Struct Scoped 

pub struct Scoped<'a, S: TenantScopedStore> { /* private fields */ }

A tenant-tagged borrow of a storage handle.

Scoped<'a, S> is produced by Tenanted::scoped. It bundles a borrow of the inner store with a borrow of the active tenant. The activation defines its domain methods via a trait implemented on Scoped<'a, MyStore> (Rust’s orphan rule forbids inherent impls on a foreign type from another crate; the AUTHZ-DATA-2-MACRO layer generates the trait + impl).

Lifetime

The single 'a lifetime is the shorter of the parent Tenanted<S>’s borrow and the supplied &Tenant. Both must outlive the Scoped. This is what makes “fabricated tenant” and “mismatched tenants” structural failures: the lifetime threads through every call site.

Public surface

The framework supplies only store, tenant, and boundary. The activation’s own domain methods live in a trait implementation on Scoped<'_, MyStore> inside the activation’s own crate.

Sealing

• No fabrication. Constructor is module-private; the only path is Tenanted::scoped.
• No struct-literal. Fields are module-private.
• No Default. Not derived.
• No Deserialize. Not derived; the borrow is not transport.

Implementations

impl<'a> Scoped<'a, InMemoryKvStore>

pub fn put(&self, key: &str, value: Vec<u8>)

Insert a value under the active tenant’s namespace.

pub fn get(&self, key: &str) -> Option<Vec<u8>>

Look up a value under the active tenant’s namespace.

pub fn list_keys(&self) -> Vec<String>

List all keys in the active tenant’s namespace.

impl<'a, S: TenantScopedStore> Scoped<'a, S>

pub fn store(&self) -> &'a S

Borrow the underlying storage handle.

The activation’s domain trait impls on Scoped call this to reach the store’s bare API, paired with tenant to bind the active tenant in queries. There is no path to the bare store that does not require having produced a Scoped, which itself requires a &Tenant.

pub fn tenant(&self) -> &'a Tenant

Borrow the active tenant.

Activation domain methods read this to bind the tenant in every SQL bind, key prefix, namespace, etc.

pub fn boundary(&self) -> TenantBoundary

Return the structural TenantBoundary witness for this scope.

Useful for downstream audit/attestation code that wants a type-level proof that a tenant boundary was crossed.

Trait Implementations

impl<'a, S: TenantScopedStore> Debug for Scoped<'a, S>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.