agent-contracts 0.11.8 → 0.12.1

package/README.md

@@ -998,7 +998,7 @@ Each `context` type provides a different rendering scope:
 
 | Context | Scope | Output | Key variables |
 |---------|-------|--------|---------------|
-| `system` | Single file | `output` as-is | `system`, `dsl` |
+| `system` | Single file | `output` as-is | `system`, `dsl`, `guardrailEnforcement`\*, `bindings`\* |
 | `agent` | Per agent | `{agent.id}` in output path | `agent`, `receivableTasks`, `delegatableTasks`, `relatedArtifacts`, `relatedTools`, `relatedHandoffTypes`, `mergedBehavior`, `dsl` |
 | `task` | Per task | `{task.id}` in output path | `task`, `targetAgent`, `dsl` |
 | `artifact` | Per artifact | `{artifact.id}` in output path | `artifact`, `relatedTools`, `relatedValidations`, `producerAgents`, `consumerAgents`, `editorAgents`, `createdInWorkflows`, `dsl` |
@@ -1027,6 +1027,18 @@ Each `context` type provides a different rendering scope:
 * `producerAgents` / `consumerAgents` / `editorAgents` — resolved agent records
 * `createdInWorkflows` — workflow phases where this artifact is written
 
+**`system` context** includes binding-aware guardrail enforcement data when `bindings` and `active_guardrail_policy` are configured:
+
+* `guardrailEnforcement` — array of enforcement entries, each with `guardrail_id`, `description`, `severity`, `action`, scoped entities (`scoped_agents`, `scoped_tasks`, `scoped_workflows`, `scoped_tools`, `scoped_artifacts`), `allow_override`, `override_requires`, `trigger` (from binding matcher type), and `escalation`
+* `bindings` — array of loaded `SoftwareBinding` objects
+
+These fields are only populated when the config specifies `bindings` and `active_guardrail_policy`. Existing templates that do not reference these fields are unaffected.
+
+**Matrix helpers** are available in `context: system` templates:
+
+* `guardrailCoverageMatrix` — generates a Guardrail Coverage Matrix table (guardrail × severity × action × scoped entities × trigger × override × escalation)
+* `taskGuardrailMatrix` — generates a Task × Guardrail cross-reference table showing which action applies to each task
+
 **`tool` context** resolves agent and artifact references:
 
 * `invokableAgents` — agents listed in `invokable_by`

package/dist/cli.js

@@ -2243,7 +2243,7 @@ var require_lodash = __commonJS({
               } else {
                 newValue = [];
               }
-            } else if (isPlainObject(srcValue) || isArguments(srcValue)) {
+            } else if (isPlainObject2(srcValue) || isArguments(srcValue)) {
               newValue = objValue;
               if (isArguments(objValue)) {
                 newValue = toPlainObject(objValue);
@@ -3207,7 +3207,7 @@ var require_lodash = __commonJS({
           return objValue;
         }
         function customOmitClone(value) {
-          return isPlainObject(value) ? undefined2 : value;
+          return isPlainObject2(value) ? undefined2 : value;
         }
         function equalArrays(array, other, bitmask, customizer, equalFunc, stack) {
           var isPartial = bitmask & COMPARE_PARTIAL_FLAG, arrLength = array.length, othLength = other.length;
@@ -4708,7 +4708,7 @@ var require_lodash = __commonJS({
         var isBuffer = nativeIsBuffer || stubFalse;
         var isDate = nodeIsDate ? baseUnary(nodeIsDate) : baseIsDate;
         function isElement(value) {
-          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject(value);
+          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject2(value);
         }
         function isEmpty(value) {
           if (value == null) {
@@ -4744,7 +4744,7 @@ var require_lodash = __commonJS({
             return false;
           }
           var tag = baseGetTag(value);
-          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject(value);
+          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject2(value);
         }
         function isFinite2(value) {
           return typeof value == "number" && nativeIsFinite(value);
@@ -4795,7 +4795,7 @@ var require_lodash = __commonJS({
         function isNumber(value) {
           return typeof value == "number" || isObjectLike(value) && baseGetTag(value) == numberTag;
         }
-        function isPlainObject(value) {
+        function isPlainObject2(value) {
           if (!isObjectLike(value) || baseGetTag(value) != objectTag) {
             return false;
           }
@@ -5866,7 +5866,7 @@ var require_lodash = __commonJS({
         lodash.isNumber = isNumber;
         lodash.isObject = isObject2;
         lodash.isObjectLike = isObjectLike;
-        lodash.isPlainObject = isPlainObject;
+        lodash.isPlainObject = isPlainObject2;
         lodash.isRegExp = isRegExp;
         lodash.isSafeInteger = isSafeInteger;
         lodash.isSet = isSet;
@@ -17506,10 +17506,10 @@ var require_immer_cjs_development = __commonJS({
     function isDraftable(value) {
       var _value$constructor;
       if (!value) return false;
-      return isPlainObject(value) || Array.isArray(value) || !!value[DRAFTABLE] || !!((_value$constructor = value.constructor) === null || _value$constructor === void 0 ? void 0 : _value$constructor[DRAFTABLE]) || isMap(value) || isSet(value);
+      return isPlainObject2(value) || Array.isArray(value) || !!value[DRAFTABLE] || !!((_value$constructor = value.constructor) === null || _value$constructor === void 0 ? void 0 : _value$constructor[DRAFTABLE]) || isMap(value) || isSet(value);
     }
     var objectCtorString = /* @__PURE__ */ Object.prototype.constructor.toString();
-    function isPlainObject(value) {
+    function isPlainObject2(value) {
       if (!value || typeof value !== "object") return false;
       var proto = Object.getPrototypeOf(value);
       if (proto === null) {
@@ -40192,10 +40192,10 @@ var require_object_inspect = __commonJS({
       }
       if (!isDate(obj) && !isRegExp(obj)) {
         var ys = arrObjKeys(obj, inspect);
-        var isPlainObject = gPO ? gPO(obj) === Object.prototype : obj instanceof Object || obj.constructor === Object;
+        var isPlainObject2 = gPO ? gPO(obj) === Object.prototype : obj instanceof Object || obj.constructor === Object;
         var protoTag = obj instanceof Object ? "" : "null prototype";
-        var stringTag = !isPlainObject && toStringTag2 && Object(obj) === obj && toStringTag2 in obj ? $slice.call(toStr(obj), 8, -1) : protoTag ? "Object" : "";
-        var constructorTag = isPlainObject || typeof obj.constructor !== "function" ? "" : obj.constructor.name ? obj.constructor.name + " " : "";
+        var stringTag = !isPlainObject2 && toStringTag2 && Object(obj) === obj && toStringTag2 in obj ? $slice.call(toStr(obj), 8, -1) : protoTag ? "Object" : "";
+        var constructorTag = isPlainObject2 || typeof obj.constructor !== "function" ? "" : obj.constructor.name ? obj.constructor.name + " " : "";
         var tag = constructorTag + (stringTag || protoTag ? "[" + $join.call($concat.call([], stringTag || [], protoTag || []), ": ") + "] " : "");
         if (ys.length === 0) {
           return tag + "{}";
@@ -44530,7 +44530,7 @@ var require_lodash3 = __commonJS({
               } else {
                 newValue = [];
               }
-            } else if (isPlainObject(srcValue) || isArguments(srcValue)) {
+            } else if (isPlainObject2(srcValue) || isArguments(srcValue)) {
               newValue = objValue;
               if (isArguments(objValue)) {
                 newValue = toPlainObject(objValue);
@@ -45501,7 +45501,7 @@ var require_lodash3 = __commonJS({
           return objValue;
         }
         function customOmitClone(value) {
-          return isPlainObject(value) ? undefined2 : value;
+          return isPlainObject2(value) ? undefined2 : value;
         }
         function equalArrays(array, other, bitmask, customizer, equalFunc, stack) {
           var isPartial = bitmask & COMPARE_PARTIAL_FLAG, arrLength = array.length, othLength = other.length;
@@ -47002,7 +47002,7 @@ var require_lodash3 = __commonJS({
         var isBuffer = nativeIsBuffer || stubFalse;
         var isDate = nodeIsDate ? baseUnary(nodeIsDate) : baseIsDate;
         function isElement(value) {
-          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject(value);
+          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject2(value);
         }
         function isEmpty(value) {
           if (value == null) {
@@ -47038,7 +47038,7 @@ var require_lodash3 = __commonJS({
             return false;
           }
           var tag = baseGetTag(value);
-          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject(value);
+          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject2(value);
         }
         function isFinite2(value) {
           return typeof value == "number" && nativeIsFinite(value);
@@ -47089,7 +47089,7 @@ var require_lodash3 = __commonJS({
         function isNumber(value) {
           return typeof value == "number" || isObjectLike(value) && baseGetTag(value) == numberTag;
         }
-        function isPlainObject(value) {
+        function isPlainObject2(value) {
           if (!isObjectLike(value) || baseGetTag(value) != objectTag) {
             return false;
           }
@@ -48155,7 +48155,7 @@ var require_lodash3 = __commonJS({
         lodash.isNumber = isNumber;
         lodash.isObject = isObject2;
         lodash.isObjectLike = isObjectLike;
-        lodash.isPlainObject = isPlainObject;
+        lodash.isPlainObject = isPlainObject2;
         lodash.isRegExp = isRegExp;
         lodash.isSafeInteger = isSafeInteger;
         lodash.isSet = isSet;
@@ -50527,13 +50527,20 @@ var BindingOutputSchema = z3.object({
   target: z3.string(),
   template: z3.string().optional(),
   inline_template: z3.string().optional(),
+  source: z3.string().optional(),
   mode: z3.enum(["write", "patch"]).default("write"),
+  format: z3.enum(["json", "yaml", "text"]).optional(),
+  patch_strategy: z3.enum(["deep_merge", "append"]).optional(),
+  array_merge_key: z3.string().optional(),
   group_by: z3.string().optional(),
   executable: z3.boolean().optional(),
   skip_empty: z3.boolean().optional()
 }).passthrough().refine(
-  (data) => !(data.template && data.inline_template),
-  { message: "template and inline_template are mutually exclusive" }
+  (data) => {
+    const count = [data.template, data.inline_template, data.source].filter(Boolean).length;
+    return count === 1 || count === 0;
+  },
+  { message: "Only one of template, inline_template, or source may be specified" }
 );
 var ReportingSchema = z3.object({
   commands: z3.record(z3.string(), z3.string()),
@@ -53574,8 +53581,52 @@ import { dirname as dirname5 } from "path";
 import Handlebars from "handlebars";
 
 // src/renderer/context.ts
-function buildSystemContext(dsl) {
-  return { system: dsl.system, dsl };
+function buildSystemContext(dsl, options) {
+  const ctx = { system: dsl.system, dsl };
+  if (options?.loadedBindings && options.loadedBindings.length > 0) {
+    ctx.bindings = options.loadedBindings.map((lb) => lb.binding);
+    const policyName = options.activeGuardrailPolicy;
+    const policy = policyName ? dsl.guardrail_policies[policyName] : void 0;
+    if (policy) {
+      ctx.guardrailEnforcement = buildGuardrailEnforcement(dsl, policy, options.loadedBindings);
+    }
+  }
+  return ctx;
+}
+function buildGuardrailEnforcement(dsl, policy, loadedBindings) {
+  const entries = [];
+  const bindingTriggers = /* @__PURE__ */ new Map();
+  for (const lb of loadedBindings) {
+    const impl = lb.binding.guardrail_impl ?? {};
+    for (const [guardrailId, gi] of Object.entries(impl)) {
+      for (const check of gi.checks) {
+        if (check.matcher) {
+          bindingTriggers.set(guardrailId, check.matcher.type);
+        }
+      }
+    }
+  }
+  for (const rule of policy.rules) {
+    const guardrail = dsl.guardrails[rule.guardrail];
+    if (!guardrail) continue;
+    const scope = guardrail.scope ?? {};
+    entries.push({
+      guardrail_id: rule.guardrail,
+      description: guardrail.description,
+      severity: rule.severity,
+      action: rule.action,
+      scoped_agents: scope.agents ?? [],
+      scoped_tasks: scope.tasks ?? [],
+      scoped_workflows: scope.workflows ?? [],
+      scoped_tools: scope.tools ?? [],
+      scoped_artifacts: scope.artifacts ?? [],
+      allow_override: rule.allow_override,
+      override_requires: rule.override_requires ?? [],
+      trigger: bindingTriggers.get(rule.guardrail) ?? null,
+      escalation: rule.escalation ? { target: rule.escalation.target, condition: rule.escalation.condition } : null
+    });
+  }
+  return entries;
 }
 function buildTaskContext(dsl, taskId) {
   const taskDef = dsl.tasks[taskId];
@@ -54630,6 +54681,50 @@ Handlebars.registerHelper(
     return generateOverviewFlowchart(dsl);
   }
 );
+Handlebars.registerHelper(
+  "guardrailCoverageMatrix",
+  function() {
+    const enforcement = this["guardrailEnforcement"];
+    if (!enforcement || enforcement.length === 0) return "";
+    const header = "| Guardrail | Severity | Action | Agents | Tasks | Workflows | Tools | Artifacts | Trigger | Override | Escalation |";
+    const divider = "|-----------|----------|--------|--------|-------|-----------|-------|-----------|---------|----------|------------|";
+    const rows = enforcement.map((e3) => {
+      const agents = e3["scoped_agents"]?.join(", ") || "\u2014";
+      const tasks = e3["scoped_tasks"]?.join(", ") || "\u2014";
+      const workflows = e3["scoped_workflows"]?.join(", ") || "\u2014";
+      const tools = e3["scoped_tools"]?.join(", ") || "\u2014";
+      const artifacts = e3["scoped_artifacts"]?.join(", ") || "\u2014";
+      const trigger = e3["trigger"] || "\u2014";
+      const override = e3["allow_override"] ? "yes" : "no";
+      const esc = e3["escalation"];
+      const escalation = esc ? esc["target"] : "\u2014";
+      return `| ${e3["guardrail_id"]} | ${e3["severity"]} | ${e3["action"]} | ${agents} | ${tasks} | ${workflows} | ${tools} | ${artifacts} | ${trigger} | ${override} | ${escalation} |`;
+    });
+    return [header, divider, ...rows].join("\n");
+  }
+);
+Handlebars.registerHelper(
+  "taskGuardrailMatrix",
+  function() {
+    const dsl = this["dsl"];
+    const enforcement = this["guardrailEnforcement"];
+    if (!dsl || !enforcement || enforcement.length === 0) return "";
+    const taskIds = Object.keys(dsl.tasks);
+    if (taskIds.length === 0) return "";
+    const guardrailIds = enforcement.map((e3) => e3["guardrail_id"]);
+    const header = `| Task | ${guardrailIds.join(" | ")} |`;
+    const divider = `|------|${guardrailIds.map(() => "------").join("|")}|`;
+    const rows = taskIds.map((taskId) => {
+      const cells = enforcement.map((e3) => {
+        const scopedTasks = e3["scoped_tasks"];
+        if (scopedTasks.length > 0 && !scopedTasks.includes(taskId)) return "n/a";
+        return e3["action"];
+      });
+      return `| ${taskId} | ${cells.join(" | ")} |`;
+    });
+    return [header, divider, ...rows].join("\n");
+  }
+);
 function getDslSection(dsl, context) {
   const sectionMap = {
     agent: dsl.agents,
@@ -54694,13 +54789,13 @@ async function removeIfExists(filePath) {
   } catch {
   }
 }
-async function renderFromConfig(dsl, renderTargets) {
+async function renderFromConfig(dsl, renderTargets, options) {
   const outputFiles = [];
   for (const target of renderTargets) {
     const templateContent = await loadTemplate(target.template);
     const compiled = Handlebars.compile(templateContent, { noEscape: false });
     if (target.context === "system") {
-      const ctx = buildSystemContext(dsl);
+      const ctx = buildSystemContext(dsl, options);
       const output = compiled(ctx);
       if (target.skip_empty && isEffectivelyEmpty(output)) {
         await removeIfExists(target.output);
@@ -54749,13 +54844,13 @@ function checkExpectedVsExisting(expected, outputPath, skipEmpty, diffs) {
     diffs.push(outputPath);
   });
 }
-async function checkDriftFromConfig(dsl, renderTargets) {
+async function checkDriftFromConfig(dsl, renderTargets, options) {
   const diffs = [];
   for (const target of renderTargets) {
     const templateContent = await loadTemplate(target.template);
     const compiled = Handlebars.compile(templateContent, { noEscape: false });
     if (target.context === "system") {
-      const ctx = buildSystemContext(dsl);
+      const ctx = buildSystemContext(dsl, options);
       const expected = compiled(ctx);
       await checkExpectedVsExisting(expected, target.output, target.skip_empty, diffs);
     } else {
@@ -54793,10 +54888,19 @@ var renderCommand = new Command4("render").description("Render resolved DSL with
         );
         process.exit(1);
       }
+      let renderOptions;
+      if (config.bindings.length > 0) {
+        const loadedBindings = await loadBindings(config.bindings);
+        renderOptions = {
+          loadedBindings,
+          activeGuardrailPolicy: config.activeGuardrailPolicy
+        };
+      }
       if (opts.check) {
         const drift = await checkDriftFromConfig(
           schemaResult.data,
-          config.renders
+          config.renders,
+          renderOptions
         );
         if (drift.hasDrift) {
           process.stderr.write("Drift detected in the following files:\n");
@@ -54812,7 +54916,8 @@ var renderCommand = new Command4("render").description("Render resolved DSL with
       } else {
         const files = await renderFromConfig(
           schemaResult.data,
-          config.renders
+          config.renders,
+          renderOptions
         );
         if (!opts.quiet) {
           process.stdout.write(`Rendered ${files.length} file(s):
@@ -54924,9 +55029,10 @@ var checkCommand = new Command5("check").description("Run full pipeline: resolve
 import { Command as Command6 } from "commander";
 
 // src/guardrail-generator/generator.ts
-import { readFile as readFile5, writeFile as writeFile2, mkdir as mkdir2, chmod, unlink as unlink2 } from "fs/promises";
+import { readFile as readFile5, writeFile as writeFile2, mkdir as mkdir2, chmod, unlink as unlink2, copyFile } from "fs/promises";
 import { resolve as resolve6, dirname as dirname6 } from "path";
 import Handlebars2 from "handlebars";
+import YAML from "yaml";
 
 // src/guardrail-generator/resolve-checks.ts
 function resolveChecks(dsl, binding, policy) {
@@ -54998,6 +55104,81 @@ Handlebars2.registerHelper(
     return new Handlebars2.SafeString(result);
   }
 );
+function isPlainObject(val) {
+  return typeof val === "object" && val !== null && !Array.isArray(val);
+}
+function deepMergeArrays(existing, incoming, mergeKey) {
+  if (!mergeKey) return [...existing, ...incoming];
+  const merged = [...existing];
+  for (const item of incoming) {
+    if (isPlainObject(item) && mergeKey in item) {
+      const idx = merged.findIndex(
+        (e3) => isPlainObject(e3) && e3[mergeKey] === item[mergeKey]
+      );
+      if (idx >= 0) {
+        merged[idx] = item;
+      } else {
+        merged.push(item);
+      }
+    } else {
+      merged.push(item);
+    }
+  }
+  return merged;
+}
+function deepMerge(existing, incoming, arrayMergeKey) {
+  if (Array.isArray(existing) && Array.isArray(incoming)) {
+    return deepMergeArrays(existing, incoming, arrayMergeKey);
+  }
+  if (isPlainObject(existing) && isPlainObject(incoming)) {
+    const result = { ...existing };
+    for (const [key, val] of Object.entries(incoming)) {
+      result[key] = key in result ? deepMerge(result[key], val, arrayMergeKey) : val;
+    }
+    return result;
+  }
+  return incoming;
+}
+function parseContent(raw, format2) {
+  if (format2 === "json") return JSON.parse(raw);
+  if (format2 === "yaml") return YAML.parse(raw);
+  throw new Error(`Unsupported format for patch parsing: ${format2}`);
+}
+function serializeContent(data, format2) {
+  if (format2 === "json") return JSON.stringify(data, null, 2) + "\n";
+  if (format2 === "yaml") return YAML.stringify(data);
+  throw new Error(`Unsupported format for patch serialization: ${format2}`);
+}
+async function applyPatch(targetPath, patchContent, outputDef) {
+  const format2 = outputDef.format ?? "json";
+  if (format2 === "text") {
+    let existing = "";
+    try {
+      existing = await readFile5(targetPath, "utf8");
+    } catch {
+    }
+    return existing + patchContent;
+  }
+  const patchData = parseContent(patchContent, format2);
+  let existingData;
+  try {
+    const existingRaw = await readFile5(targetPath, "utf8");
+    existingData = parseContent(existingRaw, format2);
+  } catch {
+    return serializeContent(patchData, format2);
+  }
+  const strategy = outputDef.patch_strategy ?? "deep_merge";
+  if (strategy === "append" && Array.isArray(existingData)) {
+    const merged2 = deepMergeArrays(
+      existingData,
+      Array.isArray(patchData) ? patchData : [patchData],
+      outputDef.array_merge_key
+    );
+    return serializeContent(merged2, format2);
+  }
+  const merged = deepMerge(existingData, patchData, outputDef.array_merge_key);
+  return serializeContent(merged, format2);
+}
 async function generateGuardrails(options) {
   const { dsl, config, loadedBindings, filterBindings, dryRun } = options;
   const outputFiles = [];
@@ -55067,6 +55248,31 @@ async function generateGuardrails(options) {
         continue;
       }
       const targetPath = resolve6(config.configDir, pathResult.resolved);
+      if (outputDef.source) {
+        const sourcePath = resolve6(config.configDir, outputDef.source);
+        if (!dryRun) {
+          try {
+            await mkdir2(dirname6(targetPath), { recursive: true });
+            await copyFile(sourcePath, targetPath);
+            if (outputDef.executable) {
+              await chmod(targetPath, 493);
+            }
+          } catch (err) {
+            const code = err.code;
+            if (code === "ENOENT") {
+              diagnostics.push({
+                path: `binding.${binding.software}.outputs.${outputId}`,
+                message: `Source file not found: ${sourcePath}`,
+                severity: "error"
+              });
+              continue;
+            }
+            throw err;
+          }
+        }
+        outputFiles.push(targetPath);
+        continue;
+      }
       let templateContent;
       if (outputDef.inline_template) {
         templateContent = outputDef.inline_template;
@@ -55093,12 +55299,13 @@ async function generateGuardrails(options) {
       } else {
         diagnostics.push({
           path: `binding.${binding.software}.outputs.${outputId}`,
-          message: "Output has neither template nor inline_template",
+          message: "Output has neither template, inline_template, nor source",
           severity: "error"
         });
         continue;
       }
       const shouldSkipEmpty = outputDef.skip_empty === true;
+      const isPatch = outputDef.mode === "patch";
       if (outputDef.group_by) {
         const groupField = outputDef.group_by;
         const groups = /* @__PURE__ */ new Map();
@@ -55116,9 +55323,9 @@ async function generateGuardrails(options) {
             current_group: groupKey
           };
           const compiled = Handlebars2.compile(templateContent, { noEscape: true });
-          const output = compiled(groupCtx);
+          const rendered = compiled(groupCtx);
           const groupTarget = resolve6(targetPath, groupKey);
-          if (shouldSkipEmpty && output.trim().length === 0) {
+          if (shouldSkipEmpty && rendered.trim().length === 0) {
             if (!dryRun) {
               try {
                 await unlink2(groupTarget);
@@ -55127,6 +55334,7 @@ async function generateGuardrails(options) {
             }
             continue;
           }
+          const output = isPatch && !dryRun ? await applyPatch(groupTarget, rendered, outputDef) : rendered;
           if (!dryRun) {
             await mkdir2(dirname6(groupTarget), { recursive: true });
             await writeFile2(groupTarget, output, "utf8");
@@ -55138,8 +55346,8 @@ async function generateGuardrails(options) {
         }
       } else {
         const compiled = Handlebars2.compile(templateContent, { noEscape: true });
-        const output = compiled(ctx);
-        if (shouldSkipEmpty && output.trim().length === 0) {
+        const rendered = compiled(ctx);
+        if (shouldSkipEmpty && rendered.trim().length === 0) {
           if (!dryRun) {
             try {
               await unlink2(targetPath);
@@ -55147,6 +55355,7 @@ async function generateGuardrails(options) {
             }
           }
         } else {
+          const output = isPatch && !dryRun ? await applyPatch(targetPath, rendered, outputDef) : rendered;
           if (!dryRun) {
             await mkdir2(dirname6(targetPath), { recursive: true });
             await writeFile2(targetPath, output, "utf8");