// Page-context backup writer for the App List version cookie. Runs at
// document_start on every groupass.yusharwz.my.id navigation.
//
// Why this exists in addition to the SW-side setVersionCookie():
// chrome.cookies.set from the service worker only runs once the SW has
// woken up, and MV3 aggressively idle-kills the SW. On a fresh browser
// session (or right after the SW was killed) there is a window where the
// session-scoped `groupass_app_version` cookie has not been written yet
// while the page is already issuing its first GET /auth/me. The backend
// then sees no X-App-Version header, reports extension_ok=false, and omits
// groupy_token from the response — which the page treats as "extension bad"
// and PURGES the user's groupy_token. That is the false-logout-from-Canva
// race users hit when they open the web and immediately use the App List.
//
// A content-script document.cookie write runs in the page's own origin at
// document_start — before ANY page script runs — and hits the cookie jar
// directly, so the value is guaranteed visible to the page's very first
// document.cookie read (and therefore to the X-App-Version it sends on
// /auth/me). This makes the cookie reliably present IFF App List is
// installed and enabled:
//   - installed/enabled → cookie set instantly → token kept
//   - disabled/uninstalled → this script never runs AND Guard's
//     management.onDisabled cleanup removes the cookie → backend omits
//     groupy_token → token purged in real time (security preserved)
//   - outdated → writes the OLD manifest version → backend sees it's below
//     the required minimum → token purged in real time (security preserved)
//
// Session cookie (no expires) and host-only (no domain) to match the
// SW-side setVersionCookie() lifecycle. Cleared by:
//   - Browser close (session scope)
//   - App List's uninstall URL handler (extension-uninstalled.html)
//   - Guard's chrome.management.onDisabled cleanup when App List is disabled
(function () {
  "use strict";
  try {
    if (location.hostname !== "groupass.yusharwz.my.id") return;
    const version = chrome.runtime.getManifest().version;
    if (!version) return;
    const secure = location.protocol === "https:" ? "Secure;" : "";
    document.cookie =
      "groupass_app_version=" +
      version +
      "; path=/; SameSite=Lax; " +
      secure;
  } catch (_) {}
})();
