY the full sha does NOT go in `payload`. The action's argsAllow names
- * `commit`, but a 40-char hex sha trips D0's `high_entropy` VALUE canary (redaction.ts:
+ * `commit`, but a 40-char hex sha trips the `high_entropy` VALUE canary (redaction.ts:
  * ≥28 chars of base64url) — it would be scrubbed to «redacted» AND set
- * `report.canaryTripped`, which D6/D7 alert on, firing a FALSE PII alarm on every cold
+ * `report.canaryTripped`, which alerting reads, firing a FALSE PII alarm on every cold
  * start. So payload carries only the SHORT `version` (7 chars, safe) plus `env` +
  * `observedFrom`; a reader wanting the full sha reads scope.workerCommit (a git sha is
- * public, so the core zone is its correct, alert-free home). See the D2 report note for
- * D5/D8: treat scope.workerCommit as the authoritative provenance, payload.version as a
+ * public, so the core zone is its correct, alert-free home). Treat scope.workerCommit
+ * as the authoritative provenance, payload.version as a
  * human-eyeball convenience.
  *
  * WHERE IT'S EMITTED. observeDeployVersion() fires ONCE PER WORKER ISOLATE (guarded
  * by a module-level flag) from the middleware's front door — a cold start emits one
- * observation, not one per request, so the stream is low-volume and honest. Until
- * D1's recordActivity()/D4's ingest+store land, the emission goes to the universal
- * `logs` sink (structured `[activity]` JSON to Workers Logs — the same pipeline the
- * interim recordActivity.ts uses, already provisioned via `[observability]`). When
- * D1's recordActivity() exists, swap `emitToLogs` for it (it will fan out to the
- * analytics+timeline sinks the action declares); the EVENT this module builds is
- * unchanged.
+ * observation, not one per request, so the stream is low-volume and honest. The
+ * emission goes to the universal `logs` sink (structured `[activity]` JSON to Workers
+ * Logs, already provisioned via `[observability]`).
  */
 import { createActivityEvent } from "@tot/public-runtime";
 import type { ActivityEvent, RedactionReport } from "@tot/public-runtime";
@@ -52,8 +46,8 @@ export interface DeployVersionObservedInput {
 
 /**
  * Build (do not emit) the `deploy.version_observed` ActivityEvent for the running
- * build. Pure + side-effect-free — the piece D5 ultimately consumes and the piece
- * tests assert against. Returns the safe-constructed event plus its redaction report.
+ * build. Pure + side-effect-free — the piece downstream consumers ultimately consume
+ * and the piece tests assert against. Returns the safe-constructed event plus its redaction report.
  */
 export function buildDeployVersionObservedEvent(
   input: DeployVersionObservedInput = {},
@@ -66,7 +60,7 @@ export function buildDeployVersionObservedEvent(
     source: "server",
     outcome: { status: "succeeded" },
     // worker_commit (full sha) in the CORE zone — never redacted; the authoritative
-    // provenance every server event carries and D5 derives skew from.
+    // provenance every server event carries and deploy skew is derived from.
     scope: commit !== UNKNOWN_COMMIT ? { workerCommit: commit } : {},
     // Payload carries the SHORT version (safe from the high_entropy canary that would
     // scrub a full sha) + env + observedFrom. Unknown builds omit `version` rather than
@@ -82,10 +76,9 @@ export function buildDeployVersionObservedEvent(
 }
 
 /**
- * Serialize an ActivityEvent to the universal `logs` sink (Workers Logs). Interim
- * transport until D1's recordActivity() fans out to all of the action's sinks;
- * mirrors the `[activity]` tag the existing recordActivity.ts slice already emits so
- * one grep finds both. Best-effort, never throws.
+ * Serialize an ActivityEvent to the universal `logs` sink (Workers Logs) —
+ * structured `[activity]` JSON so one grep finds all activity lines.
+ * Best-effort, never throws.
  */
 function emitToLogs(event: ActivityEvent): void {
   try {
@@ -108,7 +101,7 @@ export function observeDeployVersion(
   input: DeployVersionObservedInput = {},
 ): ActivityEvent | undefined {
   if (observedThisIsolate) return undefined;
-  // Kill switch (D8): telemetry off ⇒ skip the observation entirely (fail-open). Do
+  // Kill switch: telemetry off ⇒ skip the observation entirely (fail-open). Do
   // NOT set the per-isolate guard, so re-enabling emits the observation on the next call.
   if (isActivityDisabled()) return undefined;
   observedThisIsolate = true;

package/apps/storefront/src/lib/activity/ingest.ts

@@ -1,13 +1,13 @@
 /**
- * Ingest validation + server-side redaction for `POST /api/activity` (card D4).
+ * Ingest validation + server-side redaction for `POST /api/activity`.
  *
  * PURE (no I/O) so it is unit-testable and the route stays a thin auth/parse/
- * respond shell. Takes the raw JSON events an emitter posted (CLI cohort D3, UI
- * cohort D6 — both send JSON matching the `ActivityEvent` shape) plus the
+ * respond shell. Takes the raw JSON events an emitter posted (the CLI and UI
+ * cohorts — both send JSON matching the `ActivityEvent` shape) plus the
  * AUTHENTICATED tenant id, and returns the accepted events (already rebuilt
  * through `createActivityEvent`, so re-redacted server-side) and the rejections.
  *
- * DEFENSE IN DEPTH (D8's future attack surface). Even though every emitter is
+ * DEFENSE IN DEPTH. Even though every emitter is
  * expected to have run the redaction contract itself, ingest NEVER trusts that:
  * it rebuilds each event through `createActivityEvent()`, which re-applies the
  * default-deny allowlist + canary scan. A malicious/careless client that posts a
@@ -61,9 +61,9 @@ export interface IngestRejection {
 export interface AcceptedActivity {
   event: ActivityEvent;
   /** True when a value-canary fired during server-side redaction — the signal
-   *  the route emits self-telemetry for and D6/D7 alert on. */
+   *  the route emits self-telemetry for and alerting reads. */
   canaryTripped: boolean;
-  /** The redaction hits (fact-of, never the value) for D8 audit / logging. */
+  /** The redaction hits (fact-of, never the value) for audit / logging. */
   redactionHits: RedactionFieldHit[];
 }
 
@@ -122,14 +122,14 @@ export function ingestOne(index: number, raw: unknown, tenantId: string): Accept
   const durationMs = typeof durationRaw === "number" && Number.isFinite(durationRaw) ? durationRaw : undefined;
 
   // `at`: keep the emit clock when well-formed; a PRESENT-but-malformed `at` is a
-  // reject (a broken clock corrupts the D5 timeline ordering), a MISSING one is
+  // reject (a broken clock corrupts the timeline ordering), a MISSING one is
   // stamped server-side by createActivityEvent.
   const at = e.at;
   if (at !== undefined && !isIsoTimestamp(at)) return { index, reason: "bad_timestamp", attemptedAction: action };
 
   const rawScope = (e.scope && typeof e.scope === "object" ? e.scope : {}) as Record<string, unknown>;
 
-  // CORE-ZONE PII GUARD (D8 hardening). actor.id / actor.ref and the client-supplied
+  // CORE-ZONE PII GUARD. actor.id / actor.ref and the client-supplied
   // scope ids land UNREDACTED in the core zone, whose contract is "opaque, never raw
   // PII/secret". The payload contract is enforced by re-redaction below, but the core
   // ids were NOT checked — a buggy/malicious (though authenticated) emitter could

package/apps/storefront/src/lib/activity/ingestAuth.ts

@@ -1,5 +1,5 @@
 /**
- * Service-auth for `POST /api/activity` (card D4) — HMAC-SHA256 over the raw
+ * Service-auth for `POST /api/activity` — HMAC-SHA256 over the raw
  * body, with the authenticated TENANT bound into the signed material.
  *
  * WHY HMAC (not the bare `x-mcp-service-secret` shared-secret seam the

package/apps/storefront/src/lib/activity/killSwitch.ts

@@ -1,13 +1,13 @@
 /**
- * The single operational KILL SWITCH for the whole activity-telemetry pipeline (D8).
+ * The single operational KILL SWITCH for the whole activity-telemetry pipeline.
  *
  * ONE flag — the `ACTIVITY_TELEMETRY_DISABLED` env var / Worker secret — switches
  * EVERY server-side emit path to a no-op in one place:
- *   • `recordActivity()` (D1 server emitter) — and therefore `recordUiActivity()`
- *     (D6 UI cohort), which is a thin wrapper over it;
- *   • `observeDeployVersion()` (D2 deploy-provenance observer);
- *   • `POST /api/activity` (D4 ingest) — accepts-and-drops so emitters never error.
- * The out-of-process CLI (`emitActivity`, D3) honours the SAME flag name in its own
+ *   • `recordActivity()` (the server emitter) — and therefore `recordUiActivity()`
+ *     (the UI cohort), which is a thin wrapper over it;
+ *   • `observeDeployVersion()` (the deploy-provenance observer);
+ *   • `POST /api/activity` (ingest) — accepts-and-drops so emitters never error.
+ * The out-of-process CLI (`emitActivity`) honours the SAME flag name in its own
  * JS mirror. Wiring it at these SHARED chokepoints means no call site checks it.
  *
  * FAIL-OPEN — this gates ONLY the observability layer. The underlying operation

package/apps/storefront/src/lib/activity/query.ts

@@ -1,18 +1,18 @@
 /**
- * Query surface over the D1 `activity_events` timeline (card D5).
+ * Query surface over the D1 `activity_events` timeline.
  *
  * The READ half of the operational-activity spine: given a tenant, return that
  * tenant's lifecycle activity newest-first for the `/admin` ops timeline UI
  * ("who shipped/rejected what, when, why — and what happened to my change/
  * deploy"). PURE over the injected `Queryable` seam (D1 in the Worker, an
  * in-memory `node:sqlite` in tests), same posture as `lib/d1/catalog.ts` and the
- * D4 write path (`store.ts`).
+ * write path (`store.ts`).
  *
  * TENANT ISOLATION IS THE INVARIANT. `tenantId` is REQUIRED on every query and is
  * ALWAYS the first `WHERE` predicate (`tenant_id = ?`, a bound param — never
  * string-interpolated). There is NO code path that reads `activity_events` without
  * a tenant equality bound in: a query with a missing/empty tenant THROWS rather
- * than degrading to a cross-tenant scan. This mirrors the D4 write-side isolation
+ * than degrading to a cross-tenant scan. This mirrors the write-side isolation
  * (ingest writes only the authenticated tenant) for the read side — a colliding
  * `changeId`/`actorId`/`action` across two tenants can never surface tenant B's
  * rows to a tenant-A query, because the collision is AND-ed under the tenant
@@ -24,12 +24,12 @@
  * the UI. We never re-expand or un-redact it; a malformed row degrades to an empty
  * payload rather than throwing the whole query.
  *
- * DEPLOY SKEW (card D2 data, lightweight). The `deploy.version_observed` action is
+ * DEPLOY SKEW (lightweight). The `deploy.version_observed` action is
  * in the timeline cohort, so its rows are queryable here. `deriveDeploySkew()`
  * folds those rows into the set of distinct build versions observed for the tenant
  * and compares them against the build serving THIS query (`workerCommitShort()`),
  * surfacing "a stale/newer isolate is (or was) live" as a visible signal. The full
- * alerting logic is D7's job — this only makes the data visibly queryable.
+ * alerting logic lives elsewhere — this only makes the data visibly queryable.
  */
 import {
   getActionSpec,
@@ -241,7 +241,7 @@ export async function queryActivity(
   return rows.map(toTimelineRow);
 }
 
-// ─── Deploy skew (card D2 data) ──────────────────────────────────────────────
+// ─── Deploy skew ─────────────────────────────────────────────────────────────
 
 /** One distinct build version observed in the tenant's timeline. */
 export interface ObservedVersion {
@@ -256,8 +256,8 @@ export interface ObservedVersion {
 }
 
 /**
- * Deploy-skew summary for a tenant. Lightweight and derived, NOT an alert — D7
- * owns alerting. It answers: what build(s) has this tenant seen serving, and does
+ * Deploy-skew summary for a tenant. Lightweight and derived, NOT an alert —
+ * alerting lives elsewhere. It answers: what build(s) has this tenant seen serving, and does
  * the build serving THIS request match the newest one?
  */
 export interface DeploySkewSummary {
@@ -360,7 +360,7 @@ export function parseTimelineQuery(params: URLSearchParams, tenantId: string): A
   };
 }
 
-// ─── TODO (card D5 optional) — cross-tenant MCP ops query for ToT staff ──────
+// ─── TODO — cross-tenant MCP ops query for ToT staff ────────────────────────
 // Deliberately NOT built: storefront has no in-repo MCP tool surface to hook into
 // (the MCP tools live in the external `tot-mcp` repo; this repo only *authenticates*
 // tot-mcp callers via the `x-mcp-service-secret` webhook seam — it exposes no tool

package/apps/storefront/src/lib/activity/recordActivity.ts

@@ -1,21 +1,17 @@
 /**
- * Server-side activity emitter (card D1) — the storefront's entry point onto the
- * D0 actor×action telemetry contract (`@tot/public-runtime/activity`).
+ * Server-side activity emitter — the storefront's entry point onto the
+ * actor×action telemetry contract (`@tot/public-runtime/activity`).
  *
- * This SUPERSEDES the interim admin-only slice that used to live here (a bespoke
- * `{surface, action, outcome, actor_email, …}` shape logged for candidate
- * accept/reject). That slice pre-dated the contract and imported `@/lib/change`
- * for a session type — a `renderer-no-controlplane` violation. It is gone: every
- * emitter now builds through {@link recordActivity}, which runs the SAFE
+ * Every emitter builds through {@link recordActivity}, which runs the SAFE
  * constructor `createActivityEvent()` so the payload zone is always redacted, and
  * writes the envelope as one structured JSON line to Workers Logs.
  *
  * TRANSPORT — Workers Logs (DECISIONS.md §8, tier 1 "universal"). `console.log` of
- * the structured envelope, tagged `[activity]` exactly as the interim slice was, so
- * existing `wrangler tail` / CF-dashboard grep tooling keeps working unchanged.
- * `[observability]` is already enabled in `apps/storefront/wrangler.toml`, so there
- * is nothing to provision. The analytics/timeline sinks named on each action's
- * `spec.sinks` are D4's ingest/store job — D1 emits to the firehose only.
+ * the structured envelope, tagged `[activity]`, so `wrangler tail` / CF-dashboard
+ * grep tooling works. `[observability]` is already enabled in
+ * `apps/storefront/wrangler.toml`, so there is nothing to provision. The
+ * analytics/timeline sinks named on each action's `spec.sinks` are the ingest/store
+ * job — this emitter writes to the firehose only.
  *
  * BEST-EFFORT + BOUNDED — a logging failure must NEVER throw or block the caller.
  * Every path is wrapped; a construction/serialize fault degrades to a single
@@ -31,7 +27,7 @@ import { isActivityDisabled } from "./killSwitch";
  * zone is guaranteed by construction. Best-effort + never throws.
  */
 export function recordActivity(input: CreateActivityEventInput): void {
-  // Kill switch (D8): the whole pipeline is a no-op when disabled — fail-open, the
+  // Kill switch: the whole pipeline is a no-op when disabled — fail-open, the
   // action this describes is unaffected. Covers the UI cohort too (recordUiActivity
   // wraps this). Sync check so this fire-and-forget path stays synchronous.
   if (isActivityDisabled()) return;
@@ -60,9 +56,9 @@ export function recordActivity(input: CreateActivityEventInput): void {
  * one person stays correlatable across events) while being non-reversible.
  *
  * The salt is a Worker secret (`ACTIVITY_ACTOR_SALT`). The canonical salt is the
- * D1/D4 OPEN QUESTION flagged in `redaction.ts` — this SERVER-side helper is where
+ * open question flagged in `redaction.ts` — this SERVER-side helper is where
  * it lands, deliberately NOT baked into the edge-shipped `@tot/public-runtime`
- * package (which the D0 header warns against). Best-effort: on any crypto fault it
+ * package (which the redaction header warns against). Best-effort: on any crypto fault it
  * returns a coarse non-PII fallback so an emitter never throws.
  */
 export async function hashActorId(identifier: string, salt?: string | null): Promise<string> {

package/apps/storefront/src/lib/activity/store.ts

@@ -1,16 +1,15 @@
 /**
- * Sink fan-out for the activity spine (card D4) — routes ONE redacted
+ * Sink fan-out for the activity spine — routes ONE redacted
  * `ActivityEvent` to the sink(s) its catalog entry declares (`spec.sinks`), per
  * the store decision in DECISIONS.md §8:
  *
  *   • "logs"      — Workers Logs firehose, EVERY action. `console.log` of the
- *                   structured envelope (the interim `recordActivity.ts` slice's
- *                   transport). Zero provision, days-only retention.
+ *                   structured envelope. Zero provision, days-only retention.
  *   • "analytics" — Cloudflare Analytics Engine (`ACTIVITY_ANALYTICS` binding).
  *                   High-volume / query-light cohort; aggregate SQL, ~90 days.
  *   • "timeline"  — D1 `STOREFRONT_APPS_DB.activity_events`. Low-volume / high-
  *                   value lifecycle cohort; point queries + joins + arbitrary
- *                   retention for the D5 ops timeline UI.
+ *                   retention for the ops timeline UI.
  *
  * PURE over injected seams (a `Queryable` for D1, an `AnalyticsEngineLike` for
  * Analytics Engine) so the same code serves the real Worker bindings and an
@@ -36,8 +35,7 @@ export interface ActivitySinks {
   ingestedAt: string;
 }
 
-/** Structured Workers-Logs line — grep-able on the `[activity]` tag, same shape
- *  the interim admin slice emits. Never throws. */
+/** Structured Workers-Logs line — grep-able on the `[activity]` tag. Never throws. */
 export function logActivity(event: ActivityEvent): void {
   try {
     console.log(`[activity] ${JSON.stringify(event)}`);

package/apps/storefront/src/lib/activity/uiActor.ts

@@ -1,21 +1,21 @@
 /**
- * Shared emit helper for UI-ORIGINATED operational activity (card D6).
+ * Shared emit helper for UI-ORIGINATED operational activity.
  *
- * The UI cohort's entry point onto the D0 actor×action telemetry contract. It sits
- * ON TOP of D1's server emitter ({@link recordActivity}) — every admin/cockpit action
+ * The UI cohort's entry point onto the actor×action telemetry contract. It sits
+ * ON TOP of the server emitter ({@link recordActivity}) — every admin/cockpit action
  * handler already runs SERVER-SIDE in the same Worker, so a UI action reaches
- * telemetry through the same in-process `recordActivity()` call D1 uses (one
- * structured Workers-Logs line), NOT a client-side `fetch` to the D4 ingest endpoint.
+ * telemetry through the same in-process `recordActivity()` call the server path uses (one
+ * structured Workers-Logs line), NOT a client-side `fetch` to the ingest endpoint.
  * There is no browser-only signal to capture: an admin/cockpit "Publish / Connect /
  * Invite / Approve / Rollback" click is a server-rendered form/JSON POST to an API
  * route, so the route handler that already does the work is exactly where the emit
- * belongs (zero extra HTTP round-trip, no new auth/trust boundary). The D4 HMAC
+ * belongs (zero extra HTTP round-trip, no new auth/trust boundary). The HMAC
  * ingest path exists for emitters that CAN'T call `recordActivity()` directly (the
- * out-of-process CLI cohort, D3) — it is not this cohort's path.
+ * out-of-process CLI cohort) — it is not this cohort's path.
  *
  * WHAT THIS ADDS over calling `recordActivity()` raw: it stamps `source: "ui"` and,
  * critically, resolves the ACTOR KIND from the authenticated session so the timeline
- * (D5) can attribute an action to the right cohort:
+ * can attribute an action to the right cohort:
  *
  *   • "admin"    — a ToT-STAFF viewer (the session carries `staff[]` scope). ToT
  *                  operators acting through the admin shell / staff vendor selection.
@@ -29,10 +29,10 @@
  * The classifier is a PURE function ({@link classifyActorKind}) so the cohort mapping
  * is unit-tested without a live request. The opaque `actor.id` is the salted,
  * non-reversible hash of the acting identity (never raw PII in the core zone) — the
- * SAME {@link hashActorId} + `ACTIVITY_ACTOR_SALT` D1 established, so one person stays
+ * SAME {@link hashActorId} + `ACTIVITY_ACTOR_SALT` the server path uses, so one person stays
  * correlatable across the CLI, server, and UI cohorts.
  *
- * USAGE (mirrors D1's reject.ts — resolve the actor ONCE after auth, emit at each
+ * USAGE (mirrors reject.ts — resolve the actor ONCE after auth, emit at each
  * exit point, zero change to the handler's control flow):
  *
  *   const actor = await resolveUiActor(context, { owner: auth.owner });
@@ -125,8 +125,8 @@ export async function resolveUiActor(
 
 /**
  * Emit ONE UI-originated activity event with a PRE-RESOLVED actor. A thin, SYNC
- * wrapper over D1's {@link recordActivity} that stamps `source: "ui"` — so a handler
- * calls it at each exit point (succeeded / failed / refused) exactly as D1's server
+ * wrapper over {@link recordActivity} that stamps `source: "ui"` — so a handler
+ * calls it at each exit point (succeeded / failed / refused) exactly as the server
  * emitters do, with no control-flow change. Best-effort + never throws (inherited
  * from `recordActivity`).
  */

package/apps/storefront/src/lib/activity/workerCommit.ts

@@ -1,9 +1,9 @@
 /**
- * worker_commit — build provenance for the running Worker (card D2).
+ * worker_commit — build provenance for the running Worker.
  *
  * The commit SHA THIS Worker build was cut from, made available REPO-WIDE at
  * runtime so every server-emitted ActivityEvent can carry it (see event.ts
- * `ActivityScope.workerCommit`) and D5 can later derive **deploy skew** — "is the
+ * `ActivityScope.workerCommit`) and the query surface can derive **deploy skew** — "is the
  * build serving this request == the pushed umbrella tip, or is a stale worker
  * still live?".
  *
@@ -15,8 +15,8 @@
  * — we read it through the identical `typeof` guard so both agree by construction,
  * and so the value is safe under vitest (where the define isn't applied → "unknown").
  *
- * This is the single accessor the whole repo threads through: D1's recordActivity()
- * spreads serverActivityScope() into every server event; D2's deploy.version_observed
+ * This is the single accessor the whole repo threads through: recordActivity()
+ * spreads serverActivityScope() into every server event; the deploy.version_observed
  * emitter (deployVersion.ts) reads workerCommit() directly.
  */
 import type { ActivityScope } from "@tot/public-runtime";
@@ -41,7 +41,7 @@ export function workerCommitShort(override?: string): string {
 }
 
 /**
- * True when the build has a real git commit (not the "unknown" sentinel). D5's
+ * True when the build has a real git commit (not the "unknown" sentinel). The
  * skew derivation only compares against the umbrella tip when this holds — an
  * "unknown" build can't be meaningfully skew-checked.
  */
@@ -51,7 +51,7 @@ export function hasKnownWorkerCommit(override?: string): boolean {
 
 /**
  * Build the CORE scope for a SERVER-sourced ActivityEvent with `worker_commit`
- * stamped in. This is the seam D1's recordActivity() spreads into every server
+ * stamped in. This is the seam recordActivity() spreads into every server
  * event so provenance is present WITHOUT each call site remembering it:
  *
  *   createActivityEvent({ ..., source: "server", scope: serverActivityScope({ tenantId }) })