feat(dkg): add EdDSA MPCv2 AWM client methods and ME callback factory

Add three methods to AdvancedWalletManagerClient (WCI-893):
  - eddsaMPCv2KeyGenInitialize
  - eddsaMPCv2KeyGenRound1
  - eddsaMPCv2KeyGenFinalize

Each method calls the corresponding AWM endpoint added in the
previous PR, with mTLS agent support.

Add createEddsaMPCv2KeyGenCallbacks in walletGenerationCallbacks.ts
(WCI-895): the factory wraps user and backup AWM clients into an
EddsaMPCv2KeyGenCallbacks object whose initialize, round1, and
finalize callbacks fan both clients out in parallel and merge results
for the SDK's createKeychainsWithExternalSigner orchestrator
(WCI-916). This replaces the WASM/GPG/DKG logic that currently runs
inline in EddsaMPCv2Utils.createKeychains with AWM-delegated calls,
enabling hardware-backed key generation in the AKM pattern.

Local EddsaMPCv2KeyGenCallbacks type definitions mirror the shape
from BitGoJS WCI-894 and will be replaced by the SDK import once
published.

Three unit tests verify parallel fan-out and result merging for each
callback phase using nock.

Ticket: WCI-895
Session-Id: 4df43c40-1cea-4bcc-ae92-080304169427
Task-Id: 04666b37-650f-4c07-97b0-76a62e98f1ad

Author: Support Bot

src/__tests__/api/master/walletGenerationCallbacks.test.ts

@@ -6,7 +6,10 @@ import {
   createAwmClient,
   AdvancedWalletManagerClient,
 } from '../../../masterBitgoExpress/clients/advancedWalletManagerClient';
-import { createOnchainKeyGenCallback } from '../../../masterBitgoExpress/handlers/walletGenerationCallbacks';
+import {
+  createOnchainKeyGenCallback,
+  createEddsaMPCv2KeyGenCallbacks,
+} from '../../../masterBitgoExpress/handlers/walletGenerationCallbacks';
 import { AppMode, KeySource, MasterExpressConfig, TlsMode } from '../../../shared/types';
 import { DEFAULT_ASYNC_MODE_CONFIG } from './testUtils';
 
@@ -150,4 +153,148 @@ describe('walletGenerationCallbacks', () => {
       }).should.be.rejectedWith('Unexpected key source for onchain key generation: bitgo');
     });
   });
+
+  describe('createEddsaMPCv2KeyGenCallbacks', () => {
+    const enterprise = 'test-enterprise';
+    const bitgoPublicGpgKey = 'test-bitgo-gpg-key';
+
+    beforeEach(() => {
+      const config = makeConfig({ advancedWalletManagerBackupUrl: backupAwmUrl });
+      awmUserClient = createAwmClient(config, coin)!;
+      awmBackupClient = createAwmBackupClient(config, coin)!;
+      assert(awmUserClient);
+      assert(awmBackupClient);
+    });
+
+    it('initializeCallback fans out to user and backup AWM in parallel', async () => {
+      const userInitNock = nock(advancedWalletManagerUrl)
+        .post(`/api/${coin}/eddsampcv2/keygen/initialize`, {
+          source: 'user',
+          enterprise,
+          bitgoPublicGpgKey,
+        })
+        .reply(200, {
+          gpgPublicKey: 'user-gpg-pub',
+          signedMsg1: { message: 'user-msg1', signature: 'user-sig1' },
+          encryptedState: 'user-enc-state',
+          encryptedStateKey: 'user-enc-state-key',
+        });
+
+      const backupInitNock = nock(backupAwmUrl)
+        .post(`/api/${coin}/eddsampcv2/keygen/initialize`, {
+          source: 'backup',
+          enterprise,
+          bitgoPublicGpgKey,
+        })
+        .reply(200, {
+          gpgPublicKey: 'backup-gpg-pub',
+          signedMsg1: { message: 'backup-msg1', signature: 'backup-sig1' },
+          encryptedState: 'backup-enc-state',
+          encryptedStateKey: 'backup-enc-state-key',
+        });
+
+      const callbacks = createEddsaMPCv2KeyGenCallbacks(awmUserClient, awmBackupClient);
+      const result = await callbacks.initializeCallback({ enterprise, bitgoPublicGpgKey });
+
+      result.userGpgPublicKey.should.equal('user-gpg-pub');
+      result.backupGpgPublicKey.should.equal('backup-gpg-pub');
+      result.userSignedMsg1.message.should.equal('user-msg1');
+      result.backupSignedMsg1.message.should.equal('backup-msg1');
+      result.userEncryptedState.should.equal('user-enc-state');
+      result.backupEncryptedState.should.equal('backup-enc-state');
+      userInitNock.done();
+      backupInitNock.done();
+    });
+
+    it('round1Callback fans out to user and backup AWM in parallel', async () => {
+      const bitgoMsg1 = { message: 'bitgo-msg1', signature: 'bitgo-sig1' };
+
+      const userR1Nock = nock(advancedWalletManagerUrl)
+        .post(`/api/${coin}/eddsampcv2/keygen/round1`, {
+          source: 'user',
+          bitgoMsg1,
+          encryptedState: 'user-enc-state',
+          encryptedStateKey: 'user-enc-state-key',
+        })
+        .reply(200, {
+          signedMsg2: { message: 'user-msg2', signature: 'user-sig2' },
+          encryptedState: 'user-enc-state-r1',
+          encryptedStateKey: 'user-enc-state-key-r1',
+        });
+
+      const backupR1Nock = nock(backupAwmUrl)
+        .post(`/api/${coin}/eddsampcv2/keygen/round1`, {
+          source: 'backup',
+          bitgoMsg1,
+          encryptedState: 'backup-enc-state',
+          encryptedStateKey: 'backup-enc-state-key',
+        })
+        .reply(200, {
+          signedMsg2: { message: 'backup-msg2', signature: 'backup-sig2' },
+          encryptedState: 'backup-enc-state-r1',
+          encryptedStateKey: 'backup-enc-state-key-r1',
+        });
+
+      const callbacks = createEddsaMPCv2KeyGenCallbacks(awmUserClient, awmBackupClient);
+      const result = await callbacks.round1Callback({
+        bitgoMsg1,
+        userEncryptedState: 'user-enc-state',
+        userEncryptedStateKey: 'user-enc-state-key',
+        backupEncryptedState: 'backup-enc-state',
+        backupEncryptedStateKey: 'backup-enc-state-key',
+      });
+
+      result.userSignedMsg2.message.should.equal('user-msg2');
+      result.backupSignedMsg2.message.should.equal('backup-msg2');
+      result.userEncryptedState.should.equal('user-enc-state-r1');
+      result.backupEncryptedState.should.equal('backup-enc-state-r1');
+      userR1Nock.done();
+      backupR1Nock.done();
+    });
+
+    it('finalizeCallback fans out to user and backup AWM in parallel', async () => {
+      const bitgoMsg2 = { message: 'bitgo-msg2', signature: 'bitgo-sig2' };
+      const commonPublicKeychain = 'common-keychain-abc123';
+
+      const userFinalizeNock = nock(advancedWalletManagerUrl)
+        .post(`/api/${coin}/eddsampcv2/keygen/finalize`, {
+          source: 'user',
+          bitgoMsg2,
+          commonPublicKeychain,
+          encryptedState: 'user-enc-state',
+          encryptedStateKey: 'user-enc-state-key',
+        })
+        .reply(200, {
+          source: 'user',
+          commonKeychain: commonPublicKeychain,
+        });
+
+      const backupFinalizeNock = nock(backupAwmUrl)
+        .post(`/api/${coin}/eddsampcv2/keygen/finalize`, {
+          source: 'backup',
+          bitgoMsg2,
+          commonPublicKeychain,
+          encryptedState: 'backup-enc-state',
+          encryptedStateKey: 'backup-enc-state-key',
+        })
+        .reply(200, {
+          source: 'backup',
+          commonKeychain: commonPublicKeychain,
+        });
+
+      const callbacks = createEddsaMPCv2KeyGenCallbacks(awmUserClient, awmBackupClient);
+      const result = await callbacks.finalizeCallback({
+        bitgoMsg2,
+        commonPublicKeychain,
+        userEncryptedState: 'user-enc-state',
+        userEncryptedStateKey: 'user-enc-state-key',
+        backupEncryptedState: 'backup-enc-state',
+        backupEncryptedStateKey: 'backup-enc-state-key',
+      });
+
+      result.commonKeychain.should.equal(commonPublicKeychain);
+      userFinalizeNock.done();
+      backupFinalizeNock.done();
+    });
+  });
 });

src/masterBitgoExpress/clients/advancedWalletManagerClient.ts

@@ -39,6 +39,9 @@ import {
   MpcV2InitializeResponseType,
   MpcV2RecoveryResponseType,
   MpcV2RoundResponseType,
+  EddsaMPCv2KeyGenInitializeResponseType,
+  EddsaMPCv2KeyGenRound1ResponseType,
+  EddsaMPCv2KeyGenFinalizeResponseType,
 } from '../../advancedWalletManager/routers/advancedWalletManagerApiSpec';
 import { FormattedOfflineVaultTxInfo } from '@bitgo-beta/abstract-utxo';
 import { RecoveryTxRequest } from '@bitgo-beta/sdk-core';
@@ -822,6 +825,108 @@ export class AdvancedWalletManagerClient {
     }
   }
 
+  /**
+   * Initialize EdDSA MPCv2 key generation
+   */
+  async eddsaMPCv2KeyGenInitialize(params: {
+    source: 'user' | 'backup';
+    enterprise: string;
+    bitgoPublicGpgKey: string;
+  }): Promise<EddsaMPCv2KeyGenInitializeResponseType> {
+    if (!this.coin) {
+      throw new Error('Coin must be specified for EdDSA MPCv2 key generation initialize');
+    }
+
+    try {
+      let request = this.apiClient['v1.eddsampcv2.keygen.initialize'].post({
+        coin: this.coin,
+        ...params,
+      });
+
+      if (this.tlsMode === TlsMode.MTLS) {
+        request = request.agent(this.createHttpsAgent());
+      }
+
+      const response = await request.decodeExpecting(200);
+      return response.body;
+    } catch (error) {
+      logger.error(
+        'Failed to initialize EdDSA MPCv2 key generation: %s',
+        (error as DecodeError).decodedResponse?.body,
+      );
+      throw error;
+    }
+  }
+
+  /**
+   * EdDSA MPCv2 key generation round 1
+   */
+  async eddsaMPCv2KeyGenRound1(params: {
+    source: 'user' | 'backup';
+    bitgoMsg1: { message: string; signature: string };
+    encryptedState: string;
+    encryptedStateKey: string;
+  }): Promise<EddsaMPCv2KeyGenRound1ResponseType> {
+    if (!this.coin) {
+      throw new Error('Coin must be specified for EdDSA MPCv2 key generation round 1');
+    }
+
+    try {
+      let request = this.apiClient['v1.eddsampcv2.keygen.round1'].post({
+        coin: this.coin,
+        ...params,
+      });
+
+      if (this.tlsMode === TlsMode.MTLS) {
+        request = request.agent(this.createHttpsAgent());
+      }
+
+      const response = await request.decodeExpecting(200);
+      return response.body;
+    } catch (error) {
+      logger.error(
+        'Failed EdDSA MPCv2 key generation round 1: %s',
+        (error as DecodeError).decodedResponse?.body,
+      );
+      throw error;
+    }
+  }
+
+  /**
+   * Finalize EdDSA MPCv2 key generation
+   */
+  async eddsaMPCv2KeyGenFinalize(params: {
+    source: 'user' | 'backup';
+    bitgoMsg2: { message: string; signature: string };
+    commonPublicKeychain: string;
+    encryptedState: string;
+    encryptedStateKey: string;
+  }): Promise<EddsaMPCv2KeyGenFinalizeResponseType> {
+    if (!this.coin) {
+      throw new Error('Coin must be specified for EdDSA MPCv2 key generation finalize');
+    }
+
+    try {
+      let request = this.apiClient['v1.eddsampcv2.keygen.finalize'].post({
+        coin: this.coin,
+        ...params,
+      });
+
+      if (this.tlsMode === TlsMode.MTLS) {
+        request = request.agent(this.createHttpsAgent());
+      }
+
+      const response = await request.decodeExpecting(200);
+      return response.body;
+    } catch (error) {
+      logger.error(
+        'Failed to finalize EdDSA MPCv2 key generation: %s',
+        (error as DecodeError).decodedResponse?.body,
+      );
+      throw error;
+    }
+  }
+
   async recoverEcdsaMpcV2Wallet(params: {
     txHex: string;
     pub: string;