param([ValidateSet('start','stop')][string]$Action = 'start', [ValidateRange(1024,65535)][int]$Port = 8001, [switch]$ResumeIndustrialBudget)
$ErrorActionPreference = 'Stop'
$sgfProject = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
if ($sgfProject -ne 'C:\laragon\www\sgf-tempo') { throw 'Unexpected project path.' }
$sgfPhp = 'C:\laragon\tools\sgf-tempo\php-8.4.27\php.exe'
$sgfRun = 'C:\laragon\data\sgf-tempo\run'
$recordFile = Join-Path $sgfRun 'browser-proof.json'
Set-Location -LiteralPath $sgfProject
if ($Action -eq 'stop') {
    if (Test-Path -LiteralPath $recordFile) {
        $record = Get-Content -LiteralPath $recordFile -Raw | ConvertFrom-Json
        $process = Get-Process -Id $record.pid -ErrorAction SilentlyContinue
        if ($process) {
            if ($process.Path -ne $sgfPhp -or $process.StartTime.ToUniversalTime().ToString('o') -ne $record.started) { throw 'Process identity mismatch; no process stopped.' }
            Stop-Process -Id $process.Id
        }
        Remove-Item -LiteralPath $recordFile
    }
    $fixtureFile = 'C:\laragon\data\sgf-tempo\secrets\browser-fixture.json'
    if (Test-Path -LiteralPath $fixtureFile) { Remove-Item -LiteralPath $fixtureFile }
    Write-Output 'Browser proof server stopped. Synthetic data remains only in sgf_tempo_test until the next test run.'
    exit 0
}
if (Get-NetTCPConnection -LocalPort $Port -State Listen -ErrorAction SilentlyContinue) { throw "Port $Port occupied; no process was stopped." }
if (Test-Path -LiteralPath $recordFile) { throw 'Browser proof record exists; stop that proof first.' }
if ($ResumeIndustrialBudget) {
    & $sgfPhp scripts/industrial-budget-manual-prepare.php --env=testing
} else {
    & $sgfPhp scripts/prepare-browser-fixture.php --env=testing
}
if ($LASTEXITCODE) { throw 'Could not prepare synthetic fixtures.' }
$utf8 = New-Object Text.UTF8Encoding $false
$lines = Get-Content -LiteralPath '.env.testing' | Where-Object { $_ -notmatch '^(APP_ENV|APP_URL|SESSION_DRIVER|SESSION_COOKIE|SESSION_FILES|CACHE_STORE|CACHE_FILE_PATH|CACHE_LOCK_PATH)=' }
$lines += @('APP_ENV=browser-testing',"APP_URL=http://127.0.0.1:$Port",'SESSION_DRIVER=file','SESSION_COOKIE=sgf_browser_proof',
    'SESSION_FILES=C:/laragon/www/sgf-tempo/storage/framework/browser-proof/sessions', 'CACHE_STORE=file',
    'CACHE_FILE_PATH=C:/laragon/www/sgf-tempo/storage/framework/browser-proof/cache', 'CACHE_LOCK_PATH=C:/laragon/www/sgf-tempo/storage/framework/browser-proof/locks')
[IO.File]::WriteAllLines((Join-Path $sgfProject '.env.browser-testing'), $lines, $utf8)
$account = [Security.Principal.WindowsIdentity]::GetCurrent().Name
& icacls.exe '.env.browser-testing' /inheritance:r /grant:r "${account}:F" 'SYSTEM:F' | Out-Null
New-Item -ItemType Directory -Path 'storage\framework\browser-proof\sessions','storage\framework\browser-proof\cache','storage\framework\browser-proof\locks' -Force | Out-Null
$env:APP_ENV = 'browser-testing'
try {
    if (Get-NetTCPConnection -LocalPort $Port -State Listen -ErrorAction SilentlyContinue) { throw "Port $Port became occupied; no process stopped." }
    $process = Start-Process -FilePath $sgfPhp -ArgumentList @('-S',"127.0.0.1:$Port",'-t','public','scripts/router.php') -WorkingDirectory $sgfProject -WindowStyle Hidden -PassThru -RedirectStandardOutput "$sgfRun\browser-proof.stdout.log" -RedirectStandardError "$sgfRun\browser-proof.stderr.log"
    @{pid=$process.Id;started=$process.StartTime.ToUniversalTime().ToString('o');port=$Port} | ConvertTo-Json | Set-Content -LiteralPath $recordFile -Encoding UTF8
} finally { Remove-Item Env:APP_ENV -ErrorAction SilentlyContinue }
Write-Output "Browser proof: http://127.0.0.1:$Port - synthetic data only, isolated session/cache, CSRF enabled."