asciidoc-pubkit 0.6.2 → 0.8.0

data/lib/asciidoc_pubkit/cli.rb

@@ -8,10 +8,13 @@ module AsciidocPubkit
       Commands:
         writing criteria      Print the shared Japanese prose criteria
         writing prompt        Generate a Japanese technical writing prompt
-        review scan FILE       Collect Japanese prose and review candidates
+        review scan FILE       Collect Japanese prose or headings and review candidates
         review score FILE      Score Japanese prose; optionally use a local AI CLI
         review prompt SESSION  Generate an English review prompt with Japanese source excerpts
         review verify SESSION  Compare edited sources with the saved baseline
+        replace check FILE     Report prose-only replacement candidates
+        replace diff FILE      Preview prose replacements as a unified diff
+        replace apply FILE     Validate and apply explicit replacement rules
 
       Options:
         --help                 Show help (also supported for each command)
@@ -19,7 +22,7 @@ module AsciidocPubkit
 
       Use --lang ja with writing commands and review commands. Other review and
       writing languages are not supported yet and return an error.
-      No command edits manuscripts. review score --agent explicitly invokes a
+      Only replace apply edits manuscripts. review score --agent explicitly invokes a
       local Codex or Claude CLI, which may connect to its configured AI service.
     TEXT
 
@@ -29,22 +32,30 @@ module AsciidocPubkit
         out.puts VERSION
         return 0
       end
-      if args.empty? || args == ['--help'] || args == ['-h'] || %w[review writing].any? { |group| args == [group, '--help'] }
+      if args.empty? || args == ['--help'] || args == ['-h'] || %w[review writing replace].any? { |group| args == [group, '--help'] }
         out.puts HELP
         return 0
       end
       group, command = args.shift(2)
       valid = (group == 'review' && %w[scan score prompt verify].include?(command)) ||
-              (group == 'writing' && %w[criteria prompt].include?(command))
+              (group == 'writing' && %w[criteria prompt].include?(command)) ||
+              (group == 'replace' && %w[check diff apply].include?(command))
       raise Error, 'Unknown command. Use --help.' unless valid
       options = { attributes: {} }
       parser = OptionParser.new do |opts|
-        input_name = group == 'writing' ? '' : (%w[scan score].include?(command) ? ' FILE' : ' SESSION')
+        input_name = group == 'writing' ? '' : ((group == 'replace' || %w[scan score].include?(command)) ? ' FILE' : ' SESSION')
         opts.banner = "Usage: asciidoc-pubkit #{group} #{command} [options]#{input_name}"
-        opts.on('-o', '--output PATH', group == 'review' && command == 'scan' ? 'New session directory (default: .pubkit/review)' : 'New output file (default: standard output)') { |v| options[:output] = v }
+        opts.on('-o', '--output PATH', group == 'review' && command == 'scan' ? 'New session directory (default: .pubkit/review for prose, .pubkit/headings for headings)' : 'New output file (default: standard output)') { |v| options[:output] = v }
         opts.on('--lang LANG', 'Language (ja only in this release)') { |v| options[:language] = v }
-        if group == 'review' && %w[scan score].include?(command)
+        if group == 'replace'
+          opts.on('--rules FILE', 'Required prh-format replacement rules (limited compatibility)') { |v| options[:rules] = v }
+          opts.on('--base-dir DIR', 'Set the Asciidoctor base directory') { |v| options[:base_dir] = v }
+          opts.on('--config FILE', 'Use review parsing configuration and exclusions') { |v| options[:config] = v }
+          opts.on('--only FILE', 'Select one included file') { |v| options[:only] = v }
+        elsif group == 'review' && %w[scan score].include?(command)
           if command == 'scan'
+            opts.on('--scope SCOPE', 'prose (default) or headings; separate review sessions') { |v| options[:scope] = v }
+            opts.on('--heading-rules FILE', 'Replace default heading rules with a YAML rule set') { |v| options[:heading_rules] = v }
             opts.on('-y', '--yes', 'Answer yes to replacement confirmation') { options[:yes] = true }
             opts.on('--no-input', 'Never prompt; fail on existing output unless --yes') { options[:no_input] = true }
           else
@@ -83,6 +94,15 @@ module AsciidocPubkit
       end
       raise Error, 'Exactly one input is required. Use --help.' unless args.length == 1
       Language.validate!(options[:language], operation: 'review') if options[:language]
+      if group == 'replace'
+        raise Error, 'replace apply does not accept --output.' if command == 'apply' && options[:output]
+        replacement = Replacement.new(args.first, options)
+        content = command == 'diff' ? replacement.diff : replacement.report
+        replacement.apply if command == 'apply'
+        content += "Applied #{replacement.candidates.length} replacements.\n" if command == 'apply'
+        output(content, options[:output], out)
+        return command == 'check' && !replacement.candidates.empty? ? 1 : 0
+      end
       if command == 'score'
         if options[:output] && (File.exist?(options[:output]) || File.symlink?(options[:output]))
           raise Error, "Output already exists: #{options[:output]}"
@@ -106,7 +126,11 @@ module AsciidocPubkit
             true
           end
         end
-        out.puts "Scanned #{result['paragraphs']} paragraphs; found #{result['findings']} review candidates."
+        if result['scope'] == 'headings'
+          out.puts "Scanned #{result['headings']} headings; found #{result['findings']} review candidates."
+        else
+          out.puts "Scanned #{result['paragraphs']} paragraphs; found #{result['findings']} review candidates."
+        end
         out.puts "Tokenizer: #{result['tokenizer']}#{result['tokenizer'] == 'literal' ? ' (limited phrase matching; no morphological analysis)' : ' (UTF-8 IPADIC)'}"
         out.puts "Coverage notices: #{result['coverage_notices']}. See document.json for limitations."
         out.puts "Review session: #{result['session']}"

data/lib/asciidoc_pubkit/document.rb

@@ -2,16 +2,19 @@
 
 module AsciidocPubkit
   class Document
-    attr_reader :sources, :paragraphs, :coverage, :diagnostics, :structure
+    attr_reader :sources, :paragraphs, :coverage, :diagnostics, :structure, :headings, :outline, :scope
 
     def initialize(entry, settings, only: nil)
       @entry = File.realpath(entry)
       @root = File.realpath(settings.fetch('base_dir'))
       @sources = {}
       @paragraphs = []
+      @headings = []
+      @outline = []
       @coverage = []
       @diagnostics = []
       @settings = settings
+      @scope = settings.fetch('scope', 'prose')
       @only = only && File.realpath(only)
       capture(@entry)
       logger = Asciidoctor::MemoryLogger.new
@@ -43,6 +46,23 @@ module AsciidocPubkit
            node.id, (node.title if node.respond_to?(:title?) && node.title?),
            (node.lines if %i[listing literal pass].include?(node.context))]
         end
+        @heading_lines = {}
+        @source_lines.each do |path, lines|
+          lines.each_with_index do |line, offset|
+            match = line.match(/\A(={1,6}[ \t]+)(.*?)([ \t]*)\z/)
+            @heading_lines[[path, offset + 1]] = match if match
+          end
+        end
+        @section_indexes = nodes.each_with_index.to_h
+        nodes.each_with_index { |node, index| collect_heading(node, index) if node.context == :section && node != doc.header }
+        # One physical title reused by includes cannot be edited independently.
+        reused = @headings.group_by { |h| [h['file'], h['line']] }.select { |_, group| group.length > 1 }
+        @headings.reject! do |heading|
+          next false unless reused.key?([heading['file'], heading['line']])
+          @coverage << { 'context' => 'heading', 'file' => heading['file'], 'line' => heading['line'],
+                         'reason' => 'The source title is reused by multiple sections and cannot be edited independently.' }
+          true
+        end
         nodes.each { |node| collect(node) }
       ensure
         Asciidoctor::LoggerManager.logger = previous_logger
@@ -64,11 +84,39 @@ module AsciidocPubkit
     end
 
     def to_h
-      { 'paragraphs' => paragraphs, 'coverage' => coverage, 'structure' => structure }
+      { 'paragraphs' => paragraphs, 'headings' => headings, 'outline' => outline, 'coverage' => coverage, 'structure' => structure }
     end
 
     private
 
+    # Only ATX section titles that match original source text are editable.
+    # Converted inline titles, attribute substitutions and old-style titles stay protected.
+    def collect_heading(node, index)
+      parent_index = @section_indexes[node.parent] if node.parent.context == :section
+      @outline << { 'index' => index, 'parent_index' => parent_index,
+                    'level' => node.level, 'section_id' => node.id, 'text' => node.title }
+      return unless @settings.fetch('scope', 'prose') == 'headings'
+      cursor = node.source_location
+      path, line = cursor && [cursor.file, cursor.lineno]
+      match = @heading_lines[[path, line]]
+      unless match && match[2] == node.title
+        @coverage << { 'context' => 'heading', 'file' => path, 'line' => line,
+                       'reason' => 'Source title could not be resolved unambiguously; only plain ATX section titles are editable.', 'text' => node.title }
+        return
+      end
+      relative = Pathname.new(path).relative_path_from(Pathname.new(@root)).to_s
+      return if @only && @only != path
+      if @settings.fetch('exclude').any? { |glob| File.fnmatch?(glob, relative, File::FNM_PATHNAME | File::FNM_DOTMATCH) }
+        @coverage << { 'context' => 'heading', 'file' => path, 'line' => line, 'reason' => 'Excluded by configuration.' }
+        return
+      end
+      @headings << { 'id' => AsciidocPubkit.hash_text([path, line, match[2]].join("\0"))[0, 16],
+                     'index' => index, 'parent_index' => parent_index,
+                     'file' => path, 'line' => line, 'column' => match[1].length + 1,
+                     'prefix' => match[1], 'suffix' => match[3], 'level' => node.level,
+                     'section_id' => node.id, 'text' => match[2] }
+    end
+
     def collect(node)
       if %i[list_item table quote verse listing literal pass].include?(node.context)
         @coverage << { 'context' => node.context.to_s, 'reason' => 'Not reviewed as running prose.' }
@@ -99,16 +147,20 @@ module AsciidocPubkit
         return
       end
       headings = []
+      section_index = nil
       parent = node.parent
       while parent
-        headings.unshift(parent.title) if parent.context == :section && parent.title
+        if parent.context == :section && parent.title
+          headings.unshift(parent.title)
+          section_index ||= @section_indexes[parent]
+        end
         parent = parent.parent
       end
       text = lines.join("\n")
       @paragraphs << {
         'id' => AsciidocPubkit.hash_text([path, line, text].join("\0"))[0, 16],
         'file' => path, 'line' => line, 'end_line' => line + lines.length - 1,
-        'headings' => headings, 'text' => text
+        'section_index' => section_index, 'headings' => headings, 'text' => text
       }
     end
   end

data/lib/asciidoc_pubkit/heading_rules.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module AsciidocPubkit
+  class HeadingRuleSet
+    KEYS = %w[schema_version terms fixed_titles duplicate_siblings style].freeze
+
+    def self.default_path(language)
+      Language.validate!(language, operation: 'review')
+      File.expand_path("../../data/heading-rules.#{language}.yml", __dir__)
+    end
+
+    def self.load(path)
+      validate(YAML.safe_load(AsciidocPubkit.read_text(path), permitted_classes: [], aliases: false))
+    rescue Psych::Exception => e
+      raise Error, "Invalid heading rule YAML in #{path}: #{e.message}"
+    end
+
+    def self.validate(data)
+      RuleSet.mapping(data, KEYS, 'Heading rule set')
+      raise Error, 'Heading rule schema_version must be integer 1.' unless data['schema_version'].is_a?(Integer) && data['schema_version'] == 1
+      raise Error, 'Heading terms must be a mapping.' unless data['terms'].is_a?(Hash)
+      data['terms'].each do |name, entry|
+        raise Error, 'Heading rule names must be nonempty strings.' unless name.is_a?(String) && !name.strip.empty?
+        RuleSet.mapping(entry, %w[terms question], "Heading rule #{name}")
+        RuleSet.strings(entry['terms'], "Heading rule #{name}.terms")
+        unless entry['question'].is_a?(String) && !entry['question'].strip.empty?
+          raise Error, "Heading rule #{name}.question must be a nonempty string."
+        end
+      end
+      RuleSet.strings(data['fixed_titles'], 'Heading fixed_titles')
+      unless [true, false].include?(data['duplicate_siblings'])
+        raise Error, 'Heading duplicate_siblings must be boolean.'
+      end
+      raise Error, 'Heading style must be mixed, nominal, or action.' unless %w[mixed nominal action].include?(data['style'])
+      data
+    end
+  end
+
+  class HeadingRules
+    def self.scan(headings, settings, tokenizer: nil)
+      rules = HeadingRuleSet.validate(settings.fetch('heading_rules'))
+      tokenizer ||= Morphology.new(settings) if settings.fetch('tokenizer', 'mecab') == 'mecab'
+      findings = []
+      duplicates = headings.group_by { |h| [h['parent_index'], h['text']] }
+      # Use the configured analyzer; never silently substitute literal analysis.
+      tokens = tokenizer ? Rules.tokenize_paragraphs(headings, tokenizer) : []
+      headings.each_with_index do |heading, index|
+        next if rules['fixed_titles'].include?(heading['text'])
+        text = Rules.mask(heading['text'])
+        rules['terms'].each do |rule, entry|
+          entry['terms'].each do |term|
+            next if settings['allows'].include?(term)
+            text.to_enum(:scan, Regexp.new(Regexp.escape(term))).each do
+              match = Regexp.last_match
+              add(findings, heading, match.begin(0), term, rule, entry['question'])
+            end
+          end
+        end
+        settings['glossary'].each do |canonical, variants|
+          variants.each do |variant|
+            next if settings['allows'].include?(variant)
+            text.to_enum(:scan, Regexp.new(Regexp.escape(variant))).each do
+              match = Regexp.last_match
+              add(findings, heading, match.begin(0), variant, 'heading-glossary-variant', "Check #{canonical.inspect} against the book's glossary. Preserve official names and identifiers.")
+            end
+          end
+        end
+        if rules['duplicate_siblings'] && duplicates.fetch([heading['parent_index'], heading['text']]).length > 1
+          add(findings, heading, 0, heading['text'], 'heading-duplicate', 'Sibling headings have identical titles. Check whether their subjects can be distinguished; necessary repetition is valid.')
+        end
+        next if rules['style'] == 'mixed' || text.strip.empty?
+        last = tokenizer && tokens[index].last
+        # These are cues for review, not a complete grammatical classifier.
+        action = last ? %w[動詞 助動詞].include?(last['pos']) : !!text.match(/(?:する|します|できる|ない|学ぶ|使う|選ぶ|読む|続ける|分ける|確かめる)\z/)
+        next if (rules['style'] == 'action') == action
+        add(findings, heading, 0, heading['text'], 'heading-style', "Check this heading against the book's #{rules['style']} preference. Preserve questions, principles and justified exceptions; do not change meaning to fit a template.")
+      end
+      findings
+    end
+
+    def self.add(findings, heading, offset, match, rule, question)
+      findings << { 'id' => AsciidocPubkit.hash_text([heading['id'], rule, offset, match].join(':'))[0, 16],
+                    'heading_id' => heading['id'], 'rule' => rule, 'severity' => 'hint',
+                    'file' => heading['file'], 'line' => heading['line'],
+                    'column' => heading['column'] + offset, 'match' => match, 'question' => question }
+    end
+  end
+end

data/lib/asciidoc_pubkit/replacement.rb

@@ -0,0 +1,210 @@
+# frozen_string_literal: true
+
+require 'tmpdir'
+require 'tempfile'
+require 'open3'
+
+module AsciidocPubkit
+  class ReplacementRules
+    def self.load(path)
+      data = YAML.safe_load(AsciidocPubkit.read_text(path), permitted_classes: [], aliases: false)
+      RuleSet.mapping(data, %w[version rules], 'Replacement rules')
+      raise Error, 'Replacement version must be integer 1.' unless data['version'].is_a?(Integer) && data['version'] == 1
+      raise Error, 'rules must be an array.' unless data['rules'].is_a?(Array)
+      data['rules'].each_with_index.map do |rule, index|
+        unless rule.is_a?(Hash) && (rule.keys - %w[expected pattern patterns specs]).empty? &&
+               rule['expected'].is_a?(String) && (rule.key?('pattern') ^ rule.key?('patterns'))
+          raise Error, "Rule #{index + 1} requires expected and exactly one of pattern or patterns; unsupported keys are rejected."
+        end
+        patterns = rule.key?('pattern') ? [rule['pattern']] : rule['patterns']
+        unless patterns.is_a?(Array) && !patterns.empty? && patterns.all? { |p| p.is_a?(String) && !p.empty? }
+          raise Error, 'Replacement patterns must be nonempty strings.'
+        end
+        compiled = patterns.map do |pattern|
+          if pattern.start_with?('/')
+            match = pattern.match(%r{\A/(.*)/([a-z]*)\z}m)
+            raise Error, 'Regex flags are unsupported; omit flags (all matches are collected).' unless match && match[2].empty?
+            body = match[1]
+            # Deliberately small common JavaScript/Ruby subset; Ruby-only escapes
+            # and engine-specific groups must not silently change JS semantics.
+            if body.match?(/\\[^\\\/.*+?()\[\]{}^$|nrtdDsSwW-]/) || body.match?(/\(\?(?![:=!]|<[=!])/) || body.include?('&&')
+              raise Error, 'Unsupported regex syntax in replacement rule.'
+            end
+            Regexp.new(body.gsub('\\/', '/'), timeout: 0.1)
+          else
+            Regexp.new(Regexp.escape(pattern), timeout: 0.1)
+          end
+        end
+        compiled.each do |regex|
+          regex.match('') # Detect common empty matches; runtime checks cover contextual ones.
+          raise Error, 'Zero-length replacement matches are unsupported.' if regex.match('')
+        end
+        specs = rule.fetch('specs', [])
+        raise Error, 'specs must be an array.' unless specs.is_a?(Array)
+        specs.each do |spec|
+          RuleSet.mapping(spec, %w[from to], 'Replacement spec')
+          raise Error, 'Spec from/to must be strings.' unless spec.values.all? { |v| v.is_a?(String) }
+          result = spec['from'].dup
+          edits = matches(spec['from'], compiled, rule['expected'])
+          reject_overlaps!(edits)
+          edits.reverse_each { |edit| result[edit[:start]...edit[:finish]] = edit[:after] }
+          raise Error, "Replacement spec failed for rule #{index + 1}." unless result == spec['to']
+        end
+        { id: "rule-#{index + 1}", patterns: compiled, expected: rule['expected'] }
+      end
+    rescue RegexpError, Regexp::TimeoutError => e
+      raise Error, "Invalid replacement regex: #{e.message}"
+    end
+
+    def self.expand(template, match)
+      template.gsub(/\$\$|\$[1-9][0-9]?|\$./) do |ref|
+        if ref == '$$'
+          '$'
+        elsif ref.match?(/\A\$[1-9][0-9]?\z/) && ref[1..].to_i < match.length
+          match[ref[1..].to_i] || ''
+        else
+          raise Error, "Unsupported replacement reference: #{ref}"
+        end
+      end
+    end
+
+    def self.matches(text, patterns, expected)
+      patterns.flat_map do |regex|
+        text.to_enum(:scan, regex).map do
+          match = Regexp.last_match
+          raise Error, 'Zero-length replacement matches are unsupported.' if match.begin(0) == match.end(0)
+          { start: match.begin(0), finish: match.end(0), before: match[0], after: expand(expected, match) }
+        end
+      end.reject { |edit| edit[:before] == edit[:after] }.uniq.sort_by { |edit| edit[:start] }
+    rescue Regexp::TimeoutError
+      raise Error, 'Replacement regex timed out.'
+    end
+
+    def self.reject_overlaps!(edits)
+      edits.sort_by { |edit| edit[:start] }.each_cons(2) do |left, right|
+        raise Error, 'Conflicting replacement candidates overlap; revise the rules.' if left[:finish] > right[:start]
+      end
+    end
+  end
+
+  class Replacement
+    attr_reader :candidates
+
+    def initialize(entry, options)
+      raise Error, 'Replacement commands require --rules FILE.' unless options[:rules]
+      raise Error, 'Replacement entry must not be a symlink.' if File.symlink?(entry)
+      @entry = File.realpath(entry)
+      @only = options[:only] && File.realpath(options[:only])
+      @settings = Settings.new(entry, options.merge(replacement: true)).data
+      @document = Document.new(entry, @settings, only: options[:only])
+      raise Error, 'Replacement input has parsing diagnostics.' unless @document.diagnostics.empty?
+      rules = ReplacementRules.load(options[:rules])
+      @candidates = []
+      @document.paragraphs.each do |paragraph|
+        text = paragraph['text']
+        protected_ranges = text.to_enum(:scan, Rules::INLINE).map do
+          match = Regexp.last_match
+          match.begin(0)...match.end(0)
+        end
+        raw = @document.sources.fetch(paragraph['file'])
+        lines = raw.lines
+        line_offsets = [0]
+        lines.each { |line| line_offsets << line_offsets.last + line.length }
+        rules.each do |rule|
+          ReplacementRules.matches(text, rule[:patterns], rule[:expected]).each do |edit|
+            next if protected_ranges.any? { |range| edit[:start] < range.end && edit[:finish] > range.begin }
+            # Keep physical line boundaries intact, including CRLF.
+            raise Error, 'Replacement matches and results must stay on one line.' if (edit[:before] + edit[:after]).match?(/[\r\n]/)
+            prefix = text[0...edit[:start]]
+            line = paragraph['line'] + prefix.count("\n")
+            column = (prefix.rindex("\n") ? prefix.length - prefix.rindex("\n") : prefix.length + 1)
+            start = line_offsets.fetch(line - 1) + column - 1
+            raise Error, 'Replacement source mapping is ambiguous.' unless raw[start, edit[:before].length] == edit[:before]
+            @candidates << edit.merge(start: start, finish: start + edit[:before].length,
+                                     file: paragraph['file'], line: line, column: column, rule: rule[:id])
+          end
+        end
+      end
+      @candidates.uniq!
+      @candidates.sort_by! { |edit| [edit[:file], edit[:start], edit[:rule]] }
+      @candidates.group_by { |edit| edit[:file] }.each_value { |edits| ReplacementRules.reject_overlaps!(edits) }
+      @updated = @document.sources.transform_values(&:dup)
+      @candidates.reverse_each { |edit| @updated[edit[:file]][edit[:start]...edit[:finish]] = edit[:after] }
+      validate unless @candidates.empty?
+    end
+
+    def report
+      candidates.map { |edit| "#{edit[:file]}:#{edit[:line]}:#{edit[:column]}: #{edit[:rule]} #{edit[:before].inspect} -> #{edit[:after].inspect}\n" }.join +
+        "#{candidates.length} replacements; #{@document.coverage.length} coverage notices. Only mapped running prose is eligible.\n"
+    end
+
+    def changed
+      @updated.select { |path, text| text != @document.sources[path] }
+    end
+
+    def diff
+      changed.map do |path, text|
+        Tempfile.create('pubkit-before') do |before|
+          Tempfile.create('pubkit-after') do |after|
+            before.binmode.write(@document.sources[path]); before.flush
+            after.binmode.write(text); after.flush
+            output, error, status = Open3.capture3('diff', '-u', '--label', "#{path} (before)", '--label', "#{path} (after)", before.path, after.path)
+            raise Error, "Cannot generate diff: #{error}" unless [0, 1].include?(status.exitstatus)
+            output
+          end
+        end
+      end.join
+    end
+
+    def validate
+      root = File.realpath(@settings['base_dir'])
+      Dir.mktmpdir('pubkit-replacement-') do |stage|
+        stage = File.realpath(stage)
+        @updated.each do |path, text|
+          destination = File.join(stage, Pathname.new(path).relative_path_from(Pathname.new(root)).to_s)
+          FileUtils.mkdir_p(File.dirname(destination))
+          File.binwrite(destination, text)
+        end
+        staged_entry = File.join(stage, Pathname.new(@entry).relative_path_from(Pathname.new(root)).to_s)
+        staged_only = @only && File.join(stage, Pathname.new(@only).relative_path_from(Pathname.new(root)).to_s)
+        staged = Document.new(staged_entry, @settings.merge('base_dir' => stage), only: staged_only)
+        raise Error, 'Replacement changes parsing or document structure.' unless staged.diagnostics.empty? && staged.structure == @document.structure
+        original = Session.protected_content(@document).transform_keys { |path| Pathname.new(path).relative_path_from(Pathname.new(root)).to_s }
+        result = Session.protected_content(staged).transform_keys { |path| Pathname.new(path).relative_path_from(Pathname.new(stage)).to_s }
+        # --only can leave otherwise eligible paragraphs protected in the original.
+        if original != result
+          raise Error, 'Replacement changes source membership or protected content.'
+        end
+      end
+    end
+
+    def apply
+      installed = []
+      prepared = []
+      begin
+        changed.each do |path, text|
+          file = Tempfile.new('.pubkit-replace-', File.dirname(path))
+          prepared << [path, file]
+          file.binmode.write(text)
+          file.flush
+          file.fsync
+          File.chmod(File.stat(path).mode & 0o777, file.path)
+        end
+        @document.sources.each do |path, raw|
+          unless !File.symlink?(path) && File.binread(path) == raw.b
+            raise Error, "Source changed before replacement: #{path}"
+          end
+        end
+        prepared.each do |path, file|
+          File.rename(file.path, path)
+          installed << path
+        end
+      rescue StandardError
+        installed.reverse_each { |path| File.binwrite(path, @document.sources.fetch(path)) }
+        raise
+      ensure
+        prepared.each { |_, file| file.close! }
+      end
+    end
+  end
+end