fix(caip): validate full string in caip2Parts and caip10Parts

[bayrakdarerdem]

Summary

caip2Parts and caip10Parts parsed input with caip.split(":") and only
checked that the destructured segments were non-empty. split() doesn't
cap the number of segments, so malformed input with extra trailing
:segments (e.g. "eip155:1:extra") silently parsed as if truncated,
instead of being rejected.

caip10Parts is reached from @agentcommercekit/did's did:pkh
createVerificationMethod, via the public
createDidPkhDocumentFromCaip10AccountId. That entry point doesn't itself
re-validate its input against the CAIP-10 pattern, so a malformed account
ID passed there could previously produce a DID document built from
silently truncated account data instead of throwing.

Fix

Both functions now test the input against their full regex
(caip2ChainIdRegex / caip10AccountIdRegex) before parsing, so
malformed input is rejected up front instead of silently truncated.

Tests

• Added regression tests for both functions (caip10Parts previously had
  no test coverage at all).
• Ran the full caip and did package test suites — all passing.
• Ran lint/format checks — clean.

Changeset

Included (@agentcommercekit/caip patch).

---

Assisted by Claude (Anthropic) — the bug and fix were found and
implemented working interactively through the codebase and tests.

Summary by CodeRabbit

• Bug Fixes

  • Improved validation for CAIP-2 chain IDs and CAIP-10 account IDs.
  • Malformed identifiers with extra segments or missing account addresses are now rejected instead of being partially parsed.
  • Prevented invalid CAIP-10 identifiers from producing incorrect verification methods.

• Tests

  • Added coverage for valid EVM and Solana account IDs and malformed chain/account identifiers.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 14e9701f-835c-46de-a877-b924490f3063

📥 Commits

Reviewing files that changed from the base of the PR and between 0b8fdaa and 5fc0f08.

📒 Files selected for processing (5)

• .changeset/caip-parts-strict-validation.md
• packages/caip/src/caips/caip-10.test.ts
• packages/caip/src/caips/caip-10.ts
• packages/caip/src/caips/caip-2.test.ts
• packages/caip/src/caips/caip-2.ts

---

Walkthrough

CAIP-2 and CAIP-10 parsers now validate complete input strings before splitting. Tests cover valid identifiers and malformed inputs with extra segments or missing account addresses. A changeset documents the behavior and its effect on DID verification-method creation.

Changes

CAIP parser validation

Layer / File(s)	Summary
Full-string validation and regression coverage packages/caip/src/caips/caip-2.ts, packages/caip/src/caips/caip-2.test.ts, packages/caip/src/caips/caip-10.ts, packages/caip/src/caips/caip-10.test.ts, .changeset/caip-parts-strict-validation.md	caip2Parts and caip10Parts validate complete identifiers before parsing. Tests cover valid EVM and Solana account IDs, extra segments, and missing account addresses. The changeset documents the behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• agentcommercekit/ack#67: Both PRs modify CAIP-10 validation and tests, but target different functions.

Suggested reviewers: venables

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: full-string validation in both CAIP parsing functions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}