feat(sdk-coin-near): add MPCv2 signed hot recovery

Add MPCv2 detection and signing to Near.recover() alongside the
existing MPCv1 path.

What changed:
- Import getEddsaSigningMaterial and signEddsaMpcV2RecoveryTx from
  @bitgo/sdk-core in near.ts
- Add isMpcv2SigningMaterial() private method that decrypts the user
  keycard once and returns true when the plaintext is CBOR (MPCv2)
- Refactor signRecoveryTransaction() to accept an isMpcV2 boolean; when
  true it calls signEddsaMpcV2RecoveryTx (MPS DSG) instead of the
  legacy EDDSAMethods.getTSSSignature path
- Call isMpcv2SigningMaterial() once at the top of recover() and thread
  the isMpcV2 flag into both the native NEAR and NEP141 FT token paths
- Add three new unit tests: native MPCv2 signed recovery, NEP141 FT
  token MPCv2 signed recovery, and bitgoKey/commonKeyChain mismatch

Why:
NEAR wallets provisioned with the new Silence Labs (MPCv2) key material
cannot be recovered with the Zengo-era getTSSSignature path because the
keycard format is different (CBOR base64 vs JSON uShare/yShare). This
adds the same MPCv2 detection+signing path that was introduced for SOL
in WCI-398, enabling hot recovery for MPCv2 NEAR wallets without any
new caller-visible parameters.

Ticket: WCI-1223
Session-Id: 8de2a998-4754-4499-82b5-49167b8d9fd6
Task-Id: 7e0eb924-0c33-4cc6-9402-c71587bb14a5

Author: Marzooqa

modules/sdk-coin-near/src/near.ts

@@ -18,6 +18,7 @@ import {
   EDDSAMethods,
   EDDSAMethodTypes,
   Environments,
+  getEddsaSigningMaterial,
   KeyPair,
   MPCAlgorithm,
   MPCRecoveryOptions,
@@ -32,6 +33,7 @@ import {
   ParseTransactionOptions as BaseParseTransactionOptions,
   PublicKey,
   RecoveryTxRequest,
+  signEddsaMpcV2RecoveryTx,
   SignedTransaction,
   SignTransactionOptions as BaseSignTransactionOptions,
   TokenEnablementConfig,
@@ -365,6 +367,7 @@ export class Near extends BaseCoin {
     }
     const bitgoKey = params.bitgoKey.replace(/\s/g, '');
     const isUnsignedSweep = !params.userKey && !params.backupKey && !params.walletPassphrase;
+    const isMpcV2 = await this.isMpcv2SigningMaterial(params.userKey, params.backupKey, params.walletPassphrase);
     const MPC = await EDDSAMethods.getInitializedMpcInstance();
     const { storageAmountPerByte, transferCost, receiptConfig } = await this.getProtocolConfig();
     let isStorageDepositEnabled = false;
@@ -440,7 +443,8 @@ export class Near extends BaseCoin {
           bitgoKey,
           isStorageDepositEnabled,
           availableTokenBalance,
-          isUnsignedSweep
+          isUnsignedSweep,
+          isMpcV2
         );
       }
 
@@ -474,7 +478,7 @@ export class Near extends BaseCoin {
       const unsignedTransaction = (await txBuilder.build()) as Transaction;
       let serializedTx = unsignedTransaction.toBroadcastFormat();
       if (!isUnsignedSweep) {
-        serializedTx = await this.signRecoveryTransaction(txBuilder, params, currPath, accountId);
+        serializedTx = await this.signRecoveryTransaction(txBuilder, params, currPath, accountId, isMpcV2);
       } else {
         return this.buildUnsignedSweepTransaction(
           txBuilder,
@@ -514,7 +518,8 @@ export class Near extends BaseCoin {
     bitgoKey: string,
     isStorageDepositEnabled: boolean,
     availableTokenBalance: BigNumber,
-    isUnsignedSweep: boolean
+    isUnsignedSweep: boolean,
+    isMpcV2 = false
   ): Promise<MPCTx | MPCSweepTxs> {
     const factory = new TransactionBuilderFactory(token);
     const bs58EncodedPublicKey = nearAPI.utils.serialize.base_encode(new Uint8Array(Buffer.from(senderAddress, 'hex')));
@@ -549,7 +554,13 @@ export class Near extends BaseCoin {
         token
       );
     } else {
-      const serializedTx = await this.signRecoveryTransaction(txBuilder, params, derivationPath, senderAddress);
+      const serializedTx = await this.signRecoveryTransaction(
+        txBuilder,
+        params,
+        derivationPath,
+        senderAddress,
+        isMpcV2
+      );
       return { serializedTx: serializedTx, scanIndex: idx };
     }
   }
@@ -631,12 +642,11 @@ export class Near extends BaseCoin {
     txBuilder: TransactionBuilder,
     params: MPCRecoveryOptions,
     derivationPath: string,
-    senderAddress: string
+    senderAddress: string,
+    isMpcV2 = false
   ): Promise<string> {
     const unsignedTransaction = (await txBuilder.build()) as Transaction;
-    // Sign the txn
-    /* ***************** START **************************************/
-    // TODO(BG-51092): This looks like a common part which can be extracted out too
+
     if (!params.userKey) {
       throw new Error('missing userKey');
     }
@@ -647,49 +657,68 @@ export class Near extends BaseCoin {
       throw new Error('missing wallet passphrase');
     }
 
-    // Clean up whitespace from entered values
     const userKey = params.userKey.replace(/\s/g, '');
     const backupKey = params.backupKey.replace(/\s/g, '');
 
-    // Decrypt private keys from KeyCard values
-    let userPrv;
-    try {
-      userPrv = await this.bitgo.decrypt({
-        input: userKey,
-        password: params.walletPassphrase,
+    let signatureHex: Buffer;
+    if (isMpcV2) {
+      signatureHex = await signEddsaMpcV2RecoveryTx({
+        message: unsignedTransaction.signablePayload,
+        userKey,
+        backupKey,
+        walletPassphrase: params.walletPassphrase,
+        bitgoKey: params.bitgoKey.replace(/\s/g, ''),
+        derivationPath,
+        bitgo: this.bitgo,
       });
-    } catch (e) {
-      throw new Error(`Error decrypting user keychain: ${e.message}`);
-    }
-    /** TODO BG-52419 Implement Codec for parsing */
-    const userSigningMaterial = JSON.parse(userPrv) as EDDSAMethodTypes.UserSigningMaterial;
+    } else {
+      let userPrv;
+      try {
+        userPrv = await this.bitgo.decrypt({
+          input: userKey,
+          password: params.walletPassphrase,
+        });
+      } catch (e) {
+        throw new Error(`Error decrypting user keychain: ${e.message}`);
+      }
+      const userSigningMaterial = JSON.parse(userPrv) as EDDSAMethodTypes.UserSigningMaterial;
 
-    let backupPrv;
-    try {
-      backupPrv = await this.bitgo.decrypt({
-        input: backupKey,
-        password: params.walletPassphrase,
-      });
-    } catch (e) {
-      throw new Error(`Error decrypting backup keychain: ${e.message}`);
-    }
-    const backupSigningMaterial = JSON.parse(backupPrv) as EDDSAMethodTypes.BackupSigningMaterial;
-    /* ********************** END ***********************************/
-
-    // add signature
-    const signatureHex = await EDDSAMethods.getTSSSignature(
-      userSigningMaterial,
-      backupSigningMaterial,
-      derivationPath,
-      unsignedTransaction
-    );
-    const publicKeyObj = { pub: senderAddress };
-    txBuilder.addSignature(publicKeyObj as PublicKey, signatureHex);
+      let backupPrv;
+      try {
+        backupPrv = await this.bitgo.decrypt({
+          input: backupKey,
+          password: params.walletPassphrase,
+        });
+      } catch (e) {
+        throw new Error(`Error decrypting backup keychain: ${e.message}`);
+      }
+      const backupSigningMaterial = JSON.parse(backupPrv) as EDDSAMethodTypes.BackupSigningMaterial;
 
+      signatureHex = await EDDSAMethods.getTSSSignature(
+        userSigningMaterial,
+        backupSigningMaterial,
+        derivationPath,
+        unsignedTransaction
+      );
+    }
+
+    txBuilder.addSignature({ pub: senderAddress } as PublicKey, signatureHex);
     const completedTransaction = await txBuilder.build();
     return completedTransaction.toBroadcastFormat();
   }
 
+  private async isMpcv2SigningMaterial(
+    userKey?: string,
+    backupKey?: string,
+    walletPassphrase?: string
+  ): Promise<boolean> {
+    if (!walletPassphrase) return false;
+    if (!userKey) throw new Error('missing userKey');
+    if (!backupKey) throw new Error('missing backupKey');
+    const material = await getEddsaSigningMaterial(userKey.replace(/\s/g, ''), walletPassphrase, this.bitgo);
+    return material.version === 'v2';
+  }
+
   async createBroadcastableSweepTransaction(params: MPCSweepRecoveryOptions): Promise<MPCTxs> {
     const req = params.signatureShares;
     const broadcastableTransactions: MPCTx[] = [];