Add type-safe message decoding

src/protocol.ts

@@ -25,9 +25,33 @@ export function encode(msg: ServerMessage): string {
   return JSON.stringify(msg);
 }
 
+function isClientMessage(obj: unknown): obj is ClientMessage {
+  if (typeof obj !== "object" || obj === null) return false;
+  const msg = obj as Record<string, unknown>;
+
+  switch (msg.type) {
+    case "join":
+      return typeof msg.room === "string";
+    case "leave":
+      return true;
+    case "update":
+      return (
+        Array.isArray(msg.data) && msg.data.every((n) => typeof n === "number")
+      );
+    case "awareness":
+      return (
+        Array.isArray(msg.data) && msg.data.every((n) => typeof n === "number")
+      );
+    default:
+      return false;
+  }
+}
+
 export function decode(raw: string): ClientMessage | null {
   try {
-    return JSON.parse(raw) as ClientMessage;
+    const parsed = JSON.parse(raw);
+    if (!isClientMessage(parsed)) return null;
+    return parsed;
   } catch {
     return null;
   }