# Development and publication
This repository is an independent Rust package with a registry dependency on
`xlsxcraft`. Before its first publication, copy `.cargo/config.example.toml`
to ignored `.cargo/config.toml` for a sibling development checkout. A local
patch does not satisfy the registry requirement for a published package.
## Project ownership and contribution status
Copyright holder: ALGFORCE INC. Public licensing contact:
[founders@exceldashboard.ai](mailto:founders@exceldashboard.ai). The source package uses `AGPL-3.0-only`.
The separate-commercial-licensing notice does not grant an automatic exception.
External code PRs are currently not accepted; issues are welcome.
Before publishing, confirm that the release's code and XML templates are owned
or appropriately authorized, and retain third-party notices. In particular,
neither the copyright statement nor a commercial agreement replaces dependencies'
own licenses. Review [LICENSING.md](LICENSING.md), [PROVENANCE.md](PROVENANCE.md)
and [THIRD_PARTY.md](THIRD_PARTY.md).
## Checks and license inventory
```bash
cargo fmt --all -- --check
cargo test
cargo check --examples
cargo run --example basic
cargo run --example chart
cargo doc --no-deps
cargo run --example license_inventory -- --check-package
cargo package --list
```
The inventory command captures the current resolved dependencies, available
notice files and `Cargo.lock` under ignored `target/license-inventory/`.
Review missing notice files and SPDX alternatives; retain the generated inventory
with the release records. For a target-specific inventory, pass
`--target <Rust-target-triple>` to the tool. A metadata graph can contain build,
test and platform-only dependencies; review the actual distributed contents too.
`Cargo.lock`, `target/` and `.cargo/config.toml` remain ignored development
artifacts in this source repository. Published consumers resolve their own versions.
The inventory utility does not produce the corresponding dependency source.
Confirm the package includes `LICENSE`, `LICENSING.md`, `PROVENANCE.md`,
`CONTRIBUTING.md`, `THIRD_PARTY.md`, `licenses/MPL-2.0.txt`, the inventory
utility, examples, agent guides and all referenced XML templates. The utility's
`--check-package` option checks the core licensing-file list and excludes local
Cargo configuration/build output; it allows dirty files only for the read-only
package listing so proposed changes can be reviewed before committing.
## Repository and first publication
The public source repository is [AlgForce/docxcraft](https://github.com/AlgForce/docxcraft); the default
branch is `main`. Keep the Git remote and `package.repository` metadata aligned
with that address. Source publication on GitHub and package publication on
crates.io are separate actions; update registry status only after a real upload.
The required `xlsxcraft` version must already be available on crates.io before
this package can be verified/published without the local source override.
CI resolves the published XLSX dependency from crates.io and verifies the
complete standalone source package. Keep local path overrides out of release
verification, and run `cargo publish --dry-run` before each upload.
After reviewing and committing the intended release, configure an authorized
crates.io account with `cargo login` and run:
```bash
cargo publish --dry-run
cargo publish
```
Never commit an authentication token. These publication commands are explicit
maintainer actions; local Git initialization or documentation changes do not
publish anything. Once publication succeeds, update the README status and
CHANGELOG with the real version/date and keep the release tag/source accessible.
## If distributing compiled products
This is separate from publishing the source crate. Retain required dependency
notices and provide the required corresponding source/access for the exact
release. In particular, MPL components need their covered-source location, and
the AGPL route has its own corresponding-source and applicable network-use
requirements. The notice inventory alone does not satisfy source delivery.
Commercial rights for owned code do not remove third-party conditions. For
PPTX/DOCX proprietary integration, cover the `xlsxcraft` dependency in the
authorization scope as well. Review the actual product and any separately
modified dependency sources before distributing it.