// No production accounts, network providers or header overrides are used.
const [debug, base] = process.argv.slice(2);
const version=await (await fetch(debug+'/json/version')).json();
const ws=new WebSocket(version.webSocketDebuggerUrl);
await new Promise(resolve=>ws.addEventListener('open',resolve,{once:true}));
let next=0;const pending=new Map();
ws.addEventListener('message',event=>{const m=JSON.parse(event.data);if(pending.has(m.id)){const p=pending.get(m.id);pending.delete(m.id);m.error?p.reject(Error(m.error.message)):p.resolve(m.result);}});
const call=(method,params={},sessionId)=>new Promise((resolve,reject)=>{const id=++next;pending.set(id,{resolve,reject});ws.send(JSON.stringify({id,method,params,...(sessionId?{sessionId}:{})}));});
const {targetId}=await call('Target.createTarget',{url:'about:blank'});
const {sessionId}=await call('Target.attachToTarget',{targetId,flatten:true});
const cmd=(method,params)=>call(method,params,sessionId);
await cmd('Page.enable');await cmd('Network.enable');
const evaluate=async expression=>{const r=await cmd('Runtime.evaluate',{expression,returnByValue:true});if(r.exceptionDetails)throw Error('Browser evaluation failed');return r.result.value;};
async function waitFor(expression){for(let n=0;n<70;n++){if(await evaluate(expression))return;await new Promise(r=>setTimeout(r,100));}throw Error('Browser condition not met: '+expression);}
async function navigate(path){await cmd('Page.navigate',{url:base+path});await waitFor('location.href === '+JSON.stringify(base+path)+' && document.readyState === "complete"');}
async function identity(who){await cmd('Network.clearBrowserCookies');if(who)await cmd('Network.setCookie',{name:'ue_session',value:who,url:base,path:'/',httpOnly:true,sameSite:'Lax'});}
let checks=0;async function check(expression,name){if(!await evaluate(expression))throw Error(name);console.log('PASS '+name);checks++;}
try{
 await navigate('/');
 await check(`!!document.querySelector('a[href="/login"]') && !document.querySelector('a[href="/logout"]')`,'U01 anonymous session controls');
 await identity('member');await navigate('/onboarding');
 await check(`!!document.querySelector('a[href="/logout"]') && !document.querySelector('a[href="/login"]')`,'U01 authenticated session controls');
 await navigate('/platform');
 await check(`document.body.innerText.includes("Access is not available") && !!document.querySelector('a[href="/access-recovery"]')`,'T01 member denial has recovery');
 await navigate('/security');
 await check(`document.body.innerText.includes("Authenticator setup is temporarily unavailable")`,'U06 unavailable OTP is explicit');
 await identity('admin');await navigate('/admin/tenant:trial:demo-company');
 await check(`document.body.innerText.includes("Login name: actual.login")`,'T03 actual login name shown');
 await check(`document.body.innerText.includes("Onboarding follow-up")`,'T07 onboarding state visible');
 await evaluate(`Array.from(document.forms).find(f=>f.action.endsWith("/status")).querySelector("button").click()`);
 await waitFor('document.body.innerText.includes("Confirm change")');
 await check(`document.body.innerText.includes("Other tenant access and the shared login are retained")`,'T06 scope confirmation');
 await evaluate(`Array.from(document.links).find(a=>a.textContent==="Cancel without changes").click()`);
 await waitFor('location.pathname === "/"');
 await navigate('/admin/tenant:trial:demo-company');
 await check(`document.body.innerText.includes("active for this tenant")`,'T06 cancel preserves active account');
 await cmd('Emulation.setDeviceMetricsOverride',{width:390,height:844,deviceScaleFactor:1,mobile:true});
 await navigate('/security');
 await check(`document.documentElement.scrollWidth <= innerWidth`,'U12 security recovery fits mobile');
 await cmd('Emulation.clearDeviceMetricsOverride');
 await identity('operator');await navigate('/platform');
 await check(`!!document.querySelector('a[href="/platform/operations"]')`,'P01 platform recovery navigation');
 await navigate('/platform/operations');
 await check(`document.body.innerText.includes("Component checks do not prove a complete sign-in or inbox receipt")`,'P05 unknown provider health remains explicit');
 await navigate('/platform/operations?event_id=p05-browser');
 await check(`document.body.innerText.includes("No mail submission is recorded")`,'P05 selected mail evidence');
 await evaluate(`document.querySelector('form[action="/platform/operations/deliver"] button').click()`);
 await waitFor('document.body.innerText.includes("Confirm change")');
 await check(`document.body.innerText.includes("p05-browser")`,'P05 selected delivery requires review');
 await evaluate(`document.querySelector('input[name="confirm_token"]').form.querySelector('button').click()`);
 await waitFor('document.body.innerText.includes("definitely failed")');
 await check(`!!document.querySelector('form[action="/platform/operations/deliver"]')`,'P05 failure offers controlled retry');
 await evaluate(`document.querySelector('form[action="/platform/operations/deliver"] button').click()`);
 await waitFor('document.body.innerText.includes("Confirm change")');
 await evaluate(`document.querySelector('input[name="confirm_token"]').form.querySelector('button').click()`);
 await waitFor('document.body.innerText.includes("mail provider accepted")');
 await check(`!document.querySelector('form[action="/platform/operations/deliver"]') && document.body.innerText.includes("does not prove inbox receipt")`,'P05 completed delivery cannot be blindly repeated');
 await navigate('/platform/activity');
 await check(`!!document.querySelector('input[name="reference"]') && !!document.querySelector('input[name="tenant"]')`,'P08 platform investigation filters');
 await evaluate(`document.querySelector('input[name="reference"]').value='synthetic-missing';document.querySelector('form[action="/platform/activity"] button').click()`);
 await waitFor('location.search.includes("synthetic-missing") && document.body.innerText.includes("No matching records")');
 await check(`document.body.innerText.includes("does not prove that no action occurred")`,'P08 missing evidence is explicit');
 await navigate('/admin/tenant:trial:demo-company');
 await evaluate(`Array.from(document.forms).find(f=>f.action.endsWith("/recover")).querySelector("button").click()`);
 await waitFor('document.body.innerText.includes("Confirm change")');
 await check(`document.body.innerText.includes("does not reset a password") && document.body.innerText.includes("cannot bypass")`,'P04 restoration explains factor boundary');
 await identity('admin');await navigate('/platform/factor-recovery');
 await check(`document.body.innerText.includes("Access is not available")`,'P04 tenant admin cannot recover shared factor');
 await identity('operator');await navigate('/platform/factor-recovery');
 await evaluate(`document.querySelector('input[name="user"]').value='alice';document.querySelector('input[name="reference"]').value='case-1';document.querySelector('form button').click()`);
 await waitFor('document.body.innerText.includes("Review the selected authenticator")');
 await check(`document.body.innerText.includes("all applications") && !!document.querySelector('input[name="identity_verified"][required]')`,'P04 scope and identity verification before mutation');
 await evaluate(`document.querySelector('input[name="identity_verified"]').checked=true;Array.from(document.forms).find(f=>f.querySelector('input[name="confirmation"]')).querySelector('button').click()`);
 await waitFor('document.body.innerText.includes("Authenticator recovery recorded")');
 await check(`document.body.innerText.includes("case-1") && document.body.innerText.includes("Enroll a replacement") && !document.body.innerText.includes("server-only-token")`,'P04 receipt and replacement onboarding without credentials');
 await navigate('/platform/authentication-policy');
 await check(`document.body.innerText.includes("Application step-up always wins") && document.body.innerText.includes("Current policy")`,'P06 effective policy and step-up boundary');
 await evaluate(`document.querySelector('input[name="reference"]').value='p06-case';document.querySelector('select[name="mode"]').value='mandatory';document.querySelector('button[value="preview"]').click()`);
 await waitFor('document.body.innerText.includes("Review policy change")');
 await check(`document.body.innerText.includes("unable to complete sign-in") && !!document.querySelector('input[name="acknowledged"][required]')`,'P06 lockout impact requires acknowledgement');
 await evaluate(`Array.from(document.links).find(a=>a.textContent==='Cancel without changes').click()`);
 await waitFor('document.body.innerText.includes("Current policy") && !document.querySelector("input[name=confirmation]")');
 await check(`document.body.innerText.includes("Optional until an authenticator is activated")`,'P06 cancel preserves current policy');
 await evaluate(`document.querySelector('input[name="reference"]').value='p06-case';document.querySelector('select[name="mode"]').value='mandatory';document.querySelector('button[value="preview"]').click()`);
 await waitFor('!!document.querySelector("input[name=acknowledged]")');
 await evaluate(`document.querySelector('input[name="acknowledged"]').checked=true;document.querySelector('input[name="confirmation"]').form.querySelector('button').click()`);
 await waitFor('document.body.innerText.includes("Policy change recorded")');
 await check(`document.body.innerText.includes("p06-case") && !document.body.innerText.includes("server-only-token")`,'P06 recorded change has safe receipt');
 await evaluate(`document.querySelector('input[name="reference"]').value='rollback';document.querySelector('button[value="rollback"]').click()`);
 await waitFor('document.body.innerText.includes("Review policy change")');
 await check(`!!document.querySelector('input[name="acknowledged"][required]')`,'P06 rollback requires a new review');
 await identity('operator-aal1');await navigate('/platform');
 await check(`document.body.innerText.includes("Verify with MFA to administer") && !!document.querySelector('a[href="/security"]')`,'P06 AAL1 operator cannot administer');
 await navigate('/onboarding');
 await check(`document.body.innerText.includes("My account") && !document.body.innerText.includes("Verify with MFA to administer")`,'P06 AAL1 account setup remains available');
 await identity('operator');
 await navigate('/logout');
 await check(`document.body.innerText.includes("Log out of this portal?")`,'U11 logout requires confirmation');
 await evaluate(`document.querySelector('form[action="/logout"] button').click()`);
 await waitFor('location.pathname === "/logged-out"');
 await check(`!!document.querySelector('a[href="/login"]') && !document.querySelector('a[href="/logout"]')`,'U11 logout updates controls');
 console.log(JSON.stringify({checks,result:'passed',scope:'isolated browser and synthetic providers; live OTP/email not inferred'}));
}finally{await call('Target.closeTarget',{targetId});ws.close();}