Laravel Eloquent 12

Apply the Laravel 12 prompt first, including its PHP 8.4 baseline. These rules cover Laravel Eloquent 12 query construction, assignment and casts, scopes, relationships, model lifecycle, transactions, serialization, and database operation.

Query construction and bounded execution

• Validate the scalar or list shape expected by where(), whereIn(), and find() before passing input to them; reject an array where a single identifier is required instead of silently changing the query's meaning or result shape.
• Group caller-controlled alternatives inside where(function (...) { ... }), especially after relationship methods such as $user->posts(); an ungrouped orWhere() can escape the parent foreign-key condition or other mandatory predicates.
• Allowlist relation and aggregate names exposed through with(), load(), withCount(), and morph-loading APIs; cap relation depth, rows, columns, page sizes, and total query work. Neither get() nor Model::all() supplies a result limit.
• Use chunkById() or lazyById() when updating rows used by an iteration's filter, group existing alternatives before their added ID condition, and keep pagination keys and relationship keys stable during traversal.
• Use bounded lazy() batches for very large exports when cursor() would retain PDO-buffered results; cursor() also cannot eager load relationships. Enable Model::preventLazyLoading() in development and CI to expose unintended relationship queries.

Assignment, casts, and copied models

• Validate and allowlist both the lookup attributes and creation/update