{
  "schemaVersion": 1,
  "type": "resource",
  "id": "base-ui",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser",
      "local-fixture"
    ],
    "summary": "The official notification dialog passed keyboard opening, settled focus containment and Escape restoration. A separate @base-ui/react 1.9.0 fixture passed six checks for labels, focus, state callbacks and literal React text insertion. Neither test saved data.",
    "reportUrl": "/design-evaluations/resource-base-ui.json",
    "identity": {
      "target": "https://base-ui.com/react/components/dialog plus a local @base-ui/react fixture",
      "version": "Local @base-ui/react 1.9.0; React and React DOM 19.3.1 for the Dialog fixtures. Public demo is separately unversioned.",
      "integrity": "Package archive SHA-256 bcb2f90923d9be3200cde3b27cb1a8d1c832a4f5bc7d3709a4f4c99d3de771ab (npm SHA-512 integrity matched). Public document SHA-256 017006d6215b97fc5e5571b99b34a67aee57971a5eb21a7a372c7e8ed15c0338; response-body scope only."
    },
    "environment": [
      "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.",
      "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.",
      "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked.",
      "Exact direct dependencies; 38-package lock installed with --ignore-scripts, empty user/global npm configs, isolated cache and allowlisted environment. No lifecycle install scripts ran.",
      "Local browser responses served only the authored fixture, pinned bundle or stylesheet. External HTTP(S) requests were denied, with zero recorded attempts in the final fixture. WebSocket attempts were blocked but not counted.",
      "Existing Rolldown 1.2.14 bundled inspected prebuilt exports without running upstream build scripts."
    ],
    "tests": [
      {
        "name": "Public sample response",
        "mode": "http",
        "method": "Anonymous public GET; capture status, response-body hash and selected headers.",
        "result": "pass",
        "observation": "HTTP 200; https://base-ui.com/react/components/dialog. Reachability only."
      },
      {
        "name": "Keyboard open and dialog semantics",
        "mode": "browser",
        "method": "Focus the first documented dialog trigger; press Enter; inspect visible dialog and accessible-name reference.",
        "result": "pass",
        "observation": "A visible dialog opened; aria-labelledby target present=True. Presence of a reference is not a screen-reader test."
      },
      {
        "name": "Bounded dialog focus containment",
        "mode": "browser",
        "method": "Press Tab six times while the sample remains open and inspect focus containment after each press, allowing browser chrome or focus guards.",
        "result": "pass",
        "observation": "All six settled Tab samples stayed inside the dialog. This does not establish every focus path or nested-overlay behavior."
      },
      {
        "name": "Escape and focus restoration",
        "mode": "browser",
        "method": "Press Escape, wait for exit animation and inspect closed state plus focus on original trigger.",
        "result": "pass",
        "observation": "Closed=true; trigger focus restored=true. No save action or form submission."
      },
      {
        "name": "Pinned dialog opening and labels",
        "mode": "local-fixture",
        "method": "Press Enter on the authored trigger and inspect the dialog name and description relationships.",
        "result": "pass",
        "observation": "{\"title\":\"Synthetic settings\",\"description\":\"A synthetic local form; nothing is saved.\"}"
      },
      {
        "name": "Initial focus",
        "mode": "local-fixture",
        "method": "Inspect focused element after the modal opens.",
        "result": "pass",
        "observation": "{\"inside\":true,\"tag\":\"INPUT\"}"
      },
      {
        "name": "Tab containment",
        "mode": "local-fixture",
        "method": "Press Tab six times with a brief focus-settlement wait; inspect containment.",
        "result": "pass",
        "observation": "[true,true,true,true,true,true]"
      },
      {
        "name": "React text insertion boundary",
        "mode": "local-fixture",
        "method": "Render a synthetic HTML-looking string as a React child and inspect text, image count and recorded HTTP(S) request attempts.",
        "result": "pass",
        "observation": "Literal text retained=true; image nodes=0; recorded HTTP(S) request attempts=0. React text composition only; no HTML sanitizer tested. WebSocket attempts were blocked but not counted."
      },
      {
        "name": "Escape closure and restoration",
        "mode": "local-fixture",
        "method": "Press Escape and inspect removed dialog plus focus on original trigger.",
        "result": "pass",
        "observation": "{\"closed\":true,\"focused\":true}"
      },
      {
        "name": "Close action and state callback",
        "mode": "local-fixture",
        "method": "Reopen by pointer, activate the component Close control and inspect open-change callbacks.",
        "result": "pass",
        "observation": "Open state callbacks [true,false,true,false]; dialog removed=true; no persistence handler attached."
      }
    ],
    "security": {
      "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.",
      "findings": [
        {
          "level": "caution",
          "basis": "documented",
          "title": "Focus behavior still needs visible styling",
          "detail": "Base UI documents automatic focus management but leaves visible focus styling to the application. The fixture's blue outline was authored for the test, not supplied by the library."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Sampled response and request surface",
          "detail": "The anonymous HTTPS demo response included content-security-policy, strict-transport-security, x-content-type-options, x-frame-options, referrer-policy. Requests attempted 1 additional host(s), including www.googletagmanager.com. The guard blocked 1 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Pinned fixture network boundary",
          "detail": "All six @base-ui/react fixture checks completed with zero recorded HTTP(S) request attempts and zero page errors. WebSocket attempts were blocked but not counted. This applies to the small authored fixture; it is not a claim about every export, dependency or integration."
        }
      ],
      "limits": [
        "No authentication, authorization, tenant isolation, retention or backend processing was tested.",
        "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.",
        "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation."
      ]
    },
    "practicalCaveats": [
      "Unstyled does not mean finished: contrast, target size and visible focus still depend on your CSS.",
      "Portals create a separate rendering location. Check stacking, scroll locking and nested overlays in your app.",
      "Opening a protected action in a dialog does not authorize it. Enforce permissions and validation in the application backend."
    ],
    "limits": [
      "The full @base-ui/react package was installed, but only Dialog was exercised. Other controls, nested overlays, server rendering, mobile gestures and assistive technologies were not tested.",
      "The synthetic fixture used authored focus styles; it does not establish the accessibility of a team's finished visual theme."
    ],
    "sources": [
      {
        "label": "Official documentation",
        "url": "https://base-ui.com/react/overview/quick-start"
      },
      {
        "label": "Official evaluated sample",
        "url": "https://base-ui.com/react/components/dialog"
      },
      {
        "label": "Upstream repository",
        "url": "https://github.com/mui/base-ui"
      },
      {
        "label": "GitHub repository snapshot endpoint",
        "url": "https://api.github.com/repos/mui/base-ui",
        "scope": "Star count and repository identity observed 2026-10-19."
      },
      {
        "label": "Sampled source revision",
        "url": "https://github.com/mui/base-ui/commit/8c2b3182bdcde79704a2d5dc1147a680d031250e",
        "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit."
      },
      {
        "label": "Package manifest snapshot",
        "url": "https://registry.npmjs.org/@base-ui/react/1.9.0",
        "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so."
      },
      {
        "label": "Accessibility responsibilities",
        "url": "https://base-ui.com/react/overview/accessibility"
      }
    ]
  }
}