fix(caip): reject CAIP-2/CAIP-10 IDs with extra colon-delimited segments

[batuhankocyigit]

Bug

caip2Parts and caip10Parts parse their input with caip.split(":") and
destructure the expected number of parts, but never check whether there
were more parts than expected. A string like "eip155:1:evil" is invalid
per the CAIP-2 spec (the reference component [-_a-zA-Z0-9]{1,32} cannot
contain a colon), but caip2Parts currently accepts it, silently dropping
the "evil" segment and returning { namespace: "eip155", reference: "1" }
instead of throwing. Same issue in caip10Parts with a 4th segment.

This mirrors the exact bug class fixed in createCaip10AccountId in #67 —
that fix validates with caip2ChainIdRegex/caip10AccountAddressRegex
before constructing an ID, but the "Parts" parsing functions going the
other direction (string → components) were never covered, and have no
tests for malformed multi-segment input.

Both functions are exported from @agentcommercekit/caip's public API, so
downstream consumers calling them directly on untrusted input (e.g. a CAIP
string embedded in a DID or credential) would get a silently-truncated
parse instead of a validation error.

Current call sites in this repo (packages/did/src/methods/did-pkh.ts)
happen to already validate upstream with isCaip10AccountId /
createCaip10AccountId, so this isn't exploitable through them today —
this is a defense-in-depth / spec-conformance fix for the exported function
itself.

Fix

Both functions now also check that split(":") produced exactly the
expected number of segments, throwing the existing error message otherwise.

Testing

Added tests reproducing the bug (confirmed they fail on unpatched main:
"expected [Function] to throw an error"), passing with the fix. Also added
missing basic coverage for caip10Parts, which had none before.

• packages/caip: 86/86 passing (was 27/27 before this PR's added tests)
• packages/did (the package that actually calls caip10Parts): 74/74
  passing, no regressions
• oxlint and tsc --noEmit: clean

AI usage disclosure

Per AI_POLICY.md: this fix was found and implemented with Claude (Anthropic).
I asked it to review the caip package for validation gaps given the recent
#67 fix in the same area; it identified the split-based truncation issue,
wrote the failing tests, confirmed them against unpatched main, then
applied and verified the fix and ran the affected package + downstream
consumer test suites. I've reviewed the diff and understand the bug and
the fix — happy to answer any questions about it.

Summary by CodeRabbit

• Bug Fixes

  • Improved validation for chain and account identifiers.
  • Invalid identifiers containing extra colon-separated segments are now rejected.
  • Existing validation for missing namespaces or references remains intact.

• Tests

  • Added coverage for valid, incomplete, empty, and malformed identifier inputs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d39b158f-434c-4c03-8a8d-18709a0e5c1a

📥 Commits

Reviewing files that changed from the base of the PR and between 0b8fdaa and 24b81db.

📒 Files selected for processing (4)

• packages/caip/src/caips/caip-10.test.ts
• packages/caip/src/caips/caip-10.ts
• packages/caip/src/caips/caip-2.test.ts
• packages/caip/src/caips/caip-2.ts

---

Walkthrough

The CAIP-2 and CAIP-10 parsers now reject identifiers with extra colon-delimited segments. Tests cover the new validation and existing invalid-input cases.

Changes

CAIP identifier segment validation

Layer / File(s)	Summary
CAIP-2 segment validation packages/caip/src/caips/caip-2.ts, packages/caip/src/caips/caip-2.test.ts	caip2Parts rejects chain IDs with more than two segments. A regression test verifies the validation error.
CAIP-10 segment validation packages/caip/src/caips/caip-10.ts, packages/caip/src/caips/caip-10.test.ts	caip10Parts requires three segments. Tests cover valid, empty, incomplete, and extra-segment account IDs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to 24b81

This PR makes CAIP parsing reject malformed IDs with extra segments while preserving valid parsing behavior; the affected tests and downstream package checks pass, so no actionable merge-blocking risk remains beyond normal checks.

Possibly related PRs

• agentcommercekit/ack#143: Both PRs update CAIP-2 and CAIP-10 parsing to reject extra colon-delimited segments.

Suggested reviewers: venables

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: rejecting CAIP-2 and CAIP-10 IDs with extra colon-delimited segments.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}