+ )
+}
diff --git a/apps/hq-web/src/api.ts b/apps/hq-web/src/api.ts
new file mode 100644
index 0000000..5982a5f
--- /dev/null
+++ b/apps/hq-web/src/api.ts
@@ -0,0 +1,63 @@
+/** HQ web ↔ hq-server client; token survives reloads via localStorage['hq.token']. */
+
+const TOKEN_KEY = 'hq.token'
+const NAME_KEY = 'hq.name'
+const ROLE_KEY = 'hq.role'
+
+export function hasSession(): boolean {
+ return (localStorage.getItem(TOKEN_KEY) ?? '') !== ''
+}
+
+export function displayName(): string {
+ return localStorage.getItem(NAME_KEY) ?? ''
+}
+
+/** 'owner' | 'staff' — Modules page renders read-only for staff. */
+export function role(): string {
+ return localStorage.getItem(ROLE_KEY) ?? 'staff'
+}
+
+export function clearSession(): void {
+ localStorage.removeItem(TOKEN_KEY)
+ localStorage.removeItem(NAME_KEY)
+ localStorage.removeItem(ROLE_KEY)
+}
+
+/**
+ * Fetch `/api${path}` with the session bearer token. On 401 (outside the login
+ * call itself) the session is cleared and the app redirects to /login.
+ */
+export async function apiFetch