fix(payment-connector): validate secret key formats client-side at add time

[aidandaly24]

Description

Adds client-side format validation for payment connector secret keys at add time, so a wrong-format key is caught immediately instead of failing later at deploy.

Bug (#1564): A user entered a wrong-format CoinbaseCDP apiKeySecret in the TUI, saw a green-tick "valid", and add payment-connector succeeded — but deploy then failed server-side with Payment API error (400): Invalid apiKeySecret format: Expected base64-encoded Ed25519 private key.

Root cause: Only the StripePrivy authorizationPrivateKey had any format validation, and it lived inline in the CLI action — the TUI never ran it. Every other secret field (including the CoinbaseCDP key fields) was accepted as any non-empty string on both surfaces, so invalid keys were written to .env.local and only rejected by the service at deploy.

Fix: A shared validator module (src/cli/primitives/payment-validation.ts) following the existing validateBYOMountPath pattern — each validator returns true | string, which plugs directly into both the CLI add path and the TUI SecretInput customValidation prop, so the two surfaces validate identically (the same approach used by the session-storage path validation in #1555).

Validated fields (cryptographic, server-enforced format):

• apiKeySecret (CoinbaseCDP) — base64-encoded Ed25519 private key
• walletSecret (CoinbaseCDP) — base64-encoded EC P-256 private key
• authorizationPrivateKey (StripePrivy) — base64-encoded EC P-256, accepting the optional wallet-auth: prefix (now via the shared stripWalletAuthPrefix)

Opaque identifier fields (apiKeyId, appId, appSecret, authorizationId) keep their non-empty checks, since they have no documented format and over-validating risks false rejections. Ed25519 and P-256 keys differ substantially in size (Ed25519 decodes to 32–64 bytes; P-256 PKCS8 to ~138), so each field uses its own decoded-byte band rather than one shared range — reusing the P-256 band for the Ed25519 field would have rejected every valid CDP key.

Related Issue

Closes #1564

Documentation PR

N/A — no doc changes; validation behavior is self-describing via the error messages.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Notes:

• typecheck (0 errors), lint (0 errors), test:unit (5404 passed), test:integ (274 passed) all green. No src/assets/ changes.
• Unit tests in payment-validation.test.ts exercise each validator against real generated Ed25519/P-256 keys, including cross-curve rejection (a P-256 key fails validateApiKeySecret, an Ed25519 key fails validateWalletSecret) and the wallet-auth: prefix.
• Integration fixtures (add-remove-payment.test.ts) now use real keys so the lifecycle tests exercise add/remove rather than tripping the new format check.
• Verified end-to-end against the built CLI: the exact [Bug] add client side validation in payment connector #1564 repro (--api-key-secret randomsecret) is now rejected at add (apiKeySecret must be a base64-encoded Ed25519 private key (unexpected length), exit 1, connector not written), while valid Ed25519 + P-256 keys are accepted.

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[github-actions]

Package Tarball

aws-agentcore-0.20.0.tgz

How to install

gh release download pr-1573-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.20.0.tgz

[agentcore-cli-automation]

Looks good to merge.

Reviewed the changes — the shared validator module is well-factored, plugs into both the CLI and TUI surfaces with the same true | string contract, and correctly addresses the #1564 repro by failing at add time instead of deploy. The Ed25519 vs P-256 byte-band split is well-justified in the comments (reusing one band would have rejected valid CDP keys).

Tests use real generated keys (via generateKeyPairSync) rather than mocked buffers, including good cross-curve rejection coverage. Integration fixtures were updated consistently to use real keys so lifecycle tests don't trip the new format check.

No serious issues found.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	36.84%	13467 / 36555
🔵	Statements	36.13%	14320 / 39634
🔵	Functions	31.26%	2290 / 7325
🔵	Branches	30.6%	8886 / 29039

Generated in workflow #3691 for commit c634937 by the Vitest Coverage Report Action

[notgitika]

                                   _o
                                  .#$?\
                                .'##$ ?$\
                              .'.###$  ?$$\
                            .' .####$   ?$$$\
                          .'  +#####$   `$$$$$\
                        .'   d######$    `$$$$$$\
                      .'   .########$     ?$$$$$$$\
                    .'    .#########$      ?$$$$$$$$\
                  .'     ,##########$       ?$$$$$$$$$\
                .'      +###########$       `?$$$$$$$$$$\
             ..'      .;############$        `$$$$$$$$$$$$\
             |'       ;    ````""""?$         ?$$$$??"""?$$$\
             |_/_____;._______._____$_________)?;__________?;X\___.-.
             /'_____;_|______,|ooooo$oo|o,,,,/..|..___      |`'+\.\.'
          .'||  ,ooooo|ooooodS|SSSSSSSS|SSS/'SSS|SSSSSSSSSSS|SSSS|/
      .  .; |~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~/'
.,;.;';`'(`;|',.;'.'.,,,+','+.,'+,.+,'+..^+,','+.,',.';.'.,+'`;'.';,:'';,:.'
;'.';,:'.,;.;';`'(`;|',.;'.'.,,,+','+.,'+,.+,'+..^+,','+.,',.';.'.,+'`.';,:'