agent-contracts 0.11.8 → 0.12.1

package/dist/index.d.ts

@@ -130,10 +130,21 @@ declare const BindingOutputSchema: z.ZodObject<{
     target: z.ZodString;
     template: z.ZodOptional<z.ZodString>;
     inline_template: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodString>;
     mode: z.ZodDefault<z.ZodEnum<{
         write: "write";
         patch: "patch";
     }>>;
+    format: z.ZodOptional<z.ZodEnum<{
+        json: "json";
+        yaml: "yaml";
+        text: "text";
+    }>>;
+    patch_strategy: z.ZodOptional<z.ZodEnum<{
+        deep_merge: "deep_merge";
+        append: "append";
+    }>>;
+    array_merge_key: z.ZodOptional<z.ZodString>;
     group_by: z.ZodOptional<z.ZodString>;
     executable: z.ZodOptional<z.ZodBoolean>;
     skip_empty: z.ZodOptional<z.ZodBoolean>;
@@ -172,10 +183,21 @@ declare const SoftwareBindingSchema: z.ZodObject<{
         target: z.ZodString;
         template: z.ZodOptional<z.ZodString>;
         inline_template: z.ZodOptional<z.ZodString>;
+        source: z.ZodOptional<z.ZodString>;
         mode: z.ZodDefault<z.ZodEnum<{
             write: "write";
             patch: "patch";
         }>>;
+        format: z.ZodOptional<z.ZodEnum<{
+            json: "json";
+            yaml: "yaml";
+            text: "text";
+        }>>;
+        patch_strategy: z.ZodOptional<z.ZodEnum<{
+            deep_merge: "deep_merge";
+            append: "append";
+        }>>;
+        array_merge_key: z.ZodOptional<z.ZodString>;
         group_by: z.ZodOptional<z.ZodString>;
         executable: z.ZodOptional<z.ZodBoolean>;
         skip_empty: z.ZodOptional<z.ZodBoolean>;
@@ -1034,8 +1056,18 @@ interface ResolvedConfig {
     paths?: Record<string, string>;
 }
 
-declare function renderFromConfig(dsl: Dsl, renderTargets: ResolvedRenderTarget[]): Promise<string[]>;
-declare function checkDriftFromConfig(dsl: Dsl, renderTargets: ResolvedRenderTarget[]): Promise<{
+interface LoadedBinding {
+    filePath: string;
+    binding: SoftwareBinding;
+}
+declare function loadBindings(bindingPaths: string[]): Promise<LoadedBinding[]>;
+
+interface RenderOptions {
+    loadedBindings?: LoadedBinding[];
+    activeGuardrailPolicy?: string;
+}
+declare function renderFromConfig(dsl: Dsl, renderTargets: ResolvedRenderTarget[], options?: RenderOptions): Promise<string[]>;
+declare function checkDriftFromConfig(dsl: Dsl, renderTargets: ResolvedRenderTarget[], options?: RenderOptions): Promise<{
     hasDrift: boolean;
     diffs: string[];
 }>;
@@ -1054,9 +1086,29 @@ interface GlobalContext {
     guardrail_policies: Dsl["guardrail_policies"];
     [key: string]: unknown;
 }
+interface GuardrailEnforcementEntry {
+    guardrail_id: string;
+    description: string;
+    severity: string;
+    action: string;
+    scoped_agents: string[];
+    scoped_tasks: string[];
+    scoped_workflows: string[];
+    scoped_tools: string[];
+    scoped_artifacts: string[];
+    allow_override: boolean;
+    override_requires: string[];
+    trigger: string | null;
+    escalation: {
+        target: string;
+        condition?: string;
+    } | null;
+}
 interface SystemContext {
     system: System;
     dsl: Dsl;
+    guardrailEnforcement?: GuardrailEnforcementEntry[];
+    bindings?: SoftwareBinding[];
     [key: string]: unknown;
 }
 interface PerTaskContext {
@@ -1183,7 +1235,10 @@ interface PerAgentContext {
     [key: string]: unknown;
 }
 declare function buildGlobalContext(dsl: Dsl): GlobalContext;
-declare function buildSystemContext(dsl: Dsl): SystemContext;
+declare function buildSystemContext(dsl: Dsl, options?: {
+    loadedBindings?: LoadedBinding[];
+    activeGuardrailPolicy?: string;
+}): SystemContext;
 declare function buildTaskContext(dsl: Dsl, taskId: string): PerTaskContext;
 declare function buildArtifactContext(dsl: Dsl, artifactId: string): PerArtifactContext;
 declare function buildToolContext(dsl: Dsl, toolId: string): PerToolContext;
@@ -1197,12 +1252,6 @@ declare function buildPerAgentContext(dsl: Dsl, agent: Agent & {
     id: string;
 }): PerAgentContext;
 
-interface LoadedBinding {
-    filePath: string;
-    binding: SoftwareBinding;
-}
-declare function loadBindings(bindingPaths: string[]): Promise<LoadedBinding[]>;
-
 declare class ConfigLoadError extends Error {
     readonly filePath?: string | undefined;
     constructor(message: string, filePath?: string | undefined);

package/dist/index.js

@@ -2242,7 +2242,7 @@ var require_lodash = __commonJS({
               } else {
                 newValue = [];
               }
-            } else if (isPlainObject(srcValue) || isArguments(srcValue)) {
+            } else if (isPlainObject2(srcValue) || isArguments(srcValue)) {
               newValue = objValue;
               if (isArguments(objValue)) {
                 newValue = toPlainObject(objValue);
@@ -3206,7 +3206,7 @@ var require_lodash = __commonJS({
           return objValue;
         }
         function customOmitClone(value) {
-          return isPlainObject(value) ? undefined2 : value;
+          return isPlainObject2(value) ? undefined2 : value;
         }
         function equalArrays(array, other, bitmask, customizer, equalFunc, stack) {
           var isPartial = bitmask & COMPARE_PARTIAL_FLAG, arrLength = array.length, othLength = other.length;
@@ -4707,7 +4707,7 @@ var require_lodash = __commonJS({
         var isBuffer = nativeIsBuffer || stubFalse;
         var isDate = nodeIsDate ? baseUnary(nodeIsDate) : baseIsDate;
         function isElement(value) {
-          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject(value);
+          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject2(value);
         }
         function isEmpty(value) {
           if (value == null) {
@@ -4743,7 +4743,7 @@ var require_lodash = __commonJS({
             return false;
           }
           var tag = baseGetTag(value);
-          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject(value);
+          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject2(value);
         }
         function isFinite2(value) {
           return typeof value == "number" && nativeIsFinite(value);
@@ -4794,7 +4794,7 @@ var require_lodash = __commonJS({
         function isNumber(value) {
           return typeof value == "number" || isObjectLike(value) && baseGetTag(value) == numberTag;
         }
-        function isPlainObject(value) {
+        function isPlainObject2(value) {
           if (!isObjectLike(value) || baseGetTag(value) != objectTag) {
             return false;
           }
@@ -5865,7 +5865,7 @@ var require_lodash = __commonJS({
         lodash.isNumber = isNumber;
         lodash.isObject = isObject2;
         lodash.isObjectLike = isObjectLike;
-        lodash.isPlainObject = isPlainObject;
+        lodash.isPlainObject = isPlainObject2;
         lodash.isRegExp = isRegExp;
         lodash.isSafeInteger = isSafeInteger;
         lodash.isSet = isSet;
@@ -17505,10 +17505,10 @@ var require_immer_cjs_development = __commonJS({
     function isDraftable(value) {
       var _value$constructor;
       if (!value) return false;
-      return isPlainObject(value) || Array.isArray(value) || !!value[DRAFTABLE] || !!((_value$constructor = value.constructor) === null || _value$constructor === void 0 ? void 0 : _value$constructor[DRAFTABLE]) || isMap(value) || isSet(value);
+      return isPlainObject2(value) || Array.isArray(value) || !!value[DRAFTABLE] || !!((_value$constructor = value.constructor) === null || _value$constructor === void 0 ? void 0 : _value$constructor[DRAFTABLE]) || isMap(value) || isSet(value);
     }
     var objectCtorString = /* @__PURE__ */ Object.prototype.constructor.toString();
-    function isPlainObject(value) {
+    function isPlainObject2(value) {
       if (!value || typeof value !== "object") return false;
       var proto = Object.getPrototypeOf(value);
       if (proto === null) {
@@ -40191,10 +40191,10 @@ var require_object_inspect = __commonJS({
       }
       if (!isDate(obj) && !isRegExp(obj)) {
         var ys = arrObjKeys(obj, inspect);
-        var isPlainObject = gPO ? gPO(obj) === Object.prototype : obj instanceof Object || obj.constructor === Object;
+        var isPlainObject2 = gPO ? gPO(obj) === Object.prototype : obj instanceof Object || obj.constructor === Object;
         var protoTag = obj instanceof Object ? "" : "null prototype";
-        var stringTag = !isPlainObject && toStringTag2 && Object(obj) === obj && toStringTag2 in obj ? $slice.call(toStr(obj), 8, -1) : protoTag ? "Object" : "";
-        var constructorTag = isPlainObject || typeof obj.constructor !== "function" ? "" : obj.constructor.name ? obj.constructor.name + " " : "";
+        var stringTag = !isPlainObject2 && toStringTag2 && Object(obj) === obj && toStringTag2 in obj ? $slice.call(toStr(obj), 8, -1) : protoTag ? "Object" : "";
+        var constructorTag = isPlainObject2 || typeof obj.constructor !== "function" ? "" : obj.constructor.name ? obj.constructor.name + " " : "";
         var tag = constructorTag + (stringTag || protoTag ? "[" + $join.call($concat.call([], stringTag || [], protoTag || []), ": ") + "] " : "");
         if (ys.length === 0) {
           return tag + "{}";
@@ -44529,7 +44529,7 @@ var require_lodash3 = __commonJS({
               } else {
                 newValue = [];
               }
-            } else if (isPlainObject(srcValue) || isArguments(srcValue)) {
+            } else if (isPlainObject2(srcValue) || isArguments(srcValue)) {
               newValue = objValue;
               if (isArguments(objValue)) {
                 newValue = toPlainObject(objValue);
@@ -45500,7 +45500,7 @@ var require_lodash3 = __commonJS({
           return objValue;
         }
         function customOmitClone(value) {
-          return isPlainObject(value) ? undefined2 : value;
+          return isPlainObject2(value) ? undefined2 : value;
         }
         function equalArrays(array, other, bitmask, customizer, equalFunc, stack) {
           var isPartial = bitmask & COMPARE_PARTIAL_FLAG, arrLength = array.length, othLength = other.length;
@@ -47001,7 +47001,7 @@ var require_lodash3 = __commonJS({
         var isBuffer = nativeIsBuffer || stubFalse;
         var isDate = nodeIsDate ? baseUnary(nodeIsDate) : baseIsDate;
         function isElement(value) {
-          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject(value);
+          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject2(value);
         }
         function isEmpty(value) {
           if (value == null) {
@@ -47037,7 +47037,7 @@ var require_lodash3 = __commonJS({
             return false;
           }
           var tag = baseGetTag(value);
-          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject(value);
+          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject2(value);
         }
         function isFinite2(value) {
           return typeof value == "number" && nativeIsFinite(value);
@@ -47088,7 +47088,7 @@ var require_lodash3 = __commonJS({
         function isNumber(value) {
           return typeof value == "number" || isObjectLike(value) && baseGetTag(value) == numberTag;
         }
-        function isPlainObject(value) {
+        function isPlainObject2(value) {
           if (!isObjectLike(value) || baseGetTag(value) != objectTag) {
             return false;
           }
@@ -48154,7 +48154,7 @@ var require_lodash3 = __commonJS({
         lodash.isNumber = isNumber;
         lodash.isObject = isObject2;
         lodash.isObjectLike = isObjectLike;
-        lodash.isPlainObject = isPlainObject;
+        lodash.isPlainObject = isPlainObject2;
         lodash.isRegExp = isRegExp;
         lodash.isSafeInteger = isSafeInteger;
         lodash.isSet = isSet;
@@ -50511,13 +50511,20 @@ var BindingOutputSchema = z3.object({
   target: z3.string(),
   template: z3.string().optional(),
   inline_template: z3.string().optional(),
+  source: z3.string().optional(),
   mode: z3.enum(["write", "patch"]).default("write"),
+  format: z3.enum(["json", "yaml", "text"]).optional(),
+  patch_strategy: z3.enum(["deep_merge", "append"]).optional(),
+  array_merge_key: z3.string().optional(),
   group_by: z3.string().optional(),
   executable: z3.boolean().optional(),
   skip_empty: z3.boolean().optional()
 }).passthrough().refine(
-  (data) => !(data.template && data.inline_template),
-  { message: "template and inline_template are mutually exclusive" }
+  (data) => {
+    const count = [data.template, data.inline_template, data.source].filter(Boolean).length;
+    return count === 1 || count === 0;
+  },
+  { message: "Only one of template, inline_template, or source may be specified" }
 );
 var ReportingSchema = z3.object({
   commands: z3.record(z3.string(), z3.string()),
@@ -53129,8 +53136,52 @@ function buildGlobalContext(dsl) {
     guardrail_policies: dsl.guardrail_policies
   };
 }
-function buildSystemContext(dsl) {
-  return { system: dsl.system, dsl };
+function buildSystemContext(dsl, options) {
+  const ctx = { system: dsl.system, dsl };
+  if (options?.loadedBindings && options.loadedBindings.length > 0) {
+    ctx.bindings = options.loadedBindings.map((lb) => lb.binding);
+    const policyName = options.activeGuardrailPolicy;
+    const policy = policyName ? dsl.guardrail_policies[policyName] : void 0;
+    if (policy) {
+      ctx.guardrailEnforcement = buildGuardrailEnforcement(dsl, policy, options.loadedBindings);
+    }
+  }
+  return ctx;
+}
+function buildGuardrailEnforcement(dsl, policy, loadedBindings) {
+  const entries = [];
+  const bindingTriggers = /* @__PURE__ */ new Map();
+  for (const lb of loadedBindings) {
+    const impl = lb.binding.guardrail_impl ?? {};
+    for (const [guardrailId, gi] of Object.entries(impl)) {
+      for (const check of gi.checks) {
+        if (check.matcher) {
+          bindingTriggers.set(guardrailId, check.matcher.type);
+        }
+      }
+    }
+  }
+  for (const rule of policy.rules) {
+    const guardrail = dsl.guardrails[rule.guardrail];
+    if (!guardrail) continue;
+    const scope = guardrail.scope ?? {};
+    entries.push({
+      guardrail_id: rule.guardrail,
+      description: guardrail.description,
+      severity: rule.severity,
+      action: rule.action,
+      scoped_agents: scope.agents ?? [],
+      scoped_tasks: scope.tasks ?? [],
+      scoped_workflows: scope.workflows ?? [],
+      scoped_tools: scope.tools ?? [],
+      scoped_artifacts: scope.artifacts ?? [],
+      allow_override: rule.allow_override,
+      override_requires: rule.override_requires ?? [],
+      trigger: bindingTriggers.get(rule.guardrail) ?? null,
+      escalation: rule.escalation ? { target: rule.escalation.target, condition: rule.escalation.condition } : null
+    });
+  }
+  return entries;
 }
 function buildTaskContext(dsl, taskId) {
   const taskDef = dsl.tasks[taskId];
@@ -54185,6 +54236,50 @@ Handlebars.registerHelper(
     return generateOverviewFlowchart(dsl);
   }
 );
+Handlebars.registerHelper(
+  "guardrailCoverageMatrix",
+  function() {
+    const enforcement = this["guardrailEnforcement"];
+    if (!enforcement || enforcement.length === 0) return "";
+    const header = "| Guardrail | Severity | Action | Agents | Tasks | Workflows | Tools | Artifacts | Trigger | Override | Escalation |";
+    const divider = "|-----------|----------|--------|--------|-------|-----------|-------|-----------|---------|----------|------------|";
+    const rows = enforcement.map((e3) => {
+      const agents = e3["scoped_agents"]?.join(", ") || "\u2014";
+      const tasks = e3["scoped_tasks"]?.join(", ") || "\u2014";
+      const workflows = e3["scoped_workflows"]?.join(", ") || "\u2014";
+      const tools = e3["scoped_tools"]?.join(", ") || "\u2014";
+      const artifacts = e3["scoped_artifacts"]?.join(", ") || "\u2014";
+      const trigger = e3["trigger"] || "\u2014";
+      const override = e3["allow_override"] ? "yes" : "no";
+      const esc = e3["escalation"];
+      const escalation = esc ? esc["target"] : "\u2014";
+      return `| ${e3["guardrail_id"]} | ${e3["severity"]} | ${e3["action"]} | ${agents} | ${tasks} | ${workflows} | ${tools} | ${artifacts} | ${trigger} | ${override} | ${escalation} |`;
+    });
+    return [header, divider, ...rows].join("\n");
+  }
+);
+Handlebars.registerHelper(
+  "taskGuardrailMatrix",
+  function() {
+    const dsl = this["dsl"];
+    const enforcement = this["guardrailEnforcement"];
+    if (!dsl || !enforcement || enforcement.length === 0) return "";
+    const taskIds = Object.keys(dsl.tasks);
+    if (taskIds.length === 0) return "";
+    const guardrailIds = enforcement.map((e3) => e3["guardrail_id"]);
+    const header = `| Task | ${guardrailIds.join(" | ")} |`;
+    const divider = `|------|${guardrailIds.map(() => "------").join("|")}|`;
+    const rows = taskIds.map((taskId) => {
+      const cells = enforcement.map((e3) => {
+        const scopedTasks = e3["scoped_tasks"];
+        if (scopedTasks.length > 0 && !scopedTasks.includes(taskId)) return "n/a";
+        return e3["action"];
+      });
+      return `| ${taskId} | ${cells.join(" | ")} |`;
+    });
+    return [header, divider, ...rows].join("\n");
+  }
+);
 function getDslSection(dsl, context) {
   const sectionMap = {
     agent: dsl.agents,
@@ -54249,13 +54344,13 @@ async function removeIfExists(filePath) {
   } catch {
   }
 }
-async function renderFromConfig(dsl, renderTargets) {
+async function renderFromConfig(dsl, renderTargets, options) {
   const outputFiles = [];
   for (const target of renderTargets) {
     const templateContent = await loadTemplate(target.template);
     const compiled = Handlebars.compile(templateContent, { noEscape: false });
     if (target.context === "system") {
-      const ctx = buildSystemContext(dsl);
+      const ctx = buildSystemContext(dsl, options);
       const output = compiled(ctx);
       if (target.skip_empty && isEffectivelyEmpty(output)) {
         await removeIfExists(target.output);
@@ -54304,13 +54399,13 @@ function checkExpectedVsExisting(expected, outputPath, skipEmpty, diffs) {
     diffs.push(outputPath);
   });
 }
-async function checkDriftFromConfig(dsl, renderTargets) {
+async function checkDriftFromConfig(dsl, renderTargets, options) {
   const diffs = [];
   for (const target of renderTargets) {
     const templateContent = await loadTemplate(target.template);
     const compiled = Handlebars.compile(templateContent, { noEscape: false });
     if (target.context === "system") {
-      const ctx = buildSystemContext(dsl);
+      const ctx = buildSystemContext(dsl, options);
       const expected = compiled(ctx);
       await checkExpectedVsExisting(expected, target.output, target.skip_empty, diffs);
     } else {
@@ -54873,9 +54968,10 @@ function score(dsl) {
 }
 
 // src/guardrail-generator/generator.ts
-import { readFile as readFile5, writeFile as writeFile2, mkdir as mkdir2, chmod, unlink as unlink2 } from "fs/promises";
+import { readFile as readFile5, writeFile as writeFile2, mkdir as mkdir2, chmod, unlink as unlink2, copyFile } from "fs/promises";
 import { resolve as resolve6, dirname as dirname6 } from "path";
 import Handlebars2 from "handlebars";
+import YAML from "yaml";
 
 // src/guardrail-generator/resolve-checks.ts
 function resolveChecks(dsl, binding, policy) {
@@ -54947,6 +55043,81 @@ Handlebars2.registerHelper(
     return new Handlebars2.SafeString(result);
   }
 );
+function isPlainObject(val) {
+  return typeof val === "object" && val !== null && !Array.isArray(val);
+}
+function deepMergeArrays(existing, incoming, mergeKey) {
+  if (!mergeKey) return [...existing, ...incoming];
+  const merged = [...existing];
+  for (const item of incoming) {
+    if (isPlainObject(item) && mergeKey in item) {
+      const idx = merged.findIndex(
+        (e3) => isPlainObject(e3) && e3[mergeKey] === item[mergeKey]
+      );
+      if (idx >= 0) {
+        merged[idx] = item;
+      } else {
+        merged.push(item);
+      }
+    } else {
+      merged.push(item);
+    }
+  }
+  return merged;
+}
+function deepMerge(existing, incoming, arrayMergeKey) {
+  if (Array.isArray(existing) && Array.isArray(incoming)) {
+    return deepMergeArrays(existing, incoming, arrayMergeKey);
+  }
+  if (isPlainObject(existing) && isPlainObject(incoming)) {
+    const result = { ...existing };
+    for (const [key, val] of Object.entries(incoming)) {
+      result[key] = key in result ? deepMerge(result[key], val, arrayMergeKey) : val;
+    }
+    return result;
+  }
+  return incoming;
+}
+function parseContent(raw, format2) {
+  if (format2 === "json") return JSON.parse(raw);
+  if (format2 === "yaml") return YAML.parse(raw);
+  throw new Error(`Unsupported format for patch parsing: ${format2}`);
+}
+function serializeContent(data, format2) {
+  if (format2 === "json") return JSON.stringify(data, null, 2) + "\n";
+  if (format2 === "yaml") return YAML.stringify(data);
+  throw new Error(`Unsupported format for patch serialization: ${format2}`);
+}
+async function applyPatch(targetPath, patchContent, outputDef) {
+  const format2 = outputDef.format ?? "json";
+  if (format2 === "text") {
+    let existing = "";
+    try {
+      existing = await readFile5(targetPath, "utf8");
+    } catch {
+    }
+    return existing + patchContent;
+  }
+  const patchData = parseContent(patchContent, format2);
+  let existingData;
+  try {
+    const existingRaw = await readFile5(targetPath, "utf8");
+    existingData = parseContent(existingRaw, format2);
+  } catch {
+    return serializeContent(patchData, format2);
+  }
+  const strategy = outputDef.patch_strategy ?? "deep_merge";
+  if (strategy === "append" && Array.isArray(existingData)) {
+    const merged2 = deepMergeArrays(
+      existingData,
+      Array.isArray(patchData) ? patchData : [patchData],
+      outputDef.array_merge_key
+    );
+    return serializeContent(merged2, format2);
+  }
+  const merged = deepMerge(existingData, patchData, outputDef.array_merge_key);
+  return serializeContent(merged, format2);
+}
 async function generateGuardrails(options) {
   const { dsl, config, loadedBindings, filterBindings, dryRun } = options;
   const outputFiles = [];
@@ -55016,6 +55187,31 @@ async function generateGuardrails(options) {
         continue;
       }
       const targetPath = resolve6(config.configDir, pathResult.resolved);
+      if (outputDef.source) {
+        const sourcePath = resolve6(config.configDir, outputDef.source);
+        if (!dryRun) {
+          try {
+            await mkdir2(dirname6(targetPath), { recursive: true });
+            await copyFile(sourcePath, targetPath);
+            if (outputDef.executable) {
+              await chmod(targetPath, 493);
+            }
+          } catch (err) {
+            const code = err.code;
+            if (code === "ENOENT") {
+              diagnostics.push({
+                path: `binding.${binding.software}.outputs.${outputId}`,
+                message: `Source file not found: ${sourcePath}`,
+                severity: "error"
+              });
+              continue;
+            }
+            throw err;
+          }
+        }
+        outputFiles.push(targetPath);
+        continue;
+      }
       let templateContent;
       if (outputDef.inline_template) {
         templateContent = outputDef.inline_template;
@@ -55042,12 +55238,13 @@ async function generateGuardrails(options) {
       } else {
         diagnostics.push({
           path: `binding.${binding.software}.outputs.${outputId}`,
-          message: "Output has neither template nor inline_template",
+          message: "Output has neither template, inline_template, nor source",
           severity: "error"
         });
         continue;
       }
       const shouldSkipEmpty = outputDef.skip_empty === true;
+      const isPatch = outputDef.mode === "patch";
       if (outputDef.group_by) {
         const groupField = outputDef.group_by;
         const groups = /* @__PURE__ */ new Map();
@@ -55065,9 +55262,9 @@ async function generateGuardrails(options) {
             current_group: groupKey
           };
           const compiled = Handlebars2.compile(templateContent, { noEscape: true });
-          const output = compiled(groupCtx);
+          const rendered = compiled(groupCtx);
           const groupTarget = resolve6(targetPath, groupKey);
-          if (shouldSkipEmpty && output.trim().length === 0) {
+          if (shouldSkipEmpty && rendered.trim().length === 0) {
             if (!dryRun) {
               try {
                 await unlink2(groupTarget);
@@ -55076,6 +55273,7 @@ async function generateGuardrails(options) {
             }
             continue;
           }
+          const output = isPatch && !dryRun ? await applyPatch(groupTarget, rendered, outputDef) : rendered;
           if (!dryRun) {
             await mkdir2(dirname6(groupTarget), { recursive: true });
             await writeFile2(groupTarget, output, "utf8");
@@ -55087,8 +55285,8 @@ async function generateGuardrails(options) {
         }
       } else {
         const compiled = Handlebars2.compile(templateContent, { noEscape: true });
-        const output = compiled(ctx);
-        if (shouldSkipEmpty && output.trim().length === 0) {
+        const rendered = compiled(ctx);
+        if (shouldSkipEmpty && rendered.trim().length === 0) {
           if (!dryRun) {
             try {
               await unlink2(targetPath);
@@ -55096,6 +55294,7 @@ async function generateGuardrails(options) {
             }
           }
         } else {
+          const output = isPatch && !dryRun ? await applyPatch(targetPath, rendered, outputDef) : rendered;
           if (!dryRun) {
             await mkdir2(dirname6(targetPath), { recursive: true });
             await writeFile2(targetPath, output, "utf8");