┌─────────────────────────────────────────────────────────────────┐
│                    CUSTODY ARCHITECTURE                          │
├─────────────────────────────────────────────────────────────────┤
│                                                                   │
│  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐  │
│  │   Hot Wallet    │  │   Warm Wallet   │  │   Cold Vault    │  │
│  │   (Trading)     │  │   (Settlement)  │  │   (Long-term)   │  │
│  │                 │  │                 │  │                 │  │
│  │  MPC (2-of-3)   │  │  MPC (3-of-5)   │  │  MPC (4-of-7)   │  │
│  │  < $1M          │  │  $1M - $100M    │  │  > $100M        │  │
│  │  Auto-sign      │  │  Policy-sign    │  │  Manual-sign    │  │
│  └─────────────────┘  └─────────────────┘  └─────────────────┘  │
│           │                   │                   │              │
│           └───────────────────┼───────────────────┘              │
│                               │                                  │
│                    ┌──────────┴──────────┐                       │
│                    │   Policy Engine     │                       │
│                    │   • Whitelists      │                       │
│                    │   • Limits          │                       │
│                    │   • Time-locks      │                       │
│                    └─────────────────────┘                       │
└─────────────────────────────────────────────────────────────────┘

Key Generation Process (MPC-DKG)
────────────────────────────────────────────────────────────────

1. Distributed Key Generation (DKG)
   ┌─────────┐  ┌─────────┐  ┌─────────┐
   │ Share 1 │  │ Share 2 │  │ Share 3 │
   │ (LX)    │  │ (Client)│  │ (HSM)   │
   └─────────┘  └─────────┘  └─────────┘
        │            │            │
        └────────────┼────────────┘
                     │
              ┌──────┴──────┐
              │ Public Key  │  ← Only this is revealed
              │ (On-chain)  │
              └─────────────┘

2. Threshold Signing (t-of-n)
   - Hot Wallet:  2-of-3 (client + LX + HSM)
   - Warm Wallet: 3-of-5 (client + LX + 2 HSMs + backup)
   - Cold Vault:  4-of-7 (client + LX + 3 HSMs + 2 backups)

{
  "wallet_type": "hot",
  "threshold": "2-of-3",
  "max_balance_usd": 1000000,
  "auto_sign_conditions": {
    "destination_whitelist": true,
    "max_transaction_usd": 100000,
    "daily_limit_usd": 500000,
    "velocity_check": true
  }
}

{
  "wallet_type": "warm",
  "threshold": "3-of-5",
  "max_balance_usd": 100000000,
  "approval_workflow": {
    "under_1m": "auto_sign",
    "1m_to_10m": "single_approval",
    "over_10m": "dual_approval"
  },
  "time_delay_minutes": 15
}

{
  "wallet_type": "cold",
  "threshold": "4-of-7",
  "max_balance_usd": null,
  "signing_ceremony": {
    "required_parties": 4,
    "quorum_locations": 2,
    "advance_notice_hours": 24,
    "video_verification": true
  }
}

// Whitelist configuration
const whitelist = {
  addresses: [
    {
      address: "0x1234...5678",
      label: "Prime Broker Settlement",
      dailyLimit: "10000000", // $10M
      requiresApproval: false
    },
    {
      address: "0xabcd...ef01",
      label: "OTC Counterparty",
      dailyLimit: "5000000",
      requiresApproval: true
    }
  ],
  additionPolicy: {
    requiredApprovers: 2,
    cooldownPeriod: "24h"
  }
};

const timeLockPolicy = {
  tiers: [
    { minAmount: 0, maxAmount: 1000000, delay: "0h" },
    { minAmount: 1000000, maxAmount: 10000000, delay: "1h" },
    { minAmount: 10000000, maxAmount: 50000000, delay: "4h" },
    { minAmount: 50000000, maxAmount: null, delay: "24h" }
  ],
  emergencyOverride: {
    enabled: true,
    requiredApprovers: 3,
    notificationChannels: ["sms", "email", "slack"]
  }
};

Standard Withdrawal Flow
────────────────────────────────────────────────────────────────

  Initiate    →    Policy    →    Approval    →    Execute
  Request         Check          Queue            Transaction
     │               │               │                │
     │               │               │                │
     ▼               ▼               ▼                ▼
┌─────────┐   ┌─────────────┐  ┌──────────┐   ┌───────────┐
│ User    │   │ • Whitelist │  │ • Email  │   │ • Sign    │
│ Request │   │ • Limits    │  │ • SMS    │   │ • Broadcast│
│         │   │ • Velocity  │  │ • MFA    │   │ • Confirm │
└─────────┘   │ • Time-lock │  │ • 2P Auth│   └───────────┘
              └─────────────┘  └──────────┘

import { LxCustody } from '@luxfi/custody-sdk';

const custody = new LxCustody({
  apiKey: process.env.LX_API_KEY,
  clientCertificate: fs.readFileSync('./client.pem'),
});

// Create new wallet
const wallet = await custody.wallets.create({
  type: 'warm',
  name: 'Settlement Wallet',
  threshold: '3-of-5',
  policy: {
    dailyLimit: '50000000',
    whitelist: ['0x1234...'],
    timeLock: '1h'
  }
});

// Get wallet balance
const balance = await custody.wallets.getBalance(wallet.id);

// Initiate withdrawal
const withdrawal = await custody.withdrawals.create({
  walletId: wallet.id,
  destination: '0xabcd...',
  asset: 'USDC',
  amount: '1000000',
  memo: 'Settlement #12345'
});

// List pending approvals
const pending = await custody.approvals.list({
  status: 'pending',
  walletId: wallet.id
});

// Approve transaction
await custody.approvals.approve({
  approvalId: pending[0].id,
  signature: await signer.sign(pending[0].hash),
  mfaCode: '123456'
});

// Reject transaction
await custody.approvals.reject({
  approvalId: pending[1].id,
  reason: 'Suspicious destination'
});

// Request custom asset support
await custody.assets.requestSupport({
  symbol: 'CUSTOM',
  network: 'ethereum',
  contractAddress: '0x...',
  decimals: 18,
  justification: 'Portfolio holding'
});