Bump version to 17.0.0.

Localization: Restores region-specific cultures (#20939 )
* Adds localization manifests for region-specific cultures This is to support backwards-compatibility and v13 upgradability. * Removed `uiCulture` from Vietnamese localizations since it duplicated the English fallback texts. * 'en' localization file formatting * Update src/Umbraco.Web.UI.Client/src/assets/lang/en.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-11-25 09:53:36 +01:00 · 2025-11-24 14:41:24 +01:00 · 2025-11-24 12:06:03 +01:00 · 2025-11-24 10:23:08 +00:00 · 2025-11-24 10:07:45 +00:00 · 2025-11-24 09:42:35 +00:00
4323 changed files with 108813 additions and 45385 deletions
@@ -9,7 +9,7 @@ In order to use Umbraco as a CMS and build your website with it, you should not
 -   Are you about to [create a pull request for Umbraco][contribution guidelines]?
 -   Are you trying to get to the bottom of a problem in your existing Umbraco installation?

-If the answer is yes, please read on. Otherwise, make sure to head on over [to the download page](https://our.umbraco.com/download) and start using Umbraco CMS as intended.
+If the answer is yes, please read on. Otherwise, make sure to head on over [to the releases page](https://releases.umbraco.com) and start using Umbraco CMS as intended.

 ## Table of contents

@@ -37,7 +37,7 @@ In order to work with the Umbraco source code locally, first make sure you have

 ### Familiarizing yourself with the code

-Umbraco is a .NET application using C#. The solution is broken down into multiple projects.  There are several class libraries. The `Umbraco.Web.UI` project is the main project that hosts the back office and login screen. This is the project you will want to run to see your changes.
+Umbraco is a .NET application using C#. The solution is broken down into multiple projects. There are several class libraries. The `Umbraco.Web.UI` project is the main project that hosts the back office and login screen. This is the project you will want to run to see your changes.

 There are two web projects in the solution with client-side assets based on TypeScript, `Umbraco.Web.UI.Client` and `Umbraco.Web.UI.Login`.

@@ -73,13 +73,19 @@ Just be careful not to include this change in your PR.

 Conversely, if you are working on front-end only, you want to build the back-end once and then run it. Before you do so, update the configuration in `appSettings.json` to add the following under `Umbraco:Cms:Security`:

-```
+```json
 "BackOfficeHost": "http://localhost:5173",
 "AuthorizeCallbackPathName": "/oauth_complete",
 "AuthorizeCallbackLogoutPathName": "/logout",
-"AuthorizeCallbackErrorPathName": "/error"
+"AuthorizeCallbackErrorPathName": "/error",
+"BackOfficeTokenCookie": {
+  "SameSite": "None"
+}
 ```

+> [!NOTE]
+> If you get stuck in a login loop, try clearing your browser cookies for localhost, and make sure that the `Umbraco:Cms:Security:BackOfficeTokenCookie:SameSite` setting is set to `None`.
+
 Then run Umbraco from the command line.

 ```
@@ -61,7 +61,7 @@ This guide describes each step to make your first contribution:
 ## Further contribution guides

 - [Before you start](contributing-before-you-start.md)
- [Finding your first issue: Up for grabs](contributing-first-issue.md)
+- [Finding your first issue](contributing-first-issue.md)
 - [Contributing to the new backoffice](https://docs.umbraco.com/umbraco-backoffice/)
 - [Unwanted changes](contributing-unwanted-changes.md)
 - [Other ways to contribute](contributing-other-ways-to-contribute.md)
@@ -40,7 +40,7 @@ Some important documentation links to get you started:

 ## Get help

-If you need a bit of feedback while building your Umbraco projects, we are [chatty on Discord](https://discord.umbraco.com). Our Discord server serves both a social space but also has channels for questions and answers. Feel free to lurk or join in with your own questions. Or just post your daily Wordle score, up to you!
+If you need a bit of feedback while building your Umbraco projects, we are [chatty on Discord](https://discord.umbraco.com). Our Discord server serves as a social space for all Umbracians. If you have any questions or need some help with a problem, head over to our [dedicated forum](https://forum.umbraco.com/) where the Umbraco Community will be happy to help. 

 ## Looking to contribute back to Umbraco?

@@ -52,3 +52,4 @@ You came to the right place! Our GitHub repository is available for all kinds of
 Umbraco is contribution-focused and community-driven. If you want to contribute back to the Umbraco source code, please check out our [guide to contributing](CONTRIBUTING.md).

 ### Tip: You should not run Umbraco from source code found here. Umbraco is extremely extensible and can do whatever you need. Instead, [install Umbraco as noted above](#looking-to-install-umbraco) and then [extend it any way you want to](https://docs.umbraco.com/umbraco-cms/extending/).
+
@@ -7,9 +7,26 @@ We recommend you to [sync with our repository][sync fork] before you submit your
 GitHub will have picked up on the new branch you've pushed and will offer to create a Pull Request. Click that green button and away you go.
 ![Create a pull request](img/createpullrequest.png)

-We like to use [git flow][git flow] as much as possible, but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to `contrib`. This is the branch you should be targeting.
+We like to use [git flow][git flow] as much as possible, but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to `main`. This is the branch you should be targeting.

-Please note: we are no longer accepting features for v8 and below but will continue to merge security fixes as and when they arise.
+We welcome PRs for features and bugfixes for different versions according to the [published support and EOL schedule][support-and-eol].
+
+We don't have rules for naming PRs - so name them as you prefer. At HQ we do have a best practice on clear and concise PR naming, so if you would like to use the format feel free to do so. 
+
+Our convention of doing it is:
+
+_Area: Description (closes #IssueID)_
+
+1. Start by specifying the area. Fx the feature name(UFM, Tiptap etc.) or specific section (migrations, relations, segmentation).
+
+2. In your description, where applicable, mention type of PR (Build, Bump, Fix, Refactor etc.).
+   
+4. Good practise is to make sure you describe specifically the change and/or impact of change.<br>
+   Example: Writing "Extension Insights: Fixes CSS alignment" instead of "Fixed issue".
+
+6. Add (closes #IssueID) behind description, if your PR resolves an issue. 
+
+That's it! 
  
 ## The review process
 [review process]: #the-review-process
@@ -48,4 +65,5 @@ There will be times that we really like your proposed changes and we’ll finish

 [making larger changes]: contributing-before-you-start.md#making-large-changes
 [pr or package]: contributing-before-you-start.md#pull-request-or-package
-[Core collabs]: contributing-core-collabs-team.md
+[Core collabs]: contributing-core-collabs-team.md
+[support-and-eol]: https://umbraco.com/products/knowledge-center/long-term-support-and-end-of-life/
@@ -1,6 +1,8 @@
-## Finding your first issue: Up for grabs
+## Finding your first issue

-Umbraco HQ will regularly mark newly created issues on the issue tracker with [the `community/up-for-grabs` tag][up for grabs issues]. This means that the proposed changes are wanted in Umbraco but the HQ does not have the time to make them at this time. We encourage anyone to pick them up and help out.
+Umbraco HQ will regularly mark newly created issues on the issue tracker with [the `community/up-for-grabs` tag][up for grabs issues]. This means that the proposed changes are wanted in Umbraco but the HQ does not have the time to make them at this time. In adding the label we will endeavour to provide some guidelines on how to go about the implementation, such that it aligns with the project. We encourage anyone to pick them up and help out.
+
+You don't need to restrict yourselves to issues that are specifically marked as "up for grabs" though. If you are running into a bug you have reported or found on the [issue tracker][issue tracker], it's not necessary to wait for HQ response. Feel free to dive in and try to provide a fix, raising questions as you need if you have concerns about the modifications necessary to resolve the problem.

 If you do start working on something, make sure to leave a small comment on the issue saying something like: "I'm working on this". That way other people stumbling upon the issue know they don't need to pick it up, someone already has.

@@ -11,15 +13,15 @@ Great question! The short version goes like this:
 1. **Fork**

    Create a fork of [`Umbraco-CMS` on GitHub][Umbraco CMS repo]
-    
+
    ![Fork the repository](img/forkrepository.png)
-    
+
 1. **Clone**

    When GitHub has created your fork, you can clone it in your favorite Git tool
-    
-    ![Clone the fork](img/clonefork.png) 
-    
+
+    ![Clone the fork](img/clonefork.png)
+
 1. **Switch to the correct branch**

    Switch to the `contrib` branch
@@ -77,7 +79,7 @@ You can get in touch with [the core contributors team][core collabs] in multiple

 - If there's an existing issue on the issue tracker then that's a good place to leave questions and discuss how to start or move forward.
 - If you want to ask questions on some code you've already written you can create a draft pull request, [detailed in a GitHub blog post][draft prs].
- Unsure where to start? Did something not work as expected? Try leaving a note in the ["Contributing to Umbraco"][contrib forum] forum. The team monitors that one closely, so one of us will be on hand and ready to point you in the right direction.
+- Unsure where to start? Did something not work as expected? Try leaving a note in the [forum][forum]. The team monitors that one closely, so one of us will be on hand and ready to point you in the right direction.


  <!-- Local -->
@@ -88,6 +90,7 @@ You can get in touch with [the core contributors team][core collabs] in multiple

 [sync fork ext]: http://robots.thoughtbot.com/post/5133345960/keeping-a-git-fork-updated	"Details on keeping a git fork updated"
 [draft prs]: https://github.blog/2019-02-14-introducing-draft-pull-requests/	"Github's blog post providing details on draft pull requests"
-[contrib forum]: https://our.umbraco.com/forum/contributing-to-umbraco-cms/
+[forum]: https://forum.umbraco.com/
 [Umbraco CMS repo]: https://github.com/umbraco/Umbraco-CMS
-[up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs
+[up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs
+[issue tracker]: https://github.com/umbraco/Umbraco-CMS/issues
@@ -0,0 +1,188 @@
+# Umbraco CMS Development Guide
+
+Always reference these instructions first and fallback to search or bash commands only when you encounter unexpected information that does not match the info here.
+
+## Working Effectively
+
+Bootstrap, build, and test the repository:
+
+- Install .NET SDK (version specified in global.json):
+  - `curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --version $(jq -r '.sdk.version' global.json)`
+  - `export PATH="/home/runner/.dotnet:$PATH"`
+- Install Node.js (version specified in src/Umbraco.Web.UI.Client/.nvmrc):
+  - `curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash`
+  - `export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"`
+  - `nvm install $(cat src/Umbraco.Web.UI.Client/.nvmrc) && nvm use $(cat src/Umbraco.Web.UI.Client/.nvmrc)`
+- Fix shallow clone issue (required for GitVersioning):
+  - `git fetch --unshallow`
+- Restore packages:
+  - `dotnet restore` -- takes 50 seconds. NEVER CANCEL. Set timeout to 90+ seconds.
+- Build the solution:
+  - `dotnet build` -- takes 4.5 minutes. NEVER CANCEL. Set timeout to 10+ minutes.
+- Install and build frontend:
+  - `cd src/Umbraco.Web.UI.Client`
+  - `npm ci --no-fund --no-audit --prefer-offline` -- takes 11 seconds.
+  - `npm run build:for:cms` -- takes 1.25 minutes. NEVER CANCEL. Set timeout to 5+ minutes.
+- Install and build Login
+  - `cd src/Umbraco.Web.UI.Login`
+  - `npm ci --no-fund --no-audit --prefer-offline`
+  - `npm run build`
+- Run the application:
+  - `cd src/Umbraco.Web.UI`
+  - `dotnet run --no-build` -- Application runs on https://localhost:44339 and http://localhost:11000
+
+Check out [BUILD.md](./BUILD.md) for more detailed instructions.
+
+## Validation
+
+- ALWAYS run through at least one complete end-to-end scenario after making changes.
+- Build and unit tests must pass before committing changes.
+- Frontend build produces output in src/Umbraco.Web.UI.Client/dist-cms/ which gets copied to src/Umbraco.Web.UI/wwwroot/umbraco/backoffice/
+- Always run `dotnet build` and `npm run build:for:cms` before running the application to see your changes.
+- For login-only changes, you can run `npm run build` from src/Umbraco.Web.UI.Login and then `dotnet run --no-build` from src/Umbraco.Web.UI.
+- For frontend-only changes, you can run `npm run dev:server` from src/Umbraco.Web.UI.Client for hot reloading.
+- Frontend changes should be linted using `npm run lint:fix` which uses Eslint.
+
+## Testing
+
+### Unit Tests (.NET)
+- Location: tests/Umbraco.Tests.UnitTests/
+- Run: `dotnet test tests/Umbraco.Tests.UnitTests/Umbraco.Tests.UnitTests.csproj --configuration Release --verbosity minimal`
+- Duration: ~1 minute with 3,343 tests
+- NEVER CANCEL: Set timeout to 5+ minutes
+
+### Integration Tests (.NET)
+- Location: tests/Umbraco.Tests.Integration/
+- Run: `dotnet test tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj --configuration Release --verbosity minimal`
+- NEVER CANCEL: Set timeout to 10+ minutes
+
+### Frontend Tests
+- Location: src/Umbraco.Web.UI.Client/
+- Run: `npm test` (requires `npx playwright install` first)
+- Frontend tests use Web Test Runner with Playwright
+
+### Acceptance Tests (E2E)
+- Location: tests/Umbraco.Tests.AcceptanceTest/
+- Requires running Umbraco application and configuration
+- See tests/Umbraco.Tests.AcceptanceTest/README.md for detailed setup (requires `npx playwright install` first)
+
+## Project Structure
+
+The solution contains 30 C# projects organized as follows:
+
+### Main Application Projects
+- **Umbraco.Web.UI**: Main web application project (startup project)
+- **Umbraco.Web.UI.Client**: TypeScript frontend (backoffice)
+- **Umbraco.Web.UI.Login**: Separate login screen frontend
+- **Umbraco.Core**: Core domain models and interfaces
+- **Umbraco.Infrastructure**: Data access and infrastructure
+- **Umbraco.Cms**: Main CMS package
+
+### API Projects
+- **Umbraco.Cms.Api.Management**: Management API
+- **Umbraco.Cms.Api.Delivery**: Content Delivery API
+- **Umbraco.Cms.Api.Common**: Shared API components
+
+### Persistence Projects
+- **Umbraco.Cms.Persistence.SqlServer**: SQL Server support
+- **Umbraco.Cms.Persistence.Sqlite**: SQLite support
+- **Umbraco.Cms.Persistence.EFCore**: Entity Framework Core abstractions
+
+### Test Projects
+- **Umbraco.Tests.UnitTests**: Unit tests
+- **Umbraco.Tests.Integration**: Integration tests
+- **Umbraco.Tests.AcceptanceTest**: End-to-end tests with Playwright
+- **Umbraco.Tests.Common**: Shared test utilities
+
+## Common Tasks
+
+### Frontend Development
+For frontend-only changes:
+1. Configure backend for frontend development:
+   ```json
+   <!-- Add to src/Umbraco.Web.UI/appsettings.json under Umbraco:Cms:Security: -->
+   ```json
+   "BackOfficeHost": "http://localhost:5173",
+   "AuthorizeCallbackPathName": "/oauth_complete",
+   "AuthorizeCallbackLogoutPathName": "/logout",
+   "AuthorizeCallbackErrorPathName": "/error",
+   "BackOfficeTokenCookie": {
+     "SameSite": "None"
+   }
+   ```
+2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
+3. Run frontend dev server: `cd src/Umbraco.Web.UI.Client && npm run dev:server`
+
+### Backend-Only Development
+For backend-only changes, disable frontend builds:
+- Comment out the target named "BuildStaticAssetsPreconditions" in src/Umbraco.Cms.StaticAssets.csproj:
+  ```
+  <!--<Target Name="BuildStaticAssetsPreconditions" BeforeTargets="AssignTargetPaths">
+    [...]
+  </Target>-->
+  ```
+- Remember to uncomment before committing
+
+### Building NuGet Packages
+To build custom NuGet packages for testing:
+```bash
+dotnet pack -c Release -o Build.Out
+dotnet nuget add source [Path to Build.Out folder] -n MyLocalFeed
+```
+
+### Regenerating Frontend API Types
+When changing Management API:
+```bash
+cd src/Umbraco.Web.UI.Client
+npm run generate:server-api-dev
+```
+Also update OpenApi.json from /umbraco/swagger/management/swagger.json
+
+## Database Setup
+
+Default configuration supports SQLite for development. For production-like testing:
+- Use SQL Server/LocalDb for better performance
+- Configure connection string in src/Umbraco.Web.UI/appsettings.json
+
+## Clean Up / Reset
+
+To reset development environment:
+```bash
+# Remove configuration and database
+rm src/Umbraco.Web.UI/appsettings.json
+rm -rf src/Umbraco.Web.UI/umbraco/Data
+
+# Full clean (removes all untracked files)
+git clean -xdf .
+```
+
+## Version Information
+
+- Target Framework: .NET (version specified in global.json)
+- Current Version: (specified in version.json)
+- Node.js Requirement: (specified in src/Umbraco.Web.UI.Client/.nvmrc)
+- npm Requirement: Latest compatible version
+
+## Known Issues
+
+- Build requires full git history (not shallow clone) due to GitVersioning
+- Some NuGet package security warnings are expected (SixLabors.ImageSharp vulnerabilities)
+- Frontend tests require Playwright browser installation: `npx playwright install`
+- Older Node.js versions may show engine compatibility warnings (check .nvmrc for current requirement)
+
+## Timing Expectations
+
+**NEVER CANCEL** these operations - they are expected to take time:
+
+| Operation | Expected Time | Timeout Setting |
+|-----------|--------------|-----------------|
+| `dotnet restore` | 50 seconds | 90+ seconds |
+| `dotnet build` | 4.5 minutes | 10+ minutes |
+| `npm ci` | 11 seconds | 30+ seconds |
+| `npm run build:for:cms` | 1.25 minutes | 5+ minutes |
+| `npm test` | 2 minutes | 5+ minutes |
+| `npm run lint` | 1 minute | 5+ minutes |
+| Unit tests | 1 minute | 5+ minutes |
+| Integration tests | Variable | 10+ minutes |
+
+Always wait for commands to complete rather than canceling and retrying.
@@ -7,7 +7,7 @@ changelog:
      - duplicate
      - wontfix
  categories:
-    - title: 🙌 Notable Changes
+    - title: 🙌 Notable Changes 
      labels:
        - category/notable
    - title: 💥 Breaking Changes
@@ -23,7 +23,7 @@ changelog:
    - title: 📦 Dependencies
      labels:
        - dependencies
-    - title: 🌈 A11Y
+    - title: 🌈 Accessibility Improvements
      labels:
        - accessibility
        - category/accessibility
@@ -17,6 +17,7 @@ on:
      - main
      - v*/dev
      - v*/main
+  workflow_dispatch:

 jobs:
  build_and_deploy_job:
@@ -17,6 +17,7 @@ on:
      - main
      - v*/dev
      - v*/main
+  workflow_dispatch:

 env:
  NODE_OPTIONS: --max_old_space_size=16384
@@ -0,0 +1,163 @@
+name: Create a release discussions for each new version label
+
+on:
+  schedule:
+    - cron: "0 * * * *" # every hour
+  workflow_dispatch:    # allow manual runs
+permissions:
+  contents: read
+  discussions: write
+  issues: read
+  pull-requests: read
+
+jobs:
+  reconcile:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reconcile release/* labels → discussions
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const categoryName = "Releases";
+
+            // 24h cutoff
+            const since = new Date(Date.now() - 24*60*60*1000).toISOString();
+            core.info(`Scanning issues/PRs updated since ${since}`);
+
+            // fetch repo + discussion categories
+            const repoData = await github.graphql(`
+              query($owner:String!, $repo:String!){
+                repository(owner:$owner, name:$repo){
+                  id
+                  discussionCategories(first:100){ nodes { id name } }
+                }
+              }
+            `, { owner, repo });
+            const repoId = repoData.repository.id;
+            const category = repoData.repository.discussionCategories.nodes.find(c => c.name === categoryName);
+            if (!category) {
+              core.setFailed(`Discussion category "${categoryName}" not found`);
+              return;
+            }
+            const categoryId = category.id;
+
+            // paginate issues/PRs updated in last 24h
+            for await (const { data: items } of github.paginate.iterator(
+              github.rest.issues.listForRepo,
+              { owner, repo, state: "all", since, per_page: 100 }
+            )) {
+              for (const item of items) {
+                const releaseLabels = (item.labels || [])
+                  .map(l => (typeof l === "string" ? l : l.name)) // always get the name
+                  .filter(n => typeof n === "string" && n.startsWith("release/"));
+                if (releaseLabels.length === 0) continue;
+
+                core.info(`#${item.number}: ${releaseLabels.join(", ")}`);
+
+                for (const labelName of releaseLabels) {
+                  const version = labelName.substring("release/".length);
+                  const titleTarget = `Release: ${version}`;
+
+                  // search discussions
+                  let discussionId = null;
+                  let cursor = null;
+                  while (true) {
+                    const page = await github.graphql(`
+                      query($owner:String!, $repo:String!, $cursor:String){
+                        repository(owner:$owner, name:$repo){
+                          discussions(first:50, after:$cursor){
+                            nodes{
+                              id
+                              title
+                              url
+                              category{ name }
+                              labels(first:50){ nodes{ name } }
+                            }
+                            pageInfo{ hasNextPage endCursor }
+                          }
+                        }
+                      }
+                    `, { owner, repo, cursor });
+                    const nodes = page.repository.discussions.nodes;
+                    const byLabel = nodes.find(d =>
+                      d.category?.name === categoryName &&
+                      d.labels?.nodes?.some(l => l.name === labelName)
+                    );
+                    if (byLabel) { discussionId = byLabel.id; break; }
+                    const byTitle = nodes.find(d =>
+                      d.category?.name === categoryName &&
+                      d.title === titleTarget
+                    );
+                    if (byTitle) { discussionId = byTitle.id; break; }
+                    if (!page.repository.discussions.pageInfo.hasNextPage) break;
+                    cursor = page.repository.discussions.pageInfo.endCursor;
+                  }
+
+                  if (!discussionId) {
+                    core.info(`→ Creating discussion for ${labelName}`);
+                    const body =
+                      `**Release date:** TODO (YYYY-MM-DD)\n\n` +
+                      `### Links\n` +
+                      `- [Issues and pull requests marked for version ${version}](https://github.com/${owner}/${repo}/issues?q=label%3A${encodeURIComponent(labelName)})\n`;
+
+                    const created = await github.graphql(`
+                      mutation($repoId:ID!, $catId:ID!, $title:String!, $body:String!){
+                        createDiscussion(input:{
+                          repositoryId:$repoId,
+                          categoryId:$catId,
+                          title:$title,
+                          body:$body
+                        }){ discussion{ id url } }
+                      }
+                    `, { repoId, catId: categoryId, title: titleTarget, body });
+
+                    discussionId = created.createDiscussion.discussion.id;
+
+                    // lock the discussion to prevent replies
+                    await github.graphql(`
+                      mutation($id:ID!){
+                        lockLockable(input:{ lockableId:$id }) {
+                          clientMutationId
+                        }
+                      }
+                    `, { id: discussionId });
+                    core.info(`🔒 Locked discussion ${discussionId}`);
+                  } else {
+                    core.info(`→ Found existing discussion for ${labelName}`);
+                  }
+
+                  // ensure label exists
+                  let labelId;
+                  try {
+                    await github.rest.issues.getLabel({ owner, repo, name: labelName });
+                  } catch (e) {
+                    if (e.status === 404) {
+                      await github.rest.issues.createLabel({
+                        owner, repo, name: labelName, color: "0E8A16"
+                      });
+                    } else { throw e; }
+                  }
+                  const labelNode = await github.graphql(`
+                    query($owner:String!, $repo:String!, $name:String!){
+                      repository(owner:$owner, name:$repo){ label(name:$name){ id } }
+                    }
+                  `, { owner, repo, name: labelName });
+                  labelId = labelNode.repository.label?.id;
+                  if (!labelId) continue;
+
+                  // add label to discussion
+                  await github.graphql(`
+                    mutation($id:ID!, $labels:[ID!]!){
+                      addLabelsToLabelable(input:{ labelableId:$id, labelIds:$labels }) {
+                        clientMutationId
+                      }
+                    }
+                  `, { id: discussionId, labels: [labelId] });
+
+                  core.info(`✓ ${labelName} attached to discussion`);
+                }
+              }
+            }
@@ -104,7 +104,9 @@
        "UMBRACO__CMS__SECURITY__BACKOFFICEHOST": "http://localhost:5173",
        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKPATHNAME": "/oauth_complete",
        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKLOGOUTPATHNAME": "/logout",
-        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKERRORPATHNAME": "/error"
+        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKERRORPATHNAME": "/error",
+        "UMBRACO__CMS__SECURITY__KEEPUSERLOGGEDIN": "true",
+        "UMBRACO__CMS__SECURITY__BACKOFFICETOKENCOOKIE__SAMESITE": "None"
      },
      "sourceFileMap": {
        "/Views": "${workspaceFolder}/Umbraco.Web.UI/Views"
@@ -1,5 +1,11 @@
 {
-  "cSpell.words": ["unprovide"],
+  "cSpell.words": [
+    "backoffice",
+    "pickable",
+    "Pickable",
+    "unprovide",
+    "Unproviding"
+  ],
  "eslint.useFlatConfig": true,
  "eslint.workingDirectories": [
    "./src/Umbraco.Web.UI.Client/",
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Project>
  <PropertyGroup>
-    <TargetFramework>net9.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
    <Company>Umbraco HQ</Company>
    <Authors>Umbraco</Authors>
    <Copyright>Copyright © Umbraco $([System.DateTime]::Today.ToString('yyyy'))</Copyright>
@@ -40,7 +40,7 @@
  <!-- Package Validation -->
  <PropertyGroup>
    <GenerateCompatibilitySuppressionFile>false</GenerateCompatibilitySuppressionFile>
-    <EnablePackageValidation>true</EnablePackageValidation>
+    <EnablePackageValidation>false</EnablePackageValidation> <!-- TODO (V17): Set to true with version 17.0.0 once this version is released. -->
    <PackageValidationBaselineVersion>16.0.0</PackageValidationBaselineVersion>
    <EnableStrictModeForCompatibleFrameworksInPackage>true</EnableStrictModeForCompatibleFrameworksInPackage>
    <EnableStrictModeForCompatibleTfms>true</EnableStrictModeForCompatibleTfms>
@@ -5,39 +5,35 @@
  </PropertyGroup>
  <!-- Global packages (private, build-time packages for all projects) -->
  <ItemGroup>
-    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.7.115" />
+    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.8.118" />
    <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
-    <GlobalPackageReference Include="Umbraco.Code" Version="2.3.0" />
+    <GlobalPackageReference Include="Umbraco.Code" Version="2.4.0" />
    <GlobalPackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" />
  </ItemGroup>
  <!-- Microsoft packages -->
  <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.13.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.Common" Version="4.13.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.13.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.Common" Version="4.13.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" Version="4.13.0" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="9.4.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.14.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.0.0" />
+    <PackageVersion Include="System.Linq.Async" Version="7.0.0" />
  </ItemGroup>
  <!-- Umbraco packages -->
  <ItemGroup>
@@ -50,21 +46,21 @@
    <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
    <PackageVersion Include="Examine" Version="3.7.1" />
    <PackageVersion Include="Examine.Core" Version="3.7.1" />
-    <PackageVersion Include="HtmlAgilityPack" Version="1.12.1" />
+    <PackageVersion Include="HtmlAgilityPack" Version="1.12.4" />
    <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
-    <PackageVersion Include="MailKit" Version="4.11.0" />
+    <PackageVersion Include="MailKit" Version="4.14.0" />
    <PackageVersion Include="Markdown" Version="2.2.1" />
-    <PackageVersion Include="MessagePack" Version="3.1.3" />
+    <PackageVersion Include="MessagePack" Version="3.1.4" />
    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
    <PackageVersion Include="MiniProfiler.Shared" Version="4.5.4" />
-    <PackageVersion Include="ncrontab" Version="3.3.3" />
-    <PackageVersion Include="NPoco" Version="5.7.1" />
-    <PackageVersion Include="NPoco.SqlServer" Version="5.7.1" />
-    <PackageVersion Include="OpenIddict.Abstractions" Version="6.2.1" />
-    <PackageVersion Include="OpenIddict.AspNetCore" Version="6.2.1" />
-    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="6.2.1" />
-    <PackageVersion Include="Serilog" Version="4.2.0" />
+    <PackageVersion Include="ncrontab" Version="3.4.0" />
+    <PackageVersion Include="NPoco" Version="6.1.0" />
+    <PackageVersion Include="NPoco.SqlServer" Version="6.1.0" />
+    <PackageVersion Include="OpenIddict.Abstractions" Version="7.1.0" />
+    <PackageVersion Include="OpenIddict.AspNetCore" Version="7.1.0" />
+    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="7.1.0" />
+    <PackageVersion Include="Serilog" Version="4.3.0" />
    <PackageVersion Include="Serilog.AspNetCore" Version="9.0.0" />
    <PackageVersion Include="Serilog.Enrichers.Process" Version="3.0.0" />
    <PackageVersion Include="Serilog.Enrichers.Thread" Version="4.0.0" />
@@ -74,33 +70,13 @@
    <PackageVersion Include="Serilog.Formatting.Compact.Reader" Version="4.0.0" />
    <PackageVersion Include="Serilog.Settings.Configuration" Version="9.0.0" />
    <PackageVersion Include="Serilog.Sinks.Async" Version="2.1.0" />
-    <PackageVersion Include="Serilog.Sinks.File" Version="6.0.0" />
+    <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
    <PackageVersion Include="Serilog.Sinks.Map" Version="2.0.0" />
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.7" />
-    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.4" />
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="8.1.1" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.11" />
+    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.2.0" />
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.0.1" />
  </ItemGroup>
  <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
  <ItemGroup>
-    <!-- Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer brings in a vulnerable version of Azure.Identity -->
-    <!-- Take top-level depedendency on Azure.Identity, because Microsoft.EntityFrameworkCore.SqlServer depends on a vulnerable version -->
-    <PackageVersion Include="Azure.Identity" Version="1.13.2" />
-    <!-- Microsoft.EntityFrameworkCore.SqlServer brings in a vulnerable version of System.Runtime.Caching -->
-    <PackageVersion Include="System.Runtime.Caching" Version="9.0.4" />
-    <!-- Dazinator.Extensions.FileProviders brings in a vulnerable version of System.Net.Http -->
-    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
-    <!-- Examine brings in a vulnerable version of System.Security.Cryptography.Xml -->
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="9.0.4" />
-    <!-- Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc brings in a vulnerable version of System.Text.RegularExpressions -->
-    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
-    <!-- OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer brings in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
-    <!-- Take top-level depedendency on Microsoft.IdentityModel.JsonWebTokens, because OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer depends on a vulnerable version -->
-    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.8.0" />
-    <!-- Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer and Dazinator.Extensions.FileProviders brings in a legacy version of System.Text.Encodings.Web -->
-    <PackageVersion Include="System.Text.Encodings.Web" Version="9.0.4" />
-    <!-- NPoco.SqlServer brings in a vulnerable version of Microsoft.Data.SqlClient  -->
-    <PackageVersion Include="Microsoft.Data.SqlClient" Version="6.0.1" />
-    <!-- Examine.Lucene brings in a vulnerable version of Lucene.Net.Replicator -->
-    <PackageVersion Include="Lucene.Net.Replicator" Version="4.8.0-beta00017" />
  </ItemGroup>
 </Project>
@@ -3,7 +3,9 @@ Third-Party Notices

 This file contains notices and attributions for third-party software used in the Umbraco CMS project.

-It is not a license and does not grant any rights to use the third-party software.
+Third-party software may contain dependencies that are not explicitly listed here.
+
+This notice is not a license and does not grant any rights to use the third-party software.

 Umbraco CMS is licensed under the MIT License, which can be found in the LICENSE file.

@@ -113,14 +115,6 @@ Copyright: 2023 Shannon Deminick

 ---

-Glob: A library for matching file paths using glob patterns
-
-URL: https://github.com/isaacs/node-glob
-License: ISC License
-Copyright: 2009-2023 Isaac Z. Schlueter and Contributors
-
---
-
 Globals: A library for managing global variables in JavaScript

 URL: https://github.com/sindresorhus/globals
@@ -356,38 +350,6 @@ Copyright: Titus Wormer

 ---

-Rollup: A module bundler for JavaScript
-
-URL: https://rollupjs.org/
-License: MIT License
-Copyright: 2015-present Rollup contributors
-
---
-
-Rollup Plugins: A collection of Rollup plugins
-
-URL: https://github.com/rollup/plugins
-License: MIT License
-Copyright: 2019-present Rollup Plugins contributors
-
---
-
-Rollup-plugin-esbuild: A Rollup plugin for using esbuild
-
-URL: https://github.com/egoist/rollup-plugin-esbuild
-License: MIT License
-Copyright: 2020 EGOIST
-
---
-
-Rollup-plugin-import-css: A Rollup plugin for importing CSS files
-
-URL: https://github.com/jleeson/rollup-plugin-import-css
-License: MIT License
-Copyright: 2020 Jacob Leeson
-
---
-
 rxjs: Reactive Extensions for JavaScript

 URL: https://rxjs.dev/
@@ -34,6 +34,10 @@ parameters:
    displayName: Upload API docs
    type: boolean
    default: false
+  - name: uploadDependencyTrack
+    displayName: Upload BOMs to Dependency Track
+    type: boolean
+    default: false
  - name: forceReleaseTestFilter
    displayName: Force to use the release test filters
    type: boolean
@@ -103,6 +107,15 @@ stages:
              command: build
              projects: $(solution)
              arguments: "--configuration $(buildConfiguration) --no-restore --property:ContinuousIntegrationBuild=true --property:GeneratePackageOnBuild=true --property:PackageOutputPath=$(Build.ArtifactStagingDirectory)/nupkg"
+          - powershell: |
+              dotnet tool install --global CycloneDX
+              dotnet-CycloneDX $(solution) --output $(Build.ArtifactStagingDirectory)/bom --filename bom-dotnet.xml
+            displayName: 'Generate Backend BOM'
+          - powershell: |
+              npm install --global @cyclonedx/cyclonedx-npm
+              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)\bom\bom-login.xml --ignore-npm-errors --verbose
+            displayName: Generate Login UI BOM
+            workingDirectory: src/Umbraco.Web.UI.Login
          - task: PublishPipelineArtifact@1
            displayName: Publish nupkg
            inputs:
@@ -113,6 +126,11 @@ stages:
            inputs:
              targetPath: $(Build.SourcesDirectory)
              artifactName: build_output
+          - task: PublishPipelineArtifact@1
+            displayName: Publish Backend BOM
+            inputs:
+              targetPath: $(Build.ArtifactStagingDirectory)/bom
+              artifactName: bom-backend

      - job: B
        displayName: Build Bellissima Package
@@ -124,6 +142,11 @@ stages:
            lfs: false,
            fetchDepth: 500
          - template: templates/backoffice-install.yml
+          - powershell: |
+              npm install --global @cyclonedx/cyclonedx-npm
+              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-backoffice.xml --ignore-npm-errors --verbose
+            displayName: Generate Backoffice UI BOM
+            workingDirectory: src/Umbraco.Web.UI.Client
          - script: npm run build:for:npm
            displayName: Run build:for:npm
            workingDirectory: src/Umbraco.Web.UI.Client
@@ -140,6 +163,35 @@ stages:
            inputs:
              targetPath: $(Build.ArtifactStagingDirectory)/npm
              artifactName: npm
+          - publish: $(Build.ArtifactStagingDirectory)/bom
+            artifact: bom-frontend
+            displayName: 'Publish Frontend BOM'
+
+  - stage: E2E_BOM
+    displayName: E2E Tests BOM Generation
+    dependsOn: []
+    jobs:
+    - job:
+      displayName: E2E Generate BOM
+      pool:
+        vmImage: "ubuntu-latest"
+      steps:
+        - checkout: self
+          submodules: false
+          lfs: false,
+          fetchDepth: 500
+        - template: templates/e2e-install.yml
+          parameters:
+            nodeVersion: ${{ variables.nodeVersion }}
+            npm_config_cache: ${{ variables.npm_config_cache }}
+        - powershell: |
+            npm install --global @cyclonedx/cyclonedx-npm
+            cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-e2e.xml --ignore-npm-errors --verbose
+          displayName: Generate E2E Tests BOM
+          workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+        - publish: $(Build.ArtifactStagingDirectory)/bom
+          artifact: bom-e2e
+          displayName: 'Publish E2E BOM'

  - stage: Build_Docs
    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.buildApiDocs}}))
@@ -313,8 +365,8 @@ stages:
              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
            LinuxPart3Of3:
              vmImage: "ubuntu-latest"
-              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
-              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
            macOSPart1Of3:
              vmImage: "macOS-latest"
              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
@@ -325,8 +377,8 @@ stages:
              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
            macOSPart3Of3:
              vmImage: "macOS-latest"
-              # Filter tests that are not part of the Umbraco.Infrastructure namespace.
-              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure and the ManagementApi namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
        pool:
          vmImage: $(vmImage)
        variables:
@@ -389,8 +441,8 @@ stages:
              vmImage: "windows-latest"
              Tests__Database__DatabaseType: LocalDb
              Tests__Database__SQLServerMasterConnectionString: N/A
-              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
-              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
            LinuxPart1Of3:
              vmImage: "ubuntu-latest"
              SA_PASSWORD: UmbracoIntegration123!
@@ -410,8 +462,8 @@ stages:
              SA_PASSWORD: UmbracoIntegration123!
              Tests__Database__DatabaseType: SqlServer
              Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
-              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
-              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
        pool:
          vmImage: $(vmImage)
        steps:
@@ -513,354 +565,188 @@ stages:
      UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL: https://localhost:44331/
      ASPNETCORE_URLS: https://localhost:44331
    jobs:
-      # E2E Tests
+      # E2E Smoke Tests
      - job:
-        displayName: E2E Tests (SQLite)
+        displayName: E2E Smoke Tests (SQLite)
        # currently disabled due to DB locks randomly occuring.
        condition: eq(${{parameters.sqliteAcceptanceTests}}, True)
        variables:
          # Connection string
          CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=Umbraco;Mode=Memory;Cache=Shared;Foreign Keys=True;Pooling=True
          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.Sqlite
+          DatabaseType: SQLite
+          additionalEnvironmentVariables: false
        strategy:
          matrix:
            LinuxPart1Of3:
              vmImage: "ubuntu-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run smokeTestSqlite -- --shard=1/3"
            LinuxPart2Of3:
              vmImage: "ubuntu-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run smokeTestSqlite -- --shard=2/3"
            LinuxPart3Of3:
              vmImage: "ubuntu-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run smokeTestSqlite -- --shard=3/3"
            WindowsPart1Of3:
              vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run smokeTestSqlite -- --shard=1/3"
            WindowsPart2Of3:
              vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run smokeTestSqlite -- --shard=2/3"
            WindowsPart3Of3:
              vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run smokeTestSqlite -- --shard=3/3"
        pool:
          vmImage: $(vmImage)
        steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            retryCountOnTaskFailure: 3
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL }}
+              PlaywrightPassword: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}

          - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
-              CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
              dotnet restore UmbracoProject
              cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+            displayName: Restore project
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
              dotnet dev-certs https
            displayName: Build application
            workingDirectory: $(Agent.BuildDirectory)/app
+            condition: succeeded()

-          # Run application
-          - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
-              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
-            displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-            workingDirectory: $(Agent.BuildDirectory)/app
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              DatabaseType: ${{ variables.DatabaseType }}
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}

-          - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
-              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
-            displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Install Playwright and dependencies
-          - pwsh: npx playwright install chromium
-            displayName: Install Playwright only with Chromium browser
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-            env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
-
-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Copy console error log
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/console-errors.json) {
-                  Copy-Item tests/Umbraco.Tests.AcceptanceTest/console-errors.json $(Build.ArtifactStagingDirectory)
-              }
-            displayName: Copy console error log
-            condition: succeededOrFailed()
-
-          # Publish test artifacts
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
-
-          # Publish test results
-          - task: PublishTestResults@2
-            displayName: "Publish test results"
-            condition: succeededOrFailed()
-            inputs:
-              testResultsFormat: 'JUnit'
-              testResultsFiles: '*.xml'
-              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
-              testRunTitle: "$(Agent.JobName)"
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              DatabaseType: ${{ variables.DatabaseType }}

      - job:
-        displayName: E2E Tests (SQL Server)
+        displayName: E2E Smoke Tests (SQL Server)
        variables:
          # Connection string
          CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+          SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+          DatabaseType: SQLServer
+          additionalEnvironmentVariables: false
        strategy:
          matrix:
            ${{ if eq(parameters.sqlServerLinuxAcceptanceTests, True) }}:
              LinuxPart1Of3:
                testCommand: "npm run smokeTest -- --shard=1/3"
                vmImage: "ubuntu-latest"
-                SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+                testFolder: "DefaultConfig"
                CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
              LinuxPart2Of3:
                testCommand: "npm run smokeTest -- --shard=2/3"
                vmImage: "ubuntu-latest"
-                SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+                testFolder: "DefaultConfig"
                CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
              LinuxPart3Of3:
                testCommand: "npm run smokeTest -- --shard=3/3"
                vmImage: "ubuntu-latest"
-                SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+                testFolder: "DefaultConfig"
                CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
            WindowsPart1Of3:
              vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run smokeTest -- --shard=1/3"
            WindowsPart2Of3:
              vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run smokeTest -- --shard=2/3"
            WindowsPart3Of3:
              vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run smokeTest -- --shard=3/3"
        pool:
          vmImage: $(vmImage)
        steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL }}
+              PlaywrightPassword: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}

          - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
-              CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
              dotnet restore UmbracoProject
              cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+            displayName: Restore project
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
              dotnet dev-certs https
            displayName: Build application
            workingDirectory: $(Agent.BuildDirectory)/app
+            condition: succeeded()

-          # Start SQL Server
-          - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=$(SA_PASSWORD)" mcr.microsoft.com/mssql/server:2022-latest
-            displayName: Start SQL Server Docker image (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              SA_PASSWORD: ${{ variables.SA_PASSWORD }}
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              DatabaseType: ${{ variables.DatabaseType }}
+              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}

-          - pwsh: SqlLocalDB start MSSQLLocalDB
-            displayName: Start SQL Server LocalDB (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              DatabaseType: ${{ variables.DatabaseType }}

-          # Run application
-          - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
-              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
-            displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
-              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
-            displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Install Playwright and dependencies
-          - pwsh: npx playwright install chromium
-            displayName: Install Playwright only with Chromium browser
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-            env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
-
-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Stop SQL Server
-          - pwsh: docker stop mssql
-            displayName: Stop SQL Server Docker image (Linux)
-            condition: eq(variables['Agent.OS'], 'Linux')
-
-          - pwsh: SqlLocalDB stop MSSQLLocalDB
-            displayName: Stop SQL Server LocalDB (Windows)
-            condition: eq(variables['Agent.OS'], 'Windows_NT')
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Copy console error log
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/console-errors.json) {
-                  Copy-Item tests/Umbraco.Tests.AcceptanceTest/console-errors.json $(Build.ArtifactStagingDirectory)
-              }
-            displayName: Copy console error log
-            condition: succeededOrFailed()
-
-          # Publish test artifacts
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
-
-          # Publish test results
-          - task: PublishTestResults@2
-            displayName: "Publish test results"
-            condition: succeededOrFailed()
-            inputs:
-              testResultsFormat: 'JUnit'
-              testResultsFiles: '*.xml'
-              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
-              testRunTitle: "$(Agent.JobName)"
+  - stage: Dependency_Track
+    displayName: Dependency Track
+    dependsOn:
+      - Build
+      - E2E_BOM
+    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadDependencyTrack}}))
+    variables:
+      # Determine Umbraco version based on whether it's a public release or not. If public release, use major version, else use full NuGet package version.
+      umbracoVersion: $[ iif(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'], stageDependencies.Build.A.outputs['build.NBGV_NuGetPackageVersion']) ]
+    jobs:
+      - template: templates/dependency-track.yml
+        parameters:
+          projectName: "Umbraco-CMS"
+          umbracoVersion: $(umbracoVersion)
+          projects:
+            - name: "Backend"
+              artifact: "bom-backend"
+              bomFilePath: "bom-dotnet.xml"
+            - name: "Login"
+              artifact: "bom-backend"
+              bomFilePath: "bom-login.xml"
+            - name: "Backoffice"
+              artifact: "bom-frontend"
+              bomFilePath: "bom-backoffice.xml"
+            - name: "E2E"
+              artifact: "bom-e2e"
+              bomFilePath: "bom-e2e.xml"

  ###############################################
  ## Release
@@ -1068,3 +954,4 @@ stages:
              ContainerName: "$web"
              BlobPrefix: v$(umbracoMajorVersion)/ui-api
              CleanTargetBeforeCopy: true
+
@@ -0,0 +1,74 @@
+parameters:
+  - name: testFolder
+    type: string
+    default: ''
+
+  - name: buildConfiguration
+    type: string
+    default: ''
+
+  - name: additionalEnvironmentVariables
+    type: string
+    default: 'false'
+
+steps:
+  - pwsh: |
+      dotnet restore UmbracoProject
+      cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
+    displayName: Restore project
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  # Update application to use necessary app settings
+  - pwsh: |
+      $sourcePath = "$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/tests/${{ parameters.testFolder }}/AdditionalSetup"
+      $destinationPath = "UmbracoProject"
+      $jsonFiles = Get-ChildItem -Path $sourcePath -Filter "*.json"
+      if ($jsonFiles) {
+      $jsonFiles | ForEach-Object {
+        Write-Host "Copying: $($_.FullName)"
+        Copy-Item -Path $_.FullName -Destination $destinationPath -Force
+      }
+      } else {
+      Write-Host "No JSON files found."
+      }
+    displayName: Update application to use necessary app settings
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  # Update application to use necessary App_Plugins
+  - pwsh: |
+      $sourcePath = "$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/tests/${{ parameters.testFolder }}/AdditionalSetup"
+      $destinationPath = "UmbracoProject"
+      $appPluginsFolders = Get-ChildItem -Path $sourcePath -Directory -Filter "App_Plugins"
+      if ($appPluginsFolders) {
+        foreach ($folder in $appPluginsFolders) {
+          Write-Host "Copying folder: $($folder.FullName)"
+          Copy-Item -Path $folder.FullName -Destination $destinationPath -Recurse -Force
+          }
+      } else {
+        Write-Host "No App_Plugins found."
+      }
+    displayName: Update application to use necessary app plugins
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  # Update application to use necessary classes
+  - pwsh: |
+      $sourcePath = "$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/tests/${{ parameters.testFolder }}/AdditionalSetup"
+      $destinationPath = "UmbracoProject"
+      $csharpFiles = Get-ChildItem -Path $sourcePath -Filter "*.cs"
+      if ($csharpFiles) {
+        $csharpFiles | ForEach-Object {
+          Write-Host "Copying: $($_.FullName)"
+          Copy-Item -Path $_.FullName -Destination $destinationPath -Force
+        }
+      } else {
+        Write-Host "No C# files found."
+      }
+    displayName: Update application to use necessary classes
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  - pwsh: |
+      dotnet build UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-restore
+      dotnet dev-certs https
+    displayName: Build application
+    workingDirectory: $(Agent.BuildDirectory)/app
+    condition: and(succeeded(), eq(variables['additionalEnvironmentVariables'], 'false'))
@@ -0,0 +1,45 @@
+parameters:
+  - name: SA_PASSWORD
+    type: string
+    default: ''
+
+  - name: buildConfiguration
+    type: string
+    default: ''
+
+  - name: additionalEnvironmentVariables
+    type: string
+    default: 'false'
+
+  - name: DatabaseType
+    type: string
+    default: ''
+
+steps:
+  # Skips the SQLServer setup if the databaseType does not match
+  - ${{ if eq(parameters.DatabaseType, 'SQLServer') }}:
+      # Start SQL Server Linux
+      - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=${{ parameters.SA_PASSWORD }}" mcr.microsoft.com/mssql/server:2022-latest
+        displayName: Start SQL Server Docker image (Linux)
+        condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+      # Start SQL Server LocalDB Windows
+      - pwsh: SqlLocalDB start MSSQLLocalDB
+        displayName: Start SQL Server LocalDB (Windows)
+        condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+  # Run application for Linux
+  - bash: |
+      nohup dotnet run --project UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
+      echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
+    displayName: Run application (Linux)
+    condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'), eq(variables['additionalEnvironmentVariables'], 'false'))
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  # Run application for Windows
+  - pwsh: |
+      $process = Start-Process dotnet "run --project UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
+      Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
+    displayName: Run application (Windows)
+    condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'), eq(variables['additionalEnvironmentVariables'], 'false'))
+    workingDirectory: $(Agent.BuildDirectory)/app
@@ -0,0 +1,105 @@
+parameters:
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+  - name: testCommand
+    type: string
+    default: ''
+
+  - name: port
+    type: string
+    default: ''
+
+  - name: AZUREB2CTESTUSEREMAIL
+    type: string
+    default: ''
+
+  - name: AZUREB2CTESTUSERPASSWORD
+    type: string
+    default: ''
+
+  - name: DatabaseType
+    type: string
+    default: ''
+
+steps:
+  # Ensures we have the package wait-on installed
+  - pwsh: npm install wait-on
+    displayName: Install wait-on package
+
+  # Wait for either the port of the aspnetcore url
+  - pwsh: |
+      $Port = "${{ parameters.port }}"
+      $Url  = "${{ parameters.ASPNETCORE_URLS }}"
+
+      if ($Port -ne "") {
+          Write-Host "Waiting on TCP port $Port"
+          npx wait-on -v --interval 1000 --timeout 120000 "tcp:$Port"
+      } else {
+          Write-Host "Waiting on URL $Url"
+          npx wait-on -v --interval 1000 --timeout 120000 "$Url"
+      }
+    displayName: Wait for application
+    workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+
+  # Install Playwright and dependencies
+  - pwsh: npx playwright install chromium
+    displayName: Install Playwright only with Chromium browser
+    workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+
+  # Test
+  - pwsh: ${{ parameters.testCommand }}
+    displayName: Run Playwright tests
+    workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+    env:
+      CI: true
+      CommitId: $(Build.SourceVersion)
+      AgentOs: $(Agent.OS)
+      AZUREADB2CTESTUSEREMAIL: ${{ parameters.AZUREB2CTESTUSEREMAIL }}
+      AZUREADB2CTESTUSERPASSWORD: ${{ parameters.AZUREB2CTESTUSERPASSWORD }}
+
+  # Stop application
+  - bash: kill -15 $(AcceptanceTestProcessId)
+    displayName: Stop application (Linux)
+    condition: and(succeededOrFailed(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
+
+  - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
+    displayName: Stop application (Windows)
+    condition: and(succeededOrFailed(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
+
+  - ${{ if eq(parameters.DatabaseType, 'SQLServer') }}:
+      # Stop SQL Server
+      - pwsh: docker stop mssql
+        displayName: Stop SQL Server Docker image (Linux)
+        condition: and(succeededOrFailed(), eq(variables['Agent.OS'], 'Linux'))
+
+      - pwsh: SqlLocalDB stop MSSQLLocalDB
+        displayName: Stop SQL Server LocalDB (Windows)
+        condition: and(succeededOrFailed(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+  # Copy artifacts
+  - pwsh: |
+      if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
+        Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
+      }
+    displayName: Copy Playwright results
+    condition: succeededOrFailed()
+
+  # Publish
+  - task: PublishPipelineArtifact@1
+    displayName: Publish test artifacts
+    condition: succeededOrFailed()
+    inputs:
+      targetPath: $(Build.ArtifactStagingDirectory)
+      artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
+
+  # Publish test results
+  - task: PublishTestResults@2
+    displayName: "Publish test results"
+    condition: succeededOrFailed()
+    inputs:
+      testResultsFormat: 'JUnit'
+      testResultsFiles: '*.xml'
+      searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
+      testRunTitle: "$(Agent.JobName)"
@@ -0,0 +1,50 @@
+parameters:
+  - name: nodeVersion
+    type: string
+    default: ''
+
+  - name: PlaywrightUserEmail
+    type: string
+    default: ''
+
+  - name: PlaywrightPassword
+    type: string
+    default: ''
+
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+  - name: npm_config_cache
+    type: string
+    default: ''
+
+steps:
+  - task: DownloadPipelineArtifact@2
+    displayName: Download NuGet artifacts
+    inputs:
+      artifact: nupkg
+      path: $(Agent.BuildDirectory)/app/nupkg
+
+  - task: UseDotNet@2
+    displayName: Use .NET SDK from global.json
+    inputs:
+      useGlobalJson: true
+
+  - template: templates/e2e-install.yml
+    parameters:
+      nodeVersion: ${{ parameters.nodeVersion }}
+      npm_config_cache: ${{ parameters.npm_config_cache }}
+      PlaywrightUserEmail: ${{ parameters.PlaywrightUserEmail }}
+      PlaywrightPassword: ${{ parameters.PlaywrightPassword }}
+      ASPNETCORE_URLS: ${{ parameters.ASPNETCORE_URLS }}
+
+  # Install Template
+  - pwsh: |
+      $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
+      dotnet new nugetconfig
+      dotnet nuget add source ./nupkg --name Local
+      dotnet new install Umbraco.Templates::$cmsVersion
+      dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
+    displayName: Install Template
+    workingDirectory: $(Agent.BuildDirectory)/app
@@ -9,13 +9,22 @@ schedules:
    branches:
      include:
        - v15/dev
-        - release/16.0
        - main
+        - v17/dev

 parameters:
-    # Skipped due to DB locks
-  - name: sqliteAcceptanceTests
-    displayName: Run SQLite Acceptance Tests
+  - name: skipIntegrationTests
+    displayName: Skip integration tests
+    type: boolean
+    default: false
+
+  - name: differentAppSettingsAcceptanceTests
+    displayName: Run acceptance tests with different app settings
+    type: boolean
+    default: true
+
+  - name: skipDefaultConfigAcceptanceTests
+    displayName: Skip tests with DefaultConfig
    type: boolean
    default: false

@@ -101,8 +110,211 @@ stages:
              targetPath: $(Build.ArtifactStagingDirectory)/npm
              artifactName: npm

-  - stage: E2E
-    displayName: E2E Tests
+  - stage: Integration
+    displayName: Integration Tests
+    dependsOn: Build
+    condition: ${{ eq(parameters.skipIntegrationTests, false) }}
+    jobs:
+      # Integration Tests (SQLite)
+      - job:
+        timeoutInMinutes: 180
+        displayName: Integration Tests (SQLite)
+        strategy:
+          matrix:
+            #            Windows:
+            #              vmImage: 'windows-latest'
+            # We split the tests into 4 parts for each OS to reduce the time it takes to run them on the pipeline
+            LinuxPart1Of4:
+              vmImage: "ubuntu-latest"
+              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
+            LinuxPart2Of4:
+              vmImage: "ubuntu-latest"
+              # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
+            LinuxPart3Of4:
+              vmImage: "ubuntu-latest"
+              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
+            LinuxPart4Of4:
+              vmImage: "ubuntu-latest"
+              # Filter tests that are part of the ManagementApi namespace
+              testFilter: "(FullyQualifiedName~ManagementApi)"
+            macOSPart1Of4:
+              vmImage: "macOS-latest"
+              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
+            macOSPart2Of4:
+              vmImage: "macOS-latest"
+              # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
+            macOSPart3Of4:
+              vmImage: "macOS-latest"
+              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace.
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
+            macOSPart4Of4:
+              vmImage: "macOS-latest"
+              # Filter tests that are part of the ManagementApi namespace.
+              testFilter: "(FullyQualifiedName~ManagementApi)"
+        pool:
+          vmImage: $(vmImage)
+        variables:
+          Tests__Database__DatabaseType: "Sqlite"
+        steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 1
+            fetchFilter: tree:0
+          # Setup test environment
+          - task: DownloadPipelineArtifact@2
+            displayName: Download build artifacts
+            inputs:
+              artifact: build_output
+              path: $(Build.SourcesDirectory)
+
+          - task: UseDotNet@2
+            displayName: Use .NET SDK from global.json
+            inputs:
+              useGlobalJson: true
+
+          # Test
+          - task: DotNetCoreCLI@2
+            displayName: Run dotnet test
+            inputs:
+              command: test
+              projects: "tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj"
+              testRunTitle: Integration Tests SQLite - $(Agent.OS)
+              arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build'
+
+      # Integration Tests (SQL Server)
+      - job:
+        timeoutInMinutes: 180
+        displayName: Integration Tests (SQL Server)
+        variables:
+          SA_PASSWORD: UmbracoAcceptance123!
+        strategy:
+          matrix:
+            # We split the tests into 4 parts for each OS to reduce the time it takes to run them on the pipeline
+            WindowsPart1Of4:
+              vmImage: "windows-latest"
+              Tests__Database__DatabaseType: LocalDb
+              Tests__Database__SQLServerMasterConnectionString: N/A
+              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
+            WindowsPart2Of4:
+              vmImage: "windows-latest"
+              Tests__Database__DatabaseType: LocalDb
+              Tests__Database__SQLServerMasterConnectionString: N/A
+              # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
+            WindowsPart3Of4:
+              vmImage: "windows-latest"
+              Tests__Database__DatabaseType: LocalDb
+              Tests__Database__SQLServerMasterConnectionString: N/A
+              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace.
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
+            WindowsPart4Of4:
+              vmImage: "windows-latest"
+              Tests__Database__DatabaseType: LocalDb
+              Tests__Database__SQLServerMasterConnectionString: N/A
+              # Filter tests that are part of the ManagementApi namespace.
+              testFilter: "(FullyQualifiedName~ManagementApi)"
+            LinuxPart1Of4:
+              vmImage: "ubuntu-latest"
+              Tests__Database__DatabaseType: SqlServer
+              Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
+              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
+            LinuxPart2Of4:
+              vmImage: "ubuntu-latest"
+              Tests__Database__DatabaseType: SqlServer
+              Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
+              # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
+            LinuxPart3Of4:
+              vmImage: "ubuntu-latest"
+              Tests__Database__DatabaseType: SqlServer
+              Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
+              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace.
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
+            LinuxPart4Of4:
+              vmImage: "ubuntu-latest"
+              Tests__Database__DatabaseType: SqlServer
+              Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
+              # Filter tests that are part of the ManagementApi namespace.
+              testFilter: "(FullyQualifiedName~ManagementApi)"
+        pool:
+          vmImage: $(vmImage)
+        steps:
+          # Setup test environment
+          - task: DownloadPipelineArtifact@2
+            displayName: Download build artifacts
+            inputs:
+              artifact: build_output
+              path: $(Build.SourcesDirectory)
+
+          - task: UseDotNet@2
+            displayName: Use .NET SDK from global.json
+            inputs:
+              useGlobalJson: true
+
+          # Start SQL Server
+          - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=$(SA_PASSWORD)" mcr.microsoft.com/mssql/server:2022-latest
+            displayName: Start SQL Server Docker image (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - powershell: |
+              $maxAttempts = 12
+              $attempt = 0
+              $status = ""
+
+              while (($status -ne 'running') -and ($attempt -lt $maxAttempts)) {
+                Start-Sleep -Seconds 5
+                # We use the docker inspect command to check the status of the container. If the container is not running, we wait 5 seconds and try again. And if reaches 12 attempts, we fail the build.
+                $status = docker inspect -f '{{.State.Status}}' mssql
+
+                if ($status -ne 'running') {
+                  Write-Host "Waiting for SQL Server to be ready... Attempt $($attempt + 1)"
+                  $attempt++
+                }
+              }
+
+              if ($status -eq 'running') {
+                Write-Host "SQL Server container is running"
+                docker ps -a
+              } else {
+                Write-Host "SQL Server did not become ready in time. Last known status: $status"
+                docker logs mssql
+                exit 1
+              }
+            displayName: Wait for SQL Server to be ready (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - pwsh: SqlLocalDB start MSSQLLocalDB
+            displayName: Start SQL Server LocalDB (Windows)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+          # Test
+          - task: DotNetCoreCLI@2
+            displayName: Run dotnet test
+            inputs:
+              command: test
+              projects: "tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj"
+              testRunTitle: Integration Tests SQL Server - $(Agent.OS)
+              arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build'
+
+          # Stop SQL Server
+          - pwsh: docker stop mssql
+            displayName: Stop SQL Server Docker image (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - pwsh: SqlLocalDB stop MSSQLLocalDB
+            displayName: Stop SQL Server LocalDB (Windows)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+  - stage: DefaultConfigE2E
+    displayName: Default Config E2E Tests
    dependsOn: Build
    variables:
      npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
@@ -129,358 +341,358 @@ stages:
      # E2E Tests
      - job:
        displayName: E2E Tests (SQLite)
-        condition: eq(${{parameters.sqliteAcceptanceTests}}, True)
        timeoutInMinutes: 180
+        condition: ${{ eq(parameters.skipDefaultConfigAcceptanceTests, false) }}
        variables:
          # Connection string
          CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=Umbraco;Mode=Memory;Cache=Shared;Foreign Keys=True;Pooling=True
          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.Sqlite
+          DatabaseType: SQLite
+          additionalEnvironmentVariables: false
        strategy:
          matrix:
            LinuxPart1Of3:
              vmImage: "ubuntu-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run testSqlite -- --shard=1/3"
            LinuxPart2Of3:
              vmImage: "ubuntu-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run testSqlite -- --shard=2/3"
            LinuxPart3Of3:
              vmImage: "ubuntu-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run testSqlite -- --shard=3/3"
            WindowsPart1Of3:
              vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run testSqlite -- --shard=1/3"
            WindowsPart2Of3:
              vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run testSqlite -- --shard=2/3"
            WindowsPart3Of3:
              vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
              testCommand: "npm run testSqlite -- --shard=3/3"
        pool:
          vmImage: $(vmImage)
        steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            retryCountOnTaskFailure: 3
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL }}
+              PlaywrightPassword: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}

          - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
-              CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
              dotnet restore UmbracoProject
              cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+            displayName: Restore project
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
              dotnet dev-certs https
            displayName: Build application
            workingDirectory: $(Agent.BuildDirectory)/app
+            condition: succeeded()

-          # Run application
-          - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
-              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
-            displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-            workingDirectory: $(Agent.BuildDirectory)/app
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              DatabaseType: ${{ variables.DatabaseType }}
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}

-          - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
-              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
-            displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Ensures we have the package wait-on installed
-          - pwsh: npm install wait-on
-            displayName: Install wait-on package
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-            # Install Playwright and dependencies
-          - pwsh: npx playwright install chromium
-            displayName: Install Playwright only with Chromium browser
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            continueOnError: true
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-            env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
-
-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Copy console error log
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/console-errors.json) {
-                  Copy-Item tests/Umbraco.Tests.AcceptanceTest/console-errors.json $(Build.ArtifactStagingDirectory)
-              }
-            displayName: Copy console error log
-            condition: succeededOrFailed()
-
-          # Publish
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
-
-          # Publish test results
-          - task: PublishTestResults@2
-            displayName: "Publish test results"
-            condition: succeededOrFailed()
-            inputs:
-              testResultsFormat: 'JUnit'
-              testResultsFiles: '*.xml'
-              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
-              testRunTitle: "$(Agent.JobName)"
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              DatabaseType: ${{ variables.DatabaseType }}

      - job:
        displayName: E2E Tests (SQL Server)
        timeoutInMinutes: 180
+        condition: ${{ eq(parameters.skipDefaultConfigAcceptanceTests, false) }}
        variables:
          # Connection string
          CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+          DatabaseType: SQLServer
+          SA_PASSWORD: UmbracoAcceptance123!
+          additionalEnvironmentVariables: false
        strategy:
          matrix:
            LinuxPart1Of3:
              testCommand: "npm run test -- --shard=1/3"
+              testFolder: "DefaultConfig"
              vmImage: "ubuntu-latest"
-              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
            LinuxPart2Of3:
              testCommand: "npm run test -- --shard=2/3"
+              testFolder: "DefaultConfig"
              vmImage: "ubuntu-latest"
-              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
            LinuxPart3Of3:
              testCommand: "npm run test -- --shard=3/3"
+              testFolder: "DefaultConfig"
              vmImage: "ubuntu-latest"
-              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
            WindowsPart1Of3:
-              vmImage: "windows-latest"
              testCommand: "npm run test -- --shard=1/3"
+              testFolder: "DefaultConfig"
+              vmImage: "windows-latest"
            WindowsPart2Of3:
-              vmImage: "windows-latest"
              testCommand: "npm run test -- --shard=2/3"
-            WindowsPart3Of3:
+              testFolder: "DefaultConfig"
              vmImage: "windows-latest"
+            WindowsPart3Of3:
              testCommand: "npm run test -- --shard=3/3"
+              testFolder: "DefaultConfig"
+              vmImage: "windows-latest"
        pool:
          vmImage: $(vmImage)
        steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL }}
+              PlaywrightPassword: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}

          - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
-              CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
              dotnet restore UmbracoProject
              cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+            displayName: Restore project
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
              dotnet dev-certs https
            displayName: Build application
            workingDirectory: $(Agent.BuildDirectory)/app
+            condition: succeeded()

-          # Start SQL Server
-          - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=$(SA_PASSWORD)" mcr.microsoft.com/mssql/server:2022-latest
-            displayName: Start SQL Server Docker image (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              SA_PASSWORD: ${{ variables.SA_PASSWORD }}
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              DatabaseType: ${{ variables.DatabaseType }}
+              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}

-          - pwsh: SqlLocalDB start MSSQLLocalDB
-            displayName: Start SQL Server LocalDB (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              DatabaseType: ${{ variables.DatabaseType }}

-          # Run application
+  - stage: AdditionalConfigE2E
+    displayName: Additional Config E2E Tests
+    dependsOn: Build
+    variables:
+      npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
+      ASPNETCORE_URLS: https://localhost:44331
+      PlaywrightPassword: UmbracoAcceptance123!
+      PlaywrightUserEmail: playwright@umbraco.com
+    jobs:
+      - job:
+        displayName: E2E Tests with Different App settings (SQL Server)
+        condition: ${{ eq(parameters.differentAppSettingsAcceptanceTests, true) }}
+        timeoutInMinutes: 180
+        variables:
+          SA_PASSWORD: UmbracoAcceptance123!
+          DatabaseType: SQLServer
+        strategy:
+          matrix:
+            # UnattendedInstallConfig
+            WindowsUnattendedInstallConfig:
+              vmImage: "windows-latest"
+              testFolder: "UnattendedInstallConfig"
+              testCommand: "npx playwright test --project=unattendedInstallConfig --grep=InstallSQLServer"
+              port: 44331
+              additionalEnvironmentVariables: false
+            # DeliveryApiConfig
+            WindowsDeliveryApiConfig:
+              vmImage: "windows-latest"
+              testFolder: "DeliveryApi"
+              port: ''
+              testCommand: "npx playwright test --project=deliveryApi"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+            LinuxDeliveryApiConfig:
+              vmImage: "ubuntu-latest"
+              testFolder: "DeliveryApi"
+              port: ''
+              testCommand: "npx playwright test --project=deliveryApi"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+            # ExternalLogin AzureADB2C
+            WindowsExternalLoginAzureADB2C:
+              vmImage: "windows-latest"
+              testFolder: "ExternalLogin\\AzureADB2C"
+              testCommand: "npx playwright test --project=externalLoginAzureADB2C"
+              port: 44331
+              packageName: "Microsoft.AspNetCore.Authentication.OpenIdConnect"
+              packageVersion: "9.0.8"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: true
+            # ExtensionRegistry
+            WindowsExtensionRegistry:
+              vmImage: "windows-latest"
+              testFolder: "ExtensionRegistry"
+              port: ''
+              testCommand: "npx playwright test --project=extensionRegistry"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+            LinuxExtensionRegistry:
+              vmImage: "ubuntu-latest"
+              testFolder: "ExtensionRegistry"
+              port: ''
+              testCommand: "npx playwright test --project=extensionRegistry"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+        pool:
+          vmImage: $(vmImage)
+        steps:
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.PlaywrightUserEmail }}
+              PlaywrightPassword: ${{ variables.PlaywrightPassword }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}
+
+          # Install NuGet package if specified in the matrix
+          - pwsh: |
+              Write-Host "Installing package $(packageName) version $(packageVersion)"
+              dotnet add package $(packageName) --version $(packageVersion)
+            displayName: "Install NuGet package: $(packageName)"
+            workingDirectory: $(Agent.BuildDirectory)/app/UmbracoProject
+            condition: and(succeeded(), ne(variables['packageName'], ''), ne(variables['packageVersion'], ''))
+
+          # Build application Template
+          - template: nightly-E2E-build-template.yml
+            parameters:
+              testFolder: $(testFolder)
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              additionalEnvironmentVariables: $(additionalEnvironmentVariables)
+
+          # Build application for AzureADB2C
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
+              dotnet dev-certs https
+            displayName: Build application for AzureADB2C
+            workingDirectory: $(Agent.BuildDirectory)/app
+            env:
+              AZUREADB2CDOMAIN: $(AZUREB2CDOMAIN)
+              AZUREADB2CTENANT: $(AZUREB2CTENANT)
+              AZUREADB2CPOLICY: $(AZUREB2CPOLICY)
+              AZUREADB2CCLIENTID: $(AZUREB2CCLIENTID)
+              AZUREADB2CCLIENTSECRET: $(AZUREB2CCLIENTSECRET)
+            condition: and(succeeded(), eq(variables['testFolder'], 'ExternalLogin\AzureADB2C'))
+
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              SA_PASSWORD: ${{ variables.SA_PASSWORD }}
+              additionalEnvironmentVariables: $(additionalEnvironmentVariables)
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              DatabaseType: ${{ variables.DatabaseType }}
+
+          # Run application for Linux with additional Environment Variables for Azure AD
          - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
+              nohup dotnet run --project UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
            displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'), eq(variables['testFolder'], 'ExternalLogin\AzureADB2C'))
            workingDirectory: $(Agent.BuildDirectory)/app
+            env:
+              AZUREADB2CDOMAIN: $(AZUREB2CDOMAIN)
+              AZUREADB2CTENANT: $(AZUREB2CTENANT)
+              AZUREADB2CPOLICY: $(AZUREB2CPOLICY)
+              AZUREADB2CCLIENTID: $(AZUREB2CCLIENTID)
+              AZUREADB2CCLIENTSECRET: $(AZUREB2CCLIENTSECRET)

+          # Run application for Windows with additional Environment Variables for Azure AD
          - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
+              $process = Start-Process dotnet "run --project UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
            displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'), eq(variables['testFolder'], 'ExternalLogin\AzureADB2C'))
            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Ensures we have the package wait-on installed
-          - pwsh: npm install wait-on
-            displayName: Install wait-on package
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Install Playwright and dependencies
-          - pwsh: npx playwright install chromium
-            displayName: Install Playwright only with Chromium browser
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            continueOnError: true
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
            env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
+              AZUREADB2CDOMAIN: $(AZUREB2CDOMAIN)
+              AZUREADB2CTENANT: $(AZUREB2CTENANT)
+              AZUREADB2CPOLICY: $(AZUREB2CPOLICY)
+              AZUREADB2CCLIENTID: $(AZUREB2CCLIENTID)
+              AZUREADB2CCLIENTSECRET: $(AZUREB2CCLIENTSECRET)

-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              port: $(port)
+              AZUREB2CTESTUSEREMAIL: $(AZUREB2CTESTUSEREMAIL)
+              AZUREB2CTESTUSERPASSWORD: $(AZUREB2CTESTUSERPASSWORD)
+              DatabaseType: ${{ variables.DatabaseType }}

-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
+  - stage: NotifySlackBot
+    displayName: Notify Slack on Failure
+    dependsOn: DefaultConfigE2E
+    # This stage will only run if the E2E tests fail or succeed with issues
+    condition: or(eq(dependencies.DefaultConfigE2E.result, 'failed'), eq(dependencies.DefaultConfigE2E.result, 'succeededWithIssues'))
+    jobs:
+      - job: PostToSlack
+        displayName: Send Slack Notification
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          # We send a payload to the Slack webhook URL, which will post a message to a specific channel
+          - bash: |
+              PROJECT_NAME_ENCODED=$(echo -n "$SYSTEM_TEAMPROJECT" | jq -s -R -r @uri)
+              PIPELINE_URL="${SYSTEM_TEAMFOUNDATIONCOLLECTIONURI}${PROJECT_NAME_ENCODED}/_build/results?buildId=${BUILD_BUILDID}&view=ms.vss-test-web.build-test-results-tab"

-          # Stop SQL Server
-          - pwsh: docker stop mssql
-            displayName: Stop SQL Server Docker image (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+              PAYLOAD="{
+                \"attachments\": [
+                  {
+                    \"color\": \"#ff0000\",
+                    \"pretext\": \"Nightly E2E pipeline *${BUILD_DEFINITIONNAME}* (#${BUILD_BUILDNUMBER}) failed!\",
+                    \"title\": \"View Failed E2E Test Results\",
+                    \"title_link\": \"$PIPELINE_URL\",
+                    \"fields\": [
+                      {
+                        \"title\": \"Pipeline\",
+                        \"value\": \"${BUILD_DEFINITIONNAME}\",
+                        \"short\": true
+                      },
+                      {
+                        \"title\": \"Build ID\",
+                        \"value\": \"${BUILD_BUILDID}\",
+                        \"short\": true
+                      }
+                    ]
+                  }
+                ]
+              }"

-          - pwsh: SqlLocalDB stop MSSQLLocalDB
-            displayName: Stop SQL Server LocalDB (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Copy console error log
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/console-errors.json) {
-                  Copy-Item tests/Umbraco.Tests.AcceptanceTest/console-errors.json $(Build.ArtifactStagingDirectory)
-              }
-            displayName: Copy console error log
-            condition: succeededOrFailed()
-
-          # Publish
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
-
-          # Publish test results
-          - task: PublishTestResults@2
-            displayName: "Publish test results"
-            condition: succeededOrFailed()
-            inputs:
-              testResultsFormat: 'JUnit'
-              testResultsFiles: '*.xml'
-              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
-              testRunTitle: "$(Agent.JobName)"
+              echo "Sending Slack message to: $PIPELINE_URL"
+              curl -X POST -H 'Content-type: application/json' \
+                --data "$PAYLOAD" \
+                "$SLACK_WEBHOOK_URL"
+            env:
+              SLACK_WEBHOOK_URL: $(E2ESLACKWEBHOOKURL)
@@ -8,8 +8,8 @@ schedules:
  displayName: Daily midnight build
  branches:
    include:
-    - v10/dev
    - v13/dev
+    - v17/dev
    - main

 steps:
@@ -0,0 +1,56 @@
+parameters:
+  - name: projectName
+    type: string
+  - name: umbracoVersion
+    type: string
+  - name: projects
+    type: object
+
+jobs:
+- job: Create_DT_Project
+  displayName: Create Dependency Track Project
+  steps:
+    - checkout: none
+
+    - bash: |
+        project_id=$(curl --no-progress-meter -H "X-Api-Key: $(DT_API_KEY)" "$(DT_API_URL)/v1/project/lookup?name=${{ parameters.projectName }}&version=${{ parameters.umbracoVersion }}" | jq -r '.uuid')
+        if [ "$project_id" != "null" ] && [ -n "$project_id" ]; then
+          echo "Project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' already exists (ID: $project_id)."
+        else
+          project_id=$(curl --no-progress-meter \
+            -X PUT "$(DT_API_URL)/v1/project" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: application/json" \
+            -d '{"name": "${{ parameters.projectName }}", "version": "${{ parameters.umbracoVersion }}", "collectionLogic": "AGGREGATE_DIRECT_CHILDREN"}' \
+            | jq -r '.uuid')
+          if [ -z "$project_id" ] || [ "$project_id" == "null" ]; then
+            echo "Failed to create project '${{ parameters.projectName }}' version '${{ parameters.umbracoVersion }}'."
+            exit 1
+          fi
+          echo "Created project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' (ID: $project_id)."
+        fi
+      displayName: Ensure main project exists in Dependency Track
+
+- ${{ each project in parameters.projects }}:
+  - job:
+    displayName: Upload ${{ project.name }} BOM
+    dependsOn: Create_DT_Project
+    steps:
+      - checkout: none
+
+      - download: current
+        artifact: ${{ project.artifact }}
+        displayName: Download ${{ project.artifact }} artifact
+
+      - script: |
+          curl --no-progress-meter --fail-with-body \
+            -X POST "$(DT_API_URL)/v1/bom" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: multipart/form-data" \
+            -F "autoCreate=true" \
+            -F "projectName=${{ parameters.projectName }}-${{ project.name }}" \
+            -F "projectVersion=${{ parameters.umbracoVersion }}" \
+            -F "parentName=${{ parameters.projectName }}" \
+            -F "parentVersion=${{ parameters.umbracoVersion }}" \
+            -F "bom=@$(Pipeline.Workspace)/${{ project.artifact }}/${{ project.bomFilePath }}"
+        displayName: Upload ${{ project.name }} BOM to Dependency Track
@@ -0,0 +1,49 @@
+parameters:
+  - name: nodeVersion
+    type: string
+    default: ''
+
+  - name: npm_config_cache
+    type: string
+    default: ''
+
+  - name: PlaywrightUserEmail
+    type: string
+    default: ''
+
+  - name: PlaywrightPassword
+    type: string
+    default: ''
+
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+steps:
+  - task: NodeTool@0
+    displayName: Use Node.js $(nodeVersion)
+    inputs:
+      versionSpec: $(nodeVersion)
+
+  - pwsh: |
+      "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
+      UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
+      URL=${{ parameters.ASPNETCORE_URLS }}
+      STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
+      CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
+    displayName: Generate .env
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+
+  # Cache and restore NPM packages
+  - task: Cache@2
+    displayName: Cache NPM packages
+    inputs:
+      key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
+      restoreKeys: |
+        npm_e2e | "$(Agent.OS)"
+        npm_e2e
+      path: ${{ parameters.npm_config_cache }}
+
+  - script: npm ci --no-fund --no-audit --prefer-offline
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+    displayName: Restore NPM packages
@@ -1,6 +1,6 @@
 {
  "sdk": {
-    "version": "9.0.100",
+    "version": "10.0.100",
    "rollForward": "latestFeature",
    "allowPrerelease": false
  }
@@ -0,0 +1,12 @@
+using Microsoft.AspNetCore.Http;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Common.Accessors;
+
+public sealed class RequestContextOutputExpansionStrategyAccessor : RequestContextServiceAccessorBase<IOutputExpansionStrategy>, IOutputExpansionStrategyAccessor
+{
+    public RequestContextOutputExpansionStrategyAccessor(IHttpContextAccessor httpContextAccessor)
+        : base(httpContextAccessor)
+    {
+    }
+}
@@ -0,0 +1,20 @@
+using System.Diagnostics.CodeAnalysis;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Umbraco.Cms.Api.Common.Accessors;
+
+public abstract class RequestContextServiceAccessorBase<T>
+    where T : class
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    protected RequestContextServiceAccessorBase(IHttpContextAccessor httpContextAccessor)
+        => _httpContextAccessor = httpContextAccessor;
+
+    public bool TryGetValue([NotNullWhen(true)] out T? requestStartNodeService)
+    {
+        requestStartNodeService = _httpContextAccessor.HttpContext?.RequestServices.GetService<T>();
+        return requestStartNodeService is not null;
+    }
+}
@@ -4,7 +4,7 @@ using Umbraco.Cms.Core.Configuration.Models;

 namespace Umbraco.Cms.Api.Common.Configuration;

-internal class ConfigureOpenIddict : IConfigureOptions<OpenIddictServerAspNetCoreOptions>
+internal sealed class ConfigureOpenIddict : IConfigureOptions<OpenIddictServerAspNetCoreOptions>
 {
    private readonly IOptions<GlobalSettings> _globalSettings;

@@ -4,7 +4,7 @@ using Microsoft.AspNetCore.Mvc.ApiExplorer;
 using Microsoft.AspNetCore.Mvc.Controllers;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi.Models;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Extensions;
@@ -42,7 +42,7 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
        swaggerGenOptions.DocInclusionPredicate((name, api) =>
        {
            if (api.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor
-                && controllerActionDescriptor.MethodInfo.HasMapToApiAttribute(name))
+                && controllerActionDescriptor.HasMapToApiAttribute(name))
            {
                return true;
            }
@@ -0,0 +1,230 @@
+using System.Diagnostics.CodeAnalysis;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Options;
+using OpenIddict.Server;
+using OpenIddict.Validation;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.Events;
+using Umbraco.Cms.Core.Notifications;
+using Umbraco.Cms.Web.Common.Security;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.DependencyInjection;
+
+internal sealed class HideBackOfficeTokensHandler
+    : IOpenIddictServerHandler<OpenIddictServerEvents.ApplyTokenResponseContext>,
+        IOpenIddictServerHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>,
+        IOpenIddictServerHandler<OpenIddictServerEvents.ExtractTokenRequestContext>,
+        IOpenIddictValidationHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>,
+        INotificationHandler<UserLogoutSuccessNotification>
+{
+    private const string RedactedTokenValue = "[redacted]";
+    private const string AccessTokenCookieKey = "__Host-umbAccessToken";
+    private const string RefreshTokenCookieKey = "__Host-umbRefreshToken";
+    private const string PkceCodeCookieKey = "__Host-umbPkceCode";
+
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly IDataProtectionProvider _dataProtectionProvider;
+    private readonly BackOfficeTokenCookieSettings _backOfficeTokenCookieSettings;
+    private readonly GlobalSettings _globalSettings;
+
+    public HideBackOfficeTokensHandler(
+        IHttpContextAccessor httpContextAccessor,
+        IDataProtectionProvider dataProtectionProvider,
+        IOptions<BackOfficeTokenCookieSettings> backOfficeTokenCookieSettings,
+        IOptions<GlobalSettings> globalSettings)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _dataProtectionProvider = dataProtectionProvider;
+        _backOfficeTokenCookieSettings = backOfficeTokenCookieSettings.Value;
+        _globalSettings = globalSettings.Value;
+    }
+
+    /// <summary>
+    /// This is invoked when tokens (access and refresh tokens) are issued to a client. For the back-office client,
+    /// we will intercept the response, write the tokens from the response into HTTP-only cookies, and redact the
+    /// tokens from the response, so they are not exposed to the client.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ApplyTokenResponseContext context)
+    {
+        if (context.Request?.ClientId is not Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        HttpContext httpContext = GetHttpContext();
+
+        if (context.Response.AccessToken is not null)
+        {
+            SetCookie(httpContext, AccessTokenCookieKey, context.Response.AccessToken);
+            context.Response.AccessToken = RedactedTokenValue;
+        }
+
+        if (context.Response.RefreshToken is not null)
+        {
+            SetCookie(httpContext, RefreshTokenCookieKey, context.Response.RefreshToken);
+            context.Response.RefreshToken = RedactedTokenValue;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    /// This is invoked when a PKCE code is issued to the client. For the back-office client, we will intercept the
+    /// response, write the PKCE code from the response into a HTTP-only cookie, and redact the code from the response,
+    /// so it's not exposed to the client.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ApplyAuthorizationResponseContext context)
+    {
+        if (context.Request?.ClientId is not Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        if (context.Response.Code is not null)
+        {
+            SetCookie(GetHttpContext(), PkceCodeCookieKey, context.Response.Code);
+            context.Response.Code = RedactedTokenValue;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    /// This is invoked when requesting new tokens.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ExtractTokenRequestContext context)
+    {
+        if (context.Request?.ClientId != Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        // Handle when the PKCE code is being exchanged for an access token.
+        if (context.Request.Code == RedactedTokenValue
+            && TryGetCookie(PkceCodeCookieKey, out var code))
+        {
+            context.Request.Code = code;
+
+            // We won't need the PKCE cookie after this, let's remove it.
+            RemoveCookie(GetHttpContext(), PkceCodeCookieKey);
+        }
+        else
+        {
+            // PCKE codes should always be redacted. If we got here, someone might be trying to pass another PKCE
+            // code. For security reasons, explicitly discard the code (if any) to be on the safe side.
+            context.Request.Code = null;
+        }
+
+        // Handle when a refresh token is being exchanged for a new access token.
+        if (context.Request.RefreshToken == RedactedTokenValue
+            && TryGetCookie(RefreshTokenCookieKey, out var refreshToken))
+        {
+            context.Request.RefreshToken = refreshToken;
+        }
+        else
+        {
+            // If we got here, either the refresh token was not redacted, or nothing was found in the refresh token cookie.
+            // If OpenIddict found a refresh token, it could be an old token that is potentially still valid. For security
+            // reasons, we cannot accept that; at this point, we expect the refresh tokens to be explicitly redacted.
+            context.Request.RefreshToken = null;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    /// This is invoked when extracting the auth context for a client request.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictValidationEvents.ProcessAuthenticationContext context)
+    {
+        // For the back-office client, this only happens when an access token is sent to the API.
+        if (context.AccessToken != RedactedTokenValue)
+        {
+            return ValueTask.CompletedTask;
+        }
+
+        if (TryGetCookie(AccessTokenCookieKey, out var accessToken))
+        {
+            context.AccessToken = accessToken;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    public void Handle(UserLogoutSuccessNotification notification)
+    {
+        HttpContext? context = _httpContextAccessor.HttpContext;
+        if (context is null)
+        {
+            // For some reason there is no ambient HTTP context, so we can't clean up the cookies.
+            // This is OK, because the tokens in the cookies have already been revoked at user sign-out,
+            // so the cookie clean-up is mostly cosmetic.
+            return;
+        }
+
+        context.Response.Cookies.Delete(AccessTokenCookieKey);
+        context.Response.Cookies.Delete(RefreshTokenCookieKey);
+    }
+
+    private HttpContext GetHttpContext()
+        => _httpContextAccessor.GetRequiredHttpContext();
+
+    private void SetCookie(HttpContext httpContext, string key, string value)
+    {
+        var cookieValue = EncryptionHelper.Encrypt(value, _dataProtectionProvider);
+
+        RemoveCookie(httpContext, key);
+        httpContext.Response.Cookies.Append(key, cookieValue, GetCookieOptions(httpContext));
+    }
+
+    private void RemoveCookie(HttpContext httpContext, string key)
+        => httpContext.Response.Cookies.Delete(key, GetCookieOptions(httpContext));
+
+    private CookieOptions GetCookieOptions(HttpContext httpContext) =>
+        new()
+        {
+            // Prevent the client-side scripts from accessing the cookie.
+            HttpOnly = true,
+
+            // Mark the cookie as essential to the application, to enforce it despite any
+            // data collection consent options. This aligns with how ASP.NET Core Identity
+            // does when writing cookies for cookie authentication.
+            IsEssential = true,
+
+            // Cookie path must be root for optimal security.
+            Path = "/",
+
+            // For optimal security, the cooke must be secure. However, Umbraco allows for running development
+            // environments over HTTP, so we need to take that into account here.
+            // Thus, we will make the cookie secure if:
+            // - HTTPS is explicitly enabled by config (default for production environments), or
+            // - The current request is over HTTPS (meaning the environment supports it regardless of config).
+            Secure = _globalSettings.UseHttps || httpContext.Request.IsHttps,
+
+            // SameSite is configurable (see BackOfficeTokenCookieSettings for defaults):
+            SameSite = ParseSameSiteMode(_backOfficeTokenCookieSettings.SameSite),
+        };
+
+    private bool TryGetCookie(string key, [NotNullWhen(true)] out string? value)
+    {
+        if (GetHttpContext().Request.Cookies.TryGetValue(key, out var cookieValue))
+        {
+            value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
+            return true;
+        }
+
+        value = null;
+        return false;
+    }
+
+    private static SameSiteMode ParseSameSiteMode(string sameSiteMode) =>
+        Enum.TryParse(sameSiteMode, ignoreCase: true, out SameSiteMode result)
+            ? result
+            : throw new ArgumentException($"The provided {nameof(sameSiteMode)} value could not be parsed into as SameSiteMode value.", nameof(sameSiteMode));
+}
@@ -9,8 +9,9 @@ using Umbraco.Cms.Api.Common.Security;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DependencyInjection;
-using Umbraco.Cms.Infrastructure.BackgroundJobs.Jobs;
-using Umbraco.Extensions;
+using Umbraco.Cms.Infrastructure.BackgroundJobs;
+using Umbraco.Cms.Infrastructure.BackgroundJobs.Jobs.DistributedJobs;
+using Umbraco.Cms.Core.Notifications;

 namespace Umbraco.Cms.Api.Common.DependencyInjection;

@@ -113,6 +114,25 @@ public static class UmbracoBuilderAuthExtensions
                {
                    configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
                });
+
+                options.AddEventHandler<OpenIddictServerEvents.ApplyTokenResponseContext>(configuration =>
+                {
+                    configuration
+                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ProcessJsonResponse<OpenIddictServerEvents.ApplyTokenResponseContext>.Descriptor.Order - 1);
+                });
+                options.AddEventHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>(configuration =>
+                {
+                    configuration
+                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.Authentication.ProcessQueryResponse.Descriptor.Order - 1);
+                });
+                options.AddEventHandler<OpenIddictServerEvents.ExtractTokenRequestContext>(configuration =>
+                {
+                    configuration
+                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ExtractPostRequest<OpenIddictServerEvents.ExtractTokenRequestContext>.Descriptor.Order + 1);
+                });
            })

            // Register the OpenIddict validation components.
@@ -137,9 +157,19 @@ public static class UmbracoBuilderAuthExtensions
                {
                    configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
                });
+
+                options.AddEventHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>(configuration =>
+                {
+                    configuration
+                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                        // IMPORTANT: the handler must be AFTER the built-in query string handler, because the client-side SignalR library sometimes appends access tokens to the query string.
+                        .SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ExtractAccessTokenFromQueryString.Descriptor.Order + 1);
+                });
            });

-        builder.Services.AddRecurringBackgroundJob<OpenIddictCleanupJob>();
+        builder.Services.AddSingleton<IDistributedBackgroundJob, OpenIddictCleanupJob>();
        builder.Services.ConfigureOptions<ConfigureOpenIddict>();
+
+        builder.AddNotificationHandler<UserLogoutSuccessNotification, HideBackOfficeTokensHandler>();
    }
 }
@@ -0,0 +1,36 @@
+using Microsoft.AspNetCore.Mvc.Abstractions;
+using Umbraco.Cms.Api.Common.Attributes;
+using Umbraco.Cms.Api.Common.Configuration;
+
+namespace Umbraco.Extensions;
+
+/// <summary>
+/// Provides extension methods for <see cref="ActionDescriptor"/> to work with <see cref="MapToApiAttribute"/>.
+/// </summary>
+public static class ActionDescriptorApiCommonExtensions
+{
+    /// <summary>
+    /// Determines whether the <see cref="ActionDescriptor"/> has a <see cref="MapToApiAttribute"/> with the specified API name.
+    /// The check is made in runtime to support attributes added in runtime.
+    /// </summary>
+    /// <param name="actionDescriptor">The action descriptor to inspect.</param>
+    /// <param name="apiName">The API name to check for.</param>
+    /// <returns>
+    /// <c>true</c> if the <see cref="MapToApiAttribute"/> is present and matches the specified API name,
+    /// or if the attribute is not present and the API name matches the default API name; otherwise, <c>false</c>.
+    /// </returns>
+    public static bool HasMapToApiAttribute(this ActionDescriptor actionDescriptor, string apiName)
+    {
+        var value = actionDescriptor.GetMapToApiAttributeValue();
+
+        return value == apiName
+               || (value is null && apiName == DefaultApiConfiguration.ApiName);
+    }
+
+    private static string? GetMapToApiAttributeValue(this ActionDescriptor actionDescriptor)
+    {
+        IEnumerable<MapToApiAttribute> mapToApiAttributes = actionDescriptor?.EndpointMetadata?.OfType<MapToApiAttribute>() ?? [];
+
+        return mapToApiAttributes.SingleOrDefault()?.ApiName;
+    }
+}
@@ -8,11 +8,11 @@ namespace Umbraco.Extensions;
 public static class MethodInfoApiCommonExtensions
 {

-    public static string? GetMapToApiVersionAttributeValue(this MethodInfo methodInfo)
+    public static string GetMapToApiVersionAttributeValue(this MethodInfo methodInfo)
    {
        MapToApiVersionAttribute[] mapToApis = methodInfo.GetCustomAttributes(typeof(MapToApiVersionAttribute), inherit: true).Cast<MapToApiVersionAttribute>().ToArray();

-        return string.Join("|", mapToApis.SelectMany(x=>x.Versions));
+        return string.Join("|", mapToApis.SelectMany(x => x.Versions));
    }

    public static string? GetMapToApiAttributeValue(this MethodInfo methodInfo)
@@ -4,7 +4,7 @@ using Microsoft.Extensions.Logging;

 namespace Umbraco.Cms.Api.Common.Json;

-internal class NamedSystemTextJsonInputFormatter : SystemTextJsonInputFormatter
+internal sealed class NamedSystemTextJsonInputFormatter : SystemTextJsonInputFormatter
 {
    private readonly string _jsonOptionsName;

@@ -3,8 +3,7 @@ using Microsoft.AspNetCore.Mvc.Formatters;

 namespace Umbraco.Cms.Api.Common.Json;

-
-internal class NamedSystemTextJsonOutputFormatter : SystemTextJsonOutputFormatter
+internal sealed class NamedSystemTextJsonOutputFormatter : SystemTextJsonOutputFormatter
 {
    private readonly string _jsonOptionsName;

@@ -1,25 +1,27 @@
 using System.Reflection;
 using System.Runtime.Serialization;
-using Microsoft.OpenApi.Any;
-using Microsoft.OpenApi.Models;
+using System.Text.Json.Nodes;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;

 namespace Umbraco.Cms.Api.Common.OpenApi;

 public class EnumSchemaFilter : ISchemaFilter
 {
-    public void Apply(OpenApiSchema model, SchemaFilterContext context)
+    public void Apply(IOpenApiSchema model, SchemaFilterContext context)
    {
-        if (context.Type.IsEnum)
+        if (model is not OpenApiSchema schema || context.Type.IsEnum is false)
        {
-            model.Type = "string";
-            model.Format = null;
-            model.Enum.Clear();
-            foreach (var name in Enum.GetNames(context.Type))
-            {
-                var actualName = context.Type.GetField(name)?.GetCustomAttribute<EnumMemberAttribute>()?.Value ?? name;
-                model.Enum.Add(new OpenApiString(actualName));
-            }
+            return;
+        }
+
+        schema.Type = JsonSchemaType.String;
+        schema.Format = null;
+        schema.Enum = new List<JsonNode>();
+        foreach (var name in Enum.GetNames(context.Type))
+        {
+            var actualName = context.Type.GetField(name)?.GetCustomAttribute<EnumMemberAttribute>()?.Value ?? name;
+            schema.Enum.Add(actualName);
        }
    }
 }
@@ -1,4 +1,4 @@
-using Microsoft.OpenApi.Models;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Extensions;

@@ -21,25 +21,32 @@ public class MimeTypeDocumentFilter : IDocumentFilter
        }

        OpenApiOperation[] operations = swaggerDoc.Paths
-            .SelectMany(path => path.Value.Operations.Values)
+            .SelectMany(path => path.Value.Operations?.Values ?? Enumerable.Empty<OpenApiOperation>())
            .ToArray();

-        void RemoveUnwantedMimeTypes(IDictionary<string, OpenApiMediaType> content)
+        void RemoveUnwantedMimeTypes(IDictionary<string, OpenApiMediaType>? content)
        {
-            if (content.ContainsKey("application/json"))
+            if (content is null || content.ContainsKey("application/json") is false)
            {
-                content.RemoveAll(r => r.Key != "application/json");
+                return;
            }

+            content.RemoveAll(r => r.Key != "application/json");
        }

-        OpenApiRequestBody[] requestBodies = operations.Select(operation => operation.RequestBody).WhereNotNull().ToArray();
+        OpenApiRequestBody[] requestBodies = operations
+            .Select(operation => operation.RequestBody)
+            .OfType<OpenApiRequestBody>()
+            .ToArray();
        foreach (OpenApiRequestBody requestBody in requestBodies)
        {
            RemoveUnwantedMimeTypes(requestBody.Content);
        }

-        OpenApiResponse[] responses = operations.SelectMany(operation => operation.Responses.Values).WhereNotNull().ToArray();
+        OpenApiResponse[] responses = operations
+            .SelectMany(operation => operation.Responses?.Values ?? Enumerable.Empty<IOpenApiResponse>())
+            .OfType<OpenApiResponse>()
+            .ToArray();
        foreach (OpenApiResponse response in responses)
        {
            RemoveUnwantedMimeTypes(response.Content);
@@ -1,4 +1,4 @@
-using Microsoft.OpenApi.Models;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;

 namespace Umbraco.Cms.Api.Common.OpenApi;
@@ -20,6 +20,6 @@ public class RemoveSecuritySchemesDocumentFilter : IDocumentFilter
            return;
        }

-        swaggerDoc.Components.SecuritySchemes.Clear();
+        swaggerDoc.Components?.SecuritySchemes?.Clear();
    }
 }
@@ -15,20 +15,6 @@ public class SubTypesSelector : ISubTypesSelector
    private readonly IEnumerable<ISubTypesHandler> _subTypeHandlers;
    private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;

-    [Obsolete("The settings parameter is not required anymore, use the other constructor instead. Scheduled for removal in Umbraco 17.")]
-    public SubTypesSelector(
-        IOptions<GlobalSettings> settings,
-        IHostingEnvironment hostingEnvironment,
-        IHttpContextAccessor httpContextAccessor,
-        IEnumerable<ISubTypesHandler> subTypeHandlers,
-        IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
-    {
-        _hostingEnvironment = hostingEnvironment;
-        _httpContextAccessor = httpContextAccessor;
-        _subTypeHandlers = subTypeHandlers;
-        _umbracoJsonTypeInfoResolver = umbracoJsonTypeInfoResolver;
-    }
-
    public SubTypesSelector(
        IHostingEnvironment hostingEnvironment,
        IHttpContextAccessor httpContextAccessor,
@@ -3,13 +3,12 @@ using Microsoft.AspNetCore.Hosting;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi.Models;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Swashbuckle.AspNetCore.SwaggerUI;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Hosting;
 using Umbraco.Cms.Web.Common.ApplicationBuilder;
-using Umbraco.Extensions;
 using IHostingEnvironment = Umbraco.Cms.Core.Hosting.IHostingEnvironment;

 namespace Umbraco.Cms.Api.Common.OpenApi;
@@ -0,0 +1,148 @@
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.Rendering;
+
+public class ElementOnlyOutputExpansionStrategy : IOutputExpansionStrategy
+{
+    protected const string All = "$all";
+    protected const string None = "";
+    protected const string ExpandParameterName = "expand";
+    protected const string FieldsParameterName = "fields";
+
+    private readonly IApiPropertyRenderer _propertyRenderer;
+
+    protected Stack<Node?> ExpandProperties { get; } = new();
+
+    protected Stack<Node?> IncludeProperties { get; } = new();
+
+    public ElementOnlyOutputExpansionStrategy(
+        IApiPropertyRenderer propertyRenderer)
+    {
+        _propertyRenderer = propertyRenderer;
+    }
+
+    public virtual IDictionary<string, object?> MapContentProperties(IPublishedContent content)
+        => content.ItemType == PublishedItemType.Content
+            ? MapProperties(content.Properties)
+            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");
+
+    public virtual IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
+    {
+        if (media.ItemType != PublishedItemType.Media)
+        {
+            throw new ArgumentException($"Invalid item type. This method can only be used with item type {PublishedItemType.Media}, got: {media.ItemType}");
+        }
+
+        IPublishedProperty[] properties = media
+            .Properties
+            .Where(p => skipUmbracoProperties is false || p.Alias.StartsWith("umbraco") is false)
+            .ToArray();
+
+        return properties.Any()
+            ? MapProperties(properties)
+            : new Dictionary<string, object?>();
+    }
+
+    public virtual IDictionary<string, object?> MapElementProperties(IPublishedElement element)
+        => MapProperties(element.Properties, true);
+
+    private IDictionary<string, object?> MapProperties(IEnumerable<IPublishedProperty> properties, bool forceExpandProperties = false)
+    {
+        Node? currentExpandProperties = ExpandProperties.Count > 0 ? ExpandProperties.Peek() : null;
+        if (ExpandProperties.Count > 1 && currentExpandProperties is null && forceExpandProperties is false)
+        {
+            return new Dictionary<string, object?>();
+        }
+
+        Node? currentIncludeProperties = IncludeProperties.Count > 0 ? IncludeProperties.Peek() : null;
+        var result = new Dictionary<string, object?>();
+        foreach (IPublishedProperty property in properties)
+        {
+            Node? nextIncludeProperties = GetNextProperties(currentIncludeProperties, property.Alias);
+            if (currentIncludeProperties is not null && currentIncludeProperties.Items.Any() && nextIncludeProperties is null)
+            {
+                continue;
+            }
+
+            Node? nextExpandProperties = GetNextProperties(currentExpandProperties, property.Alias);
+
+            IncludeProperties.Push(nextIncludeProperties);
+            ExpandProperties.Push(nextExpandProperties);
+
+            result[property.Alias] = GetPropertyValue(property);
+
+            ExpandProperties.Pop();
+            IncludeProperties.Pop();
+        }
+
+        return result;
+    }
+
+    private Node? GetNextProperties(Node? currentProperties, string propertyAlias)
+        => currentProperties?.Items.FirstOrDefault(i => i.Key == All)
+           ?? currentProperties?.Items.FirstOrDefault(i => i.Key == "properties")?.Items.FirstOrDefault(i => i.Key == All || i.Key == propertyAlias);
+
+    private object? GetPropertyValue(IPublishedProperty property)
+        => _propertyRenderer.GetPropertyValue(property, ExpandProperties.Peek() is not null);
+
+    protected sealed class Node
+    {
+        public string Key { get; private set; } = string.Empty;
+
+        public List<Node> Items { get; } = new();
+
+        public static Node Parse(string value)
+        {
+            // verify that there are as many start brackets as there are end brackets
+            if (value.CountOccurrences("[") != value.CountOccurrences("]"))
+            {
+                throw new ArgumentException("Value did not contain an equal number of start and end brackets");
+            }
+
+            // verify that the value does not start with a start bracket
+            if (value.StartsWith("["))
+            {
+                throw new ArgumentException("Value cannot start with a bracket");
+            }
+
+            // verify that there are no empty brackets
+            if (value.Contains("[]"))
+            {
+                throw new ArgumentException("Value cannot contain empty brackets");
+            }
+
+            var stack = new Stack<Node>();
+            var root = new Node { Key = "root" };
+            stack.Push(root);
+
+            var currentNode = new Node();
+            root.Items.Add(currentNode);
+
+            foreach (char c in value)
+            {
+                switch (c)
+                {
+                    case '[': // Start a new node, child of the current node
+                        stack.Push(currentNode);
+                        currentNode = new Node();
+                        stack.Peek().Items.Add(currentNode);
+                        break;
+                    case ',': // Start a new node, but at the same level of the current node
+                        currentNode = new Node();
+                        stack.Peek().Items.Add(currentNode);
+                        break;
+                    case ']': // Back to parent of the current node
+                        currentNode = stack.Pop();
+                        break;
+                    default: // Add char to current node key
+                        currentNode.Key += c;
+                        break;
+                }
+            }
+
+            return root;
+        }
+    }
+}
@@ -16,11 +16,6 @@
    <PackageReference Include="OpenIddict.AspNetCore" />
  </ItemGroup>

-  <ItemGroup>
-    <!-- Take top-level depedendency on OpenIddict.AspNetCore depends on a vulnerable version -->
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
-  </ItemGroup>
-
  <ItemGroup>
    <ProjectReference Include="..\Umbraco.Core\Umbraco.Core.csproj" />
    <ProjectReference Include="..\Umbraco.Web.Common\Umbraco.Web.Common.csproj" />
@@ -0,0 +1,17 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Umbraco.Cms.Api.Common.ViewModels.Pagination;
+
+public class SubsetViewModel<T>
+{
+    [Required]
+    public long TotalBefore { get; set; }
+
+    [Required]
+    public long TotalAfter { get; set; }
+
+    [Required]
+    public IEnumerable<T> Items { get; set; } = Enumerable.Empty<T>();
+
+    public static SubsetViewModel<T> Empty() => new();
+}
@@ -23,7 +23,12 @@ internal sealed class DeliveryApiOutputCachePolicy : IOutputCachePolicy
            .RequestServices
            .GetRequiredService<IRequestPreviewService>();

-        context.EnableOutputCaching = requestPreviewService.IsPreview() is false;
+        IApiAccessService apiAccessService = context
+            .HttpContext
+            .RequestServices
+            .GetRequiredService<IApiAccessService>();
+
+        context.EnableOutputCaching = requestPreviewService.IsPreview() is false && apiAccessService.HasPublicAccess();
        context.ResponseExpirationTimeSpan = _duration;
        context.CacheVaryByRules.HeaderNames = _varyByHeaderNames;

@@ -1,6 +1,6 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi.Models;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Cms.Api.Delivery.Filters;
@@ -1,6 +1,6 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi.Models;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.Security;
 using Umbraco.Cms.Api.Delivery.Controllers.Content;
@@ -26,7 +26,7 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
        options.OperationFilter<DeliveryApiSecurityFilter>();
    }

-    private class DeliveryApiSecurityFilter : SwaggerFilterBase<ContentApiControllerBase>, IOperationFilter, IDocumentFilter
+    private sealed class DeliveryApiSecurityFilter : SwaggerFilterBase<ContentApiControllerBase>, IOperationFilter, IDocumentFilter
    {
        public void Apply(OpenApiOperation operation, OperationFilterContext context)
        {
@@ -35,23 +35,9 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                return;
            }

-            operation.Security = new List<OpenApiSecurityRequirement>
-            {
-                new OpenApiSecurityRequirement
-                {
-                    {
-                        new OpenApiSecurityScheme
-                        {
-                            Reference = new OpenApiReference
-                            {
-                                Type = ReferenceType.SecurityScheme,
-                                Id = AuthSchemeName,
-                            }
-                        },
-                        []
-                    }
-                }
-            };
+            var schemaRef = new OpenApiSecuritySchemeReference(AuthSchemeName, context.Document);
+            operation.Security ??= new List<OpenApiSecurityRequirement>();
+            operation.Security.Add(new OpenApiSecurityRequirement { [schemaRef] = [] });
        }

        public void Apply(OpenApiDocument swaggerDoc, DocumentFilterContext context)
@@ -61,6 +47,8 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                return;
            }

+            swaggerDoc.Components ??= new OpenApiComponents();
+            swaggerDoc.Components.SecuritySchemes ??= new Dictionary<string, IOpenApiSecurityScheme>();
            swaggerDoc.Components.SecuritySchemes.Add(
                AuthSchemeName,
                new OpenApiSecurityScheme
@@ -74,9 +62,9 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                        AuthorizationCode = new OpenApiOAuthFlow
                        {
                            AuthorizationUrl = new Uri(Paths.MemberApi.AuthorizationEndpoint, UriKind.Relative),
-                            TokenUrl = new Uri(Paths.MemberApi.TokenEndpoint, UriKind.Relative)
-                        }
-                    }
+                            TokenUrl = new Uri(Paths.MemberApi.TokenEndpoint, UriKind.Relative),
+                        },
+                    },
                });
        }
    }
@@ -35,27 +35,35 @@ public static class UmbracoBuilderExtensions
        builder.Services.AddScoped<IRequestStartItemProvider, RequestStartItemProvider>();
        builder.Services.AddScoped<RequestContextOutputExpansionStrategy>();
        builder.Services.AddScoped<RequestContextOutputExpansionStrategyV2>();
-        builder.Services.AddScoped<IOutputExpansionStrategy>(provider =>
-        {
-            HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
-            ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
-            if (apiVersion is null)
-            {
-                return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-            }

-            // V1 of the Delivery API uses a different expansion strategy than V2+
-            return apiVersion.MajorVersion == 1
-                ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
-                : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-        });
+        builder.Services.AddUnique<IOutputExpansionStrategy>(
+            provider =>
+            {
+                HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
+                ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
+                if (apiVersion is null)
+                {
+                    return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+                }
+
+                // V1 of the Delivery API uses a different expansion strategy than V2+
+                return apiVersion.MajorVersion == 1
+                    ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
+                    : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+            },
+            ServiceLifetime.Scoped);
+
        builder.Services.AddSingleton<IRequestCultureService, RequestCultureService>();
        builder.Services.AddSingleton<IRequestSegmmentService, RequestSegmentService>();
+        builder.Services.AddSingleton<IRequestSegmentService, RequestSegmentService>();
        builder.Services.AddSingleton<IRequestRoutingService, RequestRoutingService>();
        builder.Services.AddSingleton<IRequestRedirectService, RequestRedirectService>();
        builder.Services.AddSingleton<IRequestPreviewService, RequestPreviewService>();
-        builder.Services.AddSingleton<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>();
+
+        // Webooks register a more basic implementation, remove it.
+        builder.Services.AddUnique<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>(ServiceLifetime.Singleton);
        builder.Services.AddSingleton<IRequestStartItemProviderAccessor, RequestContextRequestStartItemProviderAccessor>();
+
        builder.Services.AddSingleton<IApiAccessService, ApiAccessService>();
        builder.Services.AddSingleton<IApiContentQueryService, ApiContentQueryService>();
        builder.Services.AddSingleton<IApiContentQueryProvider, ApiContentQueryProvider>();
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.Models.PublishedContent;
@@ -13,15 +13,15 @@ internal sealed class ContextualizeFromAcceptHeadersAttribute : TypeFilterAttrib
    {
    }

-    private class LocalizeFromAcceptLanguageHeaderAttributeFilter : IActionFilter
+    private sealed class LocalizeFromAcceptLanguageHeaderAttributeFilter : IActionFilter
    {
        private readonly IRequestCultureService _requestCultureService;
-        private readonly IRequestSegmmentService _requestSegmentService;
+        private readonly IRequestSegmentService _requestSegmentService;
        private readonly IVariationContextAccessor _variationContextAccessor;

        public LocalizeFromAcceptLanguageHeaderAttributeFilter(
            IRequestCultureService requestCultureService,
-            IRequestSegmmentService requestSegmentService,
+            IRequestSegmentService requestSegmentService,
            IVariationContextAccessor variationContextAccessor)
        {
            _requestCultureService = requestCultureService;
@@ -11,7 +11,7 @@ internal sealed class DeliveryApiAccessAttribute : TypeFilterAttribute
    {
    }

-    private class DeliveryApiAccessFilter : IActionFilter
+    private sealed class DeliveryApiAccessFilter : IActionFilter
    {
        private readonly IApiAccessService _apiAccessService;
        private readonly IRequestPreviewService _requestPreviewService;
@@ -11,7 +11,7 @@ internal sealed class DeliveryApiMediaAccessAttribute : TypeFilterAttribute
    {
    }

-    private class DeliveryApiMediaAccessFilter : IActionFilter
+    private sealed class DeliveryApiMediaAccessFilter : IActionFilter
    {
        private readonly IApiAccessService _apiAccessService;

@@ -1,9 +1,9 @@
-using Microsoft.OpenApi.Any;
-using Microsoft.OpenApi.Models;
+using System.Text.Json.Nodes;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Delivery.Configuration;
-using Umbraco.Cms.Api.Delivery.Controllers;
 using Umbraco.Cms.Api.Delivery.Controllers.Content;
+using Umbraco.Cms.Core;

 namespace Umbraco.Cms.Api.Delivery.Filters;

@@ -13,7 +13,7 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi

    protected override void ApplyOperation(OpenApiOperation operation, OperationFilterContext context)
    {
-        operation.Parameters ??= new List<OpenApiParameter>();
+        operation.Parameters ??= new List<IOpenApiParameter>();

        AddExpand(operation, context);

@@ -21,50 +21,50 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi

        operation.Parameters.Add(new OpenApiParameter
        {
-            Name = Core.Constants.DeliveryApi.HeaderNames.AcceptLanguage,
+            Name = Constants.DeliveryApi.HeaderNames.AcceptLanguage,
            In = ParameterLocation.Header,
            Required = false,
            Description = "Defines the language to return. Use this when querying language variant content items.",
-            Schema = new OpenApiSchema { Type = "string" },
-            Examples = new Dictionary<string, OpenApiExample>
+            Schema = new OpenApiSchema { Type = JsonSchemaType.String },
+            Examples = new Dictionary<string, IOpenApiExample>
            {
-                { "Default", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
-                { "English culture", new OpenApiExample { Value = new OpenApiString("en-us") } }
-            }
+                { "Default", new OpenApiExample { Value = string.Empty } },
+                { "English culture", new OpenApiExample { Value = "en-us" } },
+            },
        });

        operation.Parameters.Add(new OpenApiParameter
        {
-            Name = Core.Constants.DeliveryApi.HeaderNames.AcceptSegment,
+            Name = Constants.DeliveryApi.HeaderNames.AcceptSegment,
            In = ParameterLocation.Header,
            Required = false,
            Description = "Defines the segment to return. Use this when querying segment variant content items.",
-            Schema = new OpenApiSchema { Type = "string" },
-            Examples = new Dictionary<string, OpenApiExample>
+            Schema = new OpenApiSchema { Type = JsonSchemaType.String },
+            Examples = new Dictionary<string, IOpenApiExample>
            {
-                { "Default", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
-                { "Segment One", new OpenApiExample { Value = new OpenApiString("segment-one") } }
-            }
+                { "Default", new OpenApiExample { Value = string.Empty } },
+                { "Segment One", new OpenApiExample { Value = "segment-one" } },
+            },
        });

        AddApiKey(operation);

        operation.Parameters.Add(new OpenApiParameter
        {
-            Name = Core.Constants.DeliveryApi.HeaderNames.Preview,
+            Name = Constants.DeliveryApi.HeaderNames.Preview,
            In = ParameterLocation.Header,
            Required = false,
            Description = "Whether to request draft content.",
-            Schema = new OpenApiSchema { Type = "boolean" }
+            Schema = new OpenApiSchema { Type = JsonSchemaType.Boolean },
        });

        operation.Parameters.Add(new OpenApiParameter
        {
-            Name = Core.Constants.DeliveryApi.HeaderNames.StartItem,
+            Name = Constants.DeliveryApi.HeaderNames.StartItem,
            In = ParameterLocation.Header,
            Required = false,
            Description = "URL segment or GUID of a root content item.",
-            Schema = new OpenApiSchema { Type = "string" }
+            Schema = new OpenApiSchema { Type = JsonSchemaType.String },
        });
    }

@@ -92,105 +92,36 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi
        }
    }

-    private Dictionary<string, OpenApiExample> FetchQueryParameterExamples() =>
+    private Dictionary<string, IOpenApiExample> FetchQueryParameterExamples() =>
        new()
        {
-            { "Select all", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
-            {
-                "Select all ancestors of a node by id",
-                new OpenApiExample { Value = new OpenApiString("ancestors:id") }
-            },
-            {
-                "Select all ancestors of a node by path",
-                new OpenApiExample { Value = new OpenApiString("ancestors:path") }
-            },
-            {
-                "Select all children of a node by id",
-                new OpenApiExample { Value = new OpenApiString("children:id") }
-            },
-            {
-                "Select all children of a node by path",
-                new OpenApiExample { Value = new OpenApiString("children:path") }
-            },
-            {
-                "Select all descendants of a node by id",
-                new OpenApiExample { Value = new OpenApiString("descendants:id") }
-            },
-            {
-                "Select all descendants of a node by path",
-                new OpenApiExample { Value = new OpenApiString("descendants:path") }
-            }
+            { "Select all", new OpenApiExample { Value = string.Empty } },
+            { "Select all ancestors of a node by id", new OpenApiExample { Value = "ancestors:id" } },
+            { "Select all ancestors of a node by path", new OpenApiExample { Value = "ancestors:path" } },
+            { "Select all children of a node by id", new OpenApiExample { Value = "children:id" } },
+            { "Select all children of a node by path", new OpenApiExample { Value = "children:path" } },
+            { "Select all descendants of a node by id", new OpenApiExample { Value = "descendants:id" } },
+            { "Select all descendants of a node by path", new OpenApiExample { Value = "descendants:path" } },
        };

-    private Dictionary<string, OpenApiExample> FilterQueryParameterExamples() =>
+    private Dictionary<string, IOpenApiExample> FilterQueryParameterExamples() =>
        new()
        {
-            { "Default filter", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
-            {
-                "Filter by content type (equals)",
-                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("contentType:alias1") } }
-            },
-            {
-                "Filter by name (contains)",
-                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("name:nodeName") } }
-            },
-            {
-                "Filter by creation date (less than)",
-                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("createDate<2024-01-01") } }
-            },
-            {
-                "Filter by update date (greater than or equal)",
-                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("updateDate>:2023-01-01") } }
-            }
+            { "Default filter", new OpenApiExample { Value = string.Empty } },
+            { "Filter by content type (equals)", new OpenApiExample { Value = new JsonArray { "contentType:alias1" } } },
+            { "Filter by name (contains)", new OpenApiExample { Value = new JsonArray { "name:nodeName" } } },
+            { "Filter by creation date (less than)", new OpenApiExample { Value = new JsonArray { "createDate<2024-01-01" } } },
+            { "Filter by update date (greater than or equal)", new OpenApiExample { Value = new JsonArray { "updateDate>:2023-01-01" } } },
        };

-    private Dictionary<string, OpenApiExample> SortQueryParameterExamples() =>
+    private Dictionary<string, IOpenApiExample> SortQueryParameterExamples() =>
        new()
        {
-            { "Default sort", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
-            {
-                "Sort by create date",
-                new OpenApiExample
-                {
-                    Value = new OpenApiArray
-                    {
-                        new OpenApiString("createDate:asc"), new OpenApiString("createDate:desc")
-                    }
-                }
-            },
-            {
-                "Sort by level",
-                new OpenApiExample
-                {
-                    Value = new OpenApiArray { new OpenApiString("level:asc"), new OpenApiString("level:desc") }
-                }
-            },
-            {
-                "Sort by name",
-                new OpenApiExample
-                {
-                    Value = new OpenApiArray { new OpenApiString("name:asc"), new OpenApiString("name:desc") }
-                }
-            },
-            {
-                "Sort by sort order",
-                new OpenApiExample
-                {
-                    Value = new OpenApiArray
-                    {
-                        new OpenApiString("sortOrder:asc"), new OpenApiString("sortOrder:desc")
-                    }
-                }
-            },
-            {
-                "Sort by update date",
-                new OpenApiExample
-                {
-                    Value = new OpenApiArray
-                    {
-                        new OpenApiString("updateDate:asc"), new OpenApiString("updateDate:desc")
-                    }
-                }
-            }
+            { "Default sort", new OpenApiExample { Value = string.Empty } },
+            { "Sort by create date", new OpenApiExample { Value = new JsonArray { "createDate:asc", "createDate:desc" } } },
+            { "Sort by level", new OpenApiExample { Value = new JsonArray { "level:asc", "level:desc" } } },
+            { "Sort by name", new OpenApiExample { Value = new JsonArray { "name:asc", "name:desc" } } },
+            { "Sort by sort order", new OpenApiExample { Value = new JsonArray { "sortOrder:asc", "sortOrder:desc" } } },
+            { "Sort by update date", new OpenApiExample { Value = new JsonArray { "updateDate:asc", "updateDate:desc" } } },
        };
 }
@@ -1,7 +1,7 @@
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.OpenApi.Any;
-using Microsoft.OpenApi.Models;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
+using Umbraco.Cms.Core;

 namespace Umbraco.Cms.Api.Delivery.Filters;

@@ -9,6 +9,8 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
    : SwaggerFilterBase<TBaseController>, IOperationFilter, IParameterFilter
    where TBaseController : Controller
 {
+    protected abstract string DocumentationLink { get; }
+
    public void Apply(OpenApiOperation operation, OperationFilterContext context)
    {
        if (CanApply(context))
@@ -17,21 +19,19 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
        }
    }

-    public void Apply(OpenApiParameter parameter, ParameterFilterContext context)
+    public void Apply(IOpenApiParameter parameter, ParameterFilterContext context)
    {
-        if (CanApply(context))
+        if (CanApply(context) && parameter is OpenApiParameter openApiParameter)
        {
-            ApplyParameter(parameter, context);
+            ApplyParameter(openApiParameter, context);
        }
    }

-    protected abstract string DocumentationLink { get; }
-
    protected abstract void ApplyOperation(OpenApiOperation operation, OperationFilterContext context);

    protected abstract void ApplyParameter(OpenApiParameter parameter, ParameterFilterContext context);

-    protected void AddQueryParameterDocumentation(OpenApiParameter parameter, Dictionary<string, OpenApiExample> examples, string description)
+    protected void AddQueryParameterDocumentation(OpenApiParameter parameter, Dictionary<string, IOpenApiExample> examples, string description)
    {
        parameter.Description = QueryParameterDescription(description);
        parameter.Examples = examples;
@@ -60,15 +60,19 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
        AddFields(operation);
    }

-    protected void AddApiKey(OpenApiOperation operation) =>
-        operation.Parameters.Add(new OpenApiParameter
-        {
-            Name = Core.Constants.DeliveryApi.HeaderNames.ApiKey,
-            In = ParameterLocation.Header,
-            Required = false,
-            Description = "API key specified through configuration to authorize access to the API.",
-            Schema = new OpenApiSchema { Type = "string" }
-        });
+    protected void AddApiKey(OpenApiOperation operation)
+    {
+        operation.Parameters ??= new List<IOpenApiParameter>();
+        operation.Parameters.Add(
+            new OpenApiParameter
+            {
+                Name = Constants.DeliveryApi.HeaderNames.ApiKey,
+                In = ParameterLocation.Header,
+                Required = false,
+                Description = "API key specified through configuration to authorize access to the API.",
+                Schema = new OpenApiSchema { Type = JsonSchemaType.String },
+            });
+    }

    protected string PaginationDescription(bool skip, string itemType)
        => $"Specifies the number of found {itemType} items to {(skip ? "skip" : "take")}. Use this to control pagination of the response.";
@@ -82,78 +86,70 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>

    // FIXME: remove this when Delivery API V1 has been removed (expectedly in V15)
    private void AddExpandV1(OpenApiOperation operation)
-        => operation.Parameters.Add(new OpenApiParameter
-        {
-            Name = "expand",
-            In = ParameterLocation.Query,
-            Required = false,
-            Description = QueryParameterDescription("Defines the properties that should be expanded in the response"),
-            Schema = new OpenApiSchema { Type = "string" },
-            Examples = new Dictionary<string, OpenApiExample>
+    {
+        operation.Parameters ??= new List<IOpenApiParameter>();
+        operation.Parameters.Add(
+            new OpenApiParameter
            {
-                { "Expand none", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
-                { "Expand all", new OpenApiExample { Value = new OpenApiString("all") } },
+                Name = "expand",
+                In = ParameterLocation.Query,
+                Required = false,
+                Description =
+                    QueryParameterDescription("Defines the properties that should be expanded in the response"),
+                Schema = new OpenApiSchema { Type = JsonSchemaType.String },
+                Examples = new Dictionary<string, IOpenApiExample>
                {
-                    "Expand specific property",
-                    new OpenApiExample { Value = new OpenApiString("property:alias1") }
+                    { "Expand none", new OpenApiExample { Value = string.Empty } },
+                    { "Expand all", new OpenApiExample { Value = "all" } },
+                    { "Expand specific property", new OpenApiExample { Value = "property:alias1" } },
+                    { "Expand specific properties", new OpenApiExample { Value = "property:alias1,alias2" } },
                },
-                {
-                    "Expand specific properties",
-                    new OpenApiExample { Value = new OpenApiString("property:alias1,alias2") }
-                }
-            }
-        });
+            });
+    }

    private void AddExpand(OpenApiOperation operation)
-        => operation.Parameters.Add(new OpenApiParameter
-        {
-            Name = "expand",
-            In = ParameterLocation.Query,
-            Required = false,
-            Description = QueryParameterDescription("Defines the properties that should be expanded in the response"),
-            Schema = new OpenApiSchema { Type = "string" },
-            Examples = new Dictionary<string, OpenApiExample>
+    {
+        operation.Parameters ??= new List<IOpenApiParameter>();
+        operation.Parameters.Add(
+            new OpenApiParameter
            {
-                { "Expand none", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
-                { "Expand all properties", new OpenApiExample { Value = new OpenApiString("properties[$all]") } },
+                Name = "expand",
+                In = ParameterLocation.Query,
+                Required = false,
+                Description =
+                    QueryParameterDescription("Defines the properties that should be expanded in the response"),
+                Schema = new OpenApiSchema { Type = JsonSchemaType.String },
+                Examples = new Dictionary<string, IOpenApiExample>
                {
-                    "Expand specific property",
-                    new OpenApiExample { Value = new OpenApiString("properties[alias1]") }
+                    { "Expand none", new OpenApiExample { Value = string.Empty } },
+                    { "Expand all properties", new OpenApiExample { Value = "properties[$all]" } },
+                    { "Expand specific property", new OpenApiExample { Value = "properties[alias1]" } },
+                    { "Expand specific properties", new OpenApiExample { Value = "properties[alias1,alias2]" } },
+                    { "Expand nested properties", new OpenApiExample { Value = "properties[alias1[properties[nestedAlias1,nestedAlias2]]]" } },
                },
-                {
-                    "Expand specific properties",
-                    new OpenApiExample { Value = new OpenApiString("properties[alias1,alias2]") }
-                },
-                {
-                    "Expand nested properties",
-                    new OpenApiExample { Value = new OpenApiString("properties[alias1[properties[nestedAlias1,nestedAlias2]]]") }
-                }
-            }
-        });
+            });
+    }

    private void AddFields(OpenApiOperation operation)
-        => operation.Parameters.Add(new OpenApiParameter
-        {
-            Name = "fields",
-            In = ParameterLocation.Query,
-            Required = false,
-            Description = QueryParameterDescription("Explicitly defines which properties should be included in the response (by default all properties are included)"),
-            Schema = new OpenApiSchema { Type = "string" },
-            Examples = new Dictionary<string, OpenApiExample>
+    {
+        operation.Parameters ??= new List<IOpenApiParameter>();
+        operation.Parameters.Add(
+            new OpenApiParameter
            {
-                { "Include all properties", new OpenApiExample { Value = new OpenApiString("properties[$all]") } },
+                Name = "fields",
+                In = ParameterLocation.Query,
+                Required = false,
+                Description =
+                    QueryParameterDescription(
+                        "Explicitly defines which properties should be included in the response (by default all properties are included)"),
+                Schema = new OpenApiSchema { Type = JsonSchemaType.String },
+                Examples = new Dictionary<string, IOpenApiExample>
                {
-                    "Include only specific property",
-                    new OpenApiExample { Value = new OpenApiString("properties[alias1]") }
+                    { "Include all properties", new OpenApiExample { Value = "properties[$all]" } },
+                    { "Include only specific property", new OpenApiExample { Value = "properties[alias1]" } },
+                    { "Include only specific properties", new OpenApiExample { Value = "properties[alias1,alias2]" } },
+                    { "Include only specific nested properties", new OpenApiExample { Value = "properties[alias1[properties[nestedAlias1,nestedAlias2]]]" } },
                },
-                {
-                    "Include only specific properties",
-                    new OpenApiExample { Value = new OpenApiString("properties[alias1,alias2]") }
-                },
-                {
-                    "Include only specific nested properties",
-                    new OpenApiExample { Value = new OpenApiString("properties[alias1[properties[nestedAlias1,nestedAlias2]]]") }
-                }
-            }
-        });
+            });
+    }
 }
@@ -1,8 +1,7 @@
-using Microsoft.OpenApi.Any;
-using Microsoft.OpenApi.Models;
+using System.Text.Json.Nodes;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Delivery.Configuration;
-using Umbraco.Cms.Api.Delivery.Controllers;
 using Umbraco.Cms.Api.Delivery.Controllers.Media;

 namespace Umbraco.Cms.Api.Delivery.Filters;
@@ -13,7 +12,7 @@ internal sealed class SwaggerMediaDocumentationFilter : SwaggerDocumentationFilt

    protected override void ApplyOperation(OpenApiOperation operation, OperationFilterContext context)
    {
-        operation.Parameters ??= new List<OpenApiParameter>();
+        operation.Parameters ??= new List<IOpenApiParameter>();

        AddExpand(operation, context);

@@ -46,77 +45,29 @@ internal sealed class SwaggerMediaDocumentationFilter : SwaggerDocumentationFilt
        }
    }

-    private Dictionary<string, OpenApiExample> FetchQueryParameterExamples() =>
+    private Dictionary<string, IOpenApiExample> FetchQueryParameterExamples() =>
        new()
        {
-            {
-                "Select all children at root level",
-                new OpenApiExample { Value = new OpenApiString("children:/") }
-            },
-            {
-                "Select all children of a media item by id",
-                new OpenApiExample { Value = new OpenApiString("children:id") }
-            },
-            {
-                "Select all children of a media item by path",
-                new OpenApiExample { Value = new OpenApiString("children:path") }
-            }
+            { "Select all children at root level", new OpenApiExample { Value = "children:/" } },
+            { "Select all children of a media item by id", new OpenApiExample { Value = "children:id" } },
+            { "Select all children of a media item by path", new OpenApiExample { Value = "children:path" } },
        };

-    private Dictionary<string, OpenApiExample> FilterQueryParameterExamples() =>
+    private Dictionary<string, IOpenApiExample> FilterQueryParameterExamples() =>
        new()
        {
-            { "Default filter", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
-            {
-                "Filter by media type",
-                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("mediaType:alias1") } }
-            },
-            {
-                "Filter by name",
-                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("name:nodeName") } }
-            }
+            { "Default filter", new OpenApiExample { Value = string.Empty } },
+            { "Filter by media type", new OpenApiExample { Value = new JsonArray { "mediaType:alias1" } } },
+            { "Filter by name", new OpenApiExample { Value = new JsonArray { "name:nodeName" } } },
        };

-    private Dictionary<string, OpenApiExample> SortQueryParameterExamples() =>
+    private Dictionary<string, IOpenApiExample> SortQueryParameterExamples() =>
        new()
        {
-            { "Default sort", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
-            {
-                "Sort by create date",
-                new OpenApiExample
-                {
-                    Value = new OpenApiArray
-                    {
-                        new OpenApiString("createDate:asc"), new OpenApiString("createDate:desc")
-                    }
-                }
-            },
-            {
-                "Sort by name",
-                new OpenApiExample
-                {
-                    Value = new OpenApiArray { new OpenApiString("name:asc"), new OpenApiString("name:desc") }
-                }
-            },
-            {
-                "Sort by sort order",
-                new OpenApiExample
-                {
-                    Value = new OpenApiArray
-                    {
-                        new OpenApiString("sortOrder:asc"), new OpenApiString("sortOrder:desc")
-                    }
-                }
-            },
-            {
-                "Sort by update date",
-                new OpenApiExample
-                {
-                    Value = new OpenApiArray
-                    {
-                        new OpenApiString("updateDate:asc"), new OpenApiString("updateDate:desc")
-                    }
-                }
-            }
+            { "Default sort", new OpenApiExample { Value = string.Empty } },
+            { "Sort by create date", new OpenApiExample { Value = new JsonArray { "createDate:asc", "createDate:desc" } } },
+            { "Sort by name", new OpenApiExample { Value = new JsonArray { "name:asc", "name:desc" } } },
+            { "Sort by sort order", new OpenApiExample { Value = new JsonArray { "sortOrder:asc", "sortOrder:desc" } } },
+            { "Sort by update date", new OpenApiExample { Value = new JsonArray { "updateDate:asc", "updateDate:desc" } } },
        };
 }
@@ -12,7 +12,7 @@ internal sealed class ValidateStartItemAttribute : TypeFilterAttribute
    {
    }

-    private class ValidateStartItemFilter : IActionFilter
+    private sealed class ValidateStartItemFilter : IActionFilter
    {
        private readonly IRequestStartItemProviderAccessor _requestStartItemProviderAccessor;

@@ -7,6 +7,7 @@ using Umbraco.Cms.Core.Events;
 using Umbraco.Cms.Core.Notifications;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Sync;
 using Umbraco.Cms.Infrastructure.Security;

 namespace Umbraco.Cms.Api.Delivery.Handlers;
@@ -18,18 +19,24 @@ internal sealed class InitializeMemberApplicationNotificationHandler : INotifica
    private readonly DeliveryApiSettings _deliveryApiSettings;
    private readonly IServiceScopeFactory _serviceScopeFactory;
    private readonly IMemberClientCredentialsManager _memberClientCredentialsManager;
+    private readonly IServerRoleAccessor _serverRoleAccessor;
+
+    private static readonly SemaphoreSlim _locker = new(1);
+    private static bool _isInitialized = false;

    public InitializeMemberApplicationNotificationHandler(
        IRuntimeState runtimeState,
        IOptions<DeliveryApiSettings> deliveryApiSettings,
        ILogger<InitializeMemberApplicationNotificationHandler> logger,
        IServiceScopeFactory serviceScopeFactory,
-        IMemberClientCredentialsManager memberClientCredentialsManager)
+        IMemberClientCredentialsManager memberClientCredentialsManager,
+        IServerRoleAccessor serverRoleAccessor)
    {
        _runtimeState = runtimeState;
        _logger = logger;
        _serviceScopeFactory = serviceScopeFactory;
        _memberClientCredentialsManager = memberClientCredentialsManager;
+        _serverRoleAccessor = serverRoleAccessor;
        _deliveryApiSettings = deliveryApiSettings.Value;
    }

@@ -40,13 +47,34 @@ internal sealed class InitializeMemberApplicationNotificationHandler : INotifica
            return;
        }

-        // we cannot inject the IMemberApplicationManager because it ultimately takes a dependency on the DbContext ... and during
-        // install that is not allowed (no connection string means no DbContext)
-        using IServiceScope scope = _serviceScopeFactory.CreateScope();
-        IMemberApplicationManager memberApplicationManager = scope.ServiceProvider.GetRequiredService<IMemberApplicationManager>();
+        if (_serverRoleAccessor.CurrentServerRole is ServerRole.Subscriber)
+        {
+            // subscriber instances should not alter the member application
+            return;
+        }

-        await HandleMemberApplication(memberApplicationManager, cancellationToken);
-        await HandleMemberClientCredentialsApplication(memberApplicationManager, cancellationToken);
+        try
+        {
+            await _locker.WaitAsync(cancellationToken);
+            if (_isInitialized)
+            {
+                return;
+            }
+
+            // we cannot inject the IMemberApplicationManager because it ultimately takes a dependency on the DbContext ... and during
+            // install that is not allowed (no connection string means no DbContext)
+            using IServiceScope scope = _serviceScopeFactory.CreateScope();
+            IMemberApplicationManager memberApplicationManager = scope.ServiceProvider.GetRequiredService<IMemberApplicationManager>();
+
+            await HandleMemberApplication(memberApplicationManager, cancellationToken);
+            await HandleMemberClientCredentialsApplication(memberApplicationManager, cancellationToken);
+
+            _isInitialized = true;
+        }
+        finally
+        {
+            _locker.Release();
+        }
    }

    private async Task HandleMemberApplication(IMemberApplicationManager memberApplicationManager, CancellationToken cancellationToken)
@@ -1,8 +1,5 @@
-using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Cms.Core.PublishedCache;
 using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Delivery.Querying;
@@ -14,30 +11,6 @@ public abstract class QueryOptionBase
    private readonly IApiDocumentUrlService _apiDocumentUrlService;
    private readonly IVariationContextAccessor _variationContextAccessor;

-    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
-    public QueryOptionBase(
-        IPublishedContentCache publishedContentCache,
-        IRequestRoutingService requestRoutingService)
-        : this(
-            requestRoutingService,
-            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
-            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
-            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>())
-    {
-    }
-
-    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
-    public QueryOptionBase(
-        IPublishedContentCache publishedContentCache,
-        IRequestRoutingService requestRoutingService,
-        IRequestPreviewService requestPreviewService,
-        IRequestCultureService requestCultureService,
-        IApiDocumentUrlService apiDocumentUrlService,
-        IVariationContextAccessor variationContextAccessor)
-        : this(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
-    {
-    }
-
    public QueryOptionBase(
        IRequestRoutingService requestRoutingService,
        IRequestPreviewService requestPreviewService,
@@ -1,9 +1,6 @@
-using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Delivery.Indexing.Selectors;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Cms.Core.PublishedCache;
 using Umbraco.Cms.Core.Services.Navigation;

 namespace Umbraco.Cms.Api.Delivery.Querying.Selectors;
@@ -13,46 +10,6 @@ public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
    private readonly IDocumentNavigationQueryService _navigationQueryService;
    private const string AncestorsSpecifier = "ancestors:";

-    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
-    public AncestorsSelector(
-        IPublishedContentCache publishedContentCache,
-        IRequestRoutingService requestRoutingService,
-        IDocumentNavigationQueryService navigationQueryService,
-        IRequestPreviewService requestPreviewService)
-        : this(
-            requestRoutingService,
-            requestPreviewService,
-            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
-            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>(),
-            navigationQueryService)
-    {
-    }
-
-    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
-    public AncestorsSelector(
-        IPublishedContentCache publishedContentCache,
-        IRequestRoutingService requestRoutingService,
-        IDocumentNavigationQueryService navigationQueryService)
-        : this(
-            requestRoutingService,
-            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
-            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
-            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>(),
-            navigationQueryService)
-    {
-    }
-
-    [Obsolete("Use the constructor that takes all parameters. Scheduled for removal in V17.")]
-    public AncestorsSelector(IPublishedContentCache publishedContentCache, IRequestRoutingService requestRoutingService)
-        : this(
-            requestRoutingService,
-            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
-            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
-            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>(),
-            StaticServiceProvider.Instance.GetRequiredService<IDocumentNavigationQueryService>())
-    {
-    }
-
    public AncestorsSelector(
        IRequestRoutingService requestRoutingService,
        IRequestPreviewService requestPreviewService,
@@ -62,18 +19,6 @@ public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
        : base(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
        => _navigationQueryService = navigationQueryService;

-    [Obsolete("Use the constructor that takes all parameters. Scheduled for removal in V17.")]
-    public AncestorsSelector(
-        IRequestRoutingService requestRoutingService,
-        IPublishedContentCache publishedContentCache,
-        IRequestPreviewService requestPreviewService,
-        IApiDocumentUrlService apiDocumentUrlService,
-        IVariationContextAccessor variationContextAccessor,
-        IDocumentNavigationQueryService navigationQueryService)
-        : this(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor, navigationQueryService)
-    {
-    }
-
    /// <inheritdoc />
    public bool CanHandle(string query)
        => query.StartsWith(AncestorsSpecifier, StringComparison.OrdinalIgnoreCase);
@@ -12,27 +12,6 @@ public sealed class ChildrenSelector : QueryOptionBase, ISelectorHandler
 {
    private const string ChildrenSpecifier = "children:";

-    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
-    public ChildrenSelector(IPublishedContentCache publishedContentCache, IRequestRoutingService requestRoutingService)
-        : this(
-            requestRoutingService,
-            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
-            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
-            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>())
-    {
-    }
-
-    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
-    public ChildrenSelector(
-        IPublishedContentCache publishedContentCache,
-        IRequestRoutingService requestRoutingService,
-        IRequestPreviewService requestPreviewService,
-        IApiDocumentUrlService apiDocumentUrlService,
-        IVariationContextAccessor variationContextAccessor)
-        : this(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
-    {
-    }
-
    public ChildrenSelector(
        IRequestRoutingService requestRoutingService,
        IRequestPreviewService requestPreviewService,
@@ -12,27 +12,6 @@ public sealed class DescendantsSelector : QueryOptionBase, ISelectorHandler
 {
    private const string DescendantsSpecifier = "descendants:";

-    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
-    public DescendantsSelector(IPublishedContentCache publishedContentCache, IRequestRoutingService requestRoutingService)
-        : this(
-            requestRoutingService,
-            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
-            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
-            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>())
-    {
-    }
-
-    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
-    public DescendantsSelector(
-        IPublishedContentCache publishedContentCache,
-        IRequestRoutingService requestRoutingService,
-        IRequestPreviewService requestPreviewService,
-        IApiDocumentUrlService apiDocumentUrlService,
-        IVariationContextAccessor variationContextAccessor)
-        : this(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
-    {
-    }
-
    public DescendantsSelector(
        IRequestRoutingService requestRoutingService,
        IRequestPreviewService requestPreviewService,
@@ -1,62 +1,25 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Logging;
+using Umbraco.Cms.Api.Common.Rendering;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Delivery.Rendering;

-internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansionStrategy
+internal sealed class RequestContextOutputExpansionStrategyV2 : ElementOnlyOutputExpansionStrategy, IOutputExpansionStrategy
 {
-    private const string All = "$all";
-    private const string None = "";
-    private const string ExpandParameterName = "expand";
-    private const string FieldsParameterName = "fields";
-
-    private readonly IApiPropertyRenderer _propertyRenderer;
    private readonly ILogger<RequestContextOutputExpansionStrategyV2> _logger;

-    private readonly Stack<Node?> _expandProperties;
-    private readonly Stack<Node?> _includeProperties;
-
    public RequestContextOutputExpansionStrategyV2(
        IHttpContextAccessor httpContextAccessor,
        IApiPropertyRenderer propertyRenderer,
        ILogger<RequestContextOutputExpansionStrategyV2> logger)
+        : base(propertyRenderer)
    {
-        _propertyRenderer = propertyRenderer;
        _logger = logger;
-        _expandProperties = new Stack<Node?>();
-        _includeProperties = new Stack<Node?>();

        InitializeExpandAndInclude(httpContextAccessor);
    }

-    public IDictionary<string, object?> MapContentProperties(IPublishedContent content)
-        => content.ItemType == PublishedItemType.Content
-            ? MapProperties(content.Properties)
-            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");
-
-    public IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
-    {
-        if (media.ItemType != PublishedItemType.Media)
-        {
-            throw new ArgumentException($"Invalid item type. This method can only be used with item type {PublishedItemType.Media}, got: {media.ItemType}");
-        }
-
-        IPublishedProperty[] properties = media
-            .Properties
-            .Where(p => skipUmbracoProperties is false || p.Alias.StartsWith("umbraco") is false)
-            .ToArray();
-
-        return properties.Any()
-            ? MapProperties(properties)
-            : new Dictionary<string, object?>();
-    }
-
-    public IDictionary<string, object?> MapElementProperties(IPublishedElement element)
-        => MapProperties(element.Properties, true);
-
    private void InitializeExpandAndInclude(IHttpContextAccessor httpContextAccessor)
    {
        string? QueryValue(string key) => httpContextAccessor.HttpContext?.Request.Query[key];
@@ -66,7 +29,7 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion

        try
        {
-            _expandProperties.Push(Node.Parse(toExpand));
+            ExpandProperties.Push(Node.Parse(toExpand));
        }
        catch (ArgumentException ex)
        {
@@ -76,7 +39,7 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion

        try
        {
-            _includeProperties.Push(Node.Parse(toInclude));
+            IncludeProperties.Push(Node.Parse(toInclude));
        }
        catch (ArgumentException ex)
        {
@@ -84,102 +47,4 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion
            throw new ArgumentException($"Could not parse the '{FieldsParameterName}' parameter: {ex.Message}");
        }
    }
-
-    private IDictionary<string, object?> MapProperties(IEnumerable<IPublishedProperty> properties, bool forceExpandProperties = false)
-    {
-        Node? currentExpandProperties = _expandProperties.Peek();
-        if (_expandProperties.Count > 1 && currentExpandProperties is null && forceExpandProperties is false)
-        {
-            return new Dictionary<string, object?>();
-        }
-
-        Node? currentIncludeProperties = _includeProperties.Peek();
-        var result = new Dictionary<string, object?>();
-        foreach (IPublishedProperty property in properties)
-        {
-            Node? nextIncludeProperties = GetNextProperties(currentIncludeProperties, property.Alias);
-            if (currentIncludeProperties is not null && currentIncludeProperties.Items.Any() && nextIncludeProperties is null)
-            {
-                continue;
-            }
-
-            Node? nextExpandProperties = GetNextProperties(currentExpandProperties, property.Alias);
-
-            _includeProperties.Push(nextIncludeProperties);
-            _expandProperties.Push(nextExpandProperties);
-
-            result[property.Alias] = GetPropertyValue(property);
-
-            _expandProperties.Pop();
-            _includeProperties.Pop();
-        }
-
-        return result;
-    }
-
-    private Node? GetNextProperties(Node? currentProperties, string propertyAlias)
-        => currentProperties?.Items.FirstOrDefault(i => i.Key == All)
-           ?? currentProperties?.Items.FirstOrDefault(i => i.Key == "properties")?.Items.FirstOrDefault(i => i.Key == All || i.Key == propertyAlias);
-
-    private object? GetPropertyValue(IPublishedProperty property)
-        => _propertyRenderer.GetPropertyValue(property, _expandProperties.Peek() is not null);
-
-    private class Node
-    {
-        public string Key { get; private set; } = string.Empty;
-
-        public List<Node> Items { get; } = new();
-
-        public static Node Parse(string value)
-        {
-            // verify that there are as many start brackets as there are end brackets
-            if (value.CountOccurrences("[") != value.CountOccurrences("]"))
-            {
-                throw new ArgumentException("Value did not contain an equal number of start and end brackets");
-            }
-
-            // verify that the value does not start with a start bracket
-            if (value.StartsWith("["))
-            {
-                throw new ArgumentException("Value cannot start with a bracket");
-            }
-
-            // verify that there are no empty brackets
-            if (value.Contains("[]"))
-            {
-                throw new ArgumentException("Value cannot contain empty brackets");
-            }
-
-            var stack = new Stack<Node>();
-            var root = new Node { Key = "root" };
-            stack.Push(root);
-
-            var currentNode = new Node();
-            root.Items.Add(currentNode);
-
-            foreach (char c in value)
-            {
-                switch (c)
-                {
-                    case '[': // Start a new node, child of the current node
-                        stack.Push(currentNode);
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ',': // Start a new node, but at the same level of the current node
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ']': // Back to parent of the current node
-                        currentNode = stack.Pop();
-                        break;
-                    default: // Add char to current node key
-                        currentNode.Key += c;
-                        break;
-                }
-            }
-
-            return root;
-        }
-    }
 }
@@ -66,9 +66,14 @@ internal sealed class DeliveryApiItemsEndpointsMatcherPolicy : MatcherPolicy, IE
    {
        ApiVersion[]? supportedApiVersions = endpoint.Metadata.GetMetadata<MapToApiVersionAttribute>()?.Versions.ToArray();

-        // if the endpoint is versioned, the requested API version must be among the API versions supported by the endpoint.
-        // if the endpoint is NOT versioned, it cannot be used with a requested API version
-        return supportedApiVersions?.Contains(requestedApiVersion) ?? requestedApiVersion is null;
+        // If the endpoint is versioned, the requested API version must be among the API versions supported by the endpoint.
+        // If the endpoint is NOT versioned, it cannot be used with a requested API version.
+        if (supportedApiVersions is not null && requestedApiVersion is not null)
+        {
+            return supportedApiVersions.Contains(requestedApiVersion);
+        }
+
+        return requestedApiVersion is null;
    }

    private static bool IsByIdsController(ControllerActionDescriptor? controllerActionDescriptor)
@@ -66,7 +66,7 @@ internal sealed class ApiMediaQueryService : IApiMediaQueryService
    private IPublishedContent? TryGetByPath(string path, IPublishedMediaCache mediaCache)
    {
        var segments = path.Split(Constants.CharArrays.ForwardSlash, StringSplitOptions.RemoveEmptyEntries);
-        IEnumerable<IPublishedContent> currentChildren = mediaCache.GetAtRoot();
+        IEnumerable<IPublishedContent> currentChildren = GetRootContent(mediaCache);
        IPublishedContent? resolvedMedia = null;

        foreach (var segment in segments)
@@ -103,7 +103,7 @@ internal sealed class ApiMediaQueryService : IApiMediaQueryService
        IPublishedMediaCache mediaCache = GetRequiredPublishedMediaCache();
        if (childrenOf.Trim(Constants.CharArrays.ForwardSlash).Length == 0)
        {
-            return mediaCache.GetAtRoot();
+            return GetRootContent(mediaCache);
        }

        IPublishedContent? parent = Guid.TryParse(childrenOf, out Guid parentKey)
@@ -196,4 +196,8 @@ internal sealed class ApiMediaQueryService : IApiMediaQueryService

        return Attempt.SucceedWithStatus(ApiMediaQueryOperationStatus.Success, result);
    }
+
+    private IEnumerable<IPublishedContent> GetRootContent(IPublishedMediaCache mediaCache)
+        => _mediaNavigationQueryService.TryGetRootKeys(out IEnumerable<Guid> rootKeys) is false ? []
+            : rootKeys.Select(x => mediaCache.GetById(false, x)).WhereNotNull();
 }
@@ -19,12 +19,6 @@ internal sealed partial class RequestCultureService : RequestHeaderHandler, IReq
        return ValidLanguageHeaderRegex().IsMatch(acceptLanguage) ? acceptLanguage : null;
    }

-    [Obsolete("Use IVariationContextAccessor to manipulate the variation context. Scheduled for removal in V17.")]
-    public void SetRequestCulture(string culture)
-    {
-        // no-op
-    }
-
    // at the time of writing we're introducing this to get rid of accept-language header values like "en-GB,en-US;q=0.9,en;q=0.8",
    // so we don't want to be too restrictive in this regex - keep it simple for now.
    [GeneratedRegex(@"^[\w-]*$")]
@@ -3,7 +3,7 @@ using Umbraco.Cms.Core.DeliveryApi;

 namespace Umbraco.Cms.Api.Delivery.Services;

-internal sealed class RequestSegmentService : RequestHeaderHandler, IRequestSegmmentService
+internal sealed class RequestSegmentService : RequestHeaderHandler, IRequestSegmentService, IRequestSegmmentService
 {
    public RequestSegmentService(IHttpContextAccessor httpContextAccessor)
        : base(httpContextAccessor)
@@ -1,9 +1,9 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <Title>Umbraco CMS - Delivery API</Title>
    <Description>Contains the presentation layer for the Umbraco CMS Delivery API.</Description>
  </PropertyGroup>
-  
+
  <PropertyGroup>
    <!--
      TODO: Fix and remove overrides:
@@ -12,12 +12,18 @@
    -->
    <WarningsNotAsErrors>$(WarningsNotAsErrors),ASP0019,CS0618,CS0612</WarningsNotAsErrors>
  </PropertyGroup>
-  
+
  <ItemGroup>
    <ProjectReference Include="..\Umbraco.Cms.Api.Common\Umbraco.Cms.Api.Common.csproj" />
    <ProjectReference Include="..\Umbraco.Web.Common\Umbraco.Web.Common.csproj" />
  </ItemGroup>

+  <ItemGroup>
+    <PackageReference Include="System.Linq.Async">
+      <ExcludeAssets>compile</ExcludeAssets>
+    </PackageReference>
+  </ItemGroup>
+
  <ItemGroup>
    <AssemblyAttribute Include="System.Runtime.CompilerServices.InternalsVisibleTo">
      <_Parameter1>Umbraco.Tests.UnitTests</_Parameter1>
@@ -5,6 +5,7 @@ using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
+using Microsoft.Net.Http.Headers;
 using Umbraco.Cms.Api.Management.Security;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
@@ -219,10 +220,44 @@ public class ConfigureBackOfficeCookieOptions : IConfigureNamedOptions<CookieAut
                }

                return Task.CompletedTask;
-            }
+            },
+            // FIXME: We want to change this over to using an attribute on the backoffice controllers
+            // See this for more: https://github.com/dotnet/aspnetcore/issues/63093#issuecomment-3201530217
+            OnRedirectToLogin = context =>
+            {
+                if (IsXhr(context.Request))
+                {
+                    context.Response.Headers.Location = context.RedirectUri;
+                    context.Response.StatusCode = 401;
+                }
+                else
+                {
+                    context.Response.Redirect(context.RedirectUri);
+                }
+
+                return Task.CompletedTask;
+            },
+            OnRedirectToAccessDenied = context =>
+            {
+                if (IsXhr(context.Request))
+                {
+                    context.Response.Headers.Location = context.RedirectUri;
+                    context.Response.StatusCode = 403;
+                }
+                else
+                {
+                    context.Response.Redirect(context.RedirectUri);
+                }
+
+                return Task.CompletedTask;
+            },
        };
    }

+    private bool IsXhr(HttpRequest request) =>
+        string.Equals(request.Query[HeaderNames.XRequestedWith], "XMLHttpRequest", StringComparison.Ordinal) ||
+        string.Equals(request.Headers.XRequestedWith, "XMLHttpRequest", StringComparison.Ordinal);
+
    /// <summary>
    ///     Ensures the ticket is renewed if the <see cref="SecuritySettings.KeepUserLoggedIn" /> is set to true
    ///     and the current request is for the get user seconds endpoint
@@ -1,8 +1,8 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi.Models;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
-using Umbraco.Cms.Api.Common.OpenApi;
+using Umbraco.Cms.Api.Common.Security;
 using Umbraco.Cms.Api.Common.Serialization;
 using Umbraco.Cms.Api.Management.DependencyInjection;
 using Umbraco.Cms.Api.Management.OpenApi;
@@ -11,7 +11,7 @@ namespace Umbraco.Cms.Api.Management.Configuration;

 public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
 {
-    private IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;
+    private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;

    public ConfigureUmbracoManagementApiSwaggerGenOptions(IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
    {
@@ -20,7 +20,6 @@ public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<

    public void Configure(SwaggerGenOptions swaggerGenOptions)
    {
-
        swaggerGenOptions.SwaggerDoc(
            ManagementApiConfiguration.ApiName,
            new OpenApiInfo
@@ -51,10 +50,10 @@ public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<
                     AuthorizationCode = new OpenApiOAuthFlow
                     {
                         AuthorizationUrl =
-                             new Uri(Common.Security.Paths.BackOfficeApi.AuthorizationEndpoint, UriKind.Relative),
-                         TokenUrl = new Uri(Common.Security.Paths.BackOfficeApi.TokenEndpoint, UriKind.Relative)
-                     }
-                 }
+                             new Uri(Paths.BackOfficeApi.AuthorizationEndpoint, UriKind.Relative),
+                         TokenUrl = new Uri(Paths.BackOfficeApi.TokenEndpoint, UriKind.Relative),
+                     },
+                 },
             });

        // Sets Security requirement on backoffice apis
@@ -1,7 +1,10 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Content;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.ContentEditing;
@@ -18,36 +21,17 @@ public abstract class ContentCollectionControllerBase<TContent, TCollectionRespo
    where TVariantResponseModel : VariantResponseModelBase
 {
    private readonly IUmbracoMapper _mapper;
+    private readonly FlagProviderCollection _flagProviders;

-    protected ContentCollectionControllerBase(IUmbracoMapper mapper) => _mapper = mapper;
-
-    [Obsolete("This method is no longer used and will be removed in Umbraco 17.")]
-    protected IActionResult CollectionResult(ListViewPagedModel<TContent> result)
+    protected ContentCollectionControllerBase(IUmbracoMapper mapper, FlagProviderCollection flagProvider)
    {
-        PagedModel<TContent> collectionItemsResult = result.Items;
-        ListViewConfiguration collectionConfiguration = result.ListViewConfiguration;
-
-        var collectionPropertyAliases = collectionConfiguration
-            .IncludeProperties
-            .Select(p => p.Alias)
-            .WhereNotNull()
-            .ToArray();
-
-        List<TCollectionResponseModel> collectionResponseModels =
-            _mapper.MapEnumerable<TContent, TCollectionResponseModel>(collectionItemsResult.Items, context =>
-            {
-                context.SetIncludedProperties(collectionPropertyAliases);
-            });
-
-        var pageViewModel = new PagedViewModel<TCollectionResponseModel>
-        {
-            Items = collectionResponseModels,
-            Total = collectionItemsResult.Total,
-        };
-
-        return Ok(pageViewModel);
+        _mapper = mapper;
+        _flagProviders = flagProvider;
    }

+    /// <summary>
+    /// Creates a collection result from the provided collection response models and total number of items.
+    /// </summary>
    protected IActionResult CollectionResult(List<TCollectionResponseModel> collectionResponseModels, long totalNumberOfItems)
    {
        var pageViewModel = new PagedViewModel<TCollectionResponseModel>
@@ -1,40 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Factories;
-using Umbraco.Cms.Api.Management.ViewModels.DataType;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType;
-
-[ApiVersion("1.0")]
-[Obsolete("Please use ReferencedByDataTypeController and the referenced-by endpoint. Scheduled for removal in Umbraco 17.")]
-public class ReferencesDataTypeController : DataTypeControllerBase
-{
-    private readonly IDataTypeService _dataTypeService;
-    private readonly IDataTypeReferencePresentationFactory _dataTypeReferencePresentationFactory;
-
-    public ReferencesDataTypeController(IDataTypeService dataTypeService, IDataTypeReferencePresentationFactory dataTypeReferencePresentationFactory)
-    {
-        _dataTypeService = dataTypeService;
-        _dataTypeReferencePresentationFactory = dataTypeReferencePresentationFactory;
-    }
-
-    [HttpGet("{id:guid}/references")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(DataTypeReferenceResponseModel[]), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> References(CancellationToken cancellationToken, Guid id)
-    {
-        Attempt<IReadOnlyDictionary<Udi, IEnumerable<string>>, DataTypeOperationStatus> result = await _dataTypeService.GetReferencesAsync(id);
-        if (result.Success == false)
-        {
-            return DataTypeOperationStatusResult(result.Status);
-        }
-
-        DataTypeReferenceResponseModel[] viewModels = _dataTypeReferencePresentationFactory.CreateDataTypeReferenceViewModels(result.Result).ToArray();
-        return Ok(viewModels);
-    }
-}
@@ -1,6 +1,8 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;

@@ -9,11 +11,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
 [ApiVersion("1.0")]
 public class AncestorsDataTypeTreeController : DataTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public AncestorsDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
        : base(entityService, dataTypeService)
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public AncestorsDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
+    : base(entityService, flagProviders, dataTypeService)
+    {
+    }
+
    [HttpGet("ancestors")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(IEnumerable<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -1,20 +1,29 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.Flags;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;

 [ApiVersion("1.0")]
 public class ChildrenDataTypeTreeController : DataTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public ChildrenDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
        : base(entityService, dataTypeService)
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public ChildrenDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
+        : base(entityService, flagProviders, dataTypeService)
+    {
+    }
+
    [HttpGet("children")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -1,9 +1,12 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Services;
@@ -19,8 +22,17 @@ public class DataTypeTreeControllerBase : FolderTreeControllerBase<DataTypeTreeI
 {
    private readonly IDataTypeService _dataTypeService;

+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public DataTypeTreeControllerBase(IEntityService entityService, IDataTypeService dataTypeService)
-        : base(entityService) =>
+        : this(
+              entityService,
+              StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>(),
+              dataTypeService)
+    {
+    }
+
+    public DataTypeTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
+        : base(entityService, flagProviders) =>
        _dataTypeService = dataTypeService;

    protected override UmbracoObjectTypes ItemObjectType => UmbracoObjectTypes.DataType;
@@ -1,21 +1,29 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.ViewModels.DataType.Item;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.Flags;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;

 [ApiVersion("1.0")]
 public class RootDataTypeTreeController : DataTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public RootDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
        : base(entityService, dataTypeService)
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public RootDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
+    : base(entityService, flagProviders, dataTypeService)
+    {
+    }
+
    [HttpGet("root")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -1,5 +1,8 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;

@@ -7,13 +10,23 @@ namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;

 public class SiblingsDataTypeTreeController : DataTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public SiblingsDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
        : base(entityService, dataTypeService)
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public SiblingsDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
+        : base(entityService, flagProviders, dataTypeService)
+    {
+    }
+
    [HttpGet("siblings")]
-    [ProducesResponseType(typeof(IEnumerable<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
-    public Task<ActionResult<IEnumerable<DataTypeTreeItemResponseModel>>> Siblings(CancellationToken cancellationToken, Guid target, int before, int after)
-        => GetSiblings(target, before, after);
+    [ProducesResponseType(typeof(SubsetViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SubsetViewModel<DataTypeTreeItemResponseModel>>> Siblings(CancellationToken cancellationToken, Guid target, int before, int after, bool foldersOnly = false)
+    {
+        RenderFoldersOnly(foldersOnly);
+        return await GetSiblings(target, before, after);
+    }
 }
@@ -1,6 +1,8 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;

@@ -9,11 +11,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;
 [ApiVersion("1.0")]
 public class AncestorsDictionaryTreeController : DictionaryTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public AncestorsDictionaryTreeController(IEntityService entityService, IDictionaryItemService dictionaryItemService)
        : base(entityService, dictionaryItemService)
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public AncestorsDictionaryTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDictionaryItemService dictionaryItemService)
+        : base(entityService, flagProviders, dictionaryItemService)
+    {
+    }
+
    [HttpGet("ancestors")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(IEnumerable<NamedEntityTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -1,21 +1,30 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;

 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;

 [ApiVersion("1.0")]
 public class ChildrenDictionaryTreeController : DictionaryTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public ChildrenDictionaryTreeController(IEntityService entityService, IDictionaryItemService dictionaryItemService)
        : base(entityService, dictionaryItemService)
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public ChildrenDictionaryTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDictionaryItemService dictionaryItemService)
+        : base(entityService, flagProviders, dictionaryItemService)
+    {
+    }
+
    [HttpGet("children")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<NamedEntityTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -1,10 +1,13 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Web.Common.Authorization;
@@ -18,8 +21,17 @@ namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;
 // tree controller base. We'll keep it though, in the hope that we can mend EntityService.
 public class DictionaryTreeControllerBase : NamedEntityTreeControllerBase<NamedEntityTreeItemResponseModel>
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public DictionaryTreeControllerBase(IEntityService entityService, IDictionaryItemService dictionaryItemService)
-        : base(entityService) =>
+        : this(
+              entityService,
+              StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>(),
+              dictionaryItemService)
+    {
+    }
+
+    public DictionaryTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders, IDictionaryItemService dictionaryItemService)
+        : base(entityService, flagProviders) =>
        DictionaryItemService = dictionaryItemService;

    // dictionary items do not currently have a known UmbracoObjectType, so we'll settle with Unknown for now
@@ -1,10 +1,12 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;

 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;

@@ -16,6 +18,12 @@ public class RootDictionaryTreeController : DictionaryTreeControllerBase
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public RootDictionaryTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDictionaryItemService dictionaryItemService)
+        : base(entityService, flagProviders, dictionaryItemService)
+    {
+    }
+
    [HttpGet("root")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<NamedEntityTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -0,0 +1,85 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.ViewModels.Segment;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.Mapping;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Document;
+
+[Obsolete("This controller is temporary and will be removed in a future release (planned for v20). A more permanent solution will follow.")]
+[ApiVersion("1.0")]
+public class AvailableSegmentsController : DocumentControllerBase
+{
+    private readonly IAuthorizationService _authorizationService;
+    private readonly ISegmentService _segmentService;
+    private readonly IUmbracoMapper _umbracoMapper;
+
+    public AvailableSegmentsController(
+        IAuthorizationService authorizationService,
+        ISegmentService segmentService,
+        IUmbracoMapper umbracoMapper)
+    {
+        _authorizationService = authorizationService;
+        _segmentService = segmentService;
+        _umbracoMapper = umbracoMapper;
+    }
+
+    [HttpGet("{id:guid}/available-segment-options")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<SegmentResponseModel>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    public async Task<IActionResult> GetAvailableSegmentOptions(
+        Guid id,
+        CancellationToken cancellationToken,
+        int skip = 0,
+        int take = 100)
+    {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ContentPermissionResource.WithKeys(ActionBrowse.ActionLetter, id),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
+        Attempt<PagedModel<Core.Models.Segment>?, SegmentOperationStatus> pagedAttempt =
+            await _segmentService.GetPagedSegmentsForDocumentAsync(id, skip, take);
+
+        if (pagedAttempt.Success is false)
+        {
+            return MapFailure(pagedAttempt.Status);
+        }
+
+        var viewModel = new PagedViewModel<SegmentResponseModel>
+        {
+            Items = _umbracoMapper.MapEnumerable<Core.Models.Segment, SegmentResponseModel>(pagedAttempt.Result!.Items),
+            Total = pagedAttempt.Result!.Total,
+        };
+
+        return Ok(viewModel);
+    }
+
+    private IActionResult MapFailure(SegmentOperationStatus status)
+        => OperationStatusResult(
+            status,
+            problemDetailsBuilder => status switch
+            {
+                _ => StatusCode(
+                    StatusCodes.Status500InternalServerError,
+                    problemDetailsBuilder
+                        .WithTitle("Unknown segment operation status.")
+                        .Build()),
+            });
+}
@@ -2,13 +2,10 @@ using Asp.Versioning;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.Document;
 using Umbraco.Cms.Core.Actions;
-using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Security.Authorization;
-using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Services.Querying;
 using Umbraco.Cms.Web.Common.Authorization;
 using Umbraco.Extensions;
@@ -22,31 +19,6 @@ public class ByKeyDocumentController : DocumentControllerBase
    private readonly IDocumentPresentationFactory _documentPresentationFactory;
    private readonly IContentQueryService _contentQueryService;

-    [Obsolete("Scheduled for removal in v17")]
-    public ByKeyDocumentController(
-        IAuthorizationService authorizationService,
-        IContentEditingService contentEditingService,
-        IDocumentPresentationFactory documentPresentationFactory)
-    {
-        _authorizationService = authorizationService;
-        _documentPresentationFactory = documentPresentationFactory;
-        _contentQueryService = StaticServiceProvider.Instance.GetRequiredService<IContentQueryService>();
-    }
-
-    // needed for greedy selection until other constructor remains in v17
-    [Obsolete("Scheduled for removal in v17")]
-    public ByKeyDocumentController(
-        IAuthorizationService authorizationService,
-        IContentEditingService contentEditingService,
-        IDocumentPresentationFactory documentPresentationFactory,
-        IContentQueryService contentQueryService)
-    {
-        _authorizationService = authorizationService;
-        _documentPresentationFactory = documentPresentationFactory;
-        _contentQueryService = contentQueryService;
-    }
-
-    [ActivatorUtilitiesConstructor]
    public ByKeyDocumentController(
        IAuthorizationService authorizationService,
        IDocumentPresentationFactory documentPresentationFactory,
@@ -1,10 +1,13 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Document.Collection;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Security;
@@ -20,16 +23,33 @@ public class ByKeyDocumentCollectionController : DocumentCollectionControllerBas
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
    private readonly IDocumentCollectionPresentationFactory _documentCollectionPresentationFactory;

+    [ActivatorUtilitiesConstructor]
+    public ByKeyDocumentCollectionController(
+        IContentListViewService contentListViewService,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
+        IUmbracoMapper mapper,
+        IDocumentCollectionPresentationFactory documentCollectionPresentationFactory,
+        FlagProviderCollection flagProviders)
+        : base(mapper, flagProviders)
+    {
+        _contentListViewService = contentListViewService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+        _documentCollectionPresentationFactory = documentCollectionPresentationFactory;
+    }
+
+    [Obsolete("Please use the constructor with all parameters. Scheduled to be removed in V18")]
    public ByKeyDocumentCollectionController(
        IContentListViewService contentListViewService,
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
        IUmbracoMapper mapper,
        IDocumentCollectionPresentationFactory documentCollectionPresentationFactory)
-        : base(mapper)
+        : this(
+            contentListViewService,
+            backOfficeSecurityAccessor,
+            mapper,
+            documentCollectionPresentationFactory,
+            StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>())
    {
-        _contentListViewService = contentListViewService;
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-        _documentCollectionPresentationFactory = documentCollectionPresentationFactory;
    }

    [HttpGet("{id:guid}")]
@@ -2,6 +2,7 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Controllers.Content;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Document;
 using Umbraco.Cms.Api.Management.ViewModels.Document.Collection;
 using Umbraco.Cms.Core;
@@ -17,8 +18,8 @@ namespace Umbraco.Cms.Api.Management.Controllers.Document.Collection;
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDocuments)]
 public abstract class DocumentCollectionControllerBase : ContentCollectionControllerBase<IContent, DocumentCollectionResponseModel, DocumentValueResponseModel, DocumentVariantResponseModel>
 {
-    protected DocumentCollectionControllerBase(IUmbracoMapper mapper)
-        : base(mapper)
+    protected DocumentCollectionControllerBase(IUmbracoMapper mapper, FlagProviderCollection flagProviders)
+        : base(mapper, flagProviders)
    {
    }

@@ -0,0 +1,53 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Common.Builders;
+using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.ViewModels.Document;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Document;
+
+[ApiVersion("1.0")]
+public class DocumentPreviewUrlController : DocumentControllerBase
+{
+    private readonly IContentService _contentService;
+    private readonly IDocumentUrlFactory _documentUrlFactory;
+
+    public DocumentPreviewUrlController(
+        IContentService contentService,
+        IDocumentUrlFactory documentUrlFactory)
+    {
+        _contentService = contentService;
+        _documentUrlFactory = documentUrlFactory;
+    }
+
+    [MapToApiVersion("1.0")]
+    [HttpGet("{id:guid}/preview-url")]
+    [ProducesResponseType(typeof(DocumentUrlInfo), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> GetPreviewUrl(Guid id, string providerAlias, string? culture, string? segment)
+    {
+        IContent? content = _contentService.GetById(id);
+        if (content is null)
+        {
+            return NotFound(new ProblemDetailsBuilder()
+                .WithTitle("Document not found")
+                .WithDetail("The requested document did not exist.")
+                .Build());
+        }
+
+        DocumentUrlInfo? previewUrlInfo = await _documentUrlFactory.GetPreviewUrlAsync(content, providerAlias, culture, segment);
+        if (previewUrlInfo is null)
+        {
+            return BadRequest(new ProblemDetailsBuilder()
+                .WithTitle("No preview URL for document")
+                .WithDetail("Failed to produce a preview URL for the requested document.")
+                .Build());
+        }
+
+        return Ok(previewUrlInfo);
+    }
+}
@@ -1,6 +1,7 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.Document.Item;
 using Umbraco.Cms.Core.Models;
@@ -15,7 +16,10 @@ public class ItemDocumentItemController : DocumentItemControllerBase
    private readonly IEntityService _entityService;
    private readonly IDocumentPresentationFactory _documentPresentationFactory;

-    public ItemDocumentItemController(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
+    [ActivatorUtilitiesConstructor]
+    public ItemDocumentItemController(
+        IEntityService entityService,
+        IDocumentPresentationFactory documentPresentationFactory)
    {
        _entityService = entityService;
        _documentPresentationFactory = documentPresentationFactory;
@@ -24,20 +28,20 @@ public class ItemDocumentItemController : DocumentItemControllerBase
    [HttpGet]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(IEnumerable<DocumentItemResponseModel>), StatusCodes.Status200OK)]
-    public Task<IActionResult> Item(
+    public async Task<IActionResult> Item(
        CancellationToken cancellationToken,
        [FromQuery(Name = "id")] HashSet<Guid> ids)
    {
        if (ids.Count is 0)
        {
-            return Task.FromResult<IActionResult>(Ok(Enumerable.Empty<DocumentItemResponseModel>()));
+            return Ok(Enumerable.Empty<DocumentItemResponseModel>());
        }

        IEnumerable<IDocumentEntitySlim> documents = _entityService
            .GetAll(UmbracoObjectTypes.Document, ids.ToArray())
            .OfType<IDocumentEntitySlim>();

-        IEnumerable<DocumentItemResponseModel> documentItemResponseModels = documents.Select(_documentPresentationFactory.CreateItemResponseModel);
-        return Task.FromResult<IActionResult>(Ok(documentItemResponseModels));
+        IEnumerable<DocumentItemResponseModel> responseModels = documents.Select(_documentPresentationFactory.CreateItemResponseModel);
+        return Ok(responseModels);
    }
 }
@@ -1,11 +1,14 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.Document.Item;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Management.Controllers.Document.Item;

@@ -14,13 +17,52 @@ public class SearchDocumentItemController : DocumentItemControllerBase
 {
    private readonly IIndexedEntitySearchService _indexedEntitySearchService;
    private readonly IDocumentPresentationFactory _documentPresentationFactory;
+    private readonly IDataTypeService _dataTypeService;

-    public SearchDocumentItemController(IIndexedEntitySearchService indexedEntitySearchService, IDocumentPresentationFactory documentPresentationFactory)
+    [ActivatorUtilitiesConstructor]
+    public SearchDocumentItemController(
+        IIndexedEntitySearchService indexedEntitySearchService,
+        IDocumentPresentationFactory documentPresentationFactory,
+        IDataTypeService dataTypeService)
    {
        _indexedEntitySearchService = indexedEntitySearchService;
        _documentPresentationFactory = documentPresentationFactory;
+        _dataTypeService = dataTypeService;
    }

+    [Obsolete("Use the non-obsolete constructor instead, will be removed in v18")]
+    public SearchDocumentItemController(
+        IIndexedEntitySearchService indexedEntitySearchService,
+        IDocumentPresentationFactory documentPresentationFactory)
+        : this(
+            indexedEntitySearchService,
+            documentPresentationFactory,
+            StaticServiceProvider.Instance.GetRequiredService<IDataTypeService>())
+    {
+    }
+
+    [Obsolete("Please use the overload taking all parameters. Scheduled for removal in Umbraco 18.")]
+    [ApiExplorerSettings(IgnoreApi = true)]
+    public async Task<IActionResult> SearchWithTrashed(
+        CancellationToken cancellationToken,
+        string query,
+        bool? trashed = null,
+        string? culture = null,
+        int skip = 0,
+        int take = 100,
+        Guid? parentId = null,
+        [FromQuery] IEnumerable<Guid>? allowedDocumentTypes = null)
+        => await SearchWithTrashed(
+            cancellationToken,
+            query,
+            trashed,
+            culture,
+            skip,
+            take,
+            parentId,
+            allowedDocumentTypes,
+            null);
+
    [HttpGet("search")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedModel<DocumentItemResponseModel>), StatusCodes.Status200OK)]
@@ -32,9 +74,21 @@ public class SearchDocumentItemController : DocumentItemControllerBase
        int skip = 0,
        int take = 100,
        Guid? parentId = null,
-        [FromQuery] IEnumerable<Guid>? allowedDocumentTypes = null)
+        [FromQuery] IEnumerable<Guid>? allowedDocumentTypes = null,
+        Guid? dataTypeId = null)
    {
-        PagedModel<IEntitySlim> searchResult = await _indexedEntitySearchService.SearchAsync(UmbracoObjectTypes.Document, query, parentId, allowedDocumentTypes, trashed, culture, skip, take);
+        var ignoreUserStartNodes = await IgnoreUserStartNodes(dataTypeId);
+        PagedModel<IEntitySlim> searchResult = await _indexedEntitySearchService.SearchAsync(
+            UmbracoObjectTypes.Document,
+            query,
+            parentId,
+            allowedDocumentTypes,
+            trashed,
+            culture,
+            skip,
+            take,
+            ignoreUserStartNodes);
+
        var result = new PagedModel<DocumentItemResponseModel>
        {
            Items = searchResult.Items.OfType<IDocumentEntitySlim>().Select(_documentPresentationFactory.CreateItemResponseModel),
@@ -43,4 +97,7 @@ public class SearchDocumentItemController : DocumentItemControllerBase

        return Ok(result);
    }
+
+    private async Task<bool> IgnoreUserStartNodes(Guid? dataTypeKey) =>
+        dataTypeKey is not null && await _dataTypeService.IsDataTypeIgnoringUserStartNodesAsync(dataTypeKey.Value);
 }
@@ -58,11 +58,12 @@ public class PublishDocumentWithDescendantsController : DocumentControllerBase
            true);

        return attempt.Success && attempt.Result.AcceptedTaskId.HasValue
-            ? Ok(new PublishWithDescendantsResultModel
-            {
-                TaskId = attempt.Result.AcceptedTaskId.Value,
-                IsComplete = false
-            })
+            ? Ok(
+                new PublishWithDescendantsResultModel
+                {
+                    TaskId = attempt.Result.AcceptedTaskId.Value,
+                    IsComplete = false,
+                })
            : DocumentPublishingOperationStatusResult(attempt.Status, failedBranchItems: attempt.Result.FailedItems);
    }

@@ -49,21 +49,23 @@ public class PublishDocumentWithDescendantsResultController : DocumentController
        var isPublishing = await _contentPublishingService.IsPublishingBranchAsync(taskId);
        if (isPublishing)
        {
-            return Ok(new PublishWithDescendantsResultModel
-            {
-                TaskId = taskId,
-                IsComplete = false
-            });
-        };
+            return Ok(
+                new PublishWithDescendantsResultModel
+                {
+                    TaskId = taskId,
+                    IsComplete = false,
+                });
+        }

        // If completed, get the result and return the status.
        Attempt<ContentPublishingBranchResult, ContentPublishingOperationStatus> attempt = await _contentPublishingService.GetPublishBranchResultAsync(taskId);
        return attempt.Success
-            ? Ok(new PublishWithDescendantsResultModel
-            {
-                TaskId = taskId,
-                IsComplete = true
-            })
+            ? Ok(
+                new PublishWithDescendantsResultModel
+                {
+                    TaskId = taskId,
+                    IsComplete = true,
+                })
            : DocumentPublishingOperationStatusResult(attempt.Status, failedBranchItems: attempt.Result.FailedItems);
    }
 }
@@ -0,0 +1,24 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.ViewModels.Document.RecycleBin;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Document.RecycleBin;
+
+[ApiVersion("1.0")]
+public class SiblingsDocumentRecycleBinController : DocumentRecycleBinControllerBase
+{
+    public SiblingsDocumentRecycleBinController(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
+        : base(entityService, documentPresentationFactory)
+    {
+    }
+
+    [HttpGet("siblings")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(SubsetViewModel<DocumentRecycleBinItemResponseModel>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SubsetViewModel<DocumentRecycleBinItemResponseModel>>> Siblings(CancellationToken cancellationToken, Guid target, int before, int after, Guid? dataTypeId = null)
+        => await GetSiblings(target, before, after);
+}
@@ -1,8 +1,10 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Security;
@@ -13,6 +15,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.Document.Tree;
 [ApiVersion("1.0")]
 public class AncestorsDocumentTreeController : DocumentTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public AncestorsDocumentTreeController(
        IEntityService entityService,
        IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -32,6 +35,28 @@ public class AncestorsDocumentTreeController : DocumentTreeControllerBase
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public AncestorsDocumentTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        IPublicAccessService publicAccessService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IDocumentPresentationFactory documentPresentationFactory)
+        : base(
+            entityService,
+            flagProviders,
+            userStartNodeEntitiesService,
+            dataTypeService,
+            publicAccessService,
+            appCaches,
+            backofficeSecurityAccessor,
+            documentPresentationFactory)
+    {
+    }
+
    [HttpGet("ancestors")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(IEnumerable<DocumentTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -1,19 +1,22 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Api.Management.Services.Entities;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.Factories;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;

 namespace Umbraco.Cms.Api.Management.Controllers.Document.Tree;

 [ApiVersion("1.0")]
 public class ChildrenDocumentTreeController : DocumentTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public ChildrenDocumentTreeController(
        IEntityService entityService,
        IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -33,10 +36,37 @@ public class ChildrenDocumentTreeController : DocumentTreeControllerBase
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public ChildrenDocumentTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        IPublicAccessService publicAccessService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IDocumentPresentationFactory documentPresentationFactory)
+        : base(
+            entityService,
+            flagProviders,
+            userStartNodeEntitiesService,
+            dataTypeService,
+            publicAccessService,
+            appCaches,
+            backofficeSecurityAccessor,
+            documentPresentationFactory)
+    {
+    }
+
    [HttpGet("children")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<DocumentTreeItemResponseModel>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedViewModel<DocumentTreeItemResponseModel>>> Children(CancellationToken cancellationToken, Guid parentId, int skip = 0, int take = 100, Guid? dataTypeId = null)
+    public async Task<ActionResult<PagedViewModel<DocumentTreeItemResponseModel>>> Children(
+        CancellationToken cancellationToken,
+        Guid parentId,
+        int skip = 0,
+        int take = 100,
+        Guid? dataTypeId = null)
    {
        IgnoreUserStartNodesForDataType(dataTypeId);
        return await GetChildren(parentId, skip, take);
@@ -1,13 +1,16 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Security;
@@ -26,6 +29,7 @@ public abstract class DocumentTreeControllerBase : UserStartNodeTreeControllerBa
    private readonly IBackOfficeSecurityAccessor _backofficeSecurityAccessor;
    private readonly IDocumentPresentationFactory _documentPresentationFactory;

+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    protected DocumentTreeControllerBase(
        IEntityService entityService,
        IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -34,7 +38,29 @@ public abstract class DocumentTreeControllerBase : UserStartNodeTreeControllerBa
        AppCaches appCaches,
        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
        IDocumentPresentationFactory documentPresentationFactory)
-    : base(entityService, userStartNodeEntitiesService, dataTypeService)
+        : this(
+              entityService,
+              StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>(),
+              userStartNodeEntitiesService,
+              dataTypeService,
+              publicAccessService,
+              appCaches,
+              backofficeSecurityAccessor,
+              documentPresentationFactory)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
+    protected DocumentTreeControllerBase(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        IPublicAccessService publicAccessService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IDocumentPresentationFactory documentPresentationFactory)
+        : base(entityService, flagProviders, userStartNodeEntitiesService, dataTypeService)
    {
        _publicAccessService = publicAccessService;
        _appCaches = appCaches;
@@ -1,19 +1,22 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Api.Management.Services.Entities;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.Factories;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;

 namespace Umbraco.Cms.Api.Management.Controllers.Document.Tree;

 [ApiVersion("1.0")]
 public class RootDocumentTreeController : DocumentTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public RootDocumentTreeController(
        IEntityService entityService,
        IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -33,6 +36,28 @@ public class RootDocumentTreeController : DocumentTreeControllerBase
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public RootDocumentTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        IPublicAccessService publicAccessService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IDocumentPresentationFactory documentPresentationFactory)
+        : base(
+            entityService,
+            flagProviders,
+            userStartNodeEntitiesService,
+            dataTypeService,
+            publicAccessService,
+            appCaches,
+            backofficeSecurityAccessor,
+            documentPresentationFactory)
+    {
+    }
+
    [HttpGet("root")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<DocumentTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -1,8 +1,11 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Security;
@@ -13,6 +16,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.Document.Tree;
 [ApiVersion("1.0")]
 public class SiblingsDocumentTreeController : DocumentTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public SiblingsDocumentTreeController(
        IEntityService entityService,
        IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -32,9 +36,34 @@ public class SiblingsDocumentTreeController : DocumentTreeControllerBase
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public SiblingsDocumentTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        IPublicAccessService publicAccessService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IDocumentPresentationFactory documentPresentationFactory)
+        : base(
+            entityService,
+            flagProviders,
+            userStartNodeEntitiesService,
+            dataTypeService,
+            publicAccessService,
+            appCaches,
+            backofficeSecurityAccessor,
+            documentPresentationFactory)
+    {
+    }
+
    [HttpGet("siblings")]
    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(IEnumerable<DocumentTreeItemResponseModel>), StatusCodes.Status200OK)]
-    public Task<ActionResult<IEnumerable<DocumentTreeItemResponseModel>>> Siblings(CancellationToken cancellationToken, Guid target, int before, int after)
-        => GetSiblings(target, before, after);
+    [ProducesResponseType(typeof(SubsetViewModel<DocumentTreeItemResponseModel>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SubsetViewModel<DocumentTreeItemResponseModel>>> Siblings(CancellationToken cancellationToken, Guid target, int before, int after, Guid? dataTypeId = null)
+    {
+        IgnoreUserStartNodesForDataType(dataTypeId);
+        return await GetSiblings(target, before, after);
+    }
 }
@@ -21,20 +21,6 @@ public class ValidateCreateDocumentController : CreateDocumentControllerBase
    private readonly IContentEditingService _contentEditingService;
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;

-    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 17.")]
-    public ValidateCreateDocumentController(
-        IAuthorizationService authorizationService,
-        IDocumentEditingPresentationFactory documentEditingPresentationFactory,
-        IContentEditingService contentEditingService)
-        : this(
-              authorizationService,
-              documentEditingPresentationFactory,
-              contentEditingService,
-              StaticServiceProvider.Instance.GetRequiredService<IBackOfficeSecurityAccessor>())
-    {
-    }
-
-    [ActivatorUtilitiesConstructor]
    public ValidateCreateDocumentController(
        IAuthorizationService authorizationService,
        IDocumentEditingPresentationFactory documentEditingPresentationFactory,
@@ -21,20 +21,6 @@ public class ValidateUpdateDocumentController : UpdateDocumentControllerBase
    private readonly IDocumentEditingPresentationFactory _documentEditingPresentationFactory;
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;

-    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 17.")]
-    public ValidateUpdateDocumentController(
-        IAuthorizationService authorizationService,
-        IContentEditingService contentEditingService,
-        IDocumentEditingPresentationFactory documentEditingPresentationFactory)
-        : this(
-              authorizationService,
-              contentEditingService,
-              documentEditingPresentationFactory,
-              StaticServiceProvider.Instance.GetRequiredService<IBackOfficeSecurityAccessor>())
-    {
-    }
-
-    [ActivatorUtilitiesConstructor]
    public ValidateUpdateDocumentController(
        IAuthorizationService authorizationService,
        IContentEditingService contentEditingService,
@@ -1,7 +1,9 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;

@@ -10,11 +12,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.DocumentBlueprint.Tree;
 [ApiVersion("1.0")]
 public class AncestorsDocumentBlueprintTreeController : DocumentBlueprintTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public AncestorsDocumentBlueprintTreeController(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
        : base(entityService, documentPresentationFactory)
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public AncestorsDocumentBlueprintTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDocumentPresentationFactory documentPresentationFactory)
+    : base(entityService, flagProviders, documentPresentationFactory)
+    {
+    }
+
    [HttpGet("ancestors")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(IEnumerable<DocumentBlueprintTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -1,8 +1,10 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;

@@ -11,11 +13,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.DocumentBlueprint.Tree;
 [ApiVersion("1.0")]
 public class ChildrenDocumentBlueprintTreeController : DocumentBlueprintTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public ChildrenDocumentBlueprintTreeController(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
        : base(entityService, documentPresentationFactory)
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public ChildrenDocumentBlueprintTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDocumentPresentationFactory documentPresentationFactory)
+        : base(entityService, flagProviders, documentPresentationFactory)
+    {
+    }
+
    [HttpGet("children")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<DocumentBlueprintTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -1,10 +1,13 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Services;
@@ -19,8 +22,17 @@ public class DocumentBlueprintTreeControllerBase : FolderTreeControllerBase<Docu
 {
    private readonly IDocumentPresentationFactory _documentPresentationFactory;

+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public DocumentBlueprintTreeControllerBase(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
-        : base(entityService)
+        : this(
+              entityService,
+              StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>(),
+              documentPresentationFactory)
+    {
+    }
+
+    public DocumentBlueprintTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders, IDocumentPresentationFactory documentPresentationFactory)
+        : base(entityService, flagProviders)
        => _documentPresentationFactory = documentPresentationFactory;

    protected override UmbracoObjectTypes ItemObjectType => UmbracoObjectTypes.DocumentBlueprint;
@@ -1,8 +1,10 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;

@@ -11,11 +13,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.DocumentBlueprint.Tree;
 [ApiVersion("1.0")]
 public class RootDocumentBlueprintTreeController : DocumentBlueprintTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public RootDocumentBlueprintTreeController(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
        : base(entityService, documentPresentationFactory)
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public RootDocumentBlueprintTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDocumentPresentationFactory documentPresentationFactory)
+        : base(entityService, flagProviders, documentPresentationFactory)
+    {
+    }
+
    [HttpGet("root")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<DocumentBlueprintTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -1,6 +1,9 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;

@@ -8,17 +11,28 @@ namespace Umbraco.Cms.Api.Management.Controllers.DocumentBlueprint.Tree;

 public class SiblingsDocumentBlueprintTreeController : DocumentBlueprintTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public SiblingsDocumentBlueprintTreeController(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
        : base(entityService, documentPresentationFactory)
    {
    }

+    [ActivatorUtilitiesConstructor]
+    public SiblingsDocumentBlueprintTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDocumentPresentationFactory documentPresentationFactory)
+        : base(entityService, flagProviders, documentPresentationFactory)
+    {
+    }
+
    [HttpGet("siblings")]
-    [ProducesResponseType(typeof(IEnumerable<DocumentBlueprintTreeItemResponseModel>), StatusCodes.Status200OK)]
-    public Task<ActionResult<IEnumerable<DocumentBlueprintTreeItemResponseModel>>> Siblings(
+    [ProducesResponseType(typeof(SubsetViewModel<DocumentBlueprintTreeItemResponseModel>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SubsetViewModel<DocumentBlueprintTreeItemResponseModel>>> Siblings(
        CancellationToken cancellationToken,
        Guid target,
        int before,
-        int after) =>
-        GetSiblings(target, before, after);
+        int after,
+        bool foldersOnly = false)
+    {
+        RenderFoldersOnly(foldersOnly);
+        return await GetSiblings(target, before, after);
+    }
 }
--- a/Show More
+++ b/Show More