@sous-io/sous 0.2.27 → 0.2.29

package/src/lib/repos/namespace-resolver.ts

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { namespaceOfKey } from "../refs/parse.js";
 
 /**
  * Namespace addressability for templates: the reserved `~` include sigil.
@@ -202,7 +203,7 @@ function describeDropped(
   dropped: DroppedRecipe,
   opts: { namespace: string; rest: string }
 ): string[] {
-  const recipe = `${opts.namespace}/${opts.rest.split("/")[0] ?? ""}`;
+  const { recipe } = splitIncludePath(opts.namespace, opts.rest);
   if (dropped.by === "disabled-subscription") {
     return [
       `This project subscribes to "${dropped.subscription}", but that subscription is ` +
@@ -232,14 +233,15 @@ export type StaticNamespaceResolverOptions = {
    */
   recipes: Record<string, string>;
   /**
-   * What each recipe declares, mapping `<namespace>/<recipe>` to the refs it
-   * may address. An entry may be a full ref (`workflow/task-files`) or a bare
-   * namespace (`workflow`, meaning every recipe in it). A recipe with no entry
-   * declares nothing and may address only itself.
+   * What each recipe declares, mapping `<namespace>/<recipe>` to the keys it
+   * may address. An entry is a recipe key (`workflow/task-files`) or a bare
+   * namespace (`workflow`, meaning every recipe in it), already settled from
+   * however the manifest wrote it. A recipe with no entry declares nothing and
+   * may address only itself.
    */
   dependencies?: Record<string, string[]>;
   /**
-   * What the project's own templates may address, in the same ref forms as
+   * What the project's own templates may address, as the same kind of keys as
    * `dependencies`. Omit it to make every known recipe addressable from
    * project templates, which is the rule for a real project: its templates may
    * address everything its lockfile pins.
@@ -293,7 +295,7 @@ export class StaticNamespaceResolver implements NamespaceResolver {
   private knownNamespaces(): string[] {
     const names = new Set<string>();
     for (const ref of Object.keys(this.recipes)) {
-      names.add(ref.split("/")[0]);
+      names.add(namespaceOfKey(ref));
     }
     return [...names].sort();
   }
@@ -301,7 +303,7 @@ export class StaticNamespaceResolver implements NamespaceResolver {
   /** Every known recipe ref inside one namespace, sorted. */
   private recipesIn(namespace: string): string[] {
     return Object.keys(this.recipes)
-      .filter((ref) => ref.split("/")[0] === namespace)
+      .filter((ref) => namespaceOfKey(ref) === namespace)
       .sort();
   }
 
@@ -329,9 +331,7 @@ export class StaticNamespaceResolver implements NamespaceResolver {
   resolve(request: NamespaceRequest): NamespaceResolution {
     const { namespace, rest, fromFile } = request;
 
-    const segments = rest.split("/").filter((segment) => segment.length > 0);
-    const recipeName = segments[0] ?? "";
-    const ref = `${namespace}/${recipeName}`;
+    const { recipe: ref, segments } = splitIncludePath(namespace, rest);
 
     if (!this.knownNamespaces().includes(namespace)) {
       return {
@@ -361,7 +361,7 @@ export class StaticNamespaceResolver implements NamespaceResolver {
       return { kind: "not-a-dependency", recipe: ref, includingRecipe };
     }
 
-    const inner = segments.slice(1).join("/");
+    const inner = segments.join("/");
     const resolved = path.resolve(recipeDir, inner);
 
     // A `~namespace` reference addresses a recipe's own files. Without this the
@@ -370,7 +370,7 @@ export class StaticNamespaceResolver implements NamespaceResolver {
     // segment check catches the written form, and the relative check catches
     // everything else, including an absolute inner path and any symlink-free
     // route out that normalisation would otherwise hide.
-    if (escapesRecipe(recipeDir, segments.slice(1), inner, resolved)) {
+    if (escapesRecipe(recipeDir, segments, inner, resolved)) {
       return { kind: "escapes-recipe", recipe: ref, reference: `${namespace}/${rest}` };
     }
 
@@ -378,6 +378,27 @@ export class StaticNamespaceResolver implements NamespaceResolver {
   }
 }
 
+/**
+ * Takes the part of a `@~namespace/...` include line after the namespace apart:
+ * its first segment names the recipe, and the rest is a file path inside it.
+ * This is an include path, not a ref; it is the one place such a path is split.
+ *
+ * splitIncludePath("workflow", "task-files/_partials/resume.md")
+ * // -> { recipe: "workflow/task-files", segments: ["_partials", "resume.md"] }
+ *
+ * @param namespace - The namespace the include line named.
+ * @param rest - Everything after `~<namespace>/`.
+ */
+function splitIncludePath(
+  namespace: string,
+  rest: string
+): { recipe: string; segments: string[] } {
+  const [recipeName = "", ...segments] = rest
+    .split("/")
+    .filter((segment) => segment.length > 0);
+  return { recipe: `${namespace}/${recipeName}`, segments };
+}
+
 /**
  * Whether an inner path would address something outside the recipe directory.
  *
@@ -401,46 +422,18 @@ function escapesRecipe(
 }
 
 /**
- * Strip the decorations a written reference may carry so it can be compared to
- * a plain `<namespace>/<recipe>` ref: a repository qualifier (a subscription's
- * `sous-public:misc/stuff`, or a manifest's
- * `github://owner/repo/misc/stuff` locator) and a trailing version range
- * (`misc/stuff@^1.2`).
- *
- * @param ref - A reference as written in a manifest or subscription entry.
- * @returns The bare `<namespace>` or `<namespace>/<recipe>` form.
- */
-export function normalizeRef(ref: string): string {
-  const trimmed = ref.trim();
-
-  // A locator URL names the repository first and the recipe last, so the two
-  // trailing segments are the ref; everything before them is where it lives.
-  const scheme = trimmed.indexOf("://");
-  const body =
-    scheme === -1
-      ? trimmed.includes(":")
-        ? trimmed.slice(trimmed.indexOf(":") + 1)
-        : trimmed
-      : trimmed.slice(scheme + 3).split("/").slice(-2).join("/");
-
-  const at = body.lastIndexOf("@");
-  return (at > 0 ? body.slice(0, at) : body).trim();
-}
-
-/**
- * Whether a list of declared refs covers a recipe, either by naming the recipe
- * itself or by naming its whole namespace.
+ * Whether a list of declared keys covers a recipe, either by naming the recipe
+ * itself or by naming its whole namespace. The keys are already settled
+ * (`namespace` or `namespace/recipe`): whatever form a manifest wrote a
+ * dependency in, the lockfile records the key it resolved to.
  *
- * @param declared - Declared refs (dependencies, or the project's subscriptions).
+ * @param declared - Declared keys (dependencies, or the project's subscriptions).
  * @param namespace - The namespace being addressed.
  * @param ref - The fully qualified recipe ref being addressed.
  * @returns True when the reference is in scope.
  */
 function declaresRef(declared: string[], namespace: string, ref: string): boolean {
-  return declared.some((entry) => {
-    const normalized = normalizeRef(entry);
-    return normalized === ref || normalized === namespace;
-  });
+  return declared.some((entry) => entry === ref || entry === namespace);
 }
 
 /**

package/src/lib/repos/providers/base.ts

@@ -37,6 +37,8 @@ import type {
   ProviderId,
   ProviderOptions,
   RepoProvider,
+  LocationReading,
+  WrittenLocation,
 } from "./provider.js";
 
 /**
@@ -68,6 +70,34 @@ export abstract class ProviderBase implements RepoProvider {
     options?: ProviderOptions
   ): Promise<void>;
 
+  // --- Reading a location ----------------------------------------------------
+
+  /** This provider's public host, declared by a provider that has one. */
+  declare readonly defaultHost?: string;
+
+  /**
+   * No readings: a provider that does not override this reads no location
+   * inside its repositories, so a ref naming one is refused with a sentence.
+   *
+   * @param _location - The written location; unused.
+   */
+  readLocation(_location: WrittenLocation): LocationReading[] {
+    return [];
+  }
+
+  /**
+   * `<id>://<host>/<repoPath>/<rest>`, with the host left out when it is this
+   * provider's default.
+   *
+   * @param host - The repository's host.
+   * @param repoPath - The repository's path on that host.
+   * @param rest - What is named inside it.
+   */
+  formatLocator(host: string, repoPath: string, rest: string): string {
+    const where = host === this.defaultHost ? repoPath : `${host}/${repoPath}`;
+    return `${this.id}://${where}${rest.length === 0 ? "" : `/${rest}`}`;
+  }
+
   // --- Subprocess plumbing ---------------------------------------------------
 
   /**

package/src/lib/repos/providers/github.ts

@@ -24,7 +24,11 @@ import { fetchText, type FetchLike } from "./http.js";
 import {
   buildCanonicalRepo,
   invalidRepoUrl,
+  readingsAfterRepository,
   splitRepoUrl,
+  withoutGitSuffix,
+  type LocationReading,
+  type WrittenLocation,
   type AuthStatus,
   type CanonicalRepo,
   type ChangeProposal,
@@ -83,6 +87,24 @@ export class GithubProvider extends ProviderBase {
   /** What GitHub calls a proposal. */
   readonly proposalNoun = "pull request";
 
+  /** The host a `github://` locator means when it names none. */
+  readonly defaultHost = GITHUB_HOST;
+
+  /**
+   * A GitHub repository is always an owner and a name, so the first two
+   * segments are the repository and everything after them names something
+   * inside it: a namespace, a recipe, or a browser path after `tree/` or
+   * `blob/`.
+   *
+   * @param location - The host and the segments after it.
+   */
+  readLocation(location: WrittenLocation): LocationReading[] {
+    const { segments } = location;
+    if (segments.length < 2) return [];
+    const repoPath = `${segments[0]}/${withoutGitSuffix(segments[1]!)}`;
+    return readingsAfterRepository(repoPath, segments.slice(2));
+  }
+
   matches(url: string): boolean {
     const parts = splitRepoUrl(url);
     return parts !== undefined && parts.host === GITHUB_HOST;

package/src/lib/repos/providers/gitlab.ts

@@ -28,7 +28,11 @@ import { fetchText, type FetchLike } from "./http.js";
 import {
   buildCanonicalRepo,
   invalidRepoUrl,
+  readingsAfterRepository,
   splitRepoUrl,
+  withoutGitSuffix,
+  type LocationReading,
+  type WrittenLocation,
   type AuthStatus,
   type CanonicalRepo,
   type ChangeProposal,
@@ -80,6 +84,70 @@ export class GitlabProvider extends ProviderBase {
   /** What GitLab calls a proposal. */
   readonly proposalNoun = "merge request";
 
+  /** The host a `gitlab://` locator means when it names none. */
+  readonly defaultHost = GITLAB_HOST;
+
+  /**
+   * A GitLab project path nests (`group/subgroup/project`), so where it ends is
+   * only certain when the location says so: a `-` segment (GitLab's own
+   * separator, as in `/-/tree/main/...`) or a `.git` suffix ends it. Otherwise
+   * every split that leaves a project of at least two segments and at most a
+   * namespace and a recipe after it is a reading, and the caller keeps the one
+   * an index confirms.
+   *
+   * readLocation({ host: "gitlab.com", segments: ["a", "b", "c", "d"] });
+   * // -> project "a/b" naming "c/d", project "a/b/c" naming "d",
+   * //    and project "a/b/c/d" naming nothing
+   *
+   * @param location - The host and the segments after it.
+   */
+  readLocation(location: WrittenLocation): LocationReading[] {
+    const { segments } = location;
+
+    const separator = segments.indexOf("-");
+    if (separator >= 2) {
+      return readingsAfterRepository(
+        this.projectPath(segments.slice(0, separator)),
+        segments.slice(separator)
+      );
+    }
+
+    const suffixed = segments.findIndex((segment) => /\.git$/i.test(segment));
+    if (suffixed >= 1) {
+      return readingsAfterRepository(
+        this.projectPath(segments.slice(0, suffixed + 1)),
+        segments.slice(suffixed + 1)
+      );
+    }
+
+    const readings: LocationReading[] = [];
+    for (let end = 2; end <= segments.length; end++) {
+      const rest = segments.slice(end);
+      if (rest.length > 2) continue;
+      readings.push({ repoPath: this.projectPath(segments.slice(0, end)), named: rest });
+    }
+    return readings;
+  }
+
+  /**
+   * The canonical locator always marks where the project path ends with `-`,
+   * because without it a nested group reads more than one way.
+   *
+   * @param host - The project's host.
+   * @param repoPath - The project's path on that host.
+   * @param rest - What is named inside it.
+   */
+  formatLocator(host: string, repoPath: string, rest: string): string {
+    const where = host === this.defaultHost ? repoPath : `${host}/${repoPath}`;
+    return `${this.id}://${where}${rest.length === 0 ? "" : `/-/${rest}`}`;
+  }
+
+  /** A project path from its segments, with the last one's `.git` gone. */
+  private projectPath(segments: string[]): string {
+    const last = segments.length - 1;
+    return segments.map((segment, index) => (index === last ? withoutGitSuffix(segment) : segment)).join("/");
+  }
+
   matches(url: string): boolean {
     const parts = splitRepoUrl(url);
     if (parts === undefined) return false;

package/src/lib/repos/providers/provider.ts

@@ -56,6 +56,44 @@ export type CanonicalRepo = {
   sshUrl: string;
 };
 
+/**
+ * A location as written in a ref, taken apart only as far as every host agrees:
+ * the host, and the path segments after it. Which of those segments are the
+ * repository and which name something inside it is a host's own rule, so a
+ * provider answers that (see `RepoProvider.readLocation`).
+ *
+ *     https://gitlab.com/group/sub/project/-/tree/main/recipes/workflow/alpha
+ *     // -> { host: "gitlab.com",
+ *     //      segments: ["group", "sub", "project", "-", "tree", "main", ...] }
+ */
+export type WrittenLocation = {
+  /** The host, lowercased, such as `github.com`. */
+  host: string;
+  /** Every path segment after the host, in order, none of them empty. */
+  segments: string[];
+};
+
+/**
+ * One way a provider reads a written location. A location on a host where a
+ * repository path can be any length (a GitLab group nests) may have several.
+ */
+export type LocationReading = {
+  /** The repository's path on the host, such as `sous-io/sous-recipes`, with no `.git`. */
+  repoPath: string;
+  /**
+   * The segments after the repository that name something inside it: a
+   * namespace, a namespace and a recipe, or a namespace and `*`. Empty when the
+   * location names only the repository.
+   */
+  named?: string[];
+  /**
+   * A browser URL's path inside the repository, copied from a host's file view
+   * (after `tree/` or `blob/`), with the branch still in front of it. It is
+   * settled against the `path` each recipe's index entry records.
+   */
+  browsed?: string;
+};
+
 /** Options every provider call accepts, all of them for testing seams. */
 export type ProviderOptions = {
   /**
@@ -215,6 +253,27 @@ export interface RepoProvider {
   readonly id: ProviderId;
   /** What this provider can do; see ProviderFeature. */
   readonly features: ProviderFeature[];
+  /**
+   * The host a locator such as `github://owner/repo/...` means when it names
+   * none. A provider without a public host of its own leaves it out.
+   */
+  readonly defaultHost?: string;
+  /**
+   * Every way this provider reads a location inside one of its repositories:
+   * where the repository path ends, and whether the rest names a namespace, a
+   * recipe or a browser path. An empty list means the provider reads no such
+   * location.
+   */
+  readLocation(location: WrittenLocation): LocationReading[];
+  /**
+   * The canonical locator for something inside one of this provider's
+   * repositories, which is how sous prints a located ref.
+   *
+   * @param host - The repository's host.
+   * @param repoPath - The repository's path on that host.
+   * @param rest - What is named inside it, such as `workflow/alpha`.
+   */
+  formatLocator(host: string, repoPath: string, rest: string): string;
   /** True when this provider handles the given repository URL. */
   matches(url: string): boolean;
   /** Takes a repository URL apart, raising a ConfigError when it does not fit. */
@@ -339,6 +398,43 @@ export function supportsSubmit(provider: RepoProvider): provider is SubmitCapabl
   );
 }
 
+/** The words a host's file view puts between a repository and a path: `tree/` and `blob/`. */
+const BROWSE_WORDS = new Set(["tree", "blob"]);
+
+/**
+ * A repository's last path segment without a `.git` suffix.
+ *
+ * @param segment - The segment as written.
+ */
+export function withoutGitSuffix(segment: string): string {
+  return segment.replace(/\.git$/i, "");
+}
+
+/**
+ * Every reading of the segments after a repository: what they name, and, when
+ * they start with `tree/` or `blob/`, the browser path they could also be. Both
+ * are returned when both are possible (a namespace could be called `tree`), and
+ * the caller keeps the one the repository's index confirms. A leading `-`
+ * segment (GitLab's separator between a project and its pages) is dropped
+ * first, wherever it is written.
+ *
+ * readingsAfterRepository("o/r", ["tree", "main", "recipes", "workflow", "alpha"]);
+ * // -> [{ repoPath: "o/r", browsed: "main/recipes/workflow/alpha" },
+ * //     { repoPath: "o/r", named: ["tree", "main", "recipes", "workflow", "alpha"] }]
+ *
+ * @param repoPath - The repository's path on its host.
+ * @param rest - The segments after it.
+ */
+export function readingsAfterRepository(repoPath: string, rest: string[]): LocationReading[] {
+  const after = rest[0] === "-" ? rest.slice(1) : rest;
+  const readings: LocationReading[] = [];
+  if (after.length >= 2 && BROWSE_WORDS.has(after[0]!.toLowerCase())) {
+    readings.push({ repoPath, browsed: after.slice(1).join("/") });
+  }
+  readings.push({ repoPath, named: after });
+  return readings;
+}
+
 /**
  * Normalizes a repository URL for matching: trims it, drops a trailing slash
  * and a trailing `.git`, and lowercases the scheme and host only.

package/src/lib/repos/release/index-builder.ts

@@ -60,7 +60,9 @@ import {
   type ValidatedRecipe,
   type ValidationProblem,
 } from "./validate.js";
-import { parseDependencyRef } from "../ref.js";
+import { isNamedReading, namespaceOfKey, parseRef, refKey } from "../../refs/parse.js";
+import { RefSource } from "../../refs/scopes.js";
+import type { SettledDependency } from "./settle.js";
 
 /** A version that is ready to publish but has no tag yet. */
 export type PendingRelease = {
@@ -113,6 +115,12 @@ export type BuildIndexOptions = {
    * index that describes itself.
    */
   publishing?: Record<string, string>;
+  /**
+   * The dependencies that read more than one way, as `settleDependencyLocations`
+   * settled them, keyed by the dependency as written. Each is recorded under
+   * the keys it reached, with the repository it settled on.
+   */
+  settled?: Map<string, SettledDependency>;
 };
 
 /** The index file's absolute path in a repository. */
@@ -181,7 +189,15 @@ export async function buildIndex(
     // repository as it stood at the tag, which is what it was released against.
     for (const tag of recipeTags) {
       if (Object.hasOwn(versions, tag.version)) continue;
-      const rebuilt = await rebuildTaggedVersion(rootDir, tag, recipe, tagsByKey, existing, run);
+      const rebuilt = await rebuildTaggedVersion(
+        rootDir,
+        tag,
+        recipe,
+        tagsByKey,
+        existing,
+        run,
+        options.settled
+      );
       problems.push(...rebuilt.problems);
       versions[tag.version] = {
         hash: rebuilt.hash,
@@ -197,7 +213,7 @@ export async function buildIndex(
     const hasTag = recipeTags.some((entry) => entry.tag === tagName);
     const workingHash = await hashDirectory(recipe.dir);
     const where = relativeTo(rootDir, recipe.manifestPath);
-    const declared = declaredDependencies(recipe, validation);
+    const declared = declaredDependencies(recipe, validation, options.settled);
 
     // A version the index publishes must have a tag, with one exception: the
     // version the manifest declares right now, which is the one a release is in
@@ -464,10 +480,12 @@ type SiblingState = {
  *
  * @param recipe - The recipe whose dependencies are being read.
  * @param validation - The validated repository, for expanding namespace refs.
+ * @param settled - The dependencies that read more than one way, as the release settled them.
  */
 function declaredDependencies(
   recipe: ValidatedRecipe,
-  validation: RepoValidation
+  validation: RepoValidation,
+  settled: Map<string, SettledDependency> = new Map()
 ): DeclaredDependencies {
   const byKey = new Map<string, DeclaredDependency>();
   const namespaces = new Set<string>();
@@ -488,25 +506,43 @@ function declaredDependencies(
   };
 
   for (const written of declared) {
-    let parsed;
+    // A dependency that reads more than one way was settled by the release,
+    // and what it settled on is what a consumer reads instead of probing.
+    const answer = settled.get(written.trim());
+    if (answer !== undefined) {
+      for (const key of answer.keys) {
+        byKey.set(key, { kind: "remote", repo: answer.identity, range: answer.range ?? "*" });
+      }
+      continue;
+    }
+
+    let readings;
     try {
-      parsed = parseDependencyRef(written);
+      readings = parseRef(written, RefSource.Manifest);
     } catch {
       // A dependency that does not parse is already reported by validation.
       continue;
     }
-
-    if (parsed.kind === "remote") {
-      byKey.set(`${parsed.namespace}/${parsed.recipe}`, {
-        kind: "remote",
-        repo: parsed.canonicalRepo!,
-        range: parsed.range ?? "*",
-      });
+    // Several readings, or a browser path, are settled above or reported by
+    // the settling step; there is nothing more to record here.
+    const parsed = readings[0]!;
+    if (readings.length !== 1 || !isNamedReading(parsed)) continue;
+
+    if (parsed.location !== undefined) {
+      // A whole namespace in another repository is read from that repository's
+      // own index by the consumer; only a recipe has a key to record.
+      if (parsed.recipe !== undefined) {
+        byKey.set(refKey(parsed), {
+          kind: "remote",
+          repo: parsed.location.identity,
+          range: parsed.range ?? "*",
+        });
+      }
       continue;
     }
 
     if (parsed.recipe !== undefined) {
-      addSibling(`${parsed.namespace}/${parsed.recipe}`, parsed.range, true);
+      addSibling(refKey(parsed), parsed.range, true);
       continue;
     }
 
@@ -663,7 +699,7 @@ function checkRecordedDependencies(
     if (declared.byKey.has(name)) continue;
     // A recipe the declared namespace held when the version was published, and
     // no longer does, is history rather than a disagreement.
-    const namespace = name.slice(0, name.indexOf("/"));
+    const namespace = namespaceOfKey(name);
     if (entry.repo === undefined && declared.namespaces.has(namespace)) continue;
     differences.push(
       `'${name}': the index records ${describeRecorded(entry)}, and the manifest does not ` +
@@ -741,6 +777,7 @@ type RebuiltVersion = {
  * @param tagsByKey - Every release tag, grouped by recipe.
  * @param existing - The committed index, when there is one.
  * @param run - The command runner git calls go through.
+ * @param settled - The dependencies that read more than one way, as the release settled them.
  */
 async function rebuildTaggedVersion(
   rootDir: string,
@@ -748,7 +785,8 @@ async function rebuildTaggedVersion(
   recipe: ValidatedRecipe,
   tagsByKey: Map<string, RecipeTag[]>,
   existing: IndexFile | undefined,
-  run: RunOptions["run"]
+  run: RunOptions["run"],
+  settled?: Map<string, SettledDependency>
 ): Promise<RebuiltVersion> {
   return withTaggedTree(
     rootDir,
@@ -763,7 +801,7 @@ async function rebuildTaggedVersion(
         const tagged = snapshot.recipes.find((entry) => entry.key === recipe.key);
         if (tagged !== undefined) {
           const dependencies = resolveIndexDependencies(
-            declaredDependencies(tagged, snapshot),
+            declaredDependencies(tagged, snapshot, settled),
             siblingState(snapshot, tagsByKey, existing)
           );
           return { hash, ...(dependencies === undefined ? {} : { dependencies }), problems: [] };

package/src/lib/repos/release/index.ts

@@ -11,6 +11,7 @@ export * from "./validate.js";
 export * from "./tags.js";
 export * from "./git-state.js";
 export * from "./index-builder.js";
+export * from "./settle.js";
 export * from "./plan.js";
 export * from "./bump.js";
 export * from "./submit-service.js";

package/src/lib/repos/release/plan.ts

@@ -24,7 +24,8 @@
 import path from "node:path";
 import semver from "semver";
 import { hashDirectory } from "../store/hash.js";
-import { parseDependencyRef } from "../ref.js";
+import { isNamedReading, parseRef, splitRecipeKey } from "../../refs/parse.js";
+import { RefSource } from "../../refs/scopes.js";
 import type { RunOptions } from "../providers/git.js";
 import { listRecipeTags, tagFor, withTaggedTree, type RecipeTag } from "./tags.js";
 import { nextVersion, type BumpLevel } from "./bump.js";
@@ -343,13 +344,14 @@ export function siblingKeysOf(validation: RepoValidation, key: string): string[]
 
   const keys: string[] = [];
   for (const written of declared) {
-    let parsed;
+    let readings;
     try {
-      parsed = parseDependencyRef(written);
+      readings = parseRef(written, RefSource.Manifest);
     } catch {
       continue;
     }
-    if (parsed.kind !== "sibling") continue;
+    const parsed = readings[0]!;
+    if (!isNamedReading(parsed) || parsed.location !== undefined) continue;
 
     if (parsed.recipe !== undefined) {
       keys.push(`${parsed.namespace}/${parsed.recipe}`);
@@ -502,8 +504,8 @@ function coveredByScope(recipe: ValidatedRecipe, scope: ReleaseScope): boolean {
 
 /** The tag that publishes one version of one recipe key. */
 function tagOf(key: string, version: string): string {
-  const slash = key.indexOf("/");
-  return tagFor(key.slice(0, slash), key.slice(slash + 1), version);
+  const { namespace, name } = splitRecipeKey(key);
+  return tagFor(namespace, name, version);
 }
 
 /** Renders an absolute path as a repository-relative one, with forward slashes. */