(MOT-4463) fix(iii-worker): accept npm comparator dependency ranges

[ytallo]

Summary

• accept whitespace-separated npm comparator sets such as >=0.22.0 <1.0.0 in worker dependency resolution
• apply the parser consistently to manifest, lockfile, and managed-worker validation
• preserve the original comparator text for Registry requests and lockfile persistence
• document the supported range syntax and add regression coverage

Why

Worker manifests need bounded 0.x ranges that match the Registry's npm semver syntax, while the iii worker resolver previously accepted only the Rust comparator form with comma-separated constraints.

Validation

• cargo fmt --all -- --check
• cargo check -p iii-worker --lib
• focused parser, lockfile, and managed-worker tests: 16 passed

The broader worker library suite passed 977 tests; the remaining failures were in source-watcher tests under the environment's file-descriptor/event limits.

Refs MOT-4463

Related: workers PR #834

Summary by CodeRabbit

• New Features

  • Worker dependency version ranges now support npm-style comparator sets, such as >=0.22.0 <1.0.0.
  • Supported ranges are validated consistently across manifests, lockfiles, and managed dependencies.

• Documentation

  • Updated dependency field descriptions with comparator-set syntax and examples.

• Bug Fixes

  • Improved validation and compatibility checks for dependency ranges with multiple bounds.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
iii-website	Ready	Preview	Aug 19, 2026 11:28am

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 71628362-4545-43ed-9ee6-497e9f650124

📥 Commits

Reviewing files that changed from the base of the PR and between c6f6fde and b79eb84.

📒 Files selected for processing (5)

• crates/iii-worker/src/cli/lockfile.rs
• crates/iii-worker/src/cli/managed.rs
• crates/iii-worker/src/cli/worker_manifest.rs
• crates/iii-worker/src/cli/worker_manifest_deps.rs
• crates/iii-worker/src/core/types.rs

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Worker dependency parsing now accepts npm-style whitespace-separated comparator sets. Manifest parsing, lockfile validation, and managed dependency resolution use the shared parser. Documentation and regression tests cover syntax, bounds, round-tripping, and invalid input.

Changes

Dependency range parsing

Layer / File(s)	Summary
Shared dependency range parser crates/iii-worker/src/cli/worker_manifest_deps.rs	Added shared parsing for whitespace-separated npm comparator sets. Manifest parsing uses the helper and tests cover preservation, bounds, and invalid input.
Consumer validation and documentation crates/iii-worker/src/cli/lockfile.rs, crates/iii-worker/src/cli/managed.rs, crates/iii-worker/src/cli/worker_manifest.rs, crates/iii-worker/src/core/types.rs	Lockfile and managed dependency validation use the shared parser. Tests cover round-tripping and range matching. Worker dependency documentation describes the supported syntax.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to b79eb

The change expands worker dependency resolution to support npm comparator ranges while preserving existing request and lockfile behavior; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• iii-hq/iii#2013: Changes dependency-graph validation and consent handling in managed.rs.

Suggested reviewers: andersonleal

Poem

I’m a rabbit with ranges, neat and bright,
Parsing two bounds in one hop tonight.
Lower bound in, upper bound out,
Invalid commas make errors shout.
YAML returns with its text intact—
Nibble-approved, and semver-packed!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: accepting npm comparator dependency ranges.
Description check	✅ Passed	The description explains the change, motivation, validation, test results, and relevant references, despite using Summary instead of the template's What and Notes headings.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/mot-4463-worker-version-ranges

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ytallo]

Superseded by iii-hq/workers#834, which uses 0.x and 1.x ranges already supported by the current iii worker resolver and Registry. No iii code change is required.