feat: auth scaffold, notifications inbox, resources CRUD, vitest baseline, typed API client

Auth
- ~/lib/session.ts: Session type + loadSession/signIn/signOut/hasSession,
  reactive useSession hook (mock backend; replace fetch calls with your
  real auth endpoint when ready)
- routes/login.tsx: form with email/password (mock-validated), bounces
  to ?next= on success
- AppShell: redirects to /login when no session; account-menu Sign out
  now actually signs out; live session.name/email used for the appbar
  avatar (falls back to profile)

Notifications
- ~/lib/notifications.ts: persistent inbox with kinds (info/success/
  warning/error), unreadCount, markRead, markAllRead, dismiss,
  dismissAll; seedIfEmpty for a friendly first-run
- AppShell bell: 320px popover with badge, kind dots, per-row open
  (navigates to href) and dismiss; Mark all read + Clear actions
- Hidden NotificationDispatcher in AppShell so the action bus can
  create real notifications via fill notif-title / notif-body /
  notif-kind / notif-href + click notif-create

Data layer
- ~/lib/api.ts: typed apiFetch<T> + api.get/post/put/patch/del,
  auto-attaches the session token, throws structured ApiError, signs
  out on 401
- ~/lib/resources.ts: example domain entity (CRUD) backed by
  localStorage today; each call is a 1:1 swap for api.get/post/put/del
- routes/resources.tsx: real working table — search, add, inline
  status edit, delete; seeded demo rows on first load

Tests
- vitest + jsdom + @testing-library/react + @testing-library/jest-dom
  + vite-tsconfig-paths installed
- vitest.config.ts (jsdom, globals, ~ aliases via tsconfig-paths)
- vitest.setup.ts (RTL cleanup + localStorage clear between tests)
- app/lib/session.test.ts and resources.test.ts as starter coverage
- npm test / npm run test:watch scripts

UI Control catalog
- Login form, resources CRUD, notifications inbox, and the hidden
  notif-bridge ids tagged so the assistant can drive every new surface

Threads
- ThreadMessage now carries optional agentId so per-message authorship
  survives persona switches and handoffs

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/lib/resources.ts

@@ -0,0 +1,157 @@
+// Resource store — example domain entity.
+// Backed by localStorage today, but written so each call is a single function
+// you can swap with `api.get/post/put/del` once you have a real backend.
+
+import { useEffect, useSyncExternalStore } from "react"
+
+export type Resource = {
+  id: string
+  name: string
+  status: "active" | "paused" | "archived"
+  owner: string
+  createdAt: number
+  updatedAt: number
+}
+
+const STORAGE_KEY = "crema.resources"
+const CHANGE_EVENT = "crema:resources-change"
+
+function newId() {
+  return `r-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`
+}
+
+function readFromStorage(): Resource[] {
+  if (typeof window === "undefined") return []
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY)
+    if (!raw) return []
+    const parsed = JSON.parse(raw)
+    if (!Array.isArray(parsed)) return []
+    return parsed.filter(
+      (r): r is Resource =>
+        r &&
+        typeof r.id === "string" &&
+        typeof r.name === "string" &&
+        ["active", "paused", "archived"].includes(r.status) &&
+        typeof r.owner === "string" &&
+        typeof r.createdAt === "number" &&
+        typeof r.updatedAt === "number",
+    )
+  } catch {
+    return []
+  }
+}
+
+function write(items: Resource[]) {
+  if (typeof window === "undefined") return
+  try {
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(items))
+    window.dispatchEvent(new CustomEvent(CHANGE_EVENT))
+  } catch {
+    /* quota */
+  }
+}
+
+// CRUD — these mirror what `api.get/post/put/del` would look like.
+export function listResources(): Resource[] {
+  return readFromStorage()
+}
+
+export function createResource(input: {
+  name: string
+  owner: string
+  status?: Resource["status"]
+}): Resource {
+  const now = Date.now()
+  const r: Resource = {
+    id: newId(),
+    name: input.name,
+    owner: input.owner,
+    status: input.status ?? "active",
+    createdAt: now,
+    updatedAt: now,
+  }
+  write([r, ...readFromStorage()])
+  return r
+}
+
+export function updateResource(
+  id: string,
+  patch: Partial<Omit<Resource, "id" | "createdAt">>,
+): Resource | null {
+  const items = readFromStorage()
+  let updated: Resource | null = null
+  const next = items.map((r) => {
+    if (r.id !== id) return r
+    updated = { ...r, ...patch, updatedAt: Date.now() }
+    return updated
+  })
+  if (updated) write(next)
+  return updated
+}
+
+export function deleteResource(id: string) {
+  write(readFromStorage().filter((r) => r.id !== id))
+}
+
+let cached: Resource[] | null = null
+function subscribe(cb: () => void) {
+  const onChange = () => {
+    cached = null
+    cb()
+  }
+  window.addEventListener(CHANGE_EVENT, onChange)
+  window.addEventListener("storage", (e) => {
+    if (e.key === STORAGE_KEY) onChange()
+  })
+  return () => window.removeEventListener(CHANGE_EVENT, onChange)
+}
+function getSnapshot(): Resource[] {
+  if (!cached) cached = readFromStorage()
+  return cached
+}
+function getServerSnapshot(): Resource[] {
+  return []
+}
+
+export function useResources(): Resource[] {
+  const v = useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot)
+  useEffect(() => {
+    cached = null
+  }, [])
+  return v
+}
+
+/** Seed a few rows on first load so the table isn't empty. */
+export function seedResourcesIfEmpty() {
+  if (typeof window === "undefined") return
+  if (localStorage.getItem(STORAGE_KEY)) return
+  const now = Date.now()
+  const seed: Resource[] = [
+    {
+      id: newId(),
+      name: "Acme dashboard",
+      status: "active",
+      owner: "Atlas",
+      createdAt: now - 86_400_000 * 3,
+      updatedAt: now - 3600_000,
+    },
+    {
+      id: newId(),
+      name: "Onboarding pipeline",
+      status: "paused",
+      owner: "Forge",
+      createdAt: now - 86_400_000 * 7,
+      updatedAt: now - 86_400_000,
+    },
+    {
+      id: newId(),
+      name: "Q1 report draft",
+      status: "archived",
+      owner: "Inkwell",
+      createdAt: now - 86_400_000 * 30,
+      updatedAt: now - 86_400_000 * 14,
+    },
+  ]
+  write(seed)
+}