public source · HTML + JavaScript

Widget journey host starter

A credential-free nearby iframe host with loading, ready, fallback, candidate, committed, and destroyed application states.

Download project Follow the quickstart

Inside the archive

A project you can inspect before installing.

The canonical file manifest is also the archive contract. Common evidence, environment, manifest, and acceptance files accompany platform-specific source.

README.mdSetup and first-success boundary

STARTER_MANIFEST.jsonMachine-readable project scope

.env.exampleBlank non-secret configuration

EVIDENCE.mdSource and selection boundary

ACCEPTANCE.mdSuccess and hostile-path proof

index.htmlAccessible widget host

host.jsExplicit iframe lifecycle

HOST_STATES.mdApplication-owned state

Widget journey host starter

{
  "schemaVersion": "mappls.starter-kit.v1",
  "slug": "widgets-place-starter",
  "platform": "Widgets",
  "quickstartSlug": "widgets-place",
  "readiness": "public-source",
  "liveProviderCallsEnabled": false,
  "sourceGuideSlugs": [
    "mappls-web-plugins"
  ],
  "credentialRule": "Blank environment placeholders only; enable a live adapter only after account, package, host, auth, region, and entitlement review."
}

Credential boundary

Secrets have one owner.

Use only the widget/browser credential class restricted to exact origins. Validate every postMessage/callback payload and keep privileged operations on the server.

Evidence boundary

Source before syntax.

The current public Web Plugins guide spans current vector and legacy raster integration branches; source activity is not a support promise. Confirm the exact widget, script, origin, event schema, release, entitlement, and authentication line before implementation.

Mappls Web Plugins

Release evidence

What must be true after the scaffold.

The host submits only a validated selected identity and remains usable when the widget is slow, blocked, denied, or unavailable.

A blocked, missing, or unentitled provider produces a useful explicit failure rather than a blank surface or fabricated result.

No server credential, bearer value, precise private fixture, or provider response body appears in client bundles, logs, screenshots, or test artifacts.

Resources, listeners, sessions, processes, or requests stop cleanly when the owning screen, request, or application ends.

Supported status is confirmed

Origins and payloads are validated

Fallback is complete

Keyboard and screen-reader behavior is tested