feat(sdk-core): extend upgradeEncryption to support OFC wallets

- handle variable key count (OFC has 2 keys, no backup)
- skip PDF when backup/bitgo keychains absent
- include pub in user key PUT for OFC server validation

Ticket: WAL-1694

Author: pranavjain97

modules/bitgo/test/v2/unit/wallet.ts

@@ -7079,5 +7079,69 @@ describe('V2 Wallet:', function () {
 
       await wallet.upgradeEncryption({ passphrase, passcodeEncryptionCode: 'pec-supplied' });
     });
+
+    describe('OFC wallets (2 keys, no backup)', function () {
+      const ofcCoin = bitgo.coin('ofc');
+      const ofcUserKeyId = 'ofc00000000000000000000000000001';
+      const ofcBitgoKeyId = 'ofc00000000000000000000000000002';
+      const ofcWalletData = {
+        id: 'ofc0000000000000000000000wallet1',
+        coin: 'ofc',
+        keys: [ofcUserKeyId, ofcBitgoKeyId],
+        coinSpecific: {},
+        multisigType: 'onchain' as const,
+        type: 'hot' as const,
+      };
+      const ofcWallet = new Wallet(bitgo, ofcCoin, ofcWalletData as any);
+
+      function nockOfcKeychain(id: string, keychain: Record<string, unknown>) {
+        return nock(bgUrl)
+          .get(`/api/v2/ofc/key/${id}`)
+          .reply(200, { id, pub: 'pub', type: 'independent', ...keychain });
+      }
+
+      it('re-encrypts the user key and skips bitgo key with no encryptedPrv', async function () {
+        const userEnc = await bitgo.encrypt({ input: 'userPrv', password: passphrase, encryptionVersion: 1 });
+
+        nockUnlock();
+        nockOfcKeychain(ofcUserKeyId, { encryptedPrv: userEnc });
+        nockOfcKeychain(ofcBitgoKeyId, {});
+
+        const puts: Array<{ id: string; body: Record<string, unknown> }> = [];
+        nock(bgUrl)
+          .put(`/api/v2/ofc/key/${ofcUserKeyId}`, (body) => {
+            puts.push({ id: ofcUserKeyId, body });
+            return true;
+          })
+          .reply(200, {});
+
+        const result = await ofcWallet.upgradeEncryption({ passphrase, passcodeEncryptionCode: 'pec' });
+        assert.strictEqual(result, undefined);
+        puts.should.have.length(1);
+        puts[0].id.should.equal(ofcUserKeyId);
+        JSON.parse(puts[0].body.encryptedPrv as string).v.should.equal(2);
+      });
+
+      it('skips user key already at v2', async function () {
+        const userV2 = await bitgo.encrypt({ input: 'userPrv', password: passphrase, encryptionVersion: 2 });
+
+        nockUnlock();
+        nockOfcKeychain(ofcUserKeyId, { encryptedPrv: userV2 });
+        nockOfcKeychain(ofcBitgoKeyId, {});
+
+        await ofcWallet.upgradeEncryption({ passphrase, passcodeEncryptionCode: 'pec' });
+        // No PUTs expected — nock will error if any unexpected call is made.
+      });
+
+      it('makes no PUT calls in dry-run mode', async function () {
+        const userEnc = await bitgo.encrypt({ input: 'userPrv', password: passphrase, encryptionVersion: 1 });
+
+        nockOfcKeychain(ofcUserKeyId, { encryptedPrv: userEnc });
+        nockOfcKeychain(ofcBitgoKeyId, {});
+
+        const result = await ofcWallet.upgradeEncryption({ passphrase, dryRun: true });
+        assert.strictEqual(result, undefined);
+      });
+    });
   });
 });

modules/sdk-core/src/bitgo/wallet/wallet.ts

@@ -3486,10 +3486,11 @@ export class Wallet implements IWallet {
     }
 
     const keyIds = this.keyIds();
+    const fetchKeychain = (id: string | undefined) => (id ? keychainsApi.get({ id }) : Promise.resolve(undefined));
     const [userKeychain, backupKeychain, bitgoKeychain] = await Promise.all([
-      keychainsApi.get({ id: keyIds[0] }),
-      keychainsApi.get({ id: keyIds[1] }),
-      keychainsApi.get({ id: keyIds[2] }),
+      keychainsApi.get({ id: keyIds[KeyIndices.USER] }),
+      fetchKeychain(keyIds[KeyIndices.BACKUP]),
+      fetchKeychain(keyIds[KeyIndices.BITGO]),
     ]);
 
     const updated: Array<{ type: string; id: string }> = [];
@@ -3507,7 +3508,7 @@ export class Wallet implements IWallet {
         if (!dryRun) {
           await this.bitgo
             .put(this.baseCoin.url(`/key/${encodeURIComponent(userKeychain.id)}`))
-            .send({ encryptedPrv: newEncryptedPrv, originalEncryptedPrv: newEncryptedPrv })
+            .send({ encryptedPrv: newEncryptedPrv, originalEncryptedPrv: newEncryptedPrv, pub: userKeychain.pub })
             .result();
         }
         updated.push({ type: 'user', id: userKeychain.id });
@@ -3519,8 +3520,8 @@ export class Wallet implements IWallet {
     // Re-encrypt backup key. May be encrypted under the original passphrase if the wallet
     // password was changed after creation — fall back to originalPassphrase if current fails.
     // Source: server-stored encryptedPrv (preferred) or boxB for older/keycard-only wallets.
-    const serverStored = !!backupKeychain.encryptedPrv;
-    const backupSource = backupKeychain.encryptedPrv ?? boxB;
+    const serverStored = !!backupKeychain?.encryptedPrv;
+    const backupSource = backupKeychain?.encryptedPrv ?? boxB;
     if (backupSource) {
       if (keychainsApi.getEncryptionVersion(backupSource) === 2) {
         skipped.push({ type: 'backup', reason: 'already v2' });
@@ -3531,15 +3532,16 @@ export class Wallet implements IWallet {
           originalPassphrase,
           'backup key'
         );
-        backupKeychain.encryptedPrv = newEncryptedPrv;
-        if (!dryRun && serverStored) {
+        if (backupKeychain) backupKeychain.encryptedPrv = newEncryptedPrv;
+        if (!dryRun && serverStored && backupKeychain) {
           // Only PUT if the key was server-stored; boxB-only wallets have no server record.
           await this.bitgo
             .put(this.baseCoin.url(`/key/${encodeURIComponent(backupKeychain.id)}`))
             .send({ encryptedPrv: newEncryptedPrv })
             .result();
         }
-        updated.push({ type: serverStored ? 'backup' : 'backup (keycard only)', id: backupKeychain.id });
+        const backupId = backupKeychain?.id ?? boxB ?? 'unknown';
+        updated.push({ type: serverStored ? 'backup' : 'backup (keycard only)', id: backupId });
       }
     } else {
       skipped.push({ type: 'backup', reason: 'public key only' });
@@ -3573,7 +3575,7 @@ export class Wallet implements IWallet {
       );
       updated.push({ type: 'user reducedEncryptedPrv (keycard only)', id: userKeychain.id });
     }
-    if (boxB && backupKeychain.encryptedPrv) {
+    if (boxB && backupKeychain?.encryptedPrv) {
       // MPCv2: encryptedPrv exists server-side but reducedEncryptedPrv does not.
       // Re-encrypt boxB so the new keycard uses the reduced form instead of the full blob.
       backupKeychain.reducedEncryptedPrv = await this.reencryptCreationTimeKey(
@@ -3585,7 +3587,7 @@ export class Wallet implements IWallet {
       updated.push({ type: 'backup reducedEncryptedPrv (keycard only)', id: backupKeychain.id });
     }
 
-    if (!generatePdf) {
+    if (!generatePdf || !backupKeychain || !bitgoKeychain) {
       console.log('Done (no PDF generator provided).');
       return undefined;
     }

scripts/upgrade-wallet-encryption.ts

@@ -16,6 +16,11 @@
  *     [--passcodeEncryptionCode <code>] \
  *     [--dry-run]
  *
+ * OFC wallets (--coin ofc):
+ *   Only --passphrase is required. --boxD / --boxA / --boxB do not apply.
+ *   No keycard PDF is produced. The script iterates all key IDs on the wallet
+ *   and re-encrypts any that still use v1 (SJCL) encryption.
+ *
  * --accessToken: Short-lived BitGo access token. Generate this using the following guide
  *                https://developers.bitgo.com/docs/get-started-access-tokens#1-create-short-lived-access-token
  * --boxD: Box D from the original keycard. Required if the wallet passphrase has been changed since the