@zanii/blackbox 0.16.0 → 0.17.0

package/dist/analysis/faults.js

@@ -232,6 +232,17 @@ export const FAULTS = {
         en: "A tool's definition changed mid-session",
         ar: "تغيّر تعريف أداة أثناء الجلسة",
     },
+    PROMPT_INJECTION: {
+        fault: "BBX-7403",
+        squawk: "HIJACK",
+        en: "Prompt injection reached the model",
+        ar: "وصلت محاولة حقن تعليمات إلى النموذج",
+    },
+    TOOL_DRIFTED: {
+        fault: "BBX-7404",
+        en: "A tool's definition differs from earlier sessions",
+        ar: "يختلف تعريف أداة عمّا رأته الجلسات السابقة",
+    },
     REVOKED_MEMORY_READ: {
         fault: "BBX-7101",
         en: "A revoked memory was used",

package/dist/analysis/grounding.d.ts

@@ -45,6 +45,12 @@ export declare class Evidence {
     private pairSums;
 }
 /** The final answers on a record, each with the evidence it should rest on. */
+/**
+ * spec/findings.md §9: what the answer's own web search returned (Anthropic's server tool): each
+ * result's title, and each citation's quoted text and title. The provider supplies these from the
+ * pages, not the model, so a fact they hold is backed. Never the answer's own words.
+ */
+export declare function webEvidence(c: Call): string;
 export declare function answersOf(lines: readonly string[], bodies: Bodies): Array<{
     seq: number;
     text: string;

package/dist/analysis/grounding.js

@@ -460,6 +460,30 @@ export class Evidence {
     }
 }
 /** The final answers on a record, each with the evidence it should rest on. */
+/**
+ * spec/findings.md §9: what the answer's own web search returned (Anthropic's server tool): each
+ * result's title, and each citation's quoted text and title. The provider supplies these from the
+ * pages, not the model, so a fact they hold is backed. Never the answer's own words.
+ */
+export function webEvidence(c) {
+    const parts = [];
+    const add = (v) => {
+        if (typeof v === "string" && v)
+            parts.push(v);
+    };
+    for (const [, b] of [...c.blocks].sort(([x], [y]) => x - y)) {
+        const block = b;
+        if (block.type === "web_search_tool_result" && Array.isArray(block.content))
+            for (const r of block.content)
+                add(r?.title);
+        if (Array.isArray(block.citations))
+            for (const cit of block.citations) {
+                add(cit?.cited_text);
+                add(cit?.title);
+            }
+    }
+    return parts.join("\n");
+}
 export function answersOf(lines, bodies) {
     const calls = callsOf(lines, bodies);
     const ends = new Set(toolCallsOf(calls).map((t) => t.seq));
@@ -480,9 +504,11 @@ export function answersOf(lines, bodies) {
         const text = answerText(c);
         if (!text)
             continue;
+        const web = webEvidence(c);
         const pieces = [
             { seq: c.requestSeq, text: canonical(c.request) },
             ...results.filter((r) => r.seq < c.endSeq),
+            ...(web ? [{ seq: c.endSeq, text: web }] : []),
         ];
         out.push({
             seq: c.endSeq,

package/dist/analysis/index.d.ts

@@ -82,6 +82,12 @@ export declare function exitDurability(events: Ev[]): Finding[];
  * is the reference; a different one later is a finding, and becomes the new reference.
  */
 export declare function toolChanged(events: Ev[]): Finding[];
+/**
+ * spec/findings.md §1a: a tool's definition differs from the one this tenant's earlier sessions saw
+ * (a rug pull between sessions). The gateway puts the previous hashes next to a `tools/list` answer
+ * (`meta.tool_defs_prev`); a tool listed with another hash is a finding, once per server and tool.
+ */
+export declare function toolDrifted(events: Ev[]): Finding[];
 /** N6 (idea S3): the gateway refused a request that carried the session's own token. */
 export declare function tokenMisuse(events: Ev[]): Finding[];
 /** Stage 2 R3: a `verify` check that passed, then failed later in the run. */

package/dist/analysis/index.js

@@ -14,6 +14,7 @@ import { wallFindings } from "../walls/index.js";
 import { detectors } from "./detectors.js";
 import { groundingFindings, judgeFindings } from "./grounding.js";
 import { toolHallucinations } from "./hallucination.js";
+import { injectionFindings } from "./injection.js";
 import { flightPlan } from "./landing.js";
 import { memoryFindings } from "./memory.js";
 export { detectorAccuracy, wilsonLow } from "./accuracy.js";
@@ -56,6 +57,8 @@ export function analyze(lines, options) {
         ...orphanedToolCalls(events, now),
         ...tokenMisuse(events),
         ...toolChanged(events),
+        ...toolDrifted(events),
+        ...injectionFindings(lines, options.bodies),
         ...verifyRegression(events),
         ...falseSuccess(events, now),
         ...toolHallucinations(lines, options.bodies),
@@ -401,6 +404,42 @@ export function toolChanged(events) {
     }
     return out;
 }
+/**
+ * spec/findings.md §1a: a tool's definition differs from the one this tenant's earlier sessions saw
+ * (a rug pull between sessions). The gateway puts the previous hashes next to a `tools/list` answer
+ * (`meta.tool_defs_prev`); a tool listed with another hash is a finding, once per server and tool.
+ */
+export function toolDrifted(events) {
+    const out = [];
+    const done = new Set();
+    for (const e of events) {
+        const { server, tool_defs: defs, tool_defs_prev: prev } = e.meta;
+        if (e.kind !== "tool.result" || typeof server !== "string")
+            continue;
+        if (!defs || typeof defs !== "object" || Array.isArray(defs))
+            continue;
+        if (!prev || typeof prev !== "object" || Array.isArray(prev))
+            continue;
+        for (const tool of Object.keys(defs).sort()) {
+            const after = defs[tool];
+            const before = prev[tool];
+            const key = `${server}\u0000${tool}`;
+            if (typeof after !== "string" || typeof before !== "string" || before === after)
+                continue;
+            if (done.has(key))
+                continue;
+            done.add(key);
+            out.push({
+                code: "TOOL_DRIFTED",
+                source: "detectors",
+                severity: "warning",
+                ref: { seq: e.seq, server, tool, before, after },
+                detail: "A tool's description, schema or annotations differ from what this tenant's earlier sessions saw: the tool was changed between runs.",
+            });
+        }
+    }
+    return out;
+}
 /** N6 (idea S3): the gateway refused a request that carried the session's own token. */
 export function tokenMisuse(events) {
     return events

package/dist/analysis/injection.d.ts

@@ -0,0 +1,22 @@
+/** The rules, in the order they're tried. Patterns run on ASCII-lowercased, space-folded text. */
+export declare const INJECTION_RULES: ReadonlyArray<{
+    id: string;
+    re: RegExp;
+}>;
+/** Text no reader sees: Unicode tag characters, bidi overrides, a run of 4+ zero-width characters. */
+export declare function hiddenText(text: string): boolean;
+/** The first rule a text breaks, or null. */
+export declare function injectionRule(text: string): string | null;
+/** spec/findings.md §1b: PROMPT_INJECTION findings over a record. */
+export declare function injectionFindings(lines: readonly string[], bodies: (hash: string) => Uint8Array | undefined): {
+    code: string;
+    source: string;
+    severity: "warning";
+    ref: {
+        seq: number;
+        source: string;
+        rule: string;
+        tool?: string;
+    };
+    detail: string;
+}[];

package/dist/analysis/injection.js

@@ -0,0 +1,173 @@
+// spec/findings.md §1b: prompt injection (PROMPT_INJECTION, squawk HIJACK). What reaches the model
+// from outside the agent's instructions is scanned: each MCP tool result, and the newest turn of
+// each model request (the tool results and the person's words it carries). Instruction overrides,
+// role hijacks, exfiltration asks and hidden text, in English and Arabic. One finding per event and
+// source; the finding names the rule, never the text. Mirrors analysis/injection.py; pinned by
+// spec/vectors/injection.json.
+const decoder = new TextDecoder();
+const MAX_TEXT = 200_000; // characters scanned per event: an injection is near the start or not worth the cost
+/** The rules, in the order they're tried. Patterns run on ASCII-lowercased, space-folded text. */
+export const INJECTION_RULES = [
+    {
+        id: "override",
+        re: /\b(ignore|disregard|forget|override|bypass)( all| any| the| your| these| those| my)* (previous|prior|above|earlier|preceding|system|original|safety)( \w+)? (instructions|prompts?|rules|directions|guidelines|messages|policies)\b/,
+    },
+    { id: "override", re: /(تجاهل|انس|انسى|تخط) (جميع |كل )?(التعليمات|الأوامر|القواعد|ما سبق)/ },
+    {
+        id: "role",
+        re: /(\byou are now\b|\bfrom now on,? you are\b|\bact as\b) (dan|an? unrestricted|a jailbroken|in developer mode)\b|<\|im_start\|>|<\|system\|>|\[system\]|### (system|new instructions)|\bnew instructions:/,
+    },
+    {
+        id: "exfiltrate",
+        re: /\b(send|post|upload|forward|email|exfiltrate|leak|paste)\b.{0,40}\b(system prompt|api keys?|passwords?|credentials|secrets?|conversation history|chat history|access tokens?|private keys?)\b/,
+    },
+    {
+        id: "exfiltrate",
+        re: /\b(reveal|print|repeat|show|output) (me )?(your|the) (system prompt|hidden instructions|initial instructions|original instructions)\b/,
+    },
+    {
+        id: "exfiltrate",
+        re: /(أرسل|ارسل|أفصح عن|اكشف) .{0,40}(كلمة المرور|كلمات المرور|مفتاح|بيانات الدخول|التعليمات المخفية)/,
+    },
+];
+/** Text no reader sees: Unicode tag characters, bidi overrides, a run of 4+ zero-width characters. */
+export function hiddenText(text) {
+    let zw = 0;
+    for (const ch of text) {
+        const c = ch.codePointAt(0);
+        if (c >= 0xe0000 && c <= 0xe007f)
+            return true;
+        if ((c >= 0x202a && c <= 0x202e) || (c >= 0x2066 && c <= 0x2069))
+            return true;
+        if (c === 0x200b || c === 0x200c || c === 0x200d || c === 0x2060 || c === 0xfeff) {
+            zw += 1;
+            if (zw >= 4)
+                return true;
+        }
+        else
+            zw = 0;
+    }
+    return false;
+}
+/** ASCII lowercase; spaces, tabs, newlines and line separators to one space: the same in every language. */
+const fold = (s) => s.replace(/[A-Z]/g, (c) => c.toLowerCase()).replace(/[ \t\r\n\u2028\u2029]+/g, " ");
+/** The first rule a text breaks, or null. */
+export function injectionRule(text) {
+    const t = Array.from(text).slice(0, MAX_TEXT).join("");
+    if (hiddenText(t))
+        return "hidden";
+    const f = fold(t);
+    for (const r of INJECTION_RULES)
+        if (r.re.test(f))
+            return r.id;
+    return null;
+}
+/** Every string in a JSON value, depth first, in key order. */
+function strings(v, out) {
+    if (typeof v === "string")
+        out.push(v);
+    else if (Array.isArray(v))
+        for (const x of v)
+            strings(x, out);
+    else if (v && typeof v === "object")
+        for (const x of Object.values(v))
+            strings(x, out);
+}
+const textOf = (v) => {
+    const out = [];
+    strings(v, out);
+    return out.join("\n");
+};
+/** The newest turn of a model request: what it adds to the conversation. */
+function newestTurn(body) {
+    const out = [];
+    const messages = body.messages;
+    if (Array.isArray(messages) && messages.length) {
+        // Chat Completions: the trailing tool messages, and the last message itself
+        let i = messages.length - 1;
+        while (i > 0 && messages[i].role === "tool")
+            i -= 1;
+        for (const m of messages.slice(i)) {
+            if (m.role === "tool")
+                out.push({ source: "tool_result", text: textOf(m.content) });
+            else if (m.role === "user") {
+                // Anthropic: a user turn holds the tool results and the person's words
+                const blocks = Array.isArray(m.content) ? m.content : [m.content];
+                const results = blocks.filter((b) => b?.type === "tool_result");
+                const words = blocks.filter((b) => b?.type !== "tool_result");
+                if (results.length)
+                    out.push({ source: "tool_result", text: textOf(results) });
+                if (words.length)
+                    out.push({ source: "user", text: textOf(words) });
+            }
+        }
+        return out;
+    }
+    const input = body.input;
+    if (typeof input === "string")
+        return [{ source: "user", text: input }];
+    if (Array.isArray(input) && input.length) {
+        // Responses: the trailing function_call_output items, then the last item
+        let i = input.length - 1;
+        while (i > 0 && input[i].type === "function_call_output")
+            i -= 1;
+        for (const item of input.slice(i)) {
+            if (item.type === "function_call_output")
+                out.push({ source: "tool_result", text: textOf(item.output) });
+            else if (item.role === "user")
+                out.push({ source: "user", text: textOf(item.content) });
+        }
+    }
+    return out;
+}
+/** spec/findings.md §1b: PROMPT_INJECTION findings over a record. */
+export function injectionFindings(lines, bodies) {
+    const out = [];
+    const add = (seq, source, rule, tool) => out.push({
+        code: "PROMPT_INJECTION",
+        source: "detectors",
+        severity: "warning",
+        ref: { seq, source, rule, ...(tool !== undefined ? { tool } : {}) },
+        detail: rule === "hidden"
+            ? "Text the reader can't see (hidden characters) reached the model: a classic way to smuggle instructions."
+            : "Text that reached the model tries to give it new instructions: an override, a role change, or a request to send out secrets.",
+    });
+    for (const l of lines) {
+        const e = JSON.parse(l);
+        if (e.kind !== "tool.result" && e.kind !== "llm.request")
+            continue;
+        const raw = bodies(e.body_hash);
+        if (!raw || raw.length === 0)
+            continue;
+        let doc;
+        try {
+            doc = JSON.parse(decoder.decode(raw));
+        }
+        catch {
+            continue;
+        }
+        if (e.kind === "tool.result") {
+            const result = doc?.result;
+            if (result === undefined)
+                continue;
+            const rule = injectionRule(textOf(result));
+            const tool = typeof e.meta.tool === "string" ? e.meta.tool : undefined;
+            if (rule)
+                add(e.seq, "tool_result", rule, tool);
+            continue;
+        }
+        if (!doc || typeof doc !== "object" || Array.isArray(doc))
+            continue;
+        const seen = new Set();
+        for (const part of newestTurn(doc)) {
+            if (seen.has(part.source))
+                continue;
+            const rule = injectionRule(part.text);
+            if (rule) {
+                seen.add(part.source);
+                add(e.seq, part.source, rule);
+            }
+        }
+    }
+    return out;
+}

package/dist/analysis/taxonomy.js

@@ -18,6 +18,7 @@ export const MITRE_ATLAS = {
     "AML.T0034.000": "Cost Harvesting: Excessive Queries",
     "AML.T0034.001": "Cost Harvesting: Resource-Intensive Queries",
     "AML.T0034.002": "Cost Harvesting: Agentic Resource Consumption",
+    "AML.T0051": "LLM Prompt Injection",
     "AML.T0053": "AI Agent Tool Invocation",
     "AML.T0057": "LLM Data Leakage",
     "AML.T0080.000": "AI Agent Context Poisoning: Memory",
@@ -53,6 +54,8 @@ export const TAXONOMY = {
     STERILE_VIOLATION: { owasp: ["ASI02", "ASI10"], atlas: ["AML.T0053"] },
     TOKEN_MISUSE: { owasp: ["ASI03"], atlas: ["AML.T0091.000", "AML.T0086"] },
     TOOL_CHANGED: { owasp: ["ASI04"], atlas: ["AML.T0110.002"] },
+    TOOL_DRIFTED: { owasp: ["ASI04"], atlas: ["AML.T0110.002"] },
+    PROMPT_INJECTION: { owasp: ["ASI01"], atlas: ["AML.T0051"] },
     TOOL_OUTPUT_MISMATCH: { owasp: ["ASI04", "ASI06"], atlas: ["AML.T0110.002", "AML.T0099"] },
     TOOL_WITNESS_INVALID: { owasp: ["ASI04"], atlas: ["AML.T0110.002"] },
 };

package/dist/fleet/insights.d.ts

@@ -64,8 +64,11 @@ export declare function insights(summaries: readonly SummaryIn[], window: {
     from: string;
     to: string;
 }): Insights;
-/** spec/insights.md §3: the record as one line per event, metadata only, at most 600 events. */
-export declare function copilotContext(lines: readonly string[]): string;
+/**
+ * spec/insights.md §3: the record as one line per event, metadata only, at most 600 events. With
+ * `body` (a body by its hash), a verify event also says `ok=true` or `ok=false`.
+ */
+export declare function copilotContext(lines: readonly string[], body?: (hash: string) => Uint8Array | null | undefined): string;
 /** spec/insights.md §3: the system prompt and the user turn for the investigator's model. */
 export declare function copilotPrompt(question: string, context: string, lang?: string): {
     system: string;

package/dist/fleet/insights.js

@@ -195,8 +195,28 @@ function evenly(items, n) {
         return [...items];
     return Array.from({ length: n }, (_, i) => items[Math.floor((i * items.length) / n)]);
 }
-/** spec/insights.md §3: the record as one line per event, metadata only, at most 600 events. */
-export function copilotContext(lines) {
+/** A verify event's pass or fail, from its body: the one value read from a body. Never `detail`. */
+function verifyOk(e, body) {
+    const meta = (e.meta ?? {});
+    if (!body || e.kind !== "sdk.event" || meta.type !== "verify")
+        return null;
+    const raw = body(String(e.body_hash));
+    if (!raw || raw.length === 0)
+        return null; // erased, or never sent
+    try {
+        const doc = JSON.parse(new TextDecoder().decode(raw));
+        const ok = doc && typeof doc === "object" && !Array.isArray(doc) ? doc.ok : null;
+        return typeof ok === "boolean" ? ok : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * spec/insights.md §3: the record as one line per event, metadata only, at most 600 events. With
+ * `body` (a body by its hash), a verify event also says `ok=true` or `ok=false`.
+ */
+export function copilotContext(lines, body) {
     const events = lines.map((l) => JSON.parse(l));
     const n = events.length;
     let shown;
@@ -241,12 +261,16 @@ export function copilotContext(lines) {
             if (v !== null)
                 parts.push(`${k}=${v}`);
         }
+        const ok = verifyOk(e, body);
+        if (ok !== null)
+            parts.push(`ok=${ok}`);
         out.push(parts.join(" "));
     }
     return out.join("\n");
 }
 const SYSTEM = "You are an investigator reading one AI agent's flight record from Zanii Blackbox. The record " +
-    "below is one line per event: #seq, time, kind, then its metadata. Answer the question only " +
+    "below is one line per event: #seq, time, kind, then its metadata; ok=true or ok=false on a " +
+    "verify event is the result of the agent's own check. Answer the question only " +
     "from the record. Cite the event numbers your answer rests on. If the record doesn't say, say " +
     "so. Be brief and concrete. Answer with JSON only: " +
     '{"answer": "<your answer>", "cites": [<seq>, ...]}';

package/dist/index.d.ts

@@ -2,7 +2,8 @@ export { A2A_STREAMING, type AgentCardReport, a2aMethod, a2aRequestMeta, a2aResp
 export { causality, memoryXray } from "./agents/index.ts";
 export { type DetectorOptions, detectors, fingerprint } from "./analysis/detectors.ts";
 export { FAULTS, type Fault, faultOf } from "./analysis/faults.ts";
-export { type Accuracy, type AnalyzeOptions, type AnswerClaims, analyze, answerClaims, answerCredential, answerRisk, answersOf, answerText, type ClaimEntry, type ClaimVerdict, type CriterionResult, canonicalNumber, checkAgainstPacks, checkFlightPlan, checkpointReplay, detectorAccuracy, dualWitness, Evidence, eventsOf, type Fact, type Finding as AnalysisFinding, factsIn, findingKey, type GroundedClaim, groundingFindings, groundingRequest, HOLD_TRIGGERS, identifiersIn, judgeFindings, judgeRequest, type Label as AccuracyLabel, type Landing, landing, loadReferencePacks, modelGroundingFindings, normaliseValue, OUTCOMES, type Outcome, type OutcomeRollup, packsFor, parseGroundingAnswer, parseJudgeAnswer, type ReferenceFact, type ReferencePack, type ReferenceVerdict, referenceContext, rollup, type Severity, schemaProblem, toolHallucinations, verifyAnswerCredential, type WasteReason, type WasteReport, waste, wilsonLow, } from "./analysis/index.ts";
+export { type Accuracy, type AnalyzeOptions, type AnswerClaims, analyze, answerClaims, answerCredential, answerRisk, answersOf, answerText, type ClaimEntry, type ClaimVerdict, type CriterionResult, canonicalNumber, checkAgainstPacks, checkFlightPlan, checkpointReplay, detectorAccuracy, dualWitness, Evidence, eventsOf, type Fact, type Finding as AnalysisFinding, factsIn, findingKey, type GroundedClaim, groundingFindings, groundingRequest, HOLD_TRIGGERS, identifiersIn, judgeFindings, judgeRequest, type Label as AccuracyLabel, type Landing, landing, loadReferencePacks, modelGroundingFindings, normaliseValue, OUTCOMES, type Outcome, type OutcomeRollup, packsFor, parseGroundingAnswer, parseJudgeAnswer, type ReferenceFact, type ReferencePack, type ReferenceVerdict, referenceContext, rollup, type Severity, schemaProblem, toolDrifted, toolHallucinations, verifyAnswerCredential, type WasteReason, type WasteReport, waste, wilsonLow, } from "./analysis/index.ts";
+export { injectionFindings, injectionRule } from "./analysis/injection.ts";
 export { MITRE_ATLAS, OWASP_ASI, TAXONOMY, type Taxonomy, taxonomyOf, } from "./analysis/taxonomy.ts";
 export { type ApprovalFinding, approvalConfirmation, approvalFindings, argsHash, verifyConfirmation, } from "./approvals/index.ts";
 export { textWarnings } from "./approvals/warnings.ts";

package/dist/index.js

@@ -4,7 +4,8 @@ export { A2A_STREAMING, a2aMethod, a2aRequestMeta, a2aResponseMeta, a2aRestMetho
 export { causality, memoryXray } from "./agents/index.js";
 export { detectors, fingerprint } from "./analysis/detectors.js";
 export { FAULTS, faultOf } from "./analysis/faults.js";
-export { analyze, answerClaims, answerCredential, answerRisk, answersOf, answerText, canonicalNumber, checkAgainstPacks, checkFlightPlan, checkpointReplay, detectorAccuracy, dualWitness, Evidence, eventsOf, factsIn, findingKey, groundingFindings, groundingRequest, HOLD_TRIGGERS, identifiersIn, judgeFindings, judgeRequest, landing, loadReferencePacks, modelGroundingFindings, normaliseValue, OUTCOMES, packsFor, parseGroundingAnswer, parseJudgeAnswer, referenceContext, rollup, schemaProblem, toolHallucinations, verifyAnswerCredential, waste, wilsonLow, } from "./analysis/index.js";
+export { analyze, answerClaims, answerCredential, answerRisk, answersOf, answerText, canonicalNumber, checkAgainstPacks, checkFlightPlan, checkpointReplay, detectorAccuracy, dualWitness, Evidence, eventsOf, factsIn, findingKey, groundingFindings, groundingRequest, HOLD_TRIGGERS, identifiersIn, judgeFindings, judgeRequest, landing, loadReferencePacks, modelGroundingFindings, normaliseValue, OUTCOMES, packsFor, parseGroundingAnswer, parseJudgeAnswer, referenceContext, rollup, schemaProblem, toolDrifted, toolHallucinations, verifyAnswerCredential, waste, wilsonLow, } from "./analysis/index.js";
+export { injectionFindings, injectionRule } from "./analysis/injection.js";
 export { MITRE_ATLAS, OWASP_ASI, TAXONOMY, taxonomyOf, } from "./analysis/taxonomy.js";
 export { approvalConfirmation, approvalFindings, argsHash, verifyConfirmation, } from "./approvals/index.js";
 export { textWarnings } from "./approvals/warnings.js";

package/dist/reconcile/record.d.ts

@@ -6,6 +6,8 @@ export interface Block {
     id?: string;
     name?: string;
     input?: unknown;
+    /** Anthropic: where a text block's words come from (web search: the page, its title, the quote). */
+    citations?: unknown[];
 }
 export interface Call {
     requestSeq: number;

package/dist/reconcile/record.js

@@ -182,6 +182,10 @@ function rebuild(call, body) {
                 block.thinking = (block.thinking ?? "") + d.thinking;
             else if (d.type === "input_json_delta" && typeof d.partial_json === "string")
                 partial.set(event.index, (partial.get(event.index) ?? "") + d.partial_json);
+            else if (d.type === "citations_delta" && isObj(d.citation)) {
+                block.citations ??= [];
+                block.citations.push(d.citation);
+            }
         }
         else if (type === "content_block_stop" && typeof event.index === "number") {
             const block = call.blocks.get(event.index);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.16.0";
+export declare const VERSION = "0.17.0";

package/dist/version.js

@@ -1,2 +1,2 @@
 // The SDK version, on its own so the CLI can print it without loading the whole SDK.
-export const VERSION = "0.16.0";
+export const VERSION = "0.17.0";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zanii/blackbox",
   "license": "Apache-2.0",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "The flight recorder for AI agents: sessions, a zero-loss spool, framework hooks, approvals, and offline verification of the gateway's hash-chained record.",
   "keywords": [
     "ai-agents",