Major — use a named alias. A bare literal 2 makes encryptionVersion: 1 a type error, even though v1 is the current default — so callers forwarding from a generic config ({ encryptionVersion: cfg.version }) need a cast. Suggest:

export type EncryptionVersion = 1 | 2;

export interface EncryptOptions {
  input: string;
  password?: string;
  adata?: string;
  encryptionVersion?: EncryptionVersion;
}

This prepares for v3 without a hunt-and-replace across the 8+ option types where the field appears (GenerateWalletOptions, GenerateMpcWalletOptions, CreateMpcOptions, CreateBackupOptions, CreateKeychainParamsBase, etc.). Also: adata should get a JSDoc note that it is silently dropped when encryptionVersion === 2 — see the inline comment on BitGoAPI.encryptAsync.

Major — extract a named IEncryptionSession. The anonymous inline return type is repeated 4+ times across the PR (ecdsaMPCv2.ts addUserKeychain/addBackupKeychain parameter types, eddsa.ts session usage, etc.). EncryptionSession already exists as a class in modules/sdk-api/src/encryptionSession.ts. The structural problem is that sdk-core can't import from sdk-api (circular). Fix: declare an IEncryptionSession interface in modules/sdk-core/src/api/types.ts, export it from sdk-core/src/index.ts, and have both this interface and the EncryptionSession class in sdk-api reference it.

Without this, no external SDK consumer can write let session: ??? with a proper type import.

Major — params.adata is silently dropped on the v2 path. v1 forwards adata to sjcl.encrypt; v2 calls encryptV2(password, input) with no AAD. Two consequences:

1. Callers passing adata get false confidence that AAD is bound — it is not.
2. In ecdsaMPCv2.ts, the v1 path uses adata = ${hashBuffer}:${derivationPath} to bind the encrypted round-session to the transaction context (validateAdata enforces the binding). The v2 path has no equivalent (see inline comment on ecdsaMPCv2.ts line 1242).

v2's AES-GCM is self-authenticating for the ciphertext — but doesn't replicate the transaction-context binding unless AAD is threaded through encryptV2 envelopes. Fix: add an additionalData?: string option to encryptV2/aesGcmEncrypt, store it in the v2 envelope, and verify in decryptV2. Or, at minimum, throw if params.adata is set and encryptionVersion === 2 so the silent drop becomes a loud error.

Major — accepted but never read. EcdsaUtils.createKeychains (non-MPCv2 ECDSA) declares encryptionVersion?: 2 in its param type, but the function body never references it — createParticipantKeychain (line 299) still calls this.bitgo.encrypt(...) synchronously. Result: a caller that passes encryptionVersion: 2 to a non-MPCv2 ECDSA wallet gets v1 silently.

Fix: either thread encryptionVersion through createParticipantKeychain (mirroring the MPCv2 pattern), or remove the field from the param type if non-MPCv2 ECDSA is not in scope for v2 in this PR.

Major — separate Argon2id session per keychain. createUserKeychain (line 200) and createBackupKeychain (line 295) each create their own createEncryptionSession for one encryption then immediately destroy(). Since both run in parallel via Promise.all (line 397/407 of createKeychains), Argon2id is computed twice unnecessarily.

EcdsaMPCv2Utils.createKeychains does this correctly: a single shared session created in the parent function and threaded into both addUserKeychain and addBackupKeychain. Please mirror that pattern here — create one session in createKeychains, pass it into both children, destroy() it in finally. Saves one full Argon2id derivation per keygen.

Major / defense-in-depth — v2 path skips transaction-context binding. The v1 path (this.validateAdata(adata, encryptedRound1Session) on line 1246) binds the encrypted round-session to ${hashBuffer}:${derivationPath}, preventing replay across different transaction signing contexts. The v2 branch above (line 1242) has no equivalent.

GCM's authentication tag covers the ciphertext, but does not bind the session to a specific transaction — that property was provided by adata in v1. AAD support needs to be threaded through encryptV2 / EncryptionSession envelopes (see inline on BitGoAPI.encryptAsync), or the v2 round-session needs a different binding mechanism, or the relaxation needs to be documented as accepted security trade-off (with rationale for why round-session replay is not a concern for ephemeral signing keys).

This is also relevant for line 1337 (round-3 path).

Note: Zhongxi's HSM-1513 work (commits e3bc07cbf6 / d531ed2802 on a separate branch) adds round domain separators to v1 adata. v2 should get the equivalent before this lands.

Blocker — breaking-change commit marker missing. This signature change (string → Promise<string>) is a public-API break for @bitgo/sdk-core consumers. IWallet is exported from the package barrel; downstream JS / non-strict-TS callers who do const prv = wallet.getUserPrv(opts); signTransaction({ prv }) will silently pass a Promise<string> to the signer.

lerna publish --conventional-commits (Angular preset) only triggers a major bump on feat!: / fix!: / BREAKING CHANGE: footer. None of the 7 commits on this PR carry that marker, so sdk-core will publish under a minor bump. The repo's Check breaking changes CI job is OpenAPI-only and does not catch SDK type-signature changes.

Fix: add a follow-up commit (or rewrite 36c78cd) with body:

BREAKING CHANGE: IWallet.getUserPrv now returns Promise<string> instead of string.
Callers must await the result.

Same applies to the decryptKeychainPrivateKey export — see inline on decryptKeychain.ts.

Blocker — same as IWallet.getUserPrv. This is a named public export of @bitgo/sdk-core. The async signature change requires a BREAKING CHANGE: footer so lerna bumps the package to a major version on publish. Without it the published package will be a minor bump and downstream callers in untyped JS / non-strict TS will silently get a Promise where they expect a string | undefined.

Fix: roll into the same BREAKING CHANGE: footer as getUserPrv (or split into a separate footer). Suggest:

BREAKING CHANGE:
- IWallet.getUserPrv now returns Promise<string> (was string)
- decryptKeychainPrivateKey now returns Promise<string | undefined> (was string | undefined)
All callers must await the result.

Also note: modules/bitgo/test/unit/decryptKeychain.ts (5 sync decryptKeychainPrivateKey calls at lines 18, 36, 55, 74, 78) was not updated — see the summary for details. Please add await and make the test functions async so the file actually validates the new behavior.