/* ============================================================
   lrg-portal.js — shared portal behaviors for all LRG apps
   v1.5.4 · 2026-11-03 · ship alongside lrg.css at /lrg-assets/
   (v1.5.4: the v1.5.2 analytics change merged onto v1.5.3 -- both below.)
   (v1.5.3: a "What's New" tile (release notes, everyone) and a "What's new" row
   in the account menu. See release-notes/README.md. v1.5.2 is the analytics
   change on claude/analytics-review; this one doesn't depend on it.)
   (v1.5.2: analytics — every page's FIRST pageview is now attributed (cached
   pseudonymous id stamped via Umami's data-before-send; ~50% of events were
   landing in anonymous sessions); team-qa. reports to its own "Team Launchpad
   (QA)" property so events can be checked before prod; automatic App Action /
   App Action Failed / Content Copied / File Downloaded / Page Printed events
   in every app, no per-app code. Catalog: docs/analytics-events.md.)
   (v1.5.1: the Apps and account menus slide back on screen if a crowded header
   wraps their button to the left. Ships with lrg.css v1.4.1, which keeps the
   header on one row from 641 to 960 px.)
   (v1.5.0: header — an account menu (name, role, My Profile, Getting started,
   Account & security, Sign out) replaces the Account rows in the Apps menu; a
   QA badge on team-qa.; the Apps menu redraws once Page Permissions arrive (it
   was drawn from /whoami alone, so Access Control edits never reached it);
   "New" badges come from launchpad-managed dates (appMeta) with a dated
   registry fallback (newUntil) instead of a permanent isNew; env:"qa" tiles
   stay off prod; the logo is a real link; the theme button reports its state
   and the theme follows other open tabs; a failed /whoami no longer invents a
   "Preview Agent" outside local dev. How the header fits together: HEADER.md.)
   (v1.4.2: search hardening — Recent is per signed-in user, never holds
   My Contacts/Recruiting rows, and is wiped on Sign out (the old shared
   per-browser list is deleted); analytics never log client/recruit names;
   a provider failure or expired sign-in says so instead of "No matches";
   provider icons/links are never trusted as markup/schemes; headshot
   fallback works under docs.' CSP; Esc/↓/Tab behave; the panel and box
   carry proper ARIA; ⌘K no longer hijacks editors; Agents "See all" keeps
   the query.)
   (v1.4.1: the Knowledge Base hides BookStack's own header search once our
   KB search box attaches -- one search box on docs.)
   (v1.4.0: search — curated best bets (LRG.bestBets, "Top results"), search-only
   app synonyms (LRG.appKeywords), typo tolerance for 5+ letter words, "Recent"
   results on empty focus, agent results deep-link to the People directory
   (#directory?q=<name>). How it all fits: SEARCH.md.)
   (v1.3.3: search fixes — browse-on-focus lists EVERY visible app (the cap of 8
   hid the newest tiles); multi-word queries match in any order ("blast email");
   Enter opens the top result; async groups render into fixed-order slots (no
   shuffling, no lost keyboard focus); remote providers need 2+ chars, abort
   superseded queries and cache answers for 60s; "Search Performed" counts
   results only after every provider settles. One remote engine
   (LRG.searchRemote) now backs both the header dropdown and launchpad's hero.)
   (v1.3.2: fix identity coverage — identify() now waits for an ESTABLISHED Umami
   session (getSession().cache set by the first pageview) before firing, then
   re-asserts once, instead of racing the pageview; ~78% of sessions were landing
   unidentified, which capped role analysis and blocked retention.)
   (v1.3.1: (a) focusSearch also matches a "Search…" placeholder input, so ⌘K/'/'
   reaches apps with their own header search (Audit's #hSearch); (b) search-query
   telemetry — "Search Performed" now logs {query, results} (capped 60ch, self-
   hosted Umami) so results:0 surfaces gaps, and result rows carry the query +
   destination for click correlation.)
   (v1.3.0: universal-search upgrade — shared result helpers (LRG.scoreMatch/
   matchHTML/iconInner/initialsOf), relevance ranking + <mark> highlighting for
   local groups, agent headshot avatars (r.avatar, asset-host-gated, initials
   fallback), per-group caps with "See all" tails, and a global '/' + ⌘K/Ctrl-K
   focus-search hotkey. Same helpers back launchpad's hero search + the BookStack
   head. Agents provider now returns `avatar` from the roster Headshot Slug.)
   (v1.2.2: Audit tile → v2 container (/audit) on ALL hosts — v2 promoted to prod;
   the strangler host-gate ternary is retired now that team.loyaltyrealtygroup.com/audit
   is live behind its Authentik app binding.)
   (v1.2.1: enable web-vitals — Umami v3 gates the performance collector behind
   data-performance="true"; without it LCP/FCP/CLS/INP/TTFB were never sent, so
   the Performance tab stayed empty. Server stores them as event_type=5 rows.)
   (v1.2.0: analytics depth — umami.identify() attaches a pseudonymous (hashed)
   user id + role/groups so usage segments by WHO/role; global JS-error events
   as a friction signal; universal-search usage + result-open events. Event
   taxonomy in docs/analytics-events.md.)
   (v1.1.1: Audit tile → v2 container (/audit) on team-qa; prod stays on the v1
   n8n app (/fub-audit) until v2 is promoted — strangler cutover.)
   (v1.1.0: same-origin analytics — load the tracker from team.'s /stats/
   proxy instead of analytics., so web-vitals beacons (flushed on tab-hide)
   deliver reliably; cross-origin unload fetches were being dropped, leaving
   the Performance tab empty. + apps-launcher navigation events via
   data-umami-event, and an LRG.track(name, data) helper for apps.)
   (v1.0.9: centralized Umami analytics — inject the tracker from here so
   every app that loads lrg-portal.js is tracked as ONE property (the team
   portal). Prod team. host only, so team-qa, the NocoDB roster (people.),
   BookStack (docs.) and local dev never send events. Plus a hashchange
   hook so hash-routed tabs (e.g. People #my-profile) count as distinct
   pageviews — Umami auto-tracks pushState but not hashchange.)
   (v1.0.8: fix "Sign out" — the old /outpost.goauthentik.io/sign_out link
   crashes with a 502 on this Authentik instance (server-side bug, no log
   line even emitted); point it at the real global invalidation flow
   instead, which was confirmed working.)
   (v1.0.7: "My Contacts" universal search group — live FUB lookup for
   the signed-in agent's own book via the gated /api/search/contacts
   proxy; non-linked users just get no group. Opens in a new tab.)
   (v1.0.6: permanent "Getting started" link in the account sections)
   (v1.0.5: clicking the header logo returns to the Launchpad from any
   app page; no-op on the Launchpad itself)
   (v1.0.4: env-aware app links — team-hosted apps use host-relative hrefs
   on team./team-qa. so QA stays in QA; other hosts still link prod.
   Re-engagement deep-links /webhook/reengage, valid on both envs)
   (v1.0.1: group hierarchy — admins⊃all, team-lead/recruiting⊃staff)
   (v1.0.2: `accountLink` apps (My Profile) render in the account rows of
   the apps-launcher menu, not the tile grid — see LRG.apps + buildAppsMenu)
   (v1.0.3: P2 — auto-register live Docs/Agents search providers on
   team./team-qa. hosts against the gated /api/search/* proxy endpoints)
   Provides: theme init/toggle · identity (whoami) · app registry
   · apps-launcher menu · universal search (browse-on-focus, New
   badges, grouped results) · account links.
   Usage (backslashes only escape the tag for safe inlining):
     <script>window.LRG_WHOAMI='/whoami';<\/script>  (optional override)
     <script src="/lrg-assets/lrg-portal.js"><\/script>
     <script>LRG.initHeader({currentApp:'cadence'});<\/script>
   Identity comes ONLY from the SSO-gated /whoami endpoint (Caddy
   injects X-Authentik-* — never trust client-supplied identity).
   ============================================================ */
(function () {
  "use strict";

  var LRG = (window.LRG = window.LRG || {});

  /* Team-apps base: on the team hosts (prod team. and team-qa.) links are
     host-relative so each environment stays self-contained; on any other
     host (docs., people., ...) they point at prod. */
  var TEAM = /^team(-qa)?\./.test(location.hostname) ? "" : "https://team.loyaltyrealtygroup.com";

  /* QA host (gets the header's QA badge and env:"qa" tiles) and local dev
     hosts (the only place the ?role= preview identities apply -- a failed
     /whoami on a real host means a sign-in problem, not a preview). */
  var QA_HOST = /^team-qa\./.test(location.hostname);
  var DEV_HOST = location.protocol === "file:" ||
    /^(localhost|127\.0\.0\.1|\[::1\])$/.test(location.hostname) || /\.(localhost|test)$/.test(location.hostname);

  /* The Knowledge Base (BookStack on docs.) loads this file from its custom
     head. It is the same site as team., so the browser sends the team. login
     cookie, and Caddy lets exactly this origin read /whoami, the launchpad
     links and /api/search/* (credentialed CORS, 2026-11-02). So on docs. the
     identity, links and live search groups all come from team.
     window.LRG_API_BASE overrides the base (e.g. team-qa. for testing). */
  var KB = location.hostname === "docs.loyaltyrealtygroup.com";
  var API = window.LRG_API_BASE || (KB ? "https://team.loyaltyrealtygroup.com" : "");
  var API_CRED = API ? "include" : "same-origin";
  LRG.isKb = KB;

  /* ---- analytics (Umami) --------------------------------------- */
  /* One place to track every app that loads this file, under a single
     Umami "website" (the team portal property). Runs ONLY on the prod
     team host, so team-qa, the NocoDB roster (people.), BookStack (docs.)
     and local dev stay out of the numbers. Tracker + ingest are served
     SAME-ORIGIN from team.'s /stats/ proxy (Caddy handle_path → umami), so
     web-vitals beacons flushed on tab-hide deliver reliably — a cross-origin
     analytics. endpoint dropped them, leaving the Performance tab empty. */
  /* v1.5.2: team-qa. reports to its OWN property ("Team Launchpad (QA)") so
     new events can be checked in QA before prod, without polluting the prod
     numbers. QA has no /stats/ proxy, so it loads from analytics. directly
     (that host's /script.js + /api/send are public for exactly this). */
  var UMAMI_SITES = {
    "team.loyaltyrealtygroup.com": { id: "69363e79-f3f0-4b12-ba58-b074962fec87", src: "/stats/script.js" },
    "team-qa.loyaltyrealtygroup.com": { id: "a7c3e2d4-5b1f-4e8a-9c6d-2f0b8e4a1d57", src: "https://analytics.loyaltyrealtygroup.com/script.js" }
  };
  var UMAMI = UMAMI_SITES[location.hostname] || null;
  LRG.analyticsOn = !!UMAMI;

  /* Pseudonymous analytics id (hash of the email, see LRG.identify), kept in
     this browser so the FIRST pageview of every page load is attributed.
     Umami v3 files identified traffic under a separate session keyed by the
     id, and identify() can only run after /whoami -- so before v1.5.2 each
     page's landing pageview went to an anonymous session (~50% of events;
     Launchpad "/" and Agent Dashboard were 100% anonymous). Wiped on Sign out. */
  var AID_KEY = "lrg-aid";
  var analyticsId = null;
  try { analyticsId = localStorage.getItem(AID_KEY); } catch (e) {}
  LRG.analyticsForget = function () {
    analyticsId = null;
    try { localStorage.removeItem(AID_KEY); } catch (e) {}
  };
  var firstSend = true;
  /* Umami's data-before-send hook: runs on every payload before it's sent.
     Stamps the id; with nothing cached yet (first visit on this browser), the
     first send waits up to 2.5s for /whoami rather than going out anonymous. */
  window.__lrgUmamiBeforeSend = function (type, payload) {
    try {
      if (!payload || payload.id) return payload;
      if (analyticsId) { payload.id = analyticsId; return payload; }
      if (!firstSend || !LRG.ready) return payload;
      firstSend = false;
      return Promise.race([
        LRG.ready,
        new Promise(function (res) { setTimeout(res, 2500); })
      ]).then(function () {
        if (analyticsId && !payload.id) payload.id = analyticsId;
        return payload;
      }, function () { return payload; });
    } catch (e) { return payload; }
  };

  (function initUmami() {
    if (!UMAMI) return;

    /* Load the tracker — but not twice if a page still ships its own
       inline tag. */
    try {
      if (!document.querySelector("script[data-website-id]")) {
        var s = document.createElement("script");
        s.defer = true;
        s.src = UMAMI.src; // prod: same-origin proxy → posts to /stats/api/send
        s.setAttribute("data-website-id", UMAMI.id);
        s.setAttribute("data-performance", "true"); // Umami v3: web-vitals (LCP/FCP/CLS/INP/TTFB) are opt-in — the collector only runs when this is set
        s.setAttribute("data-before-send", "__lrgUmamiBeforeSend");
        (document.head || document.documentElement).appendChild(s);
      }
    } catch (e) { /* analytics must never break an app */ }

    /* Umami auto-tracks History API navigations (pushState/replaceState)
       but not hashchange. Apps that route tabs via location.hash (People,
       etc.) would otherwise collapse into one pageview — mirror each hash
       change into a pageview that keeps the hash in the URL. Runs whether
       the tracker was injected here or inline (window.umami is shared). */
    try {
      window.addEventListener("hashchange", function () {
        try {
          if (window.umami && typeof window.umami.track === "function") {
            window.umami.track(function (p) {
              return Object.assign({}, p, {
                url: location.pathname + location.search + location.hash
              });
            });
          }
        } catch (e) {}
      });
    } catch (e) {}
  })();

  /* Programmatic event helper for apps: LRG.track('Audit Run', {rows: 12}).
     Safe no-op until the tracker has loaded and on non-prod hosts. */
  LRG.track = function (name, data) {
    try {
      if (window.umami && typeof window.umami.track === "function") {
        return data ? window.umami.track(name, data) : window.umami.track(name);
      }
    } catch (e) {}
  };

  /* --- P1: pseudonymous user + role identity, so usage segments by WHO/role.
     Attach a HASH of the email (no raw PII stored in analytics) plus role +
     groups. Fired off the lrg:identity event once /whoami resolves; retries
     until the deferred tracker is live. Prod host only (matches tracker gate).
     To attribute by real name instead, swap `raw` hashing for the email. --- */
  function lrgHash32(s) {
    var h = 0x811c9dc5 >>> 0;
    for (var i = 0; i < s.length; i++) { h ^= s.charCodeAt(i); h = Math.imul(h, 0x01000193) >>> 0; }
    return h.toString(36);
  }
  LRG.identify = function (identity) {
    try {
      if (!UMAMI) return;
      if (!identity || identity.preview) return;
      var raw = identity.email || identity.username || identity.name;
      if (!raw) return;
      var pseudo = "u" + lrgHash32(String(raw).trim().toLowerCase());
      analyticsId = pseudo; // later sends on this page + the next page load's first pageview
      try { localStorage.setItem(AID_KEY, pseudo); } catch (e) {}
      var props = { role: identity.roleKey || identity.role || "unknown", groups: (identity.groups || []).join(",") };
      function fire() { try { window.umami.identify(pseudo, props); } catch (e) {} }
      var n = 0;
      (function attempt() {
        var u = window.umami;
        if (u && typeof u.identify === "function") {
          // Only identify once the tracker has an ESTABLISHED session — i.e. its
          // first pageview has been sent so getSession().cache is set. Calling
          // identify before that races the pageview and usually fails to persist
          // (root cause of ~78% of sessions landing unidentified). Then re-assert
          // once the session has fully settled server-side.
          var ready = true;
          try { var s = typeof u.getSession === "function" ? u.getSession() : null; ready = !s || !!s.cache; } catch (e) {}
          if (ready) { fire(); setTimeout(fire, 4000); return; }
        }
        if (n++ < 100) setTimeout(attempt, 200); // wait up to ~20s for tracker + session
      })();
    } catch (e) {}
  };
  document.addEventListener("lrg:identity", function (e) { LRG.identify(e.detail); });

  /* --- P2: client-side errors as a friction signal (deduped + capped so a
     broken page can't flood analytics); the page path helps locate it. --- */
  (function () {
    if (!UMAMI) return;
    var seen = {}, sent = 0;
    function report(msg, src) {
      try {
        msg = String(msg == null ? "" : msg).slice(0, 140);
        if (!msg || seen[msg] || sent >= 10) return;
        seen[msg] = 1; sent++;
        LRG.track("JS Error", { msg: msg, src: String(src || "").split("/").pop().slice(0, 60), page: location.pathname });
      } catch (e) {}
    }
    window.addEventListener("error", function (e) { report(e && e.message, e && e.filename); });
    window.addEventListener("unhandledrejection", function (e) {
      var r = e && e.reason; report((r && r.message) || r, "promise");
    });
  })();

  /* --- P3 (v1.5.2): what people DO in every app, with no per-app code.
     Apps that never called LRG.track (Email Blasts, Link Studio, Email
     Studio, Print Studio, most of Audit) only showed up as pageviews, so we
     could see they were opened but not used. These hooks only observe -- the
     app's own fetch/clipboard/print calls run exactly as before.
       App Action        {app, op, status}  a same-origin write (POST/PUT/PATCH/
                                            DELETE) that succeeded; op is
                                            "METHOD /path" with ids replaced by
                                            :id, plus the JSON body's "action"
                                            for webhook-style APIs
       App Action Failed {app, op, status}  the same, failed (status 0 = network
                                            error or expired sign-in)
       Content Copied    {app, via}         clipboard copy (button or Ctrl-C)
       File Downloaded   {app, ext}         <a download> clicks
       Page Printed      {app}              browser print (Print Studio etc.)
     No query strings, bodies or ids are ever logged. Capped per page load. --- */
  (function () {
    if (!UMAMI) return;
    var sent = 0;
    function app() { return location.pathname.split("/")[1] || "launchpad"; }
    function send(name, data) {
      if (sent >= 40) return;
      sent++;
      data.app = app();
      LRG.track(name, data);
    }
    LRG.trackAuto = send; // exposed for tests

    // Path segments that look like ids/emails become :id, so ops group.
    function normPath(p) {
      return p.split("/").map(function (seg) {
        if (!seg) return seg;
        if (/@|%40/.test(seg) || seg.length > 24 || (seg.length >= 4 && /\d/.test(seg))) return ":id";
        return seg;
      }).join("/").slice(0, 80);
    }
    // Webhook-style APIs (Email Blasts → n8n) multiplex on a JSON "action".
    // Reads sent as POST ("mine", "list", …) aren't actions.
    var READ_ACTION = /^(get|list|load|lookup|search|find|fetch|read|mine|me|whoami|status|ping|preview)(_|-|$)/i;
    function bodyAction(body) {
      if (typeof body !== "string" || body.length > 20000 || body.charAt(0) !== "{") return "";
      try {
        var a = JSON.parse(body).action;
        return typeof a === "string" && /^[a-z][\w-]{0,30}$/i.test(a) ? a : "";
      } catch (e) { return ""; }
    }
    LRG._normOp = function (method, path, body) { // exposed for tests
      var a = bodyAction(body);
      if (a && READ_ACTION.test(a)) return null;
      return method + " " + normPath(path) + (a ? " " + a : "");
    };

    if (window.fetch) {
      var origFetch = window.fetch;
      window.fetch = function (input, init) {
        var p = origFetch.apply(this, arguments);
        try {
          var method = String((init && init.method) || (input && input.method) || "GET").toUpperCase();
          if (method === "GET" || method === "HEAD" || method === "OPTIONS") return p;
          var url = new URL(typeof input === "string" ? input : (input && input.url) || String(input), location.href);
          if (url.origin !== location.origin || /^\/(stats|lrg-assets)\//.test(url.pathname)) return p;
          var op = LRG._normOp(method, url.pathname, init && init.body);
          if (!op) return p;
          p.then(function (r) {
            send(r.ok ? "App Action" : "App Action Failed", { op: op, status: r.status });
          }, function () {
            send("App Action Failed", { op: op, status: 0 });
          });
        } catch (e) {}
        return p;
      };
    }

    try {
      var cb = navigator.clipboard;
      if (cb) ["writeText", "write"].forEach(function (m) {
        if (typeof cb[m] !== "function") return;
        var orig = cb[m];
        cb[m] = function () {
          var p = orig.apply(cb, arguments);
          try { p.then(function () { send("Content Copied", { via: "button" }); }, function () {}); } catch (e) {}
          return p;
        };
      });
    } catch (e) {}
    // execCommand("copy") fallbacks and Ctrl-C both fire this.
    document.addEventListener("copy", function () {
      var t = document.activeElement;
      send("Content Copied", { via: t && /^(INPUT|TEXTAREA)$/.test(t.tagName) ? "field" : "selection" });
    }, true);

    function download(a) {
      var name = a.getAttribute("download") || (a.pathname || "").split("/").pop() || "";
      var m = /\.([a-z0-9]{1,5})$/i.exec(name);
      send("File Downloaded", { ext: m ? m[1].toLowerCase() : "file" });
    }
    document.addEventListener("click", function (e) {
      var a = e.target && e.target.closest && e.target.closest("a[download]");
      if (a) download(a);
    }, true);
    // Generated files (QR codes, exports) are usually saved via a detached
    // <a download> that is .click()ed and never enters the page.
    try {
      var origClick = HTMLAnchorElement.prototype.click;
      HTMLAnchorElement.prototype.click = function () {
        try { if (this.hasAttribute("download") && !this.isConnected) download(this); } catch (e) {}
        return origClick.apply(this, arguments);
      };
    } catch (e) {}

    window.addEventListener("beforeprint", function () { send("Page Printed", {}); });
  })();

  /* ---- registry ------------------------------------------------ */
  /* Access truth mirrors Caddy/Authentik enforcement (see
     team-portal/design-system/DEPLOY-P0-P1.md for divergences from
     the mockup registry, confirmed against the live Caddyfile).
     Optional fields: env:"qa" (tile only on team-qa. and local dev, so main
     can carry a tile for an app that isn't on prod yet); newUntil
     ("YYYY-MM-DD", the "New" badge's fallback end date -- the launchpad's
     own date for the app wins, see applyAppMeta); accountLink (shown in the
     account menu, not the tile grid); gated (lock label on launchpad tiles). */
  LRG.apps = [
    { id: "dashboard", name: "Agent Dashboard", desc: "Your book at a glance",
      href: TEAM + "/agent-dashboard",
      groups: ["staff"], icon: ["M3 3h8v10H3zM13 3h8v6h-8zM13 11h8v10h-8zM3 15h8v6H3z"] },
    { id: "cadence", name: "Audit", desc: "Lead follow-up audits",
      // v2 promoted to prod 2026-08-03: /audit (the containerized rebuild) on both hosts,
      // behind the Authentik app binding for team.loyaltyrealtygroup.com/audit.
      href: TEAM + "/audit",
      groups: ["staff"], icon: ["M9 11l3 3 6-6", "M20 12v7a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1h10"] },
    { id: "profile", name: "My Profile", desc: "Your contact & licensing",
      // People's My Profile tab (2026-07-26). The old profile-app is retired
      // (its routes 301 to People).
      href: TEAM + "/people#my-profile",
      groups: ["staff"], accountLink: true,
      icon: ["M4 20c0-3.3 3.6-6 8-6s8 2.7 8 6", { t: "c", cx: 12, cy: 8, r: 4 }] },
    { id: "signature", name: "Email Signature", desc: "Build your branded signature",
      // People's My Signature tab (2026-07-27, D-009: a pure render+copy tab;
      // every field is authored in My Profile). The old team-signature-confirm
      // app is retired (301 to People); its sig-app stack was removed 2026-11-02.
      href: TEAM + "/people#my-signature",
      groups: ["staff"],
      icon: [{ t: "r", x: 3, y: 5, w: 18, h: 14, rx: 2 }, "M3 7l9 6 9-6"] },
    { id: "roster", name: "Team Roster", desc: "Directory & contacts",
      href: TEAM + "/people#directory",   // /roster retired 2026-11-02 (only redirects)
      groups: ["staff"],
      icon: [{ t: "c", cx: 9, cy: 8, r: 3.2 }, "M3 19c0-2.8 2.7-5 6-5s6 2.2 6 5", { t: "c", cx: 17.5, cy: 9, r: 2.6 }, "M21 18c0-2.2-1.8-4-4-4"] },
    { id: "reengage", name: "Client Re-engagement", desc: "Win-back worklist",
      href: TEAM + "/webhook/reengage",
      groups: ["admins"], gated: "Admins",
      icon: ["M3 12a9 9 0 1 0 3-6.7", "M3 4v4h4", "M12 8v4l3 2"] },
    { id: "email-studio", name: "Email Studio", desc: "Branded email templates for FUB",
      href: TEAM + "/email-studio",
      groups: ["staff"],
      // Pencil/compose glyph -- "signature" already owns the envelope shape
      // ({t:"r",...} + flap above), so this needed a visually distinct icon.
      icon: ["M12 20h9", "M16.5 3.5a2.1 2.1 0 0 1 3 3L7 19l-4 1 1-4Z"] },
    { id: "print-studio", name: "Print Studio", desc: "Personalize & print your tri-folds",
      href: TEAM + "/print-studio",
      groups: ["staff"],
      icon: [{ t: "r", x: 4, y: 8, w: 16, h: 8, rx: 1.5 }, "M7 8V4h10v4", { t: "r", x: 7, y: 15, w: 10, h: 5, rx: 0.5 }] },
    { id: "links", name: "Link Studio", desc: "Short links & QR codes for signs",
      href: TEAM + "/links",
      groups: ["staff"], newUntil: "2026-12-26",   // prod 2026-10-27 + 60 days
      // Chain link. Deliberately not a QR glyph: the four-square QR shape reads as the
      // Apps grid button in the same header.
      icon: ["M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71",
             "M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"] },
    { id: "forms", name: "LRG Forms", desc: "Bilingual forms, short links & QR codes",
      href: TEAM + "/forms",
      // Mirrors the Authentik "forms" app bindings (agent, marketing), not "staff":
      // a staff-only account would get a tile that Authentik then refuses.
      // env:"qa": LRG Forms is QA-only (prod /forms just redirects home), so the
      // tile stays off team. and main can ship to prod as-is. Drop env at launch.
      groups: ["agent", "marketing"], env: "qa", newUntil: "2026-12-31",
      // A clipboard with a check. Deliberately not a QR glyph (that reads as the Apps grid button).
      icon: [{ t: "r", x: 5, y: 4, w: 14, h: 18, rx: 2 }, { t: "r", x: 9, y: 2, w: 6, h: 4, rx: 1 }, "M9 13l2 2 4-4"] },
    { id: "email-blast", name: "Email Blasts", desc: "Request a Moxi email blast",
      href: TEAM + "/email-blast",
      groups: ["staff"], newUntil: "2026-11-14",   // prod 2026-09-15 + 60 days
      // Paper-plane / send glyph -- distinct from "signature" (envelope) and
      // "email-studio" (pencil): this is the "request a send" entry point.
      icon: ["M22 2 11 13", "M22 2 15 22 11 13 2 9Z"] },
    { id: "whats-new", name: "What's New", desc: "New features, improvements & fixes",
      // Release notes (release-notes/). Everyone with a portal login; prod gates it
      // with a plain forward_auth like Email Studio.
      href: TEAM + "/whats-new",
      groups: ["staff", "agent", "admins", "team-lead", "marketing"], newUntil: "2026-12-02",
      // Two sparkles -- "new" without borrowing the bell the Notifications widget will use.
      icon: ["M10 3l1.8 4.7 4.7 1.8-4.7 1.8L10 16l-1.8-4.7L3.5 9.5l4.7-1.8z",
             "M18 14l.9 2.1 2.1.9-2.1.9L18 20l-.9-2.1L15 17l2.1-.9z"] },
    { id: "drawio", name: "Draw.io", desc: "Flowcharts & diagrams",
      href: "https://draw.loyaltyrealtygroup.com",
      groups: ["staff"],
      icon: [{ t: "r", x: 3, y: 4, w: 8, h: 6, rx: 1 }, { t: "r", x: 13, y: 14, w: 8, h: 6, rx: 1 }, "M7 10v3a2 2 0 0 0 2 2h4"] },
    { id: "kb", name: "Knowledge Base", desc: "Runbooks & guides (BookStack)",
      href: "https://docs.loyaltyrealtygroup.com",
      groups: ["staff"],
      icon: ["M4 5a2 2 0 0 1 2-2h8l4 4v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2z", "M8 8h6M8 12h8M8 16h5"] },
    { id: "people", name: "People", desc: "Recruiting, roster & your profile",
      href: TEAM + "/people",
      groups: ["staff"],
      // Design bundle's own app-people.svg is a heart shape -- inconsistent
      // with every sibling icon (profile/roster are literal person glyphs) --
      // almost certainly an asset-export mismatch. Substituted a person+plus
      // glyph in the same stroke style pending a real icon from Javi.
      icon: [{ t: "c", cx: 9, cy: 8, r: 3.3 }, "M2 20c0-3.2 3.1-5.6 7-5.6s7 2.4 7 5.6", "M18 8v6", "M15 11h6"] },
    { id: "nocodb", name: "Roster DB (raw)", desc: "Admin escape hatch — NocoDB",
      href: "https://people.loyaltyrealtygroup.com",
      groups: ["admins"], gated: "Admins",
      icon: [{ t: "r", x: 4, y: 4, w: 16, h: 16, rx: 2 }, "M4 10h16M10 10v10"] },
    { id: "launchpad-admin", name: "Launchpad Links", desc: "Manage link sections & shortcuts",
      href: TEAM + "/launchpad-admin",
      groups: ["admins"], gated: "Admins",
      icon: ["M10 14a4 4 0 0 0 6 .5l3-3a4 4 0 0 0-5.5-5.8L12 7", "M14 10a4 4 0 0 0-6-.5l-3 3a4 4 0 0 0 5.5 5.8L12 17"] },
    { id: "access-admin", name: "Access Control", desc: "Page & tab access by role",
      href: TEAM + "/access-admin",
      groups: ["admins"], gated: "Admins",
      icon: ["M12 3l7 3v5c0 4-3 6.7-7 8-4-1.3-7-4-7-8V6z", "M9.2 12l2 2 3.6-3.8"] },
    { id: "email-blast-queue", name: "Email Blast Queue", desc: "Fulfill agent blast requests",
      // Gate mirrors the Caddy header_regexp + the eb-api workflow's admin check
      // (admins|team-lead|marketing). Blake is in `marketing`.
      href: TEAM + "/email-blast/admin",
      groups: ["admins", "team-lead", "marketing"], gated: "Marketing", newUntil: "2026-11-14",
      // Inbox / tray glyph -- Blake's fulfillment queue.
      icon: ["M22 12 16 12 14 15 10 15 8 12 2 12", "M5.45 5.11 2 12v6a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-6l-3.45-6.89A2 2 0 0 0 16.76 4H7.24a2 2 0 0 0-1.79 1.11z"] },
    { id: "n8n", name: "Team n8n", desc: "Automation workflows",
      href: "https://n8n.loyaltyrealtygroup.com",
      groups: ["admins"], gated: "Admins",
      icon: [{ t: "c", cx: 6, cy: 12, r: 2.4 }, { t: "c", cx: 18, cy: 6, r: 2.4 }, { t: "c", cx: 18, cy: 18, r: 2.4 }, "M8.2 11 15.8 6.8M8.2 13l7.6 4.2"] },
    { id: "status", name: "System Status", desc: "Uptime monitor",
      href: "https://status.loyaltyrealtygroup.com",
      // Gatus's SSO gate is admins + team-lead, and so is the launchpad:status
      // Page Permissions row; the fallback said admins only.
      groups: ["admins", "team-lead"], gated: "Leads",
      icon: ["M3 12h4l2 6 4-14 2 8h6"] }
  ];

  /* Search-only synonyms per app id: words people type that aren't in the
     app's name or desc. Matched but never displayed. Keep them to terms a
     teammate would actually search for. */
  LRG.appKeywords = {
    dashboard: "stats kpi speed to lead weather holidays",
    cadence: "cadence neglected at risk compliance follow up nudge",
    profile: "bio headshot social pitch59 designations license",
    signature: "email signature footer",
    roster: "directory team agents phone email",
    reengage: "past clients win back sphere",
    "email-studio": "templates fub email drafts",
    "print-studio": "trifold tri-fold brochure flyer print marketing",
    links: "qr code short link sign rider",
    forms: "form intake spanish bilingual",
    "email-blast": "moxi blast newsletter listing announcement",
    "whats-new": "release notes changelog updates new features fixes announcements",
    drawio: "diagram flowchart chart",
    kb: "docs wiki bookstack runbook policy guide",
    people: "recruits recruiting onboarding directory roster agents",
    "email-blast-queue": "moxi blast requests fulfill"
  };

  /* Best bets: curated shortcuts for things people search for by a word
     that isn't in the destination's title (from Umami's "Search Performed"
     queries: "pond" is the #1 search; vendor/lender/plumber/recommend kept
     coming up). Shown as a "Top results" group ahead of Apps. Gated like
     apps (groups) -- the target BookStack pages are in staff-visible books. */
  LRG.bestBets = [
    { name: "Pond Policy & Best Practices", sub: "Knowledge Base · Team Onboarding",
      href: "https://docs.loyaltyrealtygroup.com/books/team-onboarding/page/pond-policy-best-practices",
      keywords: "pond ponds lead pond fub pond claim leads policy", groups: ["staff"] },
    { name: "Vendors & Partners", sub: "Knowledge Base · Team Knowledge",
      href: "https://docs.loyaltyrealtygroup.com/books/team-knowledge/page/vendors-partners",
      keywords: "vendor vendors partner lender lenders loan officer plumber inspector inspection contractor handyman title company recommend recommendation preferred",
      groups: ["staff"] },
    { name: "Permit Search", sub: "Knowledge Base · Team Knowledge",
      href: "https://docs.loyaltyrealtygroup.com/books/team-knowledge/page/permit-search",
      keywords: "permit permits building permit city county", groups: ["staff"] },
    { name: "Getting Started", sub: "Knowledge Base · Team Knowledge",
      href: "https://docs.loyaltyrealtygroup.com/books/team-knowledge/page/getting-started",
      keywords: "new agent start onboarding first day setup", groups: ["staff"] }
  ];

  /* Fallback only — the live source of truth is the "Launchpad Links" NocoDB
     table, served via /webhook/launchpad-links and fetched into LRG.linkCats
     below (LRG.linksReady). This array renders only if that fetch fails, so
     the launchpad/header search never go blank on an n8n hiccup. Manage the
     live data at /launchpad-admin (admins), not here. */
  LRG.linkCatsFallback = [
    { name: "Education", links: [
      { name: "Zillow Academy", host: "academy.zillowgroup.com", badge: "ZA", href: "https://academy.zillowgroup.com/learn/signin" },
      { name: "Ylopo Training", host: "loyaltyrealtygroup.com/tools", badge: "Y", href: "https://www.loyaltyrealtygroup.com/tools" },
      { name: "Nebraska Realty Resource", host: "realtorresource.info", badge: "NR", href: "https://realtorresource.info/dashboard" }
    ]},
    { name: "MLS", links: [
      { name: "GPRMLS (Paragon)", host: "gprmls.paragonrels.com", badge: "GP", href: "https://gprmls.paragonrels.com/" },
      { name: "Southwest Iowa MLS", host: "swi.flexmls.com", badge: "SW", href: "https://swi.flexmls.com/ticket" },
      { name: "RPR", host: "narrpr.com", badge: "RP", href: "https://www.narrpr.com/home" },
      { name: "ShowingTime", host: "showingtime.com", badge: "ST", href: "https://agent.showingtime.com/" }
    ]},
    { name: "Zillow", links: [
      { name: "Zillow", host: "zillow.com", badge: "Z", href: "https://www.zillow.com/" },
      { name: "Premier Agent", host: "zillow.com/premier-agent", badge: "PA", href: "https://www.zillow.com/premier-agent/premium-profile/" },
      { name: "Zillow Pro (ShowCase)", host: "app.zillow-workspace.com", badge: "ZP", href: "https://app.zillow-workspace.com/" }
    ]},
    { name: "Tools", links: [
      { name: "Follow Up Boss", host: "followupboss.com", badge: "FUB", href: "https://nebraskarealty3.followupboss.com/2/" },
      { name: "cal.novacat.cc", host: "scheduling", badge: "CAL", href: "https://cal.novacat.cc/" }
    ]}
  ];
  LRG.linkCats = LRG.linkCatsFallback;

  /* Page & tab permissions (Phase 2, 2026-07-29): the same /webhook/launchpad-links
     response now also carries pagePerms[] (one row per governed page/tab, from the
     Page Permissions NocoDB table that People > Settings edits). LRG.canSee consults
     it for launchpad tile visibility, and Cadence reads it (via LRG.pageVisible) for
     its own lead tabs. Empty by default → every consumer falls back to its own static
     rule (tile.groups / IS_LEAD) if the fetch fails or a key has no row, so nothing
     regresses on an n8n hiccup. The seeded rows replicate today's behavior exactly,
     so even before any admin edit the table-driven result matches the static one. */
  LRG.pagePerms = [];

  /* "New" badges (v1.5.0). The launchpad owns them: /launchpad-admin sets a
     "new until" date per app, served as appMeta[] ({id, newUntil}) by the same
     launchpad-links webhook. An app with no appMeta row falls back to its
     registry newUntil. The badge shows while today (the viewer's local date)
     is on or before newUntil. app.isNew is recomputed here, so every reader
     (Apps menu, launchpad grid, search) keeps reading a plain a.isNew. An
     entry with neither (e.g. pushed by a page) keeps its own isNew. */
  LRG.appMeta = [];
  function localISODate(d) {
    function p(n) { return (n < 10 ? "0" : "") + n; }
    return d.getFullYear() + "-" + p(d.getMonth() + 1) + "-" + p(d.getDate());
  }
  function applyAppMeta() {
    var meta = {}, today = localISODate(new Date());
    (LRG.appMeta || []).forEach(function (m) { if (m && m.id) meta[m.id] = m; });
    LRG.apps.forEach(function (a) {
      var has = Object.prototype.hasOwnProperty.call(meta, a.id);
      if (!has && a.newUntil === undefined) return;
      var until = has ? meta[a.id].newUntil : a.newUntil;
      a.isNew = typeof until === "string" && /^\d{4}-\d{2}-\d{2}$/.test(until) && today <= until;
    });
  }
  LRG.applyAppMeta = applyAppMeta;
  applyAppMeta();

  /* Live link sections, fetched from the "Launchpad Links" n8n workflow
     (backed by NocoDB, editable at /launchpad-admin). searchLocal() and the
     launchpad's own render() both read LRG.linkCats fresh on every call, so
     reassigning it here is all that's needed for the update to reach every
     portal page's header search as well as the launchpad grid — no changes
     needed to searchProviders/attachSearch. On fetch failure, LRG.linkCats
     simply keeps LRG.linkCatsFallback's value (set just above). Same fetch now
     also populates LRG.pagePerms (see above). */
  /* Fetched on the team hosts, and from docs. (the Knowledge Base, via
     LRG_API_BASE = team.) with credentialed CORS -- Caddy allows exactly
     that origin. Any other off-team host that ships this file skips the
     doomed cross-origin request and keeps LRG.linkCatsFallback -- no console
     noise, instant. Same response also carries appMeta ("New" dates). */
  LRG.linksReady = TEAM && !API
    ? Promise.resolve()
    : fetch(API + "/webhook/launchpad-links", { credentials: API_CRED })
        .then(function (r) { if (!r.ok) throw new Error(r.status); return r.json(); })
        .then(function (d) {
          if (d && Array.isArray(d.sections)) LRG.linkCats = d.sections;
          if (d && Array.isArray(d.pagePerms)) LRG.pagePerms = d.pagePerms;
          if (d && Array.isArray(d.appMeta)) { LRG.appMeta = d.appMeta; applyAppMeta(); }
        })
        .catch(function () { /* keep LRG.linkCatsFallback, empty pagePerms, registry newUntil */ });

  LRG.accountLinks = [
    { name: "What's new", desc: "Release notes — new features & fixes",
      href: TEAM + "/whats-new", badge: "✦" },
    { name: "Getting started", desc: "Guided portal setup — take it anytime",
      href: TEAM + "/onboarding", badge: "GO" },
    { name: "Account & security", desc: "Password, MFA, sessions (Authentik)",
      href: "https://portal.loyaltyrealtygroup.com/if/user/", badge: "AK" },
    { name: "Sign out", desc: "End your session everywhere",
      href: "https://portal.loyaltyrealtygroup.com/flows/-/default/invalidation/", badge: "→" }
  ];

  /* ---- identity ------------------------------------------------ */
  LRG.whoamiUrl = window.LRG_WHOAMI || API + "/whoami";

  function roleFromGroups(groups) {
    if (groups.indexOf("admins") !== -1) return "Admin";
    if (groups.indexOf("team-lead") !== -1) return "Team Lead";
    if (groups.indexOf("recruiting") !== -1 || groups.indexOf("recruiter") !== -1) return "Recruiter";
    if (groups.indexOf("marketing") !== -1) return "Marketing";
    return "Agent";
  }

  /* Six-role resolution (Phase 2, 2026-07-29) -- the SAME order/logic as
     people-app's server.js resolveRole(), so the Page Permissions table (which
     has one column per role) is read consistently across the site. Distinct
     from roleFromGroups above, which is a coarser DISPLAY label (no staff/
     observer). MUST run on the RAW groups, not expandGroups()'d ones: an agent
     expands to include "staff", which would misresolve them as staff -- staff
     is checked before the agent fallback, exactly as people-app does (a user in
     both staff and agent resolves to staff, the established behavior). */
  function resolveRole(groups) {
    var has = function (g) { return groups.indexOf(g) !== -1; };
    if (has("admins")) return "admin";
    if (has("leads") || has("team-lead")) return "lead";
    if (has("recruiting") || has("recruiter")) return "recruiter";
    if (has("staff")) return "staff";
    if (has("observers")) return "observer";
    return "agent";
  }
  LRG.resolveRole = resolveRole;

  /* Group hierarchy (PORTAL-DESIGN §5): staff is the baseline every team
     member has; team-lead and recruiting are staff-plus; admins see all.
     Authentik memberships are literal (an admin need not be in `staff`),
     so expand before filtering tiles/menu/search. NOTE: forward-auth
     sessions cache group claims — Authentik group changes appear only
     after sign-out/sign-in. */
  function expandGroups(groups) {
    var g = groups.slice();
    var has = function (x) { return g.indexOf(x) !== -1; };
    if (has("admins")) ["staff", "team-lead", "recruiting", "recruiter"].forEach(function (x) { if (!has(x)) g.push(x); });
    if (has("team-lead") && !has("staff")) g.push("staff");
    if ((has("recruiting") || has("recruiter")) && !has("staff")) g.push("staff");
    // Javi split agents out of "staff" 2026-07-26 for the People app's role
    // model -- exact literal group name unconfirmed ("agent" per chat,
    // "agents" was this repo's working assumption before that), so both are
    // accepted here. Without this, that split would silently unpublish every
    // staff-gated tile (Agent Dashboard, Cadence, Email Signature, Roster,
    // People) from every agent's launchpad the moment they're moved, not just
    // People -- this keeps "staff" meaning "any team member" for tile
    // visibility, same as team-lead/recruiting above, while People's OWN
    // internal tabs still tell staff and agent apart via its finer-grained
    // role resolution.
    if ((has("agents") || has("agent")) && !has("staff")) g.push("staff");
    return g;
  }

  var idResolve;
  LRG.identity = null;
  LRG.ready = new Promise(function (res) { idResolve = res; });

  function finishIdentity(id) {
    LRG.identity = id;
    idResolve(id);
    document.dispatchEvent(new CustomEvent("lrg:identity", { detail: id }));
  }

  (function fetchIdentity() {
    fetch(LRG.whoamiUrl, { credentials: API_CRED })
      .then(function (r) { if (!r.ok) throw 0; return r.json(); })
      .then(function (j) {
        var groups = String(j.groups || "").split(/[|,]/).map(function (s) { return s.trim(); }).filter(Boolean);
        finishIdentity({
          email: j.email || "", name: j.name || j.username || "", username: j.username || "",
          groups: expandGroups(groups.length ? groups : ["staff"]),
          role: roleFromGroups(groups),
          // roleKey resolved from RAW groups (not the expanded set) so the Page
          // Permissions lookup uses the true 6-role identity -- see resolveRole.
          roleKey: resolveRole(groups.length ? groups : ["staff"]),
          firstName: (j.name || j.username || "there").split(" ")[0]
        });
      })
      .catch(function () {
        if (!DEV_HOST) {
          // A real portal host: /whoami failed (an expired session, or Authentik
          // briefly down). Keep the baseline staff view -- display only, every
          // app is still gated server-side -- but flag it, so the account menu
          // offers "Sign in again" instead of greeting a made-up "Preview Agent".
          finishIdentity({ email: "", name: "", username: "", groups: ["staff"],
            role: roleFromGroups(["staff"]), roleKey: resolveRole(["staff"]),
            firstName: "there", unverified: true });
          return;
        }
        // Local dev/preview only: ?role=agent|team-lead|recruiter|admin
        var m = location.search.match(/[?&]role=(agent|team-lead|recruiter|admin)/);
        var previews = {
          "agent": { name: "Preview Agent", groups: ["staff"] },
          "team-lead": { name: "Preview Lead", groups: ["staff", "team-lead"] },
          "recruiter": { name: "Preview Recruiter", groups: ["staff", "recruiting"] },
          "admin": { name: "Preview Admin", groups: ["staff", "team-lead", "recruiting", "admins"] }
        };
        var p = previews[(m && m[1]) || "agent"];
        finishIdentity({ email: "", name: p.name, username: "", groups: p.groups,
          role: roleFromGroups(p.groups), roleKey: resolveRole(p.groups),
          firstName: p.name.split(" ")[0], preview: true });
      });
  })();

  /* Table-driven page/tab visibility (Phase 2, 2026-07-29). Returns true/false
     when the Page Permissions table (LRG.pagePerms) has a row for (app,key) and
     the current user's resolved role; returns null when it can't decide (perms
     not loaded, no role yet, or no matching row) so the CALLER falls back to its
     own static rule. Used by canSee below (app="launchpad", key=tile id) and by
     Cadence (app="cadence", key="team-view"). */
  LRG.pageVisible = function (app, key) {
    var pp = LRG.pagePerms;
    var role = LRG.identity && LRG.identity.roleKey;
    if (!pp || !pp.length || !role) return null;
    for (var i = 0; i < pp.length; i++) {
      if (pp[i].app === app && pp[i].key === key) {
        return (pp[i].levels && pp[i].levels[role]) === "visible";
      }
    }
    return null;
  };

  /* Launchpad tile visibility. Consults the Page Permissions table first (by the
     tile's `id`), and falls back to the tile's static `groups` array (the
     pre-Phase-2 behavior) whenever the table can't decide — so a failed perms
     fetch, or a tile with no row yet, degrades to exactly today's gating. The
     seeded rows replicate the static result, so steady-state is unchanged; an
     admin's edit in People > Settings is what makes this diverge. */
  LRG.canSee = function (app, groups) {
    if (app.env === "qa" && !(QA_HOST || DEV_HOST)) return false;   // QA-only tile
    var pv = LRG.pageVisible("launchpad", app.id);
    if (pv !== null) return pv;
    return app.groups.some(function (g) { return groups.indexOf(g) !== -1; });
  };

  /* ---- theme --------------------------------------------------- */
  var THEME_KEY = "lrg-theme";
  // The button shows what a click switches TO: a moon in light, a sun in dark.
  var MOON = '<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20.5 14.1A8.5 8.5 0 1 1 9.9 3.5a6.6 6.6 0 0 0 10.6 10.6z"/></svg>';
  var SUN = '<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="4"/><path d="M12 2v2M12 20v2M4.9 4.9l1.4 1.4M17.7 17.7l1.4 1.4M2 12h2M20 12h2M4.9 19.1l1.4-1.4M17.7 6.3l1.4-1.4"/></svg>';
  function applyTheme(t) {
    document.documentElement.setAttribute("data-theme", t);
    var btn = document.getElementById("theme-btn");
    if (btn) {
      btn.innerHTML = t === "dark" ? SUN : MOON;
      // A toggle: one fixed name, state in aria-pressed (was a static
      // "Toggle dark mode" label with a text glyph that never said which).
      btn.setAttribute("aria-label", "Dark mode");
      btn.setAttribute("aria-pressed", String(t === "dark"));
      btn.title = t === "dark" ? "Switch to light mode" : "Switch to dark mode";
    }
  }
  (function initTheme() {
    var saved = null;
    try { saved = localStorage.getItem(THEME_KEY); } catch (e) {}
    var sys = window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)");
    applyTheme(saved || (sys && sys.matches ? "dark" : "light"));
    if (sys && sys.addEventListener) sys.addEventListener("change", function (e) {
      var s = null; try { s = localStorage.getItem(THEME_KEY); } catch (err) {}
      if (!s) applyTheme(e.matches ? "dark" : "light"); // follow system until user chooses
    });
    // Every team. app shares one origin, so a toggle in one open tab reaches
    // the others through the storage event.
    window.addEventListener("storage", function (e) {
      if (e.key === THEME_KEY) applyTheme(e.newValue || (sys && sys.matches ? "dark" : "light"));
    });
    // lrg.css holds the body's colour transition until this class lands, so
    // the first switch away from a page's hard-coded light theme is instant
    // instead of a 200 ms fade on every page load.
    var raf = window.requestAnimationFrame || function (f) { return setTimeout(f, 16); };
    raf(function () { raf(function () {
      try { document.documentElement.classList.add("lrg-theme-ready"); } catch (e) {}
    }); });
  })();
  /* ---- logo → launchpad ---------------------------------------- */
  /* Every app's markup has <div class="lrg-logo">. Swap it for a real <a href>
     (v1.5.0) so cmd/middle-click and the link preview work; it used to be a
     div with role="link" and click handlers. No-op on the launchpad itself
     and on a logo that is already a link, so running it twice is safe. */
  function wireLogos() {
    if (location.pathname === "/" || location.pathname === "/index.html") return; // already home
    var logos = document.querySelectorAll(".lrg-logo");
    for (var i = 0; i < logos.length; i++) {
      var el = logos[i];
      if (el.tagName === "A" || !el.parentNode) continue;
      var a = document.createElement("a");
      for (var k = 0; k < el.attributes.length; k++) {
        if (el.attributes[k].name !== "role") a.setAttribute(el.attributes[k].name, el.attributes[k].value);
      }
      a.href = TEAM + "/";
      a.title = "Back to the Team Portal";
      a.setAttribute("aria-label", (el.getAttribute("aria-label") || "Loyalty Realty Group") + " — back to the Team Portal");
      el.parentNode.replaceChild(a, el);
    }
  }
  wireLogos();

  LRG.toggleTheme = function () {
    var next = document.documentElement.getAttribute("data-theme") === "dark" ? "light" : "dark";
    applyTheme(next);
    try { localStorage.setItem(THEME_KEY, next); } catch (e) {}
  };

  /* ---- svg helpers --------------------------------------------- */
  function svgIcon(parts, size) {
    var s = '<svg width="' + (size || 24) + '" height="' + (size || 24) +
      '" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">';
    parts.forEach(function (p) {
      if (typeof p === "string") s += '<path d="' + p + '"/>';
      else if (p.t === "c") s += '<circle cx="' + p.cx + '" cy="' + p.cy + '" r="' + p.r + '"/>';
      else if (p.t === "r") s += '<rect x="' + p.x + '" y="' + p.y + '" width="' + p.w + '" height="' + p.h + '" rx="' + (p.rx || 0) + '"/>';
    });
    return s + "</svg>";
  }
  LRG.svgIcon = svgIcon;

  function esc(s) {
    return String(s).replace(/[&<>"']/g, function (c) {
      return { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c];
    });
  }
  LRG.esc = esc;

  /* ---- apps launcher + account menus ----------------------------- */
  /* Account rows: account-linked apps (My Profile) + LRG.accountLinks. They
     live in the header's account menu; the Apps menu shows them only for a
     page that opts out of that menu (initHeader({ account: false })). */
  function accountRows(groups) {
    var html = "";
    LRG.apps.filter(function (a) { return LRG.canSee(a, groups) && a.accountLink; }).forEach(function (a) {
      html += '<a class="lrg-uresult" href="' + esc(a.href) + '" data-umami-event="App Open" data-umami-event-app="' + esc(a.name) + '">' +
        '<span class="lrg-uresult__icon">' + svgIcon(a.icon, 15) + '</span>' +
        '<span class="lrg-uresult__label">' + esc(a.name) +
        (a.isNew ? ' <span class="lrg-badge lrg-badge--brand">New</span>' : "") + "</span></a>";
    });
    LRG.accountLinks.forEach(function (l) {
      html += '<a class="lrg-uresult" href="' + esc(l.href) + '" data-umami-event="Account Link" data-umami-event-link="' + esc(l.name) + '">' +
        '<span class="lrg-uresult__icon">' + esc(l.badge) + '</span>' +
        '<span class="lrg-uresult__label">' + esc(l.name) + "</span></a>";
    });
    return html;
  }

  function buildAppsMenu(container, currentApp, groups, withAccount) {
    var vis = LRG.apps.filter(function (a) { return LRG.canSee(a, groups) && !a.accountLink; });
    var html = '<div class="lrg-eyebrow">Your apps</div><div class="lrg-app-grid">';
    vis.forEach(function (a) {
      html += '<a class="lrg-app-tile" href="' + esc(a.href) + '"' +
        ' data-umami-event="App Open" data-umami-event-app="' + esc(a.name) + '"' +
        (a.id === currentApp ? ' aria-current="page"' : "") + ">" +
        svgIcon(a.icon, 22) + "<span>" + esc(a.name) + "</span>" +
        (a.isNew ? '<span class="lrg-app-tile__new">New</span>' : "") + "</a>";
    });
    html += "</div>";
    if (withAccount) html += '<div class="lrg-menu__section"><div class="lrg-eyebrow">Account</div>' + accountRows(groups) + "</div>";
    container.innerHTML = html;
  }

  /* The menus hang off their button's right edge. If a crowded header wraps the
     button onto a second line at the left, that runs off the left of the
     screen, so slide the panel back into view (the search panel's fit() does
     the same on the right). */
  function keepOnScreen(panel) {
    panel.style.transform = "";
    var r = panel.getBoundingClientRect(), over = 8 - r.left;
    if (over > 0) panel.style.transform = "translateX(" + Math.max(0, Math.min(over, window.innerWidth - 8 - r.right)) + "px)";
  }

  /* A header button that opens a panel of links (Apps, account). Not an ARIA
     menu -- just a disclosure: aria-expanded/-controls on the button; outside
     click, Esc (focus returns to the button) or tabbing away closes it. */
  function wireDisclosure(btn, panel, holder) {
    btn.removeAttribute("aria-haspopup");
    btn.setAttribute("aria-controls", panel.id);
    btn.setAttribute("aria-expanded", "false");
    function set(open, refocus) {
      panel.hidden = !open;
      btn.setAttribute("aria-expanded", String(open));
      if (open) keepOnScreen(panel);
      if (!open && refocus) btn.focus();
    }
    btn.addEventListener("click", function () { set(panel.hidden); });
    document.addEventListener("click", function (e) { if (!holder.contains(e.target)) set(false); });
    document.addEventListener("keydown", function (e) {
      if (e.key === "Escape" && !panel.hidden) set(false, holder.contains(document.activeElement));
    });
    holder.addEventListener("focusout", function (e) {
      if (e.relatedTarget && !holder.contains(e.relatedTarget)) set(false);
    });
  }

  /* "Apps" is a bare text node in every app's button markup; wrap it so the
     phone layout can show the icon alone (the button keeps its name). */
  function labelAppsButton(btn) {
    for (var n = btn.firstChild; n; n = n.nextSibling) {
      if (n.nodeType === 3 && /\S/.test(n.nodeValue)) {
        var s = document.createElement("span");
        s.className = "lrg-btn__label";
        s.textContent = n.nodeValue.trim();
        btn.replaceChild(s, n);
        break;
      }
    }
    if (!btn.getAttribute("aria-label")) btn.setAttribute("aria-label", "Apps");
  }

  /* Tag the title block (the phone layout lets it shrink and hides the
     subtitle), and on team-qa. add a QA badge + tab-title prefix so QA is
     never mistaken for prod. */
  function markHeader() {
    var title = document.querySelector(".lrg-header .lrg-header__title");
    if (!title) return;
    var inner = title.closest ? title.closest(".lrg-header__inner") : null;
    var block = title.parentElement && title.parentElement !== inner ? title.parentElement : title;
    block.classList.add("lrg-header__titles");
    if (QA_HOST && !document.querySelector(".lrg-envbadge")) {
      // Beside the title block, not inside it: on a phone the title truncates
      // and would take the badge with it.
      var b = document.createElement("span");
      b.className = "lrg-envbadge";
      b.textContent = "QA";
      b.title = "QA environment (team-qa.loyaltyrealtygroup.com)";
      block.parentNode.insertBefore(b, block.nextSibling);
      if (document.title.indexOf("QA · ") !== 0) document.title = "QA · " + document.title;
    }
  }

  function accountMenuHTML(id) {
    var who = id.unverified
      ? '<div class="lrg-acct__who"><strong>Sign-in not confirmed</strong>' +
        "<span>Some apps and search results may be missing.</span>" +
        '<a class="lrg-btn lrg-btn--secondary lrg-acct__retry" href="' + esc(location.href) + '">Sign in again</a></div>'
      : '<div class="lrg-acct__who"><strong>' + esc(id.name || id.username || "Signed in") + "</strong>" +
        (id.email ? "<span>" + esc(id.email) + "</span>" : "") +
        (id.role ? '<span class="lrg-badge lrg-badge--info">' + esc(id.role) + "</span>" : "") + "</div>";
    return who + '<div class="lrg-menu__section">' + accountRows(id.groups) + "</div>";
  }

  /* The account menu: initials button at the end of the header, opening the
     signed-in name/role and the account rows (My Profile, Getting started,
     Account & security, Sign out -- moved here from the Apps menu). */
  function mountAccount(id) {
    var inner = document.querySelector(".lrg-header .lrg-header__inner");
    if (!inner || inner.querySelector(".lrg-acct")) return;
    var name = id.name || id.username || "";
    var holder = document.createElement("div");
    holder.className = "lrg-acct";
    var btn = document.createElement("button");
    btn.type = "button";
    btn.className = "lrg-acct__btn" + (id.unverified ? " lrg-acct__btn--warn" : "");
    btn.textContent = id.unverified ? "!" : initialsOf(name);
    btn.setAttribute("aria-label", id.unverified ? "Account (sign-in not confirmed)" : "Account: " + name);
    btn.title = id.unverified ? "We couldn't confirm your sign-in" : name + (id.role ? " · " + id.role : "");
    var menu = document.createElement("div");
    menu.className = "lrg-menu lrg-acct__menu";
    menu.id = "lrg-acct-menu";
    menu.hidden = true;
    menu.innerHTML = accountMenuHTML(id);
    holder.appendChild(btn);
    holder.appendChild(menu);
    inner.appendChild(holder);
    wireDisclosure(btn, menu, holder);
    LRG.linksReady.then(function () { menu.innerHTML = accountMenuHTML(id); }); // Page Permissions can hide My Profile
  }

  /* ---- universal search ---------------------------------------- */
  /* Providers for async groups (P2): set window.LRG.searchProviders =
     { agents: q => Promise<[{name,sub,href}]>, docs: q => Promise<[...]> } */
  LRG.searchProviders = LRG.searchProviders || {};

  /* Auto-register the live Docs/Agents/Contacts/Recruits providers on portal
     hosts. All hit gated same-origin endpoints; the server injects the
     trusted X-Authentik-Email/Groups, the client never sees a token. Docs/
     Agents/Contacts proxy Caddy -> team-n8n; Recruits proxies Caddy ->
     people-app directly (reuses people-app's own RECRUITING_TAB_ROLES
     instead of a duplicated n8n branch -- see DECISIONS.md D-010). A failure
     rejects; err.auth marks an expired sign-in (a 401, or forward_auth's
     redirect to the login page, which redirect:"manual" surfaces instead
     of following) so the panel can say so instead of "No matches". */
  function searchError(auth) { var e = new Error(auth ? "signed out" : "search failed"); e.auth = !!auth; return e; }
  if (/^team(-qa)?\.loyaltyrealtygroup\.com$/.test(location.hostname) || KB) {
    ["docs", "agents", "contacts", "recruits"].forEach(function (key) {
      // opts.signal (optional) lets the caller abort a superseded query.
      LRG.searchProviders[key] = function (q, opts) {
        return fetch(API + "/api/search/" + key + "?q=" + encodeURIComponent(q),
          { credentials: API_CRED, signal: opts && opts.signal, redirect: "manual" })
          .then(function (r) {
            if (r.type === "opaqueredirect" || r.status === 401) throw searchError(true);
            if (!r.ok) throw searchError(false);
            return r.json();
          });
      };
    });
  }

  /* ---- shared result helpers ----------------------------------------
     Ranking, match-highlighting and agent avatars live here (exposed on
     LRG.*) so the header dropdown below, launchpad-app's hero search, and
     the BookStack head all share ONE implementation. Change once, land
     everywhere. */

  /* Relevance score for a local (apps/links) row: higher = better, -1 = miss.
     Cheap + good-enough: exact > prefix > word-boundary > substring, minus a
     small position penalty so an earlier match edges out a later one.
     Multi-word queries that don't match as one phrase fall back to "every
     word appears somewhere" (so "blast email" finds Email Blasts), scored
     below any whole-phrase hit. */
  function scoreRun(h, t) {
    var i = h.indexOf(t);
    if (i === -1) return -1;
    var score = 100 - Math.min(i, 60);
    if (i === 0) score += 400;                               // prefix
    else if (/[\s·\-\/]/.test(h.charAt(i - 1))) score += 200; // word boundary
    return score;
  }
  function queryWords(q) { return String(q).toLowerCase().split(/\s+/).filter(Boolean); }

  /* Edit distance (with adjacent transpositions), giving up once it must
     exceed max. Only ever called on short words. */
  function editDistance(a, b, max) {
    if (Math.abs(a.length - b.length) > max) return max + 1;
    var prev2 = null, prev = [], cur, i, j;
    for (j = 0; j <= b.length; j++) prev[j] = j;
    for (i = 1; i <= a.length; i++) {
      cur = [i];
      var rowMin = i;
      for (j = 1; j <= b.length; j++) {
        var cost = a.charAt(i - 1) === b.charAt(j - 1) ? 0 : 1;
        var v = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + cost);
        if (prev2 && i > 1 && j > 1 && a.charAt(i - 1) === b.charAt(j - 2) && a.charAt(i - 2) === b.charAt(j - 1))
          v = Math.min(v, prev2[j - 2] + 1);
        cur[j] = v;
        if (v < rowMin) rowMin = v;
      }
      if (rowMin > max) return max + 1;
      prev2 = prev; prev = cur;
    }
    return prev[b.length];
  }
  /* Typo tolerance for one query word: 5+ letters may be 1 edit off a word in
     the haystack (or that word's same-length prefix, so a half-typed "vendr"
     still counts); 8+ letters may be 2 off. Digits never fuzz. */
  function fuzzyWord(w, hayWords) {
    if (w.length < 5 || /\d/.test(w)) return false;
    var max = w.length >= 8 ? 2 : 1;
    for (var k = 0; k < hayWords.length; k++) {
      var hw = hayWords[k];
      if (hw.length < 4) continue;
      if (editDistance(w, hw, max) <= max) return true;
      if (hw.length > w.length && editDistance(w, hw.slice(0, w.length), max) <= max) return true;
    }
    return false;
  }
  function scoreMatch(haystack, q) {
    if (!q) return 0;
    var h = String(haystack == null ? "" : haystack).toLowerCase();
    q = String(q).toLowerCase().trim();
    var whole = scoreRun(h, q);
    if (whole >= 0) return whole + (h === q ? 500 : 0);      // exact
    var words = queryWords(q), sum = 0, fuzzy = 0, hayWords = null;
    for (var k = 0; k < words.length; k++) {
      var s = scoreRun(h, words[k]);
      if (s < 0) {
        hayWords = hayWords || h.split(/[^a-z0-9]+/);
        if (!fuzzyWord(words[k], hayWords)) return -1;
        fuzzy++; s = 0;
      }
      sum += s;
    }
    if (fuzzy) return 20;                                    // typo hit: rank last
    if (words.length < 2) return -1;
    return Math.round(sum / words.length) - 60;
  }
  LRG.scoreMatch = scoreMatch;

  /* Escape text, then wrap the matched run of q in <mark> -- the whole phrase
     when it appears, else the first hit of each query word. Each segment is
     escaped independently, so this stays XSS-safe. */
  function matchHTML(text, q) {
    text = String(text == null ? "" : text);
    q = String(q == null ? "" : q).trim();
    if (!q) return esc(text);
    var lt = text.toLowerCase(), ranges = [];
    var i = lt.indexOf(q.toLowerCase());
    if (i !== -1) ranges.push([i, i + q.length]);
    else queryWords(q).forEach(function (w) {
      var j = lt.indexOf(w);
      if (j !== -1) ranges.push([j, j + w.length]);
    });
    if (!ranges.length) return esc(text);
    ranges.sort(function (a, b) { return a[0] - b[0]; });
    var out = "", pos = 0;
    ranges.forEach(function (r) {
      if (r[1] <= pos) return;                 // swallowed by an earlier run
      var a = Math.max(r[0], pos);
      out += esc(text.slice(pos, a)) + '<mark class="lrg-hl">' + esc(text.slice(a, r[1])) + "</mark>";
      pos = r[1];
    });
    return out + esc(text.slice(pos));
  }
  LRG.matchHTML = matchHTML;

  function initialsOf(name) {
    var parts = String(name == null ? "" : name).trim().split(/\s+/).filter(Boolean);
    if (!parts.length) return "?";
    var a = parts[0].charAt(0) || "";
    var b = parts.length > 1 ? (parts[parts.length - 1].charAt(0) || "") : "";
    return ((a + b).toUpperCase().replace(/[^A-Z0-9]/g, "")) || "?";
  }
  LRG.initialsOf = initialsOf;

  /* Only ever trust an avatar URL on our own asset host (defense-in-depth:
     the roster field can't smuggle an off-domain image into the panel). */
  function safeAvatar(url) {
    return (url && /^https:\/\/assets\.loyaltyrealtygroup\.com\//.test(url)) ? url : "";
  }
  LRG.safeAvatar = safeAvatar;

  /* Inner HTML for a result's 26px icon box. Agent rows carry r.avatar; the
     <img> is overlaid on the initials so a broken image falls back cleanly
     to initials. Everything else keeps its icon/badge. */
  /* A broken headshot tries data-full (the original behind a thumb) once,
     then removes itself so the initials underneath show. One capture-phase
     listener instead of inline onerror: docs. (BookStack) sends a nonce +
     strict-dynamic CSP, which never runs inline handlers. Images that carry
     their own onerror (launchpad's hero uses LRG.imgFallback) are left to it. */
  var IMG_FALLBACK = "var f=this.getAttribute('data-full');if(f){this.removeAttribute('data-full');this.src=f}else{this.remove()}";
  LRG.imgFallback = IMG_FALLBACK;
  document.addEventListener("error", function (e) {
    var img = e.target;
    if (!img || img.tagName !== "IMG" || !img.classList.contains("lrg-uresult__img") || img.hasAttribute("onerror")) return;
    var f = img.getAttribute("data-full");
    if (f) { img.removeAttribute("data-full"); img.src = f; } else img.remove();
  }, true);
  function iconInner(r) {
    var av = safeAvatar(r.avatar), full = safeAvatar(r.avatarFull);
    if (av) {
      return '<span class="lrg-ini">' + esc(initialsOf(r.name)) + "</span>" +
        '<img class="lrg-uresult__img" src="' + esc(av) + '"' +
        (full && full !== av ? ' data-full="' + esc(full) + '"' : "") +
        ' alt="" loading="lazy">';
    }
    return r.iconHtml || (r.badge ? esc(r.badge) : "");
  }
  LRG.iconInner = iconInner;

  /* Per-group result caps for the dropdown + the "See all" destinations.
     Keeps a common surname from dumping 40 agents into the panel. */
  /* Caps sit BELOW the providers' own server-side limit (8 rows), otherwise
     the "See all" tail can never trigger. */
  var GROUP_CAP = { apps: 8, links: 6, agents: 5, docs: 5, contacts: 6, recruits: 6 };
  function moreDest(key, q) {
    if (key === "agents") return { label: "See all in Team Directory", href: TEAM + "/people#directory?q=" + encodeURIComponent(q), newTab: false };
    if (key === "docs") return { label: "See all docs for “" + q + "”", href: "https://docs.loyaltyrealtygroup.com/search?term=" + encodeURIComponent(q), newTab: !KB };
    return null; // links/contacts/recruits: cap silently (no clean deep target)
  }

  /* ---- remote (async) groups: one engine for every search surface ----
     Fixed display order, so groups never shuffle with network timing. Docs
     first: nearly every real query so far (Umami, Aug-Oct 2026) was a policy
     or how-to lookup ("pond", "permit", "vendor"). */
  var REMOTE_GROUPS = [["docs", "Docs"], ["agents", "Agents"], ["contacts", "My Contacts"], ["recruits", "Recruiting"]];
  var REMOTE_NEWTAB = { docs: !KB, contacts: true };   // on the KB, docs open in place
  var REMOTE_MIN = 2;           // one letter matches half the roster -- not worth 4 requests
  var REMOTE_TTL = 60000;       // re-focusing / backspacing re-uses a recent answer
  var remoteCache = {}, remoteCacheKeys = [];

  function runProvider(key, q, signal) {
    var ck = key + "\u0000" + q.toLowerCase(), hit = remoteCache[ck];
    if (hit && Date.now() - hit.t < REMOTE_TTL) return Promise.resolve(hit.rows);
    return Promise.resolve(LRG.searchProviders[key](q, { signal: signal })).then(function (rows) {
      rows = Array.isArray(rows) ? rows : [];
      remoteCache[ck] = { t: Date.now(), rows: rows };
      remoteCacheKeys.push(ck);
      if (remoteCacheKeys.length > 40) delete remoteCache[remoteCacheKeys.shift()];
      return rows;
    });
  }

  /* Run every registered provider for q. onGroup(key, label, rows, err) fires
     once per provider as it resolves unless the handle was aborted first;
     on failure rows = [] and err = "auth" (sign-in expired) or "error".
     Returns { done, abort, failed }: `done` resolves once every provider has
     settled, with the total row count; `failed` collects { key, label, auth }
     for the providers that errored. Rows are shared with the cache --
     callers must not mutate them. */
  function searchRemote(q, onGroup) {
    var ctl = typeof AbortController === "function" ? new AbortController() : null;
    var aborted = false, total = 0, failed = [];
    var jobs = REMOTE_GROUPS.map(function (pair) {
      var key = pair[0];
      if (q.length < REMOTE_MIN || typeof LRG.searchProviders[key] !== "function") return null;
      return runProvider(key, q, ctl && ctl.signal)
        .then(function (rows) { return { rows: rows }; },
          function (e) { return { rows: [], err: e && e.auth ? "auth" : "error" }; })
        .then(function (res) {
          if (aborted) return;
          if (res.err) failed.push({ key: key, label: pair[1], auth: res.err === "auth" });
          total += res.rows.length;
          onGroup(key, pair[1], res.rows, res.err);
        });
    }).filter(Boolean);
    return {
      pending: jobs.length > 0,
      failed: failed,
      done: Promise.all(jobs).then(function () { return total; }),
      abort: function () { aborted = true; if (ctl) try { ctl.abort(); } catch (e) {} }
    };
  }
  LRG.searchRemote = searchRemote;

  /* Per-surface tidy-up of a provider's rows before rendering: agent rows
     deep-link into the directory, and Docs drops pages already shown as a
     best bet. Provider data is never trusted as markup or as a link scheme:
     any provider iconHtml is replaced with our own, and a row whose href
     isn't https:// or same-site is dropped. Each row is tagged with its
     group (`group`) so telemetry and Recent can tell client rows apart.
     Returns new objects -- the cached rows stay untouched. */
  function safeHref(h) { return typeof h === "string" && /^(https:\/\/|\/(?!\/))/.test(h); }
  function prepRemoteRows(key, rows, skipHrefs) {
    return rows.filter(function (r) { return r && !(skipHrefs && skipHrefs[r.href]); })
      .map(function (r) {
        var o = {}; for (var k in r) if (Object.prototype.hasOwnProperty.call(r, k)) o[k] = r[k];
        if (key === "agents") o.href = agentHref(r);
        o.group = key;
        // No photo: a book for docs, initials for people (else an empty box).
        o.iconHtml = safeAvatar(o.avatar) ? "" :
          key === "docs" ? BET_ICON : '<span class="lrg-ini">' + esc(initialsOf(o.name)) + "</span>";
        return o;
      })
      .filter(function (o) { return safeHref(o.href); });
  }
  /* My Contacts (FUB clients) and Recruiting rows name private people: they
     never go into Recent or analytics. */
  var PRIVATE_GROUPS = { contacts: 1, recruits: 1 };
  LRG.searchPrepRows = prepRemoteRows;
  LRG.searchGroups = REMOTE_GROUPS;
  LRG.searchGroupCap = function (key) { return GROUP_CAP[key] || 6; };
  LRG.searchMoreDest = moreDest;
  LRG.searchNewTab = function (key) { return !!REMOTE_NEWTAB[key]; };
  function moreRow(label, href, newTab) {
    return '<a class="lrg-uresult lrg-uresult--more" href="' + esc(href) + '"' +
      (newTab ? ' target="_blank" rel="noopener"' : "") + ">" +
      '<span class="lrg-uresult__icon lrg-uresult__icon--more">' +
      '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M5 12h14M13 6l6 6-6 6"/></svg></span>' +
      '<span class="lrg-uresult__label">' + esc(label) + "</span></a>";
  }

  var BET_ICON = '<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M4 19.5A2.5 2.5 0 0 1 6.5 17H20V3H6.5A2.5 2.5 0 0 0 4 5.5z"/><path d="M4 19.5A2.5 2.5 0 0 0 6.5 22H20v-5"/></svg>';
  var RECENT_ICON = '<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="9"/><path d="M12 7v5l3 2"/></svg>';

  /* Recently opened results (last 5 per signed-in user, in this browser) --
     shown when the header search is focused empty. Stored under a hash of
     the user's email so a shared computer never shows one person's list to
     the next; nothing is stored without a real identity. My Contacts and
     Recruiting rows are never saved (PRIVATE_GROUPS), and every list in
     this browser is wiped on Sign out. A convenience only: every read/write
     is try/catch'd and anything malformed is dropped. */
  var RECENT_PREFIX = "lrg-search-recent";
  function recentKey() {
    var id = LRG.identity;
    return id && id.email && !id.preview ? RECENT_PREFIX + ":" + lrgHash32(id.email.trim().toLowerCase()) : null;
  }
  function recentClearAll() {
    try {
      for (var i = localStorage.length - 1; i >= 0; i--) {
        var k = localStorage.key(i);
        if (k && k.indexOf(RECENT_PREFIX) === 0) localStorage.removeItem(k);
      }
    } catch (e) {}
  }
  // v1.4.1 and earlier kept one shared list (with client names) per browser.
  try { localStorage.removeItem(RECENT_PREFIX); } catch (e) {}
  // Sign out (any app's link to Authentik's invalidation flow) clears Recent
  // and the cached analytics id.
  document.addEventListener("click", function (e) {
    var a = e.target && e.target.closest && e.target.closest("a[href]");
    if (a && /\/flows\/-\/default\/invalidation\/|\/outpost\.goauthentik\.io\/sign_out/.test(a.getAttribute("href"))) {
      recentClearAll();
      LRG.analyticsForget();
    }
  }, true);
  function recentGet() {
    var key = recentKey();
    if (!key) return [];
    try {
      var v = JSON.parse(localStorage.getItem(key) || "[]");
      return (Array.isArray(v) ? v : []).filter(function (r) {
        return r && typeof r.name === "string" && safeHref(r.href);
      }).slice(0, 5);
    } catch (e) { return []; }
  }
  function recentAdd(r) {
    var key = recentKey();
    if (!key) return;
    try {
      var list = recentGet().filter(function (x) { return x.href !== r.href; });
      list.unshift(r);
      localStorage.setItem(key, JSON.stringify(list.slice(0, 5)));
    } catch (e) {}
  }
  LRG.searchRecent = { get: recentGet, add: recentAdd, clear: recentClearAll };

  /* Agent rows open the People directory filtered to that person (the
     provider still links the retired /roster, which only redirects). */
  function agentHref(r) { return TEAM + "/people#directory?q=" + encodeURIComponent(r.name || ""); }
  LRG.searchAgentHref = agentHref;

  /* Analytics label for a clicked row: the row's name, except private
     (client/recruit) rows, which log only their group and no query. */
  function trackAttrs(r, q) {
    if (PRIVATE_GROUPS[r.group]) return ' data-umami-event-dest="' + esc(r.group) + '"';
    return ' data-umami-event-query="' + esc(String(q || "").slice(0, 60)) + '"' +
      ' data-umami-event-dest="' + esc(String(r.name || "").slice(0, 60)) + '"';
  }
  LRG.searchTrackAttrs = trackAttrs;
  function resultRow(r, q, newTab) {
    if (newTab == null) newTab = r.newTab;
    return '<a class="lrg-uresult" data-umami-event="Search Result Opened"' + trackAttrs(r, q) +
      (r.group ? ' data-lrg-group="' + esc(r.group) + '"' : "") +
      ' data-lrg-name="' + esc(String(r.name || "").slice(0, 80)) + '"' +
      ' data-lrg-sub="' + esc(String(r.sub || "").slice(0, 120)) + '"' +
      ' href="' + esc(r.href) + '"' + (newTab ? ' target="_blank" rel="noopener"' : "") + ">" +
      '<span class="lrg-uresult__icon">' + iconInner(r) + "</span>" +
      '<span class="lrg-uresult__label">' + matchHTML(r.name, q) +
      (r.isNew ? ' <span class="lrg-badge lrg-badge--brand">New</span>' : "") +
      (r.sub ? ' <span class="lrg-uresult__sub">' + matchHTML(r.sub, q) + "</span>" : "") +
      "</span></a>";
  }

  function searchLocal(q, groups) {
    var lq = q.toLowerCase();
    var out = { bets: [], apps: [], links: [] };
    // Bets are deliberate shortcuts, so they need 3+ characters and a match at
    // the start of a word (or a typo hit, score 20) -- "an" inside "loan"
    // shouldn't surface the vendor list.
    if (lq.length >= 3) LRG.bestBets.forEach(function (b) {
      // Group check only -- bets have no Page Permissions row (canSee would
      // look one up by app id).
      if (!b.groups.some(function (g) { return groups.indexOf(g) !== -1; })) return;
      var sc = scoreMatch(b.name + " " + b.keywords, lq);
      if (sc < 200 && sc !== 20) return;
      out.bets.push({ _s: sc, name: b.name, sub: b.sub, href: b.href, iconHtml: BET_ICON, newTab: true });
    });
    out.bets.sort(function (x, y) { return y._s - x._s; });
    LRG.apps.forEach(function (a) {
      if (!LRG.canSee(a, groups)) return;
      var sc = lq ? scoreMatch(a.name + " " + a.desc + " " + (LRG.appKeywords[a.id] || ""), lq) : 0;
      if (sc < 0) return;
      // Bias toward a name hit so "Agent Dashboard" tops a query for "agent"
      // even though other rows mention it in their description.
      if (lq && scoreMatch(a.name, lq) >= 0) sc += 300;
      out.apps.push({ _s: sc, name: a.name, sub: a.desc, href: a.href, iconHtml: svgIcon(a.icon, 16), isNew: !!a.isNew });
    });
    LRG.linkCats.forEach(function (c) {
      c.links.forEach(function (l) {
        var sc = lq ? scoreMatch(l.name + " " + l.host + " " + c.name, lq) : 0;
        if (sc < 0) return;
        if (lq && scoreMatch(l.name, lq) >= 0) sc += 300;
        out.links.push({ _s: sc, name: l.name, sub: c.name + " · " + l.host, href: l.href, badge: l.badge, newTab: true });
      });
    });
    if (lq) {
      out.apps.sort(function (x, y) { return y._s - x._s; });
      out.links.sort(function (x, y) { return y._s - x._s; });
    }
    return out;
  }

  /* Exposed so OTHER surfaces reuse the exact same search + row rendering:
     launchpad-app's hero and the BookStack head (docs.) both call these.
     searchLocal(q, groups) -> ranked { apps, links }; renderResult(r, q) ->
     one .lrg-uresult row (avatar- and <mark>-highlight-aware). */
  LRG.searchLocal = searchLocal;
  LRG.renderResult = resultRow;

  /* opts.kb (the Knowledge Base bar): no ⌘K hint, a "Search the knowledge
     base" row at the end, and Enter from the box runs BookStack's own
     full-text search (the form submits) instead of opening the top result. */
  var panelSeq = 0;
  function attachSearch(input, clearBtn, groups, opts) {
    opts = opts || {};
    var wrap = input.parentElement;
    var panel = document.createElement("div");
    panel.className = "lrg-usearch__panel";
    panel.hidden = true;
    // Rows are plain links (↓/↑ move focus between them), so the panel is a
    // labelled region the input points at -- not a listbox, which may only
    // hold options. The search box's own label is set here so every app
    // gets one without per-page markup.
    panel.id = "lrg-usearch-panel-" + (++panelSeq);
    panel.setAttribute("role", "region");
    panel.setAttribute("aria-label", "Search results");
    wrap.appendChild(panel);
    if (!input.getAttribute("aria-label")) input.setAttribute("aria-label", opts.kb ? "Search apps, people and the knowledge base" : "Search apps, people and docs");
    input.setAttribute("aria-controls", panel.id);
    input.setAttribute("aria-expanded", "false");
    input.setAttribute("autocomplete", "off");
    var timer = null, seq = 0, searchTrackTimer = null;

    // Subtle ⌘K / Ctrl-K affordance at the right edge of the field; hidden
    // while the field is focused or has text (so it never fights the ✕).
    var hint = document.createElement("span");
    hint.className = "lrg-kbdhint";
    hint.setAttribute("aria-hidden", "true");
    hint.innerHTML = /Mac|iPhone|iPad/.test(navigator.platform || navigator.userAgent || "")
      ? "<kbd>⌘</kbd><kbd>K</kbd>" : "<kbd>Ctrl</kbd><kbd>K</kbd>";
    if (!opts.kb) wrap.appendChild(hint);
    function updHint() { hint.hidden = !!input.value || document.activeElement === input; }
    updHint();
    input.addEventListener("focus", updHint);
    input.addEventListener("blur", updHint);
    input.addEventListener("input", updHint);

    var remote = null, last = { q: null, done: Promise.resolve(0), priv: false };
    function show() { panel.hidden = false; input.setAttribute("aria-expanded", "true"); fit(); }
    function close() { panel.hidden = true; input.setAttribute("aria-expanded", "false"); }
    // The panel hangs off the box's left edge; in a narrow window that can run
    // past the right edge of the screen, so slide it back into view.
    function fit() {
      panel.style.transform = "";
      var r = panel.getBoundingClientRect(), over = r.right - (window.innerWidth - 8);
      if (over > 0) panel.style.transform = "translateX(-" + Math.max(0, Math.min(over, r.left - 8)) + "px)";
    }
    function render(q) {
      var my = ++seq;
      if (remote) remote.abort();
      remote = null;
      var local = searchLocal(q, groups);
      var html = "";
      if (!q) { // browse-on-focus: recently opened results, then EVERY visible
        // app (the panel scrolls), so the newest tiles at the end stay reachable
        var recent = recentGet();
        if (recent.length) html += '<div class="lrg-usearch__group">Recent</div>' +
          recent.map(function (r) { return resultRow({ name: r.name, sub: r.sub, href: r.href, iconHtml: RECENT_ICON }, q, !!r.newTab); }).join("");
        if (local.apps.length) html += '<div class="lrg-usearch__group">Apps</div>' +
          local.apps.map(function (r) { return resultRow(r, q); }).join("");
        panel.innerHTML = html || '<div class="lrg-empty" style="padding:18px">No apps available.</div>';
        show();
        last = { q: q, done: Promise.resolve(0), priv: false };
        return;
      }
      var betHrefs = {};
      if (local.bets.length) {
        html += '<div class="lrg-usearch__group">Top results</div>' +
          local.bets.slice(0, 3).map(function (r) { betHrefs[r.href] = 1; return resultRow(r, q); }).join("");
      }
      if (local.apps.length) {
        html += '<div class="lrg-usearch__group">Apps</div>' +
          local.apps.slice(0, GROUP_CAP.apps).map(function (r) { return resultRow(r, q); }).join("");
      }
      if (local.links.length) {
        html += '<div class="lrg-usearch__group">Links &amp; Tools</div>' +
          local.links.slice(0, GROUP_CAP.links).map(function (r) { return resultRow(r, q); }).join("");
      }
      // Async groups (Agents, Docs, Contacts, Recruiting) each get a fixed slot,
      // filled in place -- never `innerHTML +=` on the panel, which re-created
      // every row and dropped keyboard focus mid-arrowing.
      html += REMOTE_GROUPS.map(function (p) { return '<div data-lrg-slot="' + p[0] + '"></div>'; }).join("");
      html += '<div class="lrg-empty lrg-usearch__status" role="status" aria-live="polite" style="padding:18px"></div>';
      if (opts.kb) html += moreRow("Search the knowledge base for “" + q + "”", "/search?term=" + encodeURIComponent(q), false);
      panel.innerHTML = html;
      show();
      var status = panel.querySelector(".lrg-usearch__status");
      var localCount = local.bets.length + local.apps.length + local.links.length;
      var mine = last = { q: q, done: null, priv: false };
      remote = searchRemote(q, function (key, label, rows) {
        rows = prepRemoteRows(key, rows, betHrefs);
        if (rows.length && PRIVATE_GROUPS[key]) mine.priv = true;
        if (my !== seq || !rows.length) return;
        var cap = GROUP_CAP[key] || 6, newTab = !!REMOTE_NEWTAB[key];
        var body = rows.slice(0, cap).map(function (r) { return resultRow(r, q, newTab); }).join("");
        if (rows.length > cap) {
          var d = moreDest(key, q);
          if (d) body += moreRow(d.label, d.href, d.newTab);
        }
        var slot = panel.querySelector('[data-lrg-slot="' + key + '"]');
        if (slot) slot.innerHTML = '<div class="lrg-usearch__group">' + label + "</div>" + body;
        if (status) status.hidden = true;
      });
      if (localCount) status.hidden = true;
      else status.textContent = remote.pending ? "Searching…" : "No matches for “" + q + "”.";
      var failed = remote.failed;
      remote.done.then(function (n) {
        if (my !== seq) return;
        // A failed provider is not "no matches": say what couldn't be searched,
        // or that the sign-in expired (every provider then fails the same way).
        if (failed.length) {
          status.textContent = failed.some(function (f) { return f.auth; })
            ? "Your sign-in has expired — reload the page to see people and docs."
            : "Couldn't search " + failed.map(function (f) { return f.label; }).join(", ") + " just now. Try again in a moment.";
          status.hidden = false;
        } else if (!localCount && !n) { status.textContent = "No matches for “" + q + "”."; status.hidden = false; }
      });
      mine.done = remote.done;
    }

    // quietFocus: Esc from a result row puts the cursor back without
    // reopening the panel it just closed.
    var quietFocus = false;
    input.addEventListener("focus", function () { if (!quietFocus) render(input.value.trim()); });
    input.addEventListener("input", function () {
      if (clearBtn) clearBtn.hidden = !input.value;
      clearTimeout(timer);
      timer = setTimeout(function () { timer = null; render(input.value.trim()); }, 140);
      clearTimeout(searchTrackTimer);
      searchTrackTimer = setTimeout(function () {
        var q = input.value.trim();
        if (q.length < 2) return;
        // Log the QUERY + how many results the user ended up seeing (excludes
        // "See all" tails). `results:0` = a search that found nothing -- the
        // signal for what to add. Counted only once the remote groups have
        // settled (Docs alone can take ~1s), else slow answers logged as 0.
        // Self-hosted Umami; query capped to 60 chars. A query that matched
        // a client or recruit is almost always that person's name, so it's
        // logged as "[person]" -- the counts still show the search worked.
        var s = last;
        if (s.q !== q || !s.done) return;
        s.done.then(function () {
          if (input.value.trim() !== q) return;
          var shown = panel.querySelectorAll(".lrg-uresult:not(.lrg-uresult--more)").length;
          LRG.track("Search Performed", { query: s.priv ? "[person]" : q.slice(0, 60), chars: q.length, results: shown });
        });
      }, 1000);
    });
    input.addEventListener("keydown", function (e) {
      // Esc closes the panel and keeps the cursor in the box; a second Esc
      // (panel already closed) clears the text.
      if (e.key === "Escape") {
        if (!panel.hidden) close();
        else if (input.value) { input.value = ""; if (clearBtn) clearBtn.hidden = true; updHint(); }
        return;
      }
      if (e.key === "ArrowDown" && panel.hidden) { e.preventDefault(); render(input.value.trim()); return; }
      if (e.key === "Enter" && timer) { clearTimeout(timer); timer = null; render(input.value.trim()); }
      var items = panel.hidden ? [] : panel.querySelectorAll(".lrg-uresult");
      if (e.key === "ArrowDown" && items.length) { e.preventDefault(); items[0].focus(); }
      else if (e.key === "Enter" && items.length && input.value.trim() && !opts.kb) { e.preventDefault(); items[0].click(); }
    });
    // Tabbing (or clicking) out of the box and its results closes the panel.
    wrap.addEventListener("focusout", function (e) {
      if (!e.relatedTarget || !wrap.contains(e.relatedTarget)) {
        setTimeout(function () { if (!wrap.contains(document.activeElement)) close(); }, 0);
      }
    });
    panel.addEventListener("keydown", function (e) {
      var items = panel.querySelectorAll(".lrg-uresult");
      var idx = Array.prototype.indexOf.call(items, document.activeElement);
      if (e.key === "ArrowDown") { e.preventDefault(); (items[idx + 1] || items[0]).focus(); }
      else if (e.key === "ArrowUp") { e.preventDefault(); (items[idx - 1] || input).focus(); }
      else if (e.key === "Escape") { close(); quietFocus = true; input.focus(); quietFocus = false; }
    });
    panel.addEventListener("click", function (e) {
      var a = e.target.closest && e.target.closest("a.lrg-uresult");
      if (!a || a.classList.contains("lrg-uresult--more") || PRIVATE_GROUPS[a.getAttribute("data-lrg-group")]) return;
      recentAdd({ name: a.getAttribute("data-lrg-name") || "", sub: a.getAttribute("data-lrg-sub") || "",
        href: a.getAttribute("href") || "", newTab: a.getAttribute("target") === "_blank" });
    });
    if (clearBtn) clearBtn.addEventListener("click", function () {
      input.value = ""; clearBtn.hidden = true; input.focus(); render("");
    });
    document.addEventListener("click", function (e) {
      if (!wrap.contains(e.target)) close();
    });
  }

  /* The Knowledge Base bar (bookstack-custom-head.html) hands its search form
     here, so the KB dropdown is the same engine as every portal header: Top
     results, Apps, Links, and the live Docs/Agents/My Contacts/Recruiting
     groups. Kept in this file so changing it never needs a re-paste into
     BookStack's settings. It also hides BookStack's own header search (the
     box, and the search icon in its phone layout) so there's one search box;
     if this file doesn't load, BookStack's box stays. Its /search results
     page is untouched -- Enter in our box still lands there. */
  LRG.attachKbSearch = function (form, input) {
    if (!form || !input || input._lrgSearch) return;
    input._lrgSearch = true;
    var hide = document.createElement("style");
    hide.textContent = '#header .search-box, #header a.hide-over-l[href$="/search"] { display: none !important; }' +
      '.lrg-tb-search input::-webkit-search-cancel-button { -webkit-appearance: none; display: none; }';
    document.head.appendChild(hide);
    LRG.ready.then(function (id) { attachSearch(input, null, (id && id.groups) || ["staff"], { kb: true }); });
  };

  /* ---- keyboard: focus search from anywhere ('/' or ⌘K / Ctrl-K) ------
     Wired once at load, so every page that ships lrg-portal.js (app headers
     AND the launchpad hero) gets the shortcut with no per-page wiring. */
  LRG.focusSearch = function () {
    var el = document.getElementById("usearch") || document.getElementById("lp-q") ||
      document.querySelector('input[type="search"]') ||
      // apps with their own header search (e.g. Audit's #hSearch "Search a lead
      // or agent…") don't use #usearch — fall back to a "Search…" placeholder.
      document.querySelector('input[placeholder^="Search" i], input[aria-label^="Search" i]');
    if (!el) return false;
    try { el.focus(); if (el.select) el.select(); } catch (e) {}
    return true;
  };
  (function wireSearchHotkey() {
    if (LRG._searchHotkey) return; LRG._searchHotkey = true;
    document.addEventListener("keydown", function (e) {
      if ((e.metaKey || e.ctrlKey) && !e.altKey && (e.key === "k" || e.key === "K")) {
        // ⌘K is "insert link" in rich editors (BookStack's page editor,
        // textareas): leave it alone if the editor already handled it or
        // the cursor is in a textarea / contenteditable.
        var tk = e.target;
        if (e.defaultPrevented || (tk && (tk.tagName === "TEXTAREA" || tk.isContentEditable))) return;
        if (LRG.focusSearch()) e.preventDefault();
        return;
      }
      if (e.key === "/" && !e.metaKey && !e.ctrlKey && !e.altKey) {
        var t = e.target, tag = (t && t.tagName) || "";
        if (tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || (t && t.isContentEditable)) return;
        if (LRG.focusSearch()) e.preventDefault();
      }
    });
  })();

  /* ---- header init --------------------------------------------- */
  /* opts.currentApp: registry id to mark in the Apps menu. opts.apps,
     opts.search, opts.account (default true): pass false to leave out a piece
     the page renders itself. One call per page. See HEADER.md. */
  LRG.initHeader = function (opts) {
    opts = opts || {};
    if (LRG._headerInit) return;          // every listener below is page-global
    LRG._headerInit = true;
    var themeBtn = document.getElementById("theme-btn");
    if (themeBtn) themeBtn.addEventListener("click", LRG.toggleTheme);
    applyTheme(document.documentElement.getAttribute("data-theme") || "light");
    wireLogos();
    markHeader();
    var withAccount = opts.account !== false;

    LRG.ready.then(function (id) {
      var appsBtn = opts.apps !== false && document.getElementById("apps-btn");
      if (appsBtn) {
        var holder = appsBtn.parentElement;
        var menu = document.createElement("div");
        menu.className = "lrg-menu";
        menu.id = "lrg-apps-menu";
        menu.hidden = true;
        holder.appendChild(menu);
        labelAppsButton(appsBtn);
        var draw = function () { buildAppsMenu(menu, opts.currentApp, id.groups, !withAccount); };
        draw();
        // Page Permissions and the launchpad's "New" dates arrive with
        // launchpad-links, usually after /whoami (n8n is slower than Caddy).
        // Redraw then: before v1.5.0 the menu ignored Access Control edits.
        LRG.linksReady.then(draw);
        wireDisclosure(appsBtn, menu, holder);
      }
      if (withAccount) mountAccount(id);
      var input = opts.search !== false && document.getElementById("usearch");
      if (input) attachSearch(input, document.getElementById("usearch-clear"), id.groups);
    });
  };
})();