Merge branch 'master' into WP-5445-express-migrate-api-v2-coin-wallet-id-signer-macaroon-to-typed-routes

TICKET: WP-5445

Author: danielzhao122

.github/workflows/publish.yml

@@ -46,7 +46,7 @@ jobs:
           git checkout -b ${{ env.preid }}-$(git rev-parse --short HEAD)
           echo "email=${{ secrets.BETA_EMAIL }}" > .npmrc
           echo "@bitgo-beta:registry=https://registry.npmjs.org" >> .npmrc
-          echo "//registry.npmjs.org/:_authToken=${{ secrets.BETA_TOKEN }}" >> .npmrc
+          echo "//registry.npmjs.org/:_authToken=${{ secrets.BITGO_BETA_PUBLISH_TOKEN }}" >> .npmrc
           echo "//registry.npmjs.org/:always-auth=true" >> .npmrc
 
       - name: Prepare Release

CLAUDE.md

@@ -70,6 +70,9 @@ yarn compile-dbg
 ### Commits
 BitGoJS uses conventional commits. All commits MUST pass the spec described in `commitlint.config.js`.
 
+### TypeScript Guidelines
+- **Avoid `any` type**: Use specific types, interfaces, or union types instead of `any`. If absolutely necessary, prefer `unknown` and use type guards for safety.
+
 ## Code Architecture
 
 BitGoJS is a monorepo composed of multiple modules, each implementing specific functionality:

Dockerfile

@@ -55,6 +55,7 @@ COPY --from=builder /tmp/bitgo/modules/abstract-utxo /var/modules/abstract-utxo/
 COPY --from=builder /tmp/bitgo/modules/blockapis /var/modules/blockapis/
 COPY --from=builder /tmp/bitgo/modules/sdk-api /var/modules/sdk-api/
 COPY --from=builder /tmp/bitgo/modules/sdk-hmac /var/modules/sdk-hmac/
+COPY --from=builder /tmp/bitgo/modules/utxo-ord /var/modules/utxo-ord/
 COPY --from=builder /tmp/bitgo/modules/account-lib /var/modules/account-lib/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-ada /var/modules/sdk-coin-ada/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-algo /var/modules/sdk-coin-algo/
@@ -122,13 +123,13 @@ COPY --from=builder /tmp/bitgo/modules/sdk-coin-bch /var/modules/sdk-coin-bch/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-bcha /var/modules/sdk-coin-bcha/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-bsv /var/modules/sdk-coin-bsv/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-btc /var/modules/sdk-coin-btc/
-COPY --from=builder /tmp/bitgo/modules/utxo-ord /var/modules/utxo-ord/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-btg /var/modules/sdk-coin-btg/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-dash /var/modules/sdk-coin-dash/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-doge /var/modules/sdk-coin-doge/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-eos /var/modules/sdk-coin-eos/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-ethlike /var/modules/sdk-coin-ethlike/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-ethw /var/modules/sdk-coin-ethw/
+COPY --from=builder /tmp/bitgo/modules/sdk-coin-flrp /var/modules/sdk-coin-flrp/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-iota /var/modules/sdk-coin-iota/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-lnbtc /var/modules/sdk-coin-lnbtc/
 COPY --from=builder /tmp/bitgo/modules/sdk-coin-ltc /var/modules/sdk-coin-ltc/
@@ -152,6 +153,7 @@ cd /var/modules/abstract-utxo && yarn link && \
 cd /var/modules/blockapis && yarn link && \
 cd /var/modules/sdk-api && yarn link && \
 cd /var/modules/sdk-hmac && yarn link && \
+cd /var/modules/utxo-ord && yarn link && \
 cd /var/modules/account-lib && yarn link && \
 cd /var/modules/sdk-coin-ada && yarn link && \
 cd /var/modules/sdk-coin-algo && yarn link && \
@@ -219,13 +221,13 @@ cd /var/modules/sdk-coin-bch && yarn link && \
 cd /var/modules/sdk-coin-bcha && yarn link && \
 cd /var/modules/sdk-coin-bsv && yarn link && \
 cd /var/modules/sdk-coin-btc && yarn link && \
-cd /var/modules/utxo-ord && yarn link && \
 cd /var/modules/sdk-coin-btg && yarn link && \
 cd /var/modules/sdk-coin-dash && yarn link && \
 cd /var/modules/sdk-coin-doge && yarn link && \
 cd /var/modules/sdk-coin-eos && yarn link && \
 cd /var/modules/sdk-coin-ethlike && yarn link && \
 cd /var/modules/sdk-coin-ethw && yarn link && \
+cd /var/modules/sdk-coin-flrp && yarn link && \
 cd /var/modules/sdk-coin-iota && yarn link && \
 cd /var/modules/sdk-coin-lnbtc && yarn link && \
 cd /var/modules/sdk-coin-ltc && yarn link && \
@@ -252,6 +254,7 @@ RUN cd /var/bitgo-express && \
     yarn link @bitgo/blockapis && \
     yarn link @bitgo/sdk-api && \
     yarn link @bitgo/sdk-hmac && \
+    yarn link @bitgo/utxo-ord && \
     yarn link @bitgo/account-lib && \
     yarn link @bitgo/sdk-coin-ada && \
     yarn link @bitgo/sdk-coin-algo && \
@@ -319,13 +322,13 @@ RUN cd /var/bitgo-express && \
     yarn link @bitgo/sdk-coin-bcha && \
     yarn link @bitgo/sdk-coin-bsv && \
     yarn link @bitgo/sdk-coin-btc && \
-    yarn link @bitgo/utxo-ord && \
     yarn link @bitgo/sdk-coin-btg && \
     yarn link @bitgo/sdk-coin-dash && \
     yarn link @bitgo/sdk-coin-doge && \
     yarn link @bitgo/sdk-coin-eos && \
     yarn link @bitgo/sdk-coin-ethlike && \
     yarn link @bitgo/sdk-coin-ethw && \
+    yarn link @bitgo/sdk-coin-flrp && \
     yarn link @bitgo/sdk-coin-iota && \
     yarn link @bitgo/sdk-coin-lnbtc && \
     yarn link @bitgo/sdk-coin-ltc && \

commitlint.config.js

@@ -5,10 +5,15 @@ module.exports = {
   ignores: [
     (commit) => /^Merge commit '[a-f0-9]{40}'$/m.test(commit),
     (commit) => /^chore\(root\): publish modules/m.test(commit),
-    (commit) => commit.includes('Signed-off-by: dependabot[bot] <support@github.com>'),
+    (commit) =>
+      commit.includes('Signed-off-by: dependabot[bot] <support@github.com>'),
   ],
   rules: {
-    'scope-enum': async () => [2, 'always', (await readdir('modules')).concat('root', 'deps', 'scripts')],
+    'scope-enum': async () => [
+      2,
+      'always',
+      (await readdir('modules')).concat('root', 'deps', 'scripts', 'examples'),
+    ],
     'footer-max-line-length': [0, 'always', Infinity],
     'references-empty': [2, 'never'],
   },

examples/js/trx/consolidate-account-balances.js

@@ -2,7 +2,7 @@
  * Tron wallet can't send funds from their receive addresses.
  * Account balance consolidation is used to sweep funds from the
  * receive addresses into the wallet's base address for sending.
- * @see {@link https://app.bitgo.com/docs/#operation/v2.wallet.consolidateaccount.build}
+ * @see {@link https://developers.bitgo.com/reference/v2walletconsolidateaccountbuild#/}
  */
 const BitGoJS = require('bitgo');
 

examples/js/xtz/consolidate-account-balances.js

@@ -2,7 +2,7 @@
  * Tezos wallet can't send funds from their receive addresses.
  * Account balance consolidation is used to sweep funds from the
  * receive addresses into the wallet's base address for sending.
- * @see {@link https://app.bitgo.com/docs/#operation/v2.wallet.consolidateaccount.build}
+ * @see {@link https://developers.bitgo.com/reference/v2walletconsolidateaccountbuild#/}
  */
 const BitGoJS = require('bitgo');
 const Promise = require('bluebird');

examples/ts/apt/stake-apt.ts

@@ -0,0 +1,97 @@
+/**
+ * Performs delegated staking with Aptos.
+ *
+ * Copyright 2025, BitGo, Inc.  All Rights Reserved.
+ */
+import { BitGoAPI } from '@bitgo/sdk-api';
+import { coins } from '@bitgo/statics';
+import { Tapt, TransactionBuilderFactory, Utils } from '@bitgo/sdk-coin-apt';
+import { Network, Aptos, AptosConfig, Account, Ed25519PrivateKey, SimpleTransaction } from '@aptos-labs/ts-sdk';
+
+require('dotenv').config({ path: '../../.env' });
+
+const AMOUNT_OCTAS = 11 * 100_000_000;
+const NETWORK = Network.TESTNET;
+
+const aptosConfig = new AptosConfig({ network: NETWORK });
+const aptos = new Aptos(aptosConfig);
+
+const bitgo = new BitGoAPI({
+  accessToken: process.env.TESTNET_ACCESS_TOKEN,
+  env: 'test',
+});
+const coin = coins.get('tapt');
+bitgo.register(coin.name, Tapt.createInstance);
+
+const broadcastToSimple = (serializedTx: string) =>
+  new SimpleTransaction(Utils.default.deserializeSignedTransaction(serializedTx).raw_txn);
+
+async function main() {
+  const account = getAccount();
+  const delegationPoolAddress = getDelegationPoolAddress();
+
+  // Account should have sufficient balance
+  const accountBalance = await aptos.getAccountAPTAmount({ accountAddress: account.accountAddress });
+  if (accountBalance < AMOUNT_OCTAS) {
+    console.info(`Balance of ${account.accountAddress} is ${accountBalance} octas, requesting funds.`);
+    const txn = await aptos.fundAccount({ accountAddress: account.accountAddress, amount: AMOUNT_OCTAS });
+    await aptos.waitForTransaction({ transactionHash: txn.hash });
+    console.info(`Funding successful: ${txn.hash}`);
+  }
+  const { sequence_number } = await aptos.getAccountInfo({ accountAddress: account.accountAddress });
+
+  // Use BitGoAPI to build instruction
+  const txBuilder = new TransactionBuilderFactory(coin).getDelegationPoolAddStakeTransactionBuilder();
+  txBuilder
+    .sender(account.accountAddress.toString())
+    .recipients([{ address: delegationPoolAddress, amount: `${AMOUNT_OCTAS}` }])
+    .sequenceNumber(Number(sequence_number));
+  const unsignedTx = await txBuilder.build();
+  const serializedUnsignedTx = unsignedTx.toBroadcastFormat();
+
+  // Sign transaction. Signing is flexible, let's use Aptos libs
+  const authenticator = aptos.sign({
+    signer: account,
+    transaction: broadcastToSimple(serializedUnsignedTx),
+  });
+  if (!authenticator.isEd25519()) {
+    throw new Error('Example only supports Ed25519');
+  }
+  txBuilder.addSenderSignature(
+    { pub: account.publicKey.toString() },
+    Buffer.from(authenticator.signature.toUint8Array())
+  );
+  const tx = await txBuilder.build();
+  const serializedTx = tx.toBroadcastFormat();
+  console.info(`Transaction ${serializedTx} and JSON:\n${JSON.stringify(tx.toJson(), undefined, 2)}`);
+
+  // Submit transaction
+  const submittedTxn = await aptos.transaction.submit.simple({
+    transaction: broadcastToSimple(serializedTx),
+    senderAuthenticator: authenticator,
+  });
+  console.log(`Success: ${submittedTxn.hash}`);
+}
+
+const getAccount = () => {
+  const privateKey = process.env.APTOS_PRIVATE_KEY;
+  if (privateKey === undefined) {
+    const { privateKey } = Account.generate();
+    console.log('# Here is a new account to save into your .env file.');
+    console.log(`APTOS_PRIVATE_KEY=${privateKey.toAIP80String()}`);
+    throw new Error('Missing account information');
+  }
+  return Account.fromPrivateKey({ privateKey: new Ed25519PrivateKey(privateKey) });
+};
+
+const getDelegationPoolAddress = () => {
+  const address = process.env.APTOS_DELEGATION_POOL_ADDRESS;
+  if (!address) {
+    console.log('# Provide a delegation pool.');
+    console.log(`APTOS_DELEGATION_POOL_ADDRESS=`);
+    throw new Error('Missing delegation pool address');
+  }
+  return address;
+};
+
+main().catch((e) => console.error(e));

examples/ts/btc/v1/wallet-passphrase-recovery.ts

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+/**
+ * Wallet Passphrase Recovery Script
+ *
+ * This script takes box D information in the keycard and recovers the wallet passphrase.
+ *
+ * The script will prompt for:
+ * - Environment (test/prod)
+ * - Activation code
+ * - Encrypted wallet passphrase from Box D of keycard
+ * 
+ * You need to install node and BitGoJS SDK to run this script.
+ * 
+ * To install node, you can follow the instructions here: https://nodejs.org/en/download
+ *
+ * To install BitGoJS SDK, you can use the following command:
+ *   npm install @bitgo/sdk-api
+ *
+ * Usage:
+ *   tsx wallet-passphrase-recovery.ts
+ *                  OR
+ *   npx ts-node wallet-passphrase-recovery.ts
+ */
+
+import { BitGoAPI } from '@bitgo/sdk-api';
+import * as readline from 'readline';
+
+// Create readline interface for user input
+const rl = readline.createInterface({
+  input: process.stdin,
+  output: process.stdout,
+});
+
+// Function to ask questions in the terminal
+function askQuestion(query: string): Promise<string> {
+  return new Promise((resolve) => {
+    rl.question(query, (answer) => {
+      resolve(answer);
+    });
+  });
+}
+
+async function main(): Promise<void> {
+  try {
+    console.log('BitGo V1 Wallet Password Recovery Tool');
+    console.log('====================================\n');
+
+    // Get environment setting
+    const envInput = await askQuestion(
+      'Enter environment (test/prod) [default: test]: ',
+    );
+    const env = envInput.toLowerCase() === 'prod' ? 'prod' : 'test';
+
+    // Initialize BitGo
+    const bitgo = new BitGoAPI({
+      env: env,
+    });
+
+    // Get activation code
+    const activationCode = await askQuestion('Enter activation code: ');
+
+    // Get encrypted wallet passphrase from Box D
+    const encryptedWalletPassphrase = await askQuestion(
+      'Enter encrypted wallet passphrase from Box D: ',
+    );
+
+    // Decrypt the wallet passphrase
+    const walletPassphrase = bitgo.decrypt({
+      input: encryptedWalletPassphrase,
+      password: activationCode,
+    });
+
+    console.log(`\n✅ SUCCESS: the decrypted passphrase is: ${walletPassphrase}`);
+  } catch (error) {
+    console.error(`\nError: ${error.message}`);
+    if (error.status) {
+      console.error(`Status code: ${error.status}`);
+    }
+    console.error('Please check your credentials and try again.');
+  } finally {
+    rl.close();
+  }
+}
+
+main().catch((error) => {
+  console.error(`Fatal error: ${error.message}`);
+  process.exit(1);
+});

examples/ts/trx/consolidate-hot-account-balances.ts

@@ -2,7 +2,7 @@
  * Tron wallets can't send funds from their receive addresses.
  * Account balance consolidation is used to sweep funds from the
  * receive addresses into the wallet's base address for sending.
- * @see {@link https://app.bitgo.com/docs/#operation/v2.wallet.consolidateaccount.build}
+ * @see {@link https://developers.bitgo.com/reference/v2walletconsolidateaccountbuild#/}
  */
 import { BitGo, WalletCoinSpecific } from 'bitgo';
 

examples/ts/xtz/consolidate-account-balances.ts

@@ -2,7 +2,7 @@
  * Tezos wallet can't send funds from their receive addresses.
  * Account balance consolidation is used to sweep funds from the
  * receive addresses into the wallet's base address for sending.
- * @see {@link https://app.bitgo.com/docs/#operation/v2.wallet.consolidateaccount.build}
+ * @see {@link https://developers.bitgo.com/reference/v2walletconsolidateaccountbuild#/}
  */
 import { BitGo, WalletCoinSpecific } from 'bitgo';