canary-test-cli 7.1.0 → 8.0.0

package/dist/engine/guardian/coverage.js

@@ -35,9 +35,10 @@
 export { coverageLimits } from './diff-coverage/formats/cobertura.js';
 export { parseCoverageJson } from './diff-coverage/formats/coverage-json.js';
 export { validateCoverageJson, } from './diff-coverage/formats/coverage-json-lint.js';
+export { coverageDeltaNotice, coverageDeltaStatus, resolveCoverageDelta, } from './diff-coverage/coverage-delta.js';
 export { resolveFromGraph } from './diff-coverage/graph-tier.js';
 export { resolveFromHeuristic } from './diff-coverage/heuristic-tier.js';
-export { coverageDegradedNotice, coverageStatus, resolveCoverage, resolveCoverageWithInput, } from './diff-coverage/orchestrator.js';
+export { coverageCauses, coverageDegradedNotice, coverageStatus, resolveCoverage, resolveCoverageWithInput, } from './diff-coverage/orchestrator.js';
 export { isSourcePath, isTestPath, isTestSupportPath, } from './diff-coverage/paths.js';
 export { resolveFromReport } from './diff-coverage/report-tier.js';
 export { isTypeOnlyModule } from './diff-coverage/type-only.js';

package/dist/engine/guardian/diff-coverage/coverage-delta.js

@@ -0,0 +1,162 @@
+/**
+ * Coverage **regression** on units a PR touches, versus base (#606).
+ *
+ * The fidelity ladder in `orchestrator.ts` answers one question — *is this
+ * changed unit covered at all?* — and is blind to the case that actually ships
+ * regressions: a file that was 95% covered on `main` and is 60% covered on the
+ * PR head. Every line is still "covered", so the ladder reports nothing. This
+ * module asks the second question by comparing two coverage reports over the
+ * same touched files.
+ *
+ * It is a leaf of the diff-coverage package: it reads report indexes through
+ * `report-tier.js` and speaks only in the shapes `types.js` defines. Finding
+ * construction and severity live in `pr-check.ts`, which owns
+ * `GuardianFinding` — nothing here imports upward.
+ *
+ * **Why a ratio and not line identity.** A diff shifts line numbers, so base
+ * line N and head line N are not the same line. A per-line "was hit, now
+ * unhit" rule would manufacture findings out of an insertion. The trigger is
+ * therefore the whole-file covered ratio; the raw counts travel alongside it so
+ * a reviewer can see the shape of the drop rather than a bare percentage.
+ *
+ * **Why the state object.** Most CI never uploads a base-branch coverage
+ * artifact, which is the accepted risk #606 was filed with. A delta that was
+ * never computed must not read as a delta that came back clean, so — exactly
+ * as `CoverageInputState` does for the ladder (#554) — every field here is a
+ * count or a fact about what the run *observed*, never a verdict, and a zero
+ * denominator classifies as `unavailable` rather than as agreement (ADR 0010).
+ */
+import { countEligible, readReportIndex, zeroMatchClause, } from './report-tier.js';
+import { matchFile } from './types.js';
+/** Classify a {@link CoverageDeltaState}. Zero compared is never `compared`. */
+export function coverageDeltaStatus(state) {
+    if (state.unitsTotal > 0 && state.unitsCompared === state.unitsTotal) {
+        return 'compared';
+    }
+    return state.unitsCompared > 0 ? 'partial' : 'unavailable';
+}
+/**
+ * Float-noise guard, in percentage points. Two reports of the same coverage can
+ * differ in the last bits of a division; a drop under a tenth of a point is
+ * arithmetic, not a regression.
+ */
+const DROP_EPSILON_POINTS = 0.1;
+const EM_DASH = '\u{2014}';
+const HEAD_ONLY = 'were judged against the head report only, so a coverage REGRESSION on ' +
+    'them cannot be detected by this run';
+/**
+ * The LOUD degradation line for a delta run, or `null` when every touched unit
+ * was compared (nothing degraded, so nothing is said).
+ *
+ * A run that judged nothing (`unitsTotal === 0`) also returns `null`: it makes
+ * no claim in either direction, and the caller's abstention path reports that.
+ */
+export function coverageDeltaNotice(state) {
+    const { baseRequested, baseFound, baseParsed, filesInBaseReport } = state;
+    const { unitsCompared: compared, unitsTotal: total } = state;
+    if (total === 0)
+        return null;
+    const status = coverageDeltaStatus(state);
+    if (status === 'compared')
+        return null;
+    const dash = ` ${EM_DASH} `;
+    if (status === 'partial') {
+        return (`coverage delta partial${dash}head-only for ${total - compared} of ` +
+            `${total} changed file(s); base report '${baseRequested}' matched ` +
+            `${compared}. The unmatched file(s) ${HEAD_ONLY}`);
+    }
+    const head = `coverage delta unavailable${dash}head-only: `;
+    const tail = `; ${total} changed file(s) ${HEAD_ONLY}`;
+    if (baseRequested === null) {
+        return `${head}no base coverage report was supplied${tail}`;
+    }
+    if (!baseFound) {
+        return `${head}base report not found at '${baseRequested}'${tail}`;
+    }
+    if (!baseParsed) {
+        return `${head}base report at '${baseRequested}' yielded no usable records${tail}`;
+    }
+    return (`${head}base report at '${baseRequested}' covers ${filesInBaseReport} ` +
+        `file(s) but ${zeroMatchClause(state.unitsEligible, total)}${tail}`);
+}
+/**
+ * Count a file's covered/coverable lines in one report index, or `null` when
+ * the report cannot speak to the path with a usable denominator.
+ *
+ * `coverable` is the report's own instrumented set where the format declares
+ * one (lcov, Cobertura), else the lines it recorded. A file present with an
+ * empty record has a denominator of zero: a ratio there would be invented, so
+ * the unit is skipped rather than scored — the same reason the ladder never
+ * grades a unit it could not measure.
+ */
+function ratioFor(path, index) {
+    const file = matchFile(path, index);
+    if (file === null)
+        return null;
+    const coverableLines = file.coverable !== null
+        ? [...file.coverable]
+        : Object.keys(file.hits).map(Number);
+    if (coverableLines.length === 0)
+        return null;
+    let covered = 0;
+    for (const line of coverableLines) {
+        if ((file.hits[line] ?? 0) > 0)
+            covered++;
+    }
+    return { covered, coverable: coverableLines.length };
+}
+const percent = (r) => (r.covered / r.coverable) * 100;
+/**
+ * Compare base-branch and head coverage over the touched units (#606).
+ *
+ * Returns one {@link UnitCoverageDelta} per unit **both** reports could score,
+ * plus the {@link CoverageDeltaState} denominator. A unit either side cannot
+ * score is silently absent from `deltas` and loudly absent from
+ * `unitsCompared` — the notice, not the empty array, is what reports it.
+ */
+export function resolveCoverageDelta(units, options = {}) {
+    const { baseCoveragePath = null, headCoveragePath = null } = options;
+    const repoRoot = options.repoRoot ?? '.';
+    const state = {
+        baseRequested: baseCoveragePath,
+        baseFound: false,
+        baseParsed: false,
+        filesInBaseReport: 0,
+        unitsCompared: 0,
+        unitsTotal: units.length,
+    };
+    if (baseCoveragePath === null)
+        return { deltas: [], state };
+    const baseRead = readReportIndex(baseCoveragePath);
+    state.baseFound = baseRead.found;
+    state.baseParsed = baseRead.index !== null;
+    state.filesInBaseReport =
+        baseRead.index === null ? 0 : Object.keys(baseRead.index).length;
+    if (baseRead.index === null)
+        return { deltas: [], state };
+    const paths = units.map((u) => u.path);
+    state.unitsEligible = countEligible(paths, baseRead.index, baseCoveragePath, repoRoot);
+    if (headCoveragePath === null)
+        return { deltas: [], state };
+    const headRead = readReportIndex(headCoveragePath);
+    if (headRead.index === null)
+        return { deltas: [], state };
+    const deltas = [];
+    for (const unit of units) {
+        const base = ratioFor(unit.path, baseRead.index);
+        const head = ratioFor(unit.path, headRead.index);
+        if (base === null || head === null)
+            continue;
+        state.unitsCompared++;
+        const dropPoints = percent(base) - percent(head);
+        deltas.push({
+            path: unit.path,
+            base,
+            head,
+            dropPoints,
+            regressed: dropPoints > DROP_EPSILON_POINTS,
+        });
+    }
+    return { deltas, state };
+}
+//# sourceMappingURL=coverage-delta.js.map

package/dist/engine/guardian/diff-coverage/formats/cobertura.js

@@ -59,12 +59,56 @@ function coberturaBody(text) {
     // Pin to the canonical (namespace-free) Cobertura root; anything else is a
     // different XML format and is rejected rather than guessed at. Strip comments
     // first so a `<foo>` inside a comment can't masquerade as the root element.
-    const withoutComments = text.replace(/<!--[\s\S]*?-->/g, '');
+    const withoutComments = stripComments(text);
     const rootMatch = /<(?![?!])([A-Za-z_][\w.:-]*)/.exec(withoutComments);
     if (rootMatch === null || rootMatch[1] !== 'coverage')
         return null;
     return withoutComments;
 }
+const CDATA_OPEN = '<![CDATA[';
+const CDATA_CLOSE = ']]>';
+const COMMENT_OPEN = '<!--';
+const COMMENT_CLOSE = '-->';
+/**
+ * Drop every XML comment, leaving CDATA sections intact.
+ *
+ * Must not be a plain `/<!--[\s\S]*?-->/g` replace: inside CDATA those markers
+ * are ordinary character data, so a document carrying `<!--` in one CDATA
+ * section and `-->` in a later one would have every real element between them
+ * deleted. The damage is worse than data loss — the surviving `</class>` then
+ * rebinds the next class's `<line>` records to the previous class's filename,
+ * so a crafted report can attribute one file's hit counts to another.
+ *
+ * Chunked with `indexOf` rather than scanned per character so the cost stays
+ * proportional to the number of markers, not the size of the capped document.
+ */
+function stripComments(text) {
+    const out = [];
+    let i = 0;
+    for (;;) {
+        const cdata = text.indexOf(CDATA_OPEN, i);
+        const comment = text.indexOf(COMMENT_OPEN, i);
+        if (comment === -1)
+            break;
+        // A CDATA section that opens first swallows this comment marker: copy the
+        // whole section verbatim and resume looking after it.
+        if (cdata !== -1 && cdata < comment) {
+            const end = text.indexOf(CDATA_CLOSE, cdata + CDATA_OPEN.length);
+            if (end === -1)
+                break; // unterminated CDATA — nothing further is markup
+            out.push(text.slice(i, end + CDATA_CLOSE.length));
+            i = end + CDATA_CLOSE.length;
+            continue;
+        }
+        const end = text.indexOf(COMMENT_CLOSE, comment + COMMENT_OPEN.length);
+        if (end === -1)
+            break; // unterminated comment — leave the tail as-is
+        out.push(text.slice(i, comment));
+        i = end + COMMENT_CLOSE.length;
+    }
+    out.push(text.slice(i));
+    return out.join('');
+}
 const CLOSE_CLASS = '</class>';
 /**
  * Walk each `<class>` open tag, folding its lines into `index` by filename.

package/dist/engine/guardian/diff-coverage/orchestrator.js

@@ -5,27 +5,23 @@
  */
 import { resolveFromGraph } from './graph-tier.js';
 import { resolveFromHeuristic } from './heuristic-tier.js';
-import { matchUnitsToIndex, readReportIndex } from './report-tier.js';
+import { countEligible, instrumentedTrees, matchUnitsToIndex, readReportIndex, zeroMatchClause, } from './report-tier.js';
 /**
- * SC-3 orchestrator: resolve each unit at the highest available fidelity.
- *
- * The ladder is applied **per unit**, not per batch. For each unit the first
- * tier that has a signal for *that* unit wins:
- *
- *   1. `coveragePath` lists the unit's path → `COVERAGE_VERIFIED`
- *   2. else a graph node for the unit exists → `GRAPH_VERIFIED`
- *   3. else the naming heuristic             → `HEURISTIC` (always returns)
- *
- * A unit absent from the report is NOT judged COVERAGE_VERIFIED-uncovered; it
- * falls through to the graph then heuristic tier (FIX 2). Returns exactly one
- * {@link CoverageResult} per input unit, in input order, fidelity-labeled.
- *
- * `graphMaxDepth` bounds the graph tier's reverse-BFS hop distance (#320) and
- * is forwarded verbatim to `resolveFromGraph`.
+ * SC-3 orchestrator, applied per unit: the report (`COVERAGE_VERIFIED`), else
+ * the graph (`GRAPH_VERIFIED`, bounded by `graphMaxDepth`, #320), else the
+ * naming heuristic. An absent unit falls through, never uncovered (FIX 2).
+ * Returns one {@link CoverageResult} per unit, in input order.
  */
 export function resolveCoverage(units, options = {}) {
     return resolveCoverageWithInput(units, options).results;
 }
+/** The units the report did not verify, split by cause (#928). */
+export function coverageCauses(state) {
+    const nonCoverable = state.unitsNonCoverable ?? 0;
+    const stale = state.unitsEligible ?? 0;
+    const absent = state.unitsTotal - state.unitsMatched - nonCoverable;
+    return { stale, scopeGap: absent - stale, nonCoverable };
+}
 /** Classify a {@link CoverageInputState}. Zero matched is never `verified`. */
 export function coverageStatus(state) {
     if (state.unitsTotal > 0 && state.unitsMatched === state.unitsTotal) {
@@ -47,6 +43,10 @@ export function coverageDegradedNotice(state) {
     const { unitsMatched: matched, unitsTotal: total } = state;
     if (total === 0)
         return null;
+    const { stale, scopeGap } = coverageCauses(state);
+    // The report spoke to every unit, even if only to say "nothing coverable".
+    if (parsed && stale + scopeGap === 0)
+        return null;
     const status = coverageStatus(state);
     if (status === 'verified')
         return null;
@@ -68,7 +68,7 @@ export function coverageDegradedNotice(state) {
             `${total} changed file(s) ${FALLBACK_TIER}`);
     }
     return (`${head}report at '${requested}' covers ${filesInReport} file(s) but ` +
-        `matched 0 of ${total} changed file(s); ${FALLBACK_TIER}`);
+        `${zeroMatchClause(state.unitsEligible, stale + scopeGap)}; ${FALLBACK_TIER}`);
 }
 /**
  * {@link resolveCoverage}, additionally reporting which mode the run was in.
@@ -97,14 +97,18 @@ export function resolveCoverageWithInput(units, options = {}) {
         coverage.parsed = read.index !== null;
         coverage.filesInReport =
             read.index === null ? 0 : Object.keys(read.index).length;
-        const report = read.index === null ? null : matchUnitsToIndex(remaining, read.index);
-        // An empty array (no unit matched the report) is falsy-equivalent in the
-        // Python `if report:` guard — fall through rather than lock in nothing.
-        if (report !== null && report.length > 0) {
+        if (read.index !== null) {
+            const nonCoverable = [];
+            const report = matchUnitsToIndex(remaining, read.index, nonCoverable);
             for (const r of report)
                 resolved.set(r.unit, r);
             coverage.unitsMatched = report.length;
+            coverage.unitsNonCoverable = nonCoverable.length;
             remaining = remaining.filter((u) => !resolved.has(u));
+            // #928: only ABSENT units can make a report stale.
+            const absent = remaining.filter((u) => !nonCoverable.includes(u));
+            coverage.unitsEligible = countEligible(absent.map((u) => u.path), read.index, coveragePath, repoRoot);
+            coverage.instrumentedTrees = instrumentedTrees(read.index, coveragePath, repoRoot);
         }
     }
     if (remaining.length > 0) {

package/dist/engine/guardian/diff-coverage/paths.js

@@ -75,9 +75,11 @@ export function isTestSupportPath(path) {
  * Extensions that denote hand-authored, executable program source (#413).
  *
  * The membership rule is deliberately simple and defensible: **a programming
- * language belongs; data, config, markup, and style do not.** `.sh` is in (it is
- * executable logic — bats/shunit2 exist); `.json`, `.yaml`, `.sql`, `.css`, and
- * `.html` are out (nothing a naming heuristic could meaningfully judge).
+ * language belongs; data, config, markup, and style do not.** Shell (`.sh`,
+ * `.bash`, `.zsh`, `.ps1`, `.psm1`) is out since #933: ops and seed scripts drew
+ * "no test file references" findings no repo will ever satisfy. `.json`,
+ * `.yaml`, `.sql`, `.css`, and `.html` are out (nothing to meaningfully judge).
+ * This one set feeds both the heuristic noise filter and the coverage-unit floor.
  *
  * A repo that disagrees at the margins tunes the glob layer
  * (`canary.guardian.pr.heuristicExclude`) rather than this list.
@@ -134,12 +136,6 @@ const SOURCE_EXTENSIONS = new Set([
     '.dart',
     '.r',
     '.jl',
-    // Shell.
-    '.sh',
-    '.bash',
-    '.zsh',
-    '.ps1',
-    '.psm1',
 ]);
 /**
  * True if `path` looks like hand-authored program source (#413).

package/dist/engine/guardian/diff-coverage/report-tier.js

@@ -5,7 +5,7 @@
  * and the per-unit matching that turns a report index into verdicts.
  */
 import { existsSync, readFileSync } from 'node:fs';
-import { basename } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep, } from 'node:path';
 import { parseCobertura } from './formats/cobertura.js';
 import { parseCoverageJson } from './formats/coverage-json.js';
 import { expandRanges, makeResult, matchFile, rangesStr, selfDescribing, splitLines, pyInt, Fidelity, } from './types.js';
@@ -88,6 +88,81 @@ export function readReportIndex(reportPath) {
         return unusable(true);
     return { found: true, index };
 }
+/**
+ * The repo-relative prefix a report's relative paths are rooted at (#883): the
+ * nearest ancestor of the report's directory under which any of `samples`
+ * exists (vitest under `ts/` writes `src/cli.ts`). Every sample is tried, since
+ * a stale report names deleted files. No hit, or outside the repo: the root.
+ */
+function anchorPrefix(samples, reportPath, root) {
+    const dir = relative(root, resolve(dirname(reportPath))).split(sep);
+    if (dir[0] === '..' || isAbsolute(dir.join('/')))
+        return '';
+    for (let i = dir.length; i > 0 && dir[0] !== ''; i--) {
+        const prefix = dir.slice(0, i).join('/');
+        if (samples.some((s) => existsSync(join(root, prefix, s)))) {
+            return `${prefix}/`;
+        }
+    }
+    return '';
+}
+/** The deepest directory shared by every path in `paths` ('' when none). */
+function commonDir(paths) {
+    const dirs = paths.map((p) => p.split('/').slice(0, -1));
+    const first = dirs[0] ?? [];
+    let n = first.length;
+    for (const d of dirs) {
+        while (n > 0 && d.slice(0, n).join('/') !== first.slice(0, n).join('/'))
+            n--;
+    }
+    return first.slice(0, n).join('/');
+}
+/**
+ * The repo-relative source trees a report instruments (#883): one per top-level
+ * segment of its (anchored) paths, narrowed to the deepest shared directory.
+ * `''` means the report is rooted at the repo itself and covers everything.
+ */
+export function instrumentedTrees(index, reportPath, repoRoot) {
+    const root = resolve(repoRoot);
+    const groups = new Map();
+    for (const raw of Object.keys(index)) {
+        const p = isAbsolute(raw) ? relative(root, raw).split(sep).join('/') : raw;
+        const clean = p.replace(/^\.\//, '');
+        const top = clean.split('/')[0];
+        groups.set(top, [...(groups.get(top) ?? []), clean]);
+    }
+    return [...groups.values()].map((paths) => {
+        const tree = anchorPrefix(paths, reportPath, root) + commonDir(paths);
+        return tree.replace(/\/$/, '');
+    });
+}
+/**
+ * How many changed `paths` lie inside a tree the report instruments (#883) —
+ * the denominator a zero-match abstention needs. Zero eligible means the files
+ * are outside the instrumentation scope, so no fresh report could match them;
+ * eligible-but-unmatched means the report itself is stale.
+ */
+export function countEligible(paths, index, reportPath, repoRoot) {
+    const trees = instrumentedTrees(index, reportPath, repoRoot);
+    const inside = (p) => trees.some((t) => t === '' || p.startsWith(`${t}/`));
+    return paths.filter(inside).length;
+}
+/**
+ * The "matched 0" clause for a zero-match notice, naming its cause (#883).
+ * `eligible` is undefined for a producer that never computed it.
+ */
+export function zeroMatchClause(eligible, total) {
+    const matched = `matched 0 of ${total} changed file(s)`;
+    if (eligible === undefined)
+        return matched;
+    if (eligible === 0) {
+        return (`${matched}: 0 of ${total} changed file(s) lie inside a tree it ` +
+            'instruments, so they are outside every tree the report covers ' +
+            '(an instrumentation-scope gap; regenerating the report cannot fix it)');
+    }
+    return (`${matched}, though ${eligible} of ${total} changed file(s) lie inside a ` +
+        'tree it instruments (the report is likely stale or from another checkout)');
+}
 /** Pick the reader by report filename; `null` for a format we don't know. */
 function parseByFormat(name, text) {
     if (name.endsWith('.json')) {
@@ -107,18 +182,19 @@ function parseByFormat(name, text) {
     // Unrecognized format → fall through to a lower fidelity tier.
     return null;
 }
-/** Resolve every unit the report index can speak to (COVERAGE_VERIFIED). */
-export function matchUnitsToIndex(units, index) {
+/**
+ * Resolve every unit the report index can speak to (COVERAGE_VERIFIED). Units
+ * the report lists but whose changed lines are all non-coverable are pushed to
+ * `nonCoverable`, so a caller can tell them from absent units (#928).
+ */
+export function matchUnitsToIndex(units, index, nonCoverable = []) {
     const results = [];
     for (const unit of units) {
         const file = matchFile(unit.path, index);
-        if (file === null) {
-            // Unit path is nowhere in the report index → "not instrumented", which is
-            // NOT the same as "instrumented and unhit". Emit no COVERAGE_VERIFIED
-            // result so the orchestrator falls through to a lower-fidelity tier for
-            // this unit (FIX 2).
+        // Absent → "not instrumented", NOT "instrumented and unhit": no result, so
+        // the unit falls through to a lower-fidelity tier (FIX 2).
+        if (file === null)
             continue;
-        }
         const { hits, coverable: measured } = file;
         const added = expandRanges(unit.added_ranges);
         // The per-line form of the check above (#655/#657): where the report says
@@ -127,9 +203,9 @@ export function matchUnitsToIndex(units, index) {
         // every changed line counts and absence means uncovered.
         const coverable = measured === null ? added : added.filter((ln) => measured.has(ln));
         if (coverable.length === 0) {
-            // Every changed line is non-coverable, so this report has nothing to say
-            // about the unit. An abstention — never a clean pass, never a finding.
-            // Falls through to the graph/heuristic tier exactly as an absent path does.
+            // Nothing coverable changed: never a pass or a finding here, and it falls
+            // through like an absent path — but it is recorded as its own cause.
+            nonCoverable.push(unit);
             continue;
         }
         const uncovered = coverable.filter((ln) => (hits[ln] ?? 0) <= 0);

package/dist/engine/guardian/diff-extractor.js

@@ -103,44 +103,43 @@ function pyGet(obj, key, fallback) {
     return Object.prototype.hasOwnProperty.call(obj, key) ? obj[key] : fallback;
 }
 /**
- * Deep equality mirroring Python `==` on JSON-shaped data: arrays compare
- * order-sensitively, objects compare by key set (order-insensitive), and
- * `None`/`undefined` are interchangeable.
+ * Deep equality for spec values: arrays by order, objects by key set, null and
+ * undefined interchangeable. A boolean never equals a number (#922): a spec's
+ * true -> 1 rewrite changes the type consumers see, so it is a change.
  */
 function pyEqual(a, b) {
     if (a === b)
         return true;
-    if (a === null || a === undefined)
-        return b === null || b === undefined;
-    if (b === null || b === undefined)
+    if (isNone(a) || isNone(b))
+        return isNone(a) && isNone(b);
+    if (Array.isArray(a) || Array.isArray(b))
+        return pyListEqual(a, b);
+    return pyDictEqual(a, b);
+}
+/** Python `None`: JSON `null` or a missing key read as `undefined`. */
+function isNone(value) {
+    return value === null || value === undefined;
+}
+/** Python `list == list`: same length, element-wise equal in order. */
+function pyListEqual(a, b) {
+    if (!Array.isArray(a) || !Array.isArray(b))
         return false;
-    const aArr = Array.isArray(a);
-    const bArr = Array.isArray(b);
-    if (aArr || bArr) {
-        if (!aArr || !bArr || a.length !== b.length)
-            return false;
-        for (let i = 0; i < a.length; i++) {
-            if (!pyEqual(a[i], b[i]))
-                return false;
-        }
-        return true;
-    }
-    if (typeof a === 'object' && typeof b === 'object') {
-        const ao = a;
-        const bo = b;
-        const aKeys = Object.keys(ao);
-        const bKeys = Object.keys(bo);
-        if (aKeys.length !== bKeys.length)
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (!pyEqual(a[i], b[i]))
             return false;
-        for (const key of aKeys) {
-            if (!Object.prototype.hasOwnProperty.call(bo, key))
-                return false;
-            if (!pyEqual(ao[key], bo[key]))
-                return false;
-        }
-        return true;
-    }
-    return false;
+    return true;
+}
+/** Python `dict == dict`: same key set in any order, values equal. */
+function pyDictEqual(a, b) {
+    if (typeof a !== 'object' || typeof b !== 'object')
+        return false;
+    const [ao, bo] = [a, b];
+    const keys = Object.keys(ao);
+    if (keys.length !== Object.keys(bo).length)
+        return false;
+    return keys.every((k) => Object.hasOwn(bo, k) && pyEqual(ao[k], bo[k]));
 }
 function setEqual(a, b) {
     if (a.size !== b.size)