bug: `paymentOptionSchema.decimals` uses `toMinValue` (clamps) instead of `minValue` (validates)

[Sertug17]

Summary

paymentOptionSchema in packages/ack-pay/src/schemas/valibot.ts uses v.toMinValue(0) for the decimals field. In valibot, toMinValue is a transformation that silently clamps negative values up to the minimum it is not a validation and does not reject invalid input.

A payment option like { decimals: -6, ... } passes schema validation and is silently mutated to { decimals: 0, ... }. This can corrupt payment precision: a currency that requires 6 decimal places (e.g. USDC) would be stored and processed as integer amounts, causing payments to be off by a factor of 10^6.

Affected file

packages/ack-pay/src/schemas/valibot.ts line 10

Steps to reproduce

import * as v from "valibot"
import { paymentOptionSchema } from "ack-pay"

const result = v.parse(paymentOptionSchema, {
  id: "opt-1",
  amount: 100,
  decimals: -6,      // should be rejected
  currency: "USDC",
  recipient: "did:example:merchant",
})

console.log(result.decimals) // prints 0 silently mutated, no error thrown

Root cause

// packages/ack-pay/src/schemas/valibot.ts
decimals: v.pipe(v.number(), v.integer(), v.toMinValue(0)),
//                                        ^^^^^^^^^^^^ transforms, does not validate

v.toMinValue(min) clamps the value; v.minValue(min) rejects it. The correct action here is v.minValue.

Proposed fix

decimals: v.pipe(v.number(), v.integer(), v.minValue(0)),