{
  "schemaVersion": 1,
  "type": "resource",
  "id": "gsap",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "local-fixture",
      "source-review"
    ],
    "summary": "GSAP 3.15.0 passed four local checks: numeric seeking, sequential timeline positions, context style restoration and a consumer reduced-motion branch. Browser HTTP(S) and WebSocket requests were blocked; no plugins were exercised.",
    "reportUrl": "/design-evaluations/resource-gsap.json",
    "identity": {
      "target": "gsap",
      "version": "3.15.0",
      "integrity": "sha512-dMW4CWBTUK1AEEDeZc1g4xpPGIrSf9fJF960qbTZmN/QwZIWY5wgliS6JWl9/25fpTGJrMRtSjGtOmPnfjZB+A=="
    },
    "environment": [
      "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.",
      "Synthetic inputs only; no uploads, purchases, accounts or private data.",
      "Pinned extracted assets/modules; browser HTTP(S) and WebSocket requests denied. No install/lifecycle scripts; no process-wide Node egress guarantee."
    ],
    "tests": [
      {
        "name": "Numeric interpolation",
        "mode": "local-fixture",
        "method": "Seek paused object tween at 0/0.5/1 seconds",
        "result": "pass",
        "observation": "[0,50,100]"
      },
      {
        "name": "Timeline sequencing",
        "mode": "local-fixture",
        "method": "Seek two sequential one-second tweens to 1.5 seconds",
        "result": "pass",
        "observation": "{\"first\":100,\"second\":100}"
      },
      {
        "name": "Context cleanup",
        "mode": "local-fixture",
        "method": "Seek transform/opacity then revert GSAP context",
        "result": "pass",
        "observation": "{\"values\":[0,50,100],\"timeline\":{\"first\":100,\"second\":100},\"middle\":{\"x\":50,\"opacity\":0.625},\"restored\":{\"opacity\":\"0.25\",\"transform\":\"\"}}"
      },
      {
        "name": "Consumer motion policy",
        "mode": "local-fixture",
        "method": "Compare raw tween with no-preference matchMedia branch",
        "result": "pass",
        "observation": "{\"reduced\":true,\"rawRuns\":true,\"guardedBranch\":false}"
      },
      {
        "name": "Plugin behavior",
        "mode": "local-fixture",
        "method": "Exercise scroll, text or SVG plugins",
        "result": "not-run",
        "observation": "Only core GSAP was loaded; plugin behavior and integration remain untested."
      }
    ],
    "security": {
      "scope": "Manifest/license and selected entry/source inspection, plus the named synthetic local fixture. No active exploitation or full security audit.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "Cleanup restored authored styles",
          "detail": "The local context changed transform and opacity, then revert restored opacity 0.25 and removed its transform. Test the same ownership boundary when multiple systems can write styles."
        },
        {
          "level": "caution",
          "basis": "observed",
          "title": "Reduced motion is not a universal core default",
          "detail": "The raw tween advanced after reduced motion was requested. A separately authored no-preference matchMedia branch did not run; that is consumer policy, not blanket automatic suppression."
        },
        {
          "level": "caution",
          "basis": "documented",
          "title": "Custom licensing affects tool builders",
          "detail": "The linked Standard License restricts specified competing visual animation-building uses. Check those terms before embedding GSAP inside an editor or builder."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Pinned sample and network boundary",
          "detail": "The fetched archive matched its registry SHA-512. The selected fixture made zero outbound attempts under an HTTP/WebSocket deny rule. No package lifecycle scripts executed; this does not audit all package code or dependencies."
        }
      ],
      "limits": [
        "No plugin execution, framework adapter, touch/scroll behavior, performance benchmark or complete accessibility review.",
        "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification."
      ]
    },
    "practicalCaveats": [
      "Keep each view’s temporary animations in a cleanup scope and verify the state after closing or navigating.",
      "Do not make important copy or controls depend on a long timeline finishing."
    ],
    "limits": [
      "Only core GSAP 3.15.0 with synthetic objects and one DOM element.",
      "No plugin execution, framework adapter, touch/scroll behavior, performance benchmark or complete accessibility review."
    ],
    "sources": [
      {
        "label": "GSAP documentation",
        "url": "https://gsap.com/docs/v3/"
      },
      {
        "label": "Current Standard License",
        "url": "https://gsap.com/community/standard-license/"
      },
      {
        "label": "Dated repository snapshot source",
        "url": "https://github.com/greensock/GSAP"
      },
      {
        "label": "Exact evaluated package archive",
        "url": "https://registry.npmjs.org/gsap/-/gsap-3.15.0.tgz"
      }
    ]
  }
}