@theoremjs/agents 0.3.0 → 0.3.2

package/esm/src/guardrails/thought-guard.js

@@ -1,29 +1,32 @@
 /**
- * Thought guarding. A host that renders `thought` events shows the user what
+ * Thought guarding, under `guardrails.detect` at `thought`. A host that renders `thought` events shows the user what
  * they say and loads what they link, as it does a reply: the canary, the
  * system prompt and the user-data markers leak through a thought, and a URL
  * the model was not given carries data out. Nothing in a thought stops a turn
  * (`isGuardedOutput`); each leak is omitted and the rest of the thought
- * released.
+ * released, or under `block` omitted with the rest of the thought.
  *
  * @module
  */
 import { CANARY_LEAK_REACH, canaryHoldFrom, canaryLeakRanges, canaryOpeningFrom, createCanaryScanner, promptLeakCarry, RELEASED_LOOKBACK, wordStartAcross, } from './canary.js';
-import { CANARY_HIT, egressChecksOf, NO_CHECKS, PROMPT_ECHO_HIT, } from './egress.js';
-import { SYSTEM_BOUNDARY } from './egress-patterns.js';
-import { createEgressStream } from './egress-stream.js';
+import { detectReads, scopeOf, stronger, } from './detect-at.js';
+import { createDetectStream } from './detect-stream.js';
+import { boundaryNote } from './egress.js';
+import { notePattern, SYSTEM_BOUNDARY } from './egress-patterns.js';
+import { createEgressStream, loadEgressAutomata } from './egress-stream.js';
 import { imageLeakSpans, linkLeakSpans } from './egress-urls.js';
-import { lexiconText } from './lexicon.js';
+import { CANARY_HIT, PROMPT_ECHO_HIT } from './hits.js';
+import { labelText } from './labels.js';
 import { promptEchoHoldFrom, promptEchoRanges, promptEchoScanFrom } from './prompt-echo.js';
-import { EGRESS_RULES } from './rules.js';
+import { DETECT_RULES } from './rules.js';
 const OMIT_KEYS = {
     image: 'thought.omitted_image',
     link: 'thought.omitted_link',
     instructions: 'thought.omitted_instructions',
 };
-const IMAGE_HIT = { rule: EGRESS_RULES.image, severity: 'high' };
-const LINK_HIT = { rule: EGRESS_RULES.link, severity: 'high' };
-const BOUNDARY_HIT = { rule: EGRESS_RULES.boundary, severity: 'medium' };
+const IMAGE_HIT = { rule: DETECT_RULES.ungiven_images, severity: 'high' };
+const LINK_HIT = { rule: DETECT_RULES.ungiven_links, severity: 'high' };
+const MARKER_HIT = { rule: DETECT_RULES.marker_leak, severity: 'high' };
 /** Where `raw`, an offset into `view.text`, stands in the thought: a placeholder's start, or with `end` its end. */
 function shownAt(view, raw, end = false) {
     let piece = view.pieces[0];
@@ -38,17 +41,6 @@ function shownAt(view, raw, end = false) {
         return end ? piece.mark.end : piece.mark.start;
     return piece.shown + raw - piece.raw;
 }
-/** The checks of `checks` a thought runs: what it would load, and the markers it would show. */
-function thoughtChecks(checks) {
-    if (!(checks.images || checks.links || checks.boundary))
-        return undefined;
-    return {
-        ...NO_CHECKS,
-        boundary: checks.boundary,
-        ...(checks.images ? { images: checks.images } : {}),
-        ...(checks.links ? { links: checks.links } : {}),
-    };
-}
 /** Sorted, with overlapping leaks as one: an image's URL is a bare link too. */
 function merged(spans) {
     const out = [];
@@ -73,15 +65,24 @@ const MAX_LEAKS = 16;
  * text, is omitted too.
  */
 function createThoughtGuard(options) {
-    const { checks, canary, given, lexicon } = options;
-    const privateSystem = canary ? options.privateSystem : undefined;
+    const { omit = {}, canary, privateSystem, ends, given, labels } = options;
+    /** The detectors whose matches the guard omits as the thought streams. */
+    const streamed = [
+        ...(omit.markers ? ['marker_leak'] : []),
+        ...(omit.images ? ['ungiven_images'] : []),
+        ...(omit.links ? ['ungiven_links'] : []),
+    ];
+    const skipImages = omit.imagesRead ?? omit.images !== undefined;
+    /** The canary as the echo and the note read it: planted, whether or not a thought is read for it. */
+    const slot = canary ?? options.planted;
+    const note = boundaryNote({ canary: slot, labels });
     const scope = (check) => ({ ...check, ...(given ? { given } : {}) });
     /** The placeholder for `kind` after `before`, without a second space. */
     function placeholder(kind, before) {
-        const text = lexiconText(OMIT_KEYS[kind], {}, lexicon);
+        const text = labelText(OMIT_KEYS[kind], {}, labels);
         return /\s$/.test(before) ? text.trimStart() : text;
     }
-    let out = canary ? (options.carry ?? '') : '';
+    let out = canary || privateSystem ? (options.carry ?? '') : '';
     let held = '';
     let stream;
     let scanner;
@@ -106,7 +107,16 @@ function createThoughtGuard(options) {
     let hits = new Map();
     /** Fresh readers over `text`, as if it had streamed: true when it already holds a leak. */
     function restart(text) {
-        stream = checks ? createEgressStream({ checks, ...(given ? { given } : {}) }) : undefined;
+        stream =
+            streamed.length > 0
+                ? createEgressStream({
+                    detect: streamed,
+                    allow: { ungiven_images: omit.images ?? {}, ungiven_links: omit.links ?? {} },
+                    skipImages,
+                    ...(given ? { given } : {}),
+                    ...(note ? { note } : {}),
+                })
+                : undefined;
         scanner = canary ? createCanaryScanner(canary) : undefined;
         echoed = 0;
         readTo = 0;
@@ -115,37 +125,41 @@ function createThoughtGuard(options) {
     /** Read `text`, what follows the read part of `out + held`; true when a leak has settled. */
     function read(text) {
         readTo += text.length;
-        const urlHit = stream?.push(text) !== undefined;
+        const urlHit = (stream?.push(text).length ?? 0) > 0;
         const canaryHit = scanner?.push(text) ?? false;
         let echoHit = false;
         if (privateSystem) {
             const whole = (out + held).slice(0, readTo);
             const from = promptEchoScanFrom(whole, echoed);
-            echoHit = promptEchoRanges(whole.slice(from), privateSystem, canary).length > 0;
+            echoHit = promptEchoRanges(whole.slice(from), privateSystem, slot).length > 0;
             echoed = whole.length;
         }
         return urlHit || canaryHit || echoHit;
     }
     function leakSpans(text) {
         const spans = [];
-        if (checks?.images) {
-            for (const span of imageLeakSpans(text, scope(checks.images))) {
+        if (omit.images) {
+            for (const span of imageLeakSpans(text, scope(omit.images))) {
                 spans.push({ ...span, kind: 'image', hit: IMAGE_HIT });
             }
         }
-        if (checks?.links) {
-            for (const span of linkLeakSpans(text, scope(checks.links), checks.images !== undefined)) {
+        if (omit.links) {
+            for (const span of linkLeakSpans(text, scope(omit.links), skipImages)) {
                 spans.push({ ...span, kind: 'link', hit: LINK_HIT });
             }
         }
-        if (checks?.boundary) {
-            for (const match of text.matchAll(new RegExp(SYSTEM_BOUNDARY.source, 'gi'))) {
+        if (omit.markers) {
+            const patterns = [
+                new RegExp(SYSTEM_BOUNDARY.source, 'gi'),
+                ...(note ? [notePattern(note)] : []),
+            ];
+            for (const match of patterns.flatMap((pattern) => [...text.matchAll(pattern)])) {
                 const start = match.index;
                 spans.push({
                     start,
                     end: start + match[0].length,
                     kind: 'instructions',
-                    hit: BOUNDARY_HIT,
+                    hit: MARKER_HIT,
                 });
             }
         }
@@ -155,7 +169,7 @@ function createThoughtGuard(options) {
             }
         }
         if (privateSystem) {
-            for (const [start, end] of promptEchoRanges(text, privateSystem, canary)) {
+            for (const [start, end] of promptEchoRanges(text, privateSystem, slot)) {
                 spans.push({ start, end, kind: 'instructions', hit: PROMPT_ECHO_HIT });
             }
         }
@@ -222,7 +236,7 @@ function createThoughtGuard(options) {
                 view.text += mark.raw;
                 at = mark.end;
             }
-            // An echo run is counted in words: read back until it fits, or the thought starts.
+            // why: An echo run is counted in words: read back until it fits, or the thought starts.
             if (!privateSystem || from === 0 || promptEchoScanFrom(view.text, view.held) > 0)
                 return view;
         }
@@ -239,7 +253,7 @@ function createThoughtGuard(options) {
             }
         }
         if (privateSystem) {
-            for (const [start, end] of promptEchoRanges(view.text, privateSystem, canary)) {
+            for (const [start, end] of promptEchoRanges(view.text, privateSystem, slot)) {
                 ranges.push([start, end, PROMPT_ECHO_HIT]);
             }
         }
@@ -298,16 +312,20 @@ function createThoughtGuard(options) {
         };
         for (const { start, end, kind, hit } of closed) {
             copy(offMark(start));
-            const to = Math.max(at, offMark(end, true));
+            // why: A leak set to `block` takes the rest of the thought with it.
+            cut = ends?.has(hit.rule) ?? false;
+            const to = cut ? whole.length : Math.max(at, offMark(end, true));
             const text = placeholder(kind, out + next);
             const begin = out.length + next.length;
             kept.push({ start: begin, end: begin + text.length, raw: rawOf(at, to) });
             next += text;
             hits.set(hit.rule, hit);
             at = to;
+            if (cut)
+                break;
         }
         open = undefined;
-        if (growing) {
+        if (growing && !cut) {
             copy(offMark(growing.start));
             open = out.length + next.length;
         }
@@ -346,12 +364,14 @@ function createThoughtGuard(options) {
                 break;
             const before = new Set(marks.map((mark) => mark.start));
             if (!omitHeld(false)) {
-                // A leak the readers settled that no span covers is cut, not shown.
+                // why: A leak the readers settled that no span covers is cut, not shown.
                 if (open === undefined)
                     break;
                 return;
             }
-            // A leak running on past its placeholder only grows it.
+            if (cut)
+                return;
+            // why: A leak running on past its placeholder only grows it.
             if (marks.some((mark) => !before.has(mark.start)))
                 leaks++;
             if (!restart(readable()))
@@ -364,7 +384,7 @@ function createThoughtGuard(options) {
         const end = out.length + held.length;
         const url = stream ? stream.holdFrom() : end;
         const leak = canary ? canaryFrom(canary) : end;
-        const echo = privateSystem ? out.length + promptEchoHoldFrom(held, privateSystem, canary) : end;
+        const echo = privateSystem ? out.length + promptEchoHoldFrom(held, privateSystem, slot) : end;
         const from = Math.min(url, leak, echo, rawHoldFrom() ?? end, open ?? end);
         return offMark(from < out.length ? from : out.length + wordStartAcross(held, from - out.length));
     }
@@ -374,7 +394,6 @@ function createThoughtGuard(options) {
         const lead = Math.max(0, from - RELEASED_LOOKBACK);
         let at = lead + canaryOpeningFrom(textFrom(lead), canary);
         if (at < from && from > out.length) {
-            // An opening the bound rules out: read the held text whole.
             const whole = Math.max(0, out.length - RELEASED_LOOKBACK);
             at = whole + canaryOpeningFrom(textFrom(whole), canary);
         }
@@ -392,7 +411,7 @@ function createThoughtGuard(options) {
             return undefined;
         const rest = view.text.slice(view.held);
         const leak = canary ? canaryHoldFrom(rest, canary, view.text.slice(0, view.held)) : rest.length;
-        const echo = privateSystem ? promptEchoHoldFrom(rest, privateSystem, canary) : rest.length;
+        const echo = privateSystem ? promptEchoHoldFrom(rest, privateSystem, slot) : rest.length;
         return shownAt(view, view.held + Math.min(leak, echo));
     }
     function release(text) {
@@ -418,15 +437,15 @@ function createThoughtGuard(options) {
         },
         flush() {
             if (!cut) {
-                for (let round = 0; round < MAX_ROUNDS && omitHeld(true); round++)
+                for (let round = 0; round < MAX_ROUNDS && !cut && omitHeld(true); round++)
                     ;
-                // A leak left is one the text shown already takes part in, such as a definition an image opener held here could use.
-                if (held && (leakSpans(out + held).length > 0 || rawLeaks().length > 0))
+                // why: A leak left is one the text shown already takes part in, such as a definition an image opener held here could use.
+                if (!cut && held && (leakSpans(out + held).length > 0 || rawLeaks().length > 0))
                     cutRest();
             }
             const shown = held;
             const whole = out + held;
-            out = canary ? promptLeakCarry(whole, canary, privateSystem) : '';
+            out = canary || privateSystem ? promptLeakCarry(whole, canary, privateSystem) : '';
             const shift = out.length - whole.length;
             marks = marks
                 .filter((mark) => mark.start + shift >= 0)
@@ -442,23 +461,204 @@ function createThoughtGuard(options) {
         carryOut: () => out,
     };
 }
+/** What several readers of one stretch of a thought found: every hit, once a rule, at the strongest action. */
+function foundBy(...founds) {
+    const all = founds.filter((found) => found !== undefined);
+    if (all.length === 0)
+        return {};
+    return {
+        found: {
+            action: all.reduce((action, found) => stronger(action, found.action), 'allow'),
+            hits: [...new Map(all.flatMap(({ hits }) => hits).map((hit) => [hit.rule, hit])).values()],
+        },
+    };
+}
 /**
- * A guard for a turn's thoughts: the canary and prompt echo whenever the turn
- * binds a canary, and the URL and boundary checks `enforce` runs.
+ * `guard` with `guardrails.detect` read at `thought` in front of it: the guard
+ * reads the thought as the detectors let it through. A match set to `block`
+ * ends what is shown of the thought there. The detectors in `leave` are the
+ * guard's own. `guard` unchanged when no other detector reads a thought.
  */
-function thoughtGuardFor(enforce, context, carry) {
-    const known = egressChecksOf(enforce);
-    const checks = known ? thoughtChecks(known) : undefined;
-    const { canary, privateSystem, givenUrls, lexicon } = context;
-    if (!(checks || canary))
-        return undefined;
-    return createThoughtGuard({
-        ...(checks ? { checks } : {}),
-        ...(canary ? { canary } : {}),
-        ...(privateSystem ? { privateSystem } : {}),
+function detectingThoughts(guard, detect, scope, leave) {
+    const open = () => createDetectStream('thought', detect, scope, leave);
+    let reader = open();
+    if (!reader)
+        return guard;
+    /** How much of the thought has been written, and how much of that released. */
+    let written = 0;
+    let read = 0;
+    let stopped = false;
+    /** The text now through the detectors, and what they found in it. */
+    function through(ended) {
+        if (stopped || !reader)
+            return { text: '' };
+        const to = ended ? written : Math.max(read, reader.holdFrom());
+        const { action, text = '', hits, taken } = reader.take(read, to, ended);
+        stopped = action === 'block';
+        read += taken;
+        return { text, ...(action === 'allow' ? {} : { found: { action, hits } }) };
+    }
+    return {
+        push(text) {
+            written += text.length;
+            reader?.push(text);
+            const { text: clear, found } = through(false);
+            const shown = guard ? guard.push(clear) : { text: clear, hits: [] };
+            return { text: shown.text, hits: shown.hits, ...foundBy(found, shown.found) };
+        },
+        flush() {
+            const { text: clear, found } = through(true);
+            const last = guard?.push(clear);
+            const rest = guard ? guard.flush() : { text: clear, hits: [] };
+            reader = open();
+            written = 0;
+            read = 0;
+            stopped = false;
+            return {
+                text: (last?.text ?? '') + rest.text,
+                hits: [
+                    ...new Map([...(last?.hits ?? []), ...rest.hits].map((hit) => [hit.rule, hit])).values(),
+                ],
+                ...foundBy(found, last?.found, rest.found),
+            };
+        },
+        carryOut: () => guard?.carryOut() ?? '',
+    };
+}
+/** The detectors a thought guard omits a match of, and the hit it reports for each. */
+const LEAK_DETECTORS = {
+    canary_leak: CANARY_HIT,
+    prompt_leak: PROMPT_ECHO_HIT,
+    marker_leak: MARKER_HIT,
+    ungiven_images: IMAGE_HIT,
+    ungiven_links: LINK_HIT,
+};
+/** The detectors among them the guard reads a thought's own text for; the gate has the other two. */
+const TEXT_LEAKS = ['marker_leak', 'ungiven_images', 'ungiven_links'];
+/**
+ * Reads a thought for the leaks set to `flag`: each is reported once a thought
+ * and the thought shown as written, so nothing is held for it.
+ */
+function flaggedLeaks(scope, planted) {
+    const { canary, privateSystem } = scope;
+    let scanner = canary ? createCanaryScanner(canary) : undefined;
+    let seen = '';
+    let reported = new Set();
+    return {
+        read(text) {
+            const from = promptEchoScanFrom(seen + text, seen.length);
+            seen += text;
+            const hits = [];
+            if (scanner?.push(text))
+                hits.push(CANARY_HIT);
+            if (privateSystem && promptEchoRanges(seen.slice(from), privateSystem, planted).length > 0) {
+                hits.push(PROMPT_ECHO_HIT);
+            }
+            const fresh = hits.filter((hit) => !reported.has(hit.rule));
+            for (const hit of fresh)
+                reported.add(hit.rule);
+            return fresh;
+        },
+        reset() {
+            scanner = canary ? createCanaryScanner(canary) : undefined;
+            seen = '';
+            reported = new Set();
+        },
+    };
+}
+/**
+ * `guard` with what it omitted reported as its detector's finding at `thought`,
+ * beside the leaks `flagged` reads for.
+ */
+function reportingLeaks(guard, detect, flagged, planted) {
+    const flags = flaggedLeaks(flagged, planted);
+    const actions = new Map(Object.entries(LEAK_DETECTORS).map(([detector, hit]) => [
+        hit.rule,
+        detect[detector].thought,
+    ]));
+    function report(release, noted) {
+        const ours = [...noted, ...release.hits.filter((hit) => actions.has(hit.rule))];
+        if (ours.length === 0)
+            return release;
+        const action = ours.reduce((found, hit) => stronger(found, actions.get(hit.rule) ?? 'ignore'), release.found?.action ?? 'allow');
+        return {
+            text: release.text,
+            hits: release.hits.filter((hit) => !actions.has(hit.rule)),
+            found: { action, hits: [...(release.found?.hits ?? []), ...ours] },
+        };
+    }
+    return {
+        push: (text) => report(guard.push(text), flags.read(text)),
+        flush() {
+            flags.reset();
+            return report(guard.flush(), []);
+        },
+        carryOut: () => guard.carryOut(),
+    };
+}
+/**
+ * A guard for a turn's thoughts: the detectors `guardrails.detect` sets at
+ * `thought`. `context` carries the canary and the system instruction only
+ * while their detectors read somewhere (`leakScopeOf`); at `thought`, `redact`
+ * omits a match, `block` ends what is shown of the thought there, and `flag`
+ * reports it and shows it.
+ */
+async function thoughtGuardFor(policy, context, carry) {
+    const { detect } = policy;
+    const own = TEXT_LEAKS.filter((detector) => omitsThought(detect, detector));
+    const omitted = leakScopeAt(detect, context, omitsThought);
+    const flagged = leakScopeAt(detect, context, (set, detector) => set[detector].thought === 'flag');
+    const guarded = own.length > 0 || scoped(omitted) || scoped(flagged);
+    const scope = scopeOf(policy, context);
+    if (guarded || detectReads(['thought'], detect, scope))
+        await loadEgressAutomata();
+    const guard = guarded
+        ? createThoughtGuard({
+            omit: thoughtOmits(policy),
+            ...omitted,
+            ...thoughtEnds(detect),
+            ...thoughtTurn(context),
+            ...(carry ? { carry } : {}),
+        })
+        : undefined;
+    const leaks = guard && reportingLeaks(guard, detect, flagged, context.canary);
+    return detectingThoughts(leaks, detect, scope, own);
+}
+/** Whether `detector` takes its matches out of a thought. */
+function omitsThought(detect, detector) {
+    return detect[detector].thought === 'redact' || detect[detector].thought === 'block';
+}
+/** What `guardrails.detect` omits from a thought by its marker, image, and link detectors. */
+function thoughtOmits({ detect, allow, }) {
+    return {
+        ...(omitsThought(detect, 'marker_leak') ? { markers: true } : {}),
+        ...(omitsThought(detect, 'ungiven_images') ? { images: allow.ungiven_images } : {}),
+        ...(omitsThought(detect, 'ungiven_links') ? { links: allow.ungiven_links } : {}),
+        imagesRead: detect.ungiven_images.thought !== 'ignore',
+    };
+}
+/** The canary and the system instruction, each while `applies` to its detector and the turn has it to read. */
+function leakScopeAt(detect, context, applies) {
+    const canary = applies(detect, 'canary_leak') && !context.canaryGiven && context.canary;
+    const privateSystem = applies(detect, 'prompt_leak') && context.privateSystem;
+    return { ...(canary ? { canary } : {}), ...(privateSystem ? { privateSystem } : {}) };
+}
+function scoped(scope) {
+    return scope.canary !== undefined || scope.privateSystem !== undefined;
+}
+/** The rules whose match ends what is shown of a thought. */
+function thoughtEnds(detect) {
+    const ends = new Set(Object.entries(LEAK_DETECTORS)
+        .filter(([detector]) => detect[detector].thought === 'block')
+        .map(([, hit]) => hit.rule));
+    return ends.size > 0 ? { ends } : {};
+}
+/** What the turn gives a thought guard to read against. */
+function thoughtTurn({ canary, givenUrls, labels, }) {
+    return {
+        ...(canary ? { planted: canary } : {}),
         ...(givenUrls ? { given: givenUrls } : {}),
-        ...(lexicon ? { lexicon } : {}),
-        ...(carry ? { carry } : {}),
-    });
+        ...(labels ? { labels } : {}),
+    };
 }
 export { createThoughtGuard, thoughtGuardFor };

package/esm/src/guardrails/tool-directives.d.ts

@@ -1,19 +1,38 @@
-import type { AdvisoryLevel, GuardrailHit } from './types.js';
+import type { AdvisoryLevel } from './types.js';
+/**
+ * What of a tool's text reads as an instruction to the agent: an order to set its instructions
+ * aside, the name of a tool it can call, an order, or a claim of authority. The last three count
+ * only beside a destination.
+ */
+declare const DIRECTIVE_SIGNALS: readonly ["override", "tool_name", "order", "authority"];
+/** One of {@linkcode DIRECTIVE_SIGNALS}. */
+type DirectiveSignal = (typeof DIRECTIVE_SIGNALS)[number];
+/** A stretch of a tool's text that instructs the agent, and what about it does. */
+interface Directive {
+    signal: DirectiveSignal;
+    start: number;
+    end: number;
+}
+/** One range for each run of overlapping `ranges`, in order. */
+declare function mergedRanges(ranges: readonly [number, number][]): [number, number][];
 /**
  * Real indirect injection rarely names what it attacks, so this looks for content that behaves
- * like an instruction. Hits raise the turn's taint rather than rewriting the text: a page
- * documenting an email API legitimately says "call send_email", and being wrong should cost a
- * refused write, not silently damaged input.
+ * like an instruction: each order, claim of authority, tool name, and destination, where it sits
+ * in `text`. A page documenting an email API legitimately says "call send_email", so the
+ * detector that reads with this (`tool_instructions`) starts at `flag`.
  *
  * `callableTools` is the set the model can invoke this turn. A result naming one is the
  * highest-precision signal: ordinary data has no reason to, and no generic filter can check it
  * without the turn's registry.
+ *
+ * The text is read normalized. Where that changes it, each signal found is placed on the
+ * stretch of `text` it was read from (`normalizedView`).
  */
-declare function directiveHits(text: string, callableTools?: readonly string[]): GuardrailHit[];
-declare function looksDirective(hits: GuardrailHit[]): boolean;
+declare function directives(text: string, callableTools?: readonly string[]): Directive[];
 /**
- * Naming a tool the model can call is the sharpest signal available, so it alone
- * reaches `high`; so does agreement between two different signal kinds.
+ * How strongly a tool's text reads as instructions, by the `signals` found in it: `high` for an
+ * order to drop instructions, a callable tool's name, or two signals together.
  */
-declare function advisoryLevel(hits: GuardrailHit[]): AdvisoryLevel;
-export { advisoryLevel, directiveHits, looksDirective };
+declare function advisoryLevel(signals: readonly (string | undefined)[]): AdvisoryLevel;
+export type { Directive, DirectiveSignal };
+export { advisoryLevel, DIRECTIVE_SIGNALS, directives, mergedRanges };