public source · HTML + JavaScript

Deep-link handoff starter

A dependency-free navigation-link builder with validation and separate click, app-attempt, fallback, and arrival evidence.

Download project Follow the quickstart

Inside the archive

A project you can inspect before installing.

The canonical file manifest is also the archive contract. Common evidence, environment, manifest, and acceptance files accompany platform-specific source.

README.mdSetup and first-success boundary

STARTER_MANIFEST.jsonMachine-readable project scope

.env.exampleBlank non-secret configuration

EVIDENCE.mdSource and selection boundary

ACCEPTANCE.mdSuccess and hostile-path proof

index.htmlValidated destination form

app.jsExact documented navigation shape

HANDOFF.mdEvidence and privacy rules

Deep-link handoff starter

{
  "schemaVersion": "mappls.starter-kit.v1",
  "slug": "deep-links-starter",
  "platform": "Deep links",
  "quickstartSlug": "deep-links",
  "readiness": "public-source",
  "liveProviderCallsEnabled": false,
  "sourceGuideSlugs": [
    "mappls-app-widgets"
  ],
  "credentialRule": "Blank environment placeholders only; enable a live adapter only after account, package, host, auth, region, and entitlement review."
}

Credential boundary

Secrets have one owner.

Deep links contain no credential. Put only bounded non-sensitive intent in the URL; precise private/user data and server secrets must never become query parameters.

Evidence boundary

Source before syntax.

Use the exact link shape documented by the current App Widgets source. The scaffold below deliberately receives that approved base rather than inventing an undocumented path.

Mappls App Widgets

Release evidence

What must be true after the scaffold.

Every supported channel reaches the same destination intent or a useful visible fallback without sensitive query data.

A blocked, missing, or unentitled provider produces a useful explicit failure rather than a blank surface or fabricated result.

No server credential, bearer value, precise private fixture, or provider response body appears in client bundles, logs, screenshots, or test artifacts.

Resources, listeners, sessions, processes, or requests stop cleanly when the owning screen, request, or application ends.

No private data is encoded

All values are validated and encoded

App/browser intent matches

Redirect domains are allow-listed