{{-- Refreshes every form's CSRF token from a live request, so a cached/stale page
     token can never cause a 419 "Page Expired" on add-to-cart or checkout. --}}
<script>
(function () {
    function applyToken(token) {
        if (!token) return;
        document.querySelectorAll('input[name="_token"]').forEach(function (input) {
            input.value = token;
        });
    }
    fetch('{{ url('/csrf-token') }}', {
        headers: { 'Accept': 'application/json' },
        credentials: 'same-origin',
        cache: 'no-store'
    })
        .then(function (r) { return r.ok ? r.json() : null; })
        .then(function (data) { if (data && data.token) applyToken(data.token); })
        .catch(function () { /* keep the server-rendered token as fallback */ });
})();
</script>