test: cover aid.iid format validation

Adds tests verifying the guards from ec93c50:
- HAPServer GET /characteristics rejects malformed `?id=` entries
  (non-numeric, missing dot, too many dots, empty parts) with 400 +
  HAPStatus.INVALID_VALUE_IN_REQUEST, both for a single bad entry and
  inside a comma-separated list.
- Accessory.handleHAPConnectionClosed skips registered events that do
  not contain a dot separator, instead of feeding an undefined index
  to parseInt.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bwp91

CHANGELOG.md

@@ -15,6 +15,7 @@ All notable changes to `@homebridge/hap-nodejs` will be documented in this file.
 - test: cover SEQUENCE_NUM presence check in pair handlers
 - test: cover M1 reset prevention in pair-setup
 - test: cover safe accessory lookups in slow/timeout warnings
+- test: cover aid.iid format validation
 
 ### Homebridge Dependencies
 

src/lib/Accessory.spec.ts

@@ -1203,6 +1203,33 @@ describe("Accessory", () => {
       });
     });
 
+    describe("aid.iid format validation in handleHAPConnectionClosed (fix ec93c504)", () => {
+      test("should skip registered events without a dot separator", () => {
+        const clearMock = jest.fn();
+        const mockConnection = {
+          getRegisteredEvents: jest.fn().mockReturnValue(new Set([
+            "malformed",         // no dot — without the fix this triggers parseInt(undefined)
+            `${aid}.${iids.on}`, // valid
+          ])),
+          clearRegisteredEvents: clearMock,
+        } as unknown as HAPConnection;
+
+        // @ts-expect-error: private access
+        expect(() => accessory.handleHAPConnectionClosed(mockConnection)).not.toThrow();
+        expect(clearMock).toHaveBeenCalled();
+      });
+
+      test("should skip empty registered event strings", () => {
+        const mockConnection = {
+          getRegisteredEvents: jest.fn().mockReturnValue(new Set(["", `${aid}.${iids.on}`])),
+          clearRegisteredEvents: jest.fn(),
+        } as unknown as HAPConnection;
+
+        // @ts-expect-error: private access
+        expect(() => accessory.handleHAPConnectionClosed(mockConnection)).not.toThrow();
+      });
+    });
+
     describe("non-null assertions in accessory lookups (fix 03b49f9f)", () => {
       test("slow read / timeout warning should not crash for unknown aid.iid in request", async () => {
         jest.useFakeTimers({ doNotFake: ["nextTick", "queueMicrotask"] });

src/lib/HAPServer.spec.ts

@@ -629,6 +629,31 @@ describe("HAPServer", () => {
       });
     });
 
+    describe("GET /characteristics aid.iid format validation (fix ec93c504)", () => {
+      test.each([
+        ["non-numeric aid", "abc.5"],
+        ["non-numeric iid", "1.xyz"],
+        ["missing dot", "1"],
+        ["too many dots", "1.2.3"],
+        ["empty parts", "."],
+        ["empty aid", ".5"],
+        ["empty iid", "1."],
+        ["whitespace", "1. 5"],
+      ])("should reject id=%s (%s) with INVALID_VALUE_IN_REQUEST", async (_label, idValue) => {
+        const httpResponse = await client.writeHTTPRequest("GET", `/characteristics?id=${encodeURIComponent(idValue)}`);
+        expect(httpResponse.statusCode).toBe(HAPHTTPCode.BAD_REQUEST);
+        const body = JSON.parse(httpResponse.body.toString());
+        expect(body.status).toBe(HAPStatus.INVALID_VALUE_IN_REQUEST);
+      });
+
+      test("should reject when one entry in a comma-separated list is malformed", async () => {
+        const httpResponse = await client.writeHTTPRequest("GET", "/characteristics?id=1.5,abc.def");
+        expect(httpResponse.statusCode).toBe(HAPHTTPCode.BAD_REQUEST);
+        const body = JSON.parse(httpResponse.body.toString());
+        expect(body.status).toBe(HAPStatus.INVALID_VALUE_IN_REQUEST);
+      });
+    });
+
     test("test /accessories", async () => {
       const accessoryResponse: AccessoriesResponse = {
         accessories: [{