diff --git a/.claude/skills/migrate-to-1.0/SKILL.md b/.claude/skills/migrate-to-1.0/SKILL.md
new file mode 100644
index 0000000..c8cc95e
--- /dev/null
+++ b/.claude/skills/migrate-to-1.0/SKILL.md
@@ -0,0 +1,200 @@
+---
+name: migrate-to-1.0
+description: Migrate a project consuming ray/web-form-module from 0.x (Doctrine Annotations) to 1.0 (PHP 8 Attributes). Detects @FormValidation / @InputValidation / @VndError annotations, antiCsrf=true options, AuraInputInterceptor Reader arguments, and FormInterface signature mismatches; rewrites them and reports remaining manual steps.
+---
+
+# Migrate ray/web-form-module 0.x → 1.0
+
+Apply this skill in a project that depends on `ray/web-form-module` and is
+upgrading from `0.x` to `1.0`. Run it from the project root.
+
+## Scope
+
+You will rewrite consumer code only. Do NOT touch files under
+`vendor/`. Limit edits to:
+
+- `src/`, `app/`, `tests/`, `lib/` and similar source roots
+- PHP files only (`*.php`)
+
+Skip generated/cache directories: `var/`, `cache/`, `tmp/`, `build/`,
+`node_modules/`, `.git/`.
+
+## Preflight
+
+Before changing any file:
+
+1. Confirm the project's `composer.json` declares `ray/web-form-module`.
+   If not, abort and tell the user this skill does not apply.
+2. Confirm the working tree is clean (`git status`). If not, ask the user
+   whether to proceed — uncommitted changes will be mixed with this skill's
+   edits.
+3. Bump the constraint to `^1.0` in `composer.json` (`require` section). If
+   `doctrine/annotations` is in `require` and is no longer used elsewhere,
+   remove it.
+
+## Step 1 — Rewrite validation annotations to attributes
+
+For each PHP file under the source roots:
+
+### 1a. `@FormValidation`
+
+Find docblock annotations of the form:
+
+```php
+/**
+ * @FormValidation(form="contactForm", onFailure="badRequestAction")
+ */
+public function createAction()
+```
+
+Rewrite to a native attribute on the method:
+
+```php
+#[FormValidation(form: 'contactForm', onFailure: 'badRequestAction')]
+public function createAction()
+```
+
+Rules:
+
+- Remove the annotation line from the docblock. If the docblock becomes
+  empty (only `/**` and `*/`), delete the entire docblock.
+- Convert `=` to `:` and double-quoted strings to single-quoted PHP strings.
+- Preserve the existing `use Ray\WebFormModule\Annotation\FormValidation;`
+  import. Add it if missing.
+
+### 1b. `@FormValidation(... antiCsrf=true)` — **BC break**
+
+The `antiCsrf` option was removed. Split it into two attributes:
+
+```php
+/**
+ * @FormValidation(form="contactForm", antiCsrf=true)
+ */
+```
+
+becomes
+
+```php
+#[FormValidation(form: 'contactForm')]
+#[CsrfProtection]
+```
+
+Also add `use Ray\WebFormModule\Annotation\CsrfProtection;`.
+
+If `antiCsrf=false` (or omitted), drop the option without adding
+`#[CsrfProtection]` — methods without the attribute perform no CSRF check.
+
+### 1c. `@InputValidation` and `@VndError`
+
+Same treatment as `@FormValidation` (no `antiCsrf` concern).
+
+```php
+/** @InputValidation(form="form1") */
+public function createAction($name) {}
+```
+
+```php
+/**
+ * @VndError(message="...", logref="a1000", path="/p", href={"_self"="/p"})
+ */
+```
+
+become
+
+```php
+#[InputValidation(form: 'form1')]
+public function createAction($name) {}
+```
+
+```php
+#[VndError(message: '...', logref: 'a1000', path: '/p', href: ['_self' => '/p'])]
+```
+
+Note the `{...}` (Doctrine array literal) → `[...]` (PHP array) conversion
+in `VndError`'s `href`.
+
+## Step 2 — Drop `Reader` arguments
+
+`AuraInputInterceptor`, `InputValidationInterceptor`, and `VndErrorHandler`
+no longer accept a `Doctrine\Common\Annotations\Reader`.
+
+Find direct `new` calls and DI module bindings such as:
+
+```php
+new AuraInputInterceptor($injector, $reader)
+new InputValidationInterceptor($injector, $reader, $handler)
+new VndErrorHandler($reader)
+```
+
+Drop the `Reader` argument:
+
+```php
+new AuraInputInterceptor($injector)
+new InputValidationInterceptor($injector, $handler)
+new VndErrorHandler()
+```
+
+If the project bound `Doctrine\Common\Annotations\Reader` in a Ray.Di
+module solely to satisfy these constructors, remove that binding.
+
+## Step 3 — Update `FormInterface` implementations
+
+`FormInterface::input()` and `FormInterface::error()` now declare types:
+
+```php
+public function input(string $input): string;
+public function error(string $input): string;
+```
+
+Any project class implementing `FormInterface` (directly, or via
+`AbstractForm` override) must match these signatures. Update:
+
+```php
+public function input($input)
+public function error($input)
+```
+
+to:
+
+```php
+public function input(string $input): string
+public function error(string $input): string
+```
+
+## Step 4 — Update `ValidationException` callers
+
+`ValidationException::__construct(string $message = '', int $code = 0,
+?Throwable $e = null, ?FormValidationError $error = null)` — the third
+parameter is now `Throwable|null` (was `Exception|null`) and `$error` is
+typed `FormValidationError|null`.
+
+If the project passes a non-`Throwable` value, fix the call site.
+
+## Step 5 — Verify
+
+After all rewrites:
+
+1. Run the project's static analysis (`composer phpstan`, `composer psalm`,
+   `composer cs` — whichever exist).
+2. Run the project's test suite.
+3. `grep -rn "@FormValidation\|@InputValidation\|@VndError\|antiCsrf" src/ tests/ app/ 2>/dev/null`
+   should return nothing relevant.
+4. `grep -rn "Doctrine\\\\Common\\\\Annotations\\\\Reader" src/ app/ 2>/dev/null`
+   should not show usages tied to this package.
+
+Report to the user:
+
+- Files modified (count + paths).
+- Any annotation occurrence you could not rewrite automatically (e.g.,
+  uncommon formatting). List file:line so the user can finish manually.
+- Static analysis / test results.
+
+## Out of scope
+
+- Migrating other libraries' annotations (only `Ray\WebFormModule\Annotation\*`).
+- Renaming `SetAntiCsrfTrait` — the trait and `setAntiCsrf()` method are
+  unchanged in 1.0.
+- Changes to forms that use `AntiCsrf` without `#[CsrfProtection]` —
+  flag these to the user: in 1.0 they will silently stop enforcing CSRF.
+  The user must decide whether to add `#[CsrfProtection]` to the validated
+  controller method or accept the new behaviour.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..b0a252d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-minor", "version-update:semver-patch"]
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/coding-standards.yml b/.github/workflows/coding-standards.yml
new file mode 100644
index 0000000..9bd9501
--- /dev/null
+++ b/.github/workflows/coding-standards.yml
@@ -0,0 +1,45 @@
+name: Coding Standards
+
+on:
+  push:
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+  workflow_dispatch:
+    inputs:
+      php_version:
+        default: '8.4'
+
+jobs:
+  coding-standards:
+    name: Coding Standards
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ inputs.php_version || '8.4' }}
+          tools: cs2pr
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install dependencies
+        run: composer install --no-interaction --prefer-dist
+
+      - name: Run PHP_CodeSniffer
+        run: ./vendor/bin/phpcs -q --no-colors --report=checkstyle | cs2pr
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
new file mode 100644
index 0000000..71f9c1f
--- /dev/null
+++ b/.github/workflows/continuous-integration.yml
@@ -0,0 +1,57 @@
+name: Continuous Integration
+
+on:
+  push:
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+  workflow_dispatch:
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        operating-system:
+          - ubuntu-latest
+        php-version:
+          - '8.0'
+          - '8.1'
+          - '8.2'
+          - '8.3'
+          - '8.4'
+          - '8.5'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup PHP ${{ matrix.php-version }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-version }}
+          coverage: none
+          tools: none
+          ini-values: assert.exception=1, zend.assertions=1
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-php${{ matrix.php-version }}-composer-${{ hashFiles('**/composer.json') }}
+          restore-keys: |
+            ${{ runner.os }}-php${{ matrix.php-version }}-composer-
+            ${{ runner.os }}-composer-
+
+      - name: Install dependencies
+        run: composer update --no-interaction --no-progress --prefer-dist
+
+      - name: Run test suite
+        run: ./vendor/bin/phpunit
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
new file mode 100644
index 0000000..1c3a063
--- /dev/null
+++ b/.github/workflows/static-analysis.yml
@@ -0,0 +1,130 @@
+name: Static Analysis
+
+on:
+  push:
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+  workflow_dispatch:
+    inputs:
+      php_version:
+        default: '8.4'
+
+jobs:
+  static-analysis-phpstan:
+    name: PHPStan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ inputs.php_version || '8.4' }}
+          tools: cs2pr
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install dependencies
+        run: composer install --no-interaction --no-progress --prefer-dist
+
+      - name: Run PHPStan
+        run: ./vendor/bin/phpstan analyse -c phpstan.neon --no-progress --no-interaction --error-format=checkstyle | cs2pr
+
+  static-analysis-psalm:
+    name: Psalm
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ inputs.php_version || '8.4' }}
+          tools: cs2pr
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Install dependencies
+        run: composer install --no-interaction --no-progress --prefer-dist
+
+      - name: Run Psalm
+        run: ./vendor/bin/psalm --show-info=false --output-format=checkstyle --shepherd | cs2pr
+
+  static-analysis-phpmd:
+    name: PHPMD
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ inputs.php_version || '8.4' }}
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install dependencies
+        run: composer install --no-interaction --no-progress --prefer-dist
+
+      - name: Run PHP Mess Detector
+        run: ./vendor/bin/phpmd src text ./phpmd.xml
+
+  static-analysis-composer-require-checker:
+    name: ComposerRequireChecker
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ inputs.php_version || '8.4' }}
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Install dependencies
+        run: |
+          composer install --no-interaction --no-progress --prefer-dist
+
+      - name: Run composer-require-checker with config
+        run: ./vendor/bin/composer-require-checker check ./composer.json --config-file=./composer-require-checker.json
diff --git a/.gitignore b/.gitignore
index b47a5dd..93dec00 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,4 @@ composer.lock
 tests/tmp/*
 !tests/tmp/.placefolder
 .phpunit.result.cache
+.phpcs-cache
diff --git a/.php_cs b/.php_cs
deleted file mode 100644
index 3518e7e..0000000
--- a/.php_cs
+++ /dev/null
@@ -1,132 +0,0 @@
-<?php
-
-$header = <<<'EOF'
-This file is part of the Ray.WebFormModule package.
-
-@license http://opensource.org/licenses/MIT MIT
-EOF;
-
-return \PhpCsFixer\Config::create()
-    ->setRiskyAllowed(true)
-    ->setRules(array(
-        '@PSR2' => true,
-        'header_comment' => ['header' => $header, 'commentType' => 'PHPDoc', 'separate' => 'none'],
-        'array_syntax' => ['syntax' => 'short'],
-        'binary_operator_spaces' => ['align_equals' => false, 'align_double_arrow' => false],
-        'blank_line_after_opening_tag' => true,
-        'blank_line_after_namespace' => false,
-        'blank_line_before_return' => true,
-        'cast_spaces' => true,
-//        'class_keyword_remove' => true,
-        'combine_consecutive_unsets' => true,
-        'concat_space' => ['spacing' => 'one'],
-        'declare_equal_normalize' => true,
-        'declare_strict_types' => false,
-        'dir_constant' => true,
-        'ereg_to_preg' => true,
-        'function_typehint_space' => true,
-        'general_phpdoc_annotation_remove' => true,
-        'hash_to_slash_comment' => true,
-        'heredoc_to_nowdoc' => true,
-        'include' => true,
-        'indentation_type' => true,
-        'is_null' => ['use_yoda_style' => false],
-        'linebreak_after_opening_tag' => true,
-        'lowercase_cast' => true,
-//        'mb_str_functions' => true,
-        'method_separation' => true,
-        'modernize_types_casting' => true,
-        'native_function_casing' => true,
-//        'native_function_invocation' => true,
-        'new_with_braces' => false, //
-        'no_alias_functions' => true,
-        'no_blank_lines_after_class_opening' => true,
-        'no_blank_lines_after_phpdoc' => true,
-        'no_blank_lines_before_namespace' => true,
-        'no_empty_comment' => true,
-        'no_empty_phpdoc' => true,
-        'no_empty_statement' => true,
-        'no_extra_consecutive_blank_lines' => ['break', 'continue', 'curly_brace_block', 'extra', 'parenthesis_brace_block', 'return', 'square_brace_block', 'throw', 'use', 'useTrait'],
-        'no_leading_import_slash' => true,
-        'no_leading_namespace_whitespace' => true,
-        'no_mixed_echo_print' => ['use' => 'echo'],
-        'no_multiline_whitespace_around_double_arrow' => true,
-        'no_multiline_whitespace_before_semicolons' => true,
-        'no_php4_constructor' => false,
-        'no_short_bool_cast' => true,
-        'no_short_echo_tag' => false,
-        'no_singleline_whitespace_before_semicolons' => true,
-        'no_spaces_around_offset' => true,
-        'no_trailing_comma_in_list_call' => true,
-        'no_trailing_comma_in_singleline_array' => true,
-        'no_trailing_whitespace' => true,
-        'no_trailing_whitespace_in_comment' => true,
-        'no_unneeded_control_parentheses' => true,
-        'no_unreachable_default_argument_value' => true,
-        'no_unused_imports' => true,
-        'no_useless_else' => true,
-        'no_useless_return' => true,
-        'no_whitespace_before_comma_in_array' => true,
-        'no_whitespace_in_blank_line' => true,
-        'normalize_index_brace' => true,
-        'not_operator_with_space' => false,
-        'not_operator_with_successor_space' => true,
-        'object_operator_without_whitespace' => true,
-        'ordered_class_elements' => true,
-        'ordered_imports' => true,
-        'php_unit_construct' => true,
-        'php_unit_dedicate_assert' => true,
-        'php_unit_fqcn_annotation' => true,
-        'php_unit_strict' => true,
-//        'phpdoc_add_missing_param_annotation' => true,
-        'phpdoc_align' => true,
-        'phpdoc_annotation_without_dot' => true,
-        'phpdoc_indent' => true,
-        'phpdoc_inline_tag' => true,
-        'phpdoc_no_access' => true,
-        'phpdoc_no_alias_tag' => ['property-read' => 'property', 'property-write' => 'property', 'type' => 'var'],
-        'phpdoc_no_empty_return' => true,
-        'phpdoc_no_package' => true,
-//        'phpdoc_no_useless_inheritdoc' => true,
-        'phpdoc_order' => true,
-        'phpdoc_return_self_reference' => true,
-        'phpdoc_scalar' => true,
-        'phpdoc_separation' => true,
-        'phpdoc_single_line_var_spacing' => true,
-//        'phpdoc_summary' => true,
-        'phpdoc_to_comment' => true,
-        'phpdoc_trim' => true,
-        'phpdoc_types' => true,
-        'phpdoc_var_without_name' => true,
-        'pow_to_exponentiation' => true,
-//        'pre_increment' => true,
-        'protected_to_private' => true,
-        'psr0' => true,
-        'psr4' => true,
-        'random_api_migration' => true,
-        'return_type_declaration' =>  ['space_before' => 'one'],
-        'self_accessor' => true,
-        'short_scalar_cast' => true,
-//        'silenced_deprecation_error' => true,
-//        'simplified_null_return' => true,
-//        'single_blank_line_before_namespace' => true,
-        'single_quote' => true,
-        'space_after_semicolon' => true,
-        'standardize_not_equals' => true,
-//        'strict_comparison' => true,
-        'ternary_operator_spaces' => true,
-        'strict_param' => true,
-//        'ternary_to_null_coalescing' => true,
-//        'trailing_comma_in_multiline_array' => true,
-        'trim_array_spaces' => true,
-        'unary_operator_spaces' => true,
-        'whitespace_after_comma_in_array' => true
-    ))
-    ->setFinder(
-        PhpCsFixer\Finder::create()
-            ->exclude('tests/Fake')
-            ->exclude('src-data')
-            ->exclude('src-deprecated')
-            ->in(__DIR__)
-    )->setLineEnding("\n")
-    ->setUsingCache(false);
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..dde77f0
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,79 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - unreleased
+
+### Changed
+
+- **BC break**: Minimum PHP version raised to `8.0`.
+- **BC break**: Migrated from Doctrine Annotations to PHP 8 Attributes. All
+  validation metadata (`@FormValidation`, `@InputValidation`, `@VndError`) is
+  now expressed with `#[FormValidation]`, `#[InputValidation]`, `#[VndError]`.
+- **BC break**: CSRF protection for validation methods is now declared with
+  the separate `#[CsrfProtection]` attribute. The previous `antiCsrf=true`
+  boolean option on `@FormValidation` has been removed. CSRF checks are now
+  opt-in: methods without `#[CsrfProtection]` perform no CSRF verification
+  even if the form has an `AntiCsrf` object set.
+
+  Before:
+
+  ```php
+  /**
+   * @FormValidation(form="contactForm", antiCsrf=true)
+   */
+  public function createAction() {}
+  ```
+
+  After:
+
+  ```php
+  #[FormValidation(form: 'contactForm')]
+  #[CsrfProtection]
+  public function createAction() {}
+  ```
+- **BC break**: `AuraInputInterceptor`, `InputValidationInterceptor` and
+  `VndErrorHandler` no longer accept a `Doctrine\Common\Annotations\Reader`
+  in their constructors. Validation attributes are read directly via
+  `ReflectionMethod::getAttributes()`.
+- **BC break**: `FormInterface::input()` and `FormInterface::error()` now declare
+  parameter and return types (`string $input`, `: string` respectively).
+  Implementations must update their signatures.
+- **BC break**: `ValidationException::__construct()` now declares parameter
+  types (`string $message`, `int $code`, `Throwable|null $e`,
+  `FormValidationError|null $error`). The `$error` property is now typed as
+  `FormValidationError|null` via constructor property promotion.
+- Added property type declarations and return types across the codebase to
+  align with PHP 8 typing.
+- Bumped dependencies: `ray/di` `^2.16`, `ray/aop` `^2.14`,
+  `phpunit/phpunit` `^9.5`.
+
+### Fixed
+
+- `Exception\RuntimeException` now correctly extends `\RuntimeException`
+  instead of `\LogicException`.
+- `AntiCsrf::isValid()` uses strict comparison for the CSRF token.
+- Eliminated PHP 8.4 deprecation warnings for implicit nullable parameters in
+  `ValidationException::__construct()` and `VndErrorHandler::makeVndError()`.
+
+### Added
+
+- GitHub Actions workflows for tests and coding standards.
+- `CHANGELOG.md`.
+- `#[CsrfProtection]` attribute for composing CSRF checks with form/input
+  validation attributes.
+
+### Removed
+
+- `doctrine/annotations` dependency.
+- Travis CI configuration; replaced with GitHub Actions.
+
+## [0.6.0] - 2018-05-27
+
+See git history for changes prior to 1.0.0.
+
+[1.0.0]: https://github.com/ray-di/Ray.WebFormModule/compare/0.6.0...1.0.0
+[0.6.0]: https://github.com/ray-di/Ray.WebFormModule/releases/tag/0.6.0
diff --git a/README.JA.md b/README.JA.md
index edcdbb8..c8d4bd6 100644
--- a/README.JA.md
+++ b/README.JA.md
@@ -1,8 +1,8 @@
 # Ray.WebFormModule
 
+[![Continuous Integration](https://github.com/ray-di/Ray.WebFormModule/actions/workflows/continuous-integration.yml/badge.svg)](https://github.com/ray-di/Ray.WebFormModule/actions/workflows/continuous-integration.yml)
+[![Coding Standards](https://github.com/ray-di/Ray.WebFormModule/actions/workflows/coding-standards.yml/badge.svg)](https://github.com/ray-di/Ray.WebFormModule/actions/workflows/coding-standards.yml)
 [![Scrutinizer Code Quality](https://scrutinizer-ci.com/g/ray-di/Ray.WebFormModule/badges/quality-score.png?b=1.x)](https://scrutinizer-ci.com/g/ray-di/Ray.WebFormModule/?branch=1.x)
-[![Code Coverage](https://scrutinizer-ci.com/g/ray-di/Ray.WebFormModule/badges/coverage.png?b=1.x)](https://scrutinizer-ci.com/g/ray-di/Ray.WebFormModule/?branch=1.x)
-[![Build Status](https://travis-ci.org/ray-di/Ray.WebFormModule.svg?branch=1.x)](https://travis-ci.org/ray-di/Ray.WebFormModule)
 
 Ray.WebFormModuleはアスペクト指向でフォームのバリデーションを行うモジュールです。
 フォームライブラリには[Aura.Input](https://github.com/auraphp/Aura.Input)を使い、
@@ -124,19 +124,59 @@ class MyController
 
 ### CSRF Protections
 
-CSRF対策を行うためにはフォームにCSRFオブジェクトをセットします。
+CSRF対策は **opt-in** です。`SetAntiCsrfTrait` を使うフォームには `AntiCsrfInterface` が注入されますが、
+トークンの検証は `#[CsrfProtection]` 属性が付いたメソッドでのみ行われます。
+`#[CsrfProtection]` が無いメソッドでは、フォーム側に AntiCsrf がセットされていても CSRF チェックは実行されません。
 
 ```php
+use Ray\WebFormModule\AbstractAuraForm;
+use Ray\WebFormModule\Annotation\CsrfProtection;
+use Ray\WebFormModule\Annotation\FormValidation;
 use Ray\WebFormModule\SetAntiCsrfTrait;
 
 class MyForm extends AbstractAuraForm
 {
     use SetAntiCsrfTrait;
+}
+
+class MyController
+{
+    #[FormValidation(form: "contactForm")]
+    #[CsrfProtection]
+    public function createAction()
+    {
+    }
+}
 ```
 
 セキュリティレベルを高めるためにはユーザーの認証を含んだカスタムCsrfクラスを作成してフォームクラスにセットします。
 詳しくはAura.Inputの[Applying CSRF Protections](https://github.com/auraphp/Aura.Input#applying-csrf-protections)をご覧ください。
 
+## 0.x からのマイグレーション
+
+1.0 で Doctrine Annotations を廃止し、PHP 8 Attributes に完全移行しました。
+型宣言も強化されています。主な書き換え:
+
+| Before (0.x)                                                       | After (1.0)                                                               |
+|--------------------------------------------------------------------|---------------------------------------------------------------------------|
+| `@FormValidation(form="f", onFailure="badRequest")`                | `#[FormValidation(form: 'f', onFailure: 'badRequest')]`                   |
+| `@FormValidation(form="f", antiCsrf=true)`                         | `#[FormValidation(form: 'f')]` + `#[CsrfProtection]`                      |
+| `@InputValidation(form="f")`                                       | `#[InputValidation(form: 'f')]`                                           |
+| `@VndError(message="...", logref="...")`                           | `#[VndError(message: '...', logref: '...')]`                              |
+| `new AuraInputInterceptor($injector, $reader)`                     | `new AuraInputInterceptor($injector)` (`Reader` 引数は不要)                 |
+| `public function input($input)` / `public function error($input)`  | `public function input(string $input): string` / `error(string $input): string` |
+
+破壊的変更の完全なリストは [CHANGELOG.md](CHANGELOG.md) を参照してください。
+
+### Claude Code による自動マイグレーション
+
+リポジトリ同梱の Claude Code skill
+[`.claude/skills/migrate-to-1.0/SKILL.md`](.claude/skills/migrate-to-1.0/SKILL.md)
+が上記の書き換え (アノテーション → アトリビュート、`antiCsrf=true` の
+`#[CsrfProtection]` 分割、`Reader` 引数削除、`FormInterface` 署名更新) を
+AI アシスタントに案内します。利用側プロジェクトの `.claude/skills/` に
+ディレクトリをコピーして `/migrate-to-1.0` で起動してください。
+
 ## Validation Exception
 
 `#[FormValidation]`の代わりに`#[InputValidation]`とアノテートするとバリデーションが失敗したときに`Ray\WebFormModule\Exception\ValidationException`が投げられるよになります。この場合はHTML表現は使われません。Web APIアプリケーションなどに便利です。
diff --git a/README.md b/README.md
index 36740e2..b880d99 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
 # Ray.WebFormModule
 
+[![Continuous Integration](https://github.com/ray-di/Ray.WebFormModule/actions/workflows/continuous-integration.yml/badge.svg)](https://github.com/ray-di/Ray.WebFormModule/actions/workflows/continuous-integration.yml)
+[![Coding Standards](https://github.com/ray-di/Ray.WebFormModule/actions/workflows/coding-standards.yml/badge.svg)](https://github.com/ray-di/Ray.WebFormModule/actions/workflows/coding-standards.yml)
 [![Scrutinizer Code Quality](https://scrutinizer-ci.com/g/ray-di/Ray.WebFormModule/badges/quality-score.png?b=1.x)](https://scrutinizer-ci.com/g/ray-di/Ray.WebFormModule/?branch=1.x)
-[![Code Coverage](https://scrutinizer-ci.com/g/ray-di/Ray.WebFormModule/badges/coverage.png?b=1.x)](https://scrutinizer-ci.com/g/ray-di/Ray.WebFormModule/?branch=1.x)
-[![Build Status](https://travis-ci.org/ray-di/Ray.WebFormModule.svg?branch=1.x)](https://travis-ci.org/ray-di/Ray.WebFormModule)
 
 An aspect oriented web form module powered by [Aura.Input](https://github.com/auraphp/Aura.Input) and [Ray.Di](https://github.com/ray-di/Ray.Di).
 
@@ -12,7 +12,7 @@ An aspect oriented web form module powered by [Aura.Input](https://github.com/au
 
 ### Composer install
 
-    $ composer require web-form-module
+    $ composer require ray/web-form-module
  
 ### Module install
 
@@ -136,17 +136,61 @@ or render input element basis.
   echo $form->input('name'); // <input id="name" type="text" name="name" size="20" maxlength="20" />
   echo $form->error('name'); // "Name must be alphabetic only." or blank.
 ```
-## CSRF Protections
+### CSRF Protections
+
+CSRF protection is **opt-in**. A form that uses `SetAntiCsrfTrait` is wired
+with an `AntiCsrfInterface`, but the token is only verified when the
+validated method is annotated with `#[CsrfProtection]`. Methods without
+`#[CsrfProtection]` perform no CSRF check even if the form supports it.
 
 ```php
+use Ray\WebFormModule\AbstractAuraForm;
+use Ray\WebFormModule\Annotation\CsrfProtection;
+use Ray\WebFormModule\Annotation\FormValidation;
 use Ray\WebFormModule\SetAntiCsrfTrait;
 
-class MyController 
+class MyForm extends AbstractAuraForm
 {
     use SetAntiCsrfTrait;
+}
+
+class MyController
+{
+    #[FormValidation(form: "contactForm")]
+    #[CsrfProtection]
+    public function createAction()
+    {
+    }
+}
 ```
 You can provide your custom `AntiCsrf` class. See more detail at [Aura.Input](https://github.com/auraphp/Aura.Input#applying-csrf-protections)
 
+## Migration from 0.x
+
+Version 1.0 drops Doctrine Annotations in favour of native PHP 8 Attributes
+and tightens type declarations. The most common rewrites:
+
+| Before (0.x)                                                       | After (1.0)                                                               |
+|--------------------------------------------------------------------|---------------------------------------------------------------------------|
+| `@FormValidation(form="f", onFailure="badRequest")`                | `#[FormValidation(form: 'f', onFailure: 'badRequest')]`                   |
+| `@FormValidation(form="f", antiCsrf=true)`                         | `#[FormValidation(form: 'f')]` + `#[CsrfProtection]`                      |
+| `@InputValidation(form="f")`                                       | `#[InputValidation(form: 'f')]`                                           |
+| `@VndError(message="...", logref="...")`                           | `#[VndError(message: '...', logref: '...')]`                              |
+| `new AuraInputInterceptor($injector, $reader)`                     | `new AuraInputInterceptor($injector)` (no `Reader` argument)              |
+| `public function input($input)` / `public function error($input)`  | `public function input(string $input): string` / `error(string $input): string` |
+
+See [CHANGELOG.md](CHANGELOG.md) for the full list of breaking changes.
+
+### Automated migration with Claude Code
+
+The repository ships a Claude Code skill at
+[`.claude/skills/migrate-to-1.0/SKILL.md`](.claude/skills/migrate-to-1.0/SKILL.md)
+that walks an AI assistant through the rewrites above (annotations →
+attributes, `antiCsrf=true` split into `#[CsrfProtection]`, `Reader`
+argument removal, `FormInterface` signature updates). Copy the directory
+into your consuming project's `.claude/skills/` and invoke it via
+`/migrate-to-1.0`.
+
 ## Validation Exception
 
 When we install `Ray\WebFormModule\FormVndErrorModule` as following,
@@ -188,6 +232,6 @@ More detail for `vnd.error+json` can be added with the `#[VndError]` attribute.
 
 This optional module is handy for API application. 
    
-### Demo
+## Demo
 
     $ php -S docs/demo/1.csrf/web.php
diff --git a/composer-require-checker.json b/composer-require-checker.json
new file mode 100644
index 0000000..2c1e5fd
--- /dev/null
+++ b/composer-require-checker.json
@@ -0,0 +1,13 @@
+{
+    "symbol-whitelist": [],
+    "php-core-extensions": [
+        "Core",
+        "date",
+        "json",
+        "pcre",
+        "Reflection",
+        "SPL",
+        "standard"
+    ],
+    "scan-files": []
+}
diff --git a/composer.json b/composer.json
index e36bd59..6f8b471 100644
--- a/composer.json
+++ b/composer.json
@@ -12,10 +12,17 @@
         "aura/input": "^1.2",
         "aura/filter": "^2.3|3.x-dev",
         "aura/html": "^2.5",
+        "aura/session": "^2.1 || ^4.0",
         "ray/aura-session-module": "^1.1"
     },
     "require-dev": {
-        "phpunit/phpunit": "^9.5"
+        "phpunit/phpunit": "^9.5",
+        "doctrine/coding-standard": "^14.0",
+        "phpstan/phpstan": "^1.10",
+        "squizlabs/php_codesniffer": "^4.0",
+        "vimeo/psalm": "^5.0 || ^6.0",
+        "phpmd/phpmd": "^2.13",
+        "maglnet/composer-require-checker": "^4.0"
     },
     "license": "MIT",
     "autoload":{
@@ -30,13 +37,20 @@
     },
     "scripts" :{
         "test": ["@cs", "phpunit"],
+        "tests": ["@cs", "@sa", "@test"],
         "coverage": ["php -dzend_extension=xdebug.so ./vendor/bin/phpunit --coverage-text --coverage-html=build/coverage"],
-        "cs": ["php-cs-fixer fix -v --dry-run", "phpcs --standard=./phpcs.xml src"],
-        "cs-fix": ["php-cs-fixer fix -v", "phpcbf src"]
+        "cs": "phpcs",
+        "cs-fix": "phpcbf",
+        "phpstan": "phpstan analyse -c phpstan.neon --no-progress",
+        "psalm": "psalm --show-info=false",
+        "phpmd": "phpmd src text ./phpmd.xml",
+        "crc": "composer-require-checker check ./composer.json --config-file=./composer-require-checker.json",
+        "sa": ["@phpstan", "@psalm"]
     },
     "config": {
         "allow-plugins": {
-            "aura/installer-default": true
+            "aura/installer-default": true,
+            "dealerdirect/phpcodesniffer-composer-installer": true
         }
     }
 }
diff --git a/docs/demo/1.csrf/ContactForm.php b/docs/demo/1.csrf/ContactForm.php
index ce91165..aea6dbd 100644
--- a/docs/demo/1.csrf/ContactForm.php
+++ b/docs/demo/1.csrf/ContactForm.php
@@ -1,9 +1,4 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
 namespace Ray\WebFormModule;
 
 use Aura\Input\Filter;
diff --git a/docs/demo/1.csrf/Controller.php b/docs/demo/1.csrf/Controller.php
index f17209a..bece0e9 100644
--- a/docs/demo/1.csrf/Controller.php
+++ b/docs/demo/1.csrf/Controller.php
@@ -1,13 +1,9 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
 namespace Ray\WebFormModule;
 
 use Ray\Di\Di\Inject;
 use Ray\Di\Di\Named;
+use Ray\WebFormModule\Annotation\CsrfProtection;
 use Ray\WebFormModule\Annotation\FormValidation;
 
 class Controller
@@ -21,6 +17,7 @@ class Controller
 
     /**
      * @Inject
+     *
      * @Named("contact_form")
      */
     public function setForm(FormInterface $form)
@@ -35,9 +32,8 @@ public function indexAction()
         return $this;
     }
 
-    /**
-     * @FormValidation(form="form", onFailure="badRequestAction")
-     */
+    #[FormValidation(form: 'form', onFailure: 'badRequestAction')]
+    #[CsrfProtection]
     public function createUser($post)
     {
         $this->response['code'] = 201;
diff --git a/docs/demo/1.csrf/MyModule.php b/docs/demo/1.csrf/MyModule.php
index 295da43..4e35dba 100644
--- a/docs/demo/1.csrf/MyModule.php
+++ b/docs/demo/1.csrf/MyModule.php
@@ -1,9 +1,4 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
 namespace Ray\WebFormModule;
 
 use Ray\Di\AbstractModule;
diff --git a/docs/demo/1.csrf/run.php b/docs/demo/1.csrf/run.php
index 81e7c17..9741b75 100644
--- a/docs/demo/1.csrf/run.php
+++ b/docs/demo/1.csrf/run.php
@@ -1,9 +1,5 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
+
 $loader = require dirname(__DIR__) . '/autoload.php';
 $loader->addPsr4('Ray\WebFormModule\\', __DIR__);
 use Aura\Input\Exception\CsrfViolation;
diff --git a/docs/demo/1.csrf/web.php b/docs/demo/1.csrf/web.php
index 5bf307b..ef72c18 100644
--- a/docs/demo/1.csrf/web.php
+++ b/docs/demo/1.csrf/web.php
@@ -1,9 +1,5 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
+
 use Ray\Di\Injector;
 use Ray\WebFormModule\Controller;
 use Ray\WebFormModule\MyModule;
diff --git a/docs/demo/autoload.php b/docs/demo/autoload.php
index a0a9576..80347f6 100644
--- a/docs/demo/autoload.php
+++ b/docs/demo/autoload.php
@@ -1,9 +1,5 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
+
 use Doctrine\Common\Annotations\AnnotationRegistry;
 
 $autoloader = dirname(dirname(__DIR__)) . '/vendor/autoload.php';
diff --git a/phpcs.xml b/phpcs.xml
index 88ecf9b..00e9363 100755
--- a/phpcs.xml
+++ b/phpcs.xml
@@ -1,20 +1,64 @@
 <?xml version="1.0"?>
-<ruleset>
-    <!-- 2. General -->
-    <rule ref="Generic.NamingConventions.UpperCaseConstantName"/>
-    <rule ref="Generic.CodeAnalysis.UnusedFunctionParameter"/>
-    <rule ref="Generic.Strings.UnnecessaryStringConcat"/>
-    <!-- Include the whole PSR-2 standard -->
-    <rule ref="PSR2">
-        <exclude name="Generic.Files.LineLength"/>
+<ruleset
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="./vendor/squizlabs/php_codesniffer/phpcs.xsd">
+
+    <arg name="basepath" value="."/>
+    <arg name="extensions" value="php"/>
+    <arg name="parallel" value="80"/>
+    <arg name="cache" value=".phpcs-cache"/>
+
+    <!-- PHP Compatibility -->
+    <config name="php_version" value="80000"/>
+
+    <!-- Ignore warnings, show progress of the run and show sniff names -->
+    <arg value="nps"/>
+
+    <!-- Directories to be checked -->
+    <file>src</file>
+    <file>tests</file>
+    <exclude-pattern>*/tmp/*</exclude-pattern>
+    <exclude-pattern>*/Fake/*</exclude-pattern>
+
+    <!-- PSR12 Coding Standard -->
+    <rule ref="PSR12"/>
+
+    <!-- Based on Doctrine Coding Standard -->
+    <rule ref="Doctrine">
+        <!-- Exclude Rules -->
+        <exclude name="Generic.Formatting.MultipleStatementAlignment.NotSame"/>
+        <exclude name="Squiz.Strings.DoubleQuoteUsage.ContainsVar"/>
+        <exclude name="SlevomatCodingStandard.Classes.SuperfluousAbstractClassNaming.SuperfluousPrefix"/>
+        <exclude name="SlevomatCodingStandard.Classes.SuperfluousExceptionNaming.SuperfluousSuffix"/>
+        <exclude name="SlevomatCodingStandard.Classes.SuperfluousInterfaceNaming.SuperfluousSuffix"/>
+        <exclude name="SlevomatCodingStandard.Classes.SuperfluousTraitNaming.SuperfluousSuffix"/>
+        <exclude name="SlevomatCodingStandard.Commenting.InlineDocCommentDeclaration.MissingVariable"/>
+        <exclude name="SlevomatCodingStandard.Commenting.UselessInheritDocComment.UselessInheritDocComment"/>
+        <exclude name="SlevomatCodingStandard.TypeHints.PropertyTypeHint.MissingNativeTypeHint"/>
+        <exclude name="SlevomatCodingStandard.ControlStructures.EarlyExit.EarlyExitNotUsed"/>
+        <exclude name="SlevomatCodingStandard.PHP.RequireExplicitAssertion.RequiredExplicitAssertion"/>
+        <exclude name="SlevomatCodingStandard.TypeHints.ReturnTypeHint.MissingNativeTypeHint" />
     </rule>
-    <rule ref="Generic.Arrays.DisallowLongArraySyntax"/>
-    <rule ref="PEAR.Commenting.FunctionComment">
-        <exclude name="PEAR.Commenting.FunctionComment.MissingReturn"/>
-        <exclude name="PEAR.Commenting.FunctionComment.MissingParamComment"/>
-        <exclude name="PEAR.Commenting.FunctionComment.SpacingBeforeTags"/>
-        <exclude name="PEAR.Commenting.FunctionComment.MissingParamTag"/>
-        <exclude name="PEAR.Commenting.FunctionComment.Missing"/>
-        <exclude name="PEAR.Commenting.FunctionComment.ParameterCommentsNotAligned"/>
+    <!-- Additional Rules -->
+    <rule ref="SlevomatCodingStandard.Commenting.DocCommentSpacing">
+        <properties>
+            <property name="annotationsGroups" type="array">
+                <element value="@param, @psalm-param, @phpstan-param"/>
+                <element value="@return, @psalm-return, @phpstan-return"/>
+                <element value="@throws"/>
+            </property>
+        </properties>
+    </rule>
+    <rule ref="SlevomatCodingStandard.Classes.PropertySpacing">
+        <properties>
+            <property name="minLinesCountBeforeWithComment" value="1"/>
+            <property name="maxLinesCountBeforeWithComment" value="1"/>
+            <property name="maxLinesCountBeforeWithoutComment" value="0"/>
+        </properties>
+    </rule>
+    <rule ref="SlevomatCodingStandard.Namespaces.UnusedUses">
+        <properties>
+            <property name="searchAnnotations" value="true"/>
+        </properties>
     </rule>
 </ruleset>
diff --git a/phpstan.neon b/phpstan.neon
new file mode 100644
index 0000000..00b655a
--- /dev/null
+++ b/phpstan.neon
@@ -0,0 +1,23 @@
+parameters:
+  level: max
+  reportUnmatchedIgnoredErrors: false
+  paths:
+    - src
+  ignoreErrors:
+    # PHPMD annotations (@SuppressWarnings(PHPMD.X)) are not PHPStan tags.
+    -
+      identifier: phpDoc.parseError
+      message: '#@SuppressWarnings#'
+    # Aura\Html\HelperLocator exposes helpers via __get/__call magic methods.
+    -
+      identifier: method.notFound
+      message: '#Aura\\Html\\HelperLocator::(input|form)#'
+      path: src/AbstractForm.php
+    # SetAntiCsrfTrait is part of the public API for consumers to compose.
+    -
+      identifier: trait.unused
+      path: src/SetAntiCsrfTrait.php
+    # AbstractForm narrows Fieldset::$filter (FilterInterface) to SubjectFilter for typed filter access.
+    -
+      identifier: property.phpDocType
+      message: '#AbstractForm::\$filter#'
diff --git a/psalm.xml b/psalm.xml
new file mode 100644
index 0000000..18f8e1d
--- /dev/null
+++ b/psalm.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<psalm
+    errorLevel="4"
+    resolveFromConfigFile="true"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns="https://getpsalm.org/schema/config"
+    xsi:schemaLocation="https://getpsalm.org/schema/config vendor/vimeo/psalm/config.xsd"
+    findUnusedBaselineEntry="true"
+    findUnusedCode="false"
+>
+    <projectFiles>
+        <directory name="src" />
+    </projectFiles>
+    <issueHandlers>
+        <!-- The Override attribute requires PHP 8.3+, but this package targets PHP 8.0+. -->
+        <MissingOverrideAttribute errorLevel="suppress" />
+        <!-- Aura\Html\HelperLocator exposes helpers via __get/__call magic methods. -->
+        <UndefinedMagicMethod>
+            <errorLevel type="suppress">
+                <referencedMethod name="Aura\Html\HelperLocator::input" />
+                <referencedMethod name="Aura\Html\HelperLocator::form" />
+            </errorLevel>
+        </UndefinedMagicMethod>
+        <!-- AntiCsrfInterface::isValid declares array<array-key, mixed>; our implementation accepts the same shape via array<string, mixed>. -->
+        <MoreSpecificImplementedParamType>
+            <errorLevel type="suppress">
+                <file name="src/AntiCsrf.php" />
+            </errorLevel>
+        </MoreSpecificImplementedParamType>
+    </issueHandlers>
+</psalm>
diff --git a/src/AbstractForm.php b/src/AbstractForm.php
index 2274021..4a0431f 100644
--- a/src/AbstractForm.php
+++ b/src/AbstractForm.php
@@ -2,41 +2,44 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 use ArrayIterator;
+use Aura\Filter\Failure\FailureCollection;
 use Aura\Filter\FilterFactory;
 use Aura\Filter\SubjectFilter;
+use Aura\Html\Exception\HelperNotFound;
 use Aura\Html\HelperLocator;
 use Aura\Html\HelperLocatorFactory;
 use Aura\Input\AntiCsrfInterface;
+use Aura\Input\Builder;
 use Aura\Input\BuilderInterface;
+use Aura\Input\Exception\NoSuchInput;
 use Aura\Input\Fieldset;
-use Exception;
 use Ray\Di\Di\Inject;
 use Ray\Di\Di\PostConstruct;
 use Ray\WebFormModule\Exception\CsrfViolationException;
 use Ray\WebFormModule\Exception\LogicException;
+use Stringable;
+use Throwable;
 
+use function assert;
+use function is_string;
 use function trigger_error;
 
+use const E_USER_ERROR;
+use const PHP_EOL;
+
+/** @SuppressWarnings(PHPMD.CouplingBetweenObjects) */
 abstract class AbstractForm extends Fieldset implements FormInterface
 {
     /** @var SubjectFilter */
     protected $filter;
 
-    /** @var array<string, list<string>>|null */
-    protected ?array $errorMessages = null;
-
+    /** @var array<string, array<int, string>>|null */
+    protected array|null $errorMessages = null;
     protected HelperLocator $helper;
-
-    protected ?AntiCsrfInterface $antiCsrf = null;
+    protected AntiCsrfInterface|null $antiCsrf = null;
 
     public function __construct()
     {
@@ -50,10 +53,8 @@ public function __clone()
 
     /**
      * Return form markup string
-     *
-     * @return string
      */
-    public function __toString()
+    public function __toString(): string
     {
         try {
             if (! $this instanceof ToStringInterface) {
@@ -61,24 +62,21 @@ public function __toString()
             }
 
             return $this->toString();
-        } catch (Exception $e) {
+        } catch (Throwable $e) {
             trigger_error($e->getMessage() . PHP_EOL . $e->getTraceAsString(), E_USER_ERROR);
         }
 
-        return '';
+        // Reachable when a custom error handler intercepts E_USER_ERROR without halting.
+        return ''; // @phpstan-ignore deadCode.unreachable
     }
 
-    /**
-     * @param BuilderInterface     $builder
-     * @param FilterFactory        $filterFactory
-     * @param HelperLocatorFactory $helperFactory
-     */
     #[Inject]
     public function setBaseDependencies(
         BuilderInterface $builder,
         FilterFactory $filterFactory,
-        HelperLocatorFactory $helperFactory
+        HelperLocatorFactory $helperFactory,
     ): void {
+        assert($builder instanceof Builder);
         $this->builder = $builder;
         $this->filter = $filterFactory->newSubjectFilter();
         $this->helper = $helperFactory->newInstance();
@@ -89,29 +87,47 @@ public function setAntiCsrf(AntiCsrfInterface $antiCsrf): void
         $this->antiCsrf = $antiCsrf;
     }
 
+    public function enableAntiCsrf(AntiCsrfInterface $antiCsrf): void
+    {
+        $this->antiCsrf = $antiCsrf;
+        if (isset($this->inputs[AntiCsrf::TOKEN_KEY])) {
+            return;
+        }
+
+        $this->antiCsrf->setField($this);
+    }
+
     #[PostConstruct]
     public function postConstruct(): void
     {
         $this->init();
         if ($this->antiCsrf instanceof AntiCsrfInterface) {
-            $this->antiCsrf->setField($this);
+            $this->enableAntiCsrf($this->antiCsrf);
         }
     }
 
-    /** {@inheritdoc} */
-    public function input($input)
+    /** {@inheritDoc} */
+    public function input(string $input): string
     {
-        return $this->helper->input($this->get($input));
+        $inputHtml = $this->helper->input($this->get($input));
+        assert(is_string($inputHtml) || $inputHtml instanceof Stringable);
+
+        return (string) $inputHtml;
     }
 
-    /** {@inheritdoc} */
+    /** {@inheritDoc} */
     public function error(string $input): string
     {
-        if (! $this->errorMessages) {
+        if ($this->errorMessages === null) {
+            /** @var FailureCollection|null $failure */
             $failure = $this->filter->getFailures();
-            if ($failure) {
-                $this->errorMessages = $failure->getMessages();
+            if ($failure === null) {
+                return '';
             }
+
+            /** @var array<string, array<int, string>> $messages */
+            $messages = $failure->getMessages();
+            $this->errorMessages = $messages;
         }
 
         if (isset($this->errorMessages[$input])) {
@@ -122,16 +138,19 @@ public function error(string $input): string
     }
 
     /**
-     * @param array $attr attributes for the form tag
+     * @param array<string, mixed> $attr attributes for the form tag
      *
-     * @throws \Aura\Input\Exception\NoSuchInput
-     * @throws \Aura\Html\Exception\HelperNotFound
+     * @throws NoSuchInput
+     * @throws HelperNotFound
      */
     public function form(array $attr = []): string
     {
+        /** @var string $form */
         $form = $this->helper->form($attr);
         if (isset($this->inputs['__csrf_token'])) {
-            $form .= $this->helper->input($this->get('__csrf_token'));
+            /** @var string $input */
+            $input = $this->helper->input($this->get('__csrf_token'));
+            $form .= $input;
         }
 
         return $form;
@@ -140,14 +159,14 @@ public function form(array $attr = []): string
     /**
      * Applies the filter to a subject.
      *
-     * @param array $data
+     * @param array<string, mixed> $data
      *
      * @throws CsrfViolationException
      */
     public function apply(array $data): bool
     {
         if ($this->antiCsrf && ! $this->antiCsrf->isValid($data)) {
-            throw new CsrfViolationException;
+            throw new CsrfViolationException();
         }
 
         $this->fill($data);
@@ -158,14 +177,27 @@ public function apply(array $data): bool
     /**
      * Returns all failure messages for all fields.
      *
-     * @return list<string>
+     * @return array<string, array<int, string>>
      */
     public function getFailureMessages(): array
     {
-        return $this->filter->getFailures()->getMessages();
+        /** @var FailureCollection|null $failure */
+        $failure = $this->filter->getFailures();
+        if ($failure === null) {
+            return [];
+        }
+
+        /** @var array<string, array<int, string>> $messages */
+        $messages = $failure->getMessages();
+
+        return $messages;
     }
 
-    /** Returns all the fields collection */
+    /**
+     * Returns all the fields collection
+     *
+     * @return ArrayIterator<string, mixed>
+     */
     public function getIterator(): ArrayIterator
     {
         return new ArrayIterator($this->inputs);
diff --git a/src/Annotation/AbstractValidation.php b/src/Annotation/AbstractValidation.php
index b866cf3..8669808 100644
--- a/src/Annotation/AbstractValidation.php
+++ b/src/Annotation/AbstractValidation.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule\Annotation;
 
 abstract class AbstractValidation
diff --git a/src/Annotation/CsrfProtection.php b/src/Annotation/CsrfProtection.php
new file mode 100644
index 0000000..c40a0a4
--- /dev/null
+++ b/src/Annotation/CsrfProtection.php
@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Ray\WebFormModule\Annotation;
+
+use Attribute;
+
+#[Attribute(Attribute::TARGET_METHOD)]
+final class CsrfProtection
+{
+}
diff --git a/src/Annotation/FormValidation.php b/src/Annotation/FormValidation.php
index 3c61219..c852267 100644
--- a/src/Annotation/FormValidation.php
+++ b/src/Annotation/FormValidation.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule\Annotation;
 
 use Attribute;
@@ -17,8 +11,7 @@ final class FormValidation extends AbstractValidation
 {
     public function __construct(
         string $form = 'form',
-        public bool $antiCsrf = false,
-        public string|null $onFailure = null
+        public string|null $onFailure = null,
     ) {
         parent::__construct($form);
     }
diff --git a/src/Annotation/InputValidation.php b/src/Annotation/InputValidation.php
index 71ef33c..77c1407 100644
--- a/src/Annotation/InputValidation.php
+++ b/src/Annotation/InputValidation.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule\Annotation;
 
 use Attribute;
diff --git a/src/Annotation/VndError.php b/src/Annotation/VndError.php
index 5c35e64..34c5a56 100644
--- a/src/Annotation/VndError.php
+++ b/src/Annotation/VndError.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule\Annotation;
 
 use Attribute;
@@ -26,7 +20,7 @@ public function __construct(
         public string $message = '',
         public array $href = [],
         public string|null $logref = null,
-        public string|null $path = null
+        public string|null $path = null,
     ) {
     }
 }
diff --git a/src/AntiCsrf.php b/src/AntiCsrf.php
index bec9e6a..df4f16d 100644
--- a/src/AntiCsrf.php
+++ b/src/AntiCsrf.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 use Aura\Input\AntiCsrfInterface;
@@ -26,11 +20,8 @@ final class AntiCsrf implements AntiCsrfInterface
 
     private bool $isCli;
 
-    private Session $session;
-
-    public function __construct(Session $session, bool|null $isCli = null)
+    public function __construct(private Session $session, bool|null $isCli = null)
     {
-        $this->session = $session;
         $this->isCli = is_bool($isCli) ? $isCli : PHP_SAPI === 'cli';
     }
 
@@ -40,7 +31,7 @@ public function setField(Fieldset $fieldset): void
             ->setAttribs(['value' => $this->getToken()]);
     }
 
-    /** @param array $data */
+    /** @param array<string, mixed> $data */
     public function isValid(array $data): bool
     {
         if ($this->isCli) {
diff --git a/src/AuraInputInterceptor.php b/src/AuraInputInterceptor.php
index 697693a..676ae74 100644
--- a/src/AuraInputInterceptor.php
+++ b/src/AuraInputInterceptor.php
@@ -2,17 +2,14 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
+use Aura\Input\AntiCsrfInterface;
 use Ray\Aop\MethodInterceptor;
 use Ray\Aop\MethodInvocation;
+use Ray\Di\Di\Inject;
 use Ray\WebFormModule\Annotation\AbstractValidation;
+use Ray\WebFormModule\Annotation\CsrfProtection;
 use Ray\WebFormModule\Exception\InvalidArgumentException;
 use Ray\WebFormModule\Exception\InvalidFormPropertyException;
 use ReflectionAttribute;
@@ -22,17 +19,27 @@
 use function array_shift;
 use function property_exists;
 
+/** @SuppressWarnings(PHPMD.CouplingBetweenObjects) */
 class AuraInputInterceptor implements MethodInterceptor
 {
     protected FailureHandlerInterface $failureHandler;
+    private AntiCsrfInterface|null $antiCsrf = null;
 
     public function __construct(FailureHandlerInterface $handler)
     {
         $this->failureHandler = $handler;
     }
 
+    #[Inject]
+    public function setAntiCsrf(AntiCsrfInterface $antiCsrf): void
+    {
+        $this->antiCsrf = $antiCsrf;
+    }
+
     /**
-     * {@inheritdoc}
+     * {@inheritDoc}
+     *
+     * @param MethodInvocation<object> $invocation
      *
      * @throws InvalidArgumentException
      */
@@ -45,8 +52,11 @@ public function invoke(MethodInvocation $invocation)
         }
 
         $form = $this->getFormProperty($formValidation, $object);
+        $this->enableCsrfProtection($invocation->getMethod(), $form);
         $data = $form instanceof SubmitInterface ? $form->submit() : $this->getNamedArguments($invocation);
-        $isValid = $this->isValid($data, $form);
+        /** @var array<string, mixed> $submit */
+        $submit = (array) $data;
+        $isValid = $this->isValid($submit, $form);
         if ($isValid === true) {
             return $invocation->proceed();
         }
@@ -54,38 +64,48 @@ public function invoke(MethodInvocation $invocation)
         return $this->failureHandler->handle($formValidation, $invocation, $form);
     }
 
-    private function getValidationAttribute(ReflectionMethod $method): AbstractValidation|null
-    {
-        $attributes = $method->getAttributes(AbstractValidation::class, ReflectionAttribute::IS_INSTANCEOF);
-        if ($attributes === []) {
-            return null;
-        }
-
-        $instance = $attributes[0]->newInstance();
-        assert($instance instanceof AbstractValidation);
-
-        return $instance;
-    }
-
     /**
-     * @param array        $submit
-     * @param AbstractForm $form
+     * @param array<string, mixed> $submit
      *
-     * @return bool
      * @throws Exception\CsrfViolationException
-     *
      */
     public function isValid(array $submit, AbstractForm $form): bool
     {
         return $form->apply($submit);
     }
 
+    /** @throws InvalidArgumentException */
+    private function enableCsrfProtection(ReflectionMethod $method, AbstractForm $form): void
+    {
+        if ($method->getAttributes(CsrfProtection::class) === []) {
+            return;
+        }
+
+        if (! $this->antiCsrf instanceof AntiCsrfInterface) {
+            throw new InvalidArgumentException('#[CsrfProtection] requires AntiCsrfInterface');
+        }
+
+        $form->enableAntiCsrf($this->antiCsrf);
+    }
+
+    private function getValidationAttribute(ReflectionMethod $method): AbstractValidation|null
+    {
+        $attributes = $method->getAttributes(AbstractValidation::class, ReflectionAttribute::IS_INSTANCEOF);
+        if ($attributes === []) {
+            return null;
+        }
+
+        return $attributes[0]->newInstance();
+    }
+
     /**
      * Return arguments as named arguments.
      *
-     * @param MethodInvocation $invocation
+     * @param MethodInvocation<object> $invocation
+     *
+     * @return array<string, mixed>
      *
-     * @return array
+     * @SuppressWarnings(PHPMD.Superglobals)
      */
     private function getNamedArguments(MethodInvocation $invocation): array
     {
@@ -97,7 +117,6 @@ private function getNamedArguments(MethodInvocation $invocation): array
             $submit[$param->getName()] = $arg;
         }
 
-        // has token?
         if (isset($_POST[AntiCsrf::TOKEN_KEY])) {
             $submit[AntiCsrf::TOKEN_KEY] = $_POST[AntiCsrf::TOKEN_KEY];
         }
@@ -105,15 +124,7 @@ private function getNamedArguments(MethodInvocation $invocation): array
         return $submit;
     }
 
-    /**
-     * Return form property
-     *
-     * @param AbstractValidation $formValidation
-     * @param object             $object
-     *
-     * @return mixed
-     */
-    private function getFormProperty(AbstractValidation $formValidation, $object)
+    private function getFormProperty(AbstractValidation $formValidation, object $object): AbstractForm
     {
         if (! property_exists($object, $formValidation->form)) {
             throw new InvalidFormPropertyException($formValidation->form);
diff --git a/src/AuraInputModule.php b/src/AuraInputModule.php
index d2f56d6..dc09b81 100644
--- a/src/AuraInputModule.php
+++ b/src/AuraInputModule.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 use Aura\Filter\FilterFactory;
@@ -23,12 +17,13 @@
 use Ray\WebFormModule\Annotation\FormValidation;
 use Ray\WebFormModule\Annotation\InputValidation;
 
+/** @SuppressWarnings(PHPMD.CouplingBetweenObjects) */
 class AuraInputModule extends AbstractModule
 {
-    /** {@inheritdoc} */
+    /** {@inheritDoc} */
     protected function configure()
     {
-        $this->install(new AuraSessionModule);
+        $this->install(new AuraSessionModule());
         $this->bind(BuilderInterface::class)->to(Builder::class);
         $this->bind(FilterInterface::class)->to(Filter::class);
         $this->bind(AntiCsrfInterface::class)->to(AntiCsrf::class)->in(Scope::SINGLETON);
@@ -40,12 +35,12 @@ protected function configure()
         $this->bindInterceptor(
             $this->matcher->any(),
             $this->matcher->annotatedWith(InputValidation::class),
-            [InputValidationInterceptor::class]
+            [InputValidationInterceptor::class],
         );
         $this->bindInterceptor(
             $this->matcher->any(),
             $this->matcher->annotatedWith(FormValidation::class),
-            [AuraInputInterceptor::class]
+            [AuraInputInterceptor::class],
         );
     }
 }
diff --git a/src/Exception/CsrfViolationException.php b/src/Exception/CsrfViolationException.php
index c97b0b3..3fe1bc2 100644
--- a/src/Exception/CsrfViolationException.php
+++ b/src/Exception/CsrfViolationException.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule\Exception;
 
 use Aura\Input\Exception\CsrfViolation;
diff --git a/src/Exception/ExceptionInterface.php b/src/Exception/ExceptionInterface.php
index 237ca9d..495601e 100644
--- a/src/Exception/ExceptionInterface.php
+++ b/src/Exception/ExceptionInterface.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule\Exception;
 
 interface ExceptionInterface
diff --git a/src/Exception/InvalidArgumentException.php b/src/Exception/InvalidArgumentException.php
index 5afa83d..0c1cfcf 100644
--- a/src/Exception/InvalidArgumentException.php
+++ b/src/Exception/InvalidArgumentException.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule\Exception;
 
 class InvalidArgumentException extends \InvalidArgumentException implements ExceptionInterface
diff --git a/src/Exception/InvalidFormPropertyException.php b/src/Exception/InvalidFormPropertyException.php
index a17cfc6..b11db09 100644
--- a/src/Exception/InvalidFormPropertyException.php
+++ b/src/Exception/InvalidFormPropertyException.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule\Exception;
 
 class InvalidFormPropertyException extends LogicException
diff --git a/src/Exception/InvalidOnFailureMethod.php b/src/Exception/InvalidOnFailureMethod.php
index c4f0ea2..002b52a 100644
--- a/src/Exception/InvalidOnFailureMethod.php
+++ b/src/Exception/InvalidOnFailureMethod.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule\Exception;
 
 class InvalidOnFailureMethod extends LogicException
diff --git a/src/Exception/LogicException.php b/src/Exception/LogicException.php
index d5ec12c..4a50d27 100644
--- a/src/Exception/LogicException.php
+++ b/src/Exception/LogicException.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule\Exception;
 
 class LogicException extends \LogicException implements ExceptionInterface
diff --git a/src/Exception/RuntimeException.php b/src/Exception/RuntimeException.php
index fe827e8..5ec6384 100644
--- a/src/Exception/RuntimeException.php
+++ b/src/Exception/RuntimeException.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule\Exception;
 
 class RuntimeException extends \RuntimeException implements ExceptionInterface
diff --git a/src/Exception/ValidationException.php b/src/Exception/ValidationException.php
index 1ed951d..86b6a11 100644
--- a/src/Exception/ValidationException.php
+++ b/src/Exception/ValidationException.php
@@ -2,24 +2,16 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule\Exception;
 
 use Exception;
 use Ray\WebFormModule\FormValidationError;
+use Throwable;
 
 class ValidationException extends Exception
 {
-    public $error;
-
-    public function __construct($message = '', $code = 0, ?Exception $e = null, ?FormValidationError $error = null)
+    public function __construct(string $message = '', int $code = 0, Throwable|null $e = null, public FormValidationError|null $error = null)
     {
         parent::__construct($message, $code, $e);
-        $this->error = $error;
     }
 }
diff --git a/src/FailureHandlerInterface.php b/src/FailureHandlerInterface.php
index 948becf..ce0d3f4 100644
--- a/src/FailureHandlerInterface.php
+++ b/src/FailureHandlerInterface.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 use Ray\Aop\MethodInvocation;
@@ -15,5 +9,10 @@
 
 interface FailureHandlerInterface
 {
+    /**
+     * @param MethodInvocation<object> $invocation
+     *
+     * @return mixed
+     */
     public function handle(AbstractValidation $formValidation, MethodInvocation $invocation, AbstractForm $form);
 }
diff --git a/src/FormFactory.php b/src/FormFactory.php
index ed12a80..5fcd813 100644
--- a/src/FormFactory.php
+++ b/src/FormFactory.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 use Aura\Filter\FilterFactory;
@@ -16,11 +10,14 @@
 
 final class FormFactory
 {
+    /**
+     * @psalm-param class-string<AbstractForm> $class
+     * @phpstan-param class-string<AbstractForm> $class
+     */
     public function newInstance(string $class): AbstractForm
     {
-        /** @var $form AbstractForm */
-        $form = new $class;
-        $form->setBaseDependencies(new Builder, new FilterFactory, new HelperLocatorFactory);
+        $form = new $class();
+        $form->setBaseDependencies(new Builder(), new FilterFactory(), new HelperLocatorFactory());
         $form->postConstruct();
 
         return $form;
diff --git a/src/FormInterface.php b/src/FormInterface.php
index 5e36178..0caf3e8 100644
--- a/src/FormInterface.php
+++ b/src/FormInterface.php
@@ -2,21 +2,18 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
+use Aura\Input\Exception\NoSuchInput;
+
 interface FormInterface
 {
     /**
      * Return input element html
      *
      * @return string
-     * @throws \Aura\Input\Exception\NoSuchInput
+     *
+     * @throws NoSuchInput
      */
     public function input(string $input);
 
diff --git a/src/FormValidationError.php b/src/FormValidationError.php
index 6cdec60..77929e3 100644
--- a/src/FormValidationError.php
+++ b/src/FormValidationError.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 use function json_encode;
@@ -17,15 +11,13 @@
 
 class FormValidationError
 {
-    private array $value;
-
-    public function __construct(array $value)
+    /** @param array<string, mixed> $value */
+    public function __construct(private array $value)
     {
-        $this->value = $value;
     }
 
-    public function __toString()
+    public function __toString(): string
     {
-        return json_encode($this->value, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
+        return (string) json_encode($this->value, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
     }
 }
diff --git a/src/FormVndErrorModule.php b/src/FormVndErrorModule.php
index a4064b2..2db7c3b 100644
--- a/src/FormVndErrorModule.php
+++ b/src/FormVndErrorModule.php
@@ -2,19 +2,13 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 use Ray\Di\AbstractModule;
 
 class FormVndErrorModule extends AbstractModule
 {
-    /** {@inheritdoc} */
+    /** {@inheritDoc} */
     protected function configure()
     {
         $this->bind(FailureHandlerInterface::class)->to(VndErrorHandler::class);
diff --git a/src/InputValidationInterceptor.php b/src/InputValidationInterceptor.php
index e59098e..81f2261 100644
--- a/src/InputValidationInterceptor.php
+++ b/src/InputValidationInterceptor.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 use Ray\Di\Di\Named;
@@ -15,7 +9,7 @@
 class InputValidationInterceptor extends AuraInputInterceptor
 {
     public function __construct(
-        #[Named("vnd_error")]
+        #[Named('vnd_error')]
         FailureHandlerInterface $handler,
     ) {
         parent::__construct($handler);
diff --git a/src/OnFailureMethodHandler.php b/src/OnFailureMethodHandler.php
index 77ff764..e7aa796 100644
--- a/src/OnFailureMethodHandler.php
+++ b/src/OnFailureMethodHandler.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 use Ray\Aop\MethodInvocation;
@@ -16,13 +10,18 @@
 use Ray\WebFormModule\Exception\InvalidOnFailureMethod;
 
 use function call_user_func_array;
+use function get_class;
 use function method_exists;
 
 final class OnFailureMethodHandler implements FailureHandlerInterface
 {
     public const FAILURE_SUFFIX = 'ValidationFailed';
 
-    /** {@inheritdoc} */
+    /**
+     * {@inheritDoc}
+     *
+     * @param MethodInvocation<object> $invocation
+     */
     public function handle(AbstractValidation $formValidation, MethodInvocation $invocation, AbstractForm $form)
     {
         unset($form);
@@ -37,6 +36,9 @@ public function handle(AbstractValidation $formValidation, MethodInvocation $inv
             throw new InvalidOnFailureMethod(get_class($invocation->getThis()));
         }
 
-        return call_user_func_array([$invocation->getThis(), $onFailureMethod], $args);
+        /** @var callable $callable */
+        $callable = [$object, $onFailureMethod];
+
+        return call_user_func_array($callable, $args);
     }
 }
diff --git a/src/SetAntiCsrfTrait.php b/src/SetAntiCsrfTrait.php
index e3fb26b..cee30ae 100644
--- a/src/SetAntiCsrfTrait.php
+++ b/src/SetAntiCsrfTrait.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 use Aura\Input\AntiCsrfInterface;
diff --git a/src/SubmitInterface.php b/src/SubmitInterface.php
index 10db621..c9360f7 100644
--- a/src/SubmitInterface.php
+++ b/src/SubmitInterface.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 interface SubmitInterface
@@ -15,7 +9,7 @@ interface SubmitInterface
     /**
      * Return subject value
      *
-     * @return array|object
+     * @return array<string, mixed>|object
      */
     public function submit();
 }
diff --git a/src/ToStringInterface.php b/src/ToStringInterface.php
index 22ed248..852af69 100644
--- a/src/ToStringInterface.php
+++ b/src/ToStringInterface.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 /** Return form markup string */
diff --git a/src/VndErrorHandler.php b/src/VndErrorHandler.php
index 429a6f9..23a0555 100644
--- a/src/VndErrorHandler.php
+++ b/src/VndErrorHandler.php
@@ -2,12 +2,6 @@
 
 declare(strict_types=1);
 
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
-
 namespace Ray\WebFormModule;
 
 use Ray\Aop\MethodInvocation;
@@ -18,7 +12,11 @@
 
 final class VndErrorHandler implements FailureHandlerInterface
 {
-    /** {@inheritdoc} */
+    /**
+     * {@inheritDoc}
+     *
+     * @param MethodInvocation<object> $invocation
+     */
     public function handle(AbstractValidation $formValidation, MethodInvocation $invocation, AbstractForm $form)
     {
         unset($formValidation);
@@ -35,23 +33,25 @@ private function getVndErrorAttribute(ReflectionMethod $method): VndError|null
             return null;
         }
 
-        $instance = $attributes[0]->newInstance();
-        assert($instance instanceof VndError);
-
-        return $instance;
+        return $attributes[0]->newInstance();
     }
 
-    private function makeVndError(AbstractForm $form, ?VndError $vndError = null)
+    /**
+     * @return array<string, mixed>
+     *
+     * @SuppressWarnings(PHPMD.Superglobals)
+     */
+    private function makeVndError(AbstractForm $form, VndError|null $vndError = null): array
     {
         $body = ['message' => 'Validation failed'];
         $body['path'] = $_SERVER['PATH_INFO'] ?? '';
         $body['validation_messages'] = $form->getFailureMessages();
-        $body = $vndError ? $this->optionalAttribute($vndError) + $body : $body;
 
-        return $body;
+        return $vndError ? $this->optionalAttribute($vndError) + $body : $body;
     }
 
-    private function optionalAttribute(VndError $vndError)
+    /** @return array<string, mixed> */
+    private function optionalAttribute(VndError $vndError): array
     {
         $body = [];
         if ($vndError->message) {
diff --git a/tests/AbstractAuraFormTest.php b/tests/AbstractAuraFormTest.php
index 16862dd..5f48111 100644
--- a/tests/AbstractAuraFormTest.php
+++ b/tests/AbstractAuraFormTest.php
@@ -1,24 +1,26 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
+
+declare(strict_types=1);
+
 namespace Ray\WebFormModule;
 
 use PHPUnit\Framework\TestCase;
 
+use function restore_error_handler;
+use function set_error_handler;
+
+use const PHP_EOL;
+
 class AbstractAuraFormTest extends TestCase
 {
-    /**
-     * @var AbstractForm
-     */
+    /** @var AbstractForm */
     private $form;
 
     public function setUp(): void
     {
         parent::setUp();
-        $this->form = (new FormFactory)->newInstance(FakeForm::class);
+
+        $this->form = (new FormFactory())->newInstance(FakeForm::class);
     }
 
     public function testForm()
@@ -29,7 +31,7 @@ public function testForm()
 
     public function testAntiCsrfForm()
     {
-        $this->form->setAntiCsrf(new FakeAntiCsrf);
+        $this->form->setAntiCsrf(new FakeAntiCsrf());
         $this->form->postConstruct();
         $formHtml = $this->form->form();
         $this->assertSame('<form method="post" enctype="multipart/form-data"><input type="hidden" name="__csrf_token" value="goodvalue" />' . PHP_EOL, $formHtml);
@@ -41,7 +43,7 @@ public function testInput()
         $this->assertSame('<input id="name" type="text" name="name" />' . PHP_EOL, (string) $name);
     }
 
-    public function testError()
+    public function testError(): string
     {
         $this->form->fill([]);
         $data = ['name' => '@invalid@'];
@@ -49,28 +51,25 @@ public function testError()
         $this->assertFalse($isValid);
         $error = $this->form->error('name');
         $this->assertSame('Name must be alphabetic only.', $error);
-        $html = (string) $this->form;
 
-        return $html;
+        return (string) $this->form;
     }
 
-    /**
-     * @depends testError
-     */
-    public function tesetInputDataReamainedOnValidationFailure($html)
+    /** @depends testError */
+    public function testInputDataRemainedOnValidationFailure(string $html): void
     {
         $expected = '<input id="name" type="text" name="name" value="@invalid@" />';
-        $this->assertContains($expected, $html);
+        $this->assertStringContainsString($expected, $html);
     }
 
     public function testNotToStringImplemented()
     {
         $errNo = $errStr = '';
-        set_error_handler(function (int $no, string $str) use (&$errNo, &$errStr) {
+        set_error_handler(static function (int $no, string $str) use (&$errNo, &$errStr) {
             $errNo = $no;
             $errStr = $str;
         });
-        $form = new FakeErrorForm;
+        $form = new FakeErrorForm();
         (string) $form;
         $this->assertSame(256, $errNo);
         restore_error_handler();
diff --git a/tests/AbstractFormTest.php b/tests/AbstractFormTest.php
index 86e8263..c306eb2 100644
--- a/tests/AbstractFormTest.php
+++ b/tests/AbstractFormTest.php
@@ -1,9 +1,7 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
+
+declare(strict_types=1);
+
 namespace Ray\WebFormModule;
 
 use Aura\Session\CsrfTokenFactory;
@@ -11,33 +9,34 @@
 use Aura\Session\Randval;
 use Aura\Session\SegmentFactory;
 use Aura\Session\Session;
+use Iterator;
 use PHPUnit\Framework\TestCase;
 use Ray\Aop\ReflectiveMethodInvocation;
 use Ray\WebFormModule\Exception\CsrfViolationException;
 use Ray\WebFormModule\Exception\ValidationException;
+use ReflectionProperty;
+
+use function spl_object_hash;
 
 class AbstractFormTest extends TestCase
 {
-    /**
-     * @var AbstractForm
-     */
+    /** @var AbstractForm */
     private $form;
 
     public function setUp(): void
     {
         parent::setUp();
-        $this->form = (new FormFactory)->newInstance(FakeMiniForm::class);
+
+        $this->form = (new FormFactory())->newInstance(FakeMiniForm::class);
     }
 
-    /**
-     * @param $method
-     */
-    public function getMethodInvocation(array $arguments)
+    /** @param array<int, mixed> $arguments */
+    public function getMethodInvocation(array $arguments): ReflectiveMethodInvocation
     {
         // form
-        $fakeForm = (new FormFactory)->newInstance(FakeMiniForm::class);
+        $fakeForm = (new FormFactory())->newInstance(FakeMiniForm::class);
         // controller
-        $controller = new FakeController;
+        $controller = new FakeController();
         $controller->setForm($fakeForm);
         // interceptor
         $interceptor = new AuraInputInterceptor(new VndErrorHandler());
@@ -46,9 +45,7 @@ public function getMethodInvocation(array $arguments)
             $controller,
             'createAction',
             $arguments,
-            [
-                $interceptor
-            ]
+            [$interceptor],
         );
     }
 
@@ -76,25 +73,25 @@ public function testErrorReturnEmpty()
     public function testClone()
     {
         $form = clone $this->form;
-        (new \ReflectionProperty($form, 'filter'))->setAccessible(true);
-        (new \ReflectionProperty($this->form, 'filter'))->setAccessible(true);
+        (new ReflectionProperty($form, 'filter'))->setAccessible(true);
+        (new ReflectionProperty($this->form, 'filter'))->setAccessible(true);
         $this->assertNotSame(spl_object_hash($form), spl_object_hash($this->form));
     }
 
     public function testGetItelator()
     {
         $itelator = $this->form->getIterator();
-        $this->assertInstanceOf(\Iterator::class, $itelator);
+        $this->assertInstanceOf(Iterator::class, $itelator);
     }
 
     public function testAntiCsrfViolation()
     {
         $this->expectException(CsrfViolationException::class);
         $session = new Session(
-            new SegmentFactory,
-            new CsrfTokenFactory(new Randval(new Phpfunc)),
-            new FakePhpfunc,
-            []
+            new SegmentFactory(),
+            new CsrfTokenFactory(new Randval(new Phpfunc())),
+            new FakePhpfunc(),
+            [],
         );
         $this->form->setAntiCsrf(new AntiCsrf($session, false));
         $this->form->apply([]);
diff --git a/tests/AntiCsrfTest.php b/tests/AntiCsrfTest.php
index ebb4297..708c81d 100644
--- a/tests/AntiCsrfTest.php
+++ b/tests/AntiCsrfTest.php
@@ -1,9 +1,7 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
+
+declare(strict_types=1);
+
 namespace Ray\WebFormModule;
 
 use Aura\Input\Builder;
@@ -18,21 +16,13 @@
 
 class AntiCsrfTest extends TestCase
 {
-    private $phpfunc;
-
-    /**
-     * @var AntiCsrf
-     */
-    private $antiCsrf;
-
-    /**
-     * @var Session
-     */
-    private $session;
+    private FakePhpfunc $phpfunc;
+    private AntiCsrf $antiCsrf;
+    private Session $session;
 
     protected function setUp(): void
     {
-        $this->phpfunc = new FakePhpfunc;
+        $this->phpfunc = new FakePhpfunc();
         $this->session = $this->newSession();
         $this->antiCsrf = new AntiCsrf($this->newSession([]), false, [AntiCsrf::TOKEN_KEY => AntiCsrf::TEST_TOKEN]);
     }
@@ -44,7 +34,7 @@ public function testNew()
 
     public function testSetField()
     {
-        $result = $this->antiCsrf->setField(new Fieldset(new Builder, new Filter));
+        $result = $this->antiCsrf->setField(new Fieldset(new Builder(), new Filter()));
         $this->assertNull($result);
     }
 
@@ -54,13 +44,14 @@ public function testIsValid()
         $this->assertTrue($this->antiCsrf->isValid($data));
     }
 
-    protected function newSession(array $cookies = [])
+    /** @param array<string, string> $cookies */
+    protected function newSession(array $cookies = []): Session
     {
         return new Session(
-            new SegmentFactory,
+            new SegmentFactory(),
             new CsrfTokenFactory(new Randval(new Phpfunc())),
             $this->phpfunc,
-            $cookies
+            $cookies,
         );
     }
 }
diff --git a/tests/AuraInputInterceptorTest.php b/tests/AuraInputInterceptorTest.php
index 3c1ce68..ff7b065 100644
--- a/tests/AuraInputInterceptorTest.php
+++ b/tests/AuraInputInterceptorTest.php
@@ -1,9 +1,7 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
+
+declare(strict_types=1);
+
 namespace Ray\WebFormModule;
 
 use PHPUnit\Framework\TestCase;
@@ -15,23 +13,20 @@
 
 class AuraInputInterceptorTest extends TestCase
 {
-    /**
-     * @var InjectorInterface
-     */
+    /** @var InjectorInterface */
     private $injector;
 
-    /**
-     * @var FakeController
-     */
+    /** @var FakeController */
     private $controller;
 
     public function setUp(): void
     {
-        $this->injector = new Injector(new class() extends AbstractModule {
+        $this->injector = new Injector(new class () extends AbstractModule {
             protected function configure()
             {
-                $this->install(new AuraInputModule);
+                $this->install(new AuraInputModule());
                 $this->bind(FormInterface::class)->annotatedWith('contact_form')->to(FakeForm::class);
+                $this->bind(FormInterface::class)->annotatedWith('mini_form')->to(FakeMiniForm::class);
             }
         });
         $this->controller = $this->injector->getInstance(FakeController::class);
@@ -49,6 +44,18 @@ public function testProceed()
         $this->assertSame('201', $result);
     }
 
+    public function testCsrfProtectionAttributeEnablesAntiCsrf()
+    {
+        /** @var FakeCsrfController $controller */
+        $controller = $this->injector->getInstance(FakeCsrfController::class);
+        $this->assertStringNotContainsString(AntiCsrf::TOKEN_KEY, $controller->formHtml());
+
+        $result = $controller->createAction('BEAR');
+
+        $this->assertSame('201', $result);
+        $this->assertStringContainsString(AntiCsrf::TOKEN_KEY, $controller->formHtml());
+    }
+
     public function testInvalidFormPropertyByMissingProperty()
     {
         $this->expectException(InvalidFormPropertyException::class);
diff --git a/tests/AuraInputModuleTest.php b/tests/AuraInputModuleTest.php
index 47add84..d08deed 100644
--- a/tests/AuraInputModuleTest.php
+++ b/tests/AuraInputModuleTest.php
@@ -1,9 +1,7 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
+
+declare(strict_types=1);
+
 namespace Ray\WebFormModule;
 
 use PHPUnit\Framework\TestCase;
@@ -15,7 +13,7 @@ class AuraInputModuleTest extends TestCase
 {
     public function testAuraInputModule()
     {
-        $injector = new Injector(new FakeModule, __DIR__ . '/tmp');
+        $injector = new Injector(new FakeModule(), __DIR__ . '/tmp');
         $controller = $injector->getInstance(FakeController::class);
         $this->assertInstanceOf(WeavedInterface::class, $controller);
     }
@@ -23,8 +21,8 @@ public function testAuraInputModule()
     public function testExceptionOnFailure()
     {
         $this->expectException(ValidationException::class);
-        $injector = new Injector(new FakeModule, __DIR__ . '/tmp');
-        /** @var $controller FakeInputValidationController */
+        $injector = new Injector(new FakeModule(), __DIR__ . '/tmp');
+        /** @var FakeInputValidationController $controller */
         $controller = $injector->getInstance(FakeInputValidationController::class);
         $controller->createAction('');
     }
diff --git a/tests/Fake/FakeCsrfController.php b/tests/Fake/FakeCsrfController.php
new file mode 100644
index 0000000..dbd3962
--- /dev/null
+++ b/tests/Fake/FakeCsrfController.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace Ray\WebFormModule;
+
+use function assert;
+use Ray\Di\Di\Inject;
+use Ray\Di\Di\Named;
+use Ray\WebFormModule\Annotation\CsrfProtection;
+use Ray\WebFormModule\Annotation\FormValidation;
+
+class FakeCsrfController
+{
+    /**
+     * @var FormInterface
+     */
+    protected $form;
+
+    #[Inject]
+    public function setForm(#[Named('mini_form')] FormInterface $form)
+    {
+        $this->form = $form;
+    }
+
+    #[FormValidation]
+    #[CsrfProtection]
+    public function createAction($name)
+    {
+        return '201';
+    }
+
+    public function formHtml() : string
+    {
+        assert($this->form instanceof AbstractForm);
+
+        return $this->form->form();
+    }
+}
diff --git a/tests/FormFactoryTest.php b/tests/FormFactoryTest.php
index c8ae411..59d6f2a 100644
--- a/tests/FormFactoryTest.php
+++ b/tests/FormFactoryTest.php
@@ -1,24 +1,21 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
+
+declare(strict_types=1);
+
 namespace Ray\WebFormModule;
 
 use PHPUnit\Framework\TestCase;
 
 class FormFactoryTest extends TestCase
 {
-    /**
-     * @var FormFactory
-     */
+    /** @var FormFactory */
     private $factory;
 
     public function setUp(): void
     {
         parent::setUp();
-        $this->factory = new FormFactory;
+
+        $this->factory = new FormFactory();
     }
 
     public function testNewInstance()
diff --git a/tests/VndErrorHandlerTest.php b/tests/VndErrorHandlerTest.php
index c8b888e..4db8b3b 100644
--- a/tests/VndErrorHandlerTest.php
+++ b/tests/VndErrorHandlerTest.php
@@ -1,9 +1,7 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
+
+declare(strict_types=1);
+
 namespace Ray\WebFormModule;
 
 use PHPUnit\Framework\TestCase;
@@ -12,15 +10,14 @@
 
 class VndErrorHandlerTest extends TestCase
 {
-    /**
-     * @var FakeController
-     */
+    /** @var FakeController */
     private $controller;
 
     public function setUp(): void
     {
         parent::setUp();
-        $this->controller = (new Injector(new FakeVndErrorModule, __DIR__ . '/tmp'))->getInstance(FakeController::class);
+
+        $this->controller = (new Injector(new FakeVndErrorModule(), __DIR__ . '/tmp'))->getInstance(FakeController::class);
     }
 
     public function testValidationException()
@@ -49,8 +46,8 @@ public function testValidationExceptionError()
 
     public function testVndErrorAnnotation()
     {
-        /** @var $controller FakeControllerVndError */
-        $controller = (new Injector(new FakeVndErrorModule))->getInstance(FakeControllerVndError::class);
+        /** @var FakeControllerVndError $controller */
+        $controller = (new Injector(new FakeVndErrorModule()))->getInstance(FakeControllerVndError::class);
         try {
             $controller->createAction('');
         } catch (ValidationException $e) {
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
index adacf3f..ab50824 100644
--- a/tests/bootstrap.php
+++ b/tests/bootstrap.php
@@ -1,17 +1,17 @@
 <?php
-/**
- * This file is part of the Ray.WebFormModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
- */
+
+declare(strict_types=1);
+
+use Ray\WebFormModule\FakeSessionHandler;
+
 require dirname(__DIR__) . '/vendor/autoload.php';
 
-$handler = new \Ray\WebFormModule\FakeSessionHandler();
+$handler = new FakeSessionHandler();
 session_set_save_handler(
     [$handler, 'open'],
     [$handler, 'close'],
     [$handler, 'read'],
     [$handler, 'write'],
     [$handler, 'destroy'],
-    [$handler, 'gc']
+    [$handler, 'gc'],
 );