{
  "schemaVersion": 1,
  "type": "resource",
  "id": "kibo-ui",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser",
      "source-review"
    ],
    "summary": "The public combobox filtered to SvelteKit, selected it by keyboard, and returned focus after Escape closed the reopened popup. No registry installer, backend or application package was run.",
    "reportUrl": "/design-evaluations/resource-kibo-ui.json",
    "identity": {
      "target": "https://www.kibo-ui.com/components/combobox",
      "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.",
      "integrity": "Recorded document SHA-256 ee015e8d22cdbf2ae69fba17591d90e76882a8a2bdb3326c2b943273712b9b3f. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service."
    },
    "environment": [
      "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.",
      "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.",
      "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence."
    ],
    "tests": [
      {
        "name": "Public document response",
        "mode": "http",
        "method": "Navigate to the recorded public target in a fresh anonymous browser.",
        "result": "pass",
        "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was ee015e8d22cdbf2ae69fba17591d90e76882a8a2bdb3326c2b943273712b9b3f; this fingerprints only the recorded HTML response."
      },
      {
        "name": "Keyboard search and selection",
        "mode": "browser",
        "method": "Open the first framework picker with Enter; type Svelte, then use ArrowDown and Enter on the filtered list.",
        "result": "pass",
        "observation": "The filtered list contained SvelteKit. The same trigger changed its label to SvelteKit and reported aria-expanded=false after selection."
      },
      {
        "name": "Escape and focus return",
        "mode": "browser",
        "method": "Reopen the selected picker, press Escape and inspect focus after the close transition settled.",
        "result": "pass",
        "observation": "The popup closed and aria-expanded returned false. After 350 ms, focus was back on the same trigger."
      },
      {
        "name": "Primary-source scope review",
        "mode": "source-review",
        "method": "Read the official pages and relevant repository or standard references linked below.",
        "result": "pass",
        "observation": "Reviewed the current official repository, documented setup requirements and combobox examples. Repository metadata establishes current identity and a dated interest snapshot, not security or trend growth."
      },
      {
        "name": "Broader workflow and assurance coverage",
        "mode": "browser",
        "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.",
        "result": "not-run",
        "observation": "No CLI, dependency installation, upload, editor persistence, collaborative service, server validation, screen reader or authenticated workflow was tested. Early selector and immediate-focus probes were superseded by the stable-element check after the close transition."
      }
    ],
    "security": {
      "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.",
      "findings": [
        {
          "level": "info",
          "basis": "observed",
          "title": "Public demo and external resources",
          "detail": "The sample requested four origins, including Plausible and third-party image/CDN hosts. No non-GET request or page error was recorded. One external avatar request returned 404 without preventing the control checks."
        },
        {
          "level": "caution",
          "basis": "documented",
          "title": "Installation changes your project",
          "detail": "Kibo’s setup guide says its CLI or shadcn workflow adds component code and required dependencies. That is a code and dependency review boundary; the hosted demo does not establish those downloads’ safety."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Selection is not permission",
          "detail": "Client-side filtering and selection do not authorize a deployment, account change or other sensitive action. Validate the chosen value and the caller’s permissions on the server before using it."
        }
      ],
      "limits": [
        "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.",
        "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling."
      ]
    },
    "practicalCaveats": [
      "Choose a single component for a real use case, inspect its dependencies and keep its code maintainable.",
      "Retest naming, focus and keyboard behavior with your actual content and validation; this pass covers one default combobox only."
    ],
    "limits": [
      "No CLI, dependency installation, upload, editor persistence, collaborative service, server validation, screen reader or authenticated workflow was tested. Early selector and immediate-focus probes were superseded by the stable-element check after the close transition.",
      "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.",
      "Proposed use-case examples in this review were not implemented as a production workflow."
    ],
    "sources": [
      {
        "label": "Product and component catalog",
        "url": "https://www.kibo-ui.com/"
      },
      {
        "label": "Setup requirements",
        "url": "https://www.kibo-ui.com/docs/setup"
      },
      {
        "label": "Public combobox examples",
        "url": "https://www.kibo-ui.com/components/combobox"
      },
      {
        "label": "Current official repository",
        "url": "https://github.com/shadcnblocks/kibo"
      }
    ]
  }
}