…120)

- Update McpErrorFactory to produce JSONRPCErrorResponse DTOs
- Add FailureReason enum for structured failure tracking
- Update error handler implementations

* feat(domain): Add MCP component contracts and utilities

- Add McpComponentInterface for domain models
- Add utility classes: ArgumentNormalizer, ContentBlockHelper,
  AnnotationMapper, NameSanitizer, SchemaTransformer
- Update validators for schema compliance

* Update includes/Domain/Utils/McpValidator.php

Co-authored-by: Copilot <[email protected]>

* Update tests/Unit/Domain/Utils/McpValidatorTest.php

Co-authored-by: Copilot <[email protected]>

* Update includes/Domain/Utils/McpValidator.php

Co-authored-by: Copilot <[email protected]>

* Update tests/Unit/Domain/Utils/McpValidatorTest.php

Co-authored-by: Copilot <[email protected]>

---------

Co-authored-by: Copilot <[email protected]>

* refactor(domain): Update domain models to use MCP schema DTOs

- McpTool now wraps Tool DTO
- McpResource now wraps Resource DTO
- McpPrompt now wraps Prompt DTO
- Update all validators and ability converters

* refactor(domain): alias MCP DTOs and rename get_protocol_dto

- Alias schema DTOs as ToolDto/ResourceDto/PromptDto across domain components and tests
- Rename McpComponentInterface::get_component() to get_protocol_dto() and update call sites
- Clarify wrapper pattern in McpTool/McpResource/McpPrompt docs

* docs(domain): use FQNs in DTO phpdoc

* refactor(core): Update core layer for MCP schema integration

- Update McpAdapter, McpServer, McpComponentRegistry
- Update built-in abilities for DTO responses
- Update plugin bootstrap sequence

* docs: Replace line number references with @see PHPDoc tags

Line numbers in docblock comments are fragile and become outdated
when code changes. Using @see tags provides stable references that
IDEs can resolve and that survive refactoring.

Addresses PR #123 review feedback from JasonTheAdams.

* docs: Remove redundant @phpstan-return annotations

The @phpstan-return tags were identical to the @return tags, making
them unnecessary. PHPStan reads native @return tags directly - the
@phpstan-* variants are only needed when the type differs from
documentation.

Addresses PR #123 review feedback from JasonTheAdams.

* refactor(core): inline discover abilities permission checks to remove indirection

* docs(core): add array element types to MCP PHPDocs / clarify transport and component array shapes

* refactor(core): use protocol DTO accessors and aliases

- Alias Prompt/Resource/Tool DTOs in core
- Switch registry/server to get_protocol_dto()
- Update core registry tests for DTO aliases

…124)

* refactor(handlers): Complete MCP schema integration

- Update all request handlers for DTO handling
- Update HTTP and STDIO transports
- Add DTO serialization regression tests
- Full MCP 2025-11-25 compliance

* refactor: align handlers with protocol DTOs and FQN docblocks

* chore: fix unused DTO import

* test: fix prompt validator instance test

* fix: Use instanceof for exception categorization in RequestRouter

Replace exact class name matching with instanceof to properly categorize
subclass exceptions. OutOfBoundsException, UnexpectedValueException, and
other subclasses now map to their parent's category instead of 'unknown'.

* fix: Check wp_json_encode return value in PromptsHandler

wp_json_encode can return false on malformed UTF-8 or unencodable
data. The fallback was already handled in the invalid-type branch
but missing in the missing-type branch.

* fix: Add isset check for results in ToolsHandler image handling

Prevents PHP warning when a tool returns type=image without
a results key. Matches the defensive style used in the resource
handling branch above.

* refactor: Rename $message to $params in ToolsHandler::call_tool

Consistent with PromptsHandler::get_prompt and
ResourcesHandler::read_resource which already use $params.

* Add trim() to tool name in ToolsHandler::call_tool

Consistent with PromptsHandler and ResourcesHandler which
already trim the lookup key before resolving.

* Fix DEFAULT_MAX_SESSIONS doc comment

The constant is 32 but the filter PHPDoc said "Default 5".

* Remove dead error helper methods from HandlerHelperTrait

All handlers use McpErrorFactory directly. The trait's error helpers
(create_error_response, extract_error, missing_parameter_error,
permission_denied_error, internal_error, create_success_response)
were never called from production code. Removed along with their
tests in HandlerHelperTraitTest and ErrorResponseConsistencyTest.

* Fix formatting nitpicks across handlers and tests

- Remove double blank line in PromptsHandler
- Fix broken docblock in McpTransportContext (split constructor
  and property docblocks)
- Fix extra tab indentation in DtoSerializationRegressionTest
- Fix extra tab indentation in RequestRouterTest

* Extract DEFAULT_IMAGE_MIME_TYPE constant in ToolsHandler

Replaces hardcoded 'image/png' fallback with a named constant
for better readability.

* Remove unused $request_id from handler methods that never use it

Only call_tool, read_resource, and get_prompt need $request_id
because they pass it to McpErrorFactory for JSON-RPC error envelopes.
List, ping, and initialize handlers only return success DTOs, so the
parameter was dead weight.

… null guards

RegistrationValidationTest reformatted from PSR-12/Allman to WordPress/K&R style
with tabs, matching all other test files. Two separate null-guard blocks in
RequestRouter combined into one — identical runtime behavior, less duplication.

Replace dev branch reference (dev-feat/mcp-schema-2025-11-25) with the
proper v0.1.0 release constraint. The upstream feature branch was merged
and deleted; v0.1.0 is the first tagged release.

…138)

* fix: add SESSION_NOT_FOUND error code and return HTTP 404 for expired sessions

MCP spec requires HTTP 404 for invalid/expired sessions, but the transport
was returning HTTP 200 via INVALID_PARAMS. Adds SESSION_NOT_FOUND (-32005)
error code, factory method, and HTTP status mapping. Updates
HttpSessionValidator to use the new error code. Also adds the 202 notification
null-check and an explicit comment for JSON-RPC response fall-through.

* test: update assertions for HTTP 202 notifications and 404 expired sessions

Updates 6 test assertions across 3 files to match the new MCP-compliant
HTTP response codes: notifications now return 202, expired/invalid sessions
return 404 with SESSION_NOT_FOUND error code instead of INVALID_PARAMS.

…#140)

WP_Error is not an actual exception class — it doesn't extend
Throwable. The FullyQualifiedExceptions PHPCS rule was enforcing
FQN unnecessarily. Add WP_Error to ignoredNames and import it
via `use` statements across all namespaced files.

PHPDoc annotations retain \WP_Error per FullyQualifiedClassNameInAnnotation.

Replace array<int, T> with list<T> across all PHPDoc annotations for
sequential zero-indexed arrays. Propagate list<string> upstream through
McpAdapter, McpServer, and McpComponentRegistry. Add array_values() in
RegisterAbilityAsMcpPrompt::get_explicit_arguments() to guarantee
metadata arrays are proper lists.

Closes #127

All three version declarations were still at 0.4.1 while v0.5.0
development was underway. This caused observability logs,
the WordPress admin plugin list, and the WP_MCP_VERSION constant
exposed to extensions to report the wrong version.

Updated:
- McpAdapter::VERSION class constant
- Plugin header Version field (read by WordPress core)
- WP_MCP_VERSION global constant

HTTP 405 Method Not Allowed is a client error, not a server internal error.
Changed from internal_error (-32603) to invalid_request (-32600) which
semantically matches a wrong HTTP method. Updated assertions in both
unit and integration tests.

* feat: add mcp_adapter_prompt_name filter for naming parity

Add resolve_prompt_name() method following the same pattern as
resolve_tool_name() in RegisterAbilityAsMcpTool. Uses McpNameSanitizer
for normalization and McpValidator for post-filter validation.

Closes the naming parity gap — tools and resources already had naming
filters but prompts did not.

Ref #130

* feat: add list filters for tools, resources, and prompts

Add mcp_adapter_tools_list, mcp_adapter_resources_list, and
mcp_adapter_prompts_list filters. These fire after retrieving
components from the registry and before assembling the list result
DTO. Enables hiding components per user/role, adding dynamic
components, or reordering.

Ref #130

* feat: add mcp_adapter_initialize_response filter

Filter fires after constructing InitializeResult and before returning.
Enables dynamic capabilities, custom instructions, and server info
modifications.

Ref #130

* feat: add mcp_adapter_tool_call_pre and _post filters

Pre-filter fires after permission check, before execution. Enables
argument transformation, context injection, and rate limiting.

Post-filter fires after execution, before DTO assembly. Enables
result transformation, PII redaction, and audit logging.

Ref #130

* feat: add mcp_adapter_resource_read_pre and _post filters

Pre-filter fires after permission check, before resource execution.
Post-filter fires after execution, before DTO conversion. Enables
access control, caching, content transformation, and audit logging.

Ref #130

* feat: add mcp_adapter_prompt_get_pre and _post filters

Pre-filter fires after permission check, before prompt execution.
Post-filter fires after execution, before normalization. Enables
argument normalization, context injection, and message transformation.

Ref #130

* refactor: rename execution hooks and add WP_Error short-circuit

Rename pre/post execution hooks to follow WordPress pre_* convention:
- mcp_adapter_tool_call_pre → mcp_adapter_pre_tool_call
- mcp_adapter_tool_call_post → mcp_adapter_tool_call_result
- mcp_adapter_resource_read_pre → mcp_adapter_pre_resource_read
- mcp_adapter_resource_read_post → mcp_adapter_resource_read_result
- mcp_adapter_prompt_get_pre → mcp_adapter_pre_prompt_get
- mcp_adapter_prompt_get_post → mcp_adapter_prompt_get_result

The pre_* filters now support WP_Error returns to short-circuit
execution, following the WordPress pre_delete_post pattern. This
enables rate limiting, circuit breakers, and custom permission
checks from filter callbacks.

Ref #130

* refactor: extract ToolsHandler::create_error_result() to reduce duplication

Consolidate 4 identical CallToolResult error constructions into
a private helper method at the bottom of the class. No behavior change.

* docs: document WP_Error as possible value in result filter params

Filter consumers should know that execute() may return WP_Error,
which passes through to the result filter before being handled.

* feat: add return type validation for list filter hooks

Log a warning and fall back to the original array when a filter
callback returns a non-array from mcp_adapter_tools_list,
mcp_adapter_resources_list, or mcp_adapter_prompts_list.