fix(protect): preserve root array index paths in toJsonPath

- Handle $[0] paths without inserting erroneous dot ($[0] not $.[0])
- Update module documentation to reflect array index support
- Add tests for root array index preservation

Author: tobyhede

packages/protect/__tests__/jsonb-helpers.test.ts

@@ -54,6 +54,14 @@ describe('toJsonPath', () => {
     expect(toJsonPath('[0].name')).toBe('$[0].name')
   })
 
+  it('preserves already-prefixed root array index', () => {
+    expect(toJsonPath('$[0]')).toBe('$[0]')
+  })
+
+  it('preserves already-prefixed root array index with property', () => {
+    expect(toJsonPath('$[0].name')).toBe('$[0].name')
+  })
+
   it('handles large array index', () => {
     expect(toJsonPath('items[999].value')).toBe('$.items[999].value')
   })

packages/protect/src/helpers/jsonb.ts

@@ -1,9 +1,9 @@
 /**
  * JSONB path utilities for converting between path formats.
  *
- * These utilities support simple dot-notation paths only.
- * Path segments are not validated - callers are responsible for ensuring
- * segments contain valid property names (no brackets, quotes, or special chars).
+ * These utilities support dot-notation and basic JSONPath-style array indices (e.g., "[0]").
+ * Only limited validation is performed (forbidden prototype keys); callers should still
+ * ensure segments are valid property names.
  */
 
 /**
@@ -17,6 +17,7 @@
  */
 export function toJsonPath(path: string): string {
   if (!path || path === '$') return '$'
+  if (path.startsWith('$[')) return path
   if (path.startsWith('$.')) return path
   if (path.startsWith('$')) return `$.${path.slice(1)}`
   if (path.startsWith('.')) return `$${path}`