# Copilot instructions — Laravel

Laravel 11+, PHP 8.3, MySQL/PostgreSQL, Pest for tests, Laravel Pint for style.

- Validation lives in Form Request classes (`php artisan make:request`), never inline in controllers.
- Controllers are thin and resourceful; use single-action invokable controllers for one-off endpoints.
- Business logic goes in Action classes (`app/Actions`) with a single `handle()` method.
- Eloquent: define relationships and casts; eager load with `with()` to avoid N+1. Enable `Model::preventLazyLoading()` outside production.
- Use API Resources for JSON responses. Use policies for authorization (`$this->authorize`/`can` middleware).
- Queue anything slow (mail, external APIs) with jobs implementing `ShouldQueue`.
- Config via `config()` only; `env()` is allowed only inside config files.
- Tests: Pest feature tests with `RefreshDatabase` and model factories. Run `./vendor/bin/pint && php artisan test`.