Summary
controllerClaimSchema in both Valibot and Zod uses bare string() for id and controller. Empty strings pass structural validation even though controller credentials always carry DID URIs (createControllerCredential types both as DidUri).
That matches the empty-string hole recently addressed for ACK-Pay payment fields: identifiers that must be meaningful should reject blanks at the schema boundary.
Affected files
packages/ack-id/src/schemas/valibot.tspackages/ack-id/src/schemas/zod.ts
Expected
{ id: \"\", controller: \"did:web:example.com\" } and the reverse should fail safeParse / safeParse in both venues.
Proposed fix
Require non-empty strings (or didUriSchema) for both fields in Valibot and Zod, with parity tests.
AI usage disclosure
Drafted with Cursor assistance; I reviewed the controller claim verifier and credential creator types before proposing this.
Summary
controllerClaimSchemain both Valibot and Zod uses barestring()foridandcontroller. Empty strings pass structural validation even though controller credentials always carry DID URIs (createControllerCredentialtypes both asDidUri).That matches the empty-string hole recently addressed for ACK-Pay payment fields: identifiers that must be meaningful should reject blanks at the schema boundary.
Affected files
packages/ack-id/src/schemas/valibot.tspackages/ack-id/src/schemas/zod.tsExpected
{ id: \"\", controller: \"did:web:example.com\" }and the reverse should failsafeParse/safeParsein both venues.Proposed fix
Require non-empty strings (or
didUriSchema) for both fields in Valibot and Zod, with parity tests.AI usage disclosure
Drafted with Cursor assistance; I reviewed the controller claim verifier and credential creator types before proposing this.