Changelog

Fix Fix / Feature

A form's auto-injected

Fix Fix / Feature

Fix: the second tag generator and the guessed injection were removed. A form's js is now rendered once by render_js (single source = js.html), exposed at two coherent points: in full-form it is emitted last in the html (after the fields it drives); in field-by-field a new explicit accessor {% form.x.js %} (Django {{ form.media }} style) emits the same block — real CSP nonce and resolved static URL, regardless of how many add_js files. No more dead Tera tags, no more silent failure: the dev places {% form.x.js %} wherever they want when rendering fields one by one. Honeypot and CSRF keep their anchors (first / last field) unchanged