feat(mbe): add EdDSA MPCv2 AWM client methods and ME callback factory

Add three methods to AdvancedWalletManagerClient (WCI-893):
  - eddsaMPCv2KeyGenInitialize
  - eddsaMPCv2KeyGenRound1
  - eddsaMPCv2KeyGenFinalize

Each method calls the corresponding AWM endpoint added in the
previous PR, with mTLS agent support.

Add createEddsaMPCv2KeyGenCallbacks factory in
walletGenerationCallbacks.ts (WCI-895): wraps user and backup AWM
clients into an EddsaMPCv2KeyGenCallbacks object whose initialize,
round1, and finalize callbacks fan both clients out in parallel and
merge results for the SDK orchestrator (WCI-916). This replaces the
inline WASM/GPG/DKG key gen logic with AWM-delegated calls, enabling
hardware-backed key generation in the AKM pattern.

Local EddsaMPCv2KeyGenCallbacks type mirrors the WCI-894 shape; it
will be replaced by the SDK import once published.

Three unit tests verify parallel fan-out and result merging for each
callback phase using nock.

Ticket: WCI-895
Session-Id: 4df43c40-1cea-4bcc-ae92-080304169427
Task-Id: 04666b37-650f-4c07-97b0-76a62e98f1ad

Author: Support Bot

src/__tests__/api/master/walletGenerationCallbacks.test.ts

@@ -6,7 +6,10 @@ import {
   createAwmClient,
   AdvancedWalletManagerClient,
 } from '../../../masterBitgoExpress/clients/advancedWalletManagerClient';
-import { createOnchainKeyGenCallback } from '../../../masterBitgoExpress/handlers/walletGenerationCallbacks';
+import {
+  createOnchainKeyGenCallback,
+  createEddsaMPCv2KeyGenCallbacks,
+} from '../../../masterBitgoExpress/handlers/walletGenerationCallbacks';
 import { AppMode, KeySource, MasterExpressConfig, TlsMode } from '../../../shared/types';
 import { DEFAULT_ASYNC_MODE_CONFIG } from './testUtils';
 
@@ -150,4 +153,148 @@ describe('walletGenerationCallbacks', () => {
       }).should.be.rejectedWith('Unexpected key source for onchain key generation: bitgo');
     });
   });
+
+  describe('createEddsaMPCv2KeyGenCallbacks', () => {
+    const enterprise = 'test-enterprise';
+    const bitgoPublicGpgKey = 'test-bitgo-gpg-key';
+
+    beforeEach(() => {
+      const config = makeConfig({ advancedWalletManagerBackupUrl: backupAwmUrl });
+      awmUserClient = createAwmClient(config, coin)!;
+      awmBackupClient = createAwmBackupClient(config, coin)!;
+      assert(awmUserClient);
+      assert(awmBackupClient);
+    });
+
+    it('initializeCallback fans out to user and backup AWM in parallel', async () => {
+      const userInitNock = nock(advancedWalletManagerUrl)
+        .post(`/api/${coin}/eddsampcv2/keygen/initialize`, {
+          source: 'user',
+          enterprise,
+          bitgoPublicGpgKey,
+        })
+        .reply(200, {
+          gpgPublicKey: 'user-gpg-pub',
+          signedMsg1: { message: 'user-msg1', signature: 'user-sig1' },
+          encryptedState: 'user-enc-state',
+          encryptedStateKey: 'user-enc-state-key',
+        });
+
+      const backupInitNock = nock(backupAwmUrl)
+        .post(`/api/${coin}/eddsampcv2/keygen/initialize`, {
+          source: 'backup',
+          enterprise,
+          bitgoPublicGpgKey,
+        })
+        .reply(200, {
+          gpgPublicKey: 'backup-gpg-pub',
+          signedMsg1: { message: 'backup-msg1', signature: 'backup-sig1' },
+          encryptedState: 'backup-enc-state',
+          encryptedStateKey: 'backup-enc-state-key',
+        });
+
+      const callbacks = createEddsaMPCv2KeyGenCallbacks(awmUserClient, awmBackupClient);
+      const result = await callbacks.initializeCallback({ enterprise, bitgoPublicGpgKey });
+
+      result.userGpgPublicKey.should.equal('user-gpg-pub');
+      result.backupGpgPublicKey.should.equal('backup-gpg-pub');
+      result.userSignedMsg1.message.should.equal('user-msg1');
+      result.backupSignedMsg1.message.should.equal('backup-msg1');
+      result.userEncryptedState.should.equal('user-enc-state');
+      result.backupEncryptedState.should.equal('backup-enc-state');
+      userInitNock.done();
+      backupInitNock.done();
+    });
+
+    it('round1Callback fans out to user and backup AWM in parallel', async () => {
+      const bitgoMsg1 = { message: 'bitgo-msg1', signature: 'bitgo-sig1' };
+
+      const userR1Nock = nock(advancedWalletManagerUrl)
+        .post(`/api/${coin}/eddsampcv2/keygen/round1`, {
+          source: 'user',
+          bitgoMsg1,
+          encryptedState: 'user-enc-state',
+          encryptedStateKey: 'user-enc-state-key',
+        })
+        .reply(200, {
+          signedMsg2: { message: 'user-msg2', signature: 'user-sig2' },
+          encryptedState: 'user-enc-state-r1',
+          encryptedStateKey: 'user-enc-state-key-r1',
+        });
+
+      const backupR1Nock = nock(backupAwmUrl)
+        .post(`/api/${coin}/eddsampcv2/keygen/round1`, {
+          source: 'backup',
+          bitgoMsg1,
+          encryptedState: 'backup-enc-state',
+          encryptedStateKey: 'backup-enc-state-key',
+        })
+        .reply(200, {
+          signedMsg2: { message: 'backup-msg2', signature: 'backup-sig2' },
+          encryptedState: 'backup-enc-state-r1',
+          encryptedStateKey: 'backup-enc-state-key-r1',
+        });
+
+      const callbacks = createEddsaMPCv2KeyGenCallbacks(awmUserClient, awmBackupClient);
+      const result = await callbacks.round1Callback({
+        bitgoMsg1,
+        userEncryptedState: 'user-enc-state',
+        userEncryptedStateKey: 'user-enc-state-key',
+        backupEncryptedState: 'backup-enc-state',
+        backupEncryptedStateKey: 'backup-enc-state-key',
+      });
+
+      result.userSignedMsg2.message.should.equal('user-msg2');
+      result.backupSignedMsg2.message.should.equal('backup-msg2');
+      result.userEncryptedState.should.equal('user-enc-state-r1');
+      result.backupEncryptedState.should.equal('backup-enc-state-r1');
+      userR1Nock.done();
+      backupR1Nock.done();
+    });
+
+    it('finalizeCallback fans out to user and backup AWM in parallel', async () => {
+      const bitgoMsg2 = { message: 'bitgo-msg2', signature: 'bitgo-sig2' };
+      const commonPublicKeychain = 'common-keychain-abc123';
+
+      const userFinalizeNock = nock(advancedWalletManagerUrl)
+        .post(`/api/${coin}/eddsampcv2/keygen/finalize`, {
+          source: 'user',
+          bitgoMsg2,
+          commonPublicKeychain,
+          encryptedState: 'user-enc-state',
+          encryptedStateKey: 'user-enc-state-key',
+        })
+        .reply(200, {
+          source: 'user',
+          commonKeychain: commonPublicKeychain,
+        });
+
+      const backupFinalizeNock = nock(backupAwmUrl)
+        .post(`/api/${coin}/eddsampcv2/keygen/finalize`, {
+          source: 'backup',
+          bitgoMsg2,
+          commonPublicKeychain,
+          encryptedState: 'backup-enc-state',
+          encryptedStateKey: 'backup-enc-state-key',
+        })
+        .reply(200, {
+          source: 'backup',
+          commonKeychain: commonPublicKeychain,
+        });
+
+      const callbacks = createEddsaMPCv2KeyGenCallbacks(awmUserClient, awmBackupClient);
+      const result = await callbacks.finalizeCallback({
+        bitgoMsg2,
+        commonPublicKeychain,
+        userEncryptedState: 'user-enc-state',
+        userEncryptedStateKey: 'user-enc-state-key',
+        backupEncryptedState: 'backup-enc-state',
+        backupEncryptedStateKey: 'backup-enc-state-key',
+      });
+
+      result.commonKeychain.should.equal(commonPublicKeychain);
+      userFinalizeNock.done();
+      backupFinalizeNock.done();
+    });
+  });
 });

src/masterBitgoExpress/clients/advancedWalletManagerClient.ts

@@ -39,6 +39,9 @@ import {
   MpcV2InitializeResponseType,
   MpcV2RecoveryResponseType,
   MpcV2RoundResponseType,
+  EddsaMPCv2KeyGenInitializeResponseType,
+  EddsaMPCv2KeyGenRound1ResponseType,
+  EddsaMPCv2KeyGenFinalizeResponseType,
 } from '../../advancedWalletManager/routers/advancedWalletManagerApiSpec';
 import { FormattedOfflineVaultTxInfo } from '@bitgo-beta/abstract-utxo';
 import { RecoveryTxRequest } from '@bitgo-beta/sdk-core';
@@ -822,6 +825,108 @@ export class AdvancedWalletManagerClient {
     }
   }
 
+  /**
+   * Initialize EdDSA MPCv2 key generation
+   */
+  async eddsaMPCv2KeyGenInitialize(params: {
+    source: 'user' | 'backup';
+    enterprise: string;
+    bitgoPublicGpgKey: string;
+  }): Promise<EddsaMPCv2KeyGenInitializeResponseType> {
+    if (!this.coin) {
+      throw new Error('Coin must be specified for EdDSA MPCv2 key generation initialize');
+    }
+
+    try {
+      let request = this.apiClient['v1.eddsampcv2.keygen.initialize'].post({
+        coin: this.coin,
+        ...params,
+      });
+
+      if (this.tlsMode === TlsMode.MTLS) {
+        request = request.agent(this.createHttpsAgent());
+      }
+
+      const response = await request.decodeExpecting(200);
+      return response.body;
+    } catch (error) {
+      logger.error(
+        'Failed to initialize EdDSA MPCv2 key generation: %s',
+        (error as DecodeError).decodedResponse?.body,
+      );
+      throw error;
+    }
+  }
+
+  /**
+   * EdDSA MPCv2 key generation round 1
+   */
+  async eddsaMPCv2KeyGenRound1(params: {
+    source: 'user' | 'backup';
+    bitgoMsg1: { message: string; signature: string };
+    encryptedState: string;
+    encryptedStateKey: string;
+  }): Promise<EddsaMPCv2KeyGenRound1ResponseType> {
+    if (!this.coin) {
+      throw new Error('Coin must be specified for EdDSA MPCv2 key generation round 1');
+    }
+
+    try {
+      let request = this.apiClient['v1.eddsampcv2.keygen.round1'].post({
+        coin: this.coin,
+        ...params,
+      });
+
+      if (this.tlsMode === TlsMode.MTLS) {
+        request = request.agent(this.createHttpsAgent());
+      }
+
+      const response = await request.decodeExpecting(200);
+      return response.body;
+    } catch (error) {
+      logger.error(
+        'Failed EdDSA MPCv2 key generation round 1: %s',
+        (error as DecodeError).decodedResponse?.body,
+      );
+      throw error;
+    }
+  }
+
+  /**
+   * Finalize EdDSA MPCv2 key generation
+   */
+  async eddsaMPCv2KeyGenFinalize(params: {
+    source: 'user' | 'backup';
+    bitgoMsg2: { message: string; signature: string };
+    commonPublicKeychain: string;
+    encryptedState: string;
+    encryptedStateKey: string;
+  }): Promise<EddsaMPCv2KeyGenFinalizeResponseType> {
+    if (!this.coin) {
+      throw new Error('Coin must be specified for EdDSA MPCv2 key generation finalize');
+    }
+
+    try {
+      let request = this.apiClient['v1.eddsampcv2.keygen.finalize'].post({
+        coin: this.coin,
+        ...params,
+      });
+
+      if (this.tlsMode === TlsMode.MTLS) {
+        request = request.agent(this.createHttpsAgent());
+      }
+
+      const response = await request.decodeExpecting(200);
+      return response.body;
+    } catch (error) {
+      logger.error(
+        'Failed to finalize EdDSA MPCv2 key generation: %s',
+        (error as DecodeError).decodedResponse?.body,
+      );
+      throw error;
+    }
+  }
+
   async recoverEcdsaMpcV2Wallet(params: {
     txHex: string;
     pub: string;