Custom view rules

What custom view code may and may not contain, generated from the SDK validator.

Custom view rules

Custom view code is checked before it runs. These rules come straight from the validator:

• HTML elements: only div, section, article, header, footer, main, aside, nav, h1, h2, h3, h4, p, span, strong, em, i, small, br, hr, label, input, textarea, button, select, option, optgroup, fieldset, legend, output, progress, meter, ul, ol, li, dl, dt, dd, figure, figcaption, img, video, audio, source, canvas, table, thead, tbody, tfoot, tr, th, td, pre, code, details, summary. No scripts, iframes, SVG, forms, comments or inline event attributes; media URLs must be data: or blob:.
• Never use these names in view JavaScript: eval, Function, AsyncFunction, GeneratorFunction, require, importScripts, process, globalThis, window, self, top, parent, opener, frames, location, navigation, history, navigator, localStorage, sessionStorage, indexedDB, caches, cookieStore, fetch, XMLHttpRequest, WebSocket, EventSource, Worker, SharedWorker, ServiceWorker, WebAssembly, Deno, Bun, Reflect, Proxy, DOMParser, MutationObserver, postMessage, open, close, print, alert, confirm, prompt, setInterval, setTimeout, queueMicrotask, arguments, constructor, __proto__, prototype, __lookupGetter__, __lookupSetter__, __defineGetter__, __defineSetter__, getPrototypeOf, setPrototypeOf, getOwnPropertyDescriptor, getOwnPropertyDescriptors, getOwnPropertyNames, getOwnPropertySymbols, defineProperty, defineProperties, defaultView, ownerGlobal, contentWindow, contentDocument, cookie, domain, documentURI, URL, baseURI, referrer, write, writeln, innerHTML, outerHTML, insertAdjacentHTML, createElement, createElementNS, createContextualFragment, createRange, setAttribute, setAttributeNS, attributes, attributeStyleMap, adoptNode, importNode, execCommand, replaceChildren, setHTML, setHTMLUnsafe, parseHTML, parseHTMLUnsafe, showSaveFilePicker, showDirectoryPicker, saveAs, FileSystemWritableFileStream, createWritable, msSaveBlob, msSaveOrOpenBlob, download.
• Never use these property names: assign, values, entries, fromEntries (so no Object.assign, Object.values, Object.entries, Object.fromEntries; use arrays and map/forEach).
• These words may not appear anywhere in view JavaScript, even in strings or comments: style, cssText, setProperty, removeProperty, insertRule, deleteRule, styleSheets, adoptedStyleSheets, animate. Change appearance with CSS classes and hidden; put colors in the stylesheet.
• Property access with brackets needs a literal key: items[0] and record["title"] are accepted; items[index] is rejected. Iterate with map/forEach or call items.at(index).
• No named recursive functions and no listeners on the global frame; attach events to declared controls.
• Dynamic elements: StillMade.render can create div, section, article, header, footer, p, span, strong, em, i, small, h1, h2, h3, h4, label, button, input, textarea, select, option, ul, ol, li, table, thead, tbody, tr, th, td, details, summary, output, progress, img; give repeated items stable IDs derived from their identity. An img gets its picture when you set its src to the data URL StillMade.previewImage returns, after rendering; the renderer keeps Block-owned src. previewImage works on items of an image[] input.
• Shared writes are queued in order: if one StillMade.updateShared write is rejected (conflict, read-only or timeout), the writes queued behind it are rejected too. Send dependent edits one at a time or through StillMade.scheduleSharedEdit, keep the person's draft, and retry from the latest onShared value. {merge: true} merges independent fields of an object value; create an absent field with the precondition {exists: false}.
• Limits: HTML 64 KiB, CSS 32 KiB, JavaScript 64 KiB; 30 runs and 60 image previews per minute.