@oxy.so/core 7.32.0 → 7.33.0

package/dist/types/crypto/keyManager.d.ts

@@ -290,9 +290,46 @@ export declare class KeyManager {
      * `signSocialReceive`) is fresh, so a cached key here would let a caller
      * compare a new seed against an old key.
      *
+     * iOS, in an app that holds the private key (Commons, the Peable wallet:
+     * keychain roles `holder` and `wallet`): DERIVED from the private key in the
+     * wallet group, never read from the public-key item, which sits in the shared
+     * group every Oxy app can write (R5-1); `null` when that app holds no private
+     * key. Every other iOS app reads the public-key item: it holds nothing it
+     * could derive from, and it never spends. Money code uses
+     * {@link getIdentityPublicKeyForMoney}.
+     *
      * @returns Shared public key or null if no shared identity exists
      */
     static getSharedPublicKey(): Promise<string | null>;
+    /**
+     * Whether this iOS app holds spending keys (keychain role `holder` or
+     * `wallet`), so a public key it uses for money must be derived from them.
+     * Throws while the keychain cannot say. @internal
+     */
+    private static _holdsSpendingKeys;
+    /**
+     * THE public key of the identity a money holder (the Peable wallet, Commons)
+     * receives and spends with: the personal key, or with `opts.accountId` that
+     * organization's (ADR 0061 D6). It is the public half of exactly the private
+     * key {@link deriveScopedSeed} and {@link signSocialReceive} use, so an
+     * address shown from it is one this app can spend (R5-1).
+     *
+     * - iOS (Commons, the Peable wallet): DERIVED from the private key in the
+     *   restricted keychain groups (personal: the wallet group's slot, then
+     *   Commons' primary; organization: its pair). Never the shared group's
+     *   public-key item, which every Oxy app can write. `null` when no private
+     *   key is held, and in every other iOS app.
+     * - Android: inside Commons derived from its own key; elsewhere Commons'
+     *   identity host (`describe`), which answers from Commons' own signer
+     *   store over signature-protected IPC.
+     * - Web: `null`.
+     *
+     * Compare the answer with the account's published `#key-1` before showing a
+     * receive address (Peable ADR 0002). Lowercase uncompressed (`04…`).
+     */
+    static getIdentityPublicKeyForMoney(opts?: {
+        accountId?: string;
+    }): Promise<string | null>;
     /**
      * The shared private key, where this app may hold it: iOS only.
      *
@@ -743,17 +780,23 @@ export declare class KeyManager {
      * (personal, or `accountId`'s) whose public key it names: the current key
      * when it matches, else a RETIRED key Commons kept after a rotation or
      * replacement (`./retiredKeys`, ADR 0061 D7 as amended). Spending only: a
-     * retired key never signs in. Never falls back to another key.
+     * retired key never signs in. Never falls back to another key. A PERSONAL
+     * retired key is reached only with `opts.ownerAccountId`, the signed-in
+     * person's account id, and only when the ring keeps it for that account
+     * (R5-2); on Android outside Commons the identity host holds only the
+     * personal keys of the person Commons is signed in as.
      *
      * @param info Context/domain-binding label (distinct labels → independent seeds).
      * @param opts.accountId An organization's account id, for its key.
      * @param opts.publicKey Selects one key of that account by its public key.
+     * @param opts.ownerAccountId The person's account id, for a personal retired key.
      * @returns 32 bytes of derived keying material, or `null` on web / when no
      *          identity key is available to this app.
      */
     static deriveScopedSeed(info: string, opts?: {
         accountId?: string;
         publicKey?: string;
+        ownerAccountId?: string;
     }): Promise<Uint8Array | null>;
     /**
      * {@link deriveScopedSeed} over an ORGANIZATION key (ADR 0061 D6): Commons'
@@ -780,6 +823,7 @@ export declare class KeyManager {
     static signSocialReceive(index: number, digest: string, opts?: {
         accountId?: string;
         publicKey?: string;
+        ownerAccountId?: string;
     }): Promise<CommonsSocialReceiveSignature | null>;
     /**
      * The private key of the account (personal, or `accountId`'s organization)

package/dist/types/crypto/retiredKeys.d.ts

@@ -41,10 +41,32 @@
  *
  * This module imports nothing from `./keyManager` (which imports it).
  */
-/** Whose ring: the person's (`accountId` absent) or an organization's. */
+/**
+ * Whose ring: the person's (`accountId` absent) or an organization's.
+ *
+ * The personal ring is BOUND TO ITS OWNER (R5-2): every personal entry records
+ * the Oxy account id of the person whose key it was, and a personal read
+ * reaches only the entries of `ownerAccountId`. A phone outlives the person on
+ * it ("Start over" keeps the ring: it is money, recoverable from that account's
+ * backup), so the next person on the phone must never list, derive from or
+ * sign with a previous person's keys. A personal read without `ownerAccountId`
+ * reaches nothing. An entry whose owner is not known (a key the access-group
+ * migration kept, an entry written before 7.33.0) is QUARANTINED: invisible to
+ * every reader until Commons binds it with {@link claimRetiredIdentityKeys},
+ * which requires the account's key history to name it.
+ */
 export interface RetiredKeySelector {
     /** An organization's account id; absent for the personal ring. */
     accountId?: string;
+    /**
+     * The person's Oxy account id, for the PERSONAL ring: whose entries are
+     * reached. Ignored for an organization's ring (its owner is `accountId`).
+     */
+    ownerAccountId?: string;
+}
+/** Thrown when the ring's index cannot be read as the ring: never treated as empty (R5-9). */
+export declare class RetiredKeyRingUnreadableError extends Error {
+    constructor(reason: string);
 }
 /** One retired key as the ring lists it: public data only. */
 export interface RetiredIdentityKey {
@@ -63,25 +85,53 @@ export interface RetiredKeyPair {
 /** The ring a selector names: `personal`, or the organization's account id. */
 export declare function retiredKeyScope(selector?: RetiredKeySelector): string | null;
 /**
- * Keep `key` in the ring of `selector`'s account. Commons only. Idempotent: a
- * key already kept stays, with its first date. Refuses a pair whose public key
- * does not derive from its private key. Resolves once every copy confirmed it
+ * Keep `key` in the ring of `selector`'s account. Commons only. A PERSONAL key
+ * needs `selector.ownerAccountId`, the person whose key it was (R5-2): the
+ * signed-in account at a rotation, the account whose key history or backup
+ * named it. Idempotent: a key already kept stays, with its first date; a
+ * quarantined entry of the same key is bound to that owner; an entry bound to
+ * a DIFFERENT owner is refused. Refuses a pair whose public key does not
+ * derive from its private key. Resolves once every copy confirmed it
  * (Android: the signer store's read-back too), and throws otherwise, so a
  * caller about to replace the key can stop before anything is lost.
  */
 export declare function retireIdentityKey(key: RetiredKeyPair, selector?: RetiredKeySelector): Promise<void>;
 /**
  * {@link retireIdentityKey} from inside the iOS access-group migration, which
- * keeps a replaced pre-split copy before deleting it from the shared group and
- * cannot await itself. @internal
+ * keeps a pre-split copy before deleting it from the shared group and cannot
+ * await itself. A personal key without `ownerAccountId` is kept QUARANTINED:
+ * held (it may be money) but reached by nobody until
+ * {@link claimRetiredIdentityKeys} binds it. @internal
  */
 export declare function retireIdentityKeyDuringMigration(key: RetiredKeyPair, selector?: RetiredKeySelector): Promise<void>;
+/**
+ * Bind the QUARANTINED personal entries whose public key `publicKeys` names to
+ * `ownerAccountId` (R5-2, R5-3). Commons only, with the signed-in person's
+ * account id and that account's key history from Oxy
+ * (`oxy.identity.keyHistory()`: retired and current public keys): a key the
+ * account's own history names is that account's. Entries bound to anyone, and
+ * keys the history does not name, are left as they are. Resolves how many it
+ * bound; call {@link syncRetiredKeys} after it on Android.
+ */
+export declare function claimRetiredIdentityKeys(ownerAccountId: string, publicKeys: readonly string[]): Promise<number>;
+/**
+ * How many personal entries are quarantined (no known owner). Commons shows
+ * them as "keys from before" the person can claim by adding the phrase, and
+ * {@link claimRetiredIdentityKeys} binds the ones the account's history names.
+ */
+export declare function countQuarantinedRetiredKeys(): Promise<number>;
 /**
  * The retired keys of `selector`'s account this app can reach, oldest first.
- * iOS and Commons: the ring's index. Android elsewhere: Commons' identity host
- * (the wallet only), which leaves out the scope's current key. After an
- * interrupted rotation the local list can include the current key: compare
- * with the DID's `#key-1` before treating an entry as retired.
+ * The personal ring answers only `selector.ownerAccountId`'s entries (none
+ * without it; R5-2). iOS and Commons: the ring's index. Android elsewhere:
+ * Commons' identity host (the wallet only), which holds only the personal
+ * entries of the person Commons is signed in as and leaves out the scope's
+ * current key. After an interrupted rotation the local list can include the
+ * current key: compare with the DID's `#key-1` before treating an entry as
+ * retired, and check every entry against the account's key history.
+ *
+ * STRICT (R5-6): a ring that cannot be read throws (the keychain's error, or
+ * {@link RetiredKeyRingUnreadableError}); it never reads as empty.
  */
 export declare function listRetiredIdentityKeys(selector?: RetiredKeySelector): Promise<RetiredIdentityKey[]>;
 /**
@@ -108,23 +158,38 @@ export declare function forgetRetiredIdentityKey(publicKey: string, selector?: R
  */
 export declare function forgetRetiredIdentityKeys(selector?: RetiredKeySelector): Promise<number>;
 /**
- * Commons on Android: copy every retired key into the identity signer store
- * again, so the identity host answers for it after that file was rebuilt (its
- * self-heal leaves it empty). Call on every boot, beside `syncOrganizationKeys`.
- * Resolves how many it mirrored. Elsewhere 0.
+ * Commons on Android: make the identity signer store hold exactly what the
+ * identity host may answer — every organization ring, and the personal entries
+ * of `ownerAccountId` (the person Commons is signed in as) — so the host
+ * answers for them after that file was rebuilt (its self-heal leaves it
+ * empty), and never for a previous person's keys (R5-2): every other personal
+ * entry is removed from the signer store (its own slot keeps it). Without
+ * `ownerAccountId` no personal entry is mirrored. Call on every boot and after
+ * every sign-in, beside `syncOrganizationKeys`. Resolves how many it mirrored.
+ * Elsewhere 0.
  */
-export declare function syncRetiredKeys(): Promise<number>;
+export declare function syncRetiredKeys(ownerAccountId?: string): Promise<number>;
 /**
- * Every retired key of `selector`'s ring WITH its private half, for the
- * encrypted identity backup (`oxy.identity.backup.create`), which carries them
- * under the CURRENT phrase so a lost phone costs no more than the current
- * phrase does (R4-4). Commons only; an entry whose private half is missing or
- * does not derive its public key is left out. Never log or transmit the result
- * except inside that encrypted envelope.
+ * Every retired key of `selector`'s ring (personal: `ownerAccountId`'s entries)
+ * WITH its private half, for the encrypted identity backup
+ * (`oxy.identity.backup.create`), which carries them under the CURRENT phrase
+ * so a lost phone costs no more than the current phrase does (R4-4). Commons
+ * only. STRICT (R5-6): an unreadable ring, or a listed entry whose private
+ * half is missing or does not derive its public key, THROWS — a backup is
+ * never sealed without a key the ring says it holds. Never log or transmit the
+ * result except inside that encrypted envelope.
  */
 export declare function exportRetiredIdentityKeys(selector?: RetiredKeySelector): Promise<Array<RetiredKeyPair & {
     retiredAt: number;
 }>>;
+/**
+ * Commons on Android, when the identity leaves this device ("Start over", a
+ * forced delete): remove every PERSONAL entry from the identity signer store,
+ * so the identity host answers no other app with them before the next person
+ * signs in (R5-2). Commons' own slot and index keep them (money, bound to
+ * their owner). Elsewhere a no-op.
+ */
+export declare function unmirrorPersonalRetiredKeys(): Promise<void>;
 /**
  * The pair a previous key's raw PRIVATE KEY gives (64 hex, an optional `0x`),
  * for a person whose old identity was imported as a private key and so has no

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "7.32.0",
+  "version": "7.33.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/api/identity.ts

@@ -337,7 +337,10 @@ export class IdentityApi {
     if (!isWeb()) {
       try {
         if (!oldPrivateKeyForRing) throw new Error('no readable private key');
-        await retireIdentityKey({ privateKey: oldPrivateKeyForRing, publicKey: oldPublicKey });
+        await retireIdentityKey(
+          { privateKey: oldPrivateKeyForRing, publicKey: oldPublicKey },
+          { ownerAccountId: userId },
+        );
       } catch (retainError) {
         logger.warn(
           'Could not keep the current key as a retired key; not rotating.',
@@ -896,9 +899,11 @@ export class IdentityBackupApi {
   private async retiredKeysToCarry(currentPublicKey: string): Promise<BackupRetiredKey[]> {
     if (isWeb()) return [];
     const { exportRetiredIdentityKeys } = await import('../crypto/index');
+    const userId = this.ctx.oxy.session.userId;
+    if (!userId) throw new Error('No authenticated user — sign in before backing up.');
     let held: BackupRetiredKey[];
     try {
-      held = await exportRetiredIdentityKeys();
+      held = await exportRetiredIdentityKeys({ ownerAccountId: userId });
     } catch {
       return []; // Not Commons: this app holds no ring to carry.
     }
@@ -966,6 +971,10 @@ export class IdentityBackupApi {
    */
   private async keepCarriedRetiredKeys(payload: BackupPayload): Promise<number> {
     const { KeyManager, retireIdentityKey } = await import('../crypto/index');
+    // The backup is the signed-in account's (its phrase opened it): its keys
+    // are kept for that account only (R5-2).
+    const ownerAccountId = this.ctx.oxy.session.userId;
+    if (!ownerAccountId) throw new Error('No authenticated user — sign in before restoring.');
     let kept = 0;
     for (const key of Array.isArray(payload.retiredKeys) ? payload.retiredKeys : []) {
       try {
@@ -976,7 +985,10 @@ export class IdentityBackupApi {
         ) {
           continue;
         }
-        await retireIdentityKey({ privateKey: key.privateKey, publicKey: key.publicKey });
+        await retireIdentityKey(
+          { privateKey: key.privateKey, publicKey: key.publicKey },
+          { ownerAccountId },
+        );
         kept += 1;
       } catch (error) {
         logger.warn(

package/src/crypto/index.ts

@@ -92,6 +92,10 @@ export {
   retiredKeyFromPhrase,
   retiredKeyFromPrivateKey,
   exportRetiredIdentityKeys,
+  claimRetiredIdentityKeys,
+  countQuarantinedRetiredKeys,
+  unmirrorPersonalRetiredKeys,
+  RetiredKeyRingUnreadableError,
 } from './retiredKeys';
 export type { RetiredIdentityKey, RetiredKeyPair, RetiredKeySelector } from './retiredKeys';
 export { SignatureService } from './signatureService';

package/src/crypto/keyManager.ts

@@ -32,7 +32,7 @@ import { isDev, logger } from '../logger';
 import { deriveScopedSeedFromKey, signSocialReceiveDigest } from './identityDerivations';
 import { type IdentitySignerStore, registerIdentitySignerStore } from './identitySigner';
 import { getOrganizationPrivateKey, isOrganizationAccountId } from './organizationKeys';
-import { getRetiredPrivateKey, retiredKeyScope } from './retiredKeys';
+import { getRetiredPrivateKey, retiredKeyScope, unmirrorPersonalRetiredKeys } from './retiredKeys';
 import {
   type KeychainItemClass,
   groupedKeychainStore,
@@ -1070,6 +1070,14 @@ export class KeyManager {
    * `signSocialReceive`) is fresh, so a cached key here would let a caller
    * compare a new seed against an old key.
    *
+   * iOS, in an app that holds the private key (Commons, the Peable wallet:
+   * keychain roles `holder` and `wallet`): DERIVED from the private key in the
+   * wallet group, never read from the public-key item, which sits in the shared
+   * group every Oxy app can write (R5-1); `null` when that app holds no private
+   * key. Every other iOS app reads the public-key item: it holds nothing it
+   * could derive from, and it never spends. Money code uses
+   * {@link getIdentityPublicKeyForMoney}.
+   *
    * @returns Shared public key or null if no shared identity exists
    */
   static async getSharedPublicKey(): Promise<string | null> {
@@ -1077,6 +1085,16 @@ export class KeyManager {
       return null;
     }
 
+    if (isIOS() && (await KeyManager._holdsSpendingKeys())) {
+      // Not cached: a rotation in Commons changes it under the wallet.
+      try {
+        const privateKey = await KeyManager.getSharedPrivateKey();
+        return privateKey ? KeyManager.derivePublicKey(privateKey) : null;
+      } catch {
+        return null;
+      }
+    }
+
     // Return cached value if available (iOS only; see above).
     if (!isAndroid() && KeyManager.cachedSharedPublicKey !== null) {
       return KeyManager.cachedSharedPublicKey;
@@ -1111,6 +1129,70 @@ export class KeyManager {
     }
   }
 
+  /**
+   * Whether this iOS app holds spending keys (keychain role `holder` or
+   * `wallet`), so a public key it uses for money must be derived from them.
+   * Throws while the keychain cannot say. @internal
+   */
+  private static async _holdsSpendingKeys(): Promise<boolean> {
+    const access = await resolveKeychainAccess();
+    return access.mode === 'grouped' && access.role !== 'member';
+  }
+
+  /**
+   * THE public key of the identity a money holder (the Peable wallet, Commons)
+   * receives and spends with: the personal key, or with `opts.accountId` that
+   * organization's (ADR 0061 D6). It is the public half of exactly the private
+   * key {@link deriveScopedSeed} and {@link signSocialReceive} use, so an
+   * address shown from it is one this app can spend (R5-1).
+   *
+   * - iOS (Commons, the Peable wallet): DERIVED from the private key in the
+   *   restricted keychain groups (personal: the wallet group's slot, then
+   *   Commons' primary; organization: its pair). Never the shared group's
+   *   public-key item, which every Oxy app can write. `null` when no private
+   *   key is held, and in every other iOS app.
+   * - Android: inside Commons derived from its own key; elsewhere Commons'
+   *   identity host (`describe`), which answers from Commons' own signer
+   *   store over signature-protected IPC.
+   * - Web: `null`.
+   *
+   * Compare the answer with the account's published `#key-1` before showing a
+   * receive address (Peable ADR 0002). Lowercase uncompressed (`04…`).
+   */
+  static async getIdentityPublicKeyForMoney(opts?: { accountId?: string }): Promise<string | null> {
+    if (isWebPlatform()) {
+      return null;
+    }
+    const accountId = opts?.accountId;
+    if (accountId !== undefined) {
+      if (!isOrganizationAccountId(accountId)) return null;
+      if (isAndroid() && !KeyManager.identitySignerStore) {
+        const bridge = await loadCommonsIdentityBridge();
+        const description = (await bridge?.describe(accountId)) ?? null;
+        return description?.accountId === accountId && description.publicKey
+          ? KeyManager.canonicalPublicKey(description.publicKey)
+          : null;
+      }
+      const organizationKey = await getOrganizationPrivateKey(accountId);
+      return organizationKey ? KeyManager.derivePublicKey(organizationKey) : null;
+    }
+    if (isAndroid()) {
+      if (KeyManager.identitySignerStore) {
+        const local = await KeyManager.getPrivateKey();
+        return local ? KeyManager.derivePublicKey(local) : null;
+      }
+      const bridge = await loadCommonsIdentityBridge();
+      const publicKey = (await bridge?.describe())?.publicKey ?? null;
+      return publicKey ? KeyManager.canonicalPublicKey(publicKey) : null;
+    }
+    if (!isIOS()) {
+      return null;
+    }
+    const privateKey =
+      (await KeyManager.getSharedPrivateKey()) ?? (await KeyManager.getPrivateKey());
+    return privateKey ? KeyManager.derivePublicKey(privateKey) : null;
+  }
+
   /**
    * The shared private key, where this app may hold it: iOS only.
    *
@@ -2612,10 +2694,10 @@ export class KeyManager {
       await KeyManager._clearSharedSlot(store);
       // The retired ring is NOT cleared (R4-4): it is money under the person's
       // previous keys, and "Start over" or a forced delete must not cost it.
-      // The same person restoring their identity finds it again; a different
-      // identity on this phone cannot use it (each entry is checked against
-      // that account's key history before use). Only deleting the Oxy ACCOUNT
-      // clears it, explicitly (`forgetRetiredIdentityKeys`, Commons' flow).
+      // Every personal entry is bound to its owner's account id (R5-2), so the
+      // same person signing in again finds it, and a different person on this
+      // phone never lists, derives from or signs with it. Only deleting the Oxy
+      // ACCOUNT clears it, explicitly (`forgetRetiredIdentityKeys`).
     }
 
     // The device backup goes on EVERY delete, forced or not: it is restored
@@ -2624,8 +2706,19 @@ export class KeyManager {
     await KeyManager._clearDeviceBackup();
 
     // Same for the Android signer store: Commons' identity host must stop
-    // answering for a deleted identity, forced or not.
+    // answering for a deleted identity, forced or not — its personal retired
+    // keys included (R5-2): they stay in Commons' own ring, bound to their
+    // owner, but the host must not hand them to the next person on the phone.
     await KeyManager._clearIdentitySigner();
+    try {
+      await unmirrorPersonalRetiredKeys();
+    } catch (error) {
+      logger.warn(
+        'Failed to withdraw the personal retired keys from the identity host',
+        { component: 'KeyManager' },
+        error,
+      );
+    }
 
     // Clear the marker AFTER key deletion succeeds — a marker must never outlive
     // its identity (a leftover marker would route a truly-absent device to
@@ -3238,17 +3331,22 @@ export class KeyManager {
    * (personal, or `accountId`'s) whose public key it names: the current key
    * when it matches, else a RETIRED key Commons kept after a rotation or
    * replacement (`./retiredKeys`, ADR 0061 D7 as amended). Spending only: a
-   * retired key never signs in. Never falls back to another key.
+   * retired key never signs in. Never falls back to another key. A PERSONAL
+   * retired key is reached only with `opts.ownerAccountId`, the signed-in
+   * person's account id, and only when the ring keeps it for that account
+   * (R5-2); on Android outside Commons the identity host holds only the
+   * personal keys of the person Commons is signed in as.
    *
    * @param info Context/domain-binding label (distinct labels → independent seeds).
    * @param opts.accountId An organization's account id, for its key.
    * @param opts.publicKey Selects one key of that account by its public key.
+   * @param opts.ownerAccountId The person's account id, for a personal retired key.
    * @returns 32 bytes of derived keying material, or `null` on web / when no
    *          identity key is available to this app.
    */
   static async deriveScopedSeed(
     info: string,
-    opts?: { accountId?: string; publicKey?: string },
+    opts?: { accountId?: string; publicKey?: string; ownerAccountId?: string },
   ): Promise<Uint8Array | null> {
     if (isWebPlatform()) {
       return null;
@@ -3262,7 +3360,7 @@ export class KeyManager {
           (await bridge?.deriveRetiredScopedSeed?.(info, selected, opts.accountId)) ?? null;
         return seed ? hexToBytes(seed) : null;
       }
-      const selected = await KeyManager._selectedPrivateKey(opts.publicKey, opts.accountId);
+      const selected = await KeyManager._selectedPrivateKey({ ...opts, publicKey: opts.publicKey });
       return selected ? deriveScopedSeedFromKey(selected, info) : null;
     }
     if (opts?.accountId !== undefined) {
@@ -3326,7 +3424,7 @@ export class KeyManager {
   static async signSocialReceive(
     index: number,
     digest: string,
-    opts?: { accountId?: string; publicKey?: string },
+    opts?: { accountId?: string; publicKey?: string; ownerAccountId?: string },
   ): Promise<CommonsSocialReceiveSignature | null> {
     if (isWebPlatform()) {
       return null;
@@ -3341,7 +3439,7 @@ export class KeyManager {
           null
         );
       }
-      const selected = await KeyManager._selectedPrivateKey(opts.publicKey, opts.accountId);
+      const selected = await KeyManager._selectedPrivateKey({ ...opts, publicKey: opts.publicKey });
       return selected ? signSocialReceiveDigest(selected, index, digest) : null;
     }
     const accountId = opts?.accountId;
@@ -3382,10 +3480,12 @@ export class KeyManager {
     return KeyManager.isValidPublicKey(publicKey) ? KeyManager.canonicalPublicKey(publicKey) : null;
   }
 
-  private static async _selectedPrivateKey(
-    publicKey: string,
-    accountId?: string,
-  ): Promise<string | null> {
+  private static async _selectedPrivateKey(opts: {
+    publicKey: string;
+    accountId?: string;
+    ownerAccountId?: string;
+  }): Promise<string | null> {
+    const { publicKey, accountId, ownerAccountId } = opts;
     if (retiredKeyScope({ accountId }) === null || !KeyManager.isValidPublicKey(publicKey)) {
       return null;
     }
@@ -3399,7 +3499,14 @@ export class KeyManager {
     if (current && KeyManager.canonicalPublicKey(KeyManager.derivePublicKey(current)) === wanted) {
       return current;
     }
-    return getRetiredPrivateKey(wanted, accountId !== undefined ? { accountId } : undefined);
+    return getRetiredPrivateKey(
+      wanted,
+      accountId !== undefined
+        ? { accountId }
+        : ownerAccountId !== undefined
+          ? { ownerAccountId }
+          : undefined,
+    );
   }
 
   /**