{
  "schemaVersion": 1,
  "type": "resource",
  "id": "daisyui",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser",
      "local-fixture"
    ],
    "summary": "The public native-dialog sample opened and closed with keyboard focus returning to its trigger. Six local checks passed for compiled styles, theme tokens, native disclosure and checkbox behavior, focus outline and a disabled button. The Tailwind plugin itself was not executed.",
    "reportUrl": "/design-evaluations/resource-daisyui.json",
    "identity": {
      "target": "https://daisyui.com/components/modal/ plus a local daisyui fixture",
      "version": "Local daisyUI 5.7.50 prebuilt CSS with authored native HTML; no Tailwind plugin execution. Public demo is separately unversioned.",
      "integrity": "Package archive SHA-256 e8e51df2ac7b077a512242bca51433a95c9b35f6d5b76faec98ce964aba8424c (npm SHA-512 integrity matched). Public document SHA-256 95ca0685443ea57f04ea9083b804861ff5341c66fb520e74fcfb9833a81604ed; response-body scope only."
    },
    "environment": [
      "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.",
      "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.",
      "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked.",
      "Exact direct dependencies; 38-package lock installed with --ignore-scripts, empty user/global npm configs, isolated cache and allowlisted environment. No lifecycle install scripts ran.",
      "Local browser responses served only the authored fixture, pinned bundle or stylesheet. External HTTP(S) requests were denied, with zero recorded attempts in the final fixture. WebSocket attempts were blocked but not counted.",
      "Existing Rolldown 1.2.14 bundled inspected prebuilt exports without running upstream build scripts."
    ],
    "tests": [
      {
        "name": "Public sample response",
        "mode": "http",
        "method": "Anonymous public GET; capture status, response-body hash and selected headers.",
        "result": "pass",
        "observation": "HTTP 200; https://daisyui.com/components/modal/. Reachability only."
      },
      {
        "name": "Keyboard open and dialog semantics",
        "mode": "browser",
        "method": "Focus the first documented dialog trigger; press Enter; inspect visible dialog and accessible-name reference.",
        "result": "pass",
        "observation": "A visible dialog opened; aria-labelledby target present=False. Presence of a reference is not a screen-reader test."
      },
      {
        "name": "Bounded dialog focus containment",
        "mode": "browser",
        "method": "Press Tab six times while the sample remains open and inspect focus containment after each press, allowing browser chrome or focus guards.",
        "result": "pass",
        "observation": "Six Tab steps alternated between the dialog Close button and browser chrome. No background-page control received focus in these steps; native modal behavior, not library JavaScript."
      },
      {
        "name": "Escape and focus restoration",
        "mode": "browser",
        "method": "Press Escape, wait for exit animation and inspect closed state plus focus on original trigger.",
        "result": "pass",
        "observation": "Closed=true; trigger focus restored=true. No save action or form submission."
      },
      {
        "name": "Compiled component styles",
        "mode": "local-fixture",
        "method": "Inspect button geometry and colors with the pinned prebuilt stylesheet.",
        "result": "pass",
        "observation": "{\"display\":\"inline-flex\",\"height\":40,\"background\":\"oklch(0.45 0.24 277.023)\",\"radius\":\"4px\"}"
      },
      {
        "name": "Theme token switch",
        "mode": "local-fixture",
        "method": "Switch the synthetic root from light to dark and compare resolved base colors.",
        "result": "pass",
        "observation": "{\"light\":\"oklch(100% 0 0)\",\"dark\":\"oklch(25.33% .016 252.42)\"}"
      },
      {
        "name": "Native disclosure with CSS",
        "mode": "local-fixture",
        "method": "Use Enter twice on an authored details/summary element styled with collapse classes.",
        "result": "pass",
        "observation": "Open after Enter=true; closed after second Enter=true. Behavior comes from native HTML; daisyUI supplies styling."
      },
      {
        "name": "Native checkbox with CSS",
        "mode": "local-fixture",
        "method": "Use Space twice on the authored styled checkbox.",
        "result": "pass",
        "observation": "Native checkbox toggled and restored=true. No library JavaScript used."
      },
      {
        "name": "Keyboard focus visibility",
        "mode": "local-fixture",
        "method": "Focus the styled action after keyboard input and inspect outline.",
        "result": "pass",
        "observation": "{\"matches\":true,\"outline\":\"solid\",\"width\":\"2px\"}"
      },
      {
        "name": "Disabled control boundary",
        "mode": "local-fixture",
        "method": "Inspect disabled property and verify a click is not emitted by programmatic click on a native disabled button.",
        "result": "pass",
        "observation": "{\"disabled\":true,\"clicks\":0} Native HTML behavior, not a backend permission boundary."
      }
    ],
    "security": {
      "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "Modal naming needs review when copying a sample",
          "detail": "The first documented dialog opened with visible heading text but no aria-labelledby reference in the sampled DOM. The native dialog handled Escape; verify a usable accessible name rather than assuming the visual heading supplies one."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Sampled response and request surface",
          "detail": "The anonymous HTTPS demo response included none of the selected security response headers. Requests attempted 7 additional host(s), including fonts.googleapis.com, fonts.gstatic.com, api.daisyui.com, cdn.carbonads.com. The guard blocked 1 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Pinned fixture network boundary",
          "detail": "All six daisyui fixture checks completed with zero recorded HTTP(S) request attempts and zero page errors. WebSocket attempts were blocked but not counted. This applies to the small authored fixture; it is not a claim about every export, dependency or integration."
        }
      ],
      "limits": [
        "No authentication, authorization, tenant isolation, retention or backend processing was tested.",
        "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.",
        "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation."
      ]
    },
    "practicalCaveats": [
      "Class names can style an element but cannot turn an unsuitable element into a complete accessible control.",
      "The first public modal sample had no aria-labelledby reference. Add and verify an accessible name in your own modal composition.",
      "The shipped stylesheet is not proof that every theme has suitable contrast for your content, states or custom colors."
    ],
    "limits": [
      "Only the pinned prebuilt stylesheet and small native HTML fixtures were exercised; plugin compilation, tree-shaking and application integration were not tested.",
      "Native checkbox, details and disabled-button behavior belongs to the browser, not daisyUI JavaScript. Theme contrast and full reduced-motion behavior were not audited."
    ],
    "sources": [
      {
        "label": "Official documentation",
        "url": "https://daisyui.com/docs/install/"
      },
      {
        "label": "Official evaluated sample",
        "url": "https://daisyui.com/components/modal/"
      },
      {
        "label": "Upstream repository",
        "url": "https://github.com/saadeghi/daisyui"
      },
      {
        "label": "GitHub repository snapshot endpoint",
        "url": "https://api.github.com/repos/saadeghi/daisyui",
        "scope": "Star count and repository identity observed 2026-10-19."
      },
      {
        "label": "Sampled source revision",
        "url": "https://github.com/saadeghi/daisyui/commit/bf3bac3a397b543e55641ecb2d60a2ed961f09ec",
        "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit."
      },
      {
        "label": "Package manifest snapshot",
        "url": "https://registry.npmjs.org/daisyui/5.7.50",
        "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so."
      }
    ]
  }
}