@peers-app/peers-sdk 0.27.5 → 0.28.0

package/dist/data/user-permissions.js

@@ -1,11 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signUserObject = signUserObject;
+exports.hasSignedUserAnchors = hasSignedUserAnchors;
+exports.isSelfSignedUser = isSelfSignedUser;
+exports.sameUserIdentity = sameUserIdentity;
+exports.anchorFields = anchorFields;
 exports.verifyUserSignature = verifyUserSignature;
 exports.verifyUserSignedBySelf = verifyUserSignedBySelf;
+exports.keySucceeds = keySucceeds;
+const anchor_document_1 = require("../identity/anchor-document");
 const keys_1 = require("../keys");
 /**
- * The part of a `Users` row the owner signs: everything but `anchors`.
+ * The profile the owner signs: everything but the separately authorized anchor list.
  *
  * The anchor list on record is decided by the anchors themselves (the on-record rule), not
  * by whoever wrote the row. A peer that confirms a key change stores the row with the list
@@ -13,19 +19,68 @@ const keys_1 = require("../keys");
  * must still verify, so the list is carried beside the signature rather than under it.
  */
 function signedPart(user) {
-    const { anchors: _anchors, ...rest } = user;
+    const { anchors: _anchors, anchorsSignature: _anchorsSignature, ...rest } = user;
     return rest;
 }
 /**
- * Signs a user object with the provided secret key. The `anchors` list is kept on the row
- * but is not covered by the signature; see {@link verifyUserSignature}.
+ * Signs a user's profile and separately signs its initial anchor list. Later anchor changes
+ * are still authorized by the anchors on record; see {@link verifyUserSignature}.
  * @param user The user object to sign
  * @param secretKey The secret key to sign with
  * @returns IUser The signed user object
  */
 function signUserObject(user, secretKey) {
     const signed = (0, keys_1.addSignatureToObject)(signedPart(user), secretKey);
-    return user.anchors ? { ...signed, anchors: user.anchors } : signed;
+    return user.anchors
+        ? {
+            ...signed,
+            anchors: user.anchors,
+            anchorsSignature: (0, keys_1.addSignatureToObject)(anchorStatement(user), secretKey).signature,
+        }
+        : signed;
+}
+function anchorStatement(user) {
+    return {
+        purpose: "peers-user-anchors",
+        userId: user.userId,
+        publicKey: user.publicKey,
+        anchors: user.anchors ?? [],
+    };
+}
+/** Whether the profile owner authorized this exact initial anchor list, before any anchors exist. */
+function hasSignedUserAnchors(user) {
+    const statement = { ...anchorStatement(user), signature: user.anchorsSignature };
+    return !!user.publicKey && (0, keys_1.signedByKey)(statement) === user.publicKey;
+}
+/**
+ * Whether a Users row is signed by its own `publicKey` (its anchor list is not signed): the
+ * only rows a group's authority takes a member's key from.
+ *
+ * @param user - A Users row.
+ */
+function isSelfSignedUser(user) {
+    return !!user.publicKey && (0, keys_1.signedByKey)(signedPart(user)) === user.publicKey;
+}
+/**
+ * Whether two profiles or authenticated devices name the same user and both of their keys.
+ * This compares identity only; callers still verify signatures or the transport separately.
+ */
+function sameUserIdentity(a, b) {
+    return a.userId === b.userId && a.publicKey === b.publicKey && a.publicBoxKey === b.publicBoxKey;
+}
+/**
+ * `source`'s anchor list with the owner's signature over it, to spread onto a profile or an
+ * invite identity; nothing when `source` has no list.
+ *
+ * @param source - The row or identity the list is taken from.
+ */
+function anchorFields(source) {
+    if (!source.anchors?.length)
+        return {};
+    return {
+        anchors: source.anchors,
+        ...(source.anchorsSignature ? { anchorsSignature: source.anchorsSignature } : {}),
+    };
 }
 /**
  * Verifies that a user update signature is valid, throws on invalid signature.
@@ -69,9 +124,31 @@ function verifyUserSignedBySelf(user) {
     if (!user.signature) {
         throw new Error("A confirmed key change still has to be signed by the new key");
     }
-    (0, keys_1.verifyObjectSignature)(signedPart(user));
-    const signerPublicKey = (0, keys_1.getPublicKeyFromObjectSignature)(user) ?? "";
-    if (signerPublicKey !== user.publicKey) {
-        throw new Error("User signature must be signed with their own public key");
-    }
+    verifyUserSignature(user);
+}
+/**
+ * Whether `user`'s current key is `earlierKey`, or was handed over from it: `earlierKey` is in
+ * `keySuccession` and each link from there on is signed by its key and names the next (the
+ * last names `publicKey`). A forged profile can't produce this, since only the holder of
+ * `earlierKey` can sign its handover. The list itself sits under the profile's own signature.
+ *
+ * @param user - A profile row whose own signature has been checked.
+ * @param earlierKey - The key a grant or record names.
+ */
+function keySucceeds(user, earlierKey) {
+    if (user.publicKey === earlierKey)
+        return true;
+    const links = user.keySuccession ?? [];
+    const start = links.findIndex((link) => link.publicKey === earlierKey);
+    if (start < 0)
+        return false;
+    return links.slice(start).every((link, i, rest) => (0, anchor_document_1.verifySuccession)({
+        userId: user.userId,
+        recordPublicKey: link.publicKey,
+        entry: {
+            publicKey: rest[i + 1]?.publicKey ?? user.publicKey,
+            issuedAt: link.issuedAt,
+            authorizedBy: { publicKey: link.publicKey, signature: link.signature },
+        },
+    }));
 }

package/dist/data/users.d.ts

@@ -1,7 +1,29 @@
 import { z } from "zod";
 import type { DataContext } from "../context/data-context";
+import type { UserRowChangeDecision } from "../identity/user-row-change";
 import type { ISaveOptions } from "./orm/data-query";
 import { Table } from "./orm/table";
+/** Most earlier keys a profile carries; a rotation past this drops the oldest. */
+export declare const MAX_KEY_SUCCESSION = 8;
+/**
+ * One earlier key and its handover: `signature` is that key's signature over the
+ * `peers-key-succession` statement naming the next key (see `signSuccession`).
+ */
+export declare const keySuccessionLinkSchema: z.ZodObject<{
+    publicKey: z.ZodString;
+    issuedAt: z.ZodString;
+    signature: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    publicKey: string;
+    signature: string;
+    issuedAt: string;
+}, {
+    publicKey: string;
+    signature: string;
+    issuedAt: string;
+}>;
+/** One earlier key and its signed handover to the next. */
+export type IKeySuccessionLink = z.infer<typeof keySuccessionLinkSchema>;
 /** Schema for a signed user profile. */
 export declare const userSchema: z.ZodObject<{
     userId: z.ZodEffects<z.ZodString, string, string>;
@@ -18,6 +40,20 @@ export declare const userSchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }>, "many">>;
+    anchorsSignature: z.ZodOptional<z.ZodString>;
+    keySuccession: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        publicKey: z.ZodString;
+        issuedAt: z.ZodString;
+        signature: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        publicKey: string;
+        signature: string;
+        issuedAt: string;
+    }, {
+        publicKey: string;
+        signature: string;
+        issuedAt: string;
+    }>, "many">>;
     signature: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     name: string;
@@ -29,6 +65,12 @@ export declare const userSchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }[] | undefined;
+    anchorsSignature?: string | undefined;
+    keySuccession?: {
+        publicKey: string;
+        signature: string;
+        issuedAt: string;
+    }[] | undefined;
 }, {
     name: string;
     publicKey: string;
@@ -39,6 +81,12 @@ export declare const userSchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }[] | undefined;
+    anchorsSignature?: string | undefined;
+    keySuccession?: {
+        publicKey: string;
+        signature: string;
+        issuedAt: string;
+    }[] | undefined;
 }>;
 /** A signed user profile shared across personal and group contexts. */
 export type IUser = z.infer<typeof userSchema>;
@@ -47,24 +95,13 @@ export type IUser = z.infer<typeof userSchema>;
  * which would otherwise call the resolver again.
  */
 export declare function writeResolvedUserKey(dataContext: DataContext, user: IUser): Promise<IUser>;
-/** Outcome of a {@link UserRowChangeGuard}. See `resolveUserRowChange` in the identity module. */
-export type UserRowChangeVerdict = {
-    action: "apply";
-    row: IUser;
-} | {
-    action: "defer";
-    reason: string;
-} | {
-    action: "refuse";
-    reason: string;
-};
 /**
  * Consulted by {@link UsersTable.save} when another user's row already exists in the table.
  * Decides whether a different key or anchor list may be stored, against the anchors on
  * record. `apply` carries the row to store, whose `anchors` may have been replaced by the
  * list on record.
  */
-export type UserRowChangeGuard = (personalContext: DataContext, incoming: IUser, existing: IUser) => Promise<UserRowChangeVerdict>;
+export type UserRowChangeGuard = (personalContext: DataContext, incoming: IUser, existing: IUser) => Promise<UserRowChangeDecision>;
 /** Installs the identity check used by {@link UsersTable.save}. The identity module sets this. */
 export declare function setUserRowChangeGuard(guard: UserRowChangeGuard | undefined): void;
 /** User table with owner-signature enforcement outside the personal context. */

package/dist/data/users.js

@@ -34,7 +34,7 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     done = true;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UsersTable = exports.userSchema = void 0;
+exports.UsersTable = exports.userSchema = exports.keySuccessionLinkSchema = exports.MAX_KEY_SUCCESSION = void 0;
 exports.writeResolvedUserKey = writeResolvedUserKey;
 exports.setUserRowChangeGuard = setUserRowChangeGuard;
 exports.Users = Users;
@@ -50,6 +50,17 @@ const table_1 = require("./orm/table");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
 const user_permissions_1 = require("./user-permissions");
+/** Most earlier keys a profile carries; a rotation past this drops the oldest. */
+exports.MAX_KEY_SUCCESSION = 8;
+/**
+ * One earlier key and its handover: `signature` is that key's signature over the
+ * `peers-key-succession` statement naming the next key (see `signSuccession`).
+ */
+exports.keySuccessionLinkSchema = zod_1.z.object({
+    publicKey: zod_1.z.string(),
+    issuedAt: zod_1.z.string(),
+    signature: zod_1.z.string(),
+});
 /** Schema for a signed user profile. */
 exports.userSchema = zod_1.z.object({
     userId: zod_types_1.zodPeerId,
@@ -62,6 +73,15 @@ exports.userSchema = zod_1.z.object({
         .array(anchor_document_1.anchorRefSchema)
         .optional()
         .describe("Anchors on record for this user. A peer that already has a list updates it from those anchors, not from a row that arrives with a new key. Not covered by the row's signature"),
+    anchorsSignature: zod_1.z
+        .string()
+        .optional()
+        .describe("Owner's signature authorizing the first anchor list"),
+    keySuccession: zod_1.z
+        .array(exports.keySuccessionLinkSchema)
+        .max(exports.MAX_KEY_SUCCESSION)
+        .optional()
+        .describe("This user's earlier signing keys, oldest first, each with its signature handing over to the next key (the last to publicKey). A group membership granted to an earlier key still counts for the current one"),
     signature: zod_1.z
         .string()
         .optional()

package/dist/data/workflows.d.ts

@@ -3,6 +3,7 @@ export declare function Workflows(dataContext?: DataContext): import("..").Table
     name: string;
     description: string;
     updatedAt: Date;
+    createdBy: string;
     createdAt: Date;
     workflowId: string;
     defaultAssistantId: string;
@@ -12,6 +13,5 @@ export declare function Workflows(dataContext?: DataContext): import("..").Table
         directCallToolId?: string | undefined;
         subWorkflowId?: string | undefined;
     }[];
-    createdBy: string;
     packageId?: string | undefined;
 }>;

package/dist/device/binary-peer-connection-v2.d.ts

@@ -18,7 +18,7 @@
  * 3. **Frame cipher**: once `armFrameCipher` is called (by `Connection` after
  *    the handshake), every outbound frame is sealed as `FRAME_ENC` and every
  *    inbound frame must be sealed. See `frame-cipher.ts` and
- *    `working/transport-security.md`.
+ *    `working/done/transport-security.md`.
  */
 import { Connection } from "./connection";
 import type { Device } from "./device";

package/dist/device/binary-peer-connection-v2.js

@@ -19,7 +19,7 @@
  * 3. **Frame cipher**: once `armFrameCipher` is called (by `Connection` after
  *    the handshake), every outbound frame is sealed as `FRAME_ENC` and every
  *    inbound frame must be sealed. See `frame-cipher.ts` and
- *    `working/transport-security.md`.
+ *    `working/done/transport-security.md`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_BINARY_PEER_RECEIVE_LIMITS = void 0;

package/dist/device/connection.d.ts

@@ -48,8 +48,8 @@ export declare class Connection {
     get remoteDeviceInfo(): {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };

package/dist/device/frame-cipher.d.ts

@@ -23,7 +23,7 @@
  * mismatch. AAD is the UTF-8 `connectionId`, binding every frame to the
  * connection it was sealed for.
  *
- * Design: `working/transport-security.md`.
+ * Design: `working/done/transport-security.md`.
  */
 /** Frame type byte for a sealed frame. The only cleartext byte on the wire once armed. */
 export declare const FRAME_ENC = 32;

package/dist/device/frame-cipher.js

@@ -24,7 +24,7 @@
  * mismatch. AAD is the UTF-8 `connectionId`, binding every frame to the
  * connection it was sealed for.
  *
- * Design: `working/transport-security.md`.
+ * Design: `working/done/transport-security.md`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FrameOpener = exports.FrameSealer = exports.FRAME_CIPHER_KEY_BYTES = exports.FRAME_CIPHER_OVERHEAD = exports.FRAME_CIPHER_TAG_BYTES = exports.FRAME_ENC = void 0;

package/dist/device/get-trust-level-fn.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getTrustLevelFn = getTrustLevelFn;
 const context_1 = require("../context");
 const data_1 = require("../data");
+const user_permissions_1 = require("../data/user-permissions");
 const key_change_1 = require("../identity/key-change");
 const socket_type_1 = require("./socket.type");
 function applyReportedDeviceName(device, deviceInfo) {
@@ -32,9 +33,7 @@ function getTrustLevelFn(me, serverUrl) {
             return socket_type_1.TrustLevel.Untrusted;
         }
         // if this is my own device it is trusted
-        if (deviceInfo.userId === me.userId &&
-            deviceInfo.publicKey === me.publicKey &&
-            deviceInfo.publicBoxKey === me.publicBoxKey) {
+        if ((0, user_permissions_1.sameUserIdentity)(deviceInfo, me)) {
             // if (deviceInfo.deviceId === thisDeviceId()) {
             //   return TrustLevel.Untrusted;
             // }
@@ -96,9 +95,7 @@ function getTrustLevelFn(me, serverUrl) {
                 (device ? deviceInfo.userId !== device.userId : false))) {
             return socket_type_1.TrustLevel.Untrusted;
         }
-        if (effectiveUser &&
-            (deviceInfo.publicKey !== effectiveUser.publicKey ||
-                deviceInfo.publicBoxKey !== effectiveUser.publicBoxKey)) {
+        if (effectiveUser && !(0, user_permissions_1.sameUserIdentity)(deviceInfo, effectiveUser)) {
             // A different box key for the key on record is a mismatch. A different signing key is
             // accepted only when the anchors on record confirm a rotation.
             if (deviceInfo.publicKey === effectiveUser.publicKey) {

package/dist/device-pairing/types.d.ts

@@ -1142,15 +1142,15 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1164,15 +1164,15 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1188,16 +1188,16 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     sourceIdentity: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
     destinationIdentity: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1212,16 +1212,16 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     sourceIdentity: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
     destinationIdentity: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1262,15 +1262,15 @@ export declare const pairingConfirmationContentsSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1293,8 +1293,8 @@ export declare const pairingConfirmationContentsSchema: z.ZodObject<{
     device: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1310,8 +1310,8 @@ export declare const pairingConfirmationContentsSchema: z.ZodObject<{
     device: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1342,15 +1342,15 @@ export declare const pairingConfirmationSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1375,8 +1375,8 @@ export declare const pairingConfirmationSchema: z.ZodObject<{
     device: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1393,8 +1393,8 @@ export declare const pairingConfirmationSchema: z.ZodObject<{
     device: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1460,15 +1460,15 @@ export declare const pairingInstallationReceiptContentsSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1479,8 +1479,8 @@ export declare const pairingInstallationReceiptContentsSchema: z.ZodObject<{
     initializedDevice: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1491,8 +1491,8 @@ export declare const pairingInstallationReceiptContentsSchema: z.ZodObject<{
     initializedDevice: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1515,15 +1515,15 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         }, "strip", z.ZodTypeAny, {
             publicKey: string;
             userId: string;
-            deviceId: string;
             publicBoxKey: string;
+            deviceId: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         }, {
             publicKey: string;
             userId: string;
-            deviceId: string;
             publicBoxKey: string;
+            deviceId: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         }>;
@@ -1534,8 +1534,8 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         initializedDevice: {
             publicKey: string;
             userId: string;
-            deviceId: string;
             publicBoxKey: string;
+            deviceId: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         };
@@ -1546,8 +1546,8 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         initializedDevice: {
             publicKey: string;
             userId: string;
-            deviceId: string;
             publicBoxKey: string;
+            deviceId: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         };
@@ -1564,8 +1564,8 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         initializedDevice: {
             publicKey: string;
             userId: string;
-            deviceId: string;
             publicBoxKey: string;
+            deviceId: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         };
@@ -1580,8 +1580,8 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         initializedDevice: {
             publicKey: string;
             userId: string;
-            deviceId: string;
             publicBoxKey: string;
+            deviceId: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         };

package/dist/identity/user-row-change.d.ts

@@ -33,9 +33,11 @@ export interface ResolveUserRowChangeParams {
  * The record is the personal `Users` row when it exists, else the row already stored in the
  * table being written. The rule:
  *
- * - Nothing stored yet: the row is the bootstrap and is applied as it is.
+ * - Nothing stored yet: bootstrap the identity; its initial anchors need an owner signature.
  * - A different key: the anchors on record decide ({@link evaluatePresentedKey}). The
  *   presented anchor list is ignored; the applied row keeps the list on record.
+ * - The user's own row with their current keys: takes the anchor list from their personal row.
+ * - A row with no list keeps the list on record.
  * - The same key and a different list: when nothing is on record the list is accepted as the
  *   bootstrap (an upgraded contact announcing its first anchors); when the personal record
  *   already holds the list it is accepted; otherwise the anchors on record must publish it