Mint a tenant-salted id ${tenantId}_${suffix} after asserting the tenant is
mintable. The single salted-id constructor shared by runIds and memory ids; a
caller with its own suffix precondition (memory-id's PATH_SAFE resourceKey
check) validates that BEFORE delegating here.
The suffix may be a thunk (a uuid generator): it is evaluated ONLY after the
tenant passes assertMintableTenantId, so a caller-supplied producer can never
run its side effects — or throw and mask tenant validation — for an
invalid tenant. Callers with a callback MUST pass the function, not its call,
or JS argument evaluation would defeat this ordering.
Mint a tenant-salted id
${tenantId}_${suffix}after asserting the tenant is mintable. The single salted-id constructor shared by runIds and memory ids; a caller with its own suffix precondition (memory-id's PATH_SAFE resourceKey check) validates that BEFORE delegating here.The suffix may be a thunk (a uuid generator): it is evaluated ONLY after the tenant passes assertMintableTenantId, so a caller-supplied producer can never run its side effects — or throw and mask tenant validation — for an invalid tenant. Callers with a callback MUST pass the function, not its call, or JS argument evaluation would defeat this ordering.