Secrets have one owner.
Use only the browser-supported public key restricted to exact origins. Privileged REST credentials stay on a backend-for-frontend.
A responsive keyboard-accessible map host with explicit loading, ready, unavailable, selection, and teardown states around a replaceable SDK adapter.
The canonical file manifest is also the archive contract. Common evidence, environment, manifest, and acceptance files accompany platform-specific source.
README.mdSetup and first-success boundarySTARTER_MANIFEST.jsonMachine-readable project scope.env.exampleBlank non-secret configurationEVIDENCE.mdSource and selection boundaryACCEPTANCE.mdSuccess and hostile-path proofindex.htmlAccessible visual and text shellsrc/app.jsSDK-owned lifecycle seamstyles.cssResponsive visible statesUse only the browser-supported public key restricted to exact origins. Privileged REST credentials stay on a backend-for-frontend.
The selected Web Maps source contains current and sample evidence; confirm the script/package line and allowed origin against the target project.
Map, text fallback, and selected identity stay synchronized at mobile and desktop widths.
A blocked, missing, or unentitled provider produces a useful explicit failure rather than a blank surface or fabricated result.
No server credential, bearer value, precise private fixture, or provider response body appears in client bundles, logs, screenshots, or test artifacts.
Resources, listeners, sessions, processes, or requests stop cleanly when the owning screen, request, or application ends.
Exact origins are restricted
Canvas behavior has an accessible text equivalent
Slow/offline states are useful
Listeners and workers are destroyed on unmount