rea-agents 6.4.0 → 6.7.0

package/dist/contracts/toolOutputSchemaPrimitives.js

@@ -6,6 +6,8 @@ import { jsonValueSchema } from "../domain/jsonValue.js";
 import { PROVIDER_REJECTION_CODES, } from "./providerSelection.js";
 import { PROVIDER_FAILURE_STAGES, PROVIDER_OPERATION_STATES, PROVIDER_RETRY_ACTIONS, } from "../domain/providerOperationHealth.js";
 import { analysisErrorProjectionSchema } from "./errorSchemas.js";
+import { relationshipCoverageSchema } from "../domain/relationshipCoverage.js";
+import { ZIP_PACKAGE_FORMATS } from "../domain/zipPackageFormat.js";
 /** Specialize the single normalized result inside a complete Evidence record. */
 export const evidenceResultOf = (schema) => z
     .strictObject({ ...evidenceSchema.shape, normalized_result: schema })
@@ -23,15 +25,13 @@ export const targetFormatSchema = z.enum([
     "hopper",
     "analysis-database",
     "mach-o",
+    "mach-o-universal",
     "elf",
     "pe",
     "dos-mz",
     "dos-com",
-    "zip",
-    "ipa",
-    "apk",
-    "msix",
-    "appx",
+    "raw-binary",
+    ...ZIP_PACKAGE_FORMATS,
     "asar",
     "dmg",
     "pkg",
@@ -72,11 +72,53 @@ export const providerCapability = z.discriminatedUnion("available", [
         availability_code: z.enum(PROVIDER_REJECTION_CODES).nullable(),
     }),
 ]);
+/** Listed effects are true; all other members of this closed vocabulary are false. */
+export const PROVIDER_EFFECT_NAMES = Object.keys(providerCapabilityFacts.effects.shape);
 export const providerIdentity = z.object({
     id: z.string(),
     name: z.string(),
     version: z.string().nullable(),
 });
+const providerCapabilityGroupFacts = {
+    operations: z.array(z.string().min(1)).min(1),
+    effects: z.array(providerCapabilityFacts.effects.keyof()),
+    limitations: z.array(z.string()),
+};
+const providerCapabilityGroup = z.discriminatedUnion("available", [
+    z.strictObject({
+        ...providerCapabilityGroupFacts,
+        available: z.literal(true),
+        reason: z.null(),
+        availability_code: z.null(),
+    }),
+    z.strictObject({
+        ...providerCapabilityGroupFacts,
+        available: z.literal(false),
+        reason: z.string().nullable(),
+        availability_code: z.enum(PROVIDER_REJECTION_CODES).nullable(),
+    }),
+]);
+/** Shared limitations precede each group's suffix, preserving exact source order. */
+export const providerCapabilitySet = z.strictObject({
+    provider: providerIdentity,
+    shared_limitations: z.array(z.string()),
+    groups: z.array(providerCapabilityGroup),
+});
+/** Decode one status scope without losing provider identity or limitation order. */
+export const expandProviderCapabilities = (sets) => sets.flatMap((set) => set.groups.flatMap((group) => group.operations.map((operation) => ({
+    ...providerCapability.parse({
+        operation,
+        available: group.available,
+        reason: group.reason,
+        availability_code: group.availability_code,
+        effects: Object.fromEntries(PROVIDER_EFFECT_NAMES.map((name) => [
+            name,
+            group.effects.includes(name),
+        ])),
+        limitations: [...set.shared_limitations, ...group.limitations],
+    }),
+    provider: set.provider,
+}))));
 const processCoordinates = {
     launcher_pid: z.number().int().min(1),
     process_group_id: z.number().int().min(1),
@@ -147,6 +189,12 @@ export const providerOperationHealth = z
 const providerRejectionCode = z.enum(PROVIDER_REJECTION_CODES);
 const providerDiagnostics = z.record(z.string(), jsonValueSchema);
 const providerAvailability = z.discriminatedUnion("status", [
+    z.object({
+        status: z.literal("unknown"),
+        code: z.null(),
+        reason: z.string().min(1),
+        diagnostics: providerDiagnostics,
+    }),
     z.object({
         status: z.literal("available"),
         code: z.null(),
@@ -232,6 +280,8 @@ const toolAvailabilityFacts = {
         accessesNetwork: z.boolean(),
         changesUiState: z.boolean(),
         mayDiscardData: z.boolean(),
+        executesForeignCode: z.boolean(),
+        mutatesDevice: z.boolean(),
         idempotent: z.boolean(),
     }),
     annotations: z.object({
@@ -263,9 +313,54 @@ export const toolAvailability = z.discriminatedUnion("available", [
         remediation: z.string().nullable(),
     }),
 ]);
+export const TOOL_EFFECT_NAMES = Object.keys(toolAvailabilityFacts.effects.shape);
+export const TOOL_ANNOTATION_NAMES = Object.keys(toolAvailabilityFacts.annotations.shape);
+const toolAvailabilityGroupFacts = {
+    names: z.array(z.string().min(1)).min(1),
+    surface: toolAvailabilityFacts.surface,
+    default_mode_available: toolAvailabilityFacts.default_mode_available,
+    modes: toolAvailabilityFacts.modes,
+    client_requirements: toolAvailabilityFacts.client_requirements.optional(),
+    effects: z.array(toolAvailabilityFacts.effects.keyof()),
+    annotations: z.array(toolAvailabilityFacts.annotations.keyof()),
+};
+const toolAvailabilityGroup = z.discriminatedUnion("available", [
+    z.strictObject({
+        ...toolAvailabilityGroupFacts,
+        available: z.literal(true),
+        reason: z.literal("available"),
+        remediation: z.null(),
+    }),
+    z.strictObject({
+        ...toolAvailabilityGroupFacts,
+        available: z.literal(false),
+        reason: toolUnavailabilityReason,
+        remediation: z.string().nullable(),
+    }),
+]);
+/** Complete inventory with explicit inherited client requirements and enabled flags. */
+export const toolAvailabilityInventory = z.strictObject({
+    client_requirements: toolAvailabilityFacts.client_requirements,
+    groups: z.array(toolAvailabilityGroup),
+});
+/** Expand the wire representation once at the consuming boundary. */
+export const expandToolAvailability = (inventory) => inventory.groups.flatMap((group) => group.names.map((name) => toolAvailability.parse({
+    ...group,
+    name,
+    client_requirements: group.client_requirements ?? inventory.client_requirements,
+    effects: Object.fromEntries(TOOL_EFFECT_NAMES.map((effect) => [
+        effect,
+        group.effects.includes(effect),
+    ])),
+    annotations: Object.fromEntries(TOOL_ANNOTATION_NAMES.map((annotation) => [
+        annotation,
+        group.annotations.includes(annotation),
+    ])),
+})));
 export const sessionProvider = z
     .object({
-    capabilities: z.array(providerCapability),
+    cleanup_pending: z.boolean(),
+    capabilities: z.array(providerCapabilitySet),
     analysis_run: analysisRun,
     analysis_activity: analysisActivity,
     provider_operation_health: providerOperationHealth,
@@ -285,9 +380,9 @@ export const sessionProvider = z
         availability: providerAvailability,
         target_support: providerTargetSupport,
         selected: z.boolean(),
-        capabilities: z.array(providerCapability),
+        capabilities: z.array(providerCapabilitySet),
     })),
-    tool_availability: z.array(toolAvailability),
+    tool_availability: toolAvailabilityInventory,
     client_features: z.object({
         elicitation_form: z.boolean(),
         elicitation_url: z.boolean(),
@@ -305,7 +400,7 @@ export const sessionProvider = z
             name: z.string(),
             version: z.string(),
             started_at: z.string(),
-            command_path: z.string(),
+            command_path: z.string().nullable(),
         }),
         sdk: z.object({
             server: z.string(),
@@ -315,7 +410,18 @@ export const sessionProvider = z
         negotiated_protocol_version: z.string().nullable(),
         client: z.object({ name: z.string(), version: z.string() }).nullable(),
         skill: z.object({ name: z.string(), expected_version: z.string() }),
-        catalog: z.record(z.string(), jsonValueSchema),
+        catalog: z.strictObject({
+            counts: z.strictObject({
+                cli_commands: z.number().int().min(0),
+                mcp_tools: z.number().int().min(0),
+                mcp_prompts: z.number().int().min(0),
+            }),
+            digests: z.strictObject({
+                tools_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+                prompts_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+                combined_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+            }),
+        }),
         protocol_features: z.object({
             progress: z.boolean(),
             cancellation: z.boolean(),
@@ -417,6 +523,8 @@ export const graphNode = z.discriminatedUnion("status", [
         address: z.string(),
         status: z.literal("ok"),
         calls: z.array(z.string()),
+        relationship_coverage: relationshipCoverageSchema,
+        limitations: z.array(z.string()).optional(),
     }),
     z.object({
         address: z.string(),

package/dist/contracts/toolSchemaMetadata.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { advertisedInputExamples } from "./advertisedInputExamples.js";
 import { presentInputJsonSchema } from "./inputSchemaPresentation.js";
+import { schemaArrays, schemaChildren, schemaMaps, schemaLiteralValues, } from "./jsonSchemaKeywords.js";
 import { digestCanonicalValue } from "../domain/canonicalDigest.js";
 const PROPERTY_DESCRIPTIONS = {
     addresses: "Ordered provider-normalized procedure addresses to analyze.",
@@ -42,16 +43,23 @@ const PROPERTY_DESCRIPTIONS = {
 };
 /** Attach caller guidance to a canonical schema for the SDK wire projection. */
 export const toolInputSchemaWithMetadata = (contract) => withAdvertisedJsonSchema(contract.inputSchema, "input", (project) => (options) => {
-    const shared = project({
+    const inline = project({
         ...options,
-        libraryOptions: { reused: "ref", ...options.libraryOptions },
+        libraryOptions: { ...options.libraryOptions, reused: "inline" },
     });
     const examples = advertisedInputExamples(contract);
     return {
-        ...presentInputJsonSchema(shared, fallbackPropertyDescription),
+        // Keep advertised parameters self-contained for clients that do not
+        // resolve local references. The registered canonical schema remains
+        // responsible for runtime validation.
+        ...presentInputJsonSchema(inline, fallbackPropertyDescription),
         ...(examples.length === 0 ? {} : { examples }),
     };
 });
+/** Return the same complete input JSON Schema projection registered on MCP. */
+export const advertisedInputJsonSchema = (contract) => toolInputSchemaWithMetadata(contract)["~standard"].jsonSchema.input({
+    target: "draft-2020-12",
+});
 /** Share output definitions and content-bound validator identities on the wire. */
 export const toolOutputSchemaWithMetadata = (contract) => withAdvertisedJsonSchema(contract.outputSchema, "output", (project) => (options) => {
     const shared = project({
@@ -86,7 +94,9 @@ export const transformAdvertisedInputJsonSchema = (schema, transform) => {
     const byTarget = new Map();
     const transformedInput = (options) => {
         const target = Reflect.get(options, "target");
-        if (typeof target === "string") {
+        const cacheable = typeof target === "string" &&
+            Reflect.get(options, "libraryOptions") === undefined;
+        if (cacheable) {
             const cached = byTarget.get(target);
             if (cached !== undefined)
                 return cached;
@@ -95,7 +105,7 @@ export const transformAdvertisedInputJsonSchema = (schema, transform) => {
         const transformed = isSchemaRecord(projected)
             ? transform(projected)
             : projected;
-        if (typeof target === "string" && isSchemaRecord(transformed))
+        if (cacheable && isSchemaRecord(transformed))
             byTarget.set(target, transformed);
         return transformed;
     };
@@ -108,25 +118,101 @@ export const transformAdvertisedInputJsonSchema = (schema, transform) => {
     };
 };
 const hasRelativeSchemaReference = (schema) => {
-    const pending = [schema];
-    const visited = new WeakSet();
+    // Local pointers can make even annotation values executable schemas. Keep
+    // their resource root and traversal role separate from ordinary instance data.
+    const pending = [{ value: schema, root: schema, position: "schema" }];
+    const visited = new WeakMap();
     while (pending.length > 0) {
-        const current = pending.pop();
-        if (current === null || typeof current !== "object" || visited.has(current))
+        const entry = pending.pop();
+        const current = entry.value;
+        if (current === null || typeof current !== "object")
+            continue;
+        const { position } = entry;
+        const root = position !== "map" &&
+            isSchemaRecord(current) &&
+            typeof current.$id === "string" &&
+            URL.canParse(current.$id)
+            ? current
+            : entry.root;
+        let positions = visited.get(root);
+        if (positions === undefined) {
+            positions = {
+                schema: new WeakSet(),
+                map: new WeakSet(),
+                unknown: new WeakSet(),
+            };
+            visited.set(root, positions);
+        }
+        if (positions[position].has(current))
+            continue;
+        positions[position].add(current);
+        if (Array.isArray(current)) {
+            for (const value of current)
+                pending.push({ value, root, position });
             continue;
-        visited.add(current);
+        }
         for (const [key, value] of Object.entries(current)) {
-            if (["$id", "$ref", "$dynamicRef", "$recursiveRef"].includes(key) &&
-                typeof value === "string" &&
-                !value.startsWith("#") &&
-                !URL.canParse(value))
-                return true;
+            if (position !== "map" &&
+                ["$id", "$ref", "$dynamicRef", "$recursiveRef"].includes(key) &&
+                typeof value === "string") {
+                if (!value.startsWith("#") && !URL.canParse(value))
+                    return true;
+                if (key !== "$id" && value.startsWith("#")) {
+                    const target = localSchemaReference(root, value);
+                    // Unknown anchors are already examined at their schema positions.
+                    // Unresolvable pointers retain the existing reference base.
+                    if (target === undefined)
+                        return true;
+                    if (target.kind === "target")
+                        pending.push({ value: target.value, root, position: "schema" });
+                }
+            }
+            if (position === "schema" && schemaLiteralValues.has(key))
+                continue;
+            const childPosition = position === "map"
+                ? "schema"
+                : position === "schema" && schemaMaps.has(key)
+                    ? "map"
+                    : position === "schema" &&
+                        (schemaArrays.has(key) || schemaChildren.has(key))
+                        ? "schema"
+                        : "unknown";
             if (value !== null && typeof value === "object")
-                pending.push(value);
+                pending.push({ value, root, position: childPosition });
         }
     }
     return false;
 };
+/** Decode URI-fragment JSON Pointers without interpreting literal data as schemas. */
+const localSchemaReference = (root, reference) => {
+    let fragment;
+    try {
+        fragment = decodeURIComponent(reference.slice(1));
+    }
+    catch {
+        return undefined;
+    }
+    if (fragment === "")
+        return { kind: "target", value: root };
+    if (!fragment.startsWith("/"))
+        return { kind: "anchor" };
+    let value = root;
+    for (const token of fragment.slice(1).split("/")) {
+        if (/~(?:[^01]|$)/u.test(token))
+            return undefined;
+        const key = token.replaceAll("~1", "/").replaceAll("~0", "~");
+        if (value === null ||
+            typeof value !== "object" ||
+            !Object.hasOwn(value, key))
+            return undefined;
+        // A pointer can cross a resource boundary even inside literal data.
+        // Preserve the original projection rather than guess the reference scope.
+        if (value !== root && isSchemaRecord(value) && "$id" in value)
+            return undefined;
+        value = Reflect.get(value, key);
+    }
+    return { kind: "target", value };
+};
 const withAdvertisedJsonSchema = (canonical, io, advertise = (project) => project) => {
     // Zod's input projection drops root metadata when a descendant transforms.
     // Preserve the parser and let the SDK own conversion of everything else.

package/dist/contracts/unknownContractExamples.js

@@ -1,6 +1,6 @@
 /** Exact example inputs for residual-unknown lifecycle contracts. */
 export const UNKNOWN_CONTRACT_EXAMPLES = {
-    list_unknowns: {},
+    list_unknowns: { offset: 0, limit: 50 },
     record_unknown: {
         question: "Does this branch require an unavailable external service?",
         severity: "medium",

package/dist/contracts/wasm/wasmComparisonContracts.js

@@ -0,0 +1,52 @@
+import { evidenceResultOf } from "../toolOutputSchemaPrimitives.js";
+import { z } from "zod";
+import { evidenceInputSchema } from "../evidenceInputContracts.js";
+import { wasmInterfaceSchema } from "../../domain/wasm/wasmInterface.js";
+import { toolContractMetadata } from "../toolEffects.js";
+export const compareWasmInterfacesInputSchema = z.strictObject({
+    left: evidenceInputSchema.describe("Exact complete inspect_wasm_artifact Evidence or retained session reference"),
+    right: evidenceInputSchema.describe("Exact complete inspect_wasm_artifact Evidence or retained session reference"),
+    scope: z
+        .enum(["imports", "exports", "both"])
+        .describe("Explicit interface selection; static equality does not establish runtime compatibility"),
+});
+const identity = z.object({
+    evidence_id: z.string(),
+    artifact: z.object({
+        path: z.string(),
+        sha256: z.string(),
+        bytes: z.number().int().nonnegative(),
+    }),
+});
+export const wasmInterfaceComparisonSchema = z.object({
+    left: identity,
+    right: identity,
+    scope: z.enum(["imports", "exports", "both"]),
+    coverage: z.enum(["complete-within-inputs", "partial", "unknown"]),
+    changes: z.array(z.object({
+        direction: z.enum(["import", "export"]),
+        module: z.string().nullable(),
+        name: z.string(),
+        state: z.enum(["added", "removed", "changed", "unchanged", "unknown"]),
+        left: wasmInterfaceSchema.shape.entries,
+        right: wasmInterfaceSchema.shape.entries,
+        reason: z.string().nullable(),
+    })),
+    summary: z.object({
+        added: z.number(),
+        removed: z.number(),
+        changed: z.number(),
+        unchanged: z.number(),
+        unknown: z.number(),
+    }),
+    limitations: z.array(z.string()),
+});
+export const COMPARE_WASM_INTERFACES_CONTRACT = {
+    name: "compare_wasm_interfaces",
+    ...toolContractMetadata("compare_wasm_interfaces"),
+    kind: "application",
+    description: "Compare typed core WASM import/export names, kinds and exact signatures from two authenticated inspect_wasm_artifact Evidence records. Select imports, exports or both explicitly. Retained references resolve only in the current session; CLI accepts portable inline Evidence. Duplicate names, unsupported types and missing historical interface facets remain unknown. Preserve original module digests and every occurrence; no source acquisition, module execution or runtime-compatibility inference.",
+    inputSchema: compareWasmInterfacesInputSchema,
+    outputSchema: evidenceResultOf(wasmInterfaceComparisonSchema),
+    examples: [],
+};

package/dist/contracts/wasm/wasmToolContracts.js

@@ -0,0 +1,33 @@
+import { COMPARE_WASM_INTERFACES_CONTRACT } from "./wasmComparisonContracts.js";
+import { inspectWasmArtifactInputSchema, wasmArtifactSchema, } from "../../domain/wasm/wasmArtifact.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { analysisDetailSchema, analysisDetailOutputSchemaOf, } from "../analysisDetail.js";
+import { wasmArtifactSummaryViewResultSchema } from "../../domain/analysisView/analysisView.js";
+/** Delivery selection does not change the provider input or original Evidence. */
+export const wasmArtifactInspectionInputSchema = inspectWasmArtifactInputSchema.extend({
+    detail: analysisDetailSchema.unwrap().optional(),
+});
+/** Optional caller-supplied WABT capability with target-free CLI/MCP parity. */
+export const INSPECT_WASM_ARTIFACT_CONTRACT = {
+    name: "inspect_wasm_artifact",
+    ...toolContractMetadata("inspect_wasm_artifact"),
+    kind: "artifact-provider",
+    description: 'Validate an explicit local WASM artifact with caller-supplied WABT 1.0.42. Omitted or complete detail returns exact byte SHA-256, sections, upstream import/export WAT forms and decoded WAT inline as Evidence. For counts, validation and WAT identity without WAT text, pass detail: "summary" on this first call; it retains the complete original Evidence and returns the same typed summary as inspect_analysis_view, avoiding oversized complete delivery. Read exact imports/exports or WAT pages with inspect_analysis_view using normalized_result.parent_evidence_id. Delivery selection does not change analysis, provider inputs or source identity. Optionally associate selected JavaScript glue literals with explicit local candidates while preserving ambiguous URL/basename matches. Configure absolute REA_WABT_BIN_DIRECTORY. No installation, implicit fetch, WASM execution or original-source claim.',
+    inputSchema: wasmArtifactInspectionInputSchema,
+    outputSchema: analysisDetailOutputSchemaOf(wasmArtifactSchema, wasmArtifactSummaryViewResultSchema),
+    examples: [
+        {
+            title: "Inspect a selected local WASM module",
+            input: {
+                path: "/artifacts/module.wasm",
+                glue_paths: [],
+                candidate_paths: [],
+            },
+        },
+    ],
+};
+/** Keep the public catalog in its existing order, using its named contract. */
+export const WASM_TOOL_CONTRACTS = [
+    INSPECT_WASM_ARTIFACT_CONTRACT,
+    COMPARE_WASM_INTERFACES_CONTRACT,
+];

package/dist/contracts/webNetworkCaptureToolContracts.js

@@ -1,16 +1,27 @@
 import { inspectWebNetworkCaptureInputSchema, webNetworkCaptureSchema, } from "../domain/webNetworkCapture.js";
 import { toolContractMetadata } from "./toolEffects.js";
-import { evidenceResultOf } from "./toolOutputSchemaPrimitives.js";
+import { analysisDetailSchema, analysisDetailOutputSchemaOf, } from "./analysisDetail.js";
+import { webNetworkCaptureSummaryViewResultSchema } from "../domain/analysisView/analysisView.js";
 /** Historical inspection is distinct from live browser capture and runtime authority. */
 export const WEB_NETWORK_CAPTURE_TOOL_CONTRACTS = [
     {
         name: "inspect_web_network_capture",
         ...toolContractMetadata("inspect_web_network_capture"),
-        description: "Inspect retained local HAR 1.2 or native mitmproxy capture records without contacting recorded URLs. Returns original ordinals, pointers/byte ranges, preserved producer fields, precise numeric representations and exact exposed binary bytes inline. Excludes known transport credentials and explicitly marked values. Decodes every record before optional ordinal selection; malformed or oversized captures return no partial success. Duplicate HAR members are invalid; prototype-named members such as __proto__ are preserved as ordinary own JSON members without prototype mutation. Uses pinned upstream parsers, owned temporary files and bounded offline processes. Native mitmproxy requires caller-supplied mitmdump 12.2.3 on Linux. Browser transaction IDs, runtime attribution and original bytes of HAR Unicode text remain unknown.",
+        description: "Request detail summary for capture identity and counts; then page retained records with inspect_analysis_view kind capture (preview or complete), avoiding repeated decoding. Default detail complete preserves existing inline delivery. Inspect retained local HAR 1.2, native mitmproxy, Fiddler SAZ or aioquic 1.5.0 JSON qlog 0.3 events without contacting recorded URLs. Returns original ordinals, pointers/byte ranges/archive member names, preserved producer fields, precise numeric representations and exact exposed binary bytes inline. Excludes known transport credentials and explicitly marked values. Decodes every record before optional ordinal selection; malformed or oversized captures return no partial success. Duplicate JSON members are invalid; prototype-named members such as __proto__ are preserved as ordinary own JSON members without prototype mutation. Qlog reports trace-scoped STREAM interval unions and endpoint loss declarations; it does not recover bodies, prove network loss or correlate PCAP. Other qlog layouts are unsupported. Uses pinned upstream parsers, owned temporary files and bounded offline processes. SAZ preserves HTTP fields, XML metadata and encoded body/message bytes without replay or HAR conversion; encrypted archives are unsupported. Native mitmproxy requires caller-supplied mitmdump 12.2.3 on Linux. Browser transaction IDs, runtime attribution and original bytes of HAR Unicode text remain unknown.",
         kind: "browser-provider",
-        inputSchema: inspectWebNetworkCaptureInputSchema,
-        outputSchema: evidenceResultOf(webNetworkCaptureSchema),
+        inputSchema: inspectWebNetworkCaptureInputSchema.extend({
+            detail: analysisDetailSchema,
+        }),
+        outputSchema: analysisDetailOutputSchemaOf(webNetworkCaptureSchema, webNetworkCaptureSummaryViewResultSchema),
         examples: [
+            {
+                title: "Inspect retained aioquic qlog events",
+                input: {
+                    capture_path: "/captures/origin.qlog",
+                    format: "qlog",
+                    record_ordinals: [0, 2],
+                },
+            },
             {
                 title: "Inspect historical HAR entries",
                 input: {