destr incorrectly parses large numeric strings into unsafe Numbers, causing precision loss

[rockmandash]

Environment

Node.js: v24.3.0
destr: latest (from npm)
OS: macOS

Reproduction

Minimal reproduction:

import destr from 'destr';

const raw = '9007199254740993'; // this is a string, NOT a number

console.log('raw string:', raw);
console.log('destr parsed:', destr(raw));

Output:

raw string: 9007199254740993
destr parsed: 9007199254740992

This demonstrates that destr converts a numeric-looking string into a Number even when it exceeds JavaScript’s MAX_SAFE_INTEGER, causing silent precision loss.

No additional setup is required — just run the snippet above with Node.

Describe the bug

destr() aggressively coerces any “numeric-looking” string into a JavaScript Number.
This becomes a serious bug when the value exceeds the safe integer limit (Number.MAX_SAFE_INTEGER).

Because of this behavior:

• large ID values
• that should always remain strings
• are silently transformed into unsafe floating-point Numbers
• losing precision without any warning

This makes destructuring or parsing environment variables extremely dangerous and leads to corrupted IDs in downstream frameworks (Nuxt/Nitro runtimeConfig, etc.).

In other words:

✔ "123" → 123 is acceptable
✔ "true" → true is acceptable
❌ "9007199254740993" → 9007199254740992 is a silent data corruption

There is no practical scenario where coercing a 16–20 digit string identifier into a floating-point Number is correct.

Many frameworks that rely on destr (Nuxt, Nitro, h3) inherit this problem and unintentionally break user applications.

Additional context

No response

Logs