{# Shared modern header — used by base.html and dashboard.html.
   Styles live in app/web/static/style-custom.css under the .app-* prefix. #}
{% if session.user %}
<header class="app-header">
    <div class="app-header-left">
        <a class="app-header-logo" href="/" aria-label="Home">
            {% if config.LOGO_SVG %}{{ config.LOGO_SVG | safe }}{% else %}{{ config.INSTANCE_NAME or 'Data Analyst Portal' }}{% endif %}
        </a>
        {% if config.INSTANCE_SUBTITLE %}<span class="app-header-subtitle">{{ config.INSTANCE_SUBTITLE }}</span>{% endif %}
    </div>
    <div class="app-header-right">
        {% set _path = request.url.path %}
        {% set _home = home_route or '/dashboard' %}
        {# Primary nav: Home → Marketplace → Data Packages → Memory.
           Activity Center moved into the Admin dropdown — its content
           is per-team adoption analytics that only admins consume in
           practice (the route still allows any authed user for
           direct deep-links). The "Home" link points at the
           operator-resolved `home_route` (defaults to /dashboard for
           OSS; customer instances flip to /home via env / yaml).
           Setup local agent + My Stack used to live in the nav too;
           Setup is reached from /home's install flow and My Stack
           lives inside /marketplace as a tab. #}
        <a class="app-nav-link {% if _path == _home or _path == '/' or _path == '/dashboard' or _path == '/home' %}is-active{% endif %}" href="{{ _home }}">Home</a>
        <a class="app-nav-link {% if _path == '/marketplace' or _path.startswith('/marketplace/') %}is-active{% endif %}" href="/marketplace">Marketplace</a>
        <a class="app-nav-link {% if _path.startswith('/catalog') %}is-active{% endif %}" href="/catalog">Data Packages</a>
        <a class="app-nav-link {% if _path.startswith('/me/stats') %}is-active{% endif %}" href="/me/stats">Stats</a>
        {# Memory + Admin menu: both admin-only. Backend gates the routes
           themselves via require_admin (see app/web/router.py for
           /corporate-memory + /corporate-memory/admin + /admin/*), so
           hiding the links is purely a visibility tidy-up — non-admins
           who deep-link still get a 403 from the route handler. Single
           guard wraps both for clarity. #}
        {% if session.user.is_admin %}
        {# "Memory" link moved into the Admin dropdown's Agent Experience
           section (parallel to Curated Marketplaces / Flea Submissions /
           Prompts). The primary nav no longer carries an admin-only
           entry — primary nav stays consistently visible to all
           authenticated users. #}
        {% set _admin_active = _path.startswith('/admin/tables') or _path.startswith('/admin/tokens') or _path.startswith('/admin/users') or _path.startswith('/admin/groups') or _path.startswith('/admin/access') or _path.startswith('/admin/server-config') or _path.startswith('/admin/agent-prompt') or _path.startswith('/admin/workspace-prompt') or _path.startswith('/admin/marketplaces') or _path.startswith('/admin/store') or _path.startswith('/admin/scheduler-runs') or _path.startswith('/admin/activity') or _path.startswith('/admin/telemetry') or _path.startswith('/admin/usage') or _path.startswith('/admin/sessions') or _path.startswith('/corporate-memory') %}
        <div class="app-nav-menu" id="adminNavMenu">
            <button type="button"
                    class="app-nav-link app-nav-menu-trigger {% if _admin_active %}is-active{% endif %}"
                    id="adminNavTrigger"
                    aria-haspopup="menu" aria-expanded="false" aria-controls="adminNavPanel">
                Admin
                <svg class="app-nav-menu-chevron" width="10" height="10" viewBox="0 0 12 12" aria-hidden="true">
                    <path d="M2 4l4 4 4-4" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
                </svg>
            </button>
            {# Admin dropdown is grouped into four named sections so admins
               doing different jobs (debugging activity vs. managing users
               vs. curating marketplaces) can land on the right page
               without re-reading the full menu. Section headers are
               non-clickable, set off by `.app-nav-menu-section` styling
               (small caps, muted). Items keep the existing
               `.app-nav-menu-item` look + active state. #}
            <div class="app-nav-menu-panel" id="adminNavPanel" role="menu" hidden>
                <div class="app-nav-menu-section">Activity Center</div>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/activity') %}is-active{% endif %}" role="menuitem" href="/admin/activity">Audit log</a>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/telemetry') or _path.startswith('/admin/usage') %}is-active{% endif %}" role="menuitem" href="/admin/telemetry">Telemetry</a>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/sessions') %}is-active{% endif %}" role="menuitem" href="/admin/sessions">Sessions</a>

                <div class="app-nav-menu-section">Users &amp; Access</div>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/users') %}is-active{% endif %}" role="menuitem" href="/admin/users">Users</a>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/groups') %}is-active{% endif %}" role="menuitem" href="/admin/groups">Groups</a>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/access') %}is-active{% endif %}" role="menuitem" href="/admin/access">Resource access</a>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/tokens') %}is-active{% endif %}" role="menuitem" href="/admin/tokens">Tokens</a>

                <div class="app-nav-menu-section">Data</div>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/tables') %}is-active{% endif %}" role="menuitem" href="/admin/tables">Tables</a>

                {# "Agent Experience" groups everything the admin curates
                   for what an analyst's AI agent sees / can do: which
                   plugins (curated + flea) are available, which prompt
                   Claude lands on at `agnes init`, and the CLAUDE.md
                   template injected into each workspace. #}
                <div class="app-nav-menu-section">Agent Experience</div>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/marketplaces') %}is-active{% endif %}" role="menuitem" href="/admin/marketplaces">Curated Marketplaces</a>
                <a class="app-nav-menu-item {% if _path.startswith('/corporate-memory') %}is-active{% endif %}" role="menuitem" href="/corporate-memory">Curated Memory</a>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/store/submissions') %}is-active{% endif %}" role="menuitem" href="/admin/store/submissions">Flea Submissions</a>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/agent-prompt') %}is-active{% endif %}" role="menuitem" href="/admin/agent-prompt">Init Prompt</a>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/workspace-prompt') %}is-active{% endif %}" role="menuitem" href="/admin/workspace-prompt">Workspace Prompt</a>

                <div class="app-nav-menu-section">Server</div>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/server-config') %}is-active{% endif %}" role="menuitem" href="/admin/server-config">Server config</a>
                {# /admin/scheduler-runs collapsed into /admin/activity as
                   a `source=scheduler` filter — old route 308-redirects. #}
            </div>
        </div>
        {% endif %}

        <div class="app-user-menu" id="userMenu">
            <button type="button" class="app-user-menu-trigger" id="userMenuTrigger"
                    aria-haspopup="menu" aria-expanded="false" aria-controls="userMenuPanel">
                {% if session.user.picture %}
                <img src="{{ session.user.picture }}" alt="" class="app-avatar-img">
                {% else %}
                <span class="app-avatar">{{ (session.user.name or session.user.email)[:2] | upper }}</span>
                {% endif %}
                <svg class="app-user-menu-chevron" width="12" height="12" viewBox="0 0 12 12" aria-hidden="true">
                    <path d="M2 4l4 4 4-4" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
                </svg>
            </button>
            <div class="app-user-menu-panel" id="userMenuPanel" role="menu" hidden>
                <div class="app-user-menu-header">
                    <div class="app-user-menu-email">{{ session.user.email }}</div>
                    {% if session.user.is_admin %}
                    <div class="app-user-menu-role">Admin</div>
                    {% endif %}
                </div>
                <a class="app-user-menu-item {% if _path == '/profile' %}is-active{% endif %}" role="menuitem" href="/profile">Profile</a>
                <a class="app-user-menu-item {% if _path == '/profile/sessions' %}is-active{% endif %}" role="menuitem" href="/profile/sessions">My sessions</a>
                <a class="app-user-menu-item {% if _path == '/tokens' %}is-active{% endif %}" role="menuitem" href="/tokens">My tokens</a>
                {% if config.DEBUG_AUTH_ENABLED %}
                <a class="app-user-menu-item {% if _path.startswith('/me/debug') %}is-active{% endif %}" role="menuitem" href="/me/debug">Auth debug</a>
                {% endif %}
                <a class="app-user-menu-item" role="menuitem" href="{{ url_for('auth.logout') }}">Logout</a>
            </div>
        </div>
    </div>
</header>
{# Dropdown wiring lives in app/web/static/app.js. The script tag sits
   here (in the shared header partial) instead of base.html so EVERY
   page that includes _app_header.html — including standalone pages
   like catalog.html / corporate_memory*.html / install.html /
   admin_tables.html that don't extend base.html — gets the JS loaded
   automatically. Defer keeps it non-blocking; placed after the header
   markup so DOM is ready by the time the IIFE runs init(). #}
<script src="{{ static_url('app.js') }}" defer></script>
{% endif %}