What applies here

All packages (root, core, react) use Vitest as their test runner.

stack-binding

Core functionality—environment detection, validation, state change notifications, and time manipulation—is implemented manually without relying on third-party libraries.

packages/core · layering

DevDependencies specific to a workspace (type definitions and test runner) are declared in that workspace's package.json, while shared build and lint tooling is declared only at the root package.json.

stack-binding

Internal state is derived from multiple independent sources or exposed in multiple independent formats — time has multiple string/number representations, environment mode is detected from env vars, globals, hostname, and UA.

packages/core · layering

Library packages are built with Rollup, while the example application uses Vite for development and bundling.

stack-binding

Linting is performed with ESLint, supplemented by TypeScript-specific and React-specific plugins.

stack-binding

The codebase is organized into a framework-agnostic core package and a framework-specific binding package; the binding package depends on core and declares the UI framework as a peer dependency.

stack-binding

The example application uses Vite with @vitejs/plugin-react for development and building, while the library packages use Rollup with a consistent set of plugins (commonjs, node-resolve, typescript, dts, peer-deps-external) for production builds.

stack-binding

The library package declares its host framework (react and react-dom) as peerDependencies, ensuring consumers provide their own version, while it lists internal utilities (@time-travel/core) as a direct dependency.

stack-binding

The project uses Rollup for building the library packages and Vite for the example application, indicating separate bundling strategies for distribution and demonstration.

stack-binding

Time state is managed as mutable state with observable changes: mutations go through the TimeControllerImpl and subscribers are notified via onTimeChange and drift tracking.

packages/core · layering

Correctness footgun: [fail-open-swallow] packages/core/src/hijacker.ts:79 — restoreMoment reassigns moment.now then deletes __original; the empty catch at 171 hides any error during this restoration (e.g., delete fails in strict mode, or moment is a frozen object). If an error occurs, moment.now is left partially reassigned or still hijacked with a dangling __original… | damage: After disable() is called, the hijacked library's now() function may remain modified or corrupt — the caller sees time still controlled when it should be restored to real time. This compounds across disable/enable…

Correctness Footgun · high

Correctness footgun: [fail-open-swallow] packages/react/src/useTimeControl.ts:120 — jumpBy calls parseTimePeriod(period), which can throw on invalid input (e.g. 'xyz' or '2x'). The catch logs to console but returns without advancing the controller time. | damage: A developer calling jumpBy('badstring') expects the controlled time to advance by that period — instead the call is a silent no-op. The keyboard shortcut handler does NOT use jumpBy (it uses the raw add* methods), so this primarily affects custom callers who get zero feedback that their command…

Correctness Footgun · high

Implicit state machine: packages/core/src/controller.ts:189-193 [high] inputs: globalController, options (4 worlds) | states: smeared — un-named; the implicit states are: no controller, controller with new options, controller with no options | fusion: branch 1 creates a new TimeControllerImpl (commitment); branch 2 calls updateOptions (commitment); classification and commitment are fused; the missing else silently…

Hidden state · high