public source · JavaScript

Trusted REST service starter

A dependency-free autosuggest service with bounded input, fixture-first behavior, abortable live calls, normalized output, and credential-safe errors.

Download project Follow the quickstart

Inside the archive

A project you can inspect before installing.

The canonical file manifest is also the archive contract. Common evidence, environment, manifest, and acceptance files accompany platform-specific source.

README.mdSetup and first-success boundary

STARTER_MANIFEST.jsonMachine-readable project scope

.env.exampleBlank non-secret configuration

EVIDENCE.mdSource and selection boundary

ACCEPTANCE.mdSuccess and hostile-path proof

package.jsonRun and test commands

src/service.mjsFixture/live provider seam

src/server.mjsBounded application endpoint

test/service.test.mjsCredential-free contract tests

Trusted REST service starter

{
  "schemaVersion": "mappls.starter-kit.v1",
  "slug": "rest-api-starter",
  "platform": "REST",
  "quickstartSlug": "rest-api",
  "readiness": "public-source",
  "liveProviderCallsEnabled": false,
  "sourceGuideSlugs": [
    "mappls-rest-apis"
  ],
  "credentialRule": "Blank environment placeholders only; enable a live adapter only after account, package, host, auth, region, and entitlement review."
}

Credential boundary

Secrets have one owner.

Load the current restricted static key only inside the trusted process. Legacy OAuth and InTouch bearer credentials are separate generations and must never be mixed by inference.

Evidence boundary

Source before syntax.

The public REST repository and normalized operation are repository evidence; the issued account remains authoritative for host, auth generation, quota, and region.

Mappls Map APIs (REST) !

Release evidence

What must be true after the scaffold.

The successful response retains a Mappls place identity and the failure response is typed and redacted.

A blocked, missing, or unentitled provider produces a useful explicit failure rather than a blank surface or fabricated result.

No server credential, bearer value, precise private fixture, or provider response body appears in client bundles, logs, screenshots, or test artifacts.

Resources, listeners, sessions, processes, or requests stop cleanly when the owning screen, request, or application ends.

Credential restriction and URL-log redaction are proven

Timeout and bounded retry are explicit

Inputs and result sizes are bounded

Provider request identity is observable without response bodies