Struct Provenance 

pub struct Provenance {
    pub trace: TraceContext,
    pub tenant: Option<Arc<TenantConfig>>,
    pub claims: Option<Arc<Claims>>,
    pub session: Option<Arc<Session>>,
}

Who/where/why for one unit of work — identical shape across transports.

Fields

trace: TraceContext

W3C trace identity: continued from the caller/producer, or a fresh root.

tenant: Option<Arc<TenantConfig>>

Resolved + validated tenant (None = unknown without fallback, or suspended — callers must treat suspended as a hard cut-off).

claims: Option<Arc<Claims>>

Decoded principal claims (JWT / signed cookie), when presented.

session: Option<Arc<Session>>

Server-side session, when the session pipeline matched a cookie.

Implementations

impl Provenance

pub async fn from_headers( headers: &HeaderMap, container: &'static FrozenDiContainer, ) -> Self

HTTP requests and WebSocket handshakes: headers carry everything.

This is the ONE place trace + tenant + credentials meet a header map.

pub fn from_message( msg: &InboundMessage, container: &'static FrozenDiContainer, ) -> Self

Consumer-mesh messages: the producing request’s identity rides the envelope. The tenant id is validated against the SAME registry as HTTP — a suspended tenant’s queued events resolve to None and stop being processed — and the producer’s traceparent continues the distributed trace instead of starting an orphan root.

Messages authenticate at the transport (broker credentials), not per event, so claims/session are absent by design.

pub fn traceparent(&self) -> String

traceparent for stamping outbound hops (HTTP calls, outbox rows, queue envelopes).