isId(null, "user"); // => false ✅ hardened
getPrefix(null); // => TypeError: Cannot read properties of null (reading 'indexOf')
parseId(undefined); // => same crash
getTimestamp(null); // => undefined ✅ hardened
Half the read-side API tolerates untrusted input and half crashes. For a library whose whole job is inspecting IDs that arrive from request bodies, query strings, and databases — and which explicitly supports plain JavaScript, where the compiler isn't there to help — that inconsistency is the surprising kind.
What to do — add a typeof value !== "string" guard returning undefined in getPrefix and parseId (src/utils/validate.ts), matching isId/getTimestamp.
Acceptance criteria — getPrefix/parseId return undefined for null, undefined, numbers, and objects; tests added to test/validate.test.ts.
Half the read-side API tolerates untrusted input and half crashes. For a library whose whole job is inspecting IDs that arrive from request bodies, query strings, and databases — and which explicitly supports plain JavaScript, where the compiler isn't there to help — that inconsistency is the surprising kind.
What to do — add a typeof value !== "string" guard returning undefined in getPrefix and parseId (src/utils/validate.ts), matching isId/getTimestamp.
Acceptance criteria — getPrefix/parseId return undefined for null, undefined, numbers, and objects; tests added to test/validate.test.ts.