12, 'note' => 'opaque to callers', ]; $token = BaselineEvidenceResumeToken::encode($state); expect($token)->toBeString(); expect($token)->not->toContain('+'); expect($token)->not->toContain('/'); expect($token)->not->toContain('='); $decoded = BaselineEvidenceResumeToken::decode($token); expect($decoded)->toBe($state); }); it('returns null for invalid resume tokens', function (): void { expect(BaselineEvidenceResumeToken::decode(''))->toBeNull(); expect(BaselineEvidenceResumeToken::decode('not-base64url'))->toBeNull(); $payload = json_encode(['v' => 999, 'state' => ['offset' => 1]], JSON_THROW_ON_ERROR); $token = rtrim(strtr(base64_encode($payload), '+/', '-_'), '='); expect(BaselineEvidenceResumeToken::decode($token))->toBeNull(); });