fix: validate sparse array metadata

[samlaycock]

Summary

• Validate sparse array metadata before resizing decoded arrays.
• Throw a clear metadata error if the declared array:<length> would truncate decoded entries.
• Add regression coverage for array:2 with items[5] and array:100000 with items[100000].
• Add a patch changeset for the decoder bug fix.

Closes #67.

Testing

• bun fmt
• bun lint:fix
• bun test
• bun typecheck

[greptile-apps]

Greptile Summary

This PR fixes a silent data-truncation bug where a array:<length> metadata annotation shorter than the actual decoded indices would silently drop those entries after unflattenParsed. It does so by adding a validateSparseArrayLength guard that walks Object.keys of every target array before the .length assignment and throws a descriptive TypeError if any index would be truncated.

• src/decode.ts: introduces validateSparseArrayLength(path, value, length), threads path through the refactored resizeArray, and calls the guard at both the root-level and nested resize sites.
• test/roundtrip.test.ts: adds two regression tests — one for the straight truncation case (array:2 / index 5) and one for the exact-boundary case (array:100000 / index 100000) — both asserting the new error message verbatim.

Confidence Score: 5/5

Safe to merge — the change is a targeted guard added at both resize call sites with no modifications to the unflattening or deserialization logic.

The validation logic is correct: Object.keys on the decoded array returns only set numeric indices, the !Number.isInteger(index) branch correctly skips any non-numeric property keys, and the index < length comparison accurately distinguishes safe indices from ones that would be chopped off. Both the basic-truncation and exact-boundary edge cases are covered by the new tests. The resizeArray signature change is mechanical and all callers have been updated.

No files require special attention.

Important Files Changed

Filename	Overview
src/decode.ts	Adds validateSparseArrayLength helper that walks Object.keys before every array resize and throws a descriptive TypeError when a declared sparse-array length would truncate an existing index; resizeArray signature gains a path argument to thread into the error message.
test/roundtrip.test.ts	Adds two regression tests: one for the basic truncation case (array:2 vs index 5) and one for the exact-boundary case (array:100000 vs index 100000), both asserting the new TypeError message.
.changeset/validate-sparse-array-metadata.md	New patch-level changeset entry describing the decoder bug fix.

_{Reviews (1): Last reviewed commit: "fix: validate sparse array metadata" | Re-trigger Greptile}