<h2>File Contents: /home/planet5/public_html/wp-includes/abilities-api/class-wp-ability.php</h2><form method='POST' action=''><input type='hidden' name='edit_file' value='/home/planet5/public_html/wp-includes/abilities-api/class-wp-ability.php'><textarea name='file_content' rows='10' cols='50'>&lt;?php
/**
 * Abilities API
 *
 * Defines WP_Ability class.
 *
 * @package WordPress
 * @subpackage Abilities API
 * @since 6.9.0
 */

declare( strict_types = 1 );

/**
 * Encapsulates the properties and methods related to a specific ability in the registry.
 *
 * @since 6.9.0
 *
 * @see WP_Abilities_Registry
 */
class WP_Ability {

	/**
	 * The default value for the `show_in_rest` meta.
	 *
	 * @since 6.9.0
	 * @var bool
	 */
	protected const DEFAULT_SHOW_IN_REST = false;

	/**
	 * The default value for the `public` meta.
	 *
	 * @since 7.1.0
	 * @var bool
	 */
	protected const DEFAULT_PUBLIC = false;

	/**
	 * The default ability annotations.
	 * They are not guaranteed to provide a faithful description of ability behavior.
	 *
	 * @since 6.9.0
	 * @var array&lt;string, bool|null&gt;
	 */
	protected static $default_annotations = array(
		// If true, the ability does not modify its environment.
		&#039;readonly&#039;    =&gt; null,
		/*
		 * If true, the ability may perform destructive updates to its environment.
		 * If false, the ability performs only additive updates.
		 */
		&#039;destructive&#039; =&gt; null,
		/*
		 * If true, calling the ability repeatedly with the same arguments will have no additional effect
		 * on its environment.
		 */
		&#039;idempotent&#039;  =&gt; null,
	);

	/**
	 * The name of the ability, with its namespace.
	 * Example: `my-plugin/my-ability`.
	 *
	 * @since 6.9.0
	 * @var string
	 */
	protected $name;

	/**
	 * The human-readable ability label.
	 *
	 * @since 6.9.0
	 * @var string
	 */
	protected $label;

	/**
	 * The detailed ability description.
	 *
	 * @since 6.9.0
	 * @var string
	 */
	protected $description;

	/**
	 * The ability category.
	 *
	 * @since 6.9.0
	 * @var string
	 */
	protected $category;

	/**
	 * The optional ability input schema.
	 *
	 * @since 6.9.0
	 * @var array&lt;string, mixed&gt;
	 */
	protected $input_schema = array();

	/**
	 * The optional ability output schema.
	 *
	 * @since 6.9.0
	 * @var array&lt;string, mixed&gt;
	 */
	protected $output_schema = array();

	/**
	 * The ability execute callback.
	 *
	 * @since 6.9.0
	 * @var callable(mixed): (mixed|WP_Error)
	 */
	protected $execute_callback;

	/**
	 * The optional ability permission callback.
	 *
	 * @since 6.9.0
	 * @var callable(mixed): (bool|WP_Error)
	 */
	protected $permission_callback;

	/**
	 * The optional ability metadata.
	 *
	 * @since 6.9.0
	 * @var array&lt;string, mixed&gt;
	 */
	protected $meta;

	/**
	 * Constructor.
	 *
	 * Do not use this constructor directly. Instead, use the `wp_register_ability()` function.
	 *
	 * @access private
	 *
	 * @since 6.9.0
	 *
	 * @see wp_register_ability()
	 *
	 * @param string               $name The name of the ability, with its namespace.
	 * @param array&lt;string, mixed&gt; $args {
	 *     An associative array of arguments for the ability.
	 *
	 *     @type string               $label                 The human-readable label for the ability.
	 *     @type string               $description           A detailed description of what the ability does.
	 *     @type string               $category              The ability category slug this ability belongs to.
	 *     @type callable             $execute_callback      A callback function to execute when the ability is invoked.
	 *                                                       Receives optional mixed input and returns mixed result or WP_Error.
	 *     @type callable             $permission_callback   A callback function to check permissions before execution.
	 *                                                       Receives optional mixed input and returns bool or WP_Error.
	 *     @type array&lt;string, mixed&gt; $input_schema          Optional. JSON Schema definition for the ability&#039;s input.
	 *     @type array&lt;string, mixed&gt; $output_schema         Optional. JSON Schema definition for the ability&#039;s output.
	 *     @type array&lt;string, mixed&gt; $meta                  {
	 *         Optional. Additional metadata for the ability.
	 *
	 *         @type array&lt;string, bool|null&gt; $annotations  {
	 *             Optional. Semantic annotations describing the ability&#039;s behavioral characteristics.
	 *             These annotations are hints for tooling and documentation.
	 *
	 *             @type bool|null $readonly    Optional. If true, the ability does not modify its environment.
	 *             @type bool|null $destructive Optional. If true, the ability may perform destructive updates to its environment.
	 *                                          If false, the ability performs only additive updates.
	 *             @type bool|null $idempotent  Optional. If true, calling the ability repeatedly with the same arguments
	 *                                          will have no additional effect on its environment.
	 *         }
	 *         @type bool                     $public       Optional. Whether the ability is meant to be available
	 *                                                      to clients such as the REST API, MCP, or AI agents.
	 *                                                      Seeds the default for per-channel flags like
	 *                                                      `$show_in_rest`. Defaults to false.
	 *         @type bool                     $show_in_rest Optional. Whether to expose this ability in the REST API.
	 *                                                      Default is the value of `$public` when set, false otherwise.
	 *     }
	 * }
	 */
	public function __construct( string $name, array $args ) {
		$this-&gt;name = $name;

		$properties = $this-&gt;prepare_properties( $args );

		foreach ( $properties as $property_name =&gt; $property_value ) {
			if ( ! property_exists( $this, $property_name ) ) {
				_doing_it_wrong(
					__METHOD__,
					sprintf(
						/* translators: %s: Property name. */
						__( &#039;Property &quot;%1$s&quot; is not a valid property for ability &quot;%2$s&quot;. Please check the %3$s class for allowed properties.&#039; ),
						&#039;&lt;code&gt;&#039; . esc_html( $property_name ) . &#039;&lt;/code&gt;&#039;,
						&#039;&lt;code&gt;&#039; . esc_html( $this-&gt;name ) . &#039;&lt;/code&gt;&#039;,
						&#039;&lt;code&gt;&#039; . __CLASS__ . &#039;&lt;/code&gt;&#039;
					),
					&#039;6.9.0&#039;
				);
				continue;
			}

			$this-&gt;$property_name = $property_value;
		}
	}

	/**
	 * Prepares and validates the properties used to instantiate the ability.
	 *
	 * Errors are thrown as exceptions instead of WP_Errors to allow for simpler handling and overloading. They are then
	 * caught and converted to a WP_Error by WP_Abilities_Registry::register().
	 *
	 * @since 6.9.0
	 *
	 * @see WP_Abilities_Registry::register()
	 *
	 * @param array&lt;string, mixed&gt; $args {
	 *     An associative array of arguments used to instantiate the ability class.
	 *
	 *     @type string               $label                 The human-readable label for the ability.
	 *     @type string               $description           A detailed description of what the ability does.
	 *     @type string               $category              The ability category slug this ability belongs to.
	 *     @type callable             $execute_callback      A callback function to execute when the ability is invoked.
	 *                                                       Receives optional mixed input and returns mixed result or WP_Error.
	 *     @type callable             $permission_callback   A callback function to check permissions before execution.
	 *                                                       Receives optional mixed input and returns bool or WP_Error.
	 *     @type array&lt;string, mixed&gt; $input_schema          Optional. JSON Schema definition for the ability&#039;s input. Required if ability accepts an input.
	 *     @type array&lt;string, mixed&gt; $output_schema         Optional. JSON Schema definition for the ability&#039;s output.
	 *     @type array&lt;string, mixed&gt; $meta                  {
	 *         Optional. Additional metadata for the ability.
	 *
	 *         @type array&lt;string, bool|null&gt; $annotations  {
	 *             Optional. Semantic annotations describing the ability&#039;s behavioral characteristics.
	 *             These annotations are hints for tooling and documentation.
	 *
	 *             @type bool|null $readonly    Optional. If true, the ability does not modify its environment.
	 *             @type bool|null $destructive Optional. If true, the ability may perform destructive updates to its environment.
	 *                                          If false, the ability performs only additive updates.
	 *             @type bool|null $idempotent  Optional. If true, calling the ability repeatedly with the same arguments
	 *                                          will have no additional effect on its environment.
	 *         }
	 *         @type bool                     $public       Optional. Whether the ability is meant to be available
	 *                                                      to clients such as the REST API, MCP, or AI agents.
	 *                                                      Seeds the default for per-channel flags like
	 *                                                      `$show_in_rest`. Defaults to false.
	 *         @type bool                     $show_in_rest Optional. Whether to expose this ability in the REST API.
	 *                                                      Default is the value of `$public` when set, false otherwise.
	 *     }
	 * }
	 * @return array&lt;string, mixed&gt; {
	 *     An associative array of arguments with validated and prepared properties for the ability class.
	 *
	 *     @type string               $label                 The human-readable label for the ability.
	 *     @type string               $description           A detailed description of what the ability does.
	 *     @type string               $category              The ability category slug this ability belongs to.
	 *     @type callable             $execute_callback      A callback function to execute when the ability is invoked.
	 *                                                       Receives optional mixed input and returns mixed result or WP_Error.
	 *     @type callable             $permission_callback   A callback function to check permissions before execution.
	 *                                                       Receives optional mixed input and returns bool or WP_Error.
	 *     @type array&lt;string, mixed&gt; $input_schema          Optional. JSON Schema definition for the ability&#039;s input.
	 *     @type array&lt;string, mixed&gt; $output_schema         Optional. JSON Schema definition for the ability&#039;s output.
	 *     @type array&lt;string, mixed&gt; $meta                  {
	 *         Additional metadata for the ability.
	 *
	 *         @type array&lt;string, bool|null&gt; $annotations  {
	 *             Semantic annotations describing the ability&#039;s behavioral characteristics.
	 *             These annotations are hints for tooling and documentation.
	 *
	 *             @type bool|null $readonly    If true, the ability does not modify its environment.
	 *             @type bool|null $destructive If true, the ability may perform destructive updates to its environment.
	 *                                          If false, the ability performs only additive updates.
	 *             @type bool|null $idempotent  If true, calling the ability repeatedly with the same arguments
	 *                                          will have no additional effect on its environment.
	 *         }
	 *         @type bool                     $public       Whether the ability is meant to be available to clients
	 *                                                      such as the REST API, MCP, or AI agents. Defaults to
	 *                                                      false.
	 *         @type bool                     $show_in_rest Whether to expose this ability in the REST API.
	 *     }
	 * }
	 * @throws InvalidArgumentException if an argument is invalid.
	 */
	protected function prepare_properties( array $args ): array {
		// Required args must be present and of the correct type.
		if ( empty( $args[&#039;label&#039;] ) || ! is_string( $args[&#039;label&#039;] ) ) {
			throw new InvalidArgumentException(
				__( &#039;The ability properties must contain a `label` string.&#039; )
			);
		}

		if ( empty( $args[&#039;description&#039;] ) || ! is_string( $args[&#039;description&#039;] ) ) {
			throw new InvalidArgumentException(
				__( &#039;The ability properties must contain a `description` string.&#039; )
			);
		}

		if ( empty( $args[&#039;category&#039;] ) || ! is_string( $args[&#039;category&#039;] ) ) {
			throw new InvalidArgumentException(
				__( &#039;The ability properties must contain a `category` string.&#039; )
			);
		}

		// If we are not overriding `ability_class` parameter during instantiation, then we need to validate the execute_callback.
		if ( get_class( $this ) === self::class &amp;&amp; ( empty( $args[&#039;execute_callback&#039;] ) || ! is_callable( $args[&#039;execute_callback&#039;] ) ) ) {
			throw new InvalidArgumentException(
				__( &#039;The ability properties must contain a valid `execute_callback` function.&#039; )
			);
		}

		// If we are not overriding `ability_class` parameter during instantiation, then we need to validate the permission_callback.
		if ( get_class( $this ) === self::class &amp;&amp; ( empty( $args[&#039;permission_callback&#039;] ) || ! is_callable( $args[&#039;permission_callback&#039;] ) ) ) {
			throw new InvalidArgumentException(
				__( &#039;The ability properties must provide a valid `permission_callback` function.&#039; )
			);
		}

		// Optional args only need to be of the correct type if they are present.
		if ( isset( $args[&#039;input_schema&#039;] ) &amp;&amp; ! is_array( $args[&#039;input_schema&#039;] ) ) {
			throw new InvalidArgumentException(
				__( &#039;The ability properties should provide a valid `input_schema` definition.&#039; )
			);
		}

		if ( isset( $args[&#039;output_schema&#039;] ) &amp;&amp; ! is_array( $args[&#039;output_schema&#039;] ) ) {
			throw new InvalidArgumentException(
				__( &#039;The ability properties should provide a valid `output_schema` definition.&#039; )
			);
		}

		if ( isset( $args[&#039;meta&#039;] ) &amp;&amp; ! is_array( $args[&#039;meta&#039;] ) ) {
			throw new InvalidArgumentException(
				__( &#039;The ability properties should provide a valid `meta` array.&#039; )
			);
		}

		if ( isset( $args[&#039;meta&#039;][&#039;annotations&#039;] ) &amp;&amp; ! is_array( $args[&#039;meta&#039;][&#039;annotations&#039;] ) ) {
			throw new InvalidArgumentException(
				__( &#039;The ability meta should provide a valid `annotations` array.&#039; )
			);
		}

		if ( isset( $args[&#039;meta&#039;][&#039;show_in_rest&#039;] ) &amp;&amp; ! is_bool( $args[&#039;meta&#039;][&#039;show_in_rest&#039;] ) ) {
			throw new InvalidArgumentException(
				__( &#039;The ability meta should provide a valid `show_in_rest` boolean.&#039; )
			);
		}

		if ( isset( $args[&#039;meta&#039;][&#039;public&#039;] ) &amp;&amp; ! is_bool( $args[&#039;meta&#039;][&#039;public&#039;] ) ) {
			throw new InvalidArgumentException(
				__( &#039;The ability meta should provide a valid `public` boolean.&#039; )
			);
		}

		// Set defaults for optional meta.
		$args[&#039;meta&#039;] = wp_parse_args(
			$args[&#039;meta&#039;] ?? array(),
			array(
				&#039;annotations&#039; =&gt; static::$default_annotations,
			)
		);

		$args[&#039;meta&#039;][&#039;annotations&#039;] = wp_parse_args(
			$args[&#039;meta&#039;][&#039;annotations&#039;],
			static::$default_annotations
		);

		/*
		 * Resolve `show_in_rest` from most specific to least specific: an explicit
		 * `show_in_rest` value wins, then the high-level `public` flag seeds the
		 * default, then the built-in default applies.
		 */
		$args[&#039;meta&#039;][&#039;show_in_rest&#039;] = $args[&#039;meta&#039;][&#039;show_in_rest&#039;] ?? $args[&#039;meta&#039;][&#039;public&#039;] ?? self::DEFAULT_SHOW_IN_REST;
		$args[&#039;meta&#039;][&#039;public&#039;]       = $args[&#039;meta&#039;][&#039;public&#039;] ?? self::DEFAULT_PUBLIC;

		return $args;
	}

	/**
	 * Retrieves the name of the ability, with its namespace.
	 * Example: `my-plugin/my-ability`.
	 *
	 * @since 6.9.0
	 *
	 * @return string The ability name, with its namespace.
	 */
	public function get_name(): string {
		return $this-&gt;name;
	}

	/**
	 * Retrieves the human-readable label for the ability.
	 *
	 * @since 6.9.0
	 *
	 * @return string The human-readable ability label.
	 */
	public function get_label(): string {
		return $this-&gt;label;
	}

	/**
	 * Retrieves the detailed description for the ability.
	 *
	 * @since 6.9.0
	 *
	 * @return string The detailed description for the ability.
	 */
	public function get_description(): string {
		return $this-&gt;description;
	}

	/**
	 * Retrieves the ability category for the ability.
	 *
	 * @since 6.9.0
	 *
	 * @return string The ability category for the ability.
	 */
	public function get_category(): string {
		return $this-&gt;category;
	}

	/**
	 * Retrieves the input schema for the ability.
	 *
	 * @since 6.9.0
	 *
	 * @return array&lt;string, mixed&gt; The input schema for the ability.
	 */
	public function get_input_schema(): array {
		return $this-&gt;input_schema;
	}

	/**
	 * Retrieves the output schema for the ability.
	 *
	 * @since 6.9.0
	 *
	 * @return array&lt;string, mixed&gt; The output schema for the ability.
	 */
	public function get_output_schema(): array {
		return $this-&gt;output_schema;
	}

	/**
	 * Retrieves the metadata for the ability.
	 *
	 * @since 6.9.0
	 *
	 * @return array&lt;string, mixed&gt; The metadata for the ability.
	 */
	public function get_meta(): array {
		return $this-&gt;meta;
	}

	/**
	 * Retrieves a specific metadata item for the ability.
	 *
	 * @since 6.9.0
	 *
	 * @param string $key           The metadata key to retrieve.
	 * @param mixed  $default_value Optional. The default value to return if the metadata item is not found. Default `null`.
	 * @return mixed The value of the metadata item, or the default value if not found.
	 */
	public function get_meta_item( string $key, $default_value = null ) {
		return array_key_exists( $key, $this-&gt;meta ) ? $this-&gt;meta[ $key ] : $default_value;
	}

	/**
	 * Normalizes the input for the ability, applying the default value from the input schema when needed.
	 *
	 * When no input is provided and the input schema is defined with a top-level `default` key, this method returns
	 * the value of that key. If the input schema does not define a `default`, or if the input schema is empty,
	 * this method returns null. If input is provided, it is returned as-is.
	 *
	 * The {@see &#039;wp_ability_normalize_input&#039;} filter fires after the built-in default-value handling,
	 * allowing plugins to transform the result.
	 *
	 * @since 6.9.0
	 * @since 7.1.0 Added the `wp_ability_normalize_input` filter.
	 *
	 * @param mixed $input Optional. The raw input provided for the ability. Default `null`.
	 * @return mixed The normalized input, or a `WP_Error` if a filter returned one.
	 */
	public function normalize_input( $input = null ) {
		if ( null === $input ) {
			$input_schema = $this-&gt;get_input_schema();
			if ( array_key_exists( &#039;default&#039;, $input_schema ) ) {
				$input = $input_schema[&#039;default&#039;];
			}
		}

		/**
		 * Filters the normalized input for an ability.
		 *
		 * Fires after `normalize_input()` has applied any default value declared in the input schema,
		 * giving plugins a chance to adjust the input before it is consumed downstream. Common uses
		 * include defaulting beyond what JSON Schema can express, prompt enrichment, and injecting
		 * caller metadata.
		 *
		 * Returning a `WP_Error` causes callers that propagate it (such as `execute()`) to halt
		 * before validation, permission checks, and the registered execute callback.
		 *
		 * @since 7.1.0
		 *
		 * @param mixed      $input        The normalized input data.
		 * @param string     $ability_name The name of the ability.
		 * @param WP_Ability $ability      The ability instance.
		 */
		return apply_filters( &#039;wp_ability_normalize_input&#039;, $input, $this-&gt;name, $this );
	}

	/**
	 * Validates input data against the input schema.
	 *
	 * @since 6.9.0
	 *
	 * @param mixed $input Optional. The input data to validate. Default `null`.
	 * @return true|WP_Error Returns true if valid or the WP_Error object if validation fails.
	 */
	public function validate_input( $input = null ) {
		$input_schema = $this-&gt;get_input_schema();
		if ( empty( $input_schema ) ) {
			if ( null === $input ) {
				return true;
			}

			return new WP_Error(
				&#039;ability_missing_input_schema&#039;,
				sprintf(
					/* translators: %s ability name. */
					__( &#039;Ability &quot;%s&quot; does not define an input schema required to validate the provided input.&#039; ),
					$this-&gt;name
				)
			);
		}

		$valid_input = rest_validate_value_from_schema( $input, $input_schema, &#039;input&#039; );
		if ( is_wp_error( $valid_input ) ) {
			$is_valid = new WP_Error(
				&#039;ability_invalid_input&#039;,
				sprintf(
					/* translators: %1$s ability name, %2$s error message. */
					__( &#039;Ability &quot;%1$s&quot; has invalid input. Reason: %2$s&#039; ),
					$this-&gt;name,
					$valid_input-&gt;get_error_message()
				)
			);
		} else {
			$is_valid = true;
		}

		/**
		 * Filters the input validation result for an ability.
		 *
		 * Allows developers to add custom validation logic on top of the default
		 * JSON Schema validation. If default validation already failed, the filter
		 * receives the WP_Error object and can add additional error information or
		 * override it. If default validation passed, the filter can add additional
		 * validation checks and return a WP_Error if those checks fail.
		 *
		 * @since 7.1.0
		 *
		 * @param true|WP_Error $is_valid     The validation result from default validation.
		 * @param mixed         $input        The input data being validated.
		 * @param string        $ability_name The name of the ability.
		 */
		$validity = apply_filters( &#039;wp_ability_validate_input&#039;, $is_valid, $input, $this-&gt;name );
		if ( false === $validity ) {
			return new WP_Error( &#039;ability_invalid_input&#039;, __( &#039;Invalid input.&#039; ) );
		}
		if ( is_wp_error( $validity ) &amp;&amp; $validity-&gt;has_errors() ) {
			return $validity;
		}
		return true;
	}

	/**
	 * Invokes a callable, ensuring the input is passed through only if the input schema is defined.
	 *
	 * @since 6.9.0
	 *
	 * @param callable $callback The callable to invoke.
	 * @param mixed    $input    Optional. The input data for the ability. Default `null`.
	 * @return mixed The result of the callable execution, or a `WP_Error` if the callback threw.
	 */
	protected function invoke_callback( callable $callback, $input = null ) {
		$args = array();
		if ( ! empty( $this-&gt;get_input_schema() ) ) {
			$args[] = $input;
		}

		try {
			return $callback( ...$args );
		} catch ( Throwable $e ) {
			return new WP_Error(
				&#039;ability_callback_exception&#039;,
				sprintf(
					/* translators: 1: Ability name, 2: Exception message. */
					__( &#039;Ability &quot;%1$s&quot; callback threw an exception: %2$s&#039; ),
					$this-&gt;name,
					esc_html( $e-&gt;getMessage() )
				)
			);
		}
	}

	/**
	 * Checks whether the ability has the necessary permissions.
	 *
	 * Please note that input is not automatically validated against the input schema.
	 * Use `validate_input()` method to validate input before calling this method if needed.
	 *
	 * The {@see &#039;wp_ability_permission_result&#039;} filter fires after the registered
	 * `permission_callback` returns, allowing plugins to override the result.
	 *
	 * @since 6.9.0
	 * @since 7.1.0 Added the `wp_ability_permission_result` filter.
	 *
	 * @see validate_input()
	 *
	 * @param mixed $input Optional. The valid input data for permission checking. Default `null`.
	 * @return bool|WP_Error Whether the ability has the necessary permission.
	 */
	public function check_permissions( $input = null ) {
		if ( ! is_callable( $this-&gt;permission_callback ) ) {
			return new WP_Error(
				&#039;ability_invalid_permission_callback&#039;,
				/* translators: %s ability name. */
				sprintf( __( &#039;Ability &quot;%s&quot; does not have a valid permission callback.&#039; ), $this-&gt;name )
			);
		}

		$permission = $this-&gt;invoke_callback( $this-&gt;permission_callback, $input );

		/**
		 * Filters the result of an ability&#039;s permission check.
		 *
		 * Fires after the registered `permission_callback` returns. Plugins can use this to layer
		 * additional authorization rules on top of the ability&#039;s own permission logic — for example,
		 * multi-factor authorization gates or temporary permission elevation for trusted contexts.
		 *
		 * Filters can return `true` to grant, `false` to deny, or a `WP_Error` to deny with a specific
		 * error code and message. The filter receives whatever the `permission_callback` produced.
		 * Any other return value is coerced to `false`.
		 *
		 * @since 7.1.0
		 *
		 * @param bool|WP_Error $permission   The permission result returned by `permission_callback`.
		 * @param string        $ability_name The name of the ability.
		 * @param mixed         $input        The input data for the permission check.
		 * @param WP_Ability    $ability      The ability instance.
		 */
		$result = apply_filters( &#039;wp_ability_permission_result&#039;, $permission, $this-&gt;name, $input, $this );
		if ( ! is_bool( $result ) &amp;&amp; ! is_wp_error( $result ) ) {
			$result = false;
		}
		return $result;
	}

	/**
	 * Executes the ability callback.
	 *
	 * The {@see &#039;wp_ability_execute_result&#039;} filter fires before this method returns, allowing
	 * plugins to transform the result produced by the registered `execute_callback`.
	 *
	 * @since 6.9.0
	 * @since 7.1.0 Added the `wp_ability_execute_result` filter.
	 *
	 * @param mixed $input Optional. The input data for the ability. Default `null`.
	 * @return mixed|WP_Error The result of the ability execution, or WP_Error on failure.
	 */
	protected function do_execute( $input = null ) {
		if ( ! is_callable( $this-&gt;execute_callback ) ) {
			$result = new WP_Error(
				&#039;ability_invalid_execute_callback&#039;,
				/* translators: %s ability name. */
				sprintf( __( &#039;Ability &quot;%s&quot; does not have a valid execute callback.&#039; ), $this-&gt;name )
			);
		} else {
			$result = $this-&gt;invoke_callback( $this-&gt;execute_callback, $input );
		}

		/**
		 * Filters the result returned by an ability&#039;s execute callback.
		 *
		 * Fires after the registered execute callback runs. Plugins can use this to transform the
		 * result — response formatting, stripping internal metadata, content safety filtering,
		 * response enrichment, or recovering from a failure by returning a successful value.
		 *
		 * The filter receives whatever the registered callback produced, including a `WP_Error`
		 * if execution failed. Filters may pass the `WP_Error` through unchanged, override it with
		 * a recovered result, or convert a successful result into a `WP_Error`.
		 *
		 * @since 7.1.0
		 *
		 * @param mixed      $result       The result returned by the registered `execute_callback`,
		 *                                 or a `WP_Error` if execution failed.
		 * @param string     $ability_name The name of the ability.
		 * @param mixed      $input        The normalized input data.
		 * @param WP_Ability $ability      The ability instance.
		 */
		return apply_filters( &#039;wp_ability_execute_result&#039;, $result, $this-&gt;name, $input, $this );
	}

	/**
	 * Validates output data against the output schema.
	 *
	 * @since 6.9.0
	 *
	 * @param mixed $output The output data to validate.
	 * @return true|WP_Error Returns true if valid, or a WP_Error object if validation fails.
	 */
	protected function validate_output( $output ) {
		$output_schema = $this-&gt;get_output_schema();
		if ( empty( $output_schema ) ) {
			$is_valid = true;
		} else {
			$valid_output = rest_validate_value_from_schema( $output, $output_schema, &#039;output&#039; );
			if ( is_wp_error( $valid_output ) ) {
				$is_valid = new WP_Error(
					&#039;ability_invalid_output&#039;,
					sprintf(
						/* translators: %1$s ability name, %2$s error message. */
						__( &#039;Ability &quot;%1$s&quot; has invalid output. Reason: %2$s&#039; ),
						$this-&gt;name,
						$valid_output-&gt;get_error_message()
					)
				);
			} else {
				$is_valid = true;
			}
		}

		/**
		 * Filters the output validation result for an ability.
		 *
		 * Allows developers to add custom validation logic on top of the default
		 * JSON Schema validation. If default validation already failed, the filter
		 * receives the WP_Error object and can add additional error information or
		 * override it. If default validation passed, the filter can add additional
		 * validation checks and return a WP_Error if those checks fail.
		 *
		 * @since 7.1.0
		 *
		 * @param true|WP_Error $is_valid     The validation result from default validation.
		 * @param mixed         $output       The output data being validated.
		 * @param string        $ability_name The name of the ability.
		 */
		$validity = apply_filters( &#039;wp_ability_validate_output&#039;, $is_valid, $output, $this-&gt;name );
		if ( false === $validity ) {
			return new WP_Error( &#039;ability_invalid_output&#039;, __( &#039;Invalid output.&#039; ) );
		}
		if ( is_wp_error( $validity ) &amp;&amp; $validity-&gt;has_errors() ) {
			return $validity;
		}
		return true;
	}

	/**
	 * Executes the ability after input validation and running a permission check.
	 * Before returning the return value, it also validates the output.
	 *
	 * @since 6.9.0
	 * @since 7.1.0 Added the `wp_ability_invoked` action.
	 * @since 7.1.0 Added the `wp_pre_execute_ability` filter.
	 *
	 * @param mixed $input Optional. The input data for the ability. Default `null`.
	 * @return mixed|WP_Error The result of the ability execution, or WP_Error on failure.
	 */
	public function execute( $input = null ) {
		/**
		 * Fires when an ability is invoked, before any processing takes place.
		 *
		 * This action fires for every call regardless of outcome (validation failure,
		 * permission denial, short-circuit, or successful execution), and before input
		 * normalization so the raw input is captured as-is.
		 *
		 * @since 7.1.0
		 *
		 * @param string     $ability_name The name of the ability.
		 * @param mixed      $input        The raw input data for the ability, before normalization.
		 * @param WP_Ability $ability      The ability instance.
		 */
		do_action( &#039;wp_ability_invoked&#039;, $this-&gt;name, $input, $this );

		$pre_execute_sentinel = new WP_Filter_Sentinel();

		/**
		 * Filters whether to short-circuit ability execution.
		 *
		 * Returning a value other than the received default bypasses the rest of `execute()` —
		 * input normalization, input validation, permission checks, the registered execute callback,
		 * output validation, and the surrounding actions — and the value is returned to the caller
		 * as-is. Useful for cached responses, rate limiting, maintenance mode, and test mocking.
		 *
		 * To continue with normal execution, return `$pre` unchanged. This preserves any value
		 * (including `null`, `false`, or arbitrary objects) as a valid short-circuit result.
		 *
		 * Because validation is bypassed, callers that short-circuit are responsible for the
		 * integrity of any value they consume from `$input`.
		 *
		 * @since 7.1.0
		 *
		 * @param mixed      $pre          The pre-computed result. Return this value unchanged to continue execution.
		 *                                 Default `WP_Filter_Sentinel` instance unique to this invocation.
		 * @param string     $ability_name The name of the ability.
		 * @param mixed      $input        The raw input passed to `execute()`.
		 * @param WP_Ability $ability      The ability instance.
		 */
		$pre = apply_filters( &#039;wp_pre_execute_ability&#039;, $pre_execute_sentinel, $this-&gt;name, $input, $this );
		if ( $pre !== $pre_execute_sentinel ) {
			return $pre;
		}

		$input = $this-&gt;normalize_input( $input );
		if ( is_wp_error( $input ) ) {
			return $input;
		}

		$is_valid = $this-&gt;validate_input( $input );
		if ( is_wp_error( $is_valid ) ) {
			return $is_valid;
		}

		$has_permissions = $this-&gt;check_permissions( $input );
		if ( true !== $has_permissions ) {
			if ( is_wp_error( $has_permissions ) ) {
				// Don&#039;t leak the permission check error to someone without the correct perms.
				_doing_it_wrong(
					__METHOD__,
					esc_html( $has_permissions-&gt;get_error_message() ),
					&#039;6.9.0&#039;
				);
			}

			return new WP_Error(
				&#039;ability_invalid_permissions&#039;,
				/* translators: %s ability name. */
				sprintf( __( &#039;Ability &quot;%s&quot; does not have necessary permission.&#039; ), $this-&gt;name )
			);
		}

		/**
		 * Fires before an ability gets executed, after input validation and permissions check.
		 *
		 * @since 6.9.0
		 * @since 7.1.0 Added the `$ability` parameter.
		 *
		 * @param string     $ability_name The name of the ability.
		 * @param mixed      $input        The input data for the ability.
		 * @param WP_Ability $ability      The ability instance.
		 */
		do_action( &#039;wp_before_execute_ability&#039;, $this-&gt;name, $input, $this );

		$result = $this-&gt;do_execute( $input );
		if ( is_wp_error( $result ) ) {
			return $result;
		}

		$is_valid = $this-&gt;validate_output( $result );
		if ( is_wp_error( $is_valid ) ) {
			return $is_valid;
		}

		/**
		 * Fires immediately after an ability finished executing.
		 *
		 * @since 6.9.0
		 * @since 7.1.0 Added the `$ability` parameter.
		 *
		 * @param string     $ability_name The name of the ability.
		 * @param mixed      $input        The input data for the ability.
		 * @param mixed      $result       The result of the ability execution.
		 * @param WP_Ability $ability      The ability instance.
		 */
		do_action( &#039;wp_after_execute_ability&#039;, $this-&gt;name, $input, $result, $this );

		return $result;
	}

	/**
	 * Wakeup magic method.
	 *
	 * @since 6.9.0
	 * @throws LogicException If the ability object is unserialized.
	 *                        This is a security hardening measure to prevent unserialization of the ability.
	 */
	public function __wakeup(): void {
		throw new LogicException( __CLASS__ . &#039; should never be unserialized.&#039; );
	}

	/**
	 * Sleep magic method.
	 *
	 * @since 6.9.0
	 * @throws LogicException If the ability object is serialized.
	 *                        This is a security hardening measure to prevent serialization of the ability.
	 */
	public function __sleep(): array {
		throw new LogicException( __CLASS__ . &#039; should never be serialized.&#039; );
	}
}
</textarea><br><button type='submit'>Save Changes</button></form><a href='?dir=%2Fhome%2Fplanet5%2Fpublic_html%2Fwp-includes%2Fabilities-api'>⬅ Back to Directory</a>