### E2E Tests: Runtime Public-Config Data Island

**Suite ID:** `RUNTIME-CONFIG-E2E`
**Feature:** Runtime resolution of public client config via an inert JSON data
island injected into `<head>` (Sentry, GTM, API base/docs URL, and reserved keys). Each third-party integration
resolves to a value only when its `UI_*_ENABLED` flag is `"true"`, so a disabled
integration is exposed as `null`.

---

## Test Case: `RUNTIME-CONFIG-E2E-001` - Island rendered in `<head>` before the client bundle

**Priority:** `critical`
**Tags:** @e2e, @runtime-config

**Preconditions:**

- UI server running with `UI_API_BASE_URL` set (the playwright `webServer` provides it).

### Flow Steps

1. Navigate to `/sign-in` (unauthenticated; the island renders on every route).
2. Locate `script#__PROWLER_RUNTIME_CONFIG__`.

### Expected Result

- The island exists, is `type="application/json"` (inert), and lives in `<head>`.
- The island appears before the first ordered (non-`async`) bundle `<script src>` — Next.js's `async` chunk-preloads in `<head>` don't execute in order and are excluded.
- It parses as JSON exposing exactly the allowlisted keys and a truthy `apiBaseUrl`.

### Key Verification Points

- In-`<head>`-before-bundle ordering guarantee (not provable in jsdom).
- Only the allowlisted shape is exposed (no other env leaks).

---

## Test Case: `RUNTIME-CONFIG-E2E-002` - Browser Sentry init matches the island DSN

**Priority:** `high`
**Tags:** @e2e, @runtime-config

**Preconditions:**

- UI server running. Sentry may be enabled (`UI_SENTRY_ENABLED=true` with `UI_SENTRY_DSN`) or off.

### Flow Steps

1. Navigate to `/sign-in`.
2. Read `sentryDsn` from the island.
3. Read the DSN the browser Sentry client initialized with.

### Expected Result

- If the island carries a DSN, the browser Sentry client initialized with that
  exact runtime DSN (proving the island feeds `Sentry.init` race-free).
- If the island has no DSN, Sentry is not initialized (zero egress — the default).

### Key Verification Points

- The runtime DSN reaches module-load Sentry init via the island.
- Unset DSN ⇒ no Sentry initialization (privacy guarantee).

---

## Test Case: `RUNTIME-CONFIG-E2E-003` - Zero third-party telemetry when Sentry and GTM are unset

**Priority:** `critical`
**Tags:** @e2e, @runtime-config

**Preconditions:**

- UI server running with Sentry and Google Tag Manager disabled — their `UI_SENTRY_ENABLED` and `UI_GOOGLE_TAG_MANAGER_ENABLED` flags unset, the Enterprise default — so the island exposes both as `null` (the test skips when either is enabled and configured).

### Flow Steps

1. Navigate to `/sign-in` and read the island config.
2. Reload while recording requests to `googletagmanager.com`, `google-analytics.com`, and `sentry.io`.
3. Inspect the DOM for a Google Tag Manager script.

### Expected Result

- No request is sent to any Google or Sentry host.
- The `GoogleTagManager` component is not rendered (no `gtm.js` script).

### Key Verification Points

- Enterprise default sends zero error/analytics telemetry to any third party.
- Empty/unset GTM id ⇒ component not mounted (an empty id is NOT inert).
