Function wrap_stream 

pub fn wrap_stream<T: Serialize + Send + 'static>(
    stream: impl Stream<Item = T> + Send + 'static,
    content_type: &'static str,
    provenance: Vec<String>,
) -> PlexusStream

Wrap a typed stream into PlexusStream with automatic Done event

This is the core helper for the caller-wraps architecture. Activations return typed domain events (e.g., HealthEvent), and the caller wraps them with metadata. A Done event is automatically appended when the stream completes.

Dispatch-time credential interception (AUTHZ-CRED-CORE-2)

For every emitted item, this function routes the serialization through the dispatch-time credential capture machinery: a fresh sidecar is installed (per the RAII guard documented in plexus_auth_core::DispatchCaptureGuard), serialization runs (and each Credential<T> field emits its sentinel inline while the inner value is captured into the sidecar), and the resulting (payload, captured) pair is assembled into a wire envelope with an optional _credentials field. Payloads with zero Credential<T> fields are wire-format-identical to today (additive only).

See crate::plexus::credential_envelope for the envelope assembly rules and plans/AUTHZ/AUTHZ-CRED-CORE-2.md for the contract.

Example

let stream = health.check();  // Returns Stream<Item = HealthEvent>
let wrapped = wrap_stream(stream, "health.status", vec!["health".into()]);
// Stream will emit: Data, Data, ..., Done