fix(deep): reject sparse sort input before mutation

.changeset/deep-sort-sparse.md

@@ -0,0 +1,5 @@
+---
+"@cleverbrush/deep": patch
+---
+
+Reject sparse record arrays before sorting so missing elements cannot duplicate existing records or partially mutate input.

libs/deep/README.md

@@ -250,3 +250,4 @@ deepSort(nodes, 1, 'position');
 `RangeError` is thrown. Fields must be arrays containing finite numeric sort keys,
 or a `TypeError` is thrown. All keys are checked before the array is changed.
 Empty input is valid; path depth is independent of the number of records.
+Sparse arrays and missing records are rejected before mutation.

libs/deep/src/deepSort.test.ts

@@ -37,3 +37,12 @@ describe('deepSort', () => {
         expect(() => deepSort(null as never, 0, 'path')).toThrow(TypeError);
     });
 });
+
+it('rejects sparse input before sorting can duplicate an existing item', () => {
+    const input = new Array<{ path: number[] }>(2);
+    const existing = { path: [1] };
+    input[1] = existing;
+    expect(() => deepSort(input, 0, 'path')).toThrow(TypeError);
+    expect(0 in input).toBe(false);
+    expect(input[1]).toBe(existing);
+});

libs/deep/src/deepSort.ts

@@ -1,6 +1,7 @@
 /**
  * Stably sort records in place by one numeric position in an array-valued field.
  *
+ * Input must be a dense array of records; missing entries reject before mutation.
  * All keys are validated before changing the input. An invalid index rejects
  * with RangeError; missing/non-array fields and non-finite keys reject with
  * TypeError. Empty input is valid. Equal keys retain their original order.
@@ -20,7 +21,7 @@ export function deepSort<T extends object>(
         throw new RangeError('index must be a non-negative integer.');
     }
     if (!Array.isArray(items)) throw new TypeError('items must be an array.');
-    const sorted = items.map(item => {
+    const sorted = Array.from(items, item => {
         const values = item?.[field];
         if (!Array.isArray(values)) {
             throw new TypeError('The selected field must be an array.');