## AirForm 0.3.0: Zero-config CSRF protection

Every form rendered by AirForm now includes a signed CSRF token as a hidden field. Validation checks it automatically when the form was rendered, skips it for programmatic use. No configuration, no extra fields on your model, no middleware.

```sh
uv add AirForm --upgrade
```

### What's new

- **CSRF protection is automatic.** `render()` embeds an HMAC-signed token. `validate()` after `render()` checks it through Pydantic's own validation machinery. Missing or tampered tokens produce standard Pydantic validation errors in `form.errors`. Direct `validate()` calls without `render()` skip CSRF entirely, so tests and programmatic use are unaffected.

- **ValidCsrfToken Pydantic type.** CSRF validation uses a custom Pydantic type with `__get_pydantic_core_schema__`, not pre-processing or stripping. AirForm creates a wrapper model at class definition time that inherits from your model and adds the CSRF field. Your model stays clean, `form.data` returns your original type.

- **`from_request()` enforces CSRF.** Browser submissions always go through CSRF validation, since they come from rendered forms that include the token.

- **Zero-config secret.** A per-process secret is auto-generated on import. For multi-worker production deployments, set the `AIRFORM_SECRET` environment variable so all workers share the same key.

- **CsrfToken metadata type** lives in [AirField](https://github.com/feldroy/AirField) (0.5.0+), following the pattern where AirField defines the vocabulary and rendering packages provide the automation.

### Contributors

[@audreyfeldroy](https://github.com/audreyfeldroy) (Audrey M. Roy Greenfeld) designed and built this release, extending Daniel Roy Greenfeld's form validation pattern with Pydantic-native CSRF protection.
