"""Deployment allowlist regression tests.

These tests never contact Hugging Face. They prove the deploy helper selects
only intentional project source and excludes large/local/sensitive state.
"""

from pathlib import Path

from scripts.deploy_space import REPO_ROOT, deployment_manifest


def test_deployment_manifest_is_sorted_unique_and_complete() -> None:
    manifest = deployment_manifest()

    assert manifest == tuple(sorted(set(manifest)))
    assert {
        "README.md",
        "UPSTREAM_REVISION",
        "Dockerfile",
        ".dockerignore",
        "assets/logo.svg",
        "app/gallery_worker.py",
        "app/main.py",
        "forge/stage3_build/generate_threejs_factory.py",
        "scripts/build_fixture_factory.py",
        "tests/fixtures/canned_spec.json",
    }.issubset(manifest)
    assert all((REPO_ROOT / relative).is_file() for relative in manifest)


def test_deployment_manifest_excludes_workspace_and_generated_state() -> None:
    manifest = deployment_manifest()
    forbidden_parts = {
        ".git",
        ".pytest_cache",
        ".venv",
        ".workflow",
        "__pycache__",
        "node_modules",
        "upstream-src",
        "verification",
    }

    for relative_text in manifest:
        relative = Path(relative_text)
        assert forbidden_parts.isdisjoint(relative.parts), relative_text
        assert not relative.name.startswith("rollout"), relative_text
        assert relative.suffix not in {".pyc", ".pyo", ".log"}, relative_text

    assert "tests/fixtures/factory_fixture.ts" not in manifest