@crewhaus/hangar-ui 0.5.0

package/assets/js/dom.js

@@ -0,0 +1,228 @@
+/**
+ * Injection-safe DOM toolkit. Rendering is 100% createElement/textContent —
+ * markup-string assignment is banned app-wide (a unit test scans every
+ * embedded module for it) — so server data and agent output can never
+ * inject markup or script. SVG goes through createElementNS with attribute
+ * strings computed by pure helpers.
+ *
+ * Only function BODIES touch `document`; importing the module outside a
+ * browser is safe (the test suite imports it to assert exports).
+ */
+
+import { parseMarkdown } from "./markdown.js";
+import { fmtRelativeTime } from "./util.js";
+
+const SVGNS = "http://www.w3.org/2000/svg";
+
+/**
+ * Build an element.
+ *   attrs: { class, text, dataset: {}, style: {}, on<Event>: fn, <attr>: v }
+ *   children: Node | string | array (nested) | null
+ * Strings become text nodes — never markup.
+ */
+export function el(tag, attrs, children) {
+  const node = document.createElement(tag);
+  if (attrs) {
+    for (const [k, v] of Object.entries(attrs)) {
+      if (v === null || v === undefined || v === false) continue;
+      if (k === "class") node.className = v;
+      else if (k === "text") node.textContent = v;
+      else if (k === "dataset") {
+        for (const [dk, dv] of Object.entries(v)) node.dataset[dk] = dv;
+      } else if (k === "style" && typeof v === "object") {
+        for (const [sk, sv] of Object.entries(v)) {
+          // custom properties (e.g. --accent) only apply via setProperty
+          if (sk.startsWith("--")) node.style.setProperty(sk, sv);
+          else node.style[sk] = sv;
+        }
+      } else if (k.startsWith("on") && typeof v === "function") {
+        node.addEventListener(k.slice(2).toLowerCase(), v);
+      } else node.setAttribute(k, v === true ? "" : String(v));
+    }
+  }
+  append(node, children);
+  return node;
+}
+
+/** A plain text node. */
+export function text(value) {
+  return document.createTextNode(String(value));
+}
+
+/** Append Node | string | nested arrays; null/undefined are skipped. */
+export function append(node, children) {
+  if (children === null || children === undefined) return node;
+  if (Array.isArray(children)) {
+    for (const c of children) append(node, c);
+    return node;
+  }
+  if (typeof Node !== "undefined" && children instanceof Node) {
+    node.appendChild(children);
+    return node;
+  }
+  node.appendChild(text(children));
+  return node;
+}
+
+/** Remove all children. Returns the node. */
+export function clear(node) {
+  while (node.firstChild) node.removeChild(node.firstChild);
+  return node;
+}
+
+/** An SVG element (children must already be nodes). */
+export function svgEl(tag, attrs, children) {
+  const node = document.createElementNS(SVGNS, tag);
+  if (attrs) {
+    for (const [k, v] of Object.entries(attrs)) {
+      if (v !== null && v !== undefined && v !== false) node.setAttribute(k, String(v));
+    }
+  }
+  if (Array.isArray(children)) {
+    for (const c of children) node.appendChild(c);
+  }
+  return node;
+}
+
+/**
+ * Traffic-light dot — ALWAYS paired with a text label (never color alone).
+ * state: "ok" | "warn" | "bad" | "unknown" | "off"
+ */
+export function dot(state, label) {
+  return el("span", { class: `dot-pair dot-${state}` }, [
+    el("span", { class: "dot", "aria-hidden": "true" }),
+    el("span", { class: "dot-label", text: label }),
+  ]);
+}
+
+/**
+ * Standard empty state. "Absence is not an error": a 404/empty payload
+ * renders as "nothing yet" and names the CLI verb that creates the data.
+ */
+export function emptyState(message, verb) {
+  return el("div", { class: "empty" }, [
+    el("div", { class: "empty-msg", text: message }),
+    verb
+      ? el("div", { class: "empty-verb" }, ["Run ", el("code", { text: verb }), " to create it."])
+      : null,
+  ]);
+}
+
+/** Loading skeleton (opacity pulse only — the one animation in the app). */
+export function skeleton(lines = 3) {
+  const wrap = el("div", { class: "skeleton", "aria-label": "loading", role: "status" });
+  for (let i = 0; i < lines; i += 1) wrap.appendChild(el("div", { class: "skel-line" }));
+  return wrap;
+}
+
+/** "as of 3m ago" chip for cached figures (honest-latency invariant). */
+export function asOf(cachedAtIso) {
+  if (!cachedAtIso) return null;
+  return el("span", {
+    class: "asof",
+    title: cachedAtIso,
+    text: `as of ${fmtRelativeTime(cachedAtIso, Date.now())}`,
+  });
+}
+
+/**
+ * Error/notice toast — the "no write ever fails silently" affordance. One
+ * toast at a time (a newer message replaces the older); auto-dismisses, and
+ * `role="alert"` makes screen readers announce it.
+ */
+export function toast(message, kind = "error") {
+  for (const old of document.querySelectorAll(".toast")) old.remove();
+  const node = el("div", {
+    class: `toast toast-${kind === "error" ? "error" : "info"}`,
+    role: "alert",
+    text: message,
+  });
+  document.body.appendChild(node);
+  setTimeout(() => node.remove(), 6000);
+  return node;
+}
+
+/** Click-to-copy button (clipboard API; silently no-ops when unavailable). */
+export function copyBtn(value, label = "copy") {
+  const btn = el("button", { class: "btn btn-ghost btn-copy", type: "button", text: label });
+  btn.addEventListener("click", async () => {
+    try {
+      await navigator.clipboard.writeText(value);
+      btn.textContent = "copied";
+      btn.classList.add("ok");
+      setTimeout(() => {
+        btn.textContent = label;
+        btn.classList.remove("ok");
+      }, 1200);
+    } catch {
+      btn.textContent = "copy failed";
+    }
+  });
+  return btn;
+}
+
+/** A native collapsible (<details>) card. */
+export function collapsible(summaryChildren, bodyChildren, open = false) {
+  return el("details", { class: "fold", open: open || null }, [
+    el("summary", { class: "fold-summary" }, summaryChildren),
+    el("div", { class: "fold-body" }, bodyChildren),
+  ]);
+}
+
+/** Line-numbered read-only code view (one div per line, all textContent). */
+export function numberedCode(source, label = "code") {
+  const wrap = el("div", { class: "codeview", role: "region", "aria-label": label });
+  const lines = String(source ?? "").split("\n");
+  for (let i = 0; i < lines.length; i += 1) {
+    wrap.appendChild(
+      el("div", { class: "codeline" }, [
+        el("span", { class: "ln", text: String(i + 1) }),
+        el("span", { class: "lc", text: lines[i] === "" ? " " : lines[i] }),
+      ]),
+    );
+  }
+  return wrap;
+}
+
+/** Pretty-printed JSON in a <pre> (for the Raw toggles). */
+export function jsonPre(value) {
+  let body;
+  try {
+    body = JSON.stringify(value, null, 2);
+  } catch {
+    body = String(value);
+  }
+  return el("pre", { class: "rawjson", text: body });
+}
+
+/** Render parsed markdown tokens (see markdown.js) into a container div. */
+export function mdBlocks(source) {
+  const wrap = el("div", { class: "md" });
+  for (const block of parseMarkdown(source)) {
+    if (block.type === "heading") {
+      const level = Math.min(6, Math.max(1, block.level));
+      wrap.appendChild(el(`h${level}`, null, spansToNodes(block.spans)));
+    } else if (block.type === "para") {
+      wrap.appendChild(el("p", null, spansToNodes(block.spans)));
+    } else if (block.type === "list") {
+      wrap.appendChild(
+        el(
+          block.ordered ? "ol" : "ul",
+          null,
+          block.items.map((spans) => el("li", null, spansToNodes(spans))),
+        ),
+      );
+    } else if (block.type === "code") {
+      wrap.appendChild(el("pre", { class: "mdcode" }, [el("code", { text: block.text })]));
+    }
+  }
+  return wrap;
+}
+
+function spansToNodes(spans) {
+  return spans.map((s) => {
+    if (s.type === "bold") return el("strong", { text: s.text });
+    if (s.type === "code") return el("code", { text: s.text });
+    return text(s.text);
+  });
+}

package/assets/js/keys.js

@@ -0,0 +1,159 @@
+/**
+ * HM-190 — keyboard triage, at the APP level.
+ *
+ * The inbox half of this item shipped with M2: `triageKey` in
+ * `supervision.js` owns j/k movement, the one-key verdicts, the `.` row menu
+ * and the `?` bindings sheet inside the approvals and review lists, and
+ * `views/inbox.js` mounts it. M4 adds the layer above that — ⌘K, Escape, and
+ * a bindings sheet that works on screens with no inbox on them — and, more
+ * importantly, decides WHO owns a key when both layers want it.
+ *
+ * The whole decision is one pure reducer, {@link globalKey}, so the answer
+ * to "does `?` open the global sheet or the inbox's?" is a unit test rather
+ * than an argument with a browser.
+ *
+ * THE OWNERSHIP RULES, in the order they apply:
+ *
+ *   1. A key pressed inside an INPUT, TEXTAREA or contenteditable belongs to
+ *      the field — an operator typing a spec edit must never have a modal
+ *      stolen out from under them by a shortcut. There is exactly ONE
+ *      exception, and it is the omnibox's own input: the overlay focuses it
+ *      the instant it opens, so from that instant every key arrives with
+ *      `inField: true`. Bailing unconditionally would make Escape and the
+ *      ⌘K toggle unreachable and turn a keyboard feature into a keyboard
+ *      TRAP — the only way out a mouse click on the backdrop. So while the
+ *      omnibox is open, the two keys that CLOSE it are claimed even in a
+ *      field, and nothing else is: typing a query still belongs to the
+ *      field.
+ *   2. ⌘K / Ctrl-K opens the omnibox from anywhere else, and toggles it
+ *      closed when it is already open.
+ *   3. While the omnibox is OPEN it owns every key: the list beneath it must
+ *      not scroll while a query is being typed.
+ *   4. Escape closes the topmost overlay — omnibox first, then the sheet.
+ *   5. `?` toggles the bindings sheet, but ONLY when no inbox is mounted;
+ *      an inbox already binds `?` for its own sheet, and two sheets opening
+ *      on one keypress is the bug this rule exists to prevent.
+ *
+ * Nothing here touches `document`; the caller normalizes a KeyboardEvent
+ * with {@link keyShape} and applies the returned effect.
+ */
+
+/** The global bindings, as data — the sheet renders from this list. */
+export const GLOBAL_BINDINGS = [
+  { keys: "⌘K / Ctrl-K", does: "open the omnibox (harnesses, sessions, wiki, runs, actions)" },
+  { keys: "?", does: "show or hide this bindings sheet" },
+  { keys: "Esc", does: "close the omnibox, then this sheet" },
+];
+
+/** The inbox bindings, repeated in the global sheet so one overlay answers
+ *  "what can I press here?" wherever it is opened. */
+export const INBOX_BINDINGS = [
+  { keys: "j / ↓", does: "move down a row" },
+  { keys: "k / ↑", does: "move up a row" },
+  { keys: "g / d", does: "grant or deny (approvals inbox)" },
+  { keys: "u / d / p / f", does: "up, down, pass or fail (review queue)" },
+  { keys: ".", does: "open the row menu" },
+  { keys: "?", does: "show the inbox's own bindings" },
+];
+
+/** Fields that own their keystrokes. */
+const FIELD_TAGS = new Set(["INPUT", "TEXTAREA", "SELECT"]);
+
+/** The omnibox chord, in both flavours. */
+function isOmniChord(k) {
+  return (k.meta === true || k.ctrl === true) && (k.key === "k" || k.key === "K");
+}
+
+/**
+ * Normalize a KeyboardEvent into the plain record the reducer takes. Pure
+ * apart from reading the event; kept here so tests describe key presses as
+ * data rather than constructing DOM events.
+ */
+export function keyShape(event) {
+  const target = event?.target ?? null;
+  const tag = target && typeof target.tagName === "string" ? target.tagName : "";
+  return {
+    key: typeof event?.key === "string" ? event.key : "",
+    meta: event?.metaKey === true,
+    ctrl: event?.ctrlKey === true,
+    alt: event?.altKey === true,
+    shift: event?.shiftKey === true,
+    inField: FIELD_TAGS.has(tag) || target?.isContentEditable === true,
+  };
+}
+
+/** The initial overlay state. */
+export function initialKeyState() {
+  return { omniboxOpen: false, sheetOpen: false, inboxMounted: false };
+}
+
+/**
+ * The reducer. Returns `{ state, effect, claimed }`:
+ *
+ *   - `state`   — the next overlay state;
+ *   - `effect`  — `"open-omnibox" | "close-omnibox" | "toggle-sheet" |
+ *                 "close-sheet" | null`;
+ *   - `claimed` — true when the app handled the key and the caller should
+ *                 `preventDefault()`. A key the app did NOT claim must fall
+ *                 through untouched, which is what lets the inbox reducer
+ *                 keep working on the same screen.
+ */
+export function globalKey(state, shape) {
+  const s = { ...initialKeyState(), ...(state && typeof state === "object" ? state : {}) };
+  const k = { key: "", meta: false, ctrl: false, alt: false, inField: false, ...(shape ?? {}) };
+  const keep = { state: s, effect: null, claimed: false };
+
+  // 1. A field owns its keys — including ⌘K — except the two that close an
+  //    open omnibox. The overlay focuses its own input, so without this
+  //    exception it would swallow both of its own exits.
+  const closesOmnibox = s.omniboxOpen && (k.key === "Escape" || isOmniChord(k));
+  if (k.inField && !closesOmnibox) return keep;
+
+  // 2. ⌘K / Ctrl-K toggles the omnibox.
+  if (isOmniChord(k)) {
+    return s.omniboxOpen
+      ? { state: { ...s, omniboxOpen: false }, effect: "close-omnibox", claimed: true }
+      : {
+          state: { ...s, omniboxOpen: true, sheetOpen: false },
+          effect: "open-omnibox",
+          claimed: true,
+        };
+  }
+  // Any other modifier chord belongs to the browser (⌘R, ⌘L, ⌘T…).
+  if (k.meta || k.ctrl || k.alt) return keep;
+
+  // 3. While the omnibox is open it owns everything except Escape, which
+  //    rule 4 handles.
+  if (s.omniboxOpen) {
+    if (k.key === "Escape") {
+      return { state: { ...s, omniboxOpen: false }, effect: "close-omnibox", claimed: true };
+    }
+    return { state: s, effect: null, claimed: true };
+  }
+
+  // 4. Escape closes the sheet when it is the topmost overlay.
+  if (k.key === "Escape") {
+    return s.sheetOpen
+      ? { state: { ...s, sheetOpen: false }, effect: "close-sheet", claimed: true }
+      : keep;
+  }
+
+  // 5. `?` is the inbox's when an inbox is mounted.
+  if (k.key === "?") {
+    if (s.inboxMounted) return keep;
+    return { state: { ...s, sheetOpen: !s.sheetOpen }, effect: "toggle-sheet", claimed: true };
+  }
+
+  return keep;
+}
+
+/** Every binding the sheet shows, grouped. Pure — the overlay renders it. */
+export function bindingSheet(inboxMounted = false) {
+  return [
+    { section: "Anywhere", bindings: GLOBAL_BINDINGS },
+    {
+      section: inboxMounted ? "This inbox" : "Inboxes (approvals, review)",
+      bindings: INBOX_BINDINGS,
+    },
+  ];
+}

package/assets/js/markdown.js

@@ -0,0 +1,131 @@
+/**
+ * Minimal SAFE markdown parser for the wiki reader: headings, bold, inline
+ * code, unordered/ordered lists, and fenced code blocks — nothing else, and
+ * explicitly NO raw-HTML passthrough. The parser emits a token tree; the DOM
+ * layer renders every token via `textContent`, so `<script>` in an article
+ * body stays literal text by construction.
+ *
+ * DOM-free and pure so it runs identically in the browser and under
+ * `bun test`.
+ */
+
+/** Parse inline spans: `**bold**` and `` `code` ``; the rest is plain text. */
+export function parseInline(src) {
+  const s = String(src ?? "");
+  const spans = [];
+  let buf = "";
+  let i = 0;
+  const flush = () => {
+    if (buf !== "") {
+      spans.push({ type: "text", text: buf });
+      buf = "";
+    }
+  };
+  while (i < s.length) {
+    if (s.startsWith("**", i)) {
+      const end = s.indexOf("**", i + 2);
+      if (end > i + 1) {
+        flush();
+        spans.push({ type: "bold", text: s.slice(i + 2, end) });
+        i = end + 2;
+        continue;
+      }
+    }
+    if (s[i] === "`") {
+      const end = s.indexOf("`", i + 1);
+      if (end > i) {
+        flush();
+        spans.push({ type: "code", text: s.slice(i + 1, end) });
+        i = end + 1;
+        continue;
+      }
+    }
+    buf += s[i];
+    i += 1;
+  }
+  flush();
+  return spans;
+}
+
+const HEADING_RE = /^(#{1,6})\s+(.*)$/;
+const UL_ITEM_RE = /^\s*[-*]\s+(.*)$/;
+const OL_ITEM_RE = /^\s*\d+[.)]\s+(.*)$/;
+const FENCE_RE = /^```/;
+
+/**
+ * Parse a markdown source string into a flat list of block tokens:
+ *   { type: "heading", level, spans }
+ *   { type: "para", spans }
+ *   { type: "list", ordered, items: spans[][] }
+ *   { type: "code", text }
+ * Unrecognized syntax degrades to paragraph text; raw HTML is never parsed.
+ */
+export function parseMarkdown(src) {
+  const lines = String(src ?? "").split("\n");
+  const blocks = [];
+  let para = [];
+  let list = null;
+  const flushPara = () => {
+    if (para.length > 0) {
+      blocks.push({ type: "para", spans: parseInline(para.join(" ")) });
+      para = [];
+    }
+  };
+  const flushList = () => {
+    if (list !== null) {
+      blocks.push(list);
+      list = null;
+    }
+  };
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    if (FENCE_RE.test(line.trim())) {
+      flushPara();
+      flushList();
+      const body = [];
+      i += 1;
+      while (i < lines.length && !FENCE_RE.test(lines[i].trim())) {
+        body.push(lines[i]);
+        i += 1;
+      }
+      i += 1; // skip the closing fence (or run off the end on an unclosed one)
+      blocks.push({ type: "code", text: body.join("\n") });
+      continue;
+    }
+    const heading = line.match(HEADING_RE);
+    if (heading) {
+      flushPara();
+      flushList();
+      blocks.push({ type: "heading", level: heading[1].length, spans: parseInline(heading[2]) });
+      i += 1;
+      continue;
+    }
+    const ul = line.match(UL_ITEM_RE);
+    const ol = ul === null ? line.match(OL_ITEM_RE) : null;
+    if (ul || ol) {
+      flushPara();
+      const ordered = ol !== null;
+      const item = parseInline((ul ?? ol)[1]);
+      if (list === null || list.ordered !== ordered) {
+        flushList();
+        list = { type: "list", ordered, items: [] };
+      }
+      list.items.push(item);
+      i += 1;
+      continue;
+    }
+    if (line.trim() === "") {
+      flushPara();
+      flushList();
+      i += 1;
+      continue;
+    }
+    flushList();
+    para.push(line.trim());
+    i += 1;
+  }
+  flushPara();
+  flushList();
+  return blocks;
+}

package/assets/js/notify.js

@@ -0,0 +1,152 @@
+/**
+ * HM-183's console half — the ONE notification poll.
+ *
+ * The manager runs no timer of its own: the rules are evaluated when the
+ * console asks for the notification state, and `GET /api/notifications` IS
+ * that evaluation. Which makes an ordinary-looking read a MUTATION in one
+ * respect — every delivery it returns is added to the server's dedupe set
+ * and will never be returned again — and that turns two innocent facts into
+ * a bug:
+ *
+ *   - a console that only asks at boot never notifies anybody, however long
+ *     it is left open, which is exactly the case the one default-on rule
+ *     (a parked approval) exists for; and
+ *   - a second caller — the Settings screen drawing its rules table — can
+ *     CONSUME a delivery that nothing renders, so the toast for it can
+ *     never appear again in that manager process.
+ *
+ * So the console asks in exactly one place: here. The loop below is the only
+ * caller of `api.notifications()` in the asset tree (a unit test pins that),
+ * a view that needs the state {@link NotificationPoll.subscribe|subscribes}
+ * or asks for the shared {@link NotificationPoll.current|snapshot} rather
+ * than issuing its own GET, and a payload a mutating route already
+ * evaluated — the PUT that saves the rules answers with the same view the
+ * GET does, deliveries and all — is folded back in through
+ * {@link NotificationPoll.accept}. One rule holds it together: nothing
+ * consumes a delivery without showing it.
+ *
+ * The factory is exported, with its loader and its timer injectable, so the
+ * loop can be driven to completion in a unit test with no browser and no
+ * clock.
+ */
+
+import { api } from "./api.js";
+
+/**
+ * How often an open console re-evaluates the rules. Each poll is a
+ * fleet-wide signal scan on the server, so this is a BADGE cadence, not a
+ * live feed: often enough that a parked approval surfaces while the
+ * operator is still at the keyboard, rare enough that a hundred-harness
+ * fleet is not rescanned every second.
+ */
+export const NOTIFICATION_POLL_MS = 30_000;
+
+/** The deliveries in a payload, defensively. */
+function deliveredOf(payload) {
+  return Array.isArray(payload?.delivered) ? payload.delivered : [];
+}
+
+/**
+ * Build a poll. `load` defaults to the real route; `schedule`/`cancel`
+ * default to the browser timers. Returns:
+ *
+ *   - `start()`     — poll now, then every `intervalMs` (idempotent);
+ *   - `stop()`      — stop the loop, keeping the last snapshot;
+ *   - `subscribe(fn)` — `fn(payload, delivered)` on every snapshot seen,
+ *                     polled or folded in; returns an unsubscribe;
+ *   - `snapshot()`  — the last payload (or null) without a request;
+ *   - `current()`   — the state a view should render, awaiting the poll in
+ *                     flight or reusing the snapshot before it will start
+ *                     one;
+ *   - `refresh()`   — force one evaluation now, coalesced;
+ *   - `accept(payload)` — fold in a payload a mutating route returned.
+ */
+export function createNotificationPoll(options = {}) {
+  const load = typeof options.load === "function" ? options.load : () => api.notifications();
+  const intervalMs = Number.isFinite(options.intervalMs)
+    ? Number(options.intervalMs)
+    : NOTIFICATION_POLL_MS;
+  const schedule =
+    typeof options.schedule === "function" ? options.schedule : (fn, ms) => setTimeout(fn, ms);
+  const cancel =
+    typeof options.cancel === "function" ? options.cancel : (handle) => clearTimeout(handle);
+
+  const listeners = new Set();
+  let snapshot = null;
+  let inFlight = null;
+  let timer = null;
+  let running = false;
+
+  const emit = (payload, delivered) => {
+    for (const listener of [...listeners]) {
+      try {
+        listener(payload, delivered);
+      } catch {
+        // One listener throwing must never stop the loop that feeds the
+        // others — a broken toast cannot be allowed to break the badge.
+      }
+    }
+  };
+
+  /** Record a payload and tell everyone. The ONLY place `snapshot` moves. */
+  const fold = (payload) => {
+    if (payload === null || typeof payload !== "object") return null;
+    snapshot = payload;
+    emit(payload, deliveredOf(payload));
+    return payload;
+  };
+
+  const poll = () => {
+    // Coalesce: two callers asking at once must never become two evaluating
+    // GETs, because the second would find the first one's deliveries already
+    // deduped away and would show nothing.
+    if (inFlight !== null) return inFlight;
+    const request = Promise.resolve()
+      .then(load)
+      .then(fold, () => null) // a failed poll is not a reason to stop polling
+      .then((result) => {
+        inFlight = null;
+        return result;
+      });
+    inFlight = request;
+    return request;
+  };
+
+  const tick = () => {
+    timer = null;
+    poll().then(() => {
+      if (running && timer === null) timer = schedule(tick, intervalMs);
+    });
+  };
+
+  return {
+    start() {
+      if (running) return;
+      running = true;
+      tick();
+    },
+    stop() {
+      running = false;
+      if (timer !== null) {
+        cancel(timer);
+        timer = null;
+      }
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    snapshot: () => snapshot,
+    current() {
+      if (inFlight !== null) return inFlight;
+      if (snapshot !== null) return Promise.resolve(snapshot);
+      return poll();
+    },
+    refresh: () => poll(),
+    accept: (payload) => fold(payload),
+  };
+}
+
+/** The console's one poll. Views import THIS; the factory above exists so a
+ *  test can drive the same loop with its own clock. */
+export const notifications = createNotificationPoll();