better

src/atpasser/model/types/string.py

···
     @classmethod
     def _validate_did(cls, v: str) -> None:
         """Validate DID format"""
-        if not v.startswith("did:"):
-            raise ValueError("DID must start with 'did:'")
         if len(v) > 2048:
             raise ValueError("DID too long, max 2048 chars")
+        if not re.match(r"^did:[a-z]+:[a-zA-Z0-9._:%-]*[a-zA-Z0-9._-]$", v):
+            raise ValueError("Invalid URI format")
     
     @classmethod
     def _validate_handle(cls, v: str) -> None:
         """Validate handle format"""
-        if not re.match(r"^[a-zA-Z0-9._-]+$", v):
+        if not re.match(r"^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$", v):
             raise ValueError("Handle contains invalid characters")
         if len(v) > 253:
             raise ValueError("Handle too long, max 253 chars")
···
 
     @classmethod
     def _validate_at_uri(cls, v: str) -> None:
-        """Validate AT-URI format"""
+        """
+        Validate AT-URI format according to AT Protocol specification.
+        
+        Args:
+            v: AT-URI string to validate
+            
+        Raises:
+            ValueError: If URI violates any of these rules:
+                - Must start with 'at://'
+                - Max length 8KB
+                - No trailing slash
+                - Authority must be valid DID or handle
+                - Path segments must follow NSID/RKEY rules if present
+        """
         if not v.startswith("at://"):
             raise ValueError("AT-URI must start with 'at://'")
-        if len(v) > 8000:
-            raise ValueError("AT-URI too long, max 8000 chars")
+        if len(v) > 8192:  # 8KB
+            raise ValueError("AT-URI too long, max 8KB")
+        if v.endswith('/'):
+            raise ValueError("AT-URI cannot have trailing slash")
+            
+        # Split into parts
+        parts = v[5:].split('/')  # Skip 'at://'
+        authority = parts[0]
+        
+        # Validate authority (DID or handle)
+        if not authority:
+            raise ValueError("AT-URI must have authority")
+            
+        if authority.startswith('did:'):
+            # Basic DID format check - actual DID validation is done elsewhere
+            if len(authority) > 2048:
+                raise ValueError("DID too long")
+            if ':' not in authority[4:]:
+                raise ValueError("Invalid DID format")
+        else:
+            # Handle validation
+            if not re.match(r'^[a-z0-9.-]+$', authority):
+                raise ValueError("Invalid handle characters")
+            if len(authority) > 253:
+                raise ValueError("Handle too long")
+                
+        # Validate path segments if present
+        if len(parts) > 1:
+            if len(parts) > 3:
+                raise ValueError("AT-URI path too deep")
+                
+            collection = parts[1]
+            if not re.match(r'^[a-zA-Z0-9.-]+$', collection):
+                raise ValueError("Invalid collection NSID")
+                
+            if len(parts) > 2:
+                rkey = parts[2]
+                if not rkey:
+                    raise ValueError("Record key cannot be empty")
+                if not re.match(r'^[a-zA-Z0-9._:%-~]+$', rkey):
+                    raise ValueError("Invalid record key characters")
 
     @classmethod
     def _validate_cid(cls, v: str) -> None:
···
         """Validate NSID format"""
         if len(v) > 317:
             raise ValueError("NSID too long, max 317 chars")
-        if not re.match(r"^[a-zA-Z0-9.-]+$", v):
+        if not re.match(r"^[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)+(\.[a-zA-Z]([a-zA-Z0-9]{0,62})?)$", v):
             raise ValueError("NSID contains invalid characters")
 
     @classmethod
···
         """Validate TID format"""
         if len(v) > 13:
             raise ValueError("TID too long, max 13 chars")
-        if not re.match(r"^[234567abcdefghijklmnopqrstuvwxyz]+$", v):
+        if not re.match(r"^[234567abcdefghij][234567abcdefghijklmnopqrstuvwxyz]{12}$", v):
             raise ValueError("TID contains invalid characters")
 
     @classmethod
···
         """Validate record-key format"""
         if len(v) > 512:
             raise ValueError("Record key too long, max 512 chars")
+        if v == "." or v == "..":
+            raise ValueError(f"Record key is {v}, which is not allowed")
         if not re.match(r"^[a-zA-Z0-9._:%-~]+$", v):
             raise ValueError("Record key contains invalid characters")