Changelog

Copy Markdown View Source

v0.7.0 — 2026-10-16

Changed

  • Compile native templates into merged static HTML and evaluated value tuples, with hidden named rendering programs that do not pin old module code. Reuse the existing escaping/validation for dynamic values and spreads.
  • Build component assigns and unconditional unique slots as maps; pre-escape literal class prefixes and fixed binary-attribute portions without caching submitted or runtime HTML. Binary operands all evaluate before type validation, preserving failure-side effects before later template content.
  • Experimental representation change: compiled Template.nodes is now nil. Use Template.nodes/1 for the evaluated tree. Hand-built node trees remain supported. Recompile native callers when upgrading; snapshots are not a transport/storage format.
  • Diff materializes both trees and keeps the existing conservative patch rules. Missing compiled programs after reload reset the baseline. No expressions, authorization or data reads are skipped, and no connection process is added.

Added

  • CI checks compile, tests, documentation and package assembly on the minimum supported Elixir/OTP pair and Octafest's current pair, using the current toolchain for canonical formatting.

Fixed

  • Keep function-local aliases in evaluated keys, reject void children during compilation, and preserve moduleless template evaluation.

v0.6.1

Added

  • Native case/cond EEx clauses with pattern bindings, guards and conservative branch patching, plus :if on named slots. Legacy HEEx results remain incompatible.

Changed

  • Replace per-element and per-attribute ASCII regex validation with equivalent byte scanners, validate dynamic names once, and avoid repeated module-loading checks and successful-component error-message formatting during rendering.
  • Keep patch accumulation and duplicate-key checks linear while preserving document order, missing-key precedence and existing patch boundaries.

Fixed

  • Accept the pinned parser's normalized EEx comment nodes without emitting them, and consume compiler-only formatting/interpolation hints without DOM attributes.

Documentation

  • Clarify incremental native subtree adoption through existing HEEx HTTP hosts, and require separate rendering and actual patch measurements before expanding STAR use. The bundled skill explains the same boundary and retained-baseline limits.

v0.6.0

Added

  • Portable Datastar/StarView/Rocket agent skill bundled in skills/datastar, with copying instructions for Codex, Claude Code and other skill-capable agents.
  • Opt-in checked_events: true derives event registration from final public handler clauses, checks literal local request helpers in ~STAR, and rejects unknown names or wrong methods before SSE with HTTP 404/405.
  • Experimental ~STAR compiler and a StarView-owned template/node representation with initial HTML rendering and conservative HTML patch planning. The adapter is gated to Phoenix LiveView 1.2.12; no new page process or dependency upgrade.
  • Optional coalesced rendering on the existing stream loop: :render, :render_interval, :render_on_connect and StarView.invalidate/1. StarView.Page.handle_refresh/1 exposes the same lifecycle with :refresh_interval. Connections take a fresh snapshot after subscribing.
  • Opt-in keyed only_changed: true element patches compare SHA-256 digests within a stream, with bounded tracking and a fresh comparison on reconnect.
  • Explicit connect(retry: ...) policy for pages, preserving the existing default. :always opts into reconnecting clean stream endings; :never also sets a zero retry count for clients that retry network errors separately.
  • A Phoenix/backend mental-model guide and reactive rendering example, crediting Jacob O'Bryant's article and Biff's Datastar implementation.

Fixed

  • Controller StarView.Actions helpers now preserve trusted JavaScript :opts, matching page/component event helpers. Fetch cancellation, payload filters and retry options are emitted rather than silently ignored.
  • Stream identity examples use a document UUID rather than a copied session-storage ID, avoiding accidental replacement between duplicated tabs.

v0.5.0

Added

  • Reconciled the unpublished local Page, Component and Router work into an optional stable Phoenix surface. Existing controller/core APIs remain supported.
  • StarView.Page colocates mount, render, event and stream callbacks; StarView.Component colocates shared UI with marked event handlers.
  • Page streams use the existing StarView.Stream lifecycle and coordinator; there is no separate receive loop or process framework. Optional handle_disconnect/1 runs once after exact claim release on normal ends, takeover and raised callbacks, using the latest completed callback conn.
  • New router macros default to POST-only events. Extra unsafe methods are explicit; page GET is opt-in and component GET is restricted to an explicit marked-module allowlist via additive Dispatch :only options.
  • Page/component helpers reuse safe JSON/segment encoding. Browser pathname and component dispatch bases are validated as local paths before any request.
  • Added StarView.Test assertions for emitted Plug/Phoenix SSE, including multiline JSON, nested expected keys and explicit null patches.
  • Added a removable mix star_view.setup.stream_page PubSub demo with supervised ticker, routing and CSRF wiring, plus disconnect unsubscribe.
  • Added the page/component guide and packaged usage rules. The published 0.4.0 transport/security/installer fixes and dependency lock remain in place.
  • Fixed optional installer task compilation in Plug-only consumers without Igniter; optional dependencies remain optional.

The new page/component/routing design adapts dstar's MIT work. The original unpublished checkout remains separate; stale version and registry implementations were not carried into the release.

v0.4.0

Compatibility and security changes

  • Action expressions now use JSON double-quoted URL strings. Code that parses action text must support both quote styles instead of matching a single quote; prefer keeping module/event data rather than parsing expressions. Hand-built HTML must escape the action value with Phoenix.HTML instead of interpolating it into a double-quoted attribute. HEEx handles attribute escaping automatically.
  • Custom module: "$signal" expressions are no longer accepted: $-prefixed overrides raise ArgumentError instead of being treated as executable JavaScript. The default "$_star_view_module" signal remains supported; other overrides are literal module names. Safe relative prefixes still normalize to local absolute paths.
  • The optional Igniter integration now requires the tested ~> 0.8.4 API.
  • Script attribute names must be plain names; pass values using map/tuple attributes instead of bare type="module" fragments.
  • StreamRegistry is now a GenServer coordinator rather than Elixir's Registry. Use its public ownership API; direct Registry.lookup/2 calls and Registry child options are incompatible.
  • start_stream/2 returns a halted HTTP 400/413 for invalid/oversized signals rather than opening an unkeyed stream. Raw/query signal input defaults to 1,000,000 bytes, lower than the previous raw-body reader's 8 MB limit. Empty datastar= values and parsed non-object JSON wrappers now return HTTP 400.
  • Legacy manual streams still receive :replaced exits and must trap exits to clean up. Owners that retain a retired claim past :grace_ms are killed; release the exact claim before returning to an HTTP/1 keep-alive request. The new StarView.Stream lifecycle uses tagged ordinary takeover messages.

Added

  • Added StarView.Signals.fetch/2 and StarView.fetch_signals/2 to return the consumed Plug conn with object-only signals and configurable raw/query limits.
  • Added opt-in StarView.Stream.open/2 and run/2 for a shared SSE lifecycle: fixed-deadline liveness probes, adapter mailbox handling, exact-generation takeover, explicit claim release, and one normal disconnect callback.
  • Added StreamRegistry.release/1, unregister_stream/1, unregister_self/0, and owner/1 for explicit ownership cleanup and inspection.

Fixed

  • Action helpers percent-encode literal event/module values as route segments, serialize JavaScript strings, validate local prefixes, and encode dynamic modules. module: overrides are literal values; empty and dot segments raise.
  • Stream claims are linearizable. Replacement handover no longer blocks on a keep-alive process dying, and released generations cannot be escalated later. Refused keyed claims return plain HTTP 503 before SSE starts.
  • Both dispatchers thread the fetched conn and reject malformed/non-object signals with HTTP 400, oversized signals with 413 before invoking handlers.
  • Closed SSE writes use StarView.SSE.TransportError and halt dispatch normally; :econnreset and :epipe also end normally through the shared disconnect predicate. Other transport failures and application exceptions still propagate.
  • Formatting failures retain their original exception type rather than becoming transport errors. SSE values cannot inject CR/LF event fields or frames, and CR-only HTML/JSON patches retain the Datastar field prefix on every line.
  • Script closing-tag escaping preserves message case and validates attribute names so attribute strings cannot break out of the generated tag.
  • CSRF renaming reads DELETE's Datastar query signals, preserves existing body tokens, and prevents query _csrf_token from suppressing a valid signal token. Unfetched raw bodies remain readable when query tokens are copied to the CSRF header, and explicit existing CSRF headers retain precedence.
  • Component patches supply HEEx change tracking without changing conn assigns.
  • Installer updates replace whole function definitions and keep generated auth functions/attributes at module level.
  • Dispatch and CSRF setup run independently of sample generation, so mix star_view.install --no-example still configures Phoenix events.
  • Updated the dependency lock to current compatible releases.

URL, stream ownership, and CSRF improvements adapt concepts from dstar (MIT).

v0.3.18

Added

  • Added mix star_view.setup.auth, which generates StarView-powered AshAuthentication magic-link pages: an AuthController sign-in page at /auth/sign-in and an Auth.MagicSignIn landing page at /magic_link/:token.
  • The auth setup task replaces existing AshAuthentication sign_in_route / magic_sign_in_route calls with the generated pages and adds sign_out_route AuthController when the router uses AshAuthentication.Phoenix.Router.
  • Added Layout.auth/1 to the generated StarView layout — a full-height layout variant for auth screens. Existing layouts without it are patched by the auth setup task.
  • Added a Phoenix auth guide covering the generated pages, router changes, and the required AshAuthentication code interfaces.

Changed

  • The generated StarView root layout now accepts :theme, :html_class, and :body_class attrs (data-theme on <html> plus class pass-through), and the placeholder headings were removed from the layout template.
  • Updated README and guide installation examples for v0.3.18.

Fixed

v0.3.17

Changed

  • Changed the generated StarView layout so Layout.app/1 renders the document wrapper and disables Phoenix's controller root layout.
  • Updated README and guide installation examples for v0.3.17.

Fixed

v0.3.16

Added

  • Added generated Web.Components.StarView.Layout modules for Phoenix projects.
  • Added a Phoenix layout guide covering Layout.app/1 and the StarView root layout.
  • Added the SVG icon asset to the package.

Changed

  • Updated the generated :star_view web-module section to alias the generated layout and set it as the controller root layout.
  • Updated the generated search controller to render through Layout.app/1.
  • Updated README and guide installation examples for v0.3.16.

v0.3.15

Changed

  • Changed mix star_view.trust to use mkcert for browser-trusted development certificates instead of trusting Phoenix's generated self-signed leaf certificate directly.
  • Changed the Igniter installer to print the mix star_view.trust --host ... command and mkcert install instructions instead of queueing mix phx.gen.cert.
  • Updated README and guide installation examples for v0.3.15.

v0.3.14

Fixed

  • Stopped queueing mix star_view.trust from the Igniter installer because Igniter child tasks do not reliably receive interactive stdin. The installer now prints the direct command to run after installation.

Changed

  • Updated README and guide installation examples for v0.3.14.

v0.3.13

Fixed

  • Fixed the mix star_view.trust confirmation prompt so the [Y/n] options appear on the active input line.
  • Accepted confirmation answers case-insensitively and made sudo execution more explicit in the task output.

Changed

  • Updated README and guide installation examples for v0.3.13.

v0.3.12

Added

  • Added mix star_view.trust, an optional setup task that can add the generated development host to /etc/hosts and trust the self-signed HTTPS certificate.

Fixed

  • Fixed generated development hostnames to use DNS-safe hyphens instead of underscores.

Changed

  • mix igniter.install star_view now queues the optional trust setup after certificate generation and documents that the step requires sudo privileges.
  • Updated README and guide installation examples for v0.3.12.

v0.3.11

Fixed

  • Fixed mix igniter.install star_view so the generated star_view web-module section is inserted as a top-level sibling after controller, not inside the controller function body.

Changed

  • Updated README and guide installation examples for v0.3.11.

v0.3.10

Fixed

  • Restored README and generated docs logo references to the PNG logo asset.

Changed

  • Updated README and guide installation examples for v0.3.10.

v0.3.9

Fixed

  • Changed the generated Phoenix dispatch route to use StarView.Dispatch with alias: false, avoiding the noisy Elixir.StarView.Dispatch form while still preventing Phoenix scope aliasing from resolving the plug as <AppWeb>.StarView.Dispatch.

Changed

  • Updated README and guide installation examples for v0.3.9.
  • Switched the README and generated docs logo reference to the SVG asset.

v0.3.8

Changed

  • Reworked HexDocs guides into a Phoenix-style sidebar with Introduction, Phoenix, Core Concepts, Comparison, Reference, and Release Notes sections.

v0.3.7

Changed

  • mix igniter.install star_view now inserts the generated star_view web module section immediately after the existing controller section when possible.
  • Cleaned up README, guide, and module docs so setup examples consistently describe StarView, :star_view, mix dev, and the current router setup.
  • Removed the duplicate legacy StarView.StarView behaviour module from the public API surface.

v0.3.6

Fixed

  • Fixed generated Phoenix routes so they do not get double-prefixed inside aliased router scopes.
  • Updated the post-install certificate instruction to include the generated .test hostname, avoiding browser TLS errors with Phoenix's default localhost-only dev certificate.
  • mix igniter.install star_view now automatically queues mix phx.gen.cert <otp_app>.test localhost when HTTPS setup is enabled.

v0.3.5

Fixed

  • Fixed the generated search controller to use use MyAppWeb, :star_view instead of the old :starview section name.

Changed

  • mix igniter.install star_view now adds a dedicated star_view section to the Phoenix web module instead of patching the existing controller section.
  • The generated Phoenix endpoint URL now includes the HTTPS dev port (https://<otp_app>.test:4001) so mix star_view.server opens the actual listening endpoint.
  • Renamed the development server task to mix star_view.server and added mix dev as a shortcut.

v0.3.4

Fixed

  • Fixed mix igniter.install star_view with the default Phoenix example enabled by rendering the generated search controller template with the expected EEx bindings.
  • Fixed the generated search controller template so it no longer nests a defmodule inside the module generated by Igniter.

v0.3.3

Added

  • Added mix star_view.dev, a convenience task that starts mix phx.server with browser opening enabled. Use --no-open to start the server without opening the browser.

Changed

  • mix igniter.install star_view now configures the Phoenix endpoint URL for dev as https://<otp_app>.test, so Phoenix's browser-open flow lands on the expected local app host.
  • Updated the StarView installer notice and README quick-start instructions to point users at mix star_view.dev.

v0.3.2

Changed

  • Improved the guide documentation.

v0.3.1

Changed

  • StarView.mount/2 signature is (conn, params) — conn first argument to work with Phoenix's default action dispatch (get "/", SearchController).
  • Only handle_event/3 is optional — mount/2 and render/1 are now required callbacks on StarView.
  • SearchController demo template extracted to priv/templates/search_controller.ex.eex for easier maintenance. The generated controller now demonstrates smart change detection with maybe_patch_list/2 and data-text for client-side signal display.

Added

  • guides/comparison/liveview_vs_star_view.md — side-by-side comparison of StarView vs LiveView using the same active search example, including transport trade-offs (SSE vs WebSocket) and event payload differences (JSON vs forms).

v0.3.0

Changed

  • Breaking: Renamed StarView callbacks for clarity and consistency with LiveView:
    • show/2 → mount/2 (sets up initial signals and assigns)
    • html/1 → render/1 (renders the HEEx template)
    • handle_event/3 argument order changed from (conn, event, signals) to (event, signals, conn) to match the Phoenix LiveView convention

v0.2.1

Changed

  • Improved the Search demo example.

v0.2.0

Changed

  • mix igniter.install star_view delegates to composable setup subtasks instead of duplicating logic, removing ~270 lines of duplicated code.

v0.1.2

Fixed

  • mix igniter.install star_view now correctly detects Phoenix projects and applies all patches (web module, HTTPS config, routes, demo controller).

Changed

  • Installer split into composable setup subtasks (star_view.setup.streaming, star_view.setup.datastar, star_view.setup.web_module, star_view.setup.search_controller) for better modularity and independent invocation.

Early development notes

Added

Changed