diff --git a/.github/workflows/polish-the-code.yml b/.github/workflows/polish-the-code.yml
index 5fd7646..1cb8ccd 100644
--- a/.github/workflows/polish-the-code.yml
+++ b/.github/workflows/polish-the-code.yml
@@ -33,11 +33,12 @@ jobs:
     # Limit the running time
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # checkout PR HEAD commit
           ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0 # required for merge-base check
+          # required for merge-base check
+          fetch-depth: 0
           persist-credentials: false
       - uses: commit-check/commit-check-action@v2
         env:
@@ -54,7 +55,7 @@ jobs:
 
   # Note: https://docs.github.com/en/actions/using-workflows/reusing-workflows The strategy property is not supported in any job that calls a reusable workflow.
   php-composer-unit-stan:
-    uses: WorkOfStan/seablast-actions/.github/workflows/php-composer-dependencies-reusable.yml@v0.2.9
+    uses: WorkOfStan/seablast-actions/.github/workflows/php-composer-dependencies-reusable.yml@v0.2.11
     with:
       # JSON
       php-version: '["7.2", "7.3", "7.4", "8.0", "8.1", "8.2", "8.3", "8.4", "8.5"]'
@@ -95,11 +96,11 @@ jobs:
 
   super-linter:
     needs: phpcs-phpcbf
-    uses: WorkOfStan/seablast-actions/.github/workflows/linter.yml@v0.2.9
+    uses: WorkOfStan/seablast-actions/.github/workflows/linter.yml@v0.2.11
     with:
       # exclude third-party code
       filter-regex-exclude: ".*/assets/uls/.*"
       runs-on: "ubuntu-latest"
-      # todo fix fix assets/seablast.css and then allow again CSS validation
+      # todo fix assets/seablast.css and then allow again CSS validation
       validate-css: false
       validate-spell-codespell: true
diff --git a/.gitignore b/.gitignore
index a4c1419..1bc0af0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,13 +3,12 @@
 !/cache/.htaccess
 /log/*
 !/log/.htaccess
+/.composer-cache
+/.*.cache
 /.sass-cache/
-/.php_cs.cache
-/.php-cs-fixer.cache
-/.phpunit.result.cache
 
 #disable private local files
-*.local.php
+*.local.*
 
 #disable composer-managed libraries
 /vendor/
diff --git a/.htaccess b/.htaccess
index 7b52125..45492bc 100644
--- a/.htaccess
+++ b/.htaccess
@@ -9,6 +9,8 @@ RewriteRule ^src(/|$) - [R=404,L]
 RedirectMatch 404 \/tests\/
 RedirectMatch 404 \/views\/
 # hide these files
+RedirectMatch 404 (^|/)composer\.(json|lock)$
+RedirectMatch 404 (^|/)\.phpunit\.result\.cache$
 RedirectMatch 404 phpstan\.neon\.dist
 RedirectMatch 404 phpunit\.xml
 # hide files with these extensions
@@ -17,4 +19,5 @@ RedirectMatch 404 \.neon$
 RedirectMatch 404 \.sh$
 RedirectMatch 404 \.yml$
 # hide all the files in any directory that have no filename but only an extension (like .prettierignore)
-RedirectMatch 404 /(\.[^.]+)$
+# hide all dotfiles in any directory, including multi-dot files like .phpunit.result.cache
+RedirectMatch 404 (^|/)\.[^/]+$
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..e020966
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,375 @@
+# AGENTS.md
+
+This file is the maintainer and integration guide for `seablast/seablast`.
+It is written for two audiences:
+
+- maintainers changing the framework itself
+- applications that build on top of Seablast and need to understand its real runtime contract
+
+This document describes the current behavior of the codebase, including important caveats that are not obvious from the marketing-level `README.md` alone.
+
+## What Seablast Is
+
+Seablast is a composer-installed minimalist MVC runtime for PHP applications.
+The core runtime is small and centered around four classes:
+
+1. `SeablastSetup`
+2. `SeablastController`
+3. `SeablastModel`
+4. `SeablastView`
+
+Applications extend the framework mostly by:
+
+- providing configuration closures in `conf/app.conf.php` and `conf/app.conf.local.php`
+- registering routes in `SeablastConstant::APP_MAPPING`
+- implementing models that return `stdClass`
+- overriding or inheriting Latte templates
+
+Optional integrations include:
+
+- `seablast/auth`
+- `seablast/i18n`
+
+## Bootstrap and Request Lifecycle
+
+The runtime flow is:
+
+1. `defineAppDir.php` defines `APP_DIR`.
+   If the library is executed from `vendor/seablast/seablast`, `APP_DIR` resolves to the application root.
+2. `index.php` loads `APP_DIR . '/vendor/autoload.php'`, enables Tracy, and creates `SeablastSetup`.
+3. `SeablastSetup` builds a single `SeablastConfiguration` instance by loading configuration closures in precedence order.
+4. `SeablastController` applies environment configuration, derives runtime values, starts the session, resolves the route, and enforces authentication/authorization.
+5. `SeablastModel` instantiates the mapped application model, calls `knowledge()`, and always injects a CSRF token into the returned parameters.
+6. `SeablastView` renders JSON, HTML, or redirect output and then exposes Tracy SQL and HTTP panels.
+
+When maintaining the framework, preserve this order. Session setup, Tracy wiring, runtime-derived configuration, and route resolution are coupled.
+
+## Configuration Layering
+
+`SeablastSetup` currently loads configuration files in this order, from lowest to highest priority:
+
+1. `conf/default.conf.php`
+2. `APP_DIR/vendor/seablast/auth/conf/app.conf.php`
+3. `APP_DIR/vendor/seablast/i18n/conf/app.conf.php`
+4. `APP_DIR/conf/app.conf.php`
+5. `APP_DIR/conf/app.conf.local.php`
+
+Each file must return a callable that accepts `SeablastConfiguration`.
+
+This means application config can override:
+
+- framework defaults
+- auth defaults
+- i18n defaults
+- environment-local overrides
+
+If you change this order, you are changing a public integration contract.
+
+## Runtime Values Added by Core
+
+The controller populates several values at runtime that applications may read later:
+
+- `SeablastConstant::SB_APP_ROOT_ABSOLUTE_URL`
+- `SeablastConstant::SB_GET_ARGUMENT_ID`
+- `SeablastConstant::SB_GET_ARGUMENT_CODE`
+- `SeablastConstant::ERROR_HTTP_CODE`
+- `SeablastConstant::ERROR_MESSAGE`
+- `SeablastConstant::USER_ID`
+- `SeablastConstant::USER_ROLE_ID`
+- `SeablastConstant::USER_GROUPS`
+- `SeablastConstant::FLAG_USER_IS_AUTHENTICATED`
+
+Applications should treat these as framework-owned runtime state, not as values to preseed manually.
+
+## Route Contract
+
+Routes live in `SeablastConstant::APP_MAPPING` and are matched by exact path after:
+
+- removing the application base path from `REQUEST_URI`
+- trimming a trailing slash
+- defaulting an empty path to `/`
+
+The framework currently consumes these mapping keys:
+
+- `model`: fully qualified class name of the model
+- `template`: Latte template name without `.latte`
+- `roleIds`: comma-separated allow-list of numeric role IDs
+- `id`: required GET parameter name, stored as `SB_GET_ARGUMENT_ID`
+- `code`: required GET parameter name, validated and stored as `SB_GET_ARGUMENT_CODE`
+
+Notes:
+
+- Missing routes are converted to `/error`, not to a generic JSON error route.
+- A route with `roleIds` requires a configured identity manager.
+- `code` is intentionally restricted and rejects control characters, quotes, backslashes, semicolons, and SQL comment markers.
+
+If you add new mapping keys in core, document them in `README.md`, this file, and tests.
+
+## Model Contract for Applications
+
+Application models are expected to implement the same contract as `SeablastModelInterface`:
+
+- constructor signature: `__construct(SeablastConfiguration $configuration, Superglobals $superglobals)`
+- method: `knowledge(): stdClass`
+
+`SeablastModel` instantiates the mapped class directly and then calls `knowledge()`.
+
+Special properties in the returned `stdClass`:
+
+- `rest`: when present, Seablast renders JSON instead of HTML
+- `httpCode`: optional HTTP status code
+- `redirectionUrl`: when present, Seablast sends a redirect and renders `redirection.latte`
+- `title`: used by `BlueprintWeb.latte` as page title
+
+The framework also always adds:
+
+- `csrfToken`
+
+Important consequences:
+
+- A model must return `stdClass`, not an array.
+- JSON responses can return `rest` as either an object or an array.
+- Redirect codes are limited to `301`, `302`, `303`, `307`, and `308`.
+- For non-REST HTML responses with `httpCode >= 400`, `SeablastView` forces the `error` template.
+
+## Generic JSON API Contract
+
+`GenericRestApiJsonModel` is the base implementation for JSON endpoints.
+
+Current behavior:
+
+- requires `REQUEST_METHOD` in `Superglobals->server`
+- for real HTTP input, requires JSON `Content-Type` before reading the body
+- rejects real or injected JSON input over 1 MiB before decoding
+- reads JSON from `php://input`, or from `SeablastConstant::JSON_INPUT` when injected for tests
+- accepts only a decoded JSON object
+- requires `csrfToken`
+- validates the token against the `sb_json` token ID
+
+Default error behavior:
+
+- `400` for invalid JSON or wrong payload shape
+- `401` for missing or invalid CSRF token
+- `413` for JSON request bodies over 1 MiB
+- `415` for missing or non-JSON `Content-Type`
+
+Applications extending this class should call `parent::knowledge()` first and stop when it already returns `httpCode >= 400`.
+
+## View and Template Contract
+
+`SeablastView` injects one more template variable before rendering:
+
+- `configuration`
+
+Bundled template lookup behavior:
+
+- first try `../../../<LATTE_TEMPLATE>/<template>.latte`
+- otherwise use `<LATTE_TEMPLATE>/<template>.latte` from the bundled library
+
+In the standard vendor layout, the first path resolves to the application template directory. If you change bootstrap location or current working directory assumptions, re-check template inheritance carefully.
+
+With the default `LATTE_TEMPLATE = 'views'`, applications override bundled templates by placing files in:
+
+- `APP_DIR/views/*.latte`
+
+### BlueprintWeb Expectations
+
+The bundled `views/BlueprintWeb.latte` assumes these are available:
+
+- `$csrfToken`
+- `$configuration`
+- `SeablastConstant::SB_APP_ROOT_ABSOLUTE_URL`
+- `SeablastConstant::SB_WEB_FORCE_ASSET_VERSION`
+
+Important: `SB_WEB_FORCE_ASSET_VERSION` is not set by `conf/default.conf.php`, but the bundled layout reads it unconditionally. Applications that use `BlueprintWeb.latte` should define it explicitly.
+
+The layout also:
+
+- loads jQuery
+- loads `assets/scripts/seablast-bridge.js`
+- optionally includes Seablast I18n ULS assets when the i18n flag is active
+
+### Template CDN Security
+
+External scripts loaded from CDN must use Subresource Integrity (SRI) and
+`crossorigin="anonymous"`.
+
+SRI hashes are tied to the exact URL and response bytes that the browser loads,
+not only to the library name and version. For example, the official jQuery SRI
+snippet for `https://code.jquery.com/jquery-3.7.1.min.js` does not match the
+Google CDN URL currently used by `BlueprintWeb.latte`:
+
+- `https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js`
+
+If a CDN URL changes, recompute the SRI hash for the new URL from the raw
+downloaded bytes. Do not compute it from decoded text, because even subtle byte
+differences make the browser reject the script.
+
+## Authentication and Authorization
+
+If `SeablastConstant::SB_IDENTITY_MANAGER` is configured, the controller instantiates the class with:
+
+- `new $identityManager($configuration->mysqli())`
+
+The class is expected to match `seablast/interfaces` behavior.
+
+The controller also supports optional integration methods when they exist:
+
+- `setTablePrefix()`
+- `setCookiePath()`
+
+If the identity says the user is authenticated, core writes user data into configuration and injects the user ID into DB adapters for query logging.
+
+Route protection behavior:
+
+- no authentication and protected route: use `APP_MAPPING_401` when configured, otherwise render a `401` error page
+- authenticated but wrong role: render a `403` error page
+
+## Database Contract
+
+Database credentials are read from:
+
+- `APP_DIR/conf/phinx.local.php`
+
+The effective environment is:
+
+- `SeablastConstant::SB_PHINX_ENVIRONMENT` when set
+- otherwise `environments.default_environment` from the Phinx config
+
+`SeablastConfiguration` exposes two lazy adapters:
+
+- `mysqli()`
+- `pdo()`
+
+Useful behavior to preserve:
+
+- both adapters log write-like queries
+- both adapters collect statements for Tracy bar panels
+- `setUser()` propagates the current user to both adapters
+- `dbmsTablePrefix()` lazily initializes a preferred connection when needed
+
+Deprecated compatibility methods still present:
+
+- `dbms()`
+- `dbmsStatus()`
+
+Maintain backward compatibility unless you intentionally ship a breaking change.
+
+## Admin Contract
+
+Bundled default routes:
+
+- `/poseidon`
+- `/api/poseidon`
+
+Admin permissions are split into:
+
+- table visibility: `ADMIN_TABLE_VIEW`
+- editable columns: `ADMIN_TABLE_EDIT`
+- insert permission: `ADMIN_TABLE_INSERT_ROW`
+- delete permission: `ADMIN_TABLE_DELETE_ROW`
+
+Applications configure them by appending the role suffix constant, for example:
+
+- `SeablastConstant::ADMIN_TABLE_VIEW . SeablastConstant::USER_ROLE_EDITOR`
+
+### Current Admin Behavior
+
+The bundled admin currently supports:
+
+- table listing
+- column-level view/edit permissions
+- filtering
+- ordering
+- inline cell updates through `/api/poseidon`
+
+Filtering and ordering details:
+
+- selected table comes from GET parameter `t`
+- filters are passed as repeated `condition[]` values in the format `columnIndex|value`
+- ordering is passed as `order=a0,d2`
+- result limit is hardcoded to `50`
+
+Inline update details:
+
+- GET parameters: `t`, `key`, `id`
+- JSON body must contain `csrfToken` and `val`
+
+### Important Admin Caveats
+
+These are part of the current reality and should be documented for app integrators:
+
+- `AdminHelper` hardcodes role inheritance for role `1` as admin and role `2` as editor. The role constants exist in config, but the current helper logic still assumes those numeric values.
+- Insert/delete permission flags are exposed, but the bundled admin UI/API is still focused on view/edit and does not yet implement a full insert/delete workflow.
+- The bundled admin menu contains opinionated links such as `/user-pages` and `/user/?logout`; applications may need to override the admin template or model if those routes do not exist.
+- Some bundled admin and error UI strings are still Czech.
+
+## Under Construction Mode
+
+If `FLAG_WEB_RUNNING` is not active, the controller serves `under-construction.html` and exits.
+
+Bypass rules:
+
+- localhost (`::1`, `127.0.0.1`)
+- IPs listed in `DEBUG_IP_LIST`
+
+The application may override the static file by placing:
+
+- `APP_DIR/under-construction.html`
+
+## Debugging and Logging
+
+Tracy is enabled in development mode for:
+
+- localhost
+- IPs listed in `DEBUG_IP_LIST`
+
+`FLAG_DEBUG_JSON` intentionally suppresses the JSON `Content-Type` header so Tracy can render debug output more comfortably. This is a local debugging aid and should not be enabled in normal production traffic.
+
+SQL bar panels are rendered after output selection so that database diagnostics survive normal page, JSON, and redirect flows.
+
+## Current Realities and Non-Goals
+
+These points are worth keeping in mind when maintaining or integrating Seablast:
+
+- The controller currently performs direct path matching. Friendly URL database resolution and redirector logic are still marked as `TODO` in code.
+- Route misses currently fall back to `/error`, which means missing API routes are not automatically rendered as JSON.
+- The bundled templates are functional defaults, not a complete design system.
+- `README.md` contains the broad usage story, but this file should remain the source of truth for framework internals and hidden contracts.
+
+## Change Checklist for Maintainers
+
+When changing core behavior, verify all affected layers together:
+
+- bootstrap: `defineAppDir.php`, `index.php`, session timing, Tracy setup
+- configuration: new constants, defaults, override order, runtime-populated values
+- routing: `APP_MAPPING`, auth flow, error flow, GET parameter extraction
+- model/view contract: `stdClass`, `csrfToken`, `rest`, `httpCode`, redirects
+- templates/assets: override rules, required config keys, asset versioning
+- database: lazy init, table prefix, query logging, Tracy panels
+- admin: role inheritance, table permissions, filtering, inline edit behavior
+- docs/tests: `README.md`, `CHANGELOG.md`, this file, PHPUnit expectations
+
+## Testing and Local Development
+
+Useful local commands:
+
+- PHPUnit: run the repository test suite with your usual PHP/PHPUnit entry point
+- PHPStan on Windows: `& "C:\Program Files\Git\bin\bash.exe" -lc "./blast.sh phpstan"`
+
+Important test assumptions:
+
+- tests expect `conf/phinx.local.php`
+- tests commonly switch `SB_PHINX_ENVIRONMENT` to `testing`
+- some bundled templates assume app-level config such as `SB_WEB_FORCE_ASSET_VERSION`
+
+## Documentation Policy
+
+If a change affects framework behavior that applications depend on, update all of these together:
+
+- `README.md` for public usage guidance
+- `CHANGELOG.md` for release notes
+- `AGENTS.md` for maintainer and integration detail
+- tests where the behavior is asserted
+
+That keeps Seablast honest for both maintainers and downstream applications.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4d85106..49c238f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### `Security` in case of vulnerabilities
 
+## [0.2.17.5] - 2026-06-28
+
+feat: expose string[] SeablastConstant::ADMIN_BOOLEAN_FIELDS
+
+### Added
+
+- expose string[] SeablastConstant::ADMIN_BOOLEAN_FIELDS
+
+### Changed
+
+- Introduce AGENTS.md and CLAUDE.md DRY combination
+- TableViewModel.php: change limit from 200 to 250 records to be listed in admin view
+- bump: Seablast Logger to v2.0.6
+
+### Fixed
+
+- Fix PHPStan type inference for the bounded JSON API input read length.
+- Validate admin boolean-like columns against stored values before exposing boolean metadata.
+- Expose only true boolean-like admin column names to the table view model.
+
+### Security
+
+- Harden JSON API input handling with content-type and body-size checks before decoding, and hide Composer/root dot metadata through Apache rules.
+- Harden CDN script loading with SRI and document that hashes are tied to exact CDN response bytes.
+
 ## [0.2.17.4] - 2026-05-03
 
 feat: allow up to 200 records listed in admin view
@@ -520,7 +545,8 @@ SeablastMysqli error logging improved, HTTPS identified
 - **model returns knowledge()**
 - a nice Under construction page
 
-[Unreleased]: https://github.com/WorkOfStan/seablast/compare/v0.2.17.4...HEAD?w=1
+[Unreleased]: https://github.com/WorkOfStan/seablast/compare/v0.2.17.5...HEAD?w=1
+[0.2.17.5]: https://github.com/WorkOfStan/seablast/compare/v0.2.17.4...v0.2.17.5?w=1
 [0.2.17.4]: https://github.com/WorkOfStan/seablast/compare/v0.2.17.3...v0.2.17.4?w=1
 [0.2.17.3]: https://github.com/WorkOfStan/seablast/compare/v0.2.17.2...v0.2.17.3?w=1
 [0.2.17.2]: https://github.com/WorkOfStan/seablast/compare/v0.2.17.1...v0.2.17.2?w=1
diff --git a/CLAUDE.md b/CLAUDE.md
index b1d8d63..af0c7ea 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,355 +1,8 @@
 # CLAUDE.md
 
-This file is the maintainer and integration guide for `seablast/seablast`.
-It is written for two audiences:
+@AGENTS.md
 
-- maintainers changing the framework itself
-- applications that build on top of Seablast and need to understand its real runtime contract
+## Claude Code
 
-This document describes the current behavior of the codebase, including important caveats that are not obvious from the marketing-level `README.md` alone.
-
-## What Seablast Is
-
-Seablast is a composer-installed minimalist MVC runtime for PHP applications.
-The core runtime is small and centered around four classes:
-
-1. `SeablastSetup`
-2. `SeablastController`
-3. `SeablastModel`
-4. `SeablastView`
-
-Applications extend the framework mostly by:
-
-- providing configuration closures in `conf/app.conf.php` and `conf/app.conf.local.php`
-- registering routes in `SeablastConstant::APP_MAPPING`
-- implementing models that return `stdClass`
-- overriding or inheriting Latte templates
-
-Optional integrations include:
-
-- `seablast/auth`
-- `seablast/i18n`
-
-## Bootstrap and Request Lifecycle
-
-The runtime flow is:
-
-1. `defineAppDir.php` defines `APP_DIR`.
-   If the library is executed from `vendor/seablast/seablast`, `APP_DIR` resolves to the application root.
-2. `index.php` loads `APP_DIR . '/vendor/autoload.php'`, enables Tracy, and creates `SeablastSetup`.
-3. `SeablastSetup` builds a single `SeablastConfiguration` instance by loading configuration closures in precedence order.
-4. `SeablastController` applies environment configuration, derives runtime values, starts the session, resolves the route, and enforces authentication/authorization.
-5. `SeablastModel` instantiates the mapped application model, calls `knowledge()`, and always injects a CSRF token into the returned parameters.
-6. `SeablastView` renders JSON, HTML, or redirect output and then exposes Tracy SQL and HTTP panels.
-
-When maintaining the framework, preserve this order. Session setup, Tracy wiring, runtime-derived configuration, and route resolution are coupled.
-
-## Configuration Layering
-
-`SeablastSetup` currently loads configuration files in this order, from lowest to highest priority:
-
-1. `conf/default.conf.php`
-2. `APP_DIR/vendor/seablast/auth/conf/app.conf.php`
-3. `APP_DIR/vendor/seablast/i18n/conf/app.conf.php`
-4. `APP_DIR/conf/app.conf.php`
-5. `APP_DIR/conf/app.conf.local.php`
-
-Each file must return a callable that accepts `SeablastConfiguration`.
-
-This means application config can override:
-
-- framework defaults
-- auth defaults
-- i18n defaults
-- environment-local overrides
-
-If you change this order, you are changing a public integration contract.
-
-## Runtime Values Added by Core
-
-The controller populates several values at runtime that applications may read later:
-
-- `SeablastConstant::SB_APP_ROOT_ABSOLUTE_URL`
-- `SeablastConstant::SB_GET_ARGUMENT_ID`
-- `SeablastConstant::SB_GET_ARGUMENT_CODE`
-- `SeablastConstant::ERROR_HTTP_CODE`
-- `SeablastConstant::ERROR_MESSAGE`
-- `SeablastConstant::USER_ID`
-- `SeablastConstant::USER_ROLE_ID`
-- `SeablastConstant::USER_GROUPS`
-- `SeablastConstant::FLAG_USER_IS_AUTHENTICATED`
-
-Applications should treat these as framework-owned runtime state, not as values to preseed manually.
-
-## Route Contract
-
-Routes live in `SeablastConstant::APP_MAPPING` and are matched by exact path after:
-
-- removing the application base path from `REQUEST_URI`
-- trimming a trailing slash
-- defaulting an empty path to `/`
-
-The framework currently consumes these mapping keys:
-
-- `model`: fully qualified class name of the model
-- `template`: Latte template name without `.latte`
-- `roleIds`: comma-separated allow-list of numeric role IDs
-- `id`: required GET parameter name, stored as `SB_GET_ARGUMENT_ID`
-- `code`: required GET parameter name, validated and stored as `SB_GET_ARGUMENT_CODE`
-
-Notes:
-
-- Missing routes are converted to `/error`, not to a generic JSON error route.
-- A route with `roleIds` requires a configured identity manager.
-- `code` is intentionally restricted and rejects control characters, quotes, backslashes, semicolons, and SQL comment markers.
-
-If you add new mapping keys in core, document them in `README.md`, this file, and tests.
-
-## Model Contract for Applications
-
-Application models are expected to implement the same contract as `SeablastModelInterface`:
-
-- constructor signature: `__construct(SeablastConfiguration $configuration, Superglobals $superglobals)`
-- method: `knowledge(): stdClass`
-
-`SeablastModel` instantiates the mapped class directly and then calls `knowledge()`.
-
-Special properties in the returned `stdClass`:
-
-- `rest`: when present, Seablast renders JSON instead of HTML
-- `httpCode`: optional HTTP status code
-- `redirectionUrl`: when present, Seablast sends a redirect and renders `redirection.latte`
-- `title`: used by `BlueprintWeb.latte` as page title
-
-The framework also always adds:
-
-- `csrfToken`
-
-Important consequences:
-
-- A model must return `stdClass`, not an array.
-- JSON responses can return `rest` as either an object or an array.
-- Redirect codes are limited to `301`, `302`, `303`, `307`, and `308`.
-- For non-REST HTML responses with `httpCode >= 400`, `SeablastView` forces the `error` template.
-
-## Generic JSON API Contract
-
-`GenericRestApiJsonModel` is the base implementation for JSON endpoints.
-
-Current behavior:
-
-- requires `REQUEST_METHOD` in `Superglobals->server`
-- reads JSON from `php://input`, or from `SeablastConstant::JSON_INPUT` when injected for tests
-- accepts only a decoded JSON object
-- requires `csrfToken`
-- validates the token against the `sb_json` token ID
-
-Default error behavior:
-
-- `400` for invalid JSON or wrong payload shape
-- `401` for missing or invalid CSRF token
-
-Applications extending this class should call `parent::knowledge()` first and stop when it already returns `httpCode >= 400`.
-
-## View and Template Contract
-
-`SeablastView` injects one more template variable before rendering:
-
-- `configuration`
-
-Bundled template lookup behavior:
-
-- first try `../../../<LATTE_TEMPLATE>/<template>.latte`
-- otherwise use `<LATTE_TEMPLATE>/<template>.latte` from the bundled library
-
-In the standard vendor layout, the first path resolves to the application template directory. If you change bootstrap location or current working directory assumptions, re-check template inheritance carefully.
-
-With the default `LATTE_TEMPLATE = 'views'`, applications override bundled templates by placing files in:
-
-- `APP_DIR/views/*.latte`
-
-### BlueprintWeb Expectations
-
-The bundled `views/BlueprintWeb.latte` assumes these are available:
-
-- `$csrfToken`
-- `$configuration`
-- `SeablastConstant::SB_APP_ROOT_ABSOLUTE_URL`
-- `SeablastConstant::SB_WEB_FORCE_ASSET_VERSION`
-
-Important: `SB_WEB_FORCE_ASSET_VERSION` is not set by `conf/default.conf.php`, but the bundled layout reads it unconditionally. Applications that use `BlueprintWeb.latte` should define it explicitly.
-
-The layout also:
-
-- loads jQuery
-- loads `assets/scripts/seablast-bridge.js`
-- optionally includes Seablast I18n ULS assets when the i18n flag is active
-
-## Authentication and Authorization
-
-If `SeablastConstant::SB_IDENTITY_MANAGER` is configured, the controller instantiates the class with:
-
-- `new $identityManager($configuration->mysqli())`
-
-The class is expected to match `seablast/interfaces` behavior.
-
-The controller also supports optional integration methods when they exist:
-
-- `setTablePrefix()`
-- `setCookiePath()`
-
-If the identity says the user is authenticated, core writes user data into configuration and injects the user ID into DB adapters for query logging.
-
-Route protection behavior:
-
-- no authentication and protected route: use `APP_MAPPING_401` when configured, otherwise render a `401` error page
-- authenticated but wrong role: render a `403` error page
-
-## Database Contract
-
-Database credentials are read from:
-
-- `APP_DIR/conf/phinx.local.php`
-
-The effective environment is:
-
-- `SeablastConstant::SB_PHINX_ENVIRONMENT` when set
-- otherwise `environments.default_environment` from the Phinx config
-
-`SeablastConfiguration` exposes two lazy adapters:
-
-- `mysqli()`
-- `pdo()`
-
-Useful behavior to preserve:
-
-- both adapters log write-like queries
-- both adapters collect statements for Tracy bar panels
-- `setUser()` propagates the current user to both adapters
-- `dbmsTablePrefix()` lazily initializes a preferred connection when needed
-
-Deprecated compatibility methods still present:
-
-- `dbms()`
-- `dbmsStatus()`
-
-Maintain backward compatibility unless you intentionally ship a breaking change.
-
-## Admin Contract
-
-Bundled default routes:
-
-- `/poseidon`
-- `/api/poseidon`
-
-Admin permissions are split into:
-
-- table visibility: `ADMIN_TABLE_VIEW`
-- editable columns: `ADMIN_TABLE_EDIT`
-- insert permission: `ADMIN_TABLE_INSERT_ROW`
-- delete permission: `ADMIN_TABLE_DELETE_ROW`
-
-Applications configure them by appending the role suffix constant, for example:
-
-- `SeablastConstant::ADMIN_TABLE_VIEW . SeablastConstant::USER_ROLE_EDITOR`
-
-### Current Admin Behavior
-
-The bundled admin currently supports:
-
-- table listing
-- column-level view/edit permissions
-- filtering
-- ordering
-- inline cell updates through `/api/poseidon`
-
-Filtering and ordering details:
-
-- selected table comes from GET parameter `t`
-- filters are passed as repeated `condition[]` values in the format `columnIndex|value`
-- ordering is passed as `order=a0,d2`
-- result limit is hardcoded to `50`
-
-Inline update details:
-
-- GET parameters: `t`, `key`, `id`
-- JSON body must contain `csrfToken` and `val`
-
-### Important Admin Caveats
-
-These are part of the current reality and should be documented for app integrators:
-
-- `AdminHelper` hardcodes role inheritance for role `1` as admin and role `2` as editor. The role constants exist in config, but the current helper logic still assumes those numeric values.
-- Insert/delete permission flags are exposed, but the bundled admin UI/API is still focused on view/edit and does not yet implement a full insert/delete workflow.
-- The bundled admin menu contains opinionated links such as `/user-pages` and `/user/?logout`; applications may need to override the admin template or model if those routes do not exist.
-- Some bundled admin and error UI strings are still Czech.
-
-## Under Construction Mode
-
-If `FLAG_WEB_RUNNING` is not active, the controller serves `under-construction.html` and exits.
-
-Bypass rules:
-
-- localhost (`::1`, `127.0.0.1`)
-- IPs listed in `DEBUG_IP_LIST`
-
-The application may override the static file by placing:
-
-- `APP_DIR/under-construction.html`
-
-## Debugging and Logging
-
-Tracy is enabled in development mode for:
-
-- localhost
-- IPs listed in `DEBUG_IP_LIST`
-
-`FLAG_DEBUG_JSON` intentionally suppresses the JSON `Content-Type` header so Tracy can render debug output more comfortably. This is a local debugging aid and should not be enabled in normal production traffic.
-
-SQL bar panels are rendered after output selection so that database diagnostics survive normal page, JSON, and redirect flows.
-
-## Current Realities and Non-Goals
-
-These points are worth keeping in mind when maintaining or integrating Seablast:
-
-- The controller currently performs direct path matching. Friendly URL database resolution and redirector logic are still marked as `TODO` in code.
-- Route misses currently fall back to `/error`, which means missing API routes are not automatically rendered as JSON.
-- The bundled templates are functional defaults, not a complete design system.
-- `README.md` contains the broad usage story, but this file should remain the source of truth for framework internals and hidden contracts.
-
-## Change Checklist for Maintainers
-
-When changing core behavior, verify all affected layers together:
-
-- bootstrap: `defineAppDir.php`, `index.php`, session timing, Tracy setup
-- configuration: new constants, defaults, override order, runtime-populated values
-- routing: `APP_MAPPING`, auth flow, error flow, GET parameter extraction
-- model/view contract: `stdClass`, `csrfToken`, `rest`, `httpCode`, redirects
-- templates/assets: override rules, required config keys, asset versioning
-- database: lazy init, table prefix, query logging, Tracy panels
-- admin: role inheritance, table permissions, filtering, inline edit behavior
-- docs/tests: `README.md`, `CHANGELOG.md`, this file, PHPUnit expectations
-
-## Testing and Local Development
-
-Useful local commands:
-
-- PHPUnit: run the repository test suite with your usual PHP/PHPUnit entry point
-- PHPStan on Windows: `& "C:\Program Files\Git\bin\bash.exe" -lc "./blast.sh phpstan"`
-
-Important test assumptions:
-
-- tests expect `conf/phinx.local.php`
-- tests commonly switch `SB_PHINX_ENVIRONMENT` to `testing`
-- some bundled templates assume app-level config such as `SB_WEB_FORCE_ASSET_VERSION`
-
-## Documentation Policy
-
-If a change affects framework behavior that applications depend on, update all of these together:
-
-- `README.md` for public usage guidance
-- `CHANGELOG.md` for release notes
-- `CLAUDE.md` for maintainer and integration detail
-- tests where the behavior is asserted
-
-That keeps Seablast honest for both maintainers and downstream applications.
+- Use plan mode before large refactors.
+- Prefer editing existing files over generating new abstractions unless justified.
diff --git a/README.md b/README.md
index e4de694..7f7b6bc 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,7 @@
 
 [![Total Downloads](https://img.shields.io/packagist/dt/seablast/seablast.svg)](https://packagist.org/packages/seablast/seablast)
 [![Latest Stable Version](https://img.shields.io/packagist/v/seablast/seablast.svg)](https://packagist.org/packages/seablast/seablast)
+[![Polish the code](https://github.com/WorkOfStan/seablast/actions/workflows/polish-the-code.yml/badge.svg)](https://github.com/WorkOfStan/seablast/actions/workflows/polish-the-code.yml)
 
 This minimalist MVC framework added by [composer](https://getcomposer.org/) helps you to create a complex, yet easy to maintain, web application by configuration ONLY:
 
@@ -263,6 +264,7 @@ This feature applies to all fields with the same name across all tables (field n
 ## Security
 
 All JSON calls and form submits MUST contain `csrfToken` handed over to the view layer in the `$csrfToken` string latte variable.
+JSON API calls using `GenericRestApiJsonModel` MUST send a JSON `Content-Type` header and stay within the default 1 MiB request body limit.
 
 ## Stack
 
diff --git a/composer.json b/composer.json
index ec8ca5e..72a9536 100644
--- a/composer.json
+++ b/composer.json
@@ -6,8 +6,8 @@
     "php": ">=7.2 <8.6",
     "latte/latte": ">=2.10.8 <3.1",
     "nette/utils": "^3.2.10 || ^4.0.5 || ^4.1.0",
-    "seablast/interfaces": "^0.1.1",
-    "seablast/logger": "^1.0 || ^2.0.3",
+    "seablast/interfaces": "^0.1.3",
+    "seablast/logger": "^2.0.6",
     "symfony/security-csrf": "^4.4.37 || ^5 || ^6 || ^7 || ^8",
     "tracy/tracy": "^2.9.8 || ^2.10.9 || ^2.11.0",
     "webmozart/assert": "^1.10.0 || ^2.1.5"
diff --git a/index.php b/index.php
index e0ce506..4b35cc3 100644
--- a/index.php
+++ b/index.php
@@ -34,10 +34,6 @@
 $superglobals->setSession($_SESSION); // as only now the session started
 try {
     new SeablastView(new SeablastModel($controller, $superglobals));
-//} catch (\Seablast\Seablast\Exceptions\DbmsException $e) {
-//                // make sure that the database Tracy BarPanel is displayed when DbmsException is thrown
-//                $this->controller->getConfiguration()->showSqlBarPanel();
-//                throw new Exceptions\DbmsException($e->getMessage(), $e->getCode(), $e);
 } catch (\PDOException $e) {
     // make sure that the database Tracy BarPanel with error is displayed when PDOException is thrown
     $setup->getConfiguration()->pdo()->indicateDatabaseError();
diff --git a/src/Admin/AdminHelper.php b/src/Admin/AdminHelper.php
index 13b95c3..a420a26 100644
--- a/src/Admin/AdminHelper.php
+++ b/src/Admin/AdminHelper.php
@@ -79,7 +79,7 @@ public function getAllowedTables(string $permission): array
                 $tables = array_merge($tables, $this->configuration->getArrayString($permission . $suffix));
             }
         }
-        if ($this->configuration->getInt(SeablastConstant::SB_LOGGING_LEVEL) >= 5) { // Log as severity DEBUG
+        if ($this->configuration->getInt(SeablastConstant::SB_LOGGING_LEVEL) >= 5) { // Dump when severity DEBUG
             Debugger::barDump($tables, 'List of tables with permission: ' . $permission);
         }
         return $tables;
diff --git a/src/Admin/AdminModel.php b/src/Admin/AdminModel.php
index eb74fe0..ef4caf0 100644
--- a/src/Admin/AdminModel.php
+++ b/src/Admin/AdminModel.php
@@ -9,6 +9,7 @@
 use Seablast\Seablast\SeablastModelInterface;
 use Seablast\Seablast\Superglobals;
 use stdClass;
+use Webmozart\Assert\Assert;
 
 /**
  * Retrieve items from database
@@ -59,7 +60,7 @@ public function knowledge(): stdClass
                 $insertable = false;
             } else {
                 $knowledge = (array) $this->tableContent->knowledge();
-                $table =  $knowledge['table'];
+                $table = $knowledge['table'];
                 $columns = $knowledge['columns'];
                 $editable = $knowledge['editable'];
                 $conditionDetails = $knowledge['conditionDetails'];
@@ -71,6 +72,10 @@ public function knowledge(): stdClass
                     $this->configuration->getString(SeablastConstant::APP_SELECTED_TABLE),
                     $this->adminHelper->getAllowedTables(SeablastConstant::ADMIN_TABLE_INSERT_ROW)
                 );
+                Assert::isArray($knowledge['booleanLike']);
+                Assert::allString($knowledge['booleanLike']);
+                // TableViewModel produces it, admin.latte consumes it
+                $this->configuration->setArrayString(SeablastConstant::ADMIN_BOOLEAN_FIELDS, $knowledge['booleanLike']);
             }
 
             return (object) [
diff --git a/src/Admin/TableViewModel.php b/src/Admin/TableViewModel.php
index c76a3fa..71a866b 100644
--- a/src/Admin/TableViewModel.php
+++ b/src/Admin/TableViewModel.php
@@ -68,9 +68,10 @@ private function splitStringByFirstPipe($string): ?array
         return array(substr($string, 0, $position), substr($string, $position + 1));
     }
 
-    /// compare to             $columnTypes = $this->adminHelper->columnTypes(
-    //                $this->configuration->getString(SeablastConstant::APP_SELECTED_TABLE)
-    //          );
+    private function escapeIdentifier(string $identifier): string
+    {
+        return '`' . str_replace('`', '``', $identifier) . '`';
+    }
 
     /**
      * Get boolean-like columns of a table.
@@ -93,6 +94,10 @@ private function booleanLikeColumns(string $tableName): array
         return $result;
     }
 
+    /// TODO compare to $columnTypes = $this->adminHelper->columnTypes(
+    //                $this->configuration->getString(SeablastConstant::APP_SELECTED_TABLE)
+    //          ); ... isn't there an opportunity for a DRY refactor?
+
     /**
      * Get information about table columns including their SQL type.
      *
@@ -118,16 +123,22 @@ private function columnTypes(string $tableName): array
 
         $result = $this->configuration->mysqli()->query($query);
         $columnTypes = [];
+        $booleanLikeColumnIndexes = [];
 
         if ($result && is_object($result)) {
             while ($row = $result->fetch_assoc()) {
                 $columnType = isset($row['COLUMN_TYPE']) ? strtolower((string) $row['COLUMN_TYPE']) : '';
                 $dataType = isset($row['DATA_TYPE']) ? strtolower((string) $row['DATA_TYPE']) : '';
-
-                $row['IS_BOOLEAN_LIKE'] = (
+                Assert::scalar($row['COLUMN_NAME']);
+                $columnName = (string) $row['COLUMN_NAME'];
+                $isBooleanLike = (
                     $columnType === 'tinyint(1)' || $columnType === 'tinyint(1) unsigned' || $columnType === 'bit(1)' //
                     || $dataType === 'boolean' || $dataType === 'bool'
-                    ) ? 1 : 0;
+                );
+                $row['IS_BOOLEAN_LIKE'] = $isBooleanLike ? 1 : 0;
+                if ($isBooleanLike) {
+                    $booleanLikeColumnIndexes[$columnName] = count($columnTypes);
+                }
 
                 $columnTypes[] = $row;
             }
@@ -135,6 +146,31 @@ private function columnTypes(string $tableName): array
             $result->free();
         }
 
+        if (!empty($booleanLikeColumnIndexes)) {
+            $checks = [];
+            foreach (array_keys($booleanLikeColumnIndexes) as $i => $columnName) {
+                $checks[] = 'COALESCE(MIN(' . $this->escapeIdentifier($columnName)
+                    . ' IS NULL OR ' . $this->escapeIdentifier($columnName)
+                    . ' IN (0,1)), 1) AS ' . $this->escapeIdentifier('b' . $i);
+            }
+
+            $booleanCheckResult = $this->configuration->mysqli()->query(
+                'SELECT ' . implode(', ', $checks)
+                . ' FROM ' . $this->escapeIdentifier($fullTableName)
+            );
+
+            if ($booleanCheckResult && is_object($booleanCheckResult)) {
+                $booleanCheckRow = $booleanCheckResult->fetch_assoc();
+                if (is_array($booleanCheckRow)) {
+                    foreach (array_keys($booleanLikeColumnIndexes) as $i => $columnName) {
+                        $columnTypes[$booleanLikeColumnIndexes[$columnName]]['IS_BOOLEAN_LIKE'] =
+                            !empty($booleanCheckRow['b' . $i]) ? 1 : 0;
+                    }
+                }
+                $booleanCheckResult->free();
+            }
+        }
+
         return $columnTypes;
     }
 
@@ -146,7 +182,7 @@ private function columnTypes(string $tableName): array
      */
     private function foreignKeys(string $tableName): array
     {
-        //Query to List Foreign Keys in a Specific Table
+        // Query to List Foreign Keys in a Specific Table
         $query = "SELECT 
     TABLE_NAME, 
     COLUMN_NAME, 
@@ -178,17 +214,27 @@ private function foreignKeys(string $tableName): array
     public function knowledge(): stdClass
     {
         $cols = $this->adminHelper->getAllowedColumns();
-        Debugger::barDump($cols, 'cols');
         $columns = array_merge($cols['view'] ?? [], $cols['edit'] ?? []);
-        Debugger::barDump($columns, 'columns');
 
         // dev
         $foreignKeys = $this->foreignKeys($this->configuration->getString(SeablastConstant::APP_SELECTED_TABLE));
-        Debugger::barDump($foreignKeys, 'foreignKeys');
-        Debugger::barDump(
-            $this->booleanLikeColumns($this->configuration->getString(SeablastConstant::APP_SELECTED_TABLE)),
-            'boolean like'
-        );
+        // Boolean like columns uses a checkbox in the admin.latte
+        $booleanLikeColumnNames = [];
+        foreach (
+            $this->booleanLikeColumns(
+                $this->configuration->getString(SeablastConstant::APP_SELECTED_TABLE)
+            ) as $columnName => $isBooleanLike
+        ) {
+            if ($isBooleanLike) {
+                $booleanLikeColumnNames[] = $columnName;
+            }
+        }
+        if ($this->configuration->getInt(SeablastConstant::SB_LOGGING_LEVEL) >= 4) { // Dump when severity INFO
+            Debugger::barDump($cols, 'cols');
+            Debugger::barDump($columns, 'columns');
+            Debugger::barDump($foreignKeys, 'foreignKeys'); // dev
+            Debugger::barDump($booleanLikeColumnNames, 'booleanLike');
+        }
         // Get order and conditions from GET parameters
         $order = isset($this->superglobals->get['order']) ? $this->superglobals->get['order'] : '';
         $conditions = [];
@@ -267,8 +313,8 @@ public function knowledge(): stdClass
             . 'FROM `' . $this->configuration->dbmsTablePrefix()
             . $this->configuration->getString(SeablastConstant::APP_SELECTED_TABLE) . '` '
             . $sql
-            // todo allow paging
-            . ' LIMIT 0,200'
+            // todo allow paging instead of hard limit
+            . ' LIMIT 0,250'
         );
         $data = [];
         // Fetch each row and add it to the $data array
@@ -283,6 +329,7 @@ public function knowledge(): stdClass
                 'columns' => $columns,
                 'editable' => $cols['edit'] ?? [],
                 'conditionDetails' => $conditionDetails,
+                'booleanLike' => $booleanLikeColumnNames,
                 // data
                 'table' => $data,
         ];
diff --git a/src/Apis/GenericRestApiJsonModel.php b/src/Apis/GenericRestApiJsonModel.php
index e0e8855..4753a31 100644
--- a/src/Apis/GenericRestApiJsonModel.php
+++ b/src/Apis/GenericRestApiJsonModel.php
@@ -23,6 +23,9 @@ class GenericRestApiJsonModel implements SeablastModelInterface
 {
     use \Nette\SmartObject;
 
+    /** @var int Maximum JSON request body size in bytes */
+    protected const JSON_INPUT_MAX_BYTES = 1048576;
+
     /** @ var array<mixed> Resulting knowledge. */
     //todo move to SBdist//private $businessLogicResult;
 
@@ -88,10 +91,21 @@ public function knowledge(): stdClass
      */
     private function processInput(): void
     {
+        $jsonInputInjected = $this->configuration->exists(SeablastConstant::JSON_INPUT);
+        if (!$jsonInputInjected) {
+            if ($this->contentLengthExceedsLimit()) {
+                $this->rejectInput(413, 'JSON input exceeds the maximum allowed size.');
+                return;
+            }
+            if (!$this->hasJsonContentType()) {
+                $this->rejectInput(415, 'Unsupported content type.');
+                return;
+            }
+        }
         // Read JSON from standard input if not pre-prepared
-        $jsonInput = $this->configuration->exists(SeablastConstant::JSON_INPUT)
+        $jsonInput = $jsonInputInjected
             ? $this->configuration->getString(SeablastConstant::JSON_INPUT)
-            : file_get_contents('php://input');
+            : $this->readJsonInput();
         if (!is_string($jsonInput)) {
             Debugger::barDump(["Either JSON_INPUT or php://input isn't string", $jsonInput], 'ERROR on input');
             Debugger::log("Either JSON_INPUT or php://input isn't string", ILogger::ERROR);
@@ -99,6 +113,10 @@ private function processInput(): void
             $this->message = 'Invalid input';
             return;
         }
+        if (strlen($jsonInput) > static::JSON_INPUT_MAX_BYTES) {
+            $this->rejectInput(413, 'JSON input exceeds the maximum allowed size.');
+            return;
+        }
         $jsonDecoded = json_decode($jsonInput);
         Debugger::barDump($jsonDecoded, 'data json_decoded from php://input');
         // Validate JSON input
@@ -170,6 +188,80 @@ private function processInput(): void
         }
     }
 
+    /**
+     * Checks whether the announced request body size is too large.
+     *
+     * @return bool
+     */
+    private function contentLengthExceedsLimit(): bool
+    {
+        if (!isset($this->superglobals->server['CONTENT_LENGTH'])) {
+            return false;
+        }
+        if (!is_scalar($this->superglobals->server['CONTENT_LENGTH'])) {
+            return false;
+        }
+        $contentLength = trim((string) $this->superglobals->server['CONTENT_LENGTH']);
+        if ($contentLength === '' || !ctype_digit($contentLength)) {
+            return false;
+        }
+        return (int) $contentLength > static::JSON_INPUT_MAX_BYTES;
+    }
+
+    /**
+     * Checks whether request Content-Type is JSON.
+     *
+     * @return bool
+     */
+    private function hasJsonContentType(): bool
+    {
+        $contentType = $this->superglobals->server['CONTENT_TYPE']
+            ?? $this->superglobals->server['HTTP_CONTENT_TYPE']
+            ?? '';
+        if (!is_scalar($contentType)) {
+            return false;
+        }
+        $mediaTypeParts = explode(';', (string) $contentType, 2);
+        $mediaType = strtolower(trim($mediaTypeParts[0]));
+        if ($mediaType === 'application/json') {
+            return true;
+        }
+        return strpos($mediaType, '/') !== false && substr($mediaType, -5) === '+json';
+    }
+
+    /**
+     * Read only the maximum accepted JSON bytes plus one byte to detect overflow.
+     *
+     * @return string|false
+     */
+    private function readJsonInput()
+    {
+        $stream = fopen('php://input', 'rb');
+        if ($stream === false) {
+            return false;
+        }
+        $readLength = static::JSON_INPUT_MAX_BYTES + 1;
+        Assert::greaterThanEq($readLength, 1);
+        $jsonInput = fread($stream, $readLength);
+        fclose($stream);
+        return $jsonInput;
+    }
+
+    /**
+     * Populate a generic API validation error.
+     *
+     * @param int $httpCode
+     * @param string $message
+     * @return void
+     */
+    private function rejectInput(int $httpCode, string $message): void
+    {
+        Debugger::barDump($message, 'ERROR on input');
+        Debugger::log($message, ILogger::ERROR);
+        $this->httpCode = $httpCode;
+        $this->message = $message;
+    }
+
     /**
      * Simple API response with httpCode and message.
      *
diff --git a/src/SeablastConstant.php b/src/SeablastConstant.php
index 868f34e..0cb6347 100644
--- a/src/SeablastConstant.php
+++ b/src/SeablastConstant.php
@@ -178,6 +178,10 @@ class SeablastConstant
      * @var string int[] groupId
      */
     public const USER_GROUPS = 'SB:USER_GROUPS';
+    /**
+     * @var string string[] list of fields that are boolean, hence should be represented by a checkbox
+     */
+    public const ADMIN_BOOLEAN_FIELDS = 'SB:ADMIN_BOOLEAN_FIELDS';
     /**
      * @var string string[] list of fields that contain color, so that input type color is better than textarea
      */
diff --git a/tests/GenericRestApiJsonModelTest.php b/tests/GenericRestApiJsonModelTest.php
new file mode 100644
index 0000000..814a3cc
--- /dev/null
+++ b/tests/GenericRestApiJsonModelTest.php
@@ -0,0 +1,117 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Seablast\Seablast\Tests;
+
+use PHPUnit\Framework\TestCase;
+use Seablast\Seablast\Apis\GenericRestApiJsonModel;
+use Seablast\Seablast\SeablastConfiguration;
+use Seablast\Seablast\SeablastConstant;
+use Seablast\Seablast\Superglobals;
+use stdClass;
+use Tracy\Debugger;
+
+class GenericRestApiJsonModelTest extends TestCase
+{
+    private const JSON_INPUT_MAX_BYTES = 1048576;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        if (!defined('APP_DIR')) {
+            define('APP_DIR', __DIR__ . '/..');
+            Debugger::enable(Debugger::DEVELOPMENT, APP_DIR . '/log');
+        }
+    }
+
+    public function testInjectedJsonUnderLimitReachesCsrfValidation(): void
+    {
+        $knowledge = $this->knowledgeForInjectedJson('{}');
+
+        $this->assertRestResponse($knowledge, 401, 'CSRF token missing');
+    }
+
+    public function testInjectedJsonOverLimitReturnsPayloadTooLarge(): void
+    {
+        $knowledge = $this->knowledgeForInjectedJson(str_repeat(' ', self::JSON_INPUT_MAX_BYTES + 1));
+
+        $this->assertRestResponse($knowledge, 413, 'JSON input exceeds the maximum allowed size.');
+    }
+
+    public function testUnsupportedContentTypeReturnsUnsupportedMediaType(): void
+    {
+        $knowledge = $this->knowledgeForServer([
+            'CONTENT_TYPE' => 'text/plain',
+        ]);
+
+        $this->assertRestResponse($knowledge, 415, 'Unsupported content type.');
+    }
+
+    public function testMissingContentTypeReturnsUnsupportedMediaType(): void
+    {
+        $knowledge = $this->knowledgeForServer();
+
+        $this->assertRestResponse($knowledge, 415, 'Unsupported content type.');
+    }
+
+    public function testStructuredJsonContentTypeWithParametersIsAccepted(): void
+    {
+        $knowledge = $this->knowledgeForServer([
+            'CONTENT_TYPE' => 'application/problem+json; charset=utf-8',
+        ]);
+
+        $this->assertRestResponse($knowledge, 400, 'Syntax error');
+    }
+
+    public function testContentLengthOverLimitReturnsPayloadTooLarge(): void
+    {
+        $knowledge = $this->knowledgeForServer([
+            'CONTENT_TYPE' => 'application/json',
+            'CONTENT_LENGTH' => (string) (self::JSON_INPUT_MAX_BYTES + 1),
+        ]);
+
+        $this->assertRestResponse($knowledge, 413, 'JSON input exceeds the maximum allowed size.');
+    }
+
+    public function testMalformedJsonUnderLimitKeepsExistingParseError(): void
+    {
+        $knowledge = $this->knowledgeForInjectedJson('{');
+
+        $this->assertRestResponse($knowledge, 400, 'Syntax error');
+    }
+
+    private function assertRestResponse(stdClass $knowledge, int $httpCode, string $message): void
+    {
+        $this->assertSame($httpCode, $knowledge->httpCode);
+        $rest = $knowledge->rest;
+        $this->assertInstanceOf(stdClass::class, $rest);
+        $this->assertSame($message, $rest->message);
+    }
+
+    private function knowledgeForInjectedJson(string $jsonInput): stdClass
+    {
+        $configuration = new SeablastConfiguration();
+        $configuration->setString(SeablastConstant::JSON_INPUT, $jsonInput);
+
+        $model = new GenericRestApiJsonModel(
+            $configuration,
+            new Superglobals([], [], ['REQUEST_METHOD' => 'POST'])
+        );
+
+        return $model->knowledge();
+    }
+
+    /**
+     * @param array<string, string> $server
+     */
+    private function knowledgeForServer(array $server = []): stdClass
+    {
+        $model = new GenericRestApiJsonModel(
+            new SeablastConfiguration(),
+            new Superglobals([], [], array_merge(['REQUEST_METHOD' => 'POST'], $server))
+        );
+
+        return $model->knowledge();
+    }
+}
diff --git a/tests/TemplateSecurityTest.php b/tests/TemplateSecurityTest.php
new file mode 100644
index 0000000..1c00f19
--- /dev/null
+++ b/tests/TemplateSecurityTest.php
@@ -0,0 +1,65 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Seablast\Seablast\Tests;
+
+use PHPUnit\Framework\TestCase;
+
+class TemplateSecurityTest extends TestCase
+{
+    public function testExternalScriptTagsUseSriAndAnonymousCors(): void
+    {
+        $templateDirectory = __DIR__ . '/../views';
+        $templateFiles = glob($templateDirectory . '/*.latte');
+        $this->assertNotFalse($templateFiles, 'Should be able to list bundled Latte templates.');
+
+        $expectedIntegrityByUrl = [
+            'https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js' => //
+            'sha384-1H217gwSVyLSIfaLxHbE7dRb3v4mYCKbpQvzx0cegeju1MVsGrX5xXxAvs/HgeFs',
+            'https://cdn.jsdelivr.net/gh/e3rd/WebHotkeys@0.9.4/WebHotkeys.js?register' => //
+            'sha384-VtSHOatDaywsjcaoV86liUBBl28v5GV/w+ee6ls5ZXHWpbjiI2QuMc/r+JEYDILa',
+        ];
+        $externalScriptTagCount = 0;
+
+        foreach ($templateFiles as $templateFile) {
+            $template = file_get_contents($templateFile);
+            $this->assertNotFalse($template, sprintf('Should be able to read %s.', $templateFile));
+
+            preg_match_all('/<script\b(?=[^>]*\bsrc="(https:\/\/[^"]+)")[^>]*>/i', $template, $matches, PREG_SET_ORDER);
+
+            foreach ($matches as $match) {
+                ++$externalScriptTagCount;
+                $scriptTag = $match[0];
+                $scriptUrl = $match[1];
+                $this->assertSame(
+                    1,
+                    preg_match('/\bintegrity="sha384-[A-Za-z0-9+\/=]+"/', $scriptTag),
+                    sprintf('External script tag in %s must use sha384 SRI: %s', basename($templateFile), $scriptTag)
+                );
+                $this->assertStringContainsString(
+                    'crossorigin="anonymous"',
+                    $scriptTag,
+                    sprintf(
+                        'External script tag in %s must use anonymous CORS: %s',
+                        basename($templateFile),
+                        $scriptTag
+                    )
+                );
+                if (array_key_exists($scriptUrl, $expectedIntegrityByUrl)) {
+                    $this->assertStringContainsString(
+                        sprintf('integrity="%s"', $expectedIntegrityByUrl[$scriptUrl]),
+                        $scriptTag,
+                        sprintf(
+                            'External script tag in %s must use the expected SRI hash: %s',
+                            basename($templateFile),
+                            $scriptTag
+                        )
+                    );
+                }
+            }
+        }
+
+        $this->assertGreaterThan(0, $externalScriptTagCount, 'Should find bundled external script tags to validate.');
+    }
+}
diff --git a/views/BlueprintWeb.latte b/views/BlueprintWeb.latte
index c02ed81..5e5dd31 100644
--- a/views/BlueprintWeb.latte
+++ b/views/BlueprintWeb.latte
@@ -20,7 +20,7 @@
             ];
         </script>
         {* jQuery is required if 'I18n:SHOW_LANGUAGE_SELECTOR' and for admin.latte, therefore it's linked by default. If you want ultraminimalist blueprint without jQuery, use your own within your app *}
-        <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>{* MUST be before send-auth-token and other scripts referred to within mainblock *}
+        <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js" integrity="sha384-1H217gwSVyLSIfaLxHbE7dRb3v4mYCKbpQvzx0cegeju1MVsGrX5xXxAvs/HgeFs" crossorigin="anonymous"></script>{* MUST be before send-auth-token and other scripts referred to within mainblock *}
         <script type="module" src="{$configuration->getString('SB_APP_ROOT_ABSOLUTE_URL')}/vendor/seablast/seablast/assets/scripts/seablast-bridge.js?v={$configuration->getInt('SB_WEB_FORCE_ASSET_VERSION')}"></script> {* so that seablast objects are ready before app code *}
         <header>
             <nav>
diff --git a/views/admin.latte b/views/admin.latte
index 45d45a7..25d32c5 100644
--- a/views/admin.latte
+++ b/views/admin.latte
@@ -122,7 +122,7 @@
 <script type="module" src="{$configuration->getString('SB_APP_ROOT_ABSOLUTE_URL')}/vendor/seablast/seablast/assets/scripts/seablast-bridge.js?v={$configuration->getInt('SB_WEB_FORCE_ASSET_VERSION')}"></script>
 {* scripts using seablast objects MUST use defer, so that the expected objects are already defined *}
 <script defer src="{$configuration->getString('SB_APP_ROOT_ABSOLUTE_URL')}/vendor/seablast/seablast/assets/scripts/mit.js?v={$configuration->getInt('SB_WEB_FORCE_ASSET_VERSION')}"></script> {* initEditable(); *}
-<script src="https://cdn.jsdelivr.net/gh/e3rd/WebHotkeys@0.9.4/WebHotkeys.js?register"></script>
+<script src="https://cdn.jsdelivr.net/gh/e3rd/WebHotkeys@0.9.4/WebHotkeys.js?register" integrity="sha384-VtSHOatDaywsjcaoV86liUBBl28v5GV/w+ee6ls5ZXHWpbjiI2QuMc/r+JEYDILa" crossorigin="anonymous"></script>
 <script> {* todo make this an external js *}
     $(document).ready(function () {