fix(ack-pay): reject a negative decimals instead of clamping it

[crazywriter1]

Problem

paymentOptionSchema validates decimals with valibot's toMinValue(0). That is a transformation that clamps, not a validation that rejects, so a negative value parses successfully as 0:

input decimals : -2
valibot output : 0
zod accepts?   : false
zod error      : Too small: expected number to be >=0

decimals scales amount, so this does not just normalize a stray value — it turns an invalid payment option into a valid one asking for a different sum, and it does so silently. It applies on the verification path too, since verifyPaymentRequestToken parses token payloads with this schema.

The zod schema next to it already uses z.number().int().nonnegative(), so the two validators disagreed about which payment requests are well-formed. Every other bound in the repo uses the validating form (v.minValue), which is what makes this look like a slip rather than a decision.

Fix

v.toMinValue(0) becomes v.minValue(0), plus a test that a negative decimals is rejected. After the change both validators reject the same input and valid values still parse.

This is a breaking change in the sense that input previously accepted now fails, which is the point: accepting it was the bug. Nothing in the repo passes a negative decimals, so no existing caller breaks.

Testing

pnpm check passes.

AI usage disclosure

Per AI_POLICY.md: this change was AI-assisted using Cursor.

Summary by CodeRabbit

• Bug Fixes

  • Payment validation now rejects negative decimal values instead of silently converting them to zero.
  • Payment request verification preserves the intended payment amounts and aligns validation behavior across supported schemas.

• Tests

  • Added coverage confirming that payment requests with negative decimal values are rejected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bb498080-0c2d-4906-84a4-47b457826847

📥 Commits

Reviewing files that changed from the base of the PR and between 0b8fdaa and be20d2a.

📒 Files selected for processing (3)

• .changeset/payment-option-decimals-validation.md
• packages/ack-pay/src/payment-request.test.ts
• packages/ack-pay/src/schemas/valibot.ts

---

Walkthrough

The payment option schema now rejects negative decimals values instead of converting them to zero. A regression test covers invalid payment requests, and a changeset documents the release.

Changes

Payment decimals validation

Layer / File(s)	Summary
Schema validation and regression coverage packages/ack-pay/src/schemas/valibot.ts, packages/ack-pay/src/payment-request.test.ts, .changeset/payment-option-decimals-validation.md	paymentOptionSchema.decimals now uses minValue(0). isPaymentRequest tests reject negative decimals values. The changeset records the validation change.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to be20d

The change makes negative decimal values fail validation instead of being silently converted to zero, with a focused test covering the behavior. No actionable merge-blocking risk remains beyond normal checks and review.

Possibly related issues

• bug: paymentOptionSchema.decimals uses toMinValue (clamps) instead of minValue (validates) #147: The change matches the issue’s proposed replacement of toMinValue(0) with minValue(0) and adds regression coverage.

Possibly related PRs

• agentcommercekit/ack#149: This PR makes the same schema validator change and adds validation coverage.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: rejecting negative decimals instead of clamping them.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[crazywriter1]

Closing as a duplicate of #149, which makes the same change and landed first. Sorry.