fix: reject timestamps above sortable range

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - `getPrefix(value, separator?)` and `parseId(value, separator?)` now return `undefined` for non-string input instead of throwing, matching `isId` and `getTimestamp`.
 - `parseId()` now returns `undefined` when the ID body following the separator is empty (e.g., `"user_"`).
+- `getTimestamp()` now rejects decoded values above `SORTABLE_TIME_MAX`, so non-sortable random IDs are not reported as plausible timestamps.
 
 ## [1.1.0] - 2026-08-16
 

src/generators/sortable.ts

@@ -184,7 +184,14 @@ export function getTimestamp(
   const body = value.slice(index + separator.length);
   if (body.length < timestampSize) return undefined;
 
-  return decodeTime(body.slice(0, timestampSize), alphabet, timestampSize);
+  const timestamp = decodeTime(
+    body.slice(0, timestampSize),
+    alphabet,
+    timestampSize,
+  );
+  return timestamp !== undefined && timestamp > SORTABLE_TIME_MAX
+    ? undefined
+    : timestamp;
 }
 
 export function getTimestampOrThrow(

test/sortable.test.ts

@@ -170,6 +170,12 @@ describe("getTimestamp()", () => {
     // '-' is not in base62, so decoding must fail cleanly.
     expect(getTimestamp("u_----------aaaaaaaaaaaaaaaa")).toBeUndefined();
   });
+
+  it("returns undefined for a decoded timestamp above the sortable ceiling", () => {
+    const value = "evt_zzzzzzzzz000000000000";
+    expect(getTimestamp(value)).toBeUndefined();
+    expect(() => getTimestampOrThrow(value)).toThrow(TypeError);
+  });
 });
 
 describe("createSortableId() — configuration", () => {
@@ -362,11 +368,10 @@ describe("getDate()", () => {
     expect(SORTABLE_TIME_MAX).toBeLessThan(MAX_DATE_MS);
   });
 
-  it("returns a Date exactly at the Date-range ceiling and undefined just past it", () => {
+  it("returns undefined for a timestamp outside the sortable time range", () => {
     const at = (t: number) =>
       createSortableId({ now: () => t, monotonic: false })("evt");
 
-    expect(getDate(at(MAX_DATE_MS))).toBeInstanceOf(Date);
-    expect(getDate(at(MAX_DATE_MS + 1))).toBeUndefined();
+    expect(getDate(at(MAX_DATE_MS))).toBeUndefined();
   });
 });