The single place the ${tenantId}_${uuid} carrier is decoded. Returns the
validated tenant prefix, or undefined when the runId carries none.
Centralized for the same reason RunnerRuntime composes #runKey in one
place: this parse IS the tenant boundary, so four hand-rolled
indexOf('_') decodes would drift (and did — one skipped the pattern
check). Callers apply their own policy on undefined: the DO throws (an
unscoped grant store is a cross-tenant mint), the grant provider mints an
empty list, the runtime mints no isolation scope.
Safe: the tenant-ID pattern excludes '_' from tenantId, so the first underscore is always
the boundary regardless of what the uuid half contains.
The single place the
${tenantId}_${uuid}carrier is decoded. Returns the validated tenant prefix, or undefined when the runId carries none.Centralized for the same reason RunnerRuntime composes
#runKeyin one place: this parse IS the tenant boundary, so four hand-rolledindexOf('_')decodes would drift (and did — one skipped the pattern check). Callers apply their own policy on undefined: the DO throws (an unscoped grant store is a cross-tenant mint), the grant provider mints an empty list, the runtime mints no isolation scope.Safe: the tenant-ID pattern excludes '_' from tenantId, so the first underscore is always the boundary regardless of what the uuid half contains.