Extract DROP-clause builders and a shared applyDropClause() dispatcher
so dropPrimary, dropTimestamps, dropIndex, dropUnique, and dropForeign
emit a complete ALTER TABLE … DROP … statement when called directly
(e.g. Schema::dropPrimary('orders')) instead of an empty header.
Edit-mode aggregation via Schema::edit() is unchanged. Remove the now-
invalid Limitations docs that documented these as edit-only helpers.

Assisted-By: AI

Assisted-By: AI

The fallback path in QueryBuilder::bulkInsert() — triggered when the
post-insert re-query hydrates nothing — returned a bare int[] instead of a
Collection, breaking the documented contract. Wrap $ids in new Collection($ids)
so callers receive a consistent Collection regardless of path.

Element-type caveat: Collection elements are Model instances on the happy path
(re-query succeeded) and ints (inserted IDs) on the fallback. foreach/count()
are unaffected; is_array()/empty() now return false on the fallback.

Docs: remove the Limitations bullet that documented the bug; update the
bulk-insert code comment to note the element-type distinction.

Assisted-By: AI

Assisted-By: AI

Adds a real static method Schema::withWpPrefix() that sets the Schema
prefix to Connection::getPrefix() (wp_ + plugin prefix), giving authors
a zero-BC way to create tables that match Model table names.

Default behaviour (bare table name) is unchanged: Schema::create('orders')
still emits CREATE TABLE IF NOT EXISTS orders. The BC guard test locks this.

Docs: reframe the prefix Limitations bullet in usage.md and schema.md from
"does not auto-apply" to "by design bare", and document the new method in
the Table operations table with a code example.

Assisted-By: AI

Assisted-By: AI

Prevents AND/OR precedence leak when orWhere is combined with the
auto-scope or onlyTrashed, which could expose trashed rows.

Assisted-By: AI

3e5db3a dropped the leading Connection::wpPrefix() from join() to stop
default-prefix models double-prefixing. That broke custom-$prefix models
(e.g. bit-crm): Model::getPrefix() returns the raw $prefix without wp_, so
join/pivot tables lost the wp_ prefix and pointed at the wrong table.

Add Model::getTablePrefix() -- the full prefix (wp_ plus plugin prefix)
that mirrors how the constructor builds $this->table -- and route the
constructor, join(), and the pivot select/join helper through it.
getPrefix() is unchanged (public API). Default-prefix models stay
byte-identical (getTablePrefix() === getPrefix()); custom-prefix joins and
pivots regain wp_.

Also simplify the pivot helper: applyPivotSelectAndJoin() returns
[pivot, pivotRef, alias] so callers stop recomputing them.

Assisted-By: AI

save()/update() encode array and object attribute values via
wp_json_encode(), but bulkInsert() (insert([[...],[...]])) and upsert()
bound them raw -- an array became the literal "Array" and an object threw
"could not be converted to string". Mirror the save() encoding in both bulk
value builders so callers don't have to wp_json_encode() manually.

Scalars are unchanged; repairs already-broken output (zero-BC).

Assisted-By: AI

…oin fix

- Note that array/object values are JSON-encoded across save/update/insert/
  bulk insert/upsert (usage + breaking-changes §3).
- Note join() prepends the model's full table prefix; add getTablePrefix()
  to the additions list and a §3 behavioral note for the custom-$prefix fix.
- Drop the now-stale pivot limitation claiming custom-$prefix is unsupported.

Assisted-By: AI

prepareColumnName() wrapped the whole "title AS t" string as a single
identifier (`table`.`title AS t`), so select(['col AS alias']) produced
"Unknown column 'table.col AS alias'" errors. Split on ` AS `
(case-insensitive): qualify the column, keep the alias as a separate
back-ticked identifier -> `table`.`col` AS `alias`. Plain/dotted columns and
`*` are unchanged; raw expressions and function calls still need selectRaw().

Assisted-By: AI

with() builds `foreignKey IN ( SELECT * FROM (<parent>) AS subquery )` from a
clone of the parent query narrowed to the local key. select() resets the
select list but not selectRaw, so a parent selectRaw('... as x') leaked a
second column into the subquery -> MySQL "Operand should contain 1 column(s)".

Strip selectRaw on the key-subquery clone via a shared prepareKeySubquery()
helper, used by both the hasMany/belongsTo and pivot eager paths. Byte-identical
when the parent has no selectRaw.

Assisted-By: AI

The `foreignKey IN ( SELECT key ... )` eager subquery cloned the parent and
stripped selectRaw but kept ORDER BY. A parent ordered by a selectRaw alias
(orderBy('dsc') after selectRaw('... as dsc')) then referenced a column absent
from the narrowed subquery -> "Unknown column in order clause"; and ORDER BY is
meaningless for set membership regardless.

Move prepareKeySubquery onto QueryBuilder (so it can reset the protected
orderBy) and drop ORDER BY unless a LIMIT pins which parent rows the set comes
from. Byte-identical for parents without selectRaw/orderBy.

Assisted-By: AI

…tions

41 tests locking verified current behavior (no source change):
- WhereClauseEdgeTest: whereIn type-placeholders, implicit-IN array value,
  IS NULL, falsy values not dropped, operator/LIKE variants, whereBetween,
  nested-closure binding order, whereRaw/selectRaw/having binding order,
  soft-delete scope binding order through the paren-wrap.
- SelectJoinAggregateEdgeTest: column-alias variants (dotted/lowercase/
  backticked/spaced/multi-as), RIGHT/FULL/CROSS join, on()/orOn() chaining,
  custom-$prefix join ON qualification, count()=COUNT(pk), max/min empty=null,
  aggregate-runs-on-clone, asc() pk fallback.
- RelationEagerEdgeTest: eager/whereHas/withCount constraint closures, multiple
  whereHas, withCount alias, select+withCount no dup, relation alias attach,
  parent filter in eager subquery, eager-on-first().

Assisted-By: AI

…ase 1)

Pure repairs of crashing / invalid-SQL paths plus additive forceDelete/restore;
byte-identical for every currently-working input (momus-reviewed).

- insert(): route to bulk only for a true list-of-rows, so a single row whose
  first value is an array no longer crashes via ksort().
- where/whereIn: null + explicit operator -> IS [NOT] NULL; empty array -> the
  false constant `0 = 1` (was invalid `IN ()`); a nested IN element -> one
  JSON-encoded placeholder; object value -> wp_json_encode (was fatal on prepare).
- empty save() (no dirty columns) skips the malformed `UPDATE ... SET` and
  returns the model (fires saving/saved).
- insert([]) / empty bulk rows / upsert($v, []) no longer emit malformed SQL.
- aggregate(fn, '*') -> COUNT(*) (was invalid COUNT(`t`.*)); count() unchanged.
- forceDelete() (real DELETE bypassing the soft scope) and restore() on
  soft-delete models.
- take()/skip() cast to int -> blocks limit/offset injection.
- eager key subquery also strips the parent's groupBy/having.

Assisted-By: AI

Assisted-By: AI

…d bulk, schema DDL (zero-BC Phase 2)

Behavior-changing fixes verified safe against bit-pi/bit-crm/bit-social/bit-assist
usage (consumers pass only identifiers to order/group by, don't use the cast
aliases, etc.); byte-identical for currently-working inputs (momus-reviewed).

- E2: orderBy()/groupBy() validate the column is a plain identifier
  (`^[A-Za-z0-9_.`]+$`) and throw otherwise -> blocks ORDER BY/GROUP BY
  injection. Valid identifiers emit byte-identical SQL; raw expressions still go
  through orderByRaw().
- B1: cast aliases integer/float/double/json/datetime now map onto the real
  casters (were silent no-ops).
- C1: relation values (Collection / Model / list-of-Model) are excluded from the
  save/update column set -> lazy relation access no longer corrupts a later
  save(); scalar/JSON-array columns still persist.
- C6: bulk insert aligns each row to the header columns by key (was silent
  misalignment for ragged rows); uniform rows unchanged.
- B4: Schema edit-mode unique() emits `ADD UNIQUE INDEX`; renameColumn() in
  edit() emits `RENAME COLUMN`; decimal($p, $s) works (incl. scale 0).

Assisted-By: AI

… ragged bulk)

Assisted-By: AI

An eager-loaded parent with no related rows stored null, so accessing the
relation fell through offsetExists() to a fresh lazy query (the N+1 the eager
load exists to prevent) that returned an empty Collection. Store [] instead:
offsetExists() is true, the resolved-empty value is returned with no extra
query. Empty either way (count 0, falsy); the type now matches a non-empty
eager relation (plain array). No existing test relied on the null.

Assisted-By: AI

A model with $soft_deletes = true now injects deleted_at IS NULL on every
SELECT automatically; trashed rows no longer appear. Opt out with
public $soft_delete_scope = false to restore the unfiltered read.

refresh() reloads a row by its own primary key with withTrashed(), so a
re-hydrated trashed model still reports exists() === true and the next
save() UPDATEs instead of re-INSERTing a duplicate.

Scope is injected on SELECT only; delete/restore/forceDelete/insert/
upsert/aggregate paths are unaffected.

Assisted-By: AI

Add docs/relations.md — a standalone relationship reference covering
hasOne/belongsTo (the shared oneToOne alias and reversed-from-Laravel key
naming), hasMany, belongsToMany pivot relations (signature, key defaults,
withPivot, pivot_* attributes, read-only limits), eager/lazy loading, and
relation aggregates. Linked from README and usage.md; the deep belongsToMany
block and relation Limitations bullets in usage.md now point to it.

Document the soft-delete default flip: usage.md (property table, deleting
section, limitations) and breaking-changes.md (new 2.13 + summary row 13).

Assisted-By: AI

Failing tests pinning the desired behavior for relation-name resolution:
with()/withCount()/whereHas() must reject a non-relation method name with a
RuntimeException, and getActiveRelationKey() must fail loudly on an unknown
relation tag rather than returning a silent null.

These are the RED phase for the not-yet-implemented relation-safety fix
(option alpha) and fail until that guard lands.

Assisted-By: AI

Relation resolution (prepareRelation, the single chokepoint for with/
withCount/whereHas/withWhereHas) previously called any method whose name
matched a relation, gated only by method_exists — letting a framework
Model method (e.g. refresh(), which runs a SELECT) or any consumer no-arg
method run through a relation name, and failing messily on typos.

Now: a name declared on the framework Model is rejected WITHOUT being
called (declaring-class identity via ReflectionMethod, compared to
Model::class so it holds under php-scoper; memoized per class::method); a
consumer-declared method is called and its return validated as a relation
query (QueryBuilder whose model has an active relation key) or rejected
with a RuntimeException. A name that fails method_exists is still silently
skipped (zero-BC for optional/typo'd relation lists).

getActiveRelationKey() now throws on an unknown relation tag instead of
returning a silent null.

Turns the RED RelationResolutionSafetyTest green (216 tests, all pass).

Assisted-By: AI

Add the empirically-confirmed footguns a v1 consumer hits, under their
existing sections:
- 2.1 an is_array($result) "got rows?" guard now inverts (Collection when
  rows exist, [] when empty) -> silent data loss; use empty()/!empty().
- 2.2 $model->update([...])->save() fatals ("save() on false") on a 0-row
  update -> drop the trailing ->save().
- 2.4 a function/expression in select() only "survives" if it contains a
  '.', so CONCAT(url,...) breaks on dotless hosts (localhost); use selectRaw.
- 2.9 a leftover no-arg ->withCount() throws ArgumentCountError, including
  when reached via eager-load relation resolution.

Assisted-By: AI

exec() returns rows-affected (0 for a no-op UPDATE) and false only on a real
DB error or a cancelled pre-event. save()'s existing-model branch checked
exec() for truthiness, so a valid UPDATE that changed no rows (an idempotent
re-save where no value differs) returned false — misreporting success as
failure. This was the root cause of `$model->update([...])->save()` fataling
(false->save()) and made `if (!$model->save())` falsely error on no-op saves.

Compare against false so any non-error result (including 0 rows) returns the
Model and fires 'saved', consistent with the 'updated' event that already
fired. Insert path and genuine-error path unchanged.

Documented in breaking-changes.md §3 (+ §2.2 note updated). Adds
SaveZeroRowUpdateFixTest (0-row returns Model, chained update()->save() no
fatal, real error still false).

Assisted-By: AI

Add the edge cases the session's fixes introduced but left unverified:
- soft-delete: refresh() reloads a trashed row without the scope filter
  (withTrashed) so exists() stays true.
- relation guard: a method returning a plain QueryBuilder with no active
  relation key is rejected; a framework Model method is rejected; the 4th
  entry point withWhereHas() rejects a non-relation too.
- save() insert: a failed insert carrying a stale non-zero insert_id returns
  false and does not set the PK from it.
- saved event fires on a 0-row UPDATE and a manual-PK INSERT, and never on a
  failed write (new SavedEventUser fixture).

getActiveRelationKey() short-circuits a null relation tag before the isset()
so it no longer trips PHP 8's "null as array offset" deprecation (surfaced by
the plain-QueryBuilder rejection test). Behavior unchanged — both still throw.

Assisted-By: AI

…, events)

Cover the three edges previously flagged as skipped:
- relation guard memoizes the framework-vs-consumer verdict per class::method
  (reflection-asserted: refresh -> true, posts -> false, no collision).
- a relation declared on an intermediate base class (leaf -> base -> Model)
  resolves, since its declaring class is the base, not the framework Model.
- created fires on a successful INSERT and updated fires even on a 0-row
  UPDATE (SavedEventUser gains created/updated counters).

New fixtures RelationBaseModel/RelationLeafModel. The memoization test guards
ReflectionProperty::setAccessible() behind PHP_VERSION_ID (required on 7.4, a
deprecated no-op on 8.1+) to keep the suite deprecation-clean.

Assisted-By: AI

Raise the minimum PHP from ^7.4 || ^8.0 to >=8.2 (breaking: the package no
longer installs on PHP < 8.2). Add phpunit/phpunit ^11.5 as a dev dependency
and a `composer test` script so tests run from the vendored PHPUnit instead of
a gitignored phpunit.phar. Point the compat gate at 8.2- and pin
config.platform.php to 8.2.0 for reproducible installs.

Documented in breaking-changes.md §2.14 (+ summary row 14).

Assisted-By: AI