ÿØÿà JFIF    ÿÛ „  ( %!1"%)+...383-7(-.+  -%%--------+------------/----------------------------ÿÀ  ¶" ÿÄ     ÿÄ @    !1AQaq‘¡"±ÁÑð2’BRráS‚ñ3b¢CT²Ò #cÿÄ    ÿÄ '   1!AQ2a"‘±#ÿÚ   ? ò(/p‘—–¢·,M|¯G»R£üešT. ôŸEoCFñ‡ 4ÔkåóxR|µÁ¨ÓDà!Ç´µ˜‡p ÍQ‹§!þž^õWsŒy  åÁ§$á«%ºq˜™JyyË0y«^Ϗ -3ÃÏËÈ£Æ\P’ä„s&•‹Üs üô'àWt¹pñCp$bÚF`·7.^)¾!)ÒÙ˜–ÅÏš^h¾ø³·ìe±ŒaeÖ—Í,e=B}Jéߦ$$½—šÙÜCC¯¶è8β–Åkèwx LÉngT±æ¹£Ócœ¿Í/©Éÿ ‰ÚCÒ­mq;Tt¶–}0"zÖPcd1š­¤tˆ„ÐÓâqú[™öUCŠ2޿د­É(¸ßúçšmW,Ò ºf‹Ån™ÄLêÁ8üÁkÁ€L¥ÍuJ1œôrÂSŒÓöt!7EUíïb)AËi¬â-ÙHk8òÁiXYwÅ)O^"ÇØriÛô{»wRUKÙÏÚlÓ¬€‚’שT ] ªb—ÊîKC^×M“xùäñz¬zJ× {4[¹M'IÆeH1LCWÕ]œûº WDæà°OÅ‚¹c²ÞuA–rL`HšpCez‡V’— Ž‚Ë„–ñ­'µR0ÕÖ=À:±G»C\nÆÉ5*¢ †3šhQ4ýÒi$Õ1"Ü]¢p-q3zcQ$ªö¨¥æf›‘»´ÝÚHá„e²JÇ–iÊ:·à¬Øc5Åk»Laª*wi [0Ówk ¦a¦0Õ²ÅÅ‚T¸’³q:Æ<¹ú Ò˜Æ}2VE•Ð€p¡Ô3Úº …h³^LJºçì¥Ánó|˜ÖˆÎˆ+« ¦dø‘Mº–d\ªDðÛ„Ì×LÝ——Ð9Ç|•FèçVm™¨€™3õS–9Äå¢<̉Ìm¢±`·º˜&Z²ž Ë®D«¶»6™‰©­HÈ Àá«h­i³04æ’hxœi3ï¨(ÓL·†‹¶ËpŒ ƒÜÒ? :õdsÀ –3æÓ·Üjâ¬9—]8n¼&]I F£¼…ì–—Œ0v°LǐÅfÛ2TÖ’aµ˜N@ÖBSÏ^à´4-±°b×nÈÈœÆD=KdŒø…ÄÈK,›ÖR§fjü$^ÔÎ!„6^ s:Üun\ôkCÞò÷<—Lúl Í›G¹ÀPá¼Nc¡šÒ…ÙWͳœ±vÊáЄ×9‹P‰cEØ‘™›µŸP<×g1 º©Ø¬wiÁ^l5× I/';Ë+´Z‡ÓÄFÕp[Èð’ HÄ ó 9¬Dl4“é±Ï”V=^Hð;žLädÉa‚°Ë,#/Ž~²BÔÛ QãñQtIeórVB,ÏÂf‹4#Îœc‹É3ZIÖ Œ¢¥·üxa‡Ãçè„jŠ[5 Ä!U?,3žÎ×…ðdÓ÷háŠA‰ìÄ4÷ÃÜZÃE{‰®+W\ZÍE[‰»µk»MÝ­`¢©†˜ÃV‹-f¢¡†¢a«eŠ%«Y¨©q%jâd,Ôq`) ¤¦…šˆ ¦E>0Ùb²t–Ÿ  ÷jsÏ‚Ò’KÈcø(é›;k(’#ôŒQ ™C> õ³M9óºÆµ¤çâ;uÀ)5>RÔ¸fÓ~Ȧ—’-$fe«"FâUˆÊwµPÏu w+"åÉó¨6s™Û9(À¨ù©hE°½†n`m~“@©›p!Vkhµ Á1šbEqqÊ@ºèl›2 –Yã%‘‚hÛ{a¶‡ÅÞM²¬çL34®Çl]®‹ŽØŒm'RÜe35æöˆ­Á­ cP9šeÁköo´L³Ì=p8]”‡B¶,šº|ɏdzXˆØk*ÇÚ{#ñ‰pã(€¶‡9ý'šÜ³½¯kƒ†Â’ëSOƒ•Å®H6+a¢µˆ‹Y¨b˜b+XˆÖ!°u!¢"µˆˆn2ˆ Å0Ä`Å Ô®c(ÓÜGº•Ä»Œ âWî%q.áÐÄ÷î%umÍ£+ÜQ,Vn¦-GphU¸¢X­&,Gt ·K¢ÅÅ·¥RÄÊÉbKn N­R2g$VµÕó Qr#–ÓZUÏð0ÎtÙÀœz ëöo“Îk¯n„T°"SÞ+³/…€½"ižãO%Í%&Δâ‘ËØ´IˆÓ°Ë‰ÞM3.™yçÁzit›`4C`k¢¼á!álÄï sÂ[×!¤l¾æo"ƒIÔ'@ªu)3›ô®“@Z à¾] üœ'‡4¸PÞkÁ-qÄH‰ÓÍBd´ÿ —¹°ÄA&ÊUC„öz‚‚RæŠtf¬>˜ÑidšEçÑL÷áý¡V±h§­c¿¥¨ƒ@g¼…Ýö^ÞËc.ž„æ“I[ ª+·zÐÒÚ,½Ð»¶€C›7jk$๖€Ž¾ÅÙpp¶ÍþéΤ ½ØÎŒq ñpæžÅ¥#Øâ49ÃÂK^MYV“,¶Éz_òæ:…;Õ«¦I3âJ£¤û5$7Èxün\â]Êe¯(Ÿ&Ž‹¶2<6Ćf× æ¢ƱqWı[(ÙÂŽç‚T7¨@ÈÉÍß‚ïÙ"&3TYlGŽ†)†#5ŠA©^T2ÆÁ†)©†©†¤yGXÁ†©"†)©¼ÅV WS†#©]R–r‹q5ÕbâWþBh¯u+ªÅÄ×ü„nÑ^êkªÁj‰jeœWˆÕÕ`µDµ2Ì+Ä µDµµ5Ô{¤Þ0RF’H÷AÛ<ÊÁ§ ƈæ0Ñ£ê4 öÚµ[¬/1²€â<-¬šö²r×0o×w ´xÐÒË„ g01¬„åEM蛇Ã\6µE›‘fÙO k÷CºnÓ1`iîÒ² áÂ!ÑLÄÿ ³¬\õ*:M=Ç»c‹2[‰ØsÕLò\ŒK L^™üÄN\¶#» Ç\……ßïIœÉ$¸ÎñÍ®ÔHÇ Ûí/´>Li”„†g^$ 7NÍÑÑ2M2ªNg=k½Ð}Ÿl6‡ —JWˆ”ÞéT·+µ¦üÂFè¢Vs6ýÆ4»2+2IÝ9ô9®ÇGÙÇ1+Ä8;*Õ§ž½D*îÑWÚçá3Ma¤·ˆ¥t}š²Ü…Q+Æüµ8HíS”üxGéÁˆ¦Ël„éÈ 5 µÄƒ6äÜ(kIš¯S†fÖ&¸®×v|Äyˆ*禌Éù@7-®Ä[]ÎÖ¿ê`º…=:…žJVnݳvðÖKE¼‚ »mà ÷f®:Ë ™–4rð¡4` ܹçž~‹C=œ…¾Ïj|VDtK.ƒ"9 Ï ­–éXá³6WÒïIL-Ї Ç PK U]%uuclass-wp-ability.phpnu[ */ protected static $default_annotations = array( // If true, the ability does not modify its environment. 'readonly' => null, /* * If true, the ability may perform destructive updates to its environment. * If false, the ability performs only additive updates. */ 'destructive' => null, /* * If true, calling the ability repeatedly with the same arguments will have no additional effect * on its environment. */ 'idempotent' => null, ); /** * The name of the ability, with its namespace. * Example: `my-plugin/my-ability`. * * @since 6.9.0 * @var string */ protected $name; /** * The human-readable ability label. * * @since 6.9.0 * @var string */ protected $label; /** * The detailed ability description. * * @since 6.9.0 * @var string */ protected $description; /** * The ability category. * * @since 6.9.0 * @var string */ protected $category; /** * The optional ability input schema. * * @since 6.9.0 * @var array */ protected $input_schema = array(); /** * The optional ability output schema. * * @since 6.9.0 * @var array */ protected $output_schema = array(); /** * The ability execute callback. * * @since 6.9.0 * @var callable(mixed): (mixed|WP_Error) */ protected $execute_callback; /** * The optional ability permission callback. * * @since 6.9.0 * @var callable(mixed): (bool|WP_Error) */ protected $permission_callback; /** * The optional ability metadata. * * @since 6.9.0 * @var array */ protected $meta; /** * Constructor. * * Do not use this constructor directly. Instead, use the `wp_register_ability()` function. * * @access private * * @since 6.9.0 * * @see wp_register_ability() * * @param string $name The name of the ability, with its namespace. * @param array $args { * An associative array of arguments for the ability. * * @type string $label The human-readable label for the ability. * @type string $description A detailed description of what the ability does. * @type string $category The ability category slug this ability belongs to. * @type callable $execute_callback A callback function to execute when the ability is invoked. * Receives optional mixed input and returns mixed result or WP_Error. * @type callable $permission_callback A callback function to check permissions before execution. * Receives optional mixed input and returns bool or WP_Error. * @type array $input_schema Optional. JSON Schema definition for the ability's input. * @type array $output_schema Optional. JSON Schema definition for the ability's output. * @type array $meta { * Optional. Additional metadata for the ability. * * @type array $annotations { * Optional. Semantic annotations describing the ability's behavioral characteristics. * These annotations are hints for tooling and documentation. * * @type bool|null $readonly Optional. If true, the ability does not modify its environment. * @type bool|null $destructive Optional. If true, the ability may perform destructive updates to its environment. * If false, the ability performs only additive updates. * @type bool|null $idempotent Optional. If true, calling the ability repeatedly with the same arguments * will have no additional effect on its environment. * } * @type bool $public Optional. Whether the ability is meant to be available * to clients such as the REST API, MCP, or AI agents. * Seeds the default for per-channel flags like * `$show_in_rest`. Defaults to false. * @type bool $show_in_rest Optional. Whether to expose this ability in the REST API. * Default is the value of `$public` when set, false otherwise. * } * } */ public function __construct( string $name, array $args ) { $this->name = $name; $properties = $this->prepare_properties( $args ); foreach ( $properties as $property_name => $property_value ) { if ( ! property_exists( $this, $property_name ) ) { _doing_it_wrong( __METHOD__, sprintf( /* translators: %s: Property name. */ __( 'Property "%1$s" is not a valid property for ability "%2$s". Please check the %3$s class for allowed properties.' ), '' . esc_html( $property_name ) . '', '' . esc_html( $this->name ) . '', '' . __CLASS__ . '' ), '6.9.0' ); continue; } $this->$property_name = $property_value; } } /** * Prepares and validates the properties used to instantiate the ability. * * Errors are thrown as exceptions instead of WP_Errors to allow for simpler handling and overloading. They are then * caught and converted to a WP_Error by WP_Abilities_Registry::register(). * * @since 6.9.0 * * @see WP_Abilities_Registry::register() * * @param array $args { * An associative array of arguments used to instantiate the ability class. * * @type string $label The human-readable label for the ability. * @type string $description A detailed description of what the ability does. * @type string $category The ability category slug this ability belongs to. * @type callable $execute_callback A callback function to execute when the ability is invoked. * Receives optional mixed input and returns mixed result or WP_Error. * @type callable $permission_callback A callback function to check permissions before execution. * Receives optional mixed input and returns bool or WP_Error. * @type array $input_schema Optional. JSON Schema definition for the ability's input. Required if ability accepts an input. * @type array $output_schema Optional. JSON Schema definition for the ability's output. * @type array $meta { * Optional. Additional metadata for the ability. * * @type array $annotations { * Optional. Semantic annotations describing the ability's behavioral characteristics. * These annotations are hints for tooling and documentation. * * @type bool|null $readonly Optional. If true, the ability does not modify its environment. * @type bool|null $destructive Optional. If true, the ability may perform destructive updates to its environment. * If false, the ability performs only additive updates. * @type bool|null $idempotent Optional. If true, calling the ability repeatedly with the same arguments * will have no additional effect on its environment. * } * @type bool $public Optional. Whether the ability is meant to be available * to clients such as the REST API, MCP, or AI agents. * Seeds the default for per-channel flags like * `$show_in_rest`. Defaults to false. * @type bool $show_in_rest Optional. Whether to expose this ability in the REST API. * Default is the value of `$public` when set, false otherwise. * } * } * @return array { * An associative array of arguments with validated and prepared properties for the ability class. * * @type string $label The human-readable label for the ability. * @type string $description A detailed description of what the ability does. * @type string $category The ability category slug this ability belongs to. * @type callable $execute_callback A callback function to execute when the ability is invoked. * Receives optional mixed input and returns mixed result or WP_Error. * @type callable $permission_callback A callback function to check permissions before execution. * Receives optional mixed input and returns bool or WP_Error. * @type array $input_schema Optional. JSON Schema definition for the ability's input. * @type array $output_schema Optional. JSON Schema definition for the ability's output. * @type array $meta { * Additional metadata for the ability. * * @type array $annotations { * Semantic annotations describing the ability's behavioral characteristics. * These annotations are hints for tooling and documentation. * * @type bool|null $readonly If true, the ability does not modify its environment. * @type bool|null $destructive If true, the ability may perform destructive updates to its environment. * If false, the ability performs only additive updates. * @type bool|null $idempotent If true, calling the ability repeatedly with the same arguments * will have no additional effect on its environment. * } * @type bool $public Whether the ability is meant to be available to clients * such as the REST API, MCP, or AI agents. Defaults to * false. * @type bool $show_in_rest Whether to expose this ability in the REST API. * } * } * @throws InvalidArgumentException if an argument is invalid. */ protected function prepare_properties( array $args ): array { // Required args must be present and of the correct type. if ( empty( $args['label'] ) || ! is_string( $args['label'] ) ) { throw new InvalidArgumentException( __( 'The ability properties must contain a `label` string.' ) ); } if ( empty( $args['description'] ) || ! is_string( $args['description'] ) ) { throw new InvalidArgumentException( __( 'The ability properties must contain a `description` string.' ) ); } if ( empty( $args['category'] ) || ! is_string( $args['category'] ) ) { throw new InvalidArgumentException( __( 'The ability properties must contain a `category` string.' ) ); } // If we are not overriding `ability_class` parameter during instantiation, then we need to validate the execute_callback. if ( get_class( $this ) === self::class && ( empty( $args['execute_callback'] ) || ! is_callable( $args['execute_callback'] ) ) ) { throw new InvalidArgumentException( __( 'The ability properties must contain a valid `execute_callback` function.' ) ); } // If we are not overriding `ability_class` parameter during instantiation, then we need to validate the permission_callback. if ( get_class( $this ) === self::class && ( empty( $args['permission_callback'] ) || ! is_callable( $args['permission_callback'] ) ) ) { throw new InvalidArgumentException( __( 'The ability properties must provide a valid `permission_callback` function.' ) ); } // Optional args only need to be of the correct type if they are present. if ( isset( $args['input_schema'] ) && ! is_array( $args['input_schema'] ) ) { throw new InvalidArgumentException( __( 'The ability properties should provide a valid `input_schema` definition.' ) ); } if ( isset( $args['output_schema'] ) && ! is_array( $args['output_schema'] ) ) { throw new InvalidArgumentException( __( 'The ability properties should provide a valid `output_schema` definition.' ) ); } if ( isset( $args['meta'] ) && ! is_array( $args['meta'] ) ) { throw new InvalidArgumentException( __( 'The ability properties should provide a valid `meta` array.' ) ); } if ( isset( $args['meta']['annotations'] ) && ! is_array( $args['meta']['annotations'] ) ) { throw new InvalidArgumentException( __( 'The ability meta should provide a valid `annotations` array.' ) ); } if ( isset( $args['meta']['show_in_rest'] ) && ! is_bool( $args['meta']['show_in_rest'] ) ) { throw new InvalidArgumentException( __( 'The ability meta should provide a valid `show_in_rest` boolean.' ) ); } if ( isset( $args['meta']['public'] ) && ! is_bool( $args['meta']['public'] ) ) { throw new InvalidArgumentException( __( 'The ability meta should provide a valid `public` boolean.' ) ); } // Set defaults for optional meta. $args['meta'] = wp_parse_args( $args['meta'] ?? array(), array( 'annotations' => static::$default_annotations, ) ); $args['meta']['annotations'] = wp_parse_args( $args['meta']['annotations'], static::$default_annotations ); /* * Resolve `show_in_rest` from most specific to least specific: an explicit * `show_in_rest` value wins, then the high-level `public` flag seeds the * default, then the built-in default applies. */ $args['meta']['show_in_rest'] = $args['meta']['show_in_rest'] ?? $args['meta']['public'] ?? self::DEFAULT_SHOW_IN_REST; $args['meta']['public'] = $args['meta']['public'] ?? self::DEFAULT_PUBLIC; return $args; } /** * Retrieves the name of the ability, with its namespace. * Example: `my-plugin/my-ability`. * * @since 6.9.0 * * @return string The ability name, with its namespace. */ public function get_name(): string { return $this->name; } /** * Retrieves the human-readable label for the ability. * * @since 6.9.0 * * @return string The human-readable ability label. */ public function get_label(): string { return $this->label; } /** * Retrieves the detailed description for the ability. * * @since 6.9.0 * * @return string The detailed description for the ability. */ public function get_description(): string { return $this->description; } /** * Retrieves the ability category for the ability. * * @since 6.9.0 * * @return string The ability category for the ability. */ public function get_category(): string { return $this->category; } /** * Retrieves the input schema for the ability. * * @since 6.9.0 * * @return array The input schema for the ability. */ public function get_input_schema(): array { return $this->input_schema; } /** * Retrieves the output schema for the ability. * * @since 6.9.0 * * @return array The output schema for the ability. */ public function get_output_schema(): array { return $this->output_schema; } /** * Retrieves the metadata for the ability. * * @since 6.9.0 * * @return array The metadata for the ability. */ public function get_meta(): array { return $this->meta; } /** * Retrieves a specific metadata item for the ability. * * @since 6.9.0 * * @param string $key The metadata key to retrieve. * @param mixed $default_value Optional. The default value to return if the metadata item is not found. Default `null`. * @return mixed The value of the metadata item, or the default value if not found. */ public function get_meta_item( string $key, $default_value = null ) { return array_key_exists( $key, $this->meta ) ? $this->meta[ $key ] : $default_value; } /** * Normalizes the input for the ability, applying the default value from the input schema when needed. * * When no input is provided and the input schema is defined with a top-level `default` key, this method returns * the value of that key. If the input schema does not define a `default`, or if the input schema is empty, * this method returns null. If input is provided, it is returned as-is. * * The {@see 'wp_ability_normalize_input'} filter fires after the built-in default-value handling, * allowing plugins to transform the result. * * @since 6.9.0 * @since 7.1.0 Added the `wp_ability_normalize_input` filter. * * @param mixed $input Optional. The raw input provided for the ability. Default `null`. * @return mixed The normalized input, or a `WP_Error` if a filter returned one. */ public function normalize_input( $input = null ) { if ( null === $input ) { $input_schema = $this->get_input_schema(); if ( array_key_exists( 'default', $input_schema ) ) { $input = $input_schema['default']; } } /** * Filters the normalized input for an ability. * * Fires after `normalize_input()` has applied any default value declared in the input schema, * giving plugins a chance to adjust the input before it is consumed downstream. Common uses * include defaulting beyond what JSON Schema can express, prompt enrichment, and injecting * caller metadata. * * Returning a `WP_Error` causes callers that propagate it (such as `execute()`) to halt * before validation, permission checks, and the registered execute callback. * * @since 7.1.0 * * @param mixed $input The normalized input data. * @param string $ability_name The name of the ability. * @param WP_Ability $ability The ability instance. */ return apply_filters( 'wp_ability_normalize_input', $input, $this->name, $this ); } /** * Validates input data against the input schema. * * @since 6.9.0 * * @param mixed $input Optional. The input data to validate. Default `null`. * @return true|WP_Error Returns true if valid or the WP_Error object if validation fails. */ public function validate_input( $input = null ) { $input_schema = $this->get_input_schema(); if ( empty( $input_schema ) ) { if ( null === $input ) { return true; } return new WP_Error( 'ability_missing_input_schema', sprintf( /* translators: %s ability name. */ __( 'Ability "%s" does not define an input schema required to validate the provided input.' ), $this->name ) ); } $valid_input = rest_validate_value_from_schema( $input, $input_schema, 'input' ); if ( is_wp_error( $valid_input ) ) { $is_valid = new WP_Error( 'ability_invalid_input', sprintf( /* translators: %1$s ability name, %2$s error message. */ __( 'Ability "%1$s" has invalid input. Reason: %2$s' ), $this->name, $valid_input->get_error_message() ) ); } else { $is_valid = true; } /** * Filters the input validation result for an ability. * * Allows developers to add custom validation logic on top of the default * JSON Schema validation. If default validation already failed, the filter * receives the WP_Error object and can add additional error information or * override it. If default validation passed, the filter can add additional * validation checks and return a WP_Error if those checks fail. * * @since 7.1.0 * * @param true|WP_Error $is_valid The validation result from default validation. * @param mixed $input The input data being validated. * @param string $ability_name The name of the ability. */ $validity = apply_filters( 'wp_ability_validate_input', $is_valid, $input, $this->name ); if ( false === $validity ) { return new WP_Error( 'ability_invalid_input', __( 'Invalid input.' ) ); } if ( is_wp_error( $validity ) && $validity->has_errors() ) { return $validity; } return true; } /** * Invokes a callable, ensuring the input is passed through only if the input schema is defined. * * @since 6.9.0 * * @param callable $callback The callable to invoke. * @param mixed $input Optional. The input data for the ability. Default `null`. * @return mixed The result of the callable execution, or a `WP_Error` if the callback threw. */ protected function invoke_callback( callable $callback, $input = null ) { $args = array(); if ( ! empty( $this->get_input_schema() ) ) { $args[] = $input; } try { return $callback( ...$args ); } catch ( Throwable $e ) { return new WP_Error( 'ability_callback_exception', sprintf( /* translators: 1: Ability name, 2: Exception message. */ __( 'Ability "%1$s" callback threw an exception: %2$s' ), $this->name, esc_html( $e->getMessage() ) ) ); } } /** * Checks whether the ability has the necessary permissions. * * Please note that input is not automatically validated against the input schema. * Use `validate_input()` method to validate input before calling this method if needed. * * The {@see 'wp_ability_permission_result'} filter fires after the registered * `permission_callback` returns, allowing plugins to override the result. * * @since 6.9.0 * @since 7.1.0 Added the `wp_ability_permission_result` filter. * * @see validate_input() * * @param mixed $input Optional. The valid input data for permission checking. Default `null`. * @return bool|WP_Error Whether the ability has the necessary permission. */ public function check_permissions( $input = null ) { if ( ! is_callable( $this->permission_callback ) ) { return new WP_Error( 'ability_invalid_permission_callback', /* translators: %s ability name. */ sprintf( __( 'Ability "%s" does not have a valid permission callback.' ), $this->name ) ); } $permission = $this->invoke_callback( $this->permission_callback, $input ); /** * Filters the result of an ability's permission check. * * Fires after the registered `permission_callback` returns. Plugins can use this to layer * additional authorization rules on top of the ability's own permission logic — for example, * multi-factor authorization gates or temporary permission elevation for trusted contexts. * * Filters can return `true` to grant, `false` to deny, or a `WP_Error` to deny with a specific * error code and message. The filter receives whatever the `permission_callback` produced. * Any other return value is coerced to `false`. * * @since 7.1.0 * * @param bool|WP_Error $permission The permission result returned by `permission_callback`. * @param string $ability_name The name of the ability. * @param mixed $input The input data for the permission check. * @param WP_Ability $ability The ability instance. */ $result = apply_filters( 'wp_ability_permission_result', $permission, $this->name, $input, $this ); if ( ! is_bool( $result ) && ! is_wp_error( $result ) ) { $result = false; } return $result; } /** * Executes the ability callback. * * The {@see 'wp_ability_execute_result'} filter fires before this method returns, allowing * plugins to transform the result produced by the registered `execute_callback`. * * @since 6.9.0 * @since 7.1.0 Added the `wp_ability_execute_result` filter. * * @param mixed $input Optional. The input data for the ability. Default `null`. * @return mixed|WP_Error The result of the ability execution, or WP_Error on failure. */ protected function do_execute( $input = null ) { if ( ! is_callable( $this->execute_callback ) ) { $result = new WP_Error( 'ability_invalid_execute_callback', /* translators: %s ability name. */ sprintf( __( 'Ability "%s" does not have a valid execute callback.' ), $this->name ) ); } else { $result = $this->invoke_callback( $this->execute_callback, $input ); } /** * Filters the result returned by an ability's execute callback. * * Fires after the registered execute callback runs. Plugins can use this to transform the * result — response formatting, stripping internal metadata, content safety filtering, * response enrichment, or recovering from a failure by returning a successful value. * * The filter receives whatever the registered callback produced, including a `WP_Error` * if execution failed. Filters may pass the `WP_Error` through unchanged, override it with * a recovered result, or convert a successful result into a `WP_Error`. * * @since 7.1.0 * * @param mixed $result The result returned by the registered `execute_callback`, * or a `WP_Error` if execution failed. * @param string $ability_name The name of the ability. * @param mixed $input The normalized input data. * @param WP_Ability $ability The ability instance. */ return apply_filters( 'wp_ability_execute_result', $result, $this->name, $input, $this ); } /** * Validates output data against the output schema. * * @since 6.9.0 * * @param mixed $output The output data to validate. * @return true|WP_Error Returns true if valid, or a WP_Error object if validation fails. */ protected function validate_output( $output ) { $output_schema = $this->get_output_schema(); if ( empty( $output_schema ) ) { $is_valid = true; } else { $valid_output = rest_validate_value_from_schema( $output, $output_schema, 'output' ); if ( is_wp_error( $valid_output ) ) { $is_valid = new WP_Error( 'ability_invalid_output', sprintf( /* translators: %1$s ability name, %2$s error message. */ __( 'Ability "%1$s" has invalid output. Reason: %2$s' ), $this->name, $valid_output->get_error_message() ) ); } else { $is_valid = true; } } /** * Filters the output validation result for an ability. * * Allows developers to add custom validation logic on top of the default * JSON Schema validation. If default validation already failed, the filter * receives the WP_Error object and can add additional error information or * override it. If default validation passed, the filter can add additional * validation checks and return a WP_Error if those checks fail. * * @since 7.1.0 * * @param true|WP_Error $is_valid The validation result from default validation. * @param mixed $output The output data being validated. * @param string $ability_name The name of the ability. */ $validity = apply_filters( 'wp_ability_validate_output', $is_valid, $output, $this->name ); if ( false === $validity ) { return new WP_Error( 'ability_invalid_output', __( 'Invalid output.' ) ); } if ( is_wp_error( $validity ) && $validity->has_errors() ) { return $validity; } return true; } /** * Executes the ability after input validation and running a permission check. * Before returning the return value, it also validates the output. * * @since 6.9.0 * @since 7.1.0 Added the `wp_ability_invoked` action. * @since 7.1.0 Added the `wp_pre_execute_ability` filter. * * @param mixed $input Optional. The input data for the ability. Default `null`. * @return mixed|WP_Error The result of the ability execution, or WP_Error on failure. */ public function execute( $input = null ) { /** * Fires when an ability is invoked, before any processing takes place. * * This action fires for every call regardless of outcome (validation failure, * permission denial, short-circuit, or successful execution), and before input * normalization so the raw input is captured as-is. * * @since 7.1.0 * * @param string $ability_name The name of the ability. * @param mixed $input The raw input data for the ability, before normalization. * @param WP_Ability $ability The ability instance. */ do_action( 'wp_ability_invoked', $this->name, $input, $this ); $pre_execute_sentinel = new WP_Filter_Sentinel(); /** * Filters whether to short-circuit ability execution. * * Returning a value other than the received default bypasses the rest of `execute()` — * input normalization, input validation, permission checks, the registered execute callback, * output validation, and the surrounding actions — and the value is returned to the caller * as-is. Useful for cached responses, rate limiting, maintenance mode, and test mocking. * * To continue with normal execution, return `$pre` unchanged. This preserves any value * (including `null`, `false`, or arbitrary objects) as a valid short-circuit result. * * Because validation is bypassed, callers that short-circuit are responsible for the * integrity of any value they consume from `$input`. * * @since 7.1.0 * * @param mixed $pre The pre-computed result. Return this value unchanged to continue execution. * Default `WP_Filter_Sentinel` instance unique to this invocation. * @param string $ability_name The name of the ability. * @param mixed $input The raw input passed to `execute()`. * @param WP_Ability $ability The ability instance. */ $pre = apply_filters( 'wp_pre_execute_ability', $pre_execute_sentinel, $this->name, $input, $this ); if ( $pre !== $pre_execute_sentinel ) { return $pre; } $input = $this->normalize_input( $input ); if ( is_wp_error( $input ) ) { return $input; } $is_valid = $this->validate_input( $input ); if ( is_wp_error( $is_valid ) ) { return $is_valid; } $has_permissions = $this->check_permissions( $input ); if ( true !== $has_permissions ) { if ( is_wp_error( $has_permissions ) ) { // Don't leak the permission check error to someone without the correct perms. _doing_it_wrong( __METHOD__, esc_html( $has_permissions->get_error_message() ), '6.9.0' ); } return new WP_Error( 'ability_invalid_permissions', /* translators: %s ability name. */ sprintf( __( 'Ability "%s" does not have necessary permission.' ), $this->name ) ); } /** * Fires before an ability gets executed, after input validation and permissions check. * * @since 6.9.0 * @since 7.1.0 Added the `$ability` parameter. * * @param string $ability_name The name of the ability. * @param mixed $input The input data for the ability. * @param WP_Ability $ability The ability instance. */ do_action( 'wp_before_execute_ability', $this->name, $input, $this ); $result = $this->do_execute( $input ); if ( is_wp_error( $result ) ) { return $result; } $is_valid = $this->validate_output( $result ); if ( is_wp_error( $is_valid ) ) { return $is_valid; } /** * Fires immediately after an ability finished executing. * * @since 6.9.0 * @since 7.1.0 Added the `$ability` parameter. * * @param string $ability_name The name of the ability. * @param mixed $input The input data for the ability. * @param mixed $result The result of the ability execution. * @param WP_Ability $ability The ability instance. */ do_action( 'wp_after_execute_ability', $this->name, $input, $result, $this ); return $result; } /** * Wakeup magic method. * * @since 6.9.0 * @throws LogicException If the ability object is unserialized. * This is a security hardening measure to prevent unserialization of the ability. */ public function __wakeup(): void { throw new LogicException( __CLASS__ . ' should never be unserialized.' ); } /** * Sleep magic method. * * @since 6.9.0 * @throws LogicException If the ability object is serialized. * This is a security hardening measure to prevent serialization of the ability. */ public function __sleep(): array { throw new LogicException( __CLASS__ . ' should never be serialized.' ); } } PK U]ܦ FFclass-wp-ability-category.phpnu[ */ protected $meta = array(); /** * Constructor. * * Do not use this constructor directly. Instead, use the `wp_register_ability_category()` function. * * @access private * * @since 6.9.0 * * @see wp_register_ability_category() * * @param string $slug The unique slug for the ability category. * @param array $args { * An associative array of arguments for the ability category. * * @type string $label The human-readable label for the ability category. * @type string $description A description of the ability category. * @type array $meta Optional. Additional metadata for the ability category. * } * @throws InvalidArgumentException If an argument is invalid. */ public function __construct( string $slug, array $args ) { if ( empty( $slug ) ) { throw new InvalidArgumentException( __( 'The ability category slug cannot be empty.' ) ); } $this->slug = $slug; $properties = $this->prepare_properties( $args ); foreach ( $properties as $property_name => $property_value ) { if ( ! property_exists( $this, $property_name ) ) { _doing_it_wrong( __METHOD__, sprintf( /* translators: %s: Property name. */ __( 'Property "%1$s" is not a valid property for ability category "%2$s". Please check the %3$s class for allowed properties.' ), '' . esc_html( $property_name ) . '', '' . esc_html( $this->slug ) . '', '' . __CLASS__ . '' ), '6.9.0' ); continue; } $this->$property_name = $property_value; } } /** * Prepares and validates the properties used to instantiate the ability category. * * @since 6.9.0 * * @param array $args { * An associative array of arguments used to instantiate the ability category class. * * @type string $label The human-readable label for the ability category. * @type string $description A description of the ability category. * @type array $meta Optional. Additional metadata for the ability category. * } * @return array $args { * An associative array with validated and prepared ability category properties. * * @type string $label The human-readable label for the ability category. * @type string $description A description of the ability category. * @type array $meta Optional. Additional metadata for the ability category. * } * @throws InvalidArgumentException If an argument is invalid. */ protected function prepare_properties( array $args ): array { // Required args must be present and of the correct type. if ( empty( $args['label'] ) || ! is_string( $args['label'] ) ) { throw new InvalidArgumentException( __( 'The ability category properties must contain a `label` string.' ) ); } if ( empty( $args['description'] ) || ! is_string( $args['description'] ) ) { throw new InvalidArgumentException( __( 'The ability category properties must contain a `description` string.' ) ); } // Optional args only need to be of the correct type if they are present. if ( isset( $args['meta'] ) && ! is_array( $args['meta'] ) ) { throw new InvalidArgumentException( __( 'The ability category properties should provide a valid `meta` array.' ) ); } return $args; } /** * Retrieves the slug of the ability category. * * @since 6.9.0 * * @return string The ability category slug. */ public function get_slug(): string { return $this->slug; } /** * Retrieves the human-readable label for the ability category. * * @since 6.9.0 * * @return string The human-readable ability category label. */ public function get_label(): string { return $this->label; } /** * Retrieves the detailed description for the ability category. * * @since 6.9.0 * * @return string The detailed description for the ability category. */ public function get_description(): string { return $this->description; } /** * Retrieves the metadata for the ability category. * * @since 6.9.0 * * @return array The metadata for the ability category. */ public function get_meta(): array { return $this->meta; } /** * Wakeup magic method. * * @since 6.9.0 * @throws LogicException If the ability category object is unserialized. * This is a security hardening measure to prevent unserialization of the ability category. */ public function __wakeup(): void { throw new LogicException( __CLASS__ . ' should never be unserialized.' ); } /** * Sleep magic method. * * @since 6.9.0 * @throws LogicException If the ability category object is serialized. * This is a security hardening measure to prevent serialization of the ability category. */ public function __sleep(): array { throw new LogicException( __CLASS__ . ' should never be serialized.' ); } } PK U]RmHH(class-wp-ability-categories-registry.phpnu[ $args { * An associative array of arguments for the ability category. * * @type string $label The human-readable label for the ability category. * @type string $description A description of the ability category. * @type array $meta Optional. Additional metadata for the ability category. * } * @return WP_Ability_Category|null The registered ability category instance on success, null on failure. */ public function register( string $slug, array $args ): ?WP_Ability_Category { if ( $this->is_registered( $slug ) ) { _doing_it_wrong( __METHOD__, /* translators: %s: Ability category slug. */ sprintf( __( 'Ability category "%s" is already registered.' ), esc_html( $slug ) ), '6.9.0' ); return null; } if ( ! preg_match( '/^[a-z0-9]+(?:-[a-z0-9]+)*$/', $slug ) ) { _doing_it_wrong( __METHOD__, __( 'Ability category slug must contain only lowercase alphanumeric characters and dashes.' ), '6.9.0' ); return null; } /** * Filters the ability category arguments before they are validated and used to instantiate the ability category. * * @since 6.9.0 * * @param array $args { * The arguments used to instantiate the ability category. * * @type string $label The human-readable label for the ability category. * @type string $description A description of the ability category. * @type array $meta Optional. Additional metadata for the ability category. * } * @param string $slug The slug of the ability category. */ $args = apply_filters( 'wp_register_ability_category_args', $args, $slug ); try { // WP_Ability_Category::prepare_properties() will throw an exception if the properties are invalid. $category = new WP_Ability_Category( $slug, $args ); } catch ( InvalidArgumentException $e ) { _doing_it_wrong( __METHOD__, $e->getMessage(), '6.9.0' ); return null; } $this->registered_categories[ $slug ] = $category; return $category; } /** * Unregisters an ability category. * * Do not use this method directly. Instead, use the `wp_unregister_ability_category()` function. * * @since 6.9.0 * * @see wp_unregister_ability_category() * * @param string $slug The slug of the registered ability category. * @return WP_Ability_Category|null The unregistered ability category instance on success, null on failure. */ public function unregister( string $slug ): ?WP_Ability_Category { if ( ! $this->is_registered( $slug ) ) { _doing_it_wrong( __METHOD__, /* translators: %s: Ability category slug. */ sprintf( __( 'Ability category "%s" not found.' ), esc_html( $slug ) ), '6.9.0' ); return null; } $unregistered_category = $this->registered_categories[ $slug ]; unset( $this->registered_categories[ $slug ] ); return $unregistered_category; } /** * Retrieves the list of all registered ability categories. * * Do not use this method directly. Instead, use the `wp_get_ability_categories()` function. * * @since 6.9.0 * * @see wp_get_ability_categories() * * @return array The array of registered ability categories. */ public function get_all_registered(): array { return $this->registered_categories; } /** * Checks if an ability category is registered. * * Do not use this method directly. Instead, use the `wp_has_ability_category()` function. * * @since 6.9.0 * * @see wp_has_ability_category() * * @param string $slug The slug of the ability category. * @return bool True if the ability category is registered, false otherwise. */ public function is_registered( string $slug ): bool { return isset( $this->registered_categories[ $slug ] ); } /** * Retrieves a registered ability category. * * Do not use this method directly. Instead, use the `wp_get_ability_category()` function. * * @since 6.9.0 * * @see wp_get_ability_category() * * @param string $slug The slug of the registered ability category. * @return WP_Ability_Category|null The registered ability category instance, or null if it is not registered. */ public function get_registered( string $slug ): ?WP_Ability_Category { if ( ! $this->is_registered( $slug ) ) { _doing_it_wrong( __METHOD__, /* translators: %s: Ability category slug. */ sprintf( __( 'Ability category "%s" not found.' ), esc_html( $slug ) ), '6.9.0' ); return null; } return $this->registered_categories[ $slug ]; } /** * Utility method to retrieve the main instance of the registry class. * * The instance will be created if it does not exist yet. * * @since 6.9.0 * * @return WP_Ability_Categories_Registry|null The main registry instance, or null when `init` action has not fired. */ public static function get_instance(): ?self { if ( ! did_action( 'init' ) ) { _doing_it_wrong( __METHOD__, sprintf( // translators: %s: init action. __( 'Ability API should not be initialized before the %s action has fired.' ), 'init' ), '6.9.0' ); return null; } if ( null === self::$instance ) { self::$instance = new self(); /** * Fires when preparing ability categories registry. * * Ability categories should be registered on this action to ensure they're available when needed. * * @since 6.9.0 * * @param WP_Ability_Categories_Registry $instance Ability categories registry object. */ do_action( 'wp_abilities_api_categories_init', self::$instance ); } return self::$instance; } /** * Wakeup magic method. * * @since 6.9.0 * @throws LogicException If the registry object is unserialized. * This is a security hardening measure to prevent unserialization of the registry. */ public function __wakeup(): void { throw new LogicException( __CLASS__ . ' should never be unserialized.' ); } /** * Sleep magic method. * * @since 6.9.0 * @throws LogicException If the registry object is serialized. * This is a security hardening measure to prevent serialization of the registry. */ public function __sleep(): array { throw new LogicException( __CLASS__ . ' should never be serialized.' ); } } PK U]'.2.2class-wp-abilities-registry.phpnu[ $args { * An associative array of arguments for the ability. * * @type string $label The human-readable label for the ability. * @type string $description A detailed description of what the ability does. * @type string $category The ability category slug this ability belongs to. * @type callable $execute_callback A callback function to execute when the ability is invoked. * Receives optional mixed input and returns mixed result or WP_Error. * @type callable $permission_callback A callback function to check permissions before execution. * Receives optional mixed input and returns bool or WP_Error. * @type array $input_schema Optional. JSON Schema definition for the ability's input. * @type array $output_schema Optional. JSON Schema definition for the ability's output. * @type array $meta { * Optional. Additional metadata for the ability. * * @type array $annotations { * Optional. Semantic annotations describing the ability's behavioral characteristics. * These annotations are hints for tooling and documentation. * * @type bool|null $readonly Optional. If true, the ability does not modify its environment. * @type bool|null $destructive Optional. If true, the ability may perform destructive updates to its environment. * If false, the ability performs only additive updates. * @type bool|null $idempotent Optional. If true, calling the ability repeatedly with the same arguments * will have no additional effect on its environment. * } * @type bool $public Optional. Whether the ability is meant to be available * to clients such as the REST API, MCP, or AI agents. * Seeds the default for per-channel flags like * `$show_in_rest`. Defaults to false. * @type bool $show_in_rest Optional. Whether to expose this ability in the REST API. * Default is the value of `$public` when set, false otherwise. * } * @type string $ability_class Optional. Custom class to instantiate instead of WP_Ability. * } * @return WP_Ability|null The registered ability instance on success, null on failure. */ public function register( string $name, array $args ): ?WP_Ability { if ( ! preg_match( '/^[a-z0-9-]+\/[a-z0-9-]+$/', $name ) ) { _doing_it_wrong( __METHOD__, __( 'Ability name must be a string containing a namespace prefix, i.e. "my-plugin/my-ability". It can only contain lowercase alphanumeric characters, dashes and the forward slash.' ), '6.9.0' ); return null; } if ( $this->is_registered( $name ) ) { _doing_it_wrong( __METHOD__, /* translators: %s: Ability name. */ sprintf( __( 'Ability "%s" is already registered.' ), esc_html( $name ) ), '6.9.0' ); return null; } /** * Filters the ability arguments before they are validated and used to instantiate the ability. * * @since 6.9.0 * * @param array $args { * An associative array of arguments for the ability. * * @type string $label The human-readable label for the ability. * @type string $description A detailed description of what the ability does. * @type string $category The ability category slug this ability belongs to. * @type callable $execute_callback A callback function to execute when the ability is invoked. * Receives optional mixed input and returns mixed result or WP_Error. * @type callable $permission_callback A callback function to check permissions before execution. * Receives optional mixed input and returns bool or WP_Error. * @type array $input_schema Optional. JSON Schema definition for the ability's input. * @type array $output_schema Optional. JSON Schema definition for the ability's output. * @type array $meta { * Optional. Additional metadata for the ability. * * @type array $annotations Optional. Annotation metadata for the ability. * @type bool $public Optional. Whether the ability is meant to be * available to clients such as the REST API, MCP, or AI * agents. Seeds the default for per-channel flags like * `$show_in_rest`. Defaults to false. * @type bool $show_in_rest Optional. Whether to expose this ability in the REST API. * Default is the value of `$public` when set, false otherwise. * } * @type string $ability_class Optional. Custom class to instantiate instead of WP_Ability. * } * @param string $name The name of the ability, with its namespace. */ $args = apply_filters( 'wp_register_ability_args', $args, $name ); // Validate ability category exists if provided (will be validated as required in WP_Ability). if ( isset( $args['category'] ) ) { if ( ! wp_has_ability_category( $args['category'] ) ) { _doing_it_wrong( __METHOD__, sprintf( /* translators: %1$s: ability category slug, %2$s: ability name */ __( 'Ability category "%1$s" is not registered. Please register the ability category before assigning it to ability "%2$s".' ), esc_html( $args['category'] ), esc_html( $name ) ), '6.9.0' ); return null; } } // The class is only used to instantiate the ability, and is not a property of the ability itself. if ( isset( $args['ability_class'] ) && ! is_a( $args['ability_class'], WP_Ability::class, true ) ) { _doing_it_wrong( __METHOD__, __( 'The ability args should provide a valid `ability_class` that extends WP_Ability.' ), '6.9.0' ); return null; } /** @var class-string */ $ability_class = $args['ability_class'] ?? WP_Ability::class; unset( $args['ability_class'] ); try { // WP_Ability::prepare_properties() will throw an exception if the properties are invalid. $ability = new $ability_class( $name, $args ); } catch ( InvalidArgumentException $e ) { _doing_it_wrong( __METHOD__, $e->getMessage(), '6.9.0' ); return null; } $this->registered_abilities[ $name ] = $ability; return $ability; } /** * Unregisters an ability. * * Do not use this method directly. Instead, use the `wp_unregister_ability()` function. * * @since 6.9.0 * * @see wp_unregister_ability() * * @param string $name The name of the registered ability, with its namespace. * @return WP_Ability|null The unregistered ability instance on success, null on failure. */ public function unregister( string $name ): ?WP_Ability { if ( ! $this->is_registered( $name ) ) { _doing_it_wrong( __METHOD__, /* translators: %s: Ability name. */ sprintf( __( 'Ability "%s" not found.' ), esc_html( $name ) ), '6.9.0' ); return null; } $unregistered_ability = $this->registered_abilities[ $name ]; unset( $this->registered_abilities[ $name ] ); return $unregistered_ability; } /** * Retrieves the list of all registered abilities. * * Do not use this method directly. Instead, use the `wp_get_abilities()` function. * * @since 6.9.0 * * @see wp_get_abilities() * * @return WP_Ability[] The array of registered abilities. */ public function get_all_registered(): array { return $this->registered_abilities; } /** * Checks if an ability is registered. * * Do not use this method directly. Instead, use the `wp_has_ability()` function. * * @since 6.9.0 * * @see wp_has_ability() * * @param string $name The name of the registered ability, with its namespace. * @return bool True if the ability is registered, false otherwise. */ public function is_registered( string $name ): bool { return isset( $this->registered_abilities[ $name ] ); } /** * Retrieves a registered ability. * * Do not use this method directly. Instead, use the `wp_get_ability()` function. * * @since 6.9.0 * * @see wp_get_ability() * * @param string $name The name of the registered ability, with its namespace. * @return WP_Ability|null The registered ability instance, or null if it is not registered. */ public function get_registered( string $name ): ?WP_Ability { if ( ! $this->is_registered( $name ) ) { _doing_it_wrong( __METHOD__, /* translators: %s: Ability name. */ sprintf( __( 'Ability "%s" not found.' ), esc_html( $name ) ), '6.9.0' ); return null; } return $this->registered_abilities[ $name ]; } /** * Utility method to retrieve the main instance of the registry class. * * The instance will be created if it does not exist yet. * * @since 6.9.0 * * @return WP_Abilities_Registry|null The main registry instance, or null when `init` action has not fired. */ public static function get_instance(): ?self { if ( ! did_action( 'init' ) ) { _doing_it_wrong( __METHOD__, sprintf( // translators: %s: init action. __( 'Ability API should not be initialized before the %s action has fired.' ), 'init' ), '6.9.0' ); return null; } if ( null === self::$instance ) { self::$instance = new self(); // Ensure ability category registry is initialized first to allow categories to be registered // before abilities that depend on them. WP_Ability_Categories_Registry::get_instance(); /** * Fires when preparing abilities registry. * * Abilities should be created and register their hooks on this action rather * than another action to ensure they're only loaded when needed. * * @since 6.9.0 * * @param WP_Abilities_Registry $instance Abilities registry object. */ do_action( 'wp_abilities_api_init', self::$instance ); } return self::$instance; } /** * Wakeup magic method. * * @since 6.9.0 * @throws LogicException If the registry object is unserialized. * This is a security hardening measure to prevent unserialization of the registry. */ public function __wakeup(): void { throw new LogicException( __CLASS__ . ' should never be unserialized.' ); } /** * Sleep magic method. * * @since 6.9.0 * @throws LogicException If the registry object is serialized. * This is a security hardening measure to prevent serialization of the registry. */ public function __sleep(): array { throw new LogicException( __CLASS__ . ' should never be serialized.' ); } } PK U]%uuclass-wp-ability.phpnu[PK U]ܦ FFclass-wp-ability-category.phpnu[PK U]RmHH(Lclass-wp-ability-categories-registry.phpnu[PK U]'.2.2class-wp-abilities-registry.phpnu[PKxi