Secrets have one owner.
Treat all client credentials as platform-restricted public credentials and keep privileged REST work on a backend. Never reuse legacy auth with a current host by resemblance.
A legacy-safe WebView facade that waits for device readiness, owns teardown, and keeps a web/deep-link fallback available for migration.
The canonical file manifest is also the archive contract. Common evidence, environment, manifest, and acceptance files accompany platform-specific source.
README.mdSetup and first-success boundarySTARTER_MANIFEST.jsonMachine-readable project scope.env.exampleBlank non-secret configurationEVIDENCE.mdSource and selection boundaryACCEPTANCE.mdSuccess and hostile-path proofconfig.xmlMinimal legacy host identitywww/index.htmlWebView host with deep-link fallbackwww/js/index.jsDevice-ready lifecycle facadeTreat all client credentials as platform-restricted public credentials and keep privileged REST work on a backend. Never reuse legacy auth with a current host by resemblance.
Only legacy/beta Cordova sources exist in the public corpus. This quickstart is for stabilizing an existing estate—not recommending Cordova for new development. Use the migration track to select a supported target.
One legacy journey is reproducible, has a fallback, and can switch to a replacement adapter without changing domain state.
A blocked, missing, or unentitled provider produces a useful explicit failure rather than a blank surface or fabricated result.
No server credential, bearer value, precise private fixture, or provider response body appears in client bundles, logs, screenshots, or test artifacts.
Resources, listeners, sessions, processes, or requests stop cleanly when the owning screen, request, or application ends.
Legacy status is explicit
Every build input is frozen
Facade inputs are bounded
Migration and rollback paths are tested