feat: auth scaffold, notifications inbox, resources CRUD, vitest baseline, typed API client

Auth
- ~/lib/session.ts: Session type + loadSession/signIn/signOut/hasSession,
  reactive useSession hook (mock backend; replace fetch calls with your
  real auth endpoint when ready)
- routes/login.tsx: form with email/password (mock-validated), bounces
  to ?next= on success
- AppShell: redirects to /login when no session; account-menu Sign out
  now actually signs out; live session.name/email used for the appbar
  avatar (falls back to profile)

Notifications
- ~/lib/notifications.ts: persistent inbox with kinds (info/success/
  warning/error), unreadCount, markRead, markAllRead, dismiss,
  dismissAll; seedIfEmpty for a friendly first-run
- AppShell bell: 320px popover with badge, kind dots, per-row open
  (navigates to href) and dismiss; Mark all read + Clear actions
- Hidden NotificationDispatcher in AppShell so the action bus can
  create real notifications via fill notif-title / notif-body /
  notif-kind / notif-href + click notif-create

Data layer
- ~/lib/api.ts: typed apiFetch<T> + api.get/post/put/patch/del,
  auto-attaches the session token, throws structured ApiError, signs
  out on 401
- ~/lib/resources.ts: example domain entity (CRUD) backed by
  localStorage today; each call is a 1:1 swap for api.get/post/put/del
- routes/resources.tsx: real working table — search, add, inline
  status edit, delete; seeded demo rows on first load

Tests
- vitest + jsdom + @testing-library/react + @testing-library/jest-dom
  + vite-tsconfig-paths installed
- vitest.config.ts (jsdom, globals, ~ aliases via tsconfig-paths)
- vitest.setup.ts (RTL cleanup + localStorage clear between tests)
- app/lib/session.test.ts and resources.test.ts as starter coverage
- npm test / npm run test:watch scripts

UI Control catalog
- Login form, resources CRUD, notifications inbox, and the hidden
  notif-bridge ids tagged so the assistant can drive every new surface

Threads
- ThreadMessage now carries optional agentId so per-message authorship
  survives persona switches and handoffs

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/lib/notifications.ts

@@ -0,0 +1,155 @@
+// Notifications — small reactive store for in-app toasts/inbox items.
+// Pair with @crema/notification-ui's <ToastProvider /> for transient toasts;
+// this store is for the appbar bell's persistent inbox.
+
+import { useEffect, useSyncExternalStore } from "react"
+
+export type NotificationKind = "info" | "success" | "warning" | "error"
+
+export type AppNotification = {
+  id: string
+  kind: NotificationKind
+  title: string
+  body?: string
+  // Optional href to open when the row is clicked.
+  href?: string
+  createdAt: number
+  readAt?: number
+}
+
+const STORAGE_KEY = "crema.notifications"
+const CHANGE_EVENT = "crema:notifications-change"
+const MAX_ITEMS = 200
+
+function newId(): string {
+  return `n-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`
+}
+
+function readFromStorage(): AppNotification[] {
+  if (typeof window === "undefined") return []
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY)
+    if (!raw) return []
+    const parsed = JSON.parse(raw)
+    if (!Array.isArray(parsed)) return []
+    return parsed.filter(
+      (n): n is AppNotification =>
+        n &&
+        typeof n.id === "string" &&
+        typeof n.title === "string" &&
+        typeof n.createdAt === "number" &&
+        ["info", "success", "warning", "error"].includes(n.kind),
+    )
+  } catch {
+    return []
+  }
+}
+
+function writeToStorage(items: AppNotification[]) {
+  if (typeof window === "undefined") return
+  const trimmed = items.slice(0, MAX_ITEMS)
+  try {
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(trimmed))
+    window.dispatchEvent(new CustomEvent(CHANGE_EVENT))
+  } catch {
+    /* quota — drop silently */
+  }
+}
+
+export function loadNotifications(): AppNotification[] {
+  return readFromStorage()
+}
+
+export function addNotification(
+  n: Omit<AppNotification, "id" | "createdAt">,
+): AppNotification {
+  const next: AppNotification = {
+    ...n,
+    id: newId(),
+    createdAt: Date.now(),
+  }
+  writeToStorage([next, ...readFromStorage()])
+  return next
+}
+
+export function markRead(id: string) {
+  const items = readFromStorage().map((n) =>
+    n.id === id ? { ...n, readAt: Date.now() } : n,
+  )
+  writeToStorage(items)
+}
+
+export function markAllRead() {
+  const now = Date.now()
+  const items = readFromStorage().map((n) =>
+    n.readAt ? n : { ...n, readAt: now },
+  )
+  writeToStorage(items)
+}
+
+export function dismiss(id: string) {
+  writeToStorage(readFromStorage().filter((n) => n.id !== id))
+}
+
+export function dismissAll() {
+  writeToStorage([])
+}
+
+let cached: AppNotification[] | null = null
+
+function subscribe(cb: () => void): () => void {
+  const onChange = () => {
+    cached = null
+    cb()
+  }
+  window.addEventListener(CHANGE_EVENT, onChange)
+  window.addEventListener("storage", (e) => {
+    if (e.key === STORAGE_KEY) onChange()
+  })
+  return () => window.removeEventListener(CHANGE_EVENT, onChange)
+}
+function getSnapshot(): AppNotification[] {
+  if (!cached) cached = readFromStorage()
+  return cached
+}
+function getServerSnapshot(): AppNotification[] {
+  return []
+}
+
+export function useNotifications(): AppNotification[] {
+  const value = useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot)
+  useEffect(() => {
+    cached = null
+  }, [])
+  return value
+}
+
+export function unreadCount(items: AppNotification[]): number {
+  return items.filter((n) => !n.readAt).length
+}
+
+/** Seed a few demo notifications on first load so the bell isn't empty. */
+export function seedIfEmpty() {
+  if (typeof window === "undefined") return
+  if (localStorage.getItem(STORAGE_KEY)) return
+  const now = Date.now()
+  const seed: AppNotification[] = [
+    {
+      id: newId(),
+      kind: "info",
+      title: "Welcome",
+      body: "Tag elements with data-action and the assistant can drive them.",
+      href: "/assistant",
+      createdAt: now - 60_000,
+    },
+    {
+      id: newId(),
+      kind: "success",
+      title: "Profile saved",
+      body: "Your display name and avatar are live across the app.",
+      href: "/profile",
+      createdAt: now - 5 * 60_000,
+    },
+  ]
+  writeToStorage(seed)
+}