@cairnkeep/cli 2.25.0 → 2.27.0

package/mcp-memory-server/dist/team-cli.js

@@ -1,12 +1,15 @@
-import { closeSync, existsSync, openSync, writeFileSync, fsyncSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { readStableJson } from './stable-file.js';
-import { hardenPrivatePath } from './platform-security.js';
-import { openTeamStore, restoreTeamSnapshot, verifyTeamSnapshot, prepareTeamPrivateDirectory, TEAM_SNAPSHOT_MAX_BYTES, TeamError } from './team-store.js';
+import { openTeamStore, restoreTeamSnapshot, verifyTeamSnapshot, TEAM_SNAPSHOT_MAX_BYTES, TeamError } from './team-store.js';
+import { writePrivateExclusive } from './team-files.js';
+export { writePrivateExclusive } from './team-files.js';
 import { createTeamHttpServer, teamRequest } from './team-http.js';
 import { createTeamMcpServer, teamClientToken } from './team-mcp.js';
+import { readTeamConnection, connectionToken } from './team-client.js';
+import { verifyTeamAuditArchive } from './team-audit.js';
 const HELP = `cairn team — experimental token-first team continuity (default off)
 
 CAIRN_TEAM=1 is required. Personal memory is never uploaded.
@@ -18,8 +21,11 @@ CAIRN_TEAM=1 is required. Personal memory is never uploaded.
   cairn team credential issue SUBJECT --class human|workload --expires-at ISO --output FILE [--data DIR]
   cairn team credential revoke ID [--data DIR]
   cairn team serve [--data DIR] [--port PORT]  # requires CAIRN_TEAM_HTTP=1; loopback only
-  cairn team mcp [--project-root PATH]        # local stdio MCP; no review/admin tools
-  cairn team list --project ID
+  cairn team connect [--project-root PATH] [--url URL --organization ID --project ID --token-file FILE --harness LIST] [--access read-only|full] [--apply --yes]
+  cairn team disconnect [--project-root PATH] [--apply --yes]
+  cairn team doctor --client [--project-root PATH]
+  cairn team mcp [--project-root PATH | --connection FILE] # local stdio MCP; no review/admin tools
+  cairn team list --project ID [--page-size N --cursor CURSOR]
   cairn team proposals --project ID
   cairn team audit --project ID             # scoped, value-free metadata
   cairn team read --project ID --key KEY [--revision DIGEST]
@@ -28,8 +34,11 @@ CAIRN_TEAM=1 is required. Personal memory is never uploaded.
   cairn team proposal-show --project ID --proposal ID
   cairn team propose --project ID --input FILE --confirm VALUE_DIGEST
   cairn team review --project ID --proposal ID --decision approve|reject --confirm PROPOSAL_DIGEST
-  cairn team doctor [--data DIR]
-  cairn team backup --output FILE [--data DIR]
+  cairn team doctor [--data DIR]             # capacity and audit checkpoint
+  cairn team backup --output FILE [--read-only] [--data DIR]
+  cairn team audit-export --backup FILE --output FILE [--data DIR]
+  cairn team audit-verify --input FILE [--previous FILE]
+  cairn team audit-archive --input FILE --backup FILE --confirm DIGEST [--apply] [--data DIR]
   cairn team restore --input FILE --confirm SNAPSHOT_DIGEST --data NEW_DIR
   cairn team memory-delete --project ID --key KEY --confirm REVISION_DIGEST [--data DIR]
 
@@ -37,15 +46,25 @@ Clients require CAIRN_TEAM_URL, CAIRN_TEAM_ORGANIZATION and CAIRN_TEAM_TOKEN_FIL
 Never put tokens in command arguments, source trees or harness config.
 Team API is not OAuth MCP HTTP. Independent production security review and a
 deployment-specific approved real-data pilot remain admission gates. See docs/team.md.
+Paging is optional for list/search/history/proposals/audit. Repeat filters and
+page size with the returned next_cursor. Search pages are at most ten items.
+Audit export is metadata-only and does not mutate the store. Archival defaults
+to a no-write plan, retains files, and explicitly upgrades the team store to v2.
 `;
 function parse(args) {
     const words = [];
     const flags = {};
-    const known = new Set(['data', 'organization', 'project', 'roles', 'class', 'expires-at', 'output', 'port', 'project-root', 'key', 'revision', 'query', 'proposal', 'input', 'confirm', 'decision']);
+    const known = new Set(['data', 'organization', 'project', 'roles', 'class', 'expires-at', 'output', 'port', 'project-root', 'key', 'revision', 'query', 'proposal', 'input', 'confirm', 'decision', 'connection', 'backup', 'apply', 'read-only', 'page-size', 'cursor', 'previous']);
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
         if (arg.startsWith('--')) {
             const name = arg.slice(2);
+            if (['apply', 'read-only'].includes(name)) {
+                if (flags[name] !== undefined)
+                    throw new TeamError('invalid');
+                flags[name] = 'true';
+                continue;
+            }
             if (!known.has(name) || flags[name] !== undefined || !args[i + 1] || args[i + 1].startsWith('--'))
                 throw new TeamError('invalid');
             flags[name] = args[++i];
@@ -55,20 +74,6 @@ function parse(args) {
     }
     return { words, flags };
 }
-export function writePrivateExclusive(path, bytes) {
-    path = resolve(path);
-    const directory = dirname(path);
-    prepareTeamPrivateDirectory(directory, true);
-    const fd = openSync(path, 'wx', 0o600);
-    try {
-        hardenPrivatePath(path);
-        writeFileSync(fd, bytes, 'utf8');
-        fsyncSync(fd);
-    }
-    finally {
-        closeSync(fd);
-    }
-}
 async function main(args) {
     if (args.length === 0 || args.includes('--help') || args.includes('-h')) {
         console.log(HELP);
@@ -81,10 +86,12 @@ async function main(args) {
     const allowed = {
         init: ['data', 'organization'], project: ['data'], member: subcommand === 'remove' ? ['data', 'project'] : ['data', 'project', 'roles'],
         credential: subcommand === 'issue' ? ['data', 'class', 'expires-at', 'output'] : ['data'],
-        serve: ['data', 'port'], mcp: ['project-root'], doctor: ['data'], backup: ['data', 'output'],
+        serve: ['data', 'port'], mcp: ['project-root', 'connection'], doctor: ['data'], backup: ['data', 'output', 'read-only'],
+        'audit-export': ['data', 'backup', 'output'], 'audit-archive': ['data', 'backup', 'input', 'confirm', 'apply'],
+        'audit-verify': ['input', 'previous'],
         restore: ['data', 'input', 'confirm'], 'memory-delete': ['data', 'project', 'key', 'confirm'],
-        list: ['project'], proposals: ['project'], audit: ['project'], read: ['project', 'key', 'revision'],
-        history: ['project', 'key'], search: ['project', 'query'], 'proposal-show': ['project', 'proposal'],
+        list: ['project', 'page-size', 'cursor'], proposals: ['project', 'page-size', 'cursor'], audit: ['project', 'page-size', 'cursor'], read: ['project', 'key', 'revision'],
+        history: ['project', 'key', 'page-size', 'cursor'], search: ['project', 'query', 'page-size', 'cursor'], 'proposal-show': ['project', 'proposal'],
         propose: ['project', 'input', 'confirm'], review: ['project', 'proposal', 'decision', 'confirm'],
     };
     if (!allowed[command] || Object.keys(flags).some(flag => !allowed[command].includes(flag)))
@@ -96,11 +103,30 @@ async function main(args) {
     const print = (result) => console.log(JSON.stringify(result, null, 2));
     let store;
     try {
+        if (command === 'audit-verify') {
+            if (words.length !== 1 || !flags.input)
+                throw new TeamError('invalid');
+            const load = (path) => verifyTeamAuditArchive(readStableJson(resolve(path), { label: 'Team audit archive', maxBytes: TEAM_SNAPSHOT_MAX_BYTES, private: true }));
+            const archive = load(flags.input);
+            if (flags.previous) {
+                const previous = load(flags.previous), last = previous.entries[previous.entries.length - 1], checkpoint = archive.previous_checkpoint;
+                if (previous.organization !== archive.organization || !checkpoint || checkpoint.archive_digest !== previous.digest || checkpoint.backup_digest !== previous.backup_digest || checkpoint.sequence !== last.sequence || checkpoint.digest !== last.digest || checkpoint.previous_archive_digest !== (previous.previous_checkpoint?.archive_digest ?? null))
+                    throw new TeamError('integrity');
+            }
+            print({ verified: true, archive_digest: archive.digest, events: archive.entries.length, first_sequence: archive.entries[0].sequence, last_sequence: archive.entries[archive.entries.length - 1].sequence, previous_archive_digest: archive.previous_checkpoint?.archive_digest ?? null, previous_link_verified: !!flags.previous, history_scope: 'single-segment-and-optional-previous-link' });
+            return;
+        }
         if (command === 'mcp') {
             if (words.length !== 1)
                 throw new TeamError('invalid');
-            teamClientToken(); // validate private credential before startup
-            const server = await createTeamMcpServer({ url: process.env.CAIRN_TEAM_URL ?? '', organization: process.env.CAIRN_TEAM_ORGANIZATION ?? '', token: () => teamClientToken(), projectRoot: flags['project-root'] });
+            if (flags.connection && flags['project-root'])
+                throw new TeamError('invalid');
+            const connection = flags.connection ? readTeamConnection(resolve(flags.connection)) : undefined;
+            const token = connection ? () => connectionToken(connection) : () => teamClientToken();
+            token(); // validate private credential before startup
+            const server = await createTeamMcpServer(connection
+                ? { url: connection.url, organization: connection.organization, project: connection.project, readOnly: connection.access === 'read-only', token, projectRoot: connection.project_root }
+                : { url: process.env.CAIRN_TEAM_URL ?? '', organization: process.env.CAIRN_TEAM_ORGANIZATION ?? '', token, projectRoot: flags['project-root'] });
             await server.connect(new StdioServerTransport());
             return;
         }
@@ -112,7 +138,7 @@ async function main(args) {
             print({ restored: true, organization: store.organization, credentials_revoked: true });
             return;
         }
-        if (['init', 'project', 'member', 'credential', 'serve', 'doctor', 'backup', 'memory-delete'].includes(command)) {
+        if (['init', 'project', 'member', 'credential', 'serve', 'doctor', 'backup', 'memory-delete', 'audit-export', 'audit-archive'].includes(command)) {
             if (command === 'init' && (words.length !== 1 || !flags.organization))
                 throw new TeamError('invalid');
             store = await openTeamStore(root, command === 'init' ? { create: true, organization: flags.organization } : {});
@@ -123,11 +149,30 @@ async function main(args) {
             if (command === 'backup' && words.length === 1) {
                 if (!flags.output)
                     throw new TeamError('invalid');
-                const snapshot = await store.snapshot();
+                const snapshot = await store.snapshot({ audit: flags['read-only'] !== 'true' });
                 writePrivateExclusive(flags.output, `${JSON.stringify(snapshot)}\n`);
                 print({ snapshot_digest: snapshot.digest, written: true });
                 return;
             }
+            if (['audit-export', 'audit-archive'].includes(command) && words.length === 1) {
+                if (!flags.backup)
+                    throw new TeamError('invalid');
+                const backup = verifyTeamSnapshot(readStableJson(resolve(flags.backup), { label: 'Team archival backup', maxBytes: TEAM_SNAPSHOT_MAX_BYTES, private: true }));
+                if (command === 'audit-export') {
+                    if (!flags.output)
+                        throw new TeamError('invalid');
+                    const archive = await store.exportAudit(backup);
+                    writePrivateExclusive(flags.output, `${JSON.stringify(archive)}\n`);
+                    print({ written: true, archive_digest: archive.digest, backup_digest: archive.backup_digest, events: archive.entries.length });
+                }
+                else {
+                    if (!flags.input || !flags.confirm)
+                        throw new TeamError('invalid');
+                    const archive = verifyTeamAuditArchive(readStableJson(resolve(flags.input), { label: 'Team audit archive', maxBytes: TEAM_SNAPSHOT_MAX_BYTES, private: true }));
+                    print(await store.archiveAudit(archive, backup, flags.confirm, flags.apply === 'true'));
+                }
+                return;
+            }
             if (command === 'memory-delete' && words.length === 1) {
                 await store.admin({ operation: 'memory-delete', project: flags.project, key: flags.key, confirm: flags.confirm });
                 print({ deleted: true, backup_copies_retained: true });
@@ -206,6 +251,12 @@ async function main(args) {
         }
         else
             throw new TeamError('invalid');
+        if (flags['page-size'] || flags.cursor) {
+            const raw = flags['page-size'] ?? '100';
+            if (!/^[1-9][0-9]{0,2}$/.test(raw) || Number(raw) > 100 || (command === 'search' && Number(raw) > 10))
+                throw new TeamError('invalid');
+            input.page = { size: Number(raw), ...(flags.cursor ? { cursor: flags.cursor } : {}) };
+        }
         print(await teamRequest(process.env.CAIRN_TEAM_URL ?? '', teamClientToken(), input));
     }
     finally {

package/mcp-memory-server/dist/team-client.js

@@ -0,0 +1,71 @@
+import { dirname, isAbsolute, join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { readStableJson, readStableFile } from './stable-file.js';
+import { teamClientToken } from './team-mcp.js';
+import { teamRequest, validateTeamUrl } from './team-http.js';
+import { TeamError } from './team-store.js';
+const id = z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/);
+const path = z.string().min(1).max(4096).refine(value => isAbsolute(value) && !/[\x00-\x1f\x7f]/.test(value));
+const schema = z.object({
+    schema_version: z.literal(1), project_root: path,
+    organization: id, project: id, url: z.string().max(4096), token_file: path,
+    access: z.enum(['read-only', 'full']),
+}).strict();
+export class TeamClientError extends Error {
+}
+export function validateTeamConnection(value) {
+    const result = schema.safeParse(value);
+    if (!result.success)
+        throw new TeamClientError('Team connection fields are invalid; check organization/project IDs, absolute paths and access profile.');
+    try {
+        validateTeamUrl(result.data.url);
+    }
+    catch {
+        throw new TeamClientError('Team connection URL must be loopback HTTP or HTTPS without credentials, query, fragment or path prefix.');
+    }
+    return result.data;
+}
+export function readTeamConnection(path) {
+    const { bytes } = readStableFile(path, { label: 'Team connection', maxBytes: 32768, private: true });
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new TeamClientError('Team connection contains invalid UTF-8 or JSON.');
+    }
+    const connection = validateTeamConnection(value);
+    const receipt = readStableJson(join(dirname(path), 'receipt.json'), { label: 'Team connection activation', maxBytes: 16 * 1024 * 1024, private: true });
+    if (!receipt || typeof receipt !== 'object' || Array.isArray(receipt)
+        || receipt.schema_version !== 1
+        || receipt.status !== 'connected'
+        || receipt.project_root !== connection.project_root)
+        throw new TeamClientError('Team connection is incomplete or disconnected; inspect recovery state.');
+    if (receipt.connection_digest !== createHash('sha256').update(bytes).digest('hex'))
+        throw new TeamClientError('Team connection activation changed; inspect recovery state.');
+    return connection;
+}
+export function connectionToken(connection) {
+    try {
+        return teamClientToken({ CAIRN_TEAM_TOKEN_FILE: connection.token_file });
+    }
+    catch {
+        throw new TeamClientError('Team credential file is unsafe or unreadable; use an owner-only file issued by the operator.');
+    }
+}
+/** Authenticate and check reader membership without retrieving memory or proposals.
+ * Expiry and roles come from the service, never from guesses about opaque tokens. */
+export async function connectionDoctor(connection) {
+    connection = validateTeamConnection(connection);
+    const token = connectionToken(connection);
+    const result = await teamRequest(connection.url, token, { organization: connection.organization, project: connection.project, operation: 'connection-check' });
+    const metadata = z.object({ schema_version: z.literal(1), organization: id, project: id,
+        subject: id, credential_id: z.string().uuid(), credential_class: z.enum(['human', 'workload']),
+        expires_at: z.iso.datetime(), roles: z.array(z.enum(['reader', 'contributor', 'reviewer', 'maintainer', 'auditor'])).max(5),
+    }).strict().safeParse(result);
+    if (!metadata.success || metadata.data.organization !== connection.organization || metadata.data.project !== connection.project
+        || !metadata.data.roles.includes('reader') || Date.parse(metadata.data.expires_at) <= Date.now())
+        throw new TeamError('integrity');
+    return { ok: true, ...metadata.data, access: connection.access, experimental: true };
+}

package/mcp-memory-server/dist/team-errors.js

@@ -0,0 +1,7 @@
+export class TeamError extends Error {
+    code;
+    constructor(code) {
+        super(`Team ${code}.`);
+        this.code = code;
+    }
+}

package/mcp-memory-server/dist/team-files.js

@@ -0,0 +1,28 @@
+import { closeSync, openSync, writeFileSync, fsyncSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { hardenPrivatePath } from './platform-security.js';
+import { prepareTeamPrivateDirectory } from './team-store.js';
+export function writePrivateExclusive(path, bytes) {
+    path = resolve(path);
+    prepareTeamPrivateDirectory(dirname(path), true);
+    const fd = openSync(path, 'wx', 0o600);
+    try {
+        hardenPrivatePath(path);
+        writeFileSync(fd, bytes, 'utf8');
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    // Persist the new directory entry as well as its contents on POSIX.
+    // Node cannot open/fsync a directory handle on Windows.
+    if (process.platform !== 'win32') {
+        const parent = openSync(dirname(path), 'r');
+        try {
+            fsyncSync(parent);
+        }
+        finally {
+            closeSync(parent);
+        }
+    }
+}

package/mcp-memory-server/dist/team-mcp.js

@@ -5,6 +5,7 @@ import { isCapabilityContractEnabled, resolveCapabilityStatus } from './capabili
 import { teamRequest, validateTeamUrl } from './team-http.js';
 import { TeamError, teamDigest } from './team-store.js';
 import { resolveHttpToken } from './http-security.js';
+import { teamPageSchema } from './team-pages.js';
 const observation = (title) => ({ title, annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true } });
 // The bridge crosses the local process boundary into a remote team service;
 // openWorldHint is true even though team retrieval is deterministic and closed
@@ -32,6 +33,8 @@ export async function createTeamMcpServer(options) {
     validateTeamUrl(options.url);
     if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(options.organization))
         throw new TeamError('invalid');
+    if (options.project !== undefined && !/^[a-z0-9][a-z0-9-]{0,63}$/.test(options.project))
+        throw new TeamError('invalid');
     const profile = resolveMcpToolProfile({ projectRoot: options.projectRoot });
     const capability = isCapabilityContractEnabled() ? await resolveCapabilityStatus({ projectRoot: options.projectRoot }) : undefined;
     if (capability?.issues.length)
@@ -47,16 +50,18 @@ export async function createTeamMcpServer(options) {
     const key = z.string().regex(/^(decisions|patterns|constraints|pitfalls|conventions|bugs)\/[a-z0-9][a-z0-9-]{0,95}$/);
     const hash = z.string().regex(/^[a-f0-9]{64}$/);
     const schemas = {
-        team_memory_list: { project },
+        team_memory_list: { project, page: teamPageSchema.optional() },
         team_memory_read: { project, key, revision: hash.optional() },
-        team_memory_search: { project, query: z.string().min(1).max(256) },
-        team_memory_history: { project, key },
+        team_memory_search: { project, query: z.string().min(1).max(256), page: teamPageSchema.extend({ size: z.number().int().min(1).max(10) }).optional() },
+        team_memory_history: { project, key, page: teamPageSchema.optional() },
         team_memory_propose: { project, request_id: z.string().uuid(), key, value: z.string().min(1).max(65536), source_scope: z.enum(['selected-local', 'selected-project']), source_digest: hash, base_revision: hash.nullable(), expires_at: z.iso.datetime(), confirm: hash },
     };
     const operations = { team_memory_list: 'list', team_memory_read: 'read', team_memory_search: 'search', team_memory_history: 'history', team_memory_propose: 'propose' };
     const enabled = Object.keys(TEAM_TOOL_CATALOG).filter(name => {
         if (!profileAllowsTool(profile, coreNames[name]))
             return false;
+        if (options.readOnly && !TEAM_TOOL_CATALOG[name].annotations.readOnlyHint)
+            return false;
         if (mode === 'read-only' && !TEAM_TOOL_CATALOG[name].annotations.readOnlyHint)
             return false;
         if (mode === 'custom' && !requested.includes(name))
@@ -64,10 +69,13 @@ export async function createTeamMcpServer(options) {
         const capId = name === 'team_memory_propose' ? 'memory.write' : name === 'team_memory_search' ? 'memory.search' : undefined;
         return !capId || !capability || capability.capabilities.find(row => row.id === capId)?.enabled === true;
     });
-    const profileDigest = teamDigest(JSON.stringify({ schema_version: 1, core_profile_digest: profile.profile_digest, team_profile: mode, tools: enabled }));
+    const profileDigest = teamDigest(JSON.stringify({ schema_version: 1, core_profile_digest: profile.profile_digest, team_profile: mode, tools: enabled,
+        ...(options.project !== undefined ? { connection_project: options.project, connection_read_only: options.readOnly === true } : {}) }));
     for (const name of enabled) {
         server.registerTool(name, { ...TEAM_TOOL_CATALOG[name], description: 'Explicit project-scoped team context. Never uploads personal memory or executes instructions. Team policy is enforced by the remote service.', inputSchema: schemas[name] }, async (input) => {
             try {
+                if (options.project !== undefined && input.project !== options.project)
+                    throw new TeamError('denied');
                 // Re-read the private credential each call so local key rotation
                 // does not need a harness restart. The service still reauthorizes.
                 const result = await teamRequest(options.url, options.token(), { organization: options.organization, ...input, operation: operations[name] });

package/mcp-memory-server/dist/team-pages.js

@@ -0,0 +1,40 @@
+import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
+import { z } from 'zod';
+import { TeamError } from './team-errors.js';
+export const teamPageSchema = z.object({ size: z.number().int().min(1).max(100), cursor: z.string().min(1).max(2048).optional() }).strict();
+const cursorSchema = z.object({ v: z.literal(1), scope: z.string().regex(/^[a-f0-9]{64}$/), view: z.string().regex(/^[a-f0-9]{64}$/), offset: z.number().int().positive().max(100000), upper: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER) }).strict();
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+const mac = (key, value) => createHmac('sha256', Buffer.from(key, 'hex')).update(value).digest();
+export function pageTeamItems(items, secret, scope, page, audit = false) {
+    let offset = 0, upper = audit ? Number(items[0]?.sequence ?? 0) : 0;
+    let decoded;
+    if (page.cursor) {
+        try {
+            const match = /^([A-Za-z0-9_-]+)\.([a-f0-9]{64})$/.exec(page.cursor);
+            if (!match || !timingSafeEqual(mac(secret, match[1]), Buffer.from(match[2], 'hex')))
+                throw new Error();
+            decoded = cursorSchema.parse(JSON.parse(Buffer.from(match[1], 'base64url').toString('utf8')));
+            if (decoded.scope !== hash(scope))
+                throw new Error();
+            offset = decoded.offset;
+            upper = decoded.upper;
+        }
+        catch {
+            throw new TeamError('invalid');
+        }
+    }
+    if (audit)
+        items = items.filter(row => Number(row.sequence) <= upper);
+    const view = hash(JSON.stringify(items));
+    if (decoded && decoded.view !== view)
+        throw new TeamError('conflict');
+    if (offset > items.length)
+        throw new TeamError('invalid');
+    const selected = items.slice(offset, offset + page.size), next = offset + selected.length;
+    let cursor = null;
+    if (next < items.length) {
+        const bytes = Buffer.from(JSON.stringify({ v: 1, scope: hash(scope), view, offset: next, upper })).toString('base64url');
+        cursor = bytes + '.' + mac(secret, bytes).toString('hex');
+    }
+    return { items: selected, next_cursor: cursor };
+}