@c9up/station 0.1.6 → 0.1.8

package/dist/StationProvider.js

@@ -17,15 +17,31 @@
  * the catch — real bugs in route registration surface instead of being
  * swallowed.
  */
+import { fileURLToPath } from "node:url";
 import { ResourceRegistry } from "./ResourceRegistry.js";
 import { setStation } from "./services/main.js";
 // note: AuditEvent + ResourceAction are used by the CRUD handlers below;
 // the imports stay in one block for clarity.
-import { renderNotFoundPage } from "./views/errors/404.js";
-import { renderFormPage } from "./views/form.js";
-import { renderListPage } from "./views/list.js";
-import { renderLoginPage } from "./views/login.js";
-import { renderShowPage } from "./views/show.js";
+import { buildFormViewModel } from "./views/form.js";
+import { buildListViewModel } from "./views/list.js";
+import { buildLoginViewModel } from "./views/login.js";
+import { buildShowViewModel } from "./views/show.js";
+/**
+ * Runtime shape check for the resolved `"inker"` binding. `container.has("inker")`
+ * only proves the token is registered — a null/partial/mis-registered value would
+ * otherwise slip through `#resolveViewRenderer` and blow up as a raw `TypeError`
+ * at `renderer.mount(...)` during boot, defeating the actionable fail-loud gate
+ * (57.1 review). Guarding here turns a null/non-conforming binding into the same
+ * clear "not usable" boot error, with the specific reason chained as `cause`.
+ */
+function isInkerViewRenderer(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "mount" in value &&
+        typeof value.mount === "function" &&
+        "renderToString" in value &&
+        typeof value.renderToString === "function");
+}
 const MAX_PER_PAGE = 100;
 const DEFAULT_PER_PAGE = 25;
 const POSITIVE_INT_RE = /^[1-9][0-9]*$/;
@@ -34,15 +50,34 @@ let authWarnEmitted = false;
 let perPageClampWarned = false;
 let seedPermsWarned = false;
 let missingAuditWarned = false;
-let csrfWarnEmitted = false;
+let csrfBlockedWarned = false;
 /** @internal Reset module-level flags between tests. */
 export function resetStationProviderFlags() {
     authWarnEmitted = false;
     perPageClampWarned = false;
     seedPermsWarned = false;
     missingAuditWarned = false;
-    csrfWarnEmitted = false;
+    csrfBlockedWarned = false;
+}
+/**
+ * Stable fingerprint for a failed `station::errors/404` render, used to log each
+ * distinct failure MODE once per provider instance rather than once per request.
+ * Keys on the error `code`/`name` ONLY — never the message, which can embed the
+ * request-controlled `id` and would let attacker traffic inflate the log past
+ * the very bound this mechanism exists to hold.
+ */
+function notFoundFailFingerprint(cause) {
+    if (!(cause instanceof Error))
+        return "non-error";
+    if ("code" in cause && typeof cause.code === "string")
+        return cause.code;
+    return cause.name;
 }
+/**
+ * Hard cap on distinct 404-render failure modes logged per instance, so an
+ * unforeseen unbounded error-code space still cannot inflate the log or memory.
+ */
+const NOT_FOUND_RENDER_FAIL_CAP = 32;
 const TIMESTAMP_PROPERTY_KEYS = new Set([
     "createdAt",
     "updatedAt",
@@ -54,28 +89,57 @@ const TIMESTAMP_COLUMN_NAMES = new Set([
     "deleted_at",
 ]);
 /**
- * Mass-assignment guard. Only accepts keys that are:
- *   1. A declared `@Column` propertyKey on the resource entity, AND
- *   2. Not the primary key (DB-managed), AND
- *   3. Not a framework-managed timestamp. Two signals, both honoured:
- *      (a) the Lucid-style auto flag — `@column.dateTime({ autoCreate })` /
- *          `{ autoUpdate }` (passed in via `autoManaged`); this is the
- *          authoritative one and catches custom-named timestamp columns
- *          (e.g. `registeredAt`) the name list below would miss, AND
- *      (b) the conventional name fallback (created_at / updated_at /
- *          deleted_at) for plain `@Column` timestamps declared without the
- *          auto flag.
+ * Column `type` strings mapped to a numeric rune rule (mirrors form.ts input
+ * inference). `bigint` is deliberately EXCLUDED: coercing it through `Number()`
+ * silently loses precision above `Number.MAX_SAFE_INTEGER`, so a bigint column
+ * validates as a string (its exact submitted digits reach atlas intact).
+ */
+const NUMBER_COLUMN_TYPES = new Set(["integer", "number"]);
+/**
+ * Structural column `type` strings — validated with `rules.any()` so a JSON/XHR
+ * client can submit an object/array (a `rules.string()` would reject it, a
+ * regression vs. the pre-57.7 pass-through `filterWritableBody`).
+ */
+const JSON_COLUMN_TYPES = new Set(["json", "jsonb"]);
+/**
+ * True when at least one resource mounts a write action that maps a request
+ * body onto columns (create / edit). `destroy` needs no body validation. This
+ * is the AC7 predicate: it decides whether `@c9up/rune` is REQUIRED at boot —
+ * exported so `agnostic-peers-missing.test.ts` can pin the decision directly
+ * (the dynamic-import-absent path can't be simulated inside vitest, exactly as
+ * for atlas — see that file's header).
+ */
+export function resourcesNeedValidation(resources) {
+    return resources.some((r) => r.actions.includes("create") || r.actions.includes("edit"));
+}
+/**
+ * Derive a `@c9up/rune` validation schema (57.7) from an entity's writable
+ * column metadata — the structural replacement for the hand-rolled
+ * `filterWritableBody`. The mass-assignment guarantee is now INHERENT:
+ * `schema.validateResult()` returns only declared-column keys, so unknown body keys
+ * (`role`, `passwordHash`, PK, timestamps) are dropped automatically — no
+ * explicit filtering pass.
+ *
+ * Excluded, exactly as the old guard did: the primary key, framework-managed
+ * timestamps (both the Lucid-style `autoManaged` flag AND the `created_at /
+ * updated_at / deleted_at` name convention) — plus, new in 57.7, relations and
+ * the soft-delete column (`excludedProps`). Metadata is read column-by-column,
+ * NEVER `in` on an instance (`@Column() declare` makes `in` always false —
+ * mirror `BaseRepository.#hydrate`).
  *
- * The `_method` synthetic field from browser-form method-overrides is
- * dropped automatically because it never matches a column propertyKey.
+ * Per-column rule mapping tolerates the form-post wire shape (values arrive as
+ * strings — rune does NOT coerce): booleans `.parse(isCheckedValue)`, numbers
+ * `.parse` string→Number (NaN falls through to a type error), everything else
+ * `rules.string()`. `.parse`/`.optional`/`.nullable` force rune's TS path, so
+ * no native `.node` is touched.
  *
- * Returning a fresh object — never the caller's reference — so a
- * downstream mutation can't poison the audit snapshot.
+ * Returns the built schema plus the set of boolean columns — the handler
+ * default-fills an ABSENT boolean key to `false` before validating (an
+ * unchecked checkbox submits nothing; this preserves the old edit-clears-box
+ * behaviour).
  */
-/** @internal Exported for unit tests — the mass-assignment + checkbox coercion guard. */
-export function filterWritableBody(body, columns, pkColumn, autoManaged) {
-    const writable = {};
-    const validKeys = new Set();
+export function deriveWritableSchema(columns, pkColumn, autoManaged, excludedProps, rune) {
+    const fields = {};
     const booleanKeys = new Set();
     for (const c of columns) {
         if (c.propertyKey === pkColumn)
@@ -87,29 +151,192 @@ export function filterWritableBody(body, columns, pkColumn, autoManaged) {
         const snake = c.propertyKey.replace(/([A-Z])/g, "_$1").toLowerCase();
         if (TIMESTAMP_COLUMN_NAMES.has(snake))
             continue;
-        validKeys.add(c.propertyKey);
-        if ((c.type ?? "").toString().toLowerCase() === "boolean") {
+        if (excludedProps.has(c.propertyKey))
+            continue;
+        const type = (c.type ?? "").toString().toLowerCase();
+        if (type === "boolean") {
+            // Checkbox: the handler pre-fills an absent key to `false`, so every
+            // boolean is always present here → required, no `.optional()`.
             booleanKeys.add(c.propertyKey);
+            fields[c.propertyKey] = rune.rules.boolean().parse(isCheckedValue);
+            continue;
+        }
+        // A column is required iff the model declares neither nullability nor a
+        // default. DB-side defaults (serial, `DEFAULT`) are invisible to metadata
+        // (documented residual limitation — see story Dev Notes); the PK, the
+        // common serial case, is already excluded above.
+        const required = c.nullable !== true && c.default === undefined;
+        let chain = NUMBER_COLUMN_TYPES.has(type)
+            ? rune.rules.number().parse(parseNumeric)
+            : JSON_COLUMN_TYPES.has(type)
+                ? rune.rules.any()
+                : rune.rules.string();
+        if (!required) {
+            chain = chain.optional();
+            if (c.nullable === true)
+                chain = chain.nullable();
         }
+        fields[c.propertyKey] = chain;
     }
-    // Boolean columns render as checkboxes: an unchecked box submits NOTHING, so
-    // derive every boolean from presence/value. Otherwise an unchecked box can
-    // never clear a previously-true column on edit, and a checked box would store
-    // the raw string "1" instead of a real boolean.
+    return { schema: rune.schema(fields), booleanKeys };
+}
+/**
+ * Validate a request body against a derived schema (57.7). Default-fills any
+ * ABSENT boolean column to `false` first (unchecked checkbox = no submission),
+ * preserving the old `filterWritableBody` checkbox semantics, then runs rune's
+ * synchronous, never-throwing `validateResult()`. On success `result.data` holds only
+ * declared-column keys (mass-assignment inherent). Exported for the unit tests
+ * that pin the coercion CRUX.
+ */
+export function validateWritableBody(schema, booleanKeys, body) {
+    const input = { ...body };
     for (const key of booleanKeys) {
-        writable[key] = isCheckedValue(body[key]);
+        if (!(key in input))
+            input[key] = false;
+    }
+    return schema.validateResult(input);
+}
+/**
+ * Form-post number coercion: string→Number, NaN falls through to a type error.
+ * `null`/`undefined` pass through untouched so rune's optional/nullable handling
+ * applies (never `Number(null) === 0`), and a blank/whitespace-only string —
+ * a cleared optional field — becomes `null` (treated as absent) rather than a
+ * fabricated `0`.
+ */
+function parseNumeric(value) {
+    if (value === null || value === undefined)
+        return value;
+    if (typeof value === "string") {
+        const trimmed = value.trim();
+        if (trimmed === "")
+            return null;
+        const n = Number(trimmed);
+        return Number.isNaN(n) ? value : n;
     }
-    for (const [key, value] of Object.entries(body)) {
-        if (!validKeys.has(key))
+    const n = Number(value);
+    return Number.isNaN(n) ? value : n;
+}
+/**
+ * Collapse rune's flat `ValidationError[]` to one message per top-level field
+ * for the HTML form re-render (`form.inker` keys errors by column propertyKey).
+ * The `_root` non-object error (a body that isn't a record — never happens for
+ * a parsed form post) is skipped.
+ */
+function fieldErrors(errors) {
+    const out = {};
+    for (const e of errors) {
+        if (e.field === "_root")
             continue;
-        if (booleanKeys.has(key))
-            continue; // already derived above
-        writable[key] = value;
+        // Collapse a nested VineJS-style path (`profile.name`) to its top-level
+        // key — `form.ts` keys errors by column propertyKey. `split` always yields
+        // a non-empty array, so `[0]` is a string (no fallback needed).
+        const key = e.field.split(".")[0];
+        if (!(key in out))
+            out[key] = e.message;
     }
-    return writable;
+    return out;
 }
-/** A checkbox/boolean field is true only for its checked submissions. */
+/** Session flash key under which the per-field validation errors are stashed (AdonisJS `flashMessages.errors` parity). */
+const FLASH_ERRORS_KEY = "errors";
+/** Column propertyKeys whose values are secrets — never flashed to the session nor echoed back into HTML (AdonisJS parity). */
+const SENSITIVE_KEY_RE = /password|passwd|secret|token|apikey/i;
+/**
+ * The subset of a submitted body safe to re-surface on a validation error:
+ * declared columns only — so `_csrf`, `_method`, and any mass-assignment /
+ * arbitrary key are dropped from the flash store — minus sensitive fields (a
+ * password is never written to the session nor reflected into the re-rendered
+ * form). An empty result lets the caller fall back to the existing `row`.
+ */
+function flashableInput(submitted, columns) {
+    const out = {};
+    for (const c of columns) {
+        if (SENSITIVE_KEY_RE.test(c.propertyKey))
+            continue;
+        if (c.propertyKey in submitted)
+            out[c.propertyKey] = submitted[c.propertyKey];
+    }
+    return out;
+}
+function isStringRecord(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    return Object.values(value).every((v) => typeof v === "string");
+}
+/**
+ * Read flashed old input + per-field errors for a form `GET` re-render after a
+ * failed write redirected back (57.7, AdonisJS PRG). Returns `{}` when nothing
+ * was flashed (a normal GET) — the form then renders from `row`/empty as usual.
+ * `values` is restricted to declared column keys so the flashed `errors` bag (or
+ * any other flashed key) never leaks into a field value.
+ */
+function readFlash(ctx, columns) {
+    const flashed = ctx.session?.flashMessages.all() ?? {};
+    if (Object.keys(flashed).length === 0)
+        return {};
+    const values = {};
+    for (const c of columns) {
+        // `errors` is reserved for the per-field error bag — a column literally
+        // named `errors` must not receive that object as its field value.
+        if (c.propertyKey === FLASH_ERRORS_KEY)
+            continue;
+        if (c.propertyKey in flashed)
+            values[c.propertyKey] = flashed[c.propertyKey];
+    }
+    const rawErrors = flashed[FLASH_ERRORS_KEY];
+    return {
+        values: Object.keys(values).length > 0 ? values : undefined,
+        errors: isStringRecord(rawErrors) ? rawErrors : undefined,
+    };
+}
+/**
+ * Same-origin / relative check for a `Referer` — replicates ream's
+ * `RedirectBuilder.back()` open-redirect guard (Station consumes the response
+ * through its own `redirect(url)` seam and can't reach ream's builder). A
+ * relative path is trusted; an absolute URL only when its origin matches the
+ * request URL. Anything else is untrusted → the caller uses its safe fallback.
+ */
+function isSameOriginReferer(referer, requestUrl) {
+    // A relative path is trusted only when it starts with a single "/" and
+    // contains no backslash: browsers normalise "\\" to "/", so "/\\evil.com"
+    // becomes the protocol-relative "//evil.com" that a lone `!startsWith("//")`
+    // check would let through.
+    if (referer.startsWith("/") &&
+        !referer.startsWith("//") &&
+        !referer.includes("\\")) {
+        return true;
+    }
+    if (requestUrl === undefined)
+        return false;
+    try {
+        return new URL(referer).origin === new URL(requestUrl).origin;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * `redirect().back()` over Station's `redirect(url)` seam (57.7): prefer a
+ * trusted same-origin `Referer`, else the caller's `fallback` (the form URL) —
+ * the same behaviour as ream's `RedirectBuilder.back(fallback)`, open-redirect
+ * safe.
+ */
+function redirectBack(ctx, fallback) {
+    const referer = ctx.request.header?.("referer");
+    const target = typeof referer === "string" &&
+        isSameOriginReferer(referer, ctx.request.url?.())
+        ? referer
+        : fallback;
+    ctx.response.redirect(target);
+}
+/**
+ * A checkbox/boolean field is true only for its checked submissions. Duplicate
+ * keys (a hidden `0` companion + the checkbox `1`) arrive as an array — the box
+ * is checked if ANY submitted value is a checked token (the checkbox wins).
+ */
 function isCheckedValue(value) {
+    if (Array.isArray(value))
+        return value.some(isCheckedValue);
     return value === true || value === "1" || value === "on" || value === "true";
 }
 /**
@@ -154,9 +381,24 @@ function snapshotEntity(entity, columns) {
     }
 }
 let auditCloneWarnEmitted = false;
+/**
+ * Filesystem path to the `.inker` templates Station ships inside the
+ * package (57.1, D3). Resolved from `import.meta.url` so the SAME path
+ * holds src-run (dev, `exports` → `./src/StationProvider.ts`) and dist-run
+ * (published, `./dist/StationProvider.js`) — `templates/` is a sibling of
+ * both `src/` and `dist/`. `fileURLToPath` (not `URL.pathname`) so a repo
+ * path containing spaces or reserved characters decodes correctly.
+ */
+const TEMPLATES_ROOT = fileURLToPath(new URL("../templates/", import.meta.url));
 export default class StationProvider {
     app;
     #contexts = new Map();
+    #viewRenderer;
+    /**
+     * Distinct 404-render failure modes already logged (fingerprints), scoped
+     * per instance so one provider's fault never suppresses another's.
+     */
+    #notFoundRenderFailCauses = new Set();
     #started = false;
     // 54.7 auth state — populated when warden is wired AND
     // StationConfig.requireAuth is true (default when warden is present).
@@ -181,12 +423,12 @@ export default class StationProvider {
     async boot() {
         // Force-resolve so `setStation` runs even if no preload touches the
         // singleton. Mirrors AuroraProvider.boot().
-        this.app.container.resolve(ResourceRegistry);
+        await this.app.container.resolve(ResourceRegistry);
     }
     async start() {
         if (this.#started)
             return;
-        const registry = this.app.container.resolve(ResourceRegistry);
+        const registry = await this.app.container.resolve(ResourceRegistry);
         const resources = registry.all();
         if (resources.length === 0)
             return;
@@ -200,24 +442,44 @@ export default class StationProvider {
         const peers = await this.#loadPeers();
         if (!peers)
             return;
-        const { router, atlas } = peers;
+        const { router, atlas, rune } = peers;
+        // 57.7 fail-closed: a write-capable admin (create/edit) validates + guards
+        // mass-assignment through a rune-derived schema. If atlas is present (CRUD
+        // is live) but `@c9up/rune` is NOT installed, refuse to boot rather than
+        // silently accept unvalidated bodies — there is NO fallback to the deleted
+        // key-filter (`feedback_security_first`). Read-only admins need no rune.
+        if (rune === null && resourcesNeedValidation(resources)) {
+            throw new Error("[station] @c9up/rune is required to validate admin write forms (create/edit) but is not installed. Add @c9up/rune (a Station peer dependency) — Station will NOT fall back to unvalidated mass-assignment. See https://ream.dev/modules/station#mass-assignment.");
+        }
+        // Phase 1a2 — resolve the SHARED inker renderer (AdonisJS/Edge parity)
+        // and mount Station's package templates as the `station` disk. Unlike
+        // warden (whose absence keeps the open dev-preview path), a view engine
+        // is a HARD render requirement (D2): once an admin surface exists there
+        // is no page without it. Fail LOUD at boot when @c9up/inker is not wired
+        // — mirrors #resolveDb's loud-on-missing posture — rather than degrade
+        // silently or 500 on the first request.
+        const renderer = await this.#resolveViewRenderer();
+        // Mount once: `station::<template>` now resolves to this package's
+        // templates/ dir on the host's single inker engine (edge.mount parity).
+        renderer.mount("station", TEMPLATES_ROOT);
+        this.#viewRenderer = renderer;
         // Phase 1b — wire the warden auth gate (or warn-once when it stays open).
-        this.#configureAuth(userConfig);
+        await this.#configureAuth(userConfig);
         // Phase 2 — build per-resource context ONCE. `#resolveDb()` is
         // loud: if the host installed `@c9up/atlas` but didn't register
         // `@c9up/atlas/provider` in `reamrc.ts`, AC11's "surface
         // AtlasProvider misconfiguration" intent kicks in.
-        const db = this.#resolveDb();
+        const db = await this.#resolveDb();
         for (const resource of resources) {
-            this.#contexts.set(resource, buildResourceContext(resource, db, atlas));
+            this.#contexts.set(resource, buildResourceContext(resource, db, atlas, rune));
         }
-        // 56.5 + 54.6 + CSRF boot-time warn-onces. We surface the "auth
-        // wired but no permissions seeded", "no audit sink", and "no CSRF
-        // check" gaps loud-and-once so a half-wired install can't ship to
-        // prod without operators noticing.
+        // 56.5 + 54.6 boot-time warn-onces. We surface the "auth wired but no
+        // permissions seeded" and "no audit sink" gaps loud-and-once so a
+        // half-wired install can't ship to prod without operators noticing.
+        // (CSRF is no longer a boot-time warn — enforcement is request-time and
+        // honest now: every write route fail-closes on `ctx.request.csrfProtected`.)
         this.#warnSeedPermissionsOnce(resources);
         this.#warnAuditGapsOnce(resources);
-        this.#warnCsrfGapOnce(resources);
         // Phase 3 — route registration. The router proxy may still throw
         // "Router accessed before initialization" on first property access
         // (boot ordering hazard where the proxy module imported but
@@ -248,10 +510,33 @@ export default class StationProvider {
     async #loadPeers() {
         if (!this.app.container.has("router"))
             return null;
-        const router = this.app.container.resolve("router");
+        const router = await this.app.container.resolve("router");
         try {
             const atlas = loadBearingCast(await import("@c9up/atlas"));
-            return { router, atlas };
+            // rune is loaded here but its ABSENCE is NOT a degraded-host signal the
+            // way atlas's is: atlas-missing ⇒ no CRUD at all (silent stop), whereas
+            // rune-missing while a write resource IS mounted is a fail-CLOSED
+            // misconfiguration (start() throws loud — see below). So `#loadRune`
+            // swallows only module-not-found → null; start() decides whether that
+            // null is fatal.
+            const rune = await this.#loadRune();
+            return { router, atlas, rune };
+        }
+        catch (err) {
+            if (isModuleNotFound(err))
+                return null;
+            throw err;
+        }
+    }
+    /**
+     * Tolerantly load `@c9up/rune` (57.7) — the SAME seam as `@c9up/atlas`
+     * (dynamic module import, module-not-found → null, real error re-thrown).
+     * Returning null does NOT degrade the host: the caller fails loud only when
+     * a write-capable resource actually needs the validator (AC7, fail-closed).
+     */
+    async #loadRune() {
+        try {
+            return loadBearingCast(await import("@c9up/rune"));
         }
         catch (err) {
             if (isModuleNotFound(err))
@@ -259,16 +544,117 @@ export default class StationProvider {
             throw err;
         }
     }
+    /**
+     * Resolve the host's shared inker renderer from the container (the `"inker"`
+     * alias `InkerProvider` binds) — the AdonisJS package-views pattern (57.1,
+     * D1/D2). A view engine is mandatory once an admin surface exists, so an
+     * unbound or not-yet-ready `"inker"` throws a clear, actionable error at
+     * boot (mirrors `#resolveDb`'s loud-on-missing), rather than a silent
+     * degrade or a runtime 500. Consumed via the container only — never a
+     * static or dynamic `import "@c9up/inker"` (D5), exactly like warden.
+     */
+    async #resolveViewRenderer() {
+        if (!this.app.container.has("inker")) {
+            throw new Error("[station] register @c9up/inker (InkerProvider) to render admin views");
+        }
+        try {
+            const resolved = await this.app.container.resolve("inker");
+            if (!isInkerViewRenderer(resolved)) {
+                throw new Error('the "inker" binding is not a usable view renderer (missing mount/renderToString)');
+            }
+            return resolved;
+        }
+        catch (cause) {
+            throw new Error("[station] @c9up/inker is registered but not usable — it must fully boot (InkerProvider + its rosetta/router peers) before Station, and resolve to a real view renderer. See `cause` for the specific reason.", { cause });
+        }
+    }
+    /**
+     * Render Station's 404 page through the shared inker renderer (57.1).
+     * Builds the same data the retired `renderNotFoundPage` composed and
+     * renders the `station::errors/404` template (the package's mounted disk);
+     * inker's `{{ }}` auto-escaping replaces the hand-rolled escaper for
+     * this view. `slug` is `encodeURIComponent`-safe (no HTML-special output)
+     * so its auto-escape is a no-op in the back-link `href`. The 404 uses no
+     * inker helpers, so a minimal render ctx is sufficient.
+     */
+    async #renderNotFound(ctx, resource, id) {
+        if (this.#viewRenderer === undefined) {
+            throw new Error("[station] view engine not initialised");
+        }
+        const renderCtx = {
+            request: ctx.request,
+            response: ctx.response,
+            store: new Map(),
+            locale: "en",
+        };
+        try {
+            return await this.#viewRenderer.renderToString(renderCtx, "station::errors/404", {
+                title: "Not Found",
+                id,
+                label: resource.label,
+                labelLower: resource.label.toLowerCase(),
+                slug: encodeURIComponent(resource.name),
+            });
+        }
+        catch (cause) {
+            // The error page itself failed to render (missing/faulty template,
+            // fs fault, parse error). A not-found must never escalate into a 500:
+            // fall back to a minimal, dependency-free static body. `id` is
+            // request-controlled, so it is HTML-escaped here. The fault is logged
+            // so a persistent deploy misconfig (unpublished templates/, corrupt
+            // station::layout) is not silently swallowed — but once per failure
+            // MODE per instance, not once per request: a durably-broken template
+            // on a 404-sprayed endpoint must not turn attacker traffic into
+            // unbounded log volume, while a genuinely new failure mode still
+            // surfaces its `cause`. The fingerprint keys on code/name only (never
+            // the request-controlled message) and is capped, so both stay bounded.
+            const fingerprint = notFoundFailFingerprint(cause);
+            if (this.#notFoundRenderFailCauses.size < NOT_FOUND_RENDER_FAIL_CAP &&
+                !this.#notFoundRenderFailCauses.has(fingerprint)) {
+                this.#notFoundRenderFailCauses.add(fingerprint);
+                console.error(`[station] failed to render station::errors/404 (${fingerprint}) — serving the minimal fallback page; repeats of this failure mode are suppressed this instance`, cause);
+            }
+            return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Not Found</title></head><body><h1>404 — Not Found</h1><p>No ${escapeMin(resource.label)} matches <code>${escapeMin(id)}</code>.</p></body></html>`;
+        }
+    }
+    /**
+     * Render a Station template through the shared inker renderer (57.2). Builds
+     * the same minimal render ctx as `#renderNotFound` (the list/show views use
+     * no inker helpers) and delegates escaping to inker's `{{ }}`. Used by the
+     * list + show handlers. Unlike the retired hand-rolled builders — pure
+     * `(input) => string` functions that could only throw on their own logic —
+     * this path can additionally fault on template lookup, fs, or parse errors.
+     * Such a fault propagates to the root error boundary as a 500, which is the
+     * correct outcome on the success path: a broken list/show template is a real
+     * server error and must not be masked as a degraded 200. (`#renderNotFound`
+     * wraps its render in a static fallback only because a not-found is already
+     * an error response that must never escalate into a 500.)
+     */
+    async #renderView(ctx, name, data) {
+        if (this.#viewRenderer === undefined) {
+            throw new Error("[station] view engine not initialised");
+        }
+        // Thread the real per-request store (57.3/D3) so the als-backed inker
+        // helpers — `csrfField()` on the form/login views — read the token. Inert
+        // for list/show, whose templates call no helpers.
+        const renderCtx = {
+            request: ctx.request,
+            response: ctx.response,
+            store: ctx.store ?? new Map(),
+            locale: "en",
+        };
+        return await this.#viewRenderer.renderToString(renderCtx, name, data);
+    }
     /**
      * Wire the warden auth gate from the `station` config block. When warden is
      * not installed/bound the gate stays open and a one-time warning is emitted.
      */
-    #configureAuth(userConfig) {
+    async #configureAuth(userConfig) {
         const wardenWanted = userConfig.requireAuth !== false;
         if (wardenWanted) {
             try {
                 this.#authManager =
-                    this.app.container.resolve("auth");
+                    await this.app.container.resolve("auth");
                 this.#authConfig = {
                     requireAuth: true,
                     requireRole: userConfig.requireRole,
@@ -355,20 +741,6 @@ export default class StationProvider {
         const example = resources[0];
         console.warn(`[station] Admin actions are gated behind '<resource>.<action>' permissions resolved through @c9up/warden (e.g. '${example.name}.list', '${example.name}.create'). Seed roles/grants in the Warden rights store (store.defineRole('admin', ['${example.name}.list', '${example.name}.create', ...]) then assignRole) or every admin request will 403. See https://ream.dev/modules/station#authorization.`);
     }
-    #warnCsrfGapOnce(resources) {
-        if (csrfWarnEmitted)
-            return;
-        const writeActions = [
-            "create",
-            "edit",
-            "destroy",
-        ];
-        const writeEnabled = resources.some((r) => r.actions.some((a) => writeActions.includes(a)));
-        if (!writeEnabled)
-            return;
-        csrfWarnEmitted = true;
-        console.warn("[station] Write-enabled resources are mounted but Station does NOT enforce CSRF at the handler level. Wire @c9up/blackhole (csrf: true) or an equivalent middleware in start/kernel.ts BEFORE production — a missing CSRF check on /admin/<resource>/:id POST allows cross-site form submission to mutate rows under any logged-in user's session.");
-    }
     #warnAuditGapsOnce(resources) {
         if (missingAuditWarned)
             return;
@@ -393,6 +765,78 @@ export default class StationProvider {
         }
         return ctx;
     }
+    /**
+     * The derived rune schema for a write handler (57.7). Present by construction
+     * — start() fail-closes at boot when a write action is mounted without
+     * `@c9up/rune` — so an undefined here is an internal invariant break; throw
+     * loud (fail-closed) rather than silently accept an unvalidated body.
+     */
+    #requireWritableSchema(resource) {
+        const { writableSchema } = this.#requireContext(resource);
+        if (writableSchema === undefined) {
+            throw new Error(`[station] No validation schema for ${resource.entity.name} — @c9up/rune must be installed to accept admin writes.`);
+        }
+        return writableSchema;
+    }
+    /**
+     * Fail-closed response for invalid write input (57.7, AC4). Content-negotiated:
+     *
+     *  - **JSON/XHR** → `422` with `{ error, code: "E_VALIDATION_ERROR", messages }`
+     *    (Adonis/Vine parity — API clients get the machine-readable errors).
+     *  - **HTML with a session** → the AdonisJS web idiom (PRG): flash the old
+     *    input + per-field errors, then `redirect().back()` to the form `GET`,
+     *    which re-reads the flash and re-renders with values + errors. No inline
+     *    body — the browser lands on a fresh form (no re-POST on refresh).
+     *  - **HTML without a session** → graceful fallback: re-render the form inline
+     *    at `422` so the errors are never silently lost when no `SessionMiddleware`
+     *    ran. (`row` supplies the id/action on EDIT; undefined keeps CREATE mode.)
+     *
+     * `redirect().back()` semantics are replicated over Station's `redirect(url)`
+     * seam ({@link redirectBack}) with the same same-origin guard ream's
+     * `RedirectBuilder.back()` uses — `formUrl` is the safe fallback.
+     */
+    async #denyValidation(ctx, resource, submitted, errors, formUrl, row) {
+        if (wantsJsonResponse(ctx)) {
+            ctx.response.status(422);
+            // AdonisJS/VineJS parity: `{ errors: [{ field, rule, message }] }` —
+            // the same shape ream's own `E_VALIDATION_ERROR` handler emits.
+            ctx.response.json({
+                errors: errors.map((e) => ({
+                    field: e.field,
+                    rule: e.rule,
+                    message: e.message,
+                })),
+            });
+            return;
+        }
+        // Echo only declared, non-sensitive columns back to the form — never
+        // `_csrf`, secrets, or mass-assignment keys (both the flash store and the
+        // re-rendered HTML). An empty result falls back to `row`.
+        const { columns, pkColumn } = this.#requireContext(resource);
+        const safe = flashableInput(submitted, columns);
+        if (ctx.session !== undefined) {
+            // AdonisJS PRG: flash old input + errors, redirect back to the form.
+            ctx.session.flashAll(safe);
+            ctx.session.flash(FLASH_ERRORS_KEY, fieldErrors(errors));
+            redirectBack(ctx, formUrl);
+            return;
+        }
+        // No session middleware — fall back to an inline 422 re-render so the
+        // submitted values + errors are still shown rather than silently dropped.
+        const vm = buildFormViewModel({
+            resource,
+            columns,
+            pkColumn,
+            row,
+            values: Object.keys(safe).length > 0 ? safe : undefined,
+            errors: fieldErrors(errors),
+            csrfEnabled: ctx.store?.get("csrfToken") != null,
+        });
+        ctx.response.status(422);
+        const html = await this.#renderView(ctx, "station::form", vm);
+        ctx.response.type("text/html; charset=utf-8");
+        ctx.response.send(html);
+    }
     #buildListHandler(resource) {
         return async (ctx) => {
             const { repo, columns, pkColumn } = this.#requireContext(resource);
@@ -412,29 +856,33 @@ export default class StationProvider {
                 perPageClampWarned = true;
                 console.warn(`[station] perPage clamped to ${MAX_PER_PAGE} (got ${perPageRaw}). Suppressing further warnings.`);
             }
-            const total = await repo.query().count();
-            const lastPage = Math.max(1, Math.ceil(total / perPage));
-            if (page > lastPage && total > 0) {
+            // De-hand-rolled (57.5): atlas `paginate()` runs the parallel
+            // COUNT(*) + LIMIT/OFFSET data fetch in one call and owns the
+            // `lastPage = ceil(total/perPage)` math Station used to duplicate.
+            // Station keeps only the `MAX_PER_PAGE` clamp (above) and the
+            // redirect-to-last-page wrapper — atlas floors perPage to ≥1 but
+            // does not cap it.
+            const result = await repo
+                .query()
+                .orderBy(pkColumn, "desc")
+                .paginate(page, perPage);
+            if (page > result.meta.lastPage && result.meta.total > 0) {
                 // Never render an empty page when one exists — redirect to the
                 // last real page so the user lands on something useful.
-                ctx.response.redirect(`/admin/${resource.name}?page=${lastPage}&perPage=${perPage}`);
+                ctx.response.redirect(`/admin/${resource.name}?page=${result.meta.lastPage}&perPage=${perPage}`);
                 return;
             }
-            const rows = await repo
-                .query()
-                .orderBy(pkColumn, "desc")
-                .forPage(page, perPage)
-                .exec();
-            const html = renderListPage({
+            const viewModel = buildListViewModel({
                 resource,
-                rows,
+                rows: result.all(),
                 columns,
                 pkColumn,
-                page,
-                perPage,
-                total,
-                lastPage,
+                page: result.meta.currentPage,
+                perPage: result.meta.perPage,
+                total: result.meta.total,
+                lastPage: result.meta.lastPage,
             });
+            const html = await this.#renderView(ctx, "station::list", viewModel);
             ctx.response.type("text/html; charset=utf-8");
             ctx.response.send(html);
         };
@@ -452,17 +900,19 @@ export default class StationProvider {
             const id = ctx.params.id ?? "";
             const row = await repo.find(id);
             if (row === null) {
+                const notFoundHtml = await this.#renderNotFound(ctx, resource, id);
                 ctx.response.status(404);
                 ctx.response.type("text/html; charset=utf-8");
-                ctx.response.send(renderNotFoundPage({ resource, id }));
+                ctx.response.send(notFoundHtml);
                 return;
             }
-            const html = renderShowPage({
+            const viewModel = buildShowViewModel({
                 resource,
                 row,
                 columns,
                 pkColumn,
             });
+            const html = await this.#renderView(ctx, "station::show", viewModel);
             ctx.response.type("text/html; charset=utf-8");
             ctx.response.send(html);
         };
@@ -474,32 +924,51 @@ export default class StationProvider {
                 deny(ctx);
                 return;
             }
-            const html = renderFormPage({
+            // 57.7 — after a failed create redirected back (PRG), the flash carries
+            // the old input + per-field errors; re-populate + surface them.
+            const { values, errors } = readFlash(ctx, columns);
+            const vm = buildFormViewModel({
                 resource,
                 columns,
                 pkColumn,
-                hiddenInputs: csrfHiddenInputs(ctx),
+                values,
+                errors,
+                csrfEnabled: ctx.store?.get("csrfToken") != null,
             });
+            const html = await this.#renderView(ctx, "station::form", vm);
             ctx.response.type("text/html; charset=utf-8");
             ctx.response.send(html);
         };
     }
     #buildCreateHandler(resource) {
         return async (ctx) => {
-            const { repo, pkColumn, columns, autoManaged } = this.#requireContext(resource);
+            // Fail-close: reject a request whose CSRF was not enforced+validated
+            // (blackhole unwired / csrf:false / route excepted) BEFORE any auth or
+            // DB work — no 404-vs-403 oracle to a forged request. A seeded token is
+            // not proof; only `csrfProtected === true` is (AC4/AC7).
+            if (ctx.request.csrfProtected !== true) {
+                denyCsrf(ctx);
+                return;
+            }
+            const { repo, pkColumn, columns, booleanKeys } = this.#requireContext(resource);
             if (!(await authorizeAction(resource, "create", ctx, this.#authManager))) {
                 deny(ctx);
                 return;
             }
             const body = await readBody(ctx);
-            // Mass-assignment guard: only `@Column`-declared properties make
-            // it through to repo.create(). An attacker who POSTs
-            // `{ role: "admin" }` or `{ passwordHash: "x" }` against a
-            // resource that doesn't declare those columns has the keys
-            // silently dropped here. PK + framework timestamps are always
-            // excluded — they're decided by the DB / hooks, not the caller.
-            const filtered = filterWritableBody(body, columns, pkColumn, autoManaged);
-            const created = await repo.create(filtered);
+            // 57.7 — validate + mass-assignment guard in one pass. `result.data`
+            // holds ONLY declared-column keys, so an attacker's `{ role: "admin" }`
+            // / `{ passwordHash: "x" }` / PK / timestamps are never present (dropped
+            // by the schema, not a separate filter), and each field is type-checked.
+            // Invalid input fail-closes with a 422 BEFORE any repository write (AC4).
+            const result = validateWritableBody(this.#requireWritableSchema(resource), booleanKeys, body);
+            if (!result.valid) {
+                // PRG fallback URL = the create form (AdonisJS `redirect().back()`).
+                const formUrl = `/admin/${encodeURIComponent(resource.name)}/new`;
+                await this.#denyValidation(ctx, resource, body, result.errors, formUrl);
+                return;
+            }
+            const created = await repo.create(result.data);
             await emitAudit(resource, {
                 action: "create",
                 resource: resource.name,
@@ -522,25 +991,38 @@ export default class StationProvider {
             const id = ctx.params.id ?? "";
             const row = await repo.find(id);
             if (row === null) {
+                const notFoundHtml = await this.#renderNotFound(ctx, resource, id);
                 ctx.response.status(404);
                 ctx.response.type("text/html; charset=utf-8");
-                ctx.response.send(renderNotFoundPage({ resource, id }));
+                ctx.response.send(notFoundHtml);
                 return;
             }
-            const html = renderFormPage({
+            // 57.7 — after a failed update redirected back (PRG), the flash carries
+            // the submitted values + errors; they win over the DB `row` so the user
+            // sees what they typed. A normal edit GET has no flash → fields from row.
+            const { values, errors } = readFlash(ctx, columns);
+            const vm = buildFormViewModel({
                 resource,
                 columns,
                 pkColumn,
                 row,
-                hiddenInputs: csrfHiddenInputs(ctx),
+                values,
+                errors,
+                csrfEnabled: ctx.store?.get("csrfToken") != null,
             });
+            const html = await this.#renderView(ctx, "station::form", vm);
             ctx.response.type("text/html; charset=utf-8");
             ctx.response.send(html);
         };
     }
     #buildUpdateHandler(resource) {
         return async (ctx) => {
-            const { repo, pkColumn, columns, autoManaged } = this.#requireContext(resource);
+            // Fail-close on CSRF before any auth/DB work (see #buildCreateHandler).
+            if (ctx.request.csrfProtected !== true) {
+                denyCsrf(ctx);
+                return;
+            }
+            const { repo, pkColumn, columns, booleanKeys } = this.#requireContext(resource);
             // Authorize before the existence check (no 404-vs-403 oracle).
             if (!(await authorizeAction(resource, "edit", ctx, this.#authManager))) {
                 deny(ctx);
@@ -549,24 +1031,32 @@ export default class StationProvider {
             const id = ctx.params.id ?? "";
             const entity = await repo.find(id);
             if (entity === null) {
+                const notFoundHtml = await this.#renderNotFound(ctx, resource, id);
                 ctx.response.status(404);
                 ctx.response.type("text/html; charset=utf-8");
-                ctx.response.send(renderNotFoundPage({ resource, id }));
+                ctx.response.send(notFoundHtml);
                 return;
             }
             const body = await readBody(ctx);
+            // 57.7 — validate BEFORE any snapshot or mutation (AC4). On failure the
+            // entity is untouched (no `setProp`, no `save`), so a bad edit never
+            // poisons the audit diff nor emits a success event; the form re-renders
+            // 422 with the submitted values + per-field errors (the existing entity
+            // still supplies the id/action).
+            const result = validateWritableBody(this.#requireWritableSchema(resource), booleanKeys, body);
+            if (!result.valid) {
+                // PRG fallback URL = this row's edit form (AdonisJS `redirect().back()`).
+                const formUrl = `/admin/${encodeURIComponent(resource.name)}/${encodeURIComponent(id)}/edit`;
+                await this.#denyValidation(ctx, resource, body, result.errors, formUrl, entity);
+                return;
+            }
             // Snapshot BEFORE the mutation runs so the audit diff is
             // meaningful (entity is a BaseEntity; its dirty-tracking
-            // would shadow the original values after setProp).
+            // would shadow the original values after setProp). `result.data`
+            // holds only declared, type-checked columns — the mass-assignment
+            // guarantee (PK / timestamps / unknown keys dropped) is inherent.
             const beforeSnapshot = snapshotEntity(entity, columns);
-            // Mass-assignment guard: filterWritableBody drops every key
-            // that isn't an `@Column`-declared property, plus the PK and
-            // any framework timestamps (created_at / updated_at /
-            // deleted_at). An attacker who POSTs `{ role: "admin" }` to
-            // a resource without that column has the field silently
-            // dropped instead of overwriting the entity.
-            const writable = filterWritableBody(body, columns, pkColumn, autoManaged);
-            for (const [key, value] of Object.entries(writable)) {
+            for (const [key, value] of Object.entries(result.data)) {
                 entity.setProp(key, value);
             }
             await repo.save(entity);
@@ -592,6 +1082,14 @@ export default class StationProvider {
         const updateHandler = this.#buildUpdateHandler(resource);
         const destroyHandler = this.#buildDestroyHandler(resource);
         return async (ctx) => {
+            // Fail-close on CSRF before reading the body (see #buildCreateHandler).
+            // The PUT/DELETE branches delegate to already-guarded handlers, but the
+            // unsupported-override 405 branch would otherwise do work on a forged
+            // request and leak a 403-vs-405 oracle — guard the entrypoint too.
+            if (ctx.request.csrfProtected !== true) {
+                denyCsrf(ctx);
+                return;
+            }
             const body = await readBody(ctx);
             const override = String(body._method ?? "").toUpperCase();
             if (override === "PUT" || override === "PATCH") {
@@ -609,6 +1107,11 @@ export default class StationProvider {
     }
     #buildDestroyHandler(resource) {
         return async (ctx) => {
+            // Fail-close on CSRF before any auth/DB work (see #buildCreateHandler).
+            if (ctx.request.csrfProtected !== true) {
+                denyCsrf(ctx);
+                return;
+            }
             const { repo, pkColumn, columns } = this.#requireContext(resource);
             // Authorize before the existence check (no 404-vs-403 oracle).
             if (!(await authorizeAction(resource, "destroy", ctx, this.#authManager))) {
@@ -618,9 +1121,10 @@ export default class StationProvider {
             const id = ctx.params.id ?? "";
             const row = await repo.find(id);
             if (row === null) {
+                const notFoundHtml = await this.#renderNotFound(ctx, resource, id);
                 ctx.response.status(404);
                 ctx.response.type("text/html; charset=utf-8");
-                ctx.response.send(renderNotFoundPage({ resource, id }));
+                ctx.response.send(notFoundHtml);
                 return;
             }
             const before = snapshotEntity(row, columns);
@@ -636,9 +1140,9 @@ export default class StationProvider {
             ctx.response.redirect(`/admin/${encodeURIComponent(resource.name)}`);
         };
     }
-    #resolveDb() {
+    async #resolveDb() {
         try {
-            return this.app.container.resolve("db");
+            return await this.app.container.resolve("db");
         }
         catch (cause) {
             throw new Error(`[station] No 'db' connection registered. Did you register @c9up/atlas/provider in reamrc.ts?`, { cause });
@@ -806,11 +1310,12 @@ export default class StationProvider {
             }
             const qs = ctx.request.qs();
             const errorParam = qs.error;
-            const html = renderLoginPage({
+            const vm = buildLoginViewModel({
                 action: this.#authConfig.loginPath,
                 error: typeof errorParam === "string" ? errorParam : undefined,
-                hiddenInputs: csrfHiddenInputs(ctx),
+                csrfEnabled: ctx.store?.get("csrfToken") != null,
             });
+            const html = await this.#renderView(ctx, "station::login", vm);
             ctx.response.type("text/html; charset=utf-8");
             ctx.response.send(html);
         };
@@ -823,6 +1328,13 @@ export default class StationProvider {
      */
     #buildLoginPostHandler() {
         return async (ctx) => {
+            // Fail-close on CSRF first — a forged login POST is refused before any
+            // AuthManager work (see #buildCreateHandler). Login is open by design
+            // (no auth gate), so CSRF is the sole pre-check here.
+            if (ctx.request.csrfProtected !== true) {
+                denyCsrf(ctx);
+                return;
+            }
             const manager = this.#authManager;
             if (manager === undefined) {
                 ctx.response.status(500);
@@ -834,12 +1346,13 @@ export default class StationProvider {
             const email = typeof body.email === "string" ? body.email.trim() : "";
             const password = typeof body.password === "string" ? body.password : "";
             if (email.length === 0 || password.length === 0) {
-                const html = renderLoginPage({
+                const vm = buildLoginViewModel({
                     action: this.#authConfig.loginPath,
                     email,
                     error: "Email and password are both required.",
-                    hiddenInputs: csrfHiddenInputs(ctx),
+                    csrfEnabled: ctx.store?.get("csrfToken") != null,
                 });
+                const html = await this.#renderView(ctx, "station::login", vm);
                 ctx.response.status(400);
                 ctx.response.type("text/html; charset=utf-8");
                 ctx.response.send(html);
@@ -851,12 +1364,13 @@ export default class StationProvider {
             // every valid login down the 401 branch.
             const token = typeof result.user?.token === "string" ? result.user.token : undefined;
             if (!result.authenticated || token === undefined) {
-                const html = renderLoginPage({
+                const vm = buildLoginViewModel({
                     action: this.#authConfig.loginPath,
                     email,
                     error: result.error ?? "Invalid email or password.",
-                    hiddenInputs: csrfHiddenInputs(ctx),
+                    csrfEnabled: ctx.store?.get("csrfToken") != null,
                 });
+                const html = await this.#renderView(ctx, "station::login", vm);
                 ctx.response.status(401);
                 ctx.response.type("text/html; charset=utf-8");
                 ctx.response.send(html);
@@ -878,6 +1392,12 @@ export default class StationProvider {
      */
     #buildLogoutHandler() {
         return async (ctx) => {
+            // Fail-close on CSRF: a forged cross-site POST must not be able to log
+            // an admin out (session-fixation nuisance) (see #buildCreateHandler).
+            if (ctx.request.csrfProtected !== true) {
+                denyCsrf(ctx);
+                return;
+            }
             ctx.response.clearCookie?.(this.#authConfig.cookieName, {
                 path: "/",
             });
@@ -895,7 +1415,7 @@ export default class StationProvider {
  * single helper rather than at every call site (mirrors AC9-style
  * single-load-bearing-site convention from 54.1).
  */
-function buildResourceContext(resource, db, atlas) {
+function buildResourceContext(resource, db, atlas, rune) {
     const entityCtor = loadBearingCast(resource.entity);
     const conn = loadBearingCast(db);
     const repo = loadBearingCast(new atlas.BaseRepository(entityCtor, conn));
@@ -912,7 +1432,24 @@ function buildResourceContext(resource, db, atlas) {
     const autoManaged = new Set(Object.entries(dateColumns)
         .filter(([, cfg]) => cfg.autoCreate === true || cfg.autoUpdate === true)
         .map(([prop]) => prop));
-    return { repo, columns, pkColumn, autoManaged };
+    // 57.7 — derive the writable validation schema from the SAME column metadata
+    // the old `filterWritableBody` read. `rune === null` here means no write
+    // action is mounted for this resource (start() already fail-closed the
+    // atlas-present-but-rune-absent write case), so the schema stays undefined.
+    const excludedProps = new Set(atlas.getRelationMetadata(resource.entity).map((r) => r.propertyKey));
+    if (atlas.hasSoftDeletes(resource.entity))
+        excludedProps.add("deletedAt");
+    const derived = rune === null
+        ? undefined
+        : deriveWritableSchema(columns, pkColumn, autoManaged, excludedProps, rune);
+    return {
+        repo,
+        columns,
+        pkColumn,
+        autoManaged,
+        writableSchema: derived?.schema,
+        booleanKeys: derived?.booleanKeys ?? new Set(),
+    };
 }
 /**
  * SANCTIONED CROSS-PACKAGE NARROWING — the ONE production site in
@@ -1030,6 +1567,32 @@ function deny(ctx) {
     ctx.response.type("text/html; charset=utf-8");
     ctx.response.send("<h1>403 Forbidden</h1><p>Your account does not have access to this resource action.</p>");
 }
+/**
+ * Fail-closed CSRF denial (403), mirroring {@link deny}'s content negotiation.
+ * Fires when a write reaches an admin handler without a CSRF-verified request
+ * (`ctx.request.csrfProtected !== true`). The FIRST block per process also emits
+ * one `console.error` — unlike the removed boot-time warning it can never
+ * false-alarm (it accompanies a real unprotected write attempt), pointing the
+ * operator at the actual misconfiguration (blackhole unwired / `csrf: false` /
+ * `/admin/*` excepted).
+ */
+function denyCsrf(ctx) {
+    if (!csrfBlockedWarned) {
+        csrfBlockedWarned = true;
+        console.error("[station] Blocked a write to /admin/* — CSRF was not enforced for this request. Check that @c9up/blackhole is wired (csrf: true) in start/kernel.ts, /admin/* is NOT in csrf.exceptRoutes, and the blackhole native addon has been rebuilt (a stale .node predates the csrfProtected signal and always reads undefined). Returning 403.");
+    }
+    ctx.response.status(403);
+    if (wantsJsonResponse(ctx)) {
+        ctx.response.json({
+            error: "Forbidden",
+            code: "CSRF_REQUIRED",
+            message: "This admin action requires an active, verified CSRF token.",
+        });
+        return;
+    }
+    ctx.response.type("text/html; charset=utf-8");
+    ctx.response.send("<h1>403 Forbidden</h1><p>This admin action requires an active, verified CSRF token.</p>");
+}
 /**
  * Memoise the parsed body per request (Adonis BodyParser semantics — the
  * body is parsed once and stays re-readable). `#buildMethodOverrideHandler`
@@ -1056,27 +1619,6 @@ async function parseBody(ctx) {
     const raw = await ctx.request.body();
     return isPlainRecord(raw) ? raw : {};
 }
-/**
- * Read the CSRF token (when present) from `ctx.store` and shape it as
- * a `hiddenInputs[]` entry for `renderFormPage`. The key `csrfToken`
- * matches the @c9up/blackhole `csrfToken` convention so a fully-
- * wired host stamps the token automatically; a host that doesn't wire
- * CSRF returns no hidden input, and the form is unprotected (the
- * boot-time warn-once already flagged this).
- *
- * The form field is named `_csrf` to match Adonis / Blackhole's
- * default. Hosts using a different field name can override by writing
- * their own hiddenInputs into ctx.store under a richer key, but for
- * the common case this is the zero-config path.
- */
-function csrfHiddenInputs(ctx) {
-    if (ctx.store === undefined)
-        return undefined;
-    const token = ctx.store.get("csrfToken");
-    if (typeof token !== "string" || token.length === 0)
-        return undefined;
-    return [{ name: "_csrf", value: token }];
-}
 function redirectToShow(ctx, resource, id) {
     const slug = encodeURIComponent(resource.name);
     const safeId = encodeURIComponent(String(id ?? ""));
@@ -1129,16 +1671,19 @@ async function emitAudit(resource, event) {
     }
 }
 /**
- * Tiny HTML-escape for the 405 error body — duplicated here rather
- * than imported from views/escape.ts to keep the dependency surface
- * of StationProvider minimal (views are otherwise only reached via
- * the renderer modules).
+ * Tiny HTML-escape for the 404 / 405 error bodies — a self-contained
+ * local helper. Station keeps no shared TS escaper (inker's `{{ }}`
+ * owns view escaping); this covers the error bodies that are sent as
+ * `text/html` without going through the inker renderer. Escapes the
+ * same five characters as inker so the two escaping paths stay in
+ * parity (`&` first to avoid double-encoding).
  */
 function escapeMin(value) {
     return value
         .replace(/&/g, "&amp;")
         .replace(/</g, "&lt;")
         .replace(/>/g, "&gt;")
-        .replace(/"/g, "&quot;");
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
 }
 //# sourceMappingURL=StationProvider.js.map