{{-- Keeps CSRF tokens on this page fresh so a long-open or back-button-restored
     tab never submits a dead token (the "419 Page Expired" screen). --}}
<script>
    (function () {
        var ENDPOINT = '{{ route('csrf-token') }}';
        var REFRESH_EVERY_MS = 10 * 60 * 1000; // well inside the session lifetime
        var inFlight = false;

        function apply(token) {
            if (!token) return;

            var meta = document.querySelector('meta[name="csrf-token"]');
            if (meta) meta.setAttribute('content', token);

            var inputs = document.querySelectorAll('input[name="_token"]');
            for (var i = 0; i < inputs.length; i++) {
                inputs[i].value = token;
            }
        }

        function refresh() {
            if (inFlight || document.visibilityState === 'hidden') return;
            inFlight = true;

            fetch(ENDPOINT, {
                credentials: 'same-origin',
                headers: { 'Accept': 'application/json' },
                cache: 'no-store'
            })
                .then(function (response) { return response.ok ? response.json() : null; })
                .then(function (data) { if (data) apply(data.token); })
                .catch(function () { /* offline or blocked — the server-side handler still covers us */ })
                .finally(function () { inFlight = false; });
        }

        // Restored from the back/forward cache: the embedded token may be hours old.
        window.addEventListener('pageshow', function (event) {
            if (event.persisted) refresh();
        });

        document.addEventListener('visibilitychange', function () {
            if (document.visibilityState === 'visible') refresh();
        });

        window.setInterval(refresh, REFRESH_EVERY_MS);
    })();
</script>