deconstruct

This is a development-only motion timeline viewer/editor, not apparent malware. Its primary security concern is high-severity XSS if an untrusted `timeline.js` supplies executable content in `preview.html`; the optional `recording.src` also controls a browser network/media request. The page loads fonts from `fonts.googleapis[.]com` and `fonts.gstatic[.]com` and a local `timeline.js`; no environment variables or credential types are accessed. Treat timeline files as trusted, or sanitize preview content before rendering.