/* ============================================================
   lrg-portal.js — shared portal behaviors for all LRG apps
   v1.3.2 · 2026-08-04 · ship alongside lrg.css at /lrg-assets/
   (v1.3.2: fix identity coverage — identify() now waits for an ESTABLISHED Umami
   session (getSession().cache set by the first pageview) before firing, then
   re-asserts once, instead of racing the pageview; ~78% of sessions were landing
   unidentified, which capped role analysis and blocked retention.)
   (v1.3.1: (a) focusSearch also matches a "Search…" placeholder input, so ⌘K/'/'
   reaches apps with their own header search (Audit's #hSearch); (b) search-query
   telemetry — "Search Performed" now logs {query, results} (capped 60ch, self-
   hosted Umami) so results:0 surfaces gaps, and result rows carry the query +
   destination for click correlation.)
   (v1.3.0: universal-search upgrade — shared result helpers (LRG.scoreMatch/
   matchHTML/iconInner/initialsOf), relevance ranking + <mark> highlighting for
   local groups, agent headshot avatars (r.avatar, asset-host-gated, initials
   fallback), per-group caps with "See all" tails, and a global '/' + ⌘K/Ctrl-K
   focus-search hotkey. Same helpers back launchpad's hero search + the BookStack
   head. Agents provider now returns `avatar` from the roster Headshot Slug.)
   (v1.2.2: Audit tile → v2 container (/audit) on ALL hosts — v2 promoted to prod;
   the strangler host-gate ternary is retired now that team.loyaltyrealtygroup.com/audit
   is live behind its Authentik app binding.)
   (v1.2.1: enable web-vitals — Umami v3 gates the performance collector behind
   data-performance="true"; without it LCP/FCP/CLS/INP/TTFB were never sent, so
   the Performance tab stayed empty. Server stores them as event_type=5 rows.)
   (v1.2.0: analytics depth — umami.identify() attaches a pseudonymous (hashed)
   user id + role/groups so usage segments by WHO/role; global JS-error events
   as a friction signal; universal-search usage + result-open events. Event
   taxonomy in docs/analytics-events.md.)
   (v1.1.1: Audit tile → v2 container (/audit) on team-qa; prod stays on the v1
   n8n app (/fub-audit) until v2 is promoted — strangler cutover.)
   (v1.1.0: same-origin analytics — load the tracker from team.'s /stats/
   proxy instead of analytics., so web-vitals beacons (flushed on tab-hide)
   deliver reliably; cross-origin unload fetches were being dropped, leaving
   the Performance tab empty. + apps-launcher navigation events via
   data-umami-event, and an LRG.track(name, data) helper for apps.)
   (v1.0.9: centralized Umami analytics — inject the tracker from here so
   every app that loads lrg-portal.js is tracked as ONE property (the team
   portal). Prod team. host only, so team-qa, the NocoDB roster (people.),
   BookStack (docs.) and local dev never send events. Plus a hashchange
   hook so hash-routed tabs (e.g. People #my-profile) count as distinct
   pageviews — Umami auto-tracks pushState but not hashchange.)
   (v1.0.8: fix "Sign out" — the old /outpost.goauthentik.io/sign_out link
   crashes with a 502 on this Authentik instance (server-side bug, no log
   line even emitted); point it at the real global invalidation flow
   instead, which was confirmed working.)
   (v1.0.7: "My Contacts" universal search group — live FUB lookup for
   the signed-in agent's own book via the gated /api/search/contacts
   proxy; non-linked users just get no group. Opens in a new tab.)
   (v1.0.6: permanent "Getting started" link in the account sections)
   (v1.0.5: clicking the header logo returns to the Launchpad from any
   app page; no-op on the Launchpad itself)
   (v1.0.4: env-aware app links — team-hosted apps use host-relative hrefs
   on team./team-qa. so QA stays in QA; other hosts still link prod.
   Re-engagement deep-links /webhook/reengage, valid on both envs)
   (v1.0.1: group hierarchy — admins⊃all, team-lead/recruiting⊃staff)
   (v1.0.2: `accountLink` apps (My Profile) render in the account rows of
   the apps-launcher menu, not the tile grid — see LRG.apps + buildAppsMenu)
   (v1.0.3: P2 — auto-register live Docs/Agents search providers on
   team./team-qa. hosts against the gated /api/search/* proxy endpoints)
   Provides: theme init/toggle · identity (whoami) · app registry
   · apps-launcher menu · universal search (browse-on-focus, New
   badges, grouped results) · account links.
   Usage (backslashes only escape the tag for safe inlining):
     <script>window.LRG_WHOAMI='/whoami';<\/script>  (optional override)
     <script src="/lrg-assets/lrg-portal.js"><\/script>
     <script>LRG.initHeader({currentApp:'cadence'});<\/script>
   Identity comes ONLY from the SSO-gated /whoami endpoint (Caddy
   injects X-Authentik-* — never trust client-supplied identity).
   ============================================================ */
(function () {
  "use strict";

  var LRG = (window.LRG = window.LRG || {});

  /* Team-apps base: on the team hosts (prod team. and team-qa.) links are
     host-relative so each environment stays self-contained; on any other
     host (docs., people., ...) they point at prod. */
  var TEAM = /^team(-qa)?\./.test(location.hostname) ? "" : "https://team.loyaltyrealtygroup.com";

  /* ---- analytics (Umami) --------------------------------------- */
  /* One place to track every app that loads this file, under a single
     Umami "website" (the team portal property). Runs ONLY on the prod
     team host, so team-qa, the NocoDB roster (people.), BookStack (docs.)
     and local dev stay out of the numbers. Tracker + ingest are served
     SAME-ORIGIN from team.'s /stats/ proxy (Caddy handle_path → umami), so
     web-vitals beacons flushed on tab-hide deliver reliably — a cross-origin
     analytics. endpoint dropped them, leaving the Performance tab empty. */
  (function initUmami() {
    if (location.hostname !== "team.loyaltyrealtygroup.com") return;

    /* Load the tracker — but not twice if a page still ships its own
       inline tag (people-app currently does; harmless during rollout). */
    try {
      if (!document.querySelector("script[data-website-id]")) {
        var s = document.createElement("script");
        s.defer = true;
        s.src = "/stats/script.js"; // same-origin proxy → posts to /stats/api/send
        s.setAttribute("data-website-id", "69363e79-f3f0-4b12-ba58-b074962fec87");
        s.setAttribute("data-performance", "true"); // Umami v3: web-vitals (LCP/FCP/CLS/INP/TTFB) are opt-in — the collector only runs when this is set
        (document.head || document.documentElement).appendChild(s);
      }
    } catch (e) { /* analytics must never break an app */ }

    /* Umami auto-tracks History API navigations (pushState/replaceState)
       but not hashchange. Apps that route tabs via location.hash (People,
       etc.) would otherwise collapse into one pageview — mirror each hash
       change into a pageview that keeps the hash in the URL. Runs whether
       the tracker was injected here or inline (window.umami is shared). */
    try {
      window.addEventListener("hashchange", function () {
        try {
          if (window.umami && typeof window.umami.track === "function") {
            window.umami.track(function (p) {
              return Object.assign({}, p, {
                url: location.pathname + location.search + location.hash
              });
            });
          }
        } catch (e) {}
      });
    } catch (e) {}
  })();

  /* Programmatic event helper for apps: LRG.track('Audit Run', {rows: 12}).
     Safe no-op until the tracker has loaded and on non-prod hosts. */
  LRG.track = function (name, data) {
    try {
      if (window.umami && typeof window.umami.track === "function") {
        return data ? window.umami.track(name, data) : window.umami.track(name);
      }
    } catch (e) {}
  };

  /* --- P1: pseudonymous user + role identity, so usage segments by WHO/role.
     Attach a HASH of the email (no raw PII stored in analytics) plus role +
     groups. Fired off the lrg:identity event once /whoami resolves; retries
     until the deferred tracker is live. Prod host only (matches tracker gate).
     To attribute by real name instead, swap `raw` hashing for the email. --- */
  function lrgHash32(s) {
    var h = 0x811c9dc5 >>> 0;
    for (var i = 0; i < s.length; i++) { h ^= s.charCodeAt(i); h = Math.imul(h, 0x01000193) >>> 0; }
    return h.toString(36);
  }
  LRG.identify = function (identity) {
    try {
      if (location.hostname !== "team.loyaltyrealtygroup.com") return;
      if (!identity || identity.preview) return;
      var raw = identity.email || identity.username || identity.name;
      if (!raw) return;
      var pseudo = "u" + lrgHash32(String(raw).trim().toLowerCase());
      var props = { role: identity.roleKey || identity.role || "unknown", groups: (identity.groups || []).join(",") };
      function fire() { try { window.umami.identify(pseudo, props); } catch (e) {} }
      var n = 0;
      (function attempt() {
        var u = window.umami;
        if (u && typeof u.identify === "function") {
          // Only identify once the tracker has an ESTABLISHED session — i.e. its
          // first pageview has been sent so getSession().cache is set. Calling
          // identify before that races the pageview and usually fails to persist
          // (root cause of ~78% of sessions landing unidentified). Then re-assert
          // once the session has fully settled server-side.
          var ready = true;
          try { var s = typeof u.getSession === "function" ? u.getSession() : null; ready = !s || !!s.cache; } catch (e) {}
          if (ready) { fire(); setTimeout(fire, 4000); return; }
        }
        if (n++ < 100) setTimeout(attempt, 200); // wait up to ~20s for tracker + session
      })();
    } catch (e) {}
  };
  document.addEventListener("lrg:identity", function (e) { LRG.identify(e.detail); });

  /* --- P2: client-side errors as a friction signal (deduped + capped so a
     broken page can't flood analytics); the page path helps locate it. --- */
  (function () {
    if (location.hostname !== "team.loyaltyrealtygroup.com") return;
    var seen = {}, sent = 0;
    function report(msg, src) {
      try {
        msg = String(msg == null ? "" : msg).slice(0, 140);
        if (!msg || seen[msg] || sent >= 10) return;
        seen[msg] = 1; sent++;
        LRG.track("JS Error", { msg: msg, src: String(src || "").split("/").pop().slice(0, 60), page: location.pathname });
      } catch (e) {}
    }
    window.addEventListener("error", function (e) { report(e && e.message, e && e.filename); });
    window.addEventListener("unhandledrejection", function (e) {
      var r = e && e.reason; report((r && r.message) || r, "promise");
    });
  })();

  /* ---- registry ------------------------------------------------ */
  /* Access truth mirrors Caddy/Authentik enforcement (see
     team-portal/design-system/DEPLOY-P0-P1.md for divergences from
     the mockup registry, confirmed against the live Caddyfile). */
  LRG.apps = [
    { id: "dashboard", name: "Agent Dashboard", desc: "Your book at a glance",
      href: TEAM + "/agent-dashboard",
      groups: ["staff"], icon: ["M3 3h8v10H3zM13 3h8v6h-8zM13 11h8v10h-8zM3 15h8v6H3z"] },
    { id: "cadence", name: "Audit", desc: "Lead follow-up audits",
      // v2 promoted to prod 2026-08-03: /audit (the containerized rebuild) on both hosts,
      // behind the Authentik app binding for team.loyaltyrealtygroup.com/audit.
      href: TEAM + "/audit",
      groups: ["staff"], icon: ["M9 11l3 3 6-6", "M20 12v7a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1h10"] },
    { id: "profile", name: "My Profile", desc: "Your contact & licensing",
      // Repointed into People's My Profile tab 2026-07-26 -- profile-app
      // itself is UNCHANGED and still running (Email Signature's headshot
      // lookup and the launchpad's onboarding-tour-pill check both still
      // depend on it directly; see people-app/DEPLOY.md before touching it).
      href: TEAM + "/people#my-profile",
      groups: ["staff"], isNew: true, accountLink: true,
      icon: ["M4 20c0-3.3 3.6-6 8-6s8 2.7 8 6", { t: "c", cx: 12, cy: 8, r: 4 }] },
    { id: "signature", name: "Email Signature", desc: "Build your branded signature",
      // Repointed into People's My Signature tab 2026-07-27 (D-009: the
      // signature app is now a pure render+copy tab, zero inputs -- every
      // field it used to ask for is authored in My Profile instead).
      // team-signature-confirm itself is UNTOUCHED and still running --
      // same parallel-front-door transition as My Profile/profile-app.
      href: TEAM + "/people#my-signature",
      groups: ["staff"],
      icon: [{ t: "r", x: 3, y: 5, w: 18, h: 14, rx: 2 }, "M3 7l9 6 9-6"] },
    { id: "roster", name: "Team Roster", desc: "Directory & contacts",
      href: TEAM + "/roster",
      groups: ["staff"],
      icon: [{ t: "c", cx: 9, cy: 8, r: 3.2 }, "M3 19c0-2.8 2.7-5 6-5s6 2.2 6 5", { t: "c", cx: 17.5, cy: 9, r: 2.6 }, "M21 18c0-2.2-1.8-4-4-4"] },
    { id: "reengage", name: "Client Re-engagement", desc: "Win-back worklist",
      href: TEAM + "/webhook/reengage",
      groups: ["admins"], gated: "Admins", isNew: true,
      icon: ["M3 12a9 9 0 1 0 3-6.7", "M3 4v4h4", "M12 8v4l3 2"] },
    { id: "email-studio", name: "Email Studio", desc: "Branded email templates for FUB",
      href: TEAM + "/email-studio",
      groups: ["staff"], isNew: true,
      // Pencil/compose glyph -- "signature" already owns the envelope shape
      // ({t:"r",...} + flap above), so this needed a visually distinct icon.
      icon: ["M12 20h9", "M16.5 3.5a2.1 2.1 0 0 1 3 3L7 19l-4 1 1-4Z"] },
    { id: "print-studio", name: "Print Studio", desc: "Personalize & print your tri-folds",
      href: TEAM + "/print-studio",
      groups: ["staff"], isNew: true,
      icon: [{ t: "r", x: 4, y: 8, w: 16, h: 8, rx: 1.5 }, "M7 8V4h10v4", { t: "r", x: 7, y: 15, w: 10, h: 5, rx: 0.5 }] },
    { id: "drawio", name: "Draw.io", desc: "Flowcharts & diagrams",
      href: "https://draw.loyaltyrealtygroup.com",
      groups: ["staff"], isNew: true,
      icon: [{ t: "r", x: 3, y: 4, w: 8, h: 6, rx: 1 }, { t: "r", x: 13, y: 14, w: 8, h: 6, rx: 1 }, "M7 10v3a2 2 0 0 0 2 2h4"] },
    { id: "kb", name: "Knowledge Base", desc: "Runbooks & guides (BookStack)",
      href: "https://docs.loyaltyrealtygroup.com",
      groups: ["staff"],
      icon: ["M4 5a2 2 0 0 1 2-2h8l4 4v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2z", "M8 8h6M8 12h8M8 16h5"] },
    { id: "people", name: "People", desc: "Recruiting, roster & your profile",
      href: TEAM + "/people",
      groups: ["staff"], isNew: true,
      // Design bundle's own app-people.svg is a heart shape -- inconsistent
      // with every sibling icon (profile/roster are literal person glyphs) --
      // almost certainly an asset-export mismatch. Substituted a person+plus
      // glyph in the same stroke style pending a real icon from Javi.
      icon: [{ t: "c", cx: 9, cy: 8, r: 3.3 }, "M2 20c0-3.2 3.1-5.6 7-5.6s7 2.4 7 5.6", "M18 8v6", "M15 11h6"] },
    { id: "nocodb", name: "Roster DB (raw)", desc: "Admin escape hatch — NocoDB",
      href: "https://people.loyaltyrealtygroup.com",
      groups: ["admins"], gated: "Admins",
      icon: [{ t: "r", x: 4, y: 4, w: 16, h: 16, rx: 2 }, "M4 10h16M10 10v10"] },
    { id: "launchpad-admin", name: "Launchpad Links", desc: "Manage link sections & shortcuts",
      href: TEAM + "/launchpad-admin",
      groups: ["admins"], gated: "Admins",
      icon: ["M10 14a4 4 0 0 0 6 .5l3-3a4 4 0 0 0-5.5-5.8L12 7", "M14 10a4 4 0 0 0-6-.5l-3 3a4 4 0 0 0 5.5 5.8L12 17"] },
    { id: "access-admin", name: "Access Control", desc: "Page & tab access by role",
      href: TEAM + "/access-admin",
      groups: ["admins"], gated: "Admins", isNew: true,
      icon: ["M12 3l7 3v5c0 4-3 6.7-7 8-4-1.3-7-4-7-8V6z", "M9.2 12l2 2 3.6-3.8"] },
    { id: "n8n", name: "Team n8n", desc: "Automation workflows",
      href: "https://n8n.loyaltyrealtygroup.com",
      groups: ["admins"], gated: "Admins",
      icon: [{ t: "c", cx: 6, cy: 12, r: 2.4 }, { t: "c", cx: 18, cy: 6, r: 2.4 }, { t: "c", cx: 18, cy: 18, r: 2.4 }, "M8.2 11 15.8 6.8M8.2 13l7.6 4.2"] },
    { id: "status", name: "System Status", desc: "Uptime monitor",
      href: "https://status.loyaltyrealtygroup.com",
      groups: ["admins"], gated: "Admins",
      icon: ["M3 12h4l2 6 4-14 2 8h6"] }
  ];

  /* Fallback only — the live source of truth is the "Launchpad Links" NocoDB
     table, served via /webhook/launchpad-links and fetched into LRG.linkCats
     below (LRG.linksReady). This array renders only if that fetch fails, so
     the launchpad/header search never go blank on an n8n hiccup. Manage the
     live data at /launchpad-admin (admins), not here. */
  LRG.linkCatsFallback = [
    { name: "Education", links: [
      { name: "Zillow Academy", host: "academy.zillowgroup.com", badge: "ZA", href: "https://academy.zillowgroup.com/learn/signin" },
      { name: "Ylopo Training", host: "loyaltyrealtygroup.com/tools", badge: "Y", href: "https://www.loyaltyrealtygroup.com/tools" },
      { name: "Nebraska Realty Resource", host: "realtorresource.info", badge: "NR", href: "https://realtorresource.info/dashboard" }
    ]},
    { name: "MLS", links: [
      { name: "GPRMLS (Paragon)", host: "gprmls.paragonrels.com", badge: "GP", href: "https://gprmls.paragonrels.com/" },
      { name: "Southwest Iowa MLS", host: "swi.flexmls.com", badge: "SW", href: "https://swi.flexmls.com/ticket" },
      { name: "RPR", host: "narrpr.com", badge: "RP", href: "https://www.narrpr.com/home" },
      { name: "ShowingTime", host: "showingtime.com", badge: "ST", href: "https://agent.showingtime.com/" }
    ]},
    { name: "Zillow", links: [
      { name: "Zillow", host: "zillow.com", badge: "Z", href: "https://www.zillow.com/" },
      { name: "Premier Agent", host: "zillow.com/premier-agent", badge: "PA", href: "https://www.zillow.com/premier-agent/premium-profile/" },
      { name: "Zillow Pro (ShowCase)", host: "app.zillow-workspace.com", badge: "ZP", href: "https://app.zillow-workspace.com/" }
    ]},
    { name: "Tools", links: [
      { name: "Follow Up Boss", host: "followupboss.com", badge: "FUB", href: "https://nebraskarealty3.followupboss.com/2/" },
      { name: "cal.novacat.cc", host: "scheduling", badge: "CAL", href: "https://cal.novacat.cc/" }
    ]}
  ];
  LRG.linkCats = LRG.linkCatsFallback;

  /* Page & tab permissions (Phase 2, 2026-07-29): the same /webhook/launchpad-links
     response now also carries pagePerms[] (one row per governed page/tab, from the
     Page Permissions NocoDB table that People > Settings edits). LRG.canSee consults
     it for launchpad tile visibility, and Cadence reads it (via LRG.pageVisible) for
     its own lead tabs. Empty by default → every consumer falls back to its own static
     rule (tile.groups / IS_LEAD) if the fetch fails or a key has no row, so nothing
     regresses on an n8n hiccup. The seeded rows replicate today's behavior exactly,
     so even before any admin edit the table-driven result matches the static one. */
  LRG.pagePerms = [];

  /* Live link sections, fetched from the "Launchpad Links" n8n workflow
     (backed by NocoDB, editable at /launchpad-admin). searchLocal() and the
     launchpad's own render() both read LRG.linkCats fresh on every call, so
     reassigning it here is all that's needed for the update to reach every
     portal page's header search as well as the launchpad grid — no changes
     needed to searchProviders/attachSearch. On fetch failure, LRG.linkCats
     simply keeps LRG.linkCatsFallback's value (set just above). Same fetch now
     also populates LRG.pagePerms (see above). */
  /* The launchpad-links webhook is same-origin-only (no CORS). On the team
     hosts (TEAM === "") fetch it; on an off-team host that ships this file
     (docs. via the BookStack head, people., …) skip the doomed cross-origin
     request and just keep LRG.linkCatsFallback — no console noise, instant. */
  LRG.linksReady = TEAM
    ? Promise.resolve()
    : fetch("/webhook/launchpad-links", { credentials: "same-origin" })
        .then(function (r) { if (!r.ok) throw new Error(r.status); return r.json(); })
        .then(function (d) {
          if (d && Array.isArray(d.sections)) LRG.linkCats = d.sections;
          if (d && Array.isArray(d.pagePerms)) LRG.pagePerms = d.pagePerms;
        })
        .catch(function () { /* keep LRG.linkCatsFallback + empty LRG.pagePerms */ });

  LRG.accountLinks = [
    { name: "Getting started", desc: "Guided portal setup — take it anytime",
      href: TEAM + "/onboarding", badge: "GO" },
    { name: "Account & security", desc: "Password, MFA, sessions (Authentik)",
      href: "https://portal.loyaltyrealtygroup.com/if/user/", badge: "AK" },
    { name: "Sign out", desc: "End your session everywhere",
      href: "https://portal.loyaltyrealtygroup.com/flows/-/default/invalidation/", badge: "→" }
  ];

  /* ---- identity ------------------------------------------------ */
  LRG.whoamiUrl = window.LRG_WHOAMI || "/whoami";

  function roleFromGroups(groups) {
    if (groups.indexOf("admins") !== -1) return "Admin";
    if (groups.indexOf("team-lead") !== -1) return "Team Lead";
    if (groups.indexOf("recruiting") !== -1 || groups.indexOf("recruiter") !== -1) return "Recruiter";
    return "Agent";
  }

  /* Six-role resolution (Phase 2, 2026-07-29) -- the SAME order/logic as
     people-app's server.js resolveRole(), so the Page Permissions table (which
     has one column per role) is read consistently across the site. Distinct
     from roleFromGroups above, which is a coarser DISPLAY label (no staff/
     observer). MUST run on the RAW groups, not expandGroups()'d ones: an agent
     expands to include "staff", which would misresolve them as staff -- staff
     is checked before the agent fallback, exactly as people-app does (a user in
     both staff and agent resolves to staff, the established behavior). */
  function resolveRole(groups) {
    var has = function (g) { return groups.indexOf(g) !== -1; };
    if (has("admins")) return "admin";
    if (has("leads") || has("team-lead")) return "lead";
    if (has("recruiting") || has("recruiter")) return "recruiter";
    if (has("staff")) return "staff";
    if (has("observers")) return "observer";
    return "agent";
  }
  LRG.resolveRole = resolveRole;

  /* Group hierarchy (PORTAL-DESIGN §5): staff is the baseline every team
     member has; team-lead and recruiting are staff-plus; admins see all.
     Authentik memberships are literal (an admin need not be in `staff`),
     so expand before filtering tiles/menu/search. NOTE: forward-auth
     sessions cache group claims — Authentik group changes appear only
     after sign-out/sign-in. */
  function expandGroups(groups) {
    var g = groups.slice();
    var has = function (x) { return g.indexOf(x) !== -1; };
    if (has("admins")) ["staff", "team-lead", "recruiting", "recruiter"].forEach(function (x) { if (!has(x)) g.push(x); });
    if (has("team-lead") && !has("staff")) g.push("staff");
    if ((has("recruiting") || has("recruiter")) && !has("staff")) g.push("staff");
    // Javi split agents out of "staff" 2026-07-26 for the People app's role
    // model -- exact literal group name unconfirmed ("agent" per chat,
    // "agents" was this repo's working assumption before that), so both are
    // accepted here. Without this, that split would silently unpublish every
    // staff-gated tile (Agent Dashboard, Cadence, Email Signature, Roster,
    // People) from every agent's launchpad the moment they're moved, not just
    // People -- this keeps "staff" meaning "any team member" for tile
    // visibility, same as team-lead/recruiting above, while People's OWN
    // internal tabs still tell staff and agent apart via its finer-grained
    // role resolution.
    if ((has("agents") || has("agent")) && !has("staff")) g.push("staff");
    return g;
  }

  var idResolve;
  LRG.identity = null;
  LRG.ready = new Promise(function (res) { idResolve = res; });

  function finishIdentity(id) {
    LRG.identity = id;
    idResolve(id);
    document.dispatchEvent(new CustomEvent("lrg:identity", { detail: id }));
  }

  (function fetchIdentity() {
    // Local preview fallback: ?role=agent|team-lead|recruiter|admin
    var m = location.search.match(/[?&]role=(agent|team-lead|recruiter|admin)/);
    fetch(LRG.whoamiUrl, { credentials: "same-origin" })
      .then(function (r) { if (!r.ok) throw 0; return r.json(); })
      .then(function (j) {
        var groups = String(j.groups || "").split(/[|,]/).map(function (s) { return s.trim(); }).filter(Boolean);
        finishIdentity({
          email: j.email || "", name: j.name || j.username || "", username: j.username || "",
          groups: expandGroups(groups.length ? groups : ["staff"]),
          role: roleFromGroups(groups),
          // roleKey resolved from RAW groups (not the expanded set) so the Page
          // Permissions lookup uses the true 6-role identity -- see resolveRole.
          roleKey: resolveRole(groups.length ? groups : ["staff"]),
          firstName: (j.name || j.username || "there").split(" ")[0]
        });
      })
      .catch(function () {
        var previews = {
          "agent": { name: "Preview Agent", groups: ["staff"] },
          "team-lead": { name: "Preview Lead", groups: ["staff", "team-lead"] },
          "recruiter": { name: "Preview Recruiter", groups: ["staff", "recruiting"] },
          "admin": { name: "Preview Admin", groups: ["staff", "team-lead", "recruiting", "admins"] }
        };
        var p = previews[(m && m[1]) || "agent"];
        finishIdentity({ email: "", name: p.name, username: "", groups: p.groups,
          role: roleFromGroups(p.groups), roleKey: resolveRole(p.groups),
          firstName: p.name.split(" ")[0], preview: true });
      });
  })();

  /* Table-driven page/tab visibility (Phase 2, 2026-07-29). Returns true/false
     when the Page Permissions table (LRG.pagePerms) has a row for (app,key) and
     the current user's resolved role; returns null when it can't decide (perms
     not loaded, no role yet, or no matching row) so the CALLER falls back to its
     own static rule. Used by canSee below (app="launchpad", key=tile id) and by
     Cadence (app="cadence", key="team-view"). */
  LRG.pageVisible = function (app, key) {
    var pp = LRG.pagePerms;
    var role = LRG.identity && LRG.identity.roleKey;
    if (!pp || !pp.length || !role) return null;
    for (var i = 0; i < pp.length; i++) {
      if (pp[i].app === app && pp[i].key === key) {
        return (pp[i].levels && pp[i].levels[role]) === "visible";
      }
    }
    return null;
  };

  /* Launchpad tile visibility. Consults the Page Permissions table first (by the
     tile's `id`), and falls back to the tile's static `groups` array (the
     pre-Phase-2 behavior) whenever the table can't decide — so a failed perms
     fetch, or a tile with no row yet, degrades to exactly today's gating. The
     seeded rows replicate the static result, so steady-state is unchanged; an
     admin's edit in People > Settings is what makes this diverge. */
  LRG.canSee = function (app, groups) {
    var pv = LRG.pageVisible("launchpad", app.id);
    if (pv !== null) return pv;
    return app.groups.some(function (g) { return groups.indexOf(g) !== -1; });
  };

  /* ---- theme --------------------------------------------------- */
  var THEME_KEY = "lrg-theme";
  function applyTheme(t) {
    document.documentElement.setAttribute("data-theme", t);
    var btn = document.getElementById("theme-btn");
    if (btn) btn.innerHTML = t === "dark" ? "&#9728;" : "&#9790;";
  }
  (function initTheme() {
    var saved = null;
    try { saved = localStorage.getItem(THEME_KEY); } catch (e) {}
    var sys = window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)");
    applyTheme(saved || (sys && sys.matches ? "dark" : "light"));
    if (sys && sys.addEventListener) sys.addEventListener("change", function (e) {
      var s = null; try { s = localStorage.getItem(THEME_KEY); } catch (err) {}
      if (!s) applyTheme(e.matches ? "dark" : "light"); // follow system until user chooses
    });
  })();
  /* ---- logo → launchpad ---------------------------------------- */
  (function wireLogos() {
    if (location.pathname === "/" || location.pathname === "/index.html") return; // already home
    var logos = document.querySelectorAll(".lrg-logo");
    for (var i = 0; i < logos.length; i++) (function (el) {
      el.style.cursor = "pointer";
      el.setAttribute("role", "link");
      el.setAttribute("tabindex", "0");
      el.setAttribute("aria-label", (el.getAttribute("aria-label") || "Loyalty Realty Group") + " — back to the Team Portal");
      el.title = "Back to the Team Portal";
      function go() { location.href = TEAM + "/"; }
      el.addEventListener("click", go);
      el.addEventListener("keydown", function (e) {
        if (e.key === "Enter" || e.key === " ") { e.preventDefault(); go(); }
      });
    })(logos[i]);
  })();

  LRG.toggleTheme = function () {
    var next = document.documentElement.getAttribute("data-theme") === "dark" ? "light" : "dark";
    applyTheme(next);
    try { localStorage.setItem(THEME_KEY, next); } catch (e) {}
  };

  /* ---- svg helpers --------------------------------------------- */
  function svgIcon(parts, size) {
    var s = '<svg width="' + (size || 24) + '" height="' + (size || 24) +
      '" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">';
    parts.forEach(function (p) {
      if (typeof p === "string") s += '<path d="' + p + '"/>';
      else if (p.t === "c") s += '<circle cx="' + p.cx + '" cy="' + p.cy + '" r="' + p.r + '"/>';
      else if (p.t === "r") s += '<rect x="' + p.x + '" y="' + p.y + '" width="' + p.w + '" height="' + p.h + '" rx="' + (p.rx || 0) + '"/>';
    });
    return s + "</svg>";
  }
  LRG.svgIcon = svgIcon;

  function esc(s) {
    return String(s).replace(/[&<>"']/g, function (c) {
      return { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c];
    });
  }
  LRG.esc = esc;

  /* ---- apps launcher menu -------------------------------------- */
  function buildAppsMenu(container, currentApp, groups) {
    var vis = LRG.apps.filter(function (a) { return LRG.canSee(a, groups) && !a.accountLink; });
    var acctApps = LRG.apps.filter(function (a) { return LRG.canSee(a, groups) && a.accountLink; });
    var html = '<div class="lrg-eyebrow">Your apps</div><div class="lrg-app-grid">';
    vis.forEach(function (a) {
      html += '<a class="lrg-app-tile" href="' + esc(a.href) + '"' +
        ' data-umami-event="App Open" data-umami-event-app="' + esc(a.name) + '"' +
        (a.id === currentApp ? ' aria-current="page"' : "") + ">" +
        svgIcon(a.icon, 22) + "<span>" + esc(a.name) + "</span></a>";
    });
    html += '</div><div style="border-top:1px solid var(--lrg-border);margin:10px -12px 0;padding:8px 6px 0"><div class="lrg-eyebrow">Account</div>';
    acctApps.forEach(function (a) {
      html += '<a class="lrg-uresult" href="' + esc(a.href) + '" data-umami-event="App Open" data-umami-event-app="' + esc(a.name) + '">' +
        '<span class="lrg-uresult__icon">' + svgIcon(a.icon, 15) + '</span>' +
        '<span class="lrg-uresult__label">' + esc(a.name) +
        (a.isNew ? ' <span class="lrg-badge lrg-badge--brand">New</span>' : "") + "</span></a>";
    });
    LRG.accountLinks.forEach(function (l) {
      html += '<a class="lrg-uresult" href="' + esc(l.href) + '" data-umami-event="Account Link" data-umami-event-link="' + esc(l.name) + '">' +
        '<span class="lrg-uresult__icon">' + esc(l.badge) + '</span>' +
        '<span class="lrg-uresult__label">' + esc(l.name) + "</span></a>";
    });
    html += "</div>";
    container.innerHTML = html;
  }

  /* ---- universal search ---------------------------------------- */
  /* Providers for async groups (P2): set window.LRG.searchProviders =
     { agents: q => Promise<[{name,sub,href}]>, docs: q => Promise<[...]> } */
  LRG.searchProviders = LRG.searchProviders || {};

  /* Auto-register the live Docs/Agents/Contacts/Recruits providers on portal
     hosts. All hit gated same-origin endpoints; the server injects the
     trusted X-Authentik-Email/Groups, the client never sees a token. Docs/
     Agents/Contacts proxy Caddy -> team-n8n; Recruits proxies Caddy ->
     people-app directly (reuses people-app's own RECRUITING_TAB_ROLES
     instead of a duplicated n8n branch -- see DECISIONS.md D-010). Errors
     are swallowed by the caller (group just doesn't render). */
  if (/^team(-qa)?\.loyaltyrealtygroup\.com$/.test(location.hostname)) {
    ["docs", "agents", "contacts", "recruits"].forEach(function (key) {
      LRG.searchProviders[key] = function (q) {
        return fetch("/api/search/" + key + "?q=" + encodeURIComponent(q), { credentials: "same-origin" })
          .then(function (r) { if (!r.ok) throw 0; return r.json(); });
      };
    });
  }

  /* ---- shared result helpers ----------------------------------------
     Ranking, match-highlighting and agent avatars live here (exposed on
     LRG.*) so the header dropdown below, launchpad-app's hero search, and
     the BookStack head all share ONE implementation. Change once, land
     everywhere. */

  /* Relevance score for a local (apps/links) row: higher = better, -1 = miss.
     Cheap + good-enough: exact > prefix > word-boundary > substring, minus a
     small position penalty so an earlier match edges out a later one. */
  function scoreMatch(haystack, q) {
    if (!q) return 0;
    var h = String(haystack == null ? "" : haystack).toLowerCase();
    var i = h.indexOf(q);
    if (i === -1) return -1;
    var score = 100 - Math.min(i, 60);
    if (i === 0) score += 400;                               // prefix
    else if (/[\s·\-\/]/.test(h.charAt(i - 1))) score += 200; // word boundary
    if (h === q) score += 500;                                // exact
    return score;
  }
  LRG.scoreMatch = scoreMatch;

  /* Escape text, then wrap the first case-insensitive run of q in <mark>.
     Each segment is escaped independently, so this stays XSS-safe. */
  function matchHTML(text, q) {
    text = String(text == null ? "" : text);
    if (!q) return esc(text);
    var i = text.toLowerCase().indexOf(String(q).toLowerCase());
    if (i === -1) return esc(text);
    var n = String(q).length;
    return esc(text.slice(0, i)) + '<mark class="lrg-hl">' +
      esc(text.slice(i, i + n)) + "</mark>" + esc(text.slice(i + n));
  }
  LRG.matchHTML = matchHTML;

  function initialsOf(name) {
    var parts = String(name == null ? "" : name).trim().split(/\s+/).filter(Boolean);
    if (!parts.length) return "?";
    var a = parts[0].charAt(0) || "";
    var b = parts.length > 1 ? (parts[parts.length - 1].charAt(0) || "") : "";
    return ((a + b).toUpperCase().replace(/[^A-Z0-9]/g, "")) || "?";
  }
  LRG.initialsOf = initialsOf;

  /* Only ever trust an avatar URL on our own asset host (defense-in-depth:
     the roster field can't smuggle an off-domain image into the panel). */
  function safeAvatar(url) {
    return (url && /^https:\/\/assets\.loyaltyrealtygroup\.com\//.test(url)) ? url : "";
  }
  LRG.safeAvatar = safeAvatar;

  /* Inner HTML for a result's 26px icon box. Agent rows carry r.avatar; the
     <img> is overlaid on the initials so a 404 (onerror self-remove) falls
     back cleanly to initials. Everything else keeps its icon/badge. */
  function iconInner(r) {
    var av = safeAvatar(r.avatar);
    if (av) {
      return '<span class="lrg-ini">' + esc(initialsOf(r.name)) + "</span>" +
        '<img class="lrg-uresult__img" src="' + esc(av) +
        '" alt="" loading="lazy" onerror="this.remove()">';
    }
    return r.iconHtml || (r.badge ? esc(r.badge) : "");
  }
  LRG.iconInner = iconInner;

  /* Per-group result caps for the dropdown + the "See all" destinations.
     Keeps a common surname from dumping 40 agents into the panel. */
  var GROUP_CAP = { apps: 8, links: 6, agents: 5, docs: 5, contacts: 6, recruits: 6 };
  function moreDest(key, q) {
    if (key === "agents") return { label: "See all in Team Roster", href: TEAM + "/roster", newTab: false };
    if (key === "docs") return { label: "See all docs for “" + q + "”", href: "https://docs.loyaltyrealtygroup.com/search?term=" + encodeURIComponent(q), newTab: true };
    return null; // links/contacts/recruits: cap silently (no clean deep target)
  }
  function moreRow(label, href, newTab) {
    return '<a class="lrg-uresult lrg-uresult--more" href="' + esc(href) + '"' +
      (newTab ? ' target="_blank" rel="noopener"' : "") + ">" +
      '<span class="lrg-uresult__icon lrg-uresult__icon--more">' +
      '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M5 12h14M13 6l6 6-6 6"/></svg></span>' +
      '<span class="lrg-uresult__label">' + esc(label) + "</span></a>";
  }

  function resultRow(r, q) {
    return '<a class="lrg-uresult" data-umami-event="Search Result Opened"' +
      ' data-umami-event-query="' + esc(String(q || "").slice(0, 60)) + '"' +
      ' data-umami-event-dest="' + esc(String(r.name || "").slice(0, 60)) + '"' +
      ' href="' + esc(r.href) + '"' + (r.newTab ? ' target="_blank" rel="noopener"' : "") + ">" +
      '<span class="lrg-uresult__icon">' + iconInner(r) + "</span>" +
      '<span class="lrg-uresult__label">' + matchHTML(r.name, q) +
      (r.isNew ? ' <span class="lrg-badge lrg-badge--brand">New</span>' : "") +
      (r.sub ? ' <span class="lrg-uresult__sub">' + matchHTML(r.sub, q) + "</span>" : "") +
      "</span></a>";
  }

  function searchLocal(q, groups) {
    var lq = q.toLowerCase();
    var out = { apps: [], links: [] };
    LRG.apps.forEach(function (a) {
      if (!LRG.canSee(a, groups)) return;
      var sc = lq ? scoreMatch(a.name + " " + a.desc, lq) : 0;
      if (sc < 0) return;
      // Bias toward a name hit so "Agent Dashboard" tops a query for "agent"
      // even though other rows mention it in their description.
      if (lq && scoreMatch(a.name, lq) >= 0) sc += 300;
      out.apps.push({ _s: sc, name: a.name, sub: a.desc, href: a.href, iconHtml: svgIcon(a.icon, 16), isNew: !!a.isNew });
    });
    LRG.linkCats.forEach(function (c) {
      c.links.forEach(function (l) {
        var sc = lq ? scoreMatch(l.name + " " + l.host + " " + c.name, lq) : 0;
        if (sc < 0) return;
        if (lq && scoreMatch(l.name, lq) >= 0) sc += 300;
        out.links.push({ _s: sc, name: l.name, sub: c.name + " · " + l.host, href: l.href, badge: l.badge, newTab: true });
      });
    });
    if (lq) {
      out.apps.sort(function (x, y) { return y._s - x._s; });
      out.links.sort(function (x, y) { return y._s - x._s; });
    }
    return out;
  }

  /* Exposed so OTHER surfaces reuse the exact same search + row rendering:
     launchpad-app's hero and the BookStack head (docs.) both call these.
     searchLocal(q, groups) -> ranked { apps, links }; renderResult(r, q) ->
     one .lrg-uresult row (avatar- and <mark>-highlight-aware). */
  LRG.searchLocal = searchLocal;
  LRG.renderResult = resultRow;

  function attachSearch(input, clearBtn, groups) {
    var wrap = input.parentElement;
    var panel = document.createElement("div");
    panel.className = "lrg-usearch__panel";
    panel.hidden = true;
    panel.setAttribute("role", "listbox");
    wrap.appendChild(panel);
    var timer = null, seq = 0, searchTrackTimer = null;

    // Subtle ⌘K / Ctrl-K affordance at the right edge of the field; hidden
    // while the field is focused or has text (so it never fights the ✕).
    var hint = document.createElement("span");
    hint.className = "lrg-kbdhint";
    hint.setAttribute("aria-hidden", "true");
    hint.innerHTML = /Mac|iPhone|iPad/.test(navigator.platform || navigator.userAgent || "")
      ? "<kbd>⌘</kbd><kbd>K</kbd>" : "<kbd>Ctrl</kbd><kbd>K</kbd>";
    wrap.appendChild(hint);
    function updHint() { hint.hidden = !!input.value || document.activeElement === input; }
    updHint();
    input.addEventListener("focus", updHint);
    input.addEventListener("blur", updHint);
    input.addEventListener("input", updHint);

    function close() { panel.hidden = true; }
    function render(q) {
      var my = ++seq;
      var local = searchLocal(q, groups);
      var html = "";
      if (local.apps.length) {
        html += '<div class="lrg-usearch__group">Apps</div>' +
          local.apps.slice(0, GROUP_CAP.apps).map(function (r) { return resultRow(r, q); }).join("");
      }
      if (!q) { // browse-on-focus: apps only
        panel.innerHTML = html || '<div class="lrg-empty" style="padding:18px">No apps available.</div>';
        panel.hidden = false;
        return;
      }
      if (local.links.length) {
        html += '<div class="lrg-usearch__group">Links &amp; Tools</div>' +
          local.links.slice(0, GROUP_CAP.links).map(function (r) { return resultRow(r, q); }).join("");
      }
      panel.innerHTML = html || '<div class="lrg-empty" style="padding:18px">No matches for “' + esc(q) + '”.</div>';
      panel.hidden = false;
      // async groups (Agents, Docs, Contacts, Recruiting) — appended when providers exist (P2),
      // each capped with a "See all" tail so a broad query stays scannable.
      [["agents", "Agents"], ["docs", "Docs"], ["contacts", "My Contacts"], ["recruits", "Recruiting"]].forEach(function (pair) {
        var key = pair[0], fn = LRG.searchProviders[key];
        if (typeof fn !== "function") return;
        Promise.resolve(fn(q)).then(function (rows) {
          if (my !== seq || !rows || !rows.length) return;
          var newTab = key === "docs" || key === "contacts";
          rows.forEach(function (r) { r.newTab = newTab; });
          var cap = GROUP_CAP[key] || 6;
          var body = rows.slice(0, cap).map(function (r) { return resultRow(r, q); }).join("");
          if (rows.length > cap) {
            var d = moreDest(key, q);
            if (d) body += moreRow(d.label, d.href, d.newTab);
          }
          var empty = panel.querySelector(".lrg-empty");
          if (empty) empty.parentNode.removeChild(empty); // an async group is filling a "no matches" panel
          panel.innerHTML += '<div class="lrg-usearch__group">' + pair[1] + "</div>" + body;
        }).catch(function () {});
      });
    }

    input.addEventListener("focus", function () { render(input.value.trim()); });
    input.addEventListener("input", function () {
      if (clearBtn) clearBtn.hidden = !input.value;
      clearTimeout(timer);
      timer = setTimeout(function () { render(input.value.trim()); }, 140);
      // P2: search usage signal — debounced, no query text (avoid PII)
      clearTimeout(searchTrackTimer);
      searchTrackTimer = setTimeout(function () {
        var q = input.value.trim();
        if (q.length < 2) return;
        // Log the QUERY + how many results were on screen when the user settled
        // (excludes "See all" tails). `results:0` = a search that found nothing —
        // the signal for what to add. Self-hosted Umami; query capped to 60 chars.
        var shown = panel.querySelectorAll(".lrg-uresult:not(.lrg-uresult--more)").length;
        LRG.track("Search Performed", { query: q.slice(0, 60), chars: q.length, results: shown });
      }, 1000);
    });
    input.addEventListener("keydown", function (e) {
      var items = panel.querySelectorAll(".lrg-uresult");
      var idx = Array.prototype.indexOf.call(items, document.activeElement);
      if (e.key === "Escape") { close(); input.blur(); }
      else if (e.key === "ArrowDown" && items.length) { e.preventDefault(); items[0].focus(); }
      else if (e.key === "Enter" && items.length === 1) { items[0].click(); }
    });
    panel.addEventListener("keydown", function (e) {
      var items = panel.querySelectorAll(".lrg-uresult");
      var idx = Array.prototype.indexOf.call(items, document.activeElement);
      if (e.key === "ArrowDown") { e.preventDefault(); (items[idx + 1] || items[0]).focus(); }
      else if (e.key === "ArrowUp") { e.preventDefault(); (items[idx - 1] || input).focus(); }
      else if (e.key === "Escape") { close(); input.focus(); }
    });
    if (clearBtn) clearBtn.addEventListener("click", function () {
      input.value = ""; clearBtn.hidden = true; input.focus(); render("");
    });
    document.addEventListener("click", function (e) {
      if (!wrap.contains(e.target)) close();
    });
  }

  /* ---- keyboard: focus search from anywhere ('/' or ⌘K / Ctrl-K) ------
     Wired once at load, so every page that ships lrg-portal.js (app headers
     AND the launchpad hero) gets the shortcut with no per-page wiring. */
  LRG.focusSearch = function () {
    var el = document.getElementById("usearch") || document.getElementById("lp-q") ||
      document.querySelector('input[type="search"]') ||
      // apps with their own header search (e.g. Audit's #hSearch "Search a lead
      // or agent…") don't use #usearch — fall back to a "Search…" placeholder.
      document.querySelector('input[placeholder^="Search" i], input[aria-label^="Search" i]');
    if (!el) return false;
    try { el.focus(); if (el.select) el.select(); } catch (e) {}
    return true;
  };
  (function wireSearchHotkey() {
    if (LRG._searchHotkey) return; LRG._searchHotkey = true;
    document.addEventListener("keydown", function (e) {
      if ((e.metaKey || e.ctrlKey) && !e.altKey && (e.key === "k" || e.key === "K")) {
        if (LRG.focusSearch()) e.preventDefault();
        return;
      }
      if (e.key === "/" && !e.metaKey && !e.ctrlKey && !e.altKey) {
        var t = e.target, tag = (t && t.tagName) || "";
        if (tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || (t && t.isContentEditable)) return;
        if (LRG.focusSearch()) e.preventDefault();
      }
    });
  })();

  /* ---- header init --------------------------------------------- */
  LRG.initHeader = function (opts) {
    opts = opts || {};
    var themeBtn = document.getElementById("theme-btn");
    if (themeBtn) themeBtn.addEventListener("click", LRG.toggleTheme);
    applyTheme(document.documentElement.getAttribute("data-theme") || "light");

    LRG.ready.then(function (id) {
      var appsBtn = document.getElementById("apps-btn");
      if (appsBtn) {
        var holder = appsBtn.parentElement;
        var menu = document.createElement("div");
        menu.className = "lrg-menu";
        menu.hidden = true;
        holder.appendChild(menu);
        buildAppsMenu(menu, opts.currentApp, id.groups);
        appsBtn.setAttribute("aria-expanded", "false");
        appsBtn.addEventListener("click", function (e) {
          e.stopPropagation();
          menu.hidden = !menu.hidden;
          appsBtn.setAttribute("aria-expanded", String(!menu.hidden));
        });
        document.addEventListener("click", function (e) {
          if (!holder.contains(e.target)) { menu.hidden = true; appsBtn.setAttribute("aria-expanded", "false"); }
        });
        document.addEventListener("keydown", function (e) {
          if (e.key === "Escape") { menu.hidden = true; appsBtn.setAttribute("aria-expanded", "false"); }
        });
      }
      var input = document.getElementById("usearch");
      if (input) attachSearch(input, document.getElementById("usearch-clear"), id.groups);
    });
  };
})();