docxdriver 0.3.3__tar.gz → 0.4.1__tar.gz

{docxdriver-0.3.3 → docxdriver-0.4.1}/Cargo.lock

@@ -416,7 +416,7 @@ dependencies = [
 
 [[package]]
 name = "docxdriver-cli"
-version = "0.3.3"
+version = "0.4.1"
 dependencies = [
  "clap",
  "docxdriver-core",
@@ -427,10 +427,11 @@ dependencies = [
 
 [[package]]
 name = "docxdriver-core"
-version = "0.3.3"
+version = "0.4.1"
 dependencies = [
  "hex",
  "latex2mathml",
+ "quick-xml",
  "regex-lite",
  "schemars 0.8.22",
  "serde",
@@ -444,7 +445,7 @@ dependencies = [
 
 [[package]]
 name = "docxdriver-mcp"
-version = "0.3.3"
+version = "0.4.1"
 dependencies = [
  "axum",
  "cap-std",
@@ -460,18 +461,26 @@ dependencies = [
  "tokio-util",
 ]
 
+[[package]]
+name = "docxdriver-monty-repl"
+version = "0.4.1"
+dependencies = [
+ "docxdriver-core",
+]
+
 [[package]]
 name = "docxdriver-python"
-version = "0.3.3"
+version = "0.4.1"
 dependencies = [
  "docxdriver-core",
  "pyo3",
+ "serde",
  "serde_json",
 ]
 
 [[package]]
 name = "docxdriver-wasm"
-version = "0.3.3"
+version = "0.4.1"
 dependencies = [
  "docxdriver-core",
  "js-sys",
@@ -1180,6 +1189,15 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "quick-xml"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.46"

{docxdriver-0.3.3 → docxdriver-0.4.1}/Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/docxdriver-python"]
 
 [workspace.package]
-version = "0.3.3"
+version = "0.4.1"
 edition = "2021"
 license = "MIT"
 repository = "https://github.com/jhnoel/docxdriver"

{docxdriver-0.3.3 → docxdriver-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: docxdriver
-Version: 0.3.3
+Version: 0.4.1
 Summary: Python SDK for the native Rust DOCX engine
 License-Expression: MIT
 Requires-Python: >=3.10
@@ -18,38 +18,44 @@ Install from PyPI:
 python -m pip install docxdriver
 ```
 
-The core API exposes `execute_request`, `canonical_plan_json`, and the convenience
-functions `run_command`, `run_plan`, and `run_request`. Results preserve document
-contents as Python `bytes`.
-
-The optional sandbox REPL harness is available as a subpackage in the same
-distribution:
+`Document` works on `.docx` bytes; typed plan builders live in
+`docxdriver.plan`:
 
 ```python
-from docxdriver.repl import NativeBridge, PRELUDE, REFERENCE
+from pathlib import Path
+from docxdriver import Document, create
+from docxdriver.plan import Plan, ReplaceText
+
+doc = Document(Path("contract.docx").read_bytes())
+doc.markup()                      # body with the ids plans address
+doc.comments(); doc.revisions(); doc.styles(); doc.assets()
+doc.find("thirty")
+review = doc.review(Plan(author="Reviewer", ops=[
+    ReplaceText(at="0F537164", select="thirty", with_="sixty"),
+]))
+review.report                     # preview: each op's outcome
+Path("contract.docx").write_bytes(doc.commit(review.key).data)
+
+new = create(paragraphs=["Hello"])  # or create(html="<p>Hello</p>")
 ```
 
-`NativeBridge` provides async `init`, `call`, and `reset` requests for a host
-running a Python sandbox. The sandbox receives authoring classes and async
-wrappers from `PRELUDE`; `REFERENCE` provides their API documentation. The
-sandbox itself does not import the native extension. Native work runs through
-host callbacks outside the server event loop.
-
-The host confines reads and writes to the provided workspace, verifies source
-hashes and candidate output before commit, and performs atomic file replacement
-with read-back verification. Commit keys are bounded and single-use. Cancellation
-is drained before another host call so a write callback cannot be abandoned.
+Commit keys are single-use. Natively `review.key` carries the key; in a
+sandbox it is `None` and the host shows the key only to the model, so a
+commit proves the review was read. Sandbox hosts written in Python build on
+the stateless `review_plan(data, plan_json)` and
+`commit_plan(data, plan_json, key)`, keeping each plan under a key they issue.
 
-Set `DOCXDRIVER_QUOTE_AUDIT_COMMENTS=1` to enable structured Quote/Term/Inline plan
-values and protected quotation audit comments. The provenance policy defaults to
-`permissive`; `controlled` and `authoritative` fail closed.
+Engine diagnostics raise `ValueError`. The lower-level `execute_request`,
+`canonical_plan_json`, `run_command`, `run_plan` and `run_request` remain.
 
-The prelude and API reference are generated from shared Pi templates. After
-changing those templates, regenerate them from the repository root:
+`plan.py` and `document.py` stay within Monty's Python subset. Rust hosts get
+the same text as `docxdriver_monty_repl::PLAN` and `DOCUMENT`, so sandbox code
+and native code are interchangeable. The op dataclasses are generated from the
+core schema; regenerate from the repository root with
+`python scripts/generate-python-plan.py`.
 
-```sh
-python scripts/generate-docxdriver-repl-prelude.py
-```
+Version 0.4.0 removed the `docxdriver.repl` sandbox host from this package. Its
+source remains in `experimental/python-repl-host` for hosts to vendor.
 
 Build and install a wheel from the repository root:
 

docxdriver-0.4.1/README.md

@@ -0,0 +1,87 @@
+# docxdriver
+
+Python SDK for the Rust DOCX engine. It supports Python 3.10 and later and has no
+Python runtime dependencies.
+
+Install from PyPI:
+
+```sh
+python -m pip install docxdriver
+```
+
+`Document` works on `.docx` bytes; typed plan builders live in
+`docxdriver.plan`:
+
+```python
+from pathlib import Path
+from docxdriver import Document, create
+from docxdriver.plan import Plan, ReplaceText
+
+doc = Document(Path("contract.docx").read_bytes())
+doc.markup()                      # body with the ids plans address
+doc.comments(); doc.revisions(); doc.styles(); doc.assets()
+doc.find("thirty")
+review = doc.review(Plan(author="Reviewer", ops=[
+    ReplaceText(at="0F537164", select="thirty", with_="sixty"),
+]))
+review.report                     # preview: each op's outcome
+Path("contract.docx").write_bytes(doc.commit(review.key).data)
+
+new = create(paragraphs=["Hello"])  # or create(html="<p>Hello</p>")
+```
+
+Commit keys are single-use. Natively `review.key` carries the key; in a
+sandbox it is `None` and the host shows the key only to the model, so a
+commit proves the review was read. Sandbox hosts written in Python build on
+the stateless `review_plan(data, plan_json)` and
+`commit_plan(data, plan_json, key)`, keeping each plan under a key they issue.
+
+Engine diagnostics raise `ValueError`. The lower-level `execute_request`,
+`canonical_plan_json`, `run_command`, `run_plan` and `run_request` remain.
+
+`plan.py` and `document.py` stay within Monty's Python subset. Rust hosts get
+the same text as `docxdriver_monty_repl::PLAN` and `DOCUMENT`, so sandbox code
+and native code are interchangeable. The op dataclasses are generated from the
+core schema; regenerate from the repository root with
+`python scripts/generate-python-plan.py`.
+
+Version 0.4.0 removed the `docxdriver.repl` sandbox host from this package. Its
+source remains in `experimental/python-repl-host` for hosts to vendor.
+
+Build and install a wheel from the repository root:
+
+```sh
+python -m pip install "maturin>=1.9,<2"
+maturin build --profile python --locked --manifest-path crates/docxdriver-python/Cargo.toml --out /tmp/docxdriver-wheels
+python -m pip install /tmp/docxdriver-wheels/*.whl
+```
+
+## Publish to PyPI
+
+The `Publish Python SDK` GitHub Actions workflow builds a source distribution
+and wheels for Linux x86_64 and aarch64, macOS universal2, and Windows x86_64
+when a `v*` tag is pushed. The tag must match the version in the root
+`Cargo.toml` workspace package.
+
+Before the first release, configure a PyPI trusted publisher for the
+`docxdriver` project with these values:
+
+- Owner: `jhnoel`
+- Repository: `docxdriver`
+- Workflow filename: `pypi.yml`
+- GitHub environment: `pypi`
+
+Create the `pypi` GitHub environment under the repository settings if you want
+to add release approvals. Then update the workspace version, commit the change,
+and push the matching tag (for example, `v0.2.7`). GitHub Actions publishes the
+built distributions using PyPI's trusted publishing; no long-lived PyPI token is
+needed.
+
+The `python` Cargo profile keeps release optimizations and enables panic unwinding
+so PyO3 can turn Rust panics into Python exceptions. ABI3 wheels support Python
+3.10 and later on the built operating system and architecture. To run the Python
+SDK and host tests after installing the wheel:
+
+```sh
+python -m unittest discover -s crates/docxdriver-python/tests
+```

{docxdriver-0.3.3 → docxdriver-0.4.1}/crates/docxdriver-core/Cargo.toml

@@ -4,7 +4,13 @@ description = "Artifact-first DOCX engine: (bytes, DocxCommand JSON) -> (bytes,
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+repository.workspace = true
 readme = "README.md"
+keywords = ["docx", "ooxml", "word", "document", "track-changes"]
+categories = ["text-processing", "parser-implementations"]
+# Library sources and the runtime template only; tests, examples and the
+# schema generator stay in the repository.
+include = ["/src/**/*.rs", "!/src/bin/**", "/assets/blank.docx", "/README.md", "/LICENSE"]
 
 [dependencies]
 xmloxide = { version = "0.4.3", default-features = false }
@@ -18,5 +24,6 @@ sha2 = "0.10"
 hex = "0.4"
 toml = "0.8"
 schemars = "0.8"
+quick-xml = "0.42.0"
 
 [dev-dependencies]

docxdriver-0.4.1/crates/docxdriver-core/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 docxdriver contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{docxdriver-0.3.3 → docxdriver-0.4.1}/crates/docxdriver-core/src/api.rs

@@ -1957,7 +1957,22 @@ fn fold_typed(
         crate::outcome::Outcome::ok("plan applied", serde_json::json!({})),
         &ctx,
     );
-    (report, out.bytes, None)
+    if out.status != crate::outcome::Status::Ok {
+        return (
+            report.clone(),
+            None,
+            Some((diag("package_write", out.summary, None), report)),
+        );
+    }
+    // Review and commit apply the same gate to the same bytes, so a plan
+    // that reviews clean commits clean.
+    if let Some(bytes) = &out.bytes {
+        if let Err(failure) = crate::integrity::gate(input, bytes) {
+            let diagnostic = diag("integrity_regression", failure.summary(), None);
+            return (report.clone(), None, Some((diagnostic, report)));
+        }
+    }
+    (report, if commit { out.bytes } else { None }, None)
 }
 /// When a selector matched nothing but matches the same paragraph as it was
 /// before the plan, name the earlier operations that changed that text:

{docxdriver-0.3.3 → docxdriver-0.4.1}/crates/docxdriver-core/src/commands/comments.rs

@@ -28,7 +28,6 @@ const EXTENDED_PART: &str = "word/commentsExtended.xml";
 const IDS_PART: &str = "word/commentsIds.xml";
 const EXTENSIBLE_PART: &str = "word/commentsExtensible.xml";
 const CONTENT_TYPES_PART: &str = "[Content_Types].xml";
-const DOCUMENT_RELS_PART: &str = "word/_rels/document.xml.rels";
 
 const W15_NS: &str = "http://schemas.microsoft.com/office/word/2012/wordml";
 const W14_NS: &str = "http://schemas.microsoft.com/office/word/2010/wordml";
@@ -104,15 +103,18 @@ fn register_part(
         }
     }
 
-    // word/_rels/document.xml.rels relationship
-    let mut rels = parse_part(package, DOCUMENT_RELS_PART, "")?;
+    // The main document part's relationship.
+    let rels_part = super::document_rels_part(package);
+    let mut rels = parse_part(package, &rels_part, "")?;
     let root = rels
         .doc
         .root_element()
         .ok_or_else(|| Outcome::error("malformed document.xml.rels"))?;
     let target = part.strip_prefix("word/").unwrap_or(part);
     let exists = rels.doc.children(root).any(|child| {
-        rels.is_local(child, "Relationship") && rels.doc.attribute(child, "Target") == Some(target)
+        rels.is_local(child, "Relationship")
+            && rels.doc.attribute(child, "Target") == Some(target)
+            && rels.doc.attribute(child, "Type") == Some(rel_type)
     });
     if !exists {
         let mut max_rid = 0u64;
@@ -132,7 +134,7 @@ fn register_part(
         rels.doc.set_attribute(node, "Type", rel_type);
         rels.doc.set_attribute(node, "Target", target);
         rels.doc.append_child(root, node);
-        package.set(DOCUMENT_RELS_PART, rels.serialize());
+        package.set(&rels_part, rels.serialize());
     }
     Ok(())
 }
@@ -279,14 +281,35 @@ fn next_para_id(records: &[CommentRecord], extra_occupied: &HashSet<u64>) -> u64
     }
 }
 
-fn document_para_ids(xml: &DocxXml) -> HashSet<u64> {
-    xml.all_paragraphs()
+/// Paragraph ids in use: the in-memory document's (it may carry repaired or
+/// new ids not yet written) and every `paraId` attribute in any XML part —
+/// other comment paragraphs, headers, footers and notes. A paragraph id
+/// names one paragraph across the whole document.
+fn occupied_para_ids(package: &Package, xml: &DocxXml) -> HashSet<u64> {
+    static PARA_ID: std::sync::OnceLock<regex_lite::Regex> = std::sync::OnceLock::new();
+    let pattern = PARA_ID.get_or_init(|| {
+        regex_lite::Regex::new(r#"paraId(?:Parent)?\s*=\s*["']([0-9A-Fa-f]{8})["']"#).unwrap()
+    });
+    let mut occupied: HashSet<u64> = xml
+        .all_paragraphs()
         .into_iter()
         .filter_map(|node| {
             xml.para_id(node)
                 .and_then(|value| u64::from_str_radix(value, 16).ok())
         })
-        .collect()
+        .collect();
+    for (name, bytes) in package.parts() {
+        if !name.to_ascii_lowercase().ends_with(".xml") {
+            continue;
+        }
+        let text = String::from_utf8_lossy(bytes);
+        occupied.extend(
+            pattern
+                .captures_iter(&text)
+                .filter_map(|c| u64::from_str_radix(&c[1], 16).ok()),
+        );
+    }
+    occupied
 }
 
 /// Deterministic 8-hex durable id (FNV-1a over identifying fields), clamped
@@ -447,7 +470,7 @@ pub(crate) fn anchor_comment_at(
     let comments = parse_part(package, COMMENTS_PART, EMPTY_COMMENTS)?;
     let records = comment_records(&comments);
     let id = next_comment_id(&records);
-    let para_id = format!("{:08X}", next_para_id(&records, &document_para_ids(xml)));
+    let para_id = format!("{:08X}", next_para_id(&records, &occupied_para_ids(package, xml)));
 
     insert_anchor_markers(xml, paragraph, start, end, id)?;
     append_comment_record(package, id, &para_id, None, author, date, text)?;
@@ -736,7 +759,7 @@ pub fn reply_comment_typed(
     let parent_para_id = parent.para_id.clone();
     let parent_id = parent.id.clone();
     let id = next_comment_id(&records);
-    let para_id = format!("{:08X}", next_para_id(&records, &document_para_ids(xml)));
+    let para_id = format!("{:08X}", next_para_id(&records, &occupied_para_ids(package, xml)));
     append_comment_record(
         package,
         id,

{docxdriver-0.3.3 → docxdriver-0.4.1}/crates/docxdriver-core/src/commands/equations.rs

@@ -101,6 +101,7 @@ pub(super) fn replace(
         xml.doc.insert_before(target, holder);
         xml.doc.detach(target);
         xml.doc.append_child(deletion, target);
+        crate::segments::mark_deleted_leaves(xml, target, true);
         let ins_id = xml.next_revision_id();
         xml.doc.set_attribute(holder, "w:id", &ins_id.to_string());
         xml.doc.set_attribute(holder, "w:author", author);
@@ -110,7 +111,7 @@ pub(super) fn replace(
             xml.doc.detach(child);
             xml.doc.insert_before(target, child);
         }
-        xml.doc.remove_node(target);
+        crate::segments::remove_content(xml, target);
         xml.doc.remove_node(holder);
     }
     Ok((
@@ -156,8 +157,9 @@ pub(super) fn delete(
         xml.doc.insert_before(target, deletion);
         xml.doc.detach(target);
         xml.doc.append_child(deletion, target);
+        crate::segments::mark_deleted_leaves(xml, target, true);
     } else {
-        xml.doc.remove_node(target);
+        crate::segments::remove_content(xml, target);
     }
     Ok((
         format!("deleted equation {} in paragraph {at}", index + 1),

{docxdriver-0.3.3 → docxdriver-0.4.1}/crates/docxdriver-core/src/commands/headers.rs

@@ -13,7 +13,6 @@ use crate::package::Package;
 use super::layout::ensure_sect_pr;
 
 const CONTENT_TYPES_PART: &str = "[Content_Types].xml";
-const DOCUMENT_RELS_PART: &str = "word/_rels/document.xml.rels";
 const SETTINGS_CT: &str =
     "application/vnd.openxmlformats-officedocument.wordprocessingml.settings+xml";
 const SETTINGS_REL: &str =
@@ -73,13 +72,18 @@ fn ensure_document_rel(
         "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>",
         "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\"/>",
     );
-    let mut rels = parse_part(package, DOCUMENT_RELS_PART, default)?;
+    let rels_part = super::document_rels_part(package);
+    let mut rels = parse_part(package, &rels_part, default)?;
     let root = rels
         .doc
         .root_element()
         .ok_or_else(|| Outcome::error("malformed document.xml.rels"))?;
+    // Reuse only a relationship of the same type: a header id that names a
+    // footer relationship makes Word refuse the document.
     if let Some(existing) = rels.doc.children(root).find(|&child| {
-        rels.is_local(child, "Relationship") && rels.doc.attribute(child, "Target") == Some(target)
+        rels.is_local(child, "Relationship")
+            && rels.doc.attribute(child, "Target") == Some(target)
+            && rels.doc.attribute(child, "Type") == Some(rel_type)
     }) {
         return Ok(rels
             .doc
@@ -104,7 +108,7 @@ fn ensure_document_rel(
     rels.doc.set_attribute(node, "Type", rel_type);
     rels.doc.set_attribute(node, "Target", target);
     rels.doc.append_child(root, node);
-    package.set(DOCUMENT_RELS_PART, rels.serialize());
+    package.set(&rels_part, rels.serialize());
     Ok(id)
 }
 

{docxdriver-0.3.3 → docxdriver-0.4.1}/crates/docxdriver-core/src/commands/layout.rs

@@ -188,10 +188,13 @@ fn ensure_property_child(
         .iter()
         .position(|name| *name == local)
         .map_or(&[][..], |index| &sequence[index + 1..]);
-    let successor = xml
-        .doc
-        .children(parent)
-        .find(|&child| successors.iter().any(|name| xml.is_w(child, name)));
+    // Office extension elements (w14 text effects and the like) close the
+    // base sequence, before only the trailing revision record.
+    let trailing = sequence.last() == Some(&local);
+    let successor = xml.doc.children(parent).find(|&child| {
+        successors.iter().any(|name| xml.is_w(child, name))
+            || (!trailing && xml.doc.is_element(child) && is_extension(xml, child))
+    });
     if let Some(next) = successor {
         xml.doc.insert_before(next, node);
     } else {
@@ -200,6 +203,13 @@ fn ensure_property_child(
     node
 }
 
+/// An element outside WordprocessingML: an Office extension, or the markup
+/// compatibility wrapper that carries one.
+fn is_extension(xml: &DocxXml, node: NodeId) -> bool {
+    let ns = xml.doc.node_namespace(node);
+    ns.is_some() && ns != Some(crate::document::W_NS)
+}
+
 pub(crate) fn set_child_val(xml: &mut DocxXml, parent: NodeId, local: &str, val: &str) {
     let node = if matches!(local, "pStyle" | "jc") {
         ensure_ppr_child(xml, parent, local)

{docxdriver-0.3.3 → docxdriver-0.4.1}/crates/docxdriver-core/src/commands/mod.rs

@@ -27,6 +27,8 @@ pub struct ExecCtx {
     pub now: String,
 }
 
+const STRICT_W_NS: &str = "http://purl.oclc.org/ooxml/wordprocessingml/main";
+
 /// The parsed working set the operation fold runs over: one unzip + one
 /// document.xml parse per typed plan, however many operations follow.
 pub(crate) struct WorkState {
@@ -62,6 +64,14 @@ impl WorkState {
                 .map_err(|error| Outcome::error(error.to_string()))?;
             DocxXml::parse(bytes).map_err(Outcome::error)?
         };
+        // ISO Strict markup lives in other namespaces: the engine would read
+        // it as empty and write Transitional markup into it.
+        if xml.doc.root_element().and_then(|root| xml.doc.node_namespace(root)) == Some(STRICT_W_NS) {
+            return Err(Outcome::error(
+                "this document is saved as Strict Open XML, which docxdriver does not support; \
+                 save it as a standard Word Document (.docx) and try again",
+            ));
+        }
         let table_positions = table_positions(&xml);
         let table_handles = table_positions.iter().map(|(node, address)| (address.clone(), *node)).collect();
         Ok(WorkState {
@@ -93,6 +103,16 @@ pub(crate) fn table_positions(xml: &DocxXml) -> HashMap<xmloxide::tree::NodeId,
     map
 }
 
+/// The relationships part of the main document part (`word/_rels/document.xml.rels`
+/// for the conventional name; a renamed main part has its own).
+pub(crate) fn document_rels_part(package: &crate::package::Package) -> String {
+    let main = package.document_part_name();
+    match main.rsplit_once('/') {
+        Some((dir, file)) => format!("{dir}/_rels/{file}.rels"),
+        None => format!("_rels/{main}.rels"),
+    }
+}
+
 /// sha256 of the exact input package bytes.
 pub(crate) fn package_sha256(bytes: &[u8]) -> [u8; 32] {
     use sha2::{Digest, Sha256};
@@ -100,14 +120,16 @@ pub(crate) fn package_sha256(bytes: &[u8]) -> [u8; 32] {
 }
 
 /// Attach the serialized package to a successful outcome when something
-/// actually mutated (and dryRun doesn't withhold it). The one zip write.
+/// actually mutated. The one zip write. A dry run builds the bytes too, so
+/// review runs the same integrity gate as commit; callers withhold them.
 ///
 /// Every engine write persists paragraph identity first: existing valid
 /// `w14:paraId` values are untouched, while missing/invalid/duplicate and
 /// engine-created paragraphs receive the same deterministic values inspection
 /// showed — one atomic write of repairs plus content operations.
 pub(crate) fn emit(mut state: WorkState, outcome: Outcome, ctx: &ExecCtx) -> Outcome {
-    if outcome.status != crate::outcome::Status::Ok || !state.mutated || ctx.dry_run {
+    let _ = ctx;
+    if outcome.status != crate::outcome::Status::Ok || !state.mutated {
         return outcome;
     }
     state.flush_lists();

{docxdriver-0.3.3 → docxdriver-0.4.1}/crates/docxdriver-core/src/commands/readonly.rs

@@ -219,7 +219,10 @@ pub fn create(command: &Value, ctx: &ExecCtx) -> Outcome {
         return Outcome::ok(summary, result);
     }
     match package.to_bytes() {
-        Ok(bytes) => Outcome::ok_bytes(summary, result, bytes),
+        Ok(bytes) => match crate::integrity::gate_created(&bytes) {
+            Ok(()) => Outcome::ok_bytes(summary, result, bytes),
+            Err(failure) => Outcome::error(failure.summary()),
+        },
         Err(error) => Outcome::error(error.to_string()),
     }
 }