feat(sdk-coin-sui): add MPCv2 signed hot recovery support

Detect keycard format (MPCv1 JSON vs MPCv2 CBOR) in Sui.recover() and its
private helpers (recoverSuiToken, signRecoveryTransaction) via the shared
getEddsaSigningMaterial helper, and dispatch MPCv2 keycards to
signEddsaMpcV2RecoveryTx instead of the MPCv1-only EDDSAMethods.getTSSSignature
path. The raw 64-byte signature is wrapped in SUI's existing 0x00-flag +
signature + pubkey envelope before being attached to the transaction builder,
so both native transfer and token recovery route through the same dispatch.

MPCv2 hot wallets could not recover funds via WRW: recover() only understood
the MPCv1 JSON keycard format and threw when handed an MPCv2 CBOR keycard.
This mirrors the pattern already landed for DOT (WCI-1227) and unblocks
WCI-1234 (recoverConsolidations MPCv2 support), which depends on this
dispatch existing in recover().

Ticket: WCI-1224
Session-Id: bf130f11-6bd0-4a91-88c6-a9138ecc96ab
Task-Id: 179247fb-4ff6-49f3-9849-df120620c98b

Author: vibhavgo

modules/sdk-coin-sui/src/sui.ts

@@ -1,13 +1,17 @@
+import assert from 'assert';
 import crypto from 'crypto';
 import {
   BaseBroadcastTransactionOptions,
   BaseBroadcastTransactionResult,
   BaseCoin,
   BaseTransaction,
   BitGoBase,
+  decryptKeychainPrivateKey,
   EDDSAMethods,
   EDDSAMethodTypes,
+  EddsaSigningMaterial,
   Environments,
+  getEddsaSigningMaterial as sharedGetEddsaSigningMaterial,
   KeyPair,
   MPCAlgorithm,
   MPCRecoveryOptions,
@@ -20,6 +24,7 @@ import {
   ParsedTransaction,
   ParseTransactionOptions as BaseParseTransactionOptions,
   RecoveryTxRequest,
+  signEddsaMpcV2RecoveryTx,
   SignedTransaction,
   SignTransactionOptions,
   TransactionExplanation,
@@ -463,7 +468,7 @@ export class Sui extends BaseCoin {
         return this.buildUnsignedSweepTransaction(txBuilder, senderAddress, bitgoKey, idx, derivationPath);
       }
 
-      await this.signRecoveryTransaction(txBuilder, params, derivationPath, derivedPublicKey, false);
+      await this.signRecoveryTransaction(txBuilder, params, derivationPath, derivedPublicKey, bitgoKey, false);
       const tx = (await txBuilder.build()) as TransferTransaction;
       return {
         transactions: [
@@ -554,7 +559,7 @@ export class Sui extends BaseCoin {
       return this.buildUnsignedSweepTransaction(txBuilder, senderAddress, bitgoKey, idx, derivationPath, token);
     }
 
-    await this.signRecoveryTransaction(txBuilder, params, derivationPath, derivedPublicKey, true);
+    await this.signRecoveryTransaction(txBuilder, params, derivationPath, derivedPublicKey, bitgoKey, true);
     const tx = (await txBuilder.build()) as TokenTransferTransaction;
     return {
       transactions: [
@@ -630,55 +635,64 @@ export class Sui extends BaseCoin {
     return { txRequests: [txRequest] };
   }
 
+  /**
+   * Detects whether a keycard's decrypted plaintext is MPCv1 JSON or MPCv2 CBOR.
+   * Protected so tests can stub it via sinon; wraps the shared sdk-core helper.
+   */
+  protected async getEddsaSigningMaterial(userKey: string, walletPassphrase: string): Promise<EddsaSigningMaterial> {
+    return sharedGetEddsaSigningMaterial(userKey, walletPassphrase, this.bitgo);
+  }
+
+  // Protected so tests can stub via instance overrides — direct module function bindings
+  // cannot be intercepted by sinon after import.
+  protected async signSuiMpcV2Recovery(params: Parameters<typeof signEddsaMpcV2RecoveryTx>[0]): Promise<Buffer> {
+    return signEddsaMpcV2RecoveryTx(params);
+  }
+
   private async signRecoveryTransaction(
     txBuilder: TransactionBuilder,
     params: MPCRecoveryOptions,
     derivationPath: string,
     derivedPublicKey: string,
+    bitgoKey: string,
     isTokenTransaction: boolean
   ) {
     // TODO(BG-51092): This looks like a common part which can be extracted out too
     const unsignedTx = isTokenTransaction
       ? ((await txBuilder.build()) as TokenTransferTransaction)
       : ((await txBuilder.build()) as TransferTransaction);
-    if (!params.userKey) {
-      throw new Error('missing userKey');
-    }
-    if (!params.backupKey) {
-      throw new Error('missing backupKey');
-    }
-    if (!params.walletPassphrase) {
-      throw new Error('missing wallet passphrase');
-    }
+    assert(params.userKey, 'missing userKey');
+    assert(params.backupKey, 'missing backupKey');
+    assert(params.walletPassphrase, 'missing wallet passphrase');
 
     // Clean up whitespace from entered values
     const userKey = params.userKey.replace(/\s/g, '');
     const backupKey = params.backupKey.replace(/\s/g, '');
 
-    // Decrypt private keys from KeyCard values
-    let userPrv: string;
-    try {
-      userPrv = await this.bitgo.decrypt({
-        input: userKey,
-        password: params.walletPassphrase,
+    const signingMaterial = await this.getEddsaSigningMaterial(userKey, params.walletPassphrase);
+
+    if (signingMaterial.version === 'v2') {
+      const signature = await this.signSuiMpcV2Recovery({
+        message: unsignedTx.signablePayload,
+        userKey: signingMaterial.encryptedUserKey,
+        backupKey,
+        walletPassphrase: params.walletPassphrase,
+        bitgoKey,
+        derivationPath,
+        bitgo: this.bitgo,
       });
-    } catch (e) {
-      throw new Error(`Error decrypting user keychain: ${e.message}`);
+      txBuilder.addSignature({ pub: derivedPublicKey }, signature);
+      return;
     }
+
     /** TODO BG-52419 Implement Codec for parsing */
-    const userSigningMaterial = JSON.parse(userPrv) as EDDSAMethodTypes.UserSigningMaterial;
+    const userSigningMaterial = JSON.parse(signingMaterial.userPrv) as EDDSAMethodTypes.UserSigningMaterial;
 
-    let backupPrv: string;
-    try {
-      backupPrv = await this.bitgo.decrypt({
-        input: backupKey,
-        password: params.walletPassphrase,
-      });
-    } catch (e) {
-      throw new Error(`Error decrypting backup keychain: ${e.message}`);
+    const backupPrv = await decryptKeychainPrivateKey(this.bitgo, { encryptedPrv: backupKey }, params.walletPassphrase);
+    if (!backupPrv) {
+      throw new Error('Error decrypting backup keychain: invalid password or corrupted key');
     }
     const backupSigningMaterial = JSON.parse(backupPrv) as EDDSAMethodTypes.BackupSigningMaterial;
-    /* ********************** END ***********************************/
 
     // add signature
     const signatureHex = await EDDSAMethods.getTSSSignature(