Upgrade PHPStan to 2.x and raise analysis level from 6 to 10

- Bump phpstan/phpstan ^2.0 and szepeviktor/phpstan-wordpress ^2.0
- Move the analysis level into phpstan.neon (single source) and raise it to 10
- Add Val, a runtime coercion helper that narrows untyped WordPress boundary
  values (wpdb rows, REST params, superglobals, options) with explicit checks
  instead of blind casts, plus unit tests
- Type value-object fromRow() params as stdClass (what wpdb returns) and map
  columns through Val so unexpected shapes degrade safely
- Use %i identifier placeholders for table names in all wpdb::prepare() calls
  so every query string is a literal and identifiers are escaped by WordPress;
  raises the minimum WordPress version to 6.2 where %i was introduced
- Guard wpdb::prepare() null result before wpdb::query() in updateTax()
- Fix nullable get_permalink()/strtotime() handling, list types at REST and
  capability call sites, dead null-coalescing on checked superglobals, and
  narrow get_users() results before mapping
- Register Val method names with the ValidatedSanitizedInput sniff so it
  validates the real sanitizer around each superglobal read
- Update repository unit tests for the %i placeholder arguments

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Unit/Auth/InviteRepositoryTest.php

@@ -48,7 +48,7 @@ class InviteRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/token = %s/'), 'tok123')
+            ->with(Mockery::pattern('/token = %s/'), 'wp_us_invites', 'tok123')
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_row')->andReturn($this->row());
@@ -71,7 +71,7 @@ class InviteRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/email = %s AND status = %s/'), 'a@b.test', Invite::STATUS_PENDING)
+            ->with(Mockery::pattern('/email = %s AND status = %s/'), 'wp_us_invites', 'a@b.test', Invite::STATUS_PENDING)
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_row')->andReturn($this->row());
@@ -83,7 +83,7 @@ class InviteRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/status = %s/'), Invite::STATUS_PENDING)
+            ->with(Mockery::pattern('/status = %s/'), 'wp_us_invites', Invite::STATUS_PENDING)
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_results')->andReturn([$this->row()]);

tests/Unit/Availability/AvailabilityRepositoryTest.php

@@ -147,11 +147,16 @@ class AvailabilityRepositoryTest extends TestCase
         self::assertFalse($this->repo->delete(1));
     }
 
-    public function testFindAvailableWithNoFiltersUsesNoParams(): void
+    public function testFindAvailableWithNoFiltersPreparesTableOnly(): void
     {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(Mockery::pattern('/WHERE is_booked = 0/'), ['wp_us_availability'])
+            ->andReturn('SELECT ...');
+
         $this->db->shouldReceive('get_results')
             ->once()
-            ->with(Mockery::pattern('/WHERE is_booked = 0/'))
+            ->with('SELECT ...')
             ->andReturn([]);
 
         $result = $this->repo->findAvailable();
@@ -177,7 +182,7 @@ class AvailabilityRepositoryTest extends TestCase
             ->once()
             ->with(
                 Mockery::pattern('/offering_id = %d AND duration_minutes = %d/'),
-                Mockery::on(static fn (array $p): bool => $p === [8, 30])
+                Mockery::on(static fn (array $p): bool => $p === ['wp_us_availability', 8, 30])
             )
             ->andReturn('SELECT ...');
 

tests/Unit/Booking/BookingRepositoryTest.php

@@ -138,7 +138,7 @@ class BookingRepositoryTest extends TestCase
 
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/COUNT\(\*\).*l.student_id = %d.*a.start_dt >= %s/s'), 5, Lesson::STATUS_CANCELLED, '2026-06-08 12:00:00')
+            ->with(Mockery::pattern('/COUNT\(\*\).*l.student_id = %d.*a.start_dt >= %s/s'), 'wp_us_lessons', 'wp_us_availability', 5, Lesson::STATUS_CANCELLED, '2026-06-08 12:00:00')
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_var')->andReturn('3');

tests/Unit/GroupClass/EnrollmentRepositoryTest.php

@@ -48,7 +48,7 @@ class EnrollmentRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/COUNT\(\*\).*offering_id = %d AND status = %s/s'), 7, Enrollment::STATUS_ACTIVE)
+            ->with(Mockery::pattern('/COUNT\(\*\).*offering_id = %d AND status = %s/s'), 'wp_us_group_enrollments', 7, Enrollment::STATUS_ACTIVE)
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_var')->andReturn('4');
@@ -60,7 +60,7 @@ class EnrollmentRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/student_id = %d AND status = %s/'), 5, Enrollment::STATUS_ACTIVE)
+            ->with(Mockery::pattern('/student_id = %d AND status = %s/'), 'wp_us_group_enrollments', 5, Enrollment::STATUS_ACTIVE)
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_var')->andReturn('2');
@@ -72,7 +72,7 @@ class EnrollmentRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/offering_id = %d AND student_id = %d AND status = %s/'), 7, 5, Enrollment::STATUS_ACTIVE)
+            ->with(Mockery::pattern('/offering_id = %d AND student_id = %d AND status = %s/'), 'wp_us_group_enrollments', 7, 5, Enrollment::STATUS_ACTIVE)
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_var')->andReturn('1');

tests/Unit/Offering/OfferingRepositoryTest.php

@@ -109,11 +109,16 @@ class OfferingRepositoryTest extends TestCase
         self::assertSame(3, $offering->instructorId);
     }
 
-    public function testFindAllWithNoFiltersUsesNoParams(): void
+    public function testFindAllWithNoFiltersPreparesTableOnly(): void
     {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(Mockery::pattern('/WHERE 1 = 1/'), ['wp_us_offerings'])
+            ->andReturn('SELECT ...');
+
         $this->db->shouldReceive('get_results')
             ->once()
-            ->with(Mockery::pattern('/WHERE 1 = 1/'))
+            ->with('SELECT ...')
             ->andReturn([$this->sampleRow()]);
 
         $offerings = $this->repo->findAll();
@@ -126,7 +131,7 @@ class OfferingRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/is_active = %d/'), Mockery::on(static fn (array $p): bool => $p === [1]))
+            ->with(Mockery::pattern('/is_active = %d/'), Mockery::on(static fn (array $p): bool => $p === ['wp_us_offerings', 1]))
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_results')->andReturn([]);
@@ -140,7 +145,7 @@ class OfferingRepositoryTest extends TestCase
             ->once()
             ->with(
                 Mockery::pattern('/instructor_id = %d AND kind = %s/'),
-                Mockery::on(static fn (array $p): bool => $p === [3, Offering::KIND_GROUP_CLASS])
+                Mockery::on(static fn (array $p): bool => $p === ['wp_us_offerings', 3, Offering::KIND_GROUP_CLASS])
             )
             ->andReturn('SELECT ...');
 

tests/Unit/Payment/PaymentRepositoryTest.php

@@ -66,7 +66,7 @@ class PaymentRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/tax_amount = ROUND\( amount \* %f \/ 100, 2 \)/'), 13.0, 13.0, 50)
+            ->with(Mockery::pattern('/tax_amount = ROUND\( amount \* %f \/ 100, 2 \)/'), 'wp_us_payments', 13.0, 13.0, 50)
             ->andReturn('UPDATE ...');
 
         $this->db->shouldReceive('query')->once()->with('UPDATE ...')->andReturn(1);
@@ -78,7 +78,7 @@ class PaymentRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/status = %s AND paid_at >= %s AND paid_at < %s AND instructor_id = %d/'), ['paid', '2026-06-01 00:00:00', '2026-07-01 00:00:00', 3])
+            ->with(Mockery::pattern('/status = %s AND paid_at >= %s AND paid_at < %s AND instructor_id = %d/'), ['wp_us_payments', 'paid', '2026-06-01 00:00:00', '2026-07-01 00:00:00', 3])
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_results')->andReturn([$this->row()]);
@@ -90,7 +90,7 @@ class PaymentRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::on(static fn (string $sql): bool => ! str_contains($sql, 'instructor_id')), ['paid', '2026-06-01 00:00:00', '2026-07-01 00:00:00'])
+            ->with(Mockery::on(static fn (string $sql): bool => ! str_contains($sql, 'instructor_id')), ['wp_us_payments', 'paid', '2026-06-01 00:00:00', '2026-07-01 00:00:00'])
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_results')->andReturn([]);
@@ -118,7 +118,7 @@ class PaymentRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/stripe_payment_intent_id = %s/'), 'pi_123')
+            ->with(Mockery::pattern('/stripe_payment_intent_id = %s/'), 'wp_us_payments', 'pi_123')
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_row')->andReturn($this->row());
@@ -138,7 +138,7 @@ class PaymentRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/registration_type = %s AND registration_id = %d/'), Payment::REG_LESSON, 12)
+            ->with(Mockery::pattern('/registration_type = %s AND registration_id = %d/'), 'wp_us_payments', Payment::REG_LESSON, 12)
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_row')->andReturn($this->row());
@@ -150,7 +150,7 @@ class PaymentRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/status = %s/'), Payment::STATUS_PENDING)
+            ->with(Mockery::pattern('/status = %s/'), 'wp_us_payments', Payment::STATUS_PENDING)
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_results')->andReturn([$this->row()]);

tests/Unit/Policy/AcceptanceRepositoryTest.php

@@ -70,7 +70,7 @@ class AcceptanceRepositoryTest extends TestCase
     {
         $this->db->shouldReceive('prepare')
             ->once()
-            ->with(Mockery::pattern('/registration_type = %s AND registration_id = %d/'), PolicyAcceptance::REG_LESSON, 12)
+            ->with(Mockery::pattern('/registration_type = %s AND registration_id = %d/'), 'wp_us_policy_acceptances', PolicyAcceptance::REG_LESSON, 12)
             ->andReturn('SELECT ...');
 
         $this->db->shouldReceive('get_results')->andReturn([

tests/Unit/Policy/PolicyRepositoryTest.php

@@ -45,6 +45,7 @@ class PolicyRepositoryTest extends TestCase
             ->once()
             ->with(
                 Mockery::pattern('/acceptance_scope = %s OR acceptance_scope = %s/'),
+                'wp_us_policies',
                 Policy::SCOPE_SIGNUP,
                 Policy::SCOPE_BOTH
             )

tests/Unit/Registration/AnswerRepositoryTest.php

@@ -84,6 +84,7 @@ class AnswerRepositoryTest extends TestCase
             ->once()
             ->with(
                 Mockery::pattern('/registration_type = %s AND registration_id = %d/'),
+                'wp_us_question_answers',
                 Answer::REG_LESSON,
                 12
             )

tests/Unit/Registration/QuestionRepositoryTest.php

@@ -101,7 +101,7 @@ class QuestionRepositoryTest extends TestCase
             ->once()
             ->with(
                 Mockery::pattern('/offering_id = %d AND is_active = %d/'),
-                Mockery::on(static fn (array $p): bool => $p === [7, 1])
+                Mockery::on(static fn (array $p): bool => $p === ['wp_us_questions', 7, 1])
             )
             ->andReturn('SELECT ...');
 

tests/Unit/ValTest.php

@@ -0,0 +1,66 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit;
+
+use Unsupervised\Schedular\Val;
+
+class ValTest extends TestCase
+{
+    public function testIntCoercesNumericValues(): void
+    {
+        self::assertSame(5, Val::int('5'));
+        self::assertSame(5, Val::int(5));
+        self::assertSame(5, Val::int(5.7));
+        self::assertSame(-3, Val::int('-3'));
+    }
+
+    public function testIntFallsBackToZeroForNonNumeric(): void
+    {
+        self::assertSame(0, Val::int('abc'));
+        self::assertSame(0, Val::int(null));
+        self::assertSame(0, Val::int([]));
+        self::assertSame(0, Val::int(new \stdClass()));
+    }
+
+    public function testIntOrNullPreservesNull(): void
+    {
+        self::assertNull(Val::intOrNull(null));
+        self::assertSame(7, Val::intOrNull('7'));
+        self::assertSame(0, Val::intOrNull('abc'));
+    }
+
+    public function testFloatCoercesNumericValues(): void
+    {
+        self::assertSame(12.5, Val::float('12.5'));
+        self::assertSame(12.0, Val::float(12));
+        self::assertSame(0.0, Val::float('abc'));
+        self::assertSame(0.0, Val::float(null));
+    }
+
+    public function testStringCoercesScalars(): void
+    {
+        self::assertSame('hello', Val::string('hello'));
+        self::assertSame('5', Val::string(5));
+        self::assertSame('1', Val::string(true));
+        self::assertSame('', Val::string(null));
+        self::assertSame('', Val::string([]));
+        self::assertSame('', Val::string(new \stdClass()));
+    }
+
+    public function testStringOrNullPreservesNull(): void
+    {
+        self::assertNull(Val::stringOrNull(null));
+        self::assertSame('x', Val::stringOrNull('x'));
+        self::assertSame('', Val::stringOrNull([]));
+    }
+
+    public function testBoolUsesTruthiness(): void
+    {
+        self::assertTrue(Val::bool('1'));
+        self::assertTrue(Val::bool(1));
+        self::assertFalse(Val::bool('0'));
+        self::assertFalse(Val::bool(''));
+        self::assertFalse(Val::bool(null));
+    }
+}