feat: nest vault keys under walletType

WCN-1192

TICKET: WCN-1192

Author: davidkaplanbitgo

modules/sdk-core/src/bitgo/vault/codecs.ts

@@ -42,14 +42,37 @@ export const VaultPermission = t.keyof(
 /** An ordered [userKeyId, backupKeyId, bitgoKeyId] triplet — same shape/order as wallet.keys[]. */
 export const RootKeyTriplet = t.tuple([t.string, t.string, t.string], 'RootKeyTriplet');
 
-/** The 12 static root key ids, by (curve, scheme). */
-export const VaultRootKeys = t.type(
+/** The 12 root key ids for a single custody model, keyed by (curve, scheme). */
+export const RootKeysByType = t.type(
   {
     secp256k1Multisig: RootKeyTriplet,
     ecdsaMpc: RootKeyTriplet,
     eddsaMpc: RootKeyTriplet,
     ed25519Multisig: RootKeyTriplet,
   },
+  'RootKeysByType'
+);
+
+/** Custody models a vault's roots can be created under. v1 implements `hot` only. */
+export const VaultCustodyType = t.keyof(
+  {
+    hot: null,
+    cold: null,
+    custodial: null,
+  },
+  'VaultCustodyType'
+);
+
+/**
+ * A vault's root keys grouped by custody model — each model holds its own set of 4 (curve, scheme)
+ * root triplets. Only `hot` is populated in v1; `cold`/`custodial` are reserved for later phases.
+ */
+export const VaultRootKeys = t.partial(
+  {
+    hot: RootKeysByType,
+    cold: RootKeysByType,
+    custodial: RootKeysByType,
+  },
   'VaultRootKeys'
 );
 
@@ -100,7 +123,6 @@ export const VaultData = t.intersection(
       id: t.string,
       enterpriseId: t.string,
       label: t.string,
-      // freeze is NOT a status — a frozen vault stays 'active' with the freeze field set (wallet precedent)
       status: VaultStatus,
       creator: t.string,
       users: t.array(VaultMembershipData),
@@ -174,5 +196,5 @@ export const InitializeVaultBody = t.type({ label: t.string }, 'InitializeVaultB
 /** POST /enterprise/:eId/vaults/:vId/finalize — the 12 key ids as 4 ordered triplets. */
 export const FinalizeVaultBody = t.type({ rootKeys: VaultRootKeys }, 'FinalizeVaultBody');
 
-/** POST/DELETE /enterprise/:eId/vaults/:vId/freeze */
+/** POST /enterprise/:eId/vaults/:vId/freeze */
 export const FreezeVaultBody = t.partial({ duration: t.number }, 'FreezeVaultBody');

modules/sdk-core/src/bitgo/vault/iVault.ts

@@ -12,6 +12,8 @@ import * as VaultCodecs from './codecs';
 
 export type RootKeyType = t.TypeOf<typeof VaultCodecs.RootKeyType>;
 export type VaultPermission = t.TypeOf<typeof VaultCodecs.VaultPermission>;
+export type VaultCustodyType = t.TypeOf<typeof VaultCodecs.VaultCustodyType>;
+export type RootKeysByType = t.TypeOf<typeof VaultCodecs.RootKeysByType>;
 export type VaultRootKeys = t.TypeOf<typeof VaultCodecs.VaultRootKeys>;
 export type VaultMembershipData = t.TypeOf<typeof VaultCodecs.VaultMembershipData>;
 export type VaultShareRequest = t.TypeOf<typeof VaultCodecs.VaultShareRequest>;
@@ -87,7 +89,7 @@ export interface IVault {
   status(): VaultData['status'];
   url(extra?: string): string;
   createWallet(params: CreateVaultWalletOptions): Promise<Wallet>;
-  // whole-vault: view/admin/spend; spend opens a key share (also how a spender services a
+  // whole-vault: view/admin/spend/dapp; spend opens a key share (also how a spender services a
   // vaultShareRequests entry in UMS orgs)
   addMember(params: AddVaultMemberOptions): Promise<VaultData>;
   // share ONE vault wallet, not the whole vault

modules/sdk-core/test/unit/bitgo/vault/vaults.ts

@@ -41,10 +41,12 @@ describe('Vaults', function () {
       await vaults
         .finalizeVault('vid', {
           rootKeys: {
-            secp256k1Multisig: ['u', 'b', 'g'],
-            ecdsaMpc: ['u', 'b', 'g'],
-            eddsaMpc: ['u', 'b', 'g'],
-            ed25519Multisig: ['u', 'b', 'g'],
+            hot: {
+              secp256k1Multisig: ['u', 'b', 'g'],
+              ecdsaMpc: ['u', 'b', 'g'],
+              eddsaMpc: ['u', 'b', 'g'],
+              ed25519Multisig: ['u', 'b', 'g'],
+            },
           },
         })
         .should.be.rejectedWith(/not yet implemented .*Phase 2/);