Build: V15 Disable schedule nightly E2E trigger (#22203)

Disable schedule nightly E2E trigger

.editorconfig

@@ -102,7 +102,7 @@ dotnet_style_predefined_type_for_locals_parameters_members = true:warning
 dotnet_style_predefined_type_for_member_access = true:warning
 # Modifier preferences
 # https://docs.microsoft.com/visualstudio/ide/editorconfig-language-conventions#normalize-modifiers
-dotnet_style_require_accessibility_modifiers = for_non_interface_members:warning
+dotnet_style_require_accessibility_modifiers = always:warning
 csharp_preferred_modifier_order = public,private,protected,internal,static,extern,new,virtual,abstract,sealed,override,readonly,unsafe,volatile,async:warning
 visual_basic_preferred_modifier_order = Partial,Default,Private,Protected,Public,Friend,NotOverridable,Overridable,MustOverride,Overloads,Overrides,MustInherit,NotInheritable,Static,Shared,Shadows,ReadOnly,WriteOnly,Dim,Const,WithEvents,Widening,Narrowing,Custom,Async:warning
 dotnet_style_readonly_field = true:warning

.github/BUILD.md

@@ -9,7 +9,7 @@ In order to use Umbraco as a CMS and build your website with it, you should not
 -   Are you about to [create a pull request for Umbraco][contribution guidelines]?
 -   Are you trying to get to the bottom of a problem in your existing Umbraco installation?
 
-If the answer is yes, please read on. Otherwise, make sure to head on over [to the releases page](https://releases.umbraco.com) and start using Umbraco CMS as intended.
+If the answer is yes, please read on. Otherwise, make sure to head on over [to the download page](https://our.umbraco.com/download) and start using Umbraco CMS as intended.
 
 ## Table of contents
 
@@ -37,7 +37,7 @@ In order to work with the Umbraco source code locally, first make sure you have
 
 ### Familiarizing yourself with the code
 
-Umbraco is a .NET application using C#. The solution is broken down into multiple projects. There are several class libraries. The `Umbraco.Web.UI` project is the main project that hosts the back office and login screen. This is the project you will want to run to see your changes.
+Umbraco is a .NET application using C#. The solution is broken down into multiple projects.  There are several class libraries. The `Umbraco.Web.UI` project is the main project that hosts the back office and login screen. This is the project you will want to run to see your changes.
 
 There are two web projects in the solution with client-side assets based on TypeScript, `Umbraco.Web.UI.Client` and `Umbraco.Web.UI.Login`.
 
@@ -73,19 +73,13 @@ Just be careful not to include this change in your PR.
 
 Conversely, if you are working on front-end only, you want to build the back-end once and then run it. Before you do so, update the configuration in `appSettings.json` to add the following under `Umbraco:Cms:Security`:
 
-```json
+```
 "BackOfficeHost": "http://localhost:5173",
 "AuthorizeCallbackPathName": "/oauth_complete",
 "AuthorizeCallbackLogoutPathName": "/logout",
-"AuthorizeCallbackErrorPathName": "/error",
-"BackOfficeTokenCookie": {
-  "SameSite": "None"
-}
+"AuthorizeCallbackErrorPathName": "/error"
 ```
 
-> [!NOTE]
-> If you get stuck in a login loop, try clearing your browser cookies for localhost, and make sure that the `Umbraco:Cms:Security:BackOfficeTokenCookie:SameSite` setting is set to `None`.
-
 Then run Umbraco from the command line.
 
 ```

.github/CONTRIBUTING.md

@@ -1,8 +1,8 @@
 # Contributing to Umbraco CMS
 
-👍🎉 First of all, thanks for taking the time to contribute! 🎉👍
+👍🎉 First off, thanks for taking the time to contribute! 🎉👍
 
-These contribution guidelines are mostly just that - guidelines, not rules. This is what we've found to work best over the years, but if you choose to ignore them, we still love you! 💖 Use your best judgment, and feel free to propose changes to this document in a pull request.
+These contribution guidelines are mostly just that - guidelines, not rules. This is what we've found to work best over the years, but if you choose to ignore them, we still love you! 💖 Use your best judgement, and feel free to propose changes to this document in a pull request.
 
 We have a guide on [what to consider before you start](contributing-before-you-start.md) and more detailed guides at the end of this article.
 
@@ -12,56 +12,56 @@ This guide describes each step to make your first contribution:
 
 1. **Fork**
 
-   Create a fork of [`Umbraco-CMS` on GitHub](https://github.com/umbraco/Umbraco-CMS)
+    Create a fork of [`Umbraco-CMS` on GitHub](https://github.com/umbraco/Umbraco-CMS)
 
-   ![Fork the repository](img/forkrepositorynew.png)
+    ![Fork the repository](img/forkrepository.png)
 
 2. **Clone**
 
-   When GitHub has created your fork, you can clone it in your favorite Git tool or on the command line with `git clone https://github.com/[YourUsername]/Umbraco-CMS`.
+    When GitHub has created your fork, you can clone it in your favorite Git tool or on the command line with `git clone https://github.com/[YourUsername]/Umbraco-CMS`.
 
-   ![Clone the fork](img/cloneforknew.png)
+    ![Clone the fork](img/clonefork.png)
 
 3. **Switch to the correct branch**
 
-   Switch to the `main` branch
+    Switch to the `contrib` branch
 
 4. **Branch out**
 
-   Create a new branch based on `main` and name it after the issue you're fixing. For example: `v15/bugfix/18132-rte-tinymce-onchange-value-check`.
+    Create a new branch based on `contrib` and name it after the issue you're fixing, For example: `v15/bugfix/18132-rte-tinymce-onchange-value-check`.
 
-   Please follow this format for branches: `v{major}/{feature|bugfix|task|qa|improvement}/{issue}-{description}`.
+    Please follow this format for branches: `v{major}/{feature|bugfix|task}/{issue}-{description}`. 
 
-   This is a development branch for the particular issue you're working on, in this case, a bug-fix for issue number `18132` that affects Umbraco v.15.
+    This is a development branch for the particular issue you're working on, in this case a bug-fix for issue number `18132` that affects Umbraco v.15.
 
-   Don't commit to `main`, create a new branch first.
+    Don't commit to `contrib`, create a new branch first.
 
 5. **Build or run a Development Server**
 
-   You can build or run a Development Server with any IDE that supports .NET or the command line.
+    You can build or run a Development Server with any IDE that supports DotNet or the command line.
 
-   Read [Build or run a Development Server](BUILD.md) for the right approach to your needs.
+    Read [Build or run a Development Server](BUILD.md) for the right approach to your needs.
 
 6. **Change**
 
-   Make your changes, experiment, have fun, explore and learn, and don't be afraid. We welcome all contributions and will [happily give feedback](contributing-first-issue.md#questions).
+    Make your changes, experiment, have fun, explore and learn, and don't be afraid. We welcome all contributions and will [happily give feedback](contributing-first-issue.md#questions).
 
 7. **Commit and push**
 
-   Done? Yay! 🎉
+    Done? Yay! 🎉
 
-   Remember to commit to your branch. When it's ready, push the changes to your fork on GitHub.
+    Remember to commit to your branch. When it's ready push the changes to your fork on GitHub.
 
 8. **Create pull request**
 
-   On GitHub, in your forked repository (`https://github.com/[YourUsername]/Umbraco-CMS`), you will see a banner saying that you pushed a new branch and a button to make a pull request. Tap the button and follow the instructions.
+    On GitHub, in your forked repository (`https://github.com/[YourUsername]/Umbraco-CMS`) you will see a banner saying that you pushed a new branch and a button to make a pull request. Tap the button and follow the instuctions.
 
-   Would you like to read further? [Creating a pull request and what happens next](contributing-creating-a-pr.md).
+    Want to read further? [Creating a pull request and what happens next](contributing-creating-a-pr.md).
 
 ## Further contribution guides
 
 - [Before you start](contributing-before-you-start.md)
-- [Finding your first issue](contributing-first-issue.md)
+- [Finding your first issue: Up for grabs](contributing-first-issue.md)
 - [Contributing to the new backoffice](https://docs.umbraco.com/umbraco-backoffice/)
 - [Unwanted changes](contributing-unwanted-changes.md)
 - [Other ways to contribute](contributing-other-ways-to-contribute.md)

.github/README.md

@@ -38,17 +38,9 @@ Some important documentation links to get you started:
 - [Getting to know Umbraco](https://docs.umbraco.com/umbraco-cms/fundamentals/get-to-know-umbraco)
 - [Tutorials for creating a basic website and customizing the editing experience](https://docs.umbraco.com/umbraco-cms/tutorials/overview)
 
-## Backoffice Preview
-
-Want to see the latest backoffice UI in action? Check out our live preview:
-
-**[backofficepreview.umbraco.com](https://backofficepreview.umbraco.com/)**
-
-This preview is automatically deployed from the main branch and showcases the latest backoffice features and improvements.  It runs from mock data and persistent edits are not supported.
-
 ## Get help
 
-If you need a bit of feedback while building your Umbraco projects, we are [chatty on Discord](https://discord.umbraco.com). Our Discord server serves as a social space for all Umbracians. If you have any questions or need some help with a problem, head over to our [dedicated forum](https://forum.umbraco.com/) where the Umbraco Community will be happy to help. 
+If you need a bit of feedback while building your Umbraco projects, we are [chatty on Discord](https://discord.umbraco.com). Our Discord server serves both a social space but also has channels for questions and answers. Feel free to lurk or join in with your own questions. Or just post your daily Wordle score, up to you!
 
 ## Looking to contribute back to Umbraco?
 
@@ -60,4 +52,3 @@ You came to the right place! Our GitHub repository is available for all kinds of
 Umbraco is contribution-focused and community-driven. If you want to contribute back to the Umbraco source code, please check out our [guide to contributing](CONTRIBUTING.md).
 
 ### Tip: You should not run Umbraco from source code found here. Umbraco is extremely extensible and can do whatever you need. Instead, [install Umbraco as noted above](#looking-to-install-umbraco) and then [extend it any way you want to](https://docs.umbraco.com/umbraco-cms/extending/).
-

.github/contributing-backoffice.md

@@ -114,7 +114,7 @@ To declare the Published Cache Status Dashboard as a new manifest, we need to ad
 	},
 	conditions: [
 		{
-			alias: UMB_SECTION_ALIAS_CONDITION_ALIAS,
+			alias: 'Umb.Condition.SectionAlias',
 			match: 'Umb.Section.Settings',
 		},
 	],

.github/contributing-creating-a-pr.md

@@ -7,26 +7,9 @@ We recommend you to [sync with our repository][sync fork] before you submit your
 GitHub will have picked up on the new branch you've pushed and will offer to create a Pull Request. Click that green button and away you go.
 ![Create a pull request](img/createpullrequest.png)
 
-We like to use [git flow][git flow] as much as possible, but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to `main`. This is the branch you should be targeting.
+We like to use [git flow][git flow] as much as possible, but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to `contrib`. This is the branch you should be targeting.
 
-We welcome PRs for features and bugfixes for different versions according to the [published support and EOL schedule][support-and-eol].
-
-We don't have rules for naming PRs - so name them as you prefer. At HQ we do have a best practice on clear and concise PR naming, so if you would like to use the format feel free to do so. 
-
-Our convention of doing it is:
-
-_Area: Description (closes #IssueID)_
-
-1. Start by specifying the area. Fx the feature name(UFM, Tiptap etc.) or specific section (migrations, relations, segmentation).
-
-2. In your description, where applicable, mention type of PR (Build, Bump, Fix, Refactor etc.).
-   
-4. Good practise is to make sure you describe specifically the change and/or impact of change.<br>
-   Example: Writing "Extension Insights: Fixes CSS alignment" instead of "Fixed issue".
-
-6. Add (closes #IssueID) behind description, if your PR resolves an issue. 
-
-That's it! 
+Please note: we are no longer accepting features for v8 and below but will continue to merge security fixes as and when they arise.
   
 ## The review process
 [review process]: #the-review-process
@@ -65,5 +48,4 @@ There will be times that we really like your proposed changes and we’ll finish
 
 [making larger changes]: contributing-before-you-start.md#making-large-changes
 [pr or package]: contributing-before-you-start.md#pull-request-or-package
-[Core collabs]: contributing-core-collabs-team.md
-[support-and-eol]: https://umbraco.com/products/knowledge-center/long-term-support-and-end-of-life/
+[Core collabs]: contributing-core-collabs-team.md

.github/contributing-first-issue.md

@@ -1,8 +1,6 @@
-## Finding your first issue
+## Finding your first issue: Up for grabs
 
-Umbraco HQ will regularly mark newly created issues on the issue tracker with [the `community/up-for-grabs` tag][up for grabs issues]. This means that the proposed changes are wanted in Umbraco but the HQ does not have the time to make them at this time. In adding the label we will endeavour to provide some guidelines on how to go about the implementation, such that it aligns with the project. We encourage anyone to pick them up and help out.
-
-You don't need to restrict yourselves to issues that are specifically marked as "up for grabs" though. If you are running into a bug you have reported or found on the [issue tracker][issue tracker], it's not necessary to wait for HQ response. Feel free to dive in and try to provide a fix, raising questions as you need if you have concerns about the modifications necessary to resolve the problem.
+Umbraco HQ will regularly mark newly created issues on the issue tracker with [the `community/up-for-grabs` tag][up for grabs issues]. This means that the proposed changes are wanted in Umbraco but the HQ does not have the time to make them at this time. We encourage anyone to pick them up and help out.
 
 If you do start working on something, make sure to leave a small comment on the issue saying something like: "I'm working on this". That way other people stumbling upon the issue know they don't need to pick it up, someone already has.
 
@@ -13,18 +11,18 @@ Great question! The short version goes like this:
 1. **Fork**
 
     Create a fork of [`Umbraco-CMS` on GitHub][Umbraco CMS repo]
-
+    
     ![Fork the repository](img/forkrepository.png)
-
+    
 1. **Clone**
 
     When GitHub has created your fork, you can clone it in your favorite Git tool
-
-    ![Clone the fork](img/clonefork.png)
-
+    
+    ![Clone the fork](img/clonefork.png) 
+    
 1. **Switch to the correct branch**
 
-    Switch to the `main` branch
+    Switch to the `contrib` branch
 
 1. **Build**
 
@@ -32,7 +30,7 @@ Great question! The short version goes like this:
 
 1. **Branch**
 
-    Create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp-12345`. This means it's a temporary branch for the particular issue you're working on, in this case issue number `12345`.  Don't commit to `main`, create a new branch first.
+    Create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp-12345`. This means it's a temporary branch for the particular issue you're working on, in this case issue number `12345`.  Don't commit to `contrib`, create a new branch first.
 
 1. **Change**
 
@@ -42,7 +40,7 @@ Great question! The short version goes like this:
 
     Done? Yay! 🎉
 
-    Remember to commit to your new `temp` branch, and don't commit to `main`. Then you can push the changes up to your fork on GitHub.
+    Remember to commit to your new `temp` branch, and don't commit to `contrib`. Then you can push the changes up to your fork on GitHub.
 
 #### Keeping your Umbraco fork in sync with the main repository
 [sync fork]: #keeping-your-umbraco-fork-in-sync-with-the-main-repository
@@ -59,10 +57,10 @@ Then when you want to get the changes from the main repository:
 
 ```
 git fetch upstream
-git rebase upstream/main
+git rebase upstream/contrib
 ```
 
-In this command we're syncing with the `main` branch, but you can of course choose another one if needed.
+In this command we're syncing with the `contrib` branch, but you can of course choose another one if needed.
 
 [More information on how this works can be found on the thoughtbot blog.][sync fork ext]
 
@@ -79,7 +77,7 @@ You can get in touch with [the core contributors team][core collabs] in multiple
 
 - If there's an existing issue on the issue tracker then that's a good place to leave questions and discuss how to start or move forward.
 - If you want to ask questions on some code you've already written you can create a draft pull request, [detailed in a GitHub blog post][draft prs].
-- Unsure where to start? Did something not work as expected? Try leaving a note in the [forum][forum]. The team monitors that one closely, so one of us will be on hand and ready to point you in the right direction.
+- Unsure where to start? Did something not work as expected? Try leaving a note in the ["Contributing to Umbraco"][contrib forum] forum. The team monitors that one closely, so one of us will be on hand and ready to point you in the right direction.
 
 
   <!-- Local -->
@@ -90,7 +88,6 @@ You can get in touch with [the core contributors team][core collabs] in multiple
 
 [sync fork ext]: http://robots.thoughtbot.com/post/5133345960/keeping-a-git-fork-updated	"Details on keeping a git fork updated"
 [draft prs]: https://github.blog/2019-02-14-introducing-draft-pull-requests/	"Github's blog post providing details on draft pull requests"
-[forum]: https://forum.umbraco.com/
+[contrib forum]: https://our.umbraco.com/forum/contributing-to-umbraco-cms/
 [Umbraco CMS repo]: https://github.com/umbraco/Umbraco-CMS
-[up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs
-[issue tracker]: https://github.com/umbraco/Umbraco-CMS/issues
+[up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs

.github/contributing-localization.md

@@ -1,223 +0,0 @@
-# **Contributing to Localization in the Backoffice**
-
-Do you want to help keep our translations accurate and up to standard? 🌍✨
-
-Your input makes a real difference! By reviewing, refining, or suggesting improvements, you ensure that our translations remain clear, consistent, and user-friendly for everyone.
-
-
-## **How Can I Contribute?**
-
-To contribute to localization in the Backoffice, follow this step-by-step guide:
-
-
-### **1. Change the Language in Backoffice**
-
-
-
-1. Open the Backoffice, click on your profile icon in the top-right corner, and select "Edit." 
-
-
-
-![Menubar profile image](/.github/img/contributing/ProfileImage.png "Menubar profile image")
-
-
-
-![Edit button inside profile](/.github/img/contributing/editBtn.png "Edit button inside profile")
-
-
-2. Under "UI Culture," select the language you want to review from the dropdown menu. 
-
-
-
-![Dropdown of languages in Umbraco](/.github/img/contributing/uiCulture.png "Dropdown of languages in Umbraco")
-
-
-
-### **2. Find a Translation Error**
-
-
-
-1. Navigate through the Backoffice and check if everything is translated correctly. 
-
-2. When you find a translation error, right-click on it and select "Inspect." 
-
-3. Look for the nearest element that starts with `umb-` and has a name indicating something specific to the given location. 
- 
-    **Example:**  
-
-    * The closest parent element should be specific, such as `umb-document-type-workspace-view-settings` instead of a generic element like `umb-property-layout.`
-
-
-### **3. Find the Code in VS Code**
-
-
-
-1. Open VS Code and search for the nearest `umb-` element you identified. 
-
-
-
-![Search for nearest umb element in code](/.github/img/contributing/searchInVsCode.png "Search for nearest umb element in code")
-
-2. Scroll down to find `render() {` and look for the element label that needs updating. 
-
-
-![Find render and label in code](/.github/img/contributing/renderCode.png "Find render and label in code")
-
-3. If the label is hardcoded, it must be updated. 
- 
-    **Example:**  
-    `label="Vary by culture"`
-
-
-### **4. Find the Correct Translation**
-
-
-
-1. Open the `en.ts` or `en-us.ts` file and search for relevant keywords. \
- \
-    **Example:** 
-
-    * If the text is "Vary by culture," search for `vary`, `culture`, or `Vary by culture`. 
-
-
-2. Once you find the translation, take the element name and search for it in the target language file (e.g., `da-dk.ts` for Danish). 
-
-
-![Search for translation in language files](/.github/img/contributing/searchingThroughLanguageFiles.png "Search for translation in language files")
-
-3. If a translation exists, insert it into the label element found earlier. 
-
-
-
-### **5. Insert the Translation**
-
-To display the new translation correctly, insert the following code inside the label element:
-
-`${this.localize.term('action_key')}`
-
-Replace `action_key` with the correct translation key.
-
-**Example:**
-
-`${this.localize.term('contentTypeEditor_allowVaryByCulture')}`
-
-![Localization code snippet](/.github/img/contributing/localizationCodeSnippetInCode.png "Localization code snippet")
-
-
-Save the changes and return to the Backoffice to see the update.
-
-
-![Changes in backoffice after changes in code](/.github/img/contributing/changedBackofficeAfterLocalization.png "Changes in backoffice after changes in code")
-
-
-
-### **6. Commit and Push**
-
-
-
-1. Commit your changes to a new temporary branch (avoid committing directly to `main`). 
-
-2. Push the changes to your fork on GitHub.
-
-
-### **7. Create a Pull Request**
-
-
-
-1. In your forked repository on GitHub (`https://github.com/[YourUsername]/Umbraco-CMS`), a banner will appear stating that you pushed a new branch. 
-
-2. Click the button to create a pull request and follow the instructions.
-
-
-## **I Can’t Find the Correct Translation**
-
-If you can’t find the translation you need, it may not exist yet. In this case, you can create a new action with related keys.
-
-
-### **1. Ensure It Doesn’t Already Exist**
-
-Search thoroughly in `en.ts` or `en-us.ts` for all relevant keywords.
-
-
-### **2. Create an Action**
-
-
-
-1. Choose a meaningful name for the action to avoid confusion. \
- \
- **Example:** Translation for the Data Type "Color Picker." 
-
-    * **Good name:** `colorPickerConfigurations`
-    * **Bad name:** `colorpicker`
-2. A specific action name prevents unnecessarily long key names. 
-
-3. Define the action: 
-
-
-
-### **3. Create Keys**
-
-
-
-1. Use clear and descriptive key names. \
- \
- **Example:**
-    * **Good name:** `colorsTitle`
-    * **Bad name:** `colors`
-2. Add the necessary keys inside the action with proper translations. 
-
-
-
-![Action and related Keys in language files](/.github/img/contributing/actionAndKeys.png "Action and related Keys in language files")
-
-
-
-## **I Can’t Find a <code>render()</code> Code in VS Code**
-
-In some cases, such as Data Types, the label might not be inside `render()`. Instead, it may be in a manifest file.
-
-
-### 1. Search for the Text
-
-Copy the text from the Backoffice and search for it in the code.
-
-
-### 2. Open the Manifest File
-
-Once you find the relevant manifest file, open it to confirm you’re in the right place.
-
-
-### 3. Change the Label
-
-In Markdown files, localization is slightly different. Instead of:
-`${this.localize.term('action_key')}`
-
-Use: `#action_key`
-
-**Example:**
-`#colorPickerConfigurations_showLabelTitle`
-
-### 4. Change the Description
-
-For descriptions in Markdown files, use:
-`{umbLocalize: action_key}`
-
-**Example:**
-`{umbLocalize: colorPickerConfigurations_showLabelDescription}`
-
-
-### 5. Save and Verify
-
-Once all changes are made, your manifest should look something like this:
-
-
-![Localization changes to manifest files](/.github/img/contributing/finishedManifestAfterLocalizatonChanges.png "Localization changes to manifest files")
-
-
-
----
-
-
-### Thank you 
-
-Following these steps ensures that the Umbraco Backoffice remains accessible and user-friendly in all supported languages. Thanks for contributing! 🎉

.github/copilot-instructions.md

@@ -1,218 +0,0 @@
-# Umbraco CMS Development Guide
-
-Always reference these instructions first and fallback to search or bash commands only when you encounter unexpected information that does not match the info here.
-
-## Working Effectively
-
-Bootstrap, build, and test the repository:
-
--   Install .NET SDK (version specified in global.json):
-    -   `curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --version $(jq -r '.sdk.version' global.json)`
-    -   `export PATH="/home/runner/.dotnet:$PATH"`
--   Install Node.js (version specified in src/Umbraco.Web.UI.Client/.nvmrc):
-    -   `curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash`
-    -   `export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"`
-    -   `nvm install $(cat src/Umbraco.Web.UI.Client/.nvmrc) && nvm use $(cat src/Umbraco.Web.UI.Client/.nvmrc)`
--   Fix shallow clone issue (required for GitVersioning):
-    -   `git fetch --unshallow`
--   Restore packages:
-    -   `dotnet restore` -- takes 50 seconds. NEVER CANCEL. Set timeout to 90+ seconds.
--   Build the solution:
-    -   `dotnet build` -- takes 4.5 minutes. NEVER CANCEL. Set timeout to 10+ minutes.
--   Install and build frontend:
-    -   `cd src/Umbraco.Web.UI.Client`
-    -   `npm ci --no-fund --no-audit --prefer-offline` -- takes 11 seconds.
-    -   `npm run build:for:cms` -- takes 1.25 minutes. NEVER CANCEL. Set timeout to 5+ minutes.
--   Install and build Login
-    -   `cd src/Umbraco.Web.UI.Login`
-    -   `npm ci --no-fund --no-audit --prefer-offline`
-    -   `npm run build`
--   Run the application:
-    -   `cd src/Umbraco.Web.UI`
-    -   `dotnet run --no-build` -- Application runs on https://localhost:44339 and http://localhost:11000
-
-Check out [BUILD.md](./BUILD.md) for more detailed instructions.
-
-## Validation
-
--   ALWAYS run through at least one complete end-to-end scenario after making changes.
--   Build and unit tests must pass before committing changes.
--   Frontend build produces output in src/Umbraco.Web.UI.Client/dist-cms/ which gets copied to src/Umbraco.Web.UI/wwwroot/umbraco/backoffice/
--   Always run `dotnet build` and `npm run build:for:cms` before running the application to see your changes.
--   For login-only changes, you can run `npm run build` from src/Umbraco.Web.UI.Login and then `dotnet run --no-build` from src/Umbraco.Web.UI.
--   For frontend-only changes, you can run `npm run dev:server` from src/Umbraco.Web.UI.Client for hot reloading.
--   Frontend changes should be linted using `npm run lint:fix` which uses Eslint.
-
-## Testing
-
-### Unit Tests (.NET)
-
--   Location: tests/Umbraco.Tests.UnitTests/
--   Run: `dotnet test tests/Umbraco.Tests.UnitTests/Umbraco.Tests.UnitTests.csproj --configuration Release --verbosity minimal`
--   Duration: ~1 minute with 3,343 tests
--   NEVER CANCEL: Set timeout to 5+ minutes
-
-### Integration Tests (.NET)
-
--   Location: tests/Umbraco.Tests.Integration/
--   Run: `dotnet test tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj --configuration Release --verbosity minimal`
--   NEVER CANCEL: Set timeout to 10+ minutes
-
-### Frontend Tests
-
--   Location: src/Umbraco.Web.UI.Client/
--   Run: `npm test` (requires `npx playwright install` first)
--   Frontend tests use Web Test Runner with Playwright
-
-### Acceptance Tests (E2E)
-
--   Location: tests/Umbraco.Tests.AcceptanceTest/
--   Requires running Umbraco application and configuration
--   See tests/Umbraco.Tests.AcceptanceTest/README.md for detailed setup (requires `npx playwright install` first)
-
-## Project Structure
-
-The solution contains 30 C# projects organized as follows:
-
-### Main Application Projects
-
--   **Umbraco.Web.UI**: Main web application project (startup project)
--   **Umbraco.Web.UI.Client**: TypeScript frontend (backoffice)
--   **Umbraco.Web.UI.Login**: Separate login screen frontend
--   **Umbraco.Core**: Core domain models and interfaces
--   **Umbraco.Infrastructure**: Data access and infrastructure
--   **Umbraco.Cms**: Main CMS package
-
-### API Projects
-
--   **Umbraco.Cms.Api.Management**: Management API
--   **Umbraco.Cms.Api.Delivery**: Content Delivery API
--   **Umbraco.Cms.Api.Common**: Shared API components
-
-### Persistence Projects
-
--   **Umbraco.Cms.Persistence.SqlServer**: SQL Server support
--   **Umbraco.Cms.Persistence.Sqlite**: SQLite support
--   **Umbraco.Cms.Persistence.EFCore**: Entity Framework Core abstractions
-
-### Test Projects
-
--   **Umbraco.Tests.UnitTests**: Unit tests
--   **Umbraco.Tests.Integration**: Integration tests
--   **Umbraco.Tests.AcceptanceTest**: End-to-end tests with Playwright
--   **Umbraco.Tests.Common**: Shared test utilities
-
-## Common Tasks
-
-### Running Umbraco in Different Modes
-
-**Production Mode (Standard Development)**
-Use this for backend development, testing full builds, or when you don't need hot reloading:
-
-1. Build frontend assets: `cd src/Umbraco.Web.UI.Client && npm run build:for:cms`
-2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
-3. Access backoffice: `https://localhost:44339/umbraco`
-4. Application uses compiled frontend from `wwwroot/umbraco/backoffice/`
-
-**Vite Dev Server Mode (Frontend Development with Hot Reload)**
-Use this for frontend-only development with hot module reloading:
-
-1. Configure backend for frontend development - Add to `src/Umbraco.Web.UI/appsettings.json` under `Umbraco:CMS:Security`:
-    ```json
-    "BackOfficeHost": "http://localhost:5173",
-    "AuthorizeCallbackPathName": "/oauth_complete",
-    "AuthorizeCallbackLogoutPathName": "/logout",
-    "AuthorizeCallbackErrorPathName": "/error",
-    "BackOfficeTokenCookie": {
-      "SameSite": "None"
-    }
-    ```
-2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
-3. Run frontend dev server: `cd src/Umbraco.Web.UI.Client && npm run dev:server`
-4. Access backoffice: `http://localhost:5173/` (no `/umbraco` prefix)
-5. Changes to TypeScript/Lit files hot reload automatically
-
-**Important:** Remove the `BackOfficeHost` configuration before committing or switching back to production mode.
-
-### Backend-Only Development
-
-For backend-only changes, disable frontend builds:
-
--   Comment out the target named "BuildStaticAssetsPreconditions" in src/Umbraco.Cms.StaticAssets.csproj:
-    ```
-    <!--<Target Name="BuildStaticAssetsPreconditions" BeforeTargets="AssignTargetPaths">
-      [...]
-    </Target>-->
-    ```
--   Remember to uncomment before committing
-
-### Building NuGet Packages
-
-To build custom NuGet packages for testing:
-
-```bash
-dotnet pack -c Release -o Build.Out
-dotnet nuget add source [Path to Build.Out folder] -n MyLocalFeed
-```
-
-### Regenerating Frontend API Types
-
-When changing Management API:
-
-```bash
-cd src/Umbraco.Web.UI.Client
-npm run generate:server-api-dev
-```
-
-Also update OpenApi.json from /umbraco/swagger/management/swagger.json
-
-## Database Setup
-
-Default configuration supports SQLite for development. For production-like testing:
-
--   Use SQL Server/LocalDb for better performance
--   Configure connection string in src/Umbraco.Web.UI/appsettings.json
-
-## Clean Up / Reset
-
-To reset development environment:
-
-```bash
-# Remove configuration and database
-rm src/Umbraco.Web.UI/appsettings.json
-rm -rf src/Umbraco.Web.UI/umbraco/Data
-
-# Full clean (removes all untracked files)
-git clean -xdf .
-```
-
-## Version Information
-
--   Target Framework: .NET (version specified in global.json)
--   Current Version: (specified in version.json)
--   Node.js Requirement: (specified in src/Umbraco.Web.UI.Client/.nvmrc)
--   npm Requirement: Latest compatible version
-
-## Known Issues
-
--   Build requires full git history (not shallow clone) due to GitVersioning
--   Some NuGet package security warnings are expected (SixLabors.ImageSharp vulnerabilities)
--   Frontend tests require Playwright browser installation: `npx playwright install`
--   Older Node.js versions may show engine compatibility warnings (check .nvmrc for current requirement)
-
-## Timing Expectations
-
-**NEVER CANCEL** these operations - they are expected to take time:
-
-| Operation               | Expected Time | Timeout Setting |
-| ----------------------- | ------------- | --------------- |
-| `dotnet restore`        | 50 seconds    | 90+ seconds     |
-| `dotnet build`          | 4.5 minutes   | 10+ minutes     |
-| `npm ci`                | 11 seconds    | 30+ seconds     |
-| `npm run build:for:cms` | 1.25 minutes  | 5+ minutes      |
-| `npm test`              | 2 minutes     | 5+ minutes      |
-| `npm run lint`          | 1 minute      | 5+ minutes      |
-| Unit tests              | 1 minute      | 5+ minutes      |
-| Integration tests       | Variable      | 10+ minutes     |
-
-Always wait for commands to complete rather than canceling and retrying.

.github/release.yml

@@ -7,7 +7,7 @@ changelog:
       - duplicate
       - wontfix
   categories:
-    - title: 🙌 Notable Changes 
+    - title: 🙌 Notable Changes
       labels:
         - category/notable
     - title: 💥 Breaking Changes
@@ -23,7 +23,7 @@ changelog:
     - title: 📦 Dependencies
       labels:
         - dependencies
-    - title: 🌈 Accessibility Improvements
+    - title: 🌈 A11Y
       labels:
         - accessibility
         - category/accessibility

.github/workflows/azure-backoffice.yml

@@ -1,60 +0,0 @@
-name: Backoffice Static Web Apps CI/CD
-
-on:
-  push:
-    branches:
-      - main
-      - release/*
-      - v*/dev
-      - v*/main
-    paths:
-      - src/Umbraco.Web.UI.Client/package.json
-      - src/Umbraco.Web.UI.Client/package-lock.json
-      - src/Umbraco.Web.UI.Client/src/**
-      - .github/workflows/azure-backoffice.yml
-  pull_request:
-    types: [opened, synchronize, reopened, closed]
-    branches:
-      - main
-      - release/*
-      - v*/dev
-      - v*/main
-  workflow_dispatch:
-
-jobs:
-  build_and_deploy_job:
-    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed' && contains(github.event.pull_request.labels.*.name, 'preview/backoffice') && github.repository == github.event.pull_request.head.repo.full_name)
-    runs-on: ubuntu-latest
-    name: Build and Deploy Job
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: true
-      - name: Build And Deploy
-        id: builddeploy
-        uses: Azure/static-web-apps-deploy@v1
-        with:
-          production_branch: main
-          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_VICTORIOUS_GROUND_017B08103 }}
-          repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
-          action: "upload"
-          ###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
-          # For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig
-          app_location: "src/Umbraco.Web.UI.Client" # App source code path
-          app_build_command: "npm run build:for:static"
-          output_location: "dist" # Built app content directory - optional
-          skip_api_build: true # Set to true if you do not have an Azure Functions API in your repo
-          ###### End of Repository/Build Configurations ######
-
-  close_pull_request_job:
-    if: github.event_name == 'pull_request' && github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'preview/backoffice') && github.repository == github.event.pull_request.head.repo.full_name
-    runs-on: ubuntu-latest
-    name: Close Pull Request Job
-    steps:
-      - name: Close Pull Request
-        id: closepullrequest
-        uses: Azure/static-web-apps-deploy@v1
-        with:
-          app_location: "src/Umbraco.Web.UI.Client"
-          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_VICTORIOUS_GROUND_017B08103 }}
-          action: "close"

.github/workflows/azure-storybook.yml

@@ -1,59 +0,0 @@
-name: Storybook CI/CD
-
-on:
-  push:
-    branches:
-      - main
-      - v*/dev
-      - v*/main
-    paths:
-      - src/Umbraco.Web.UI.Client/package.json
-      - src/Umbraco.Web.UI.Client/package-lock.json
-      - src/Umbraco.Web.UI.Client/src/**
-      - .github/workflows/azure-storybook.yml
-  pull_request:
-    types: [opened, synchronize, reopened, closed]
-    branches:
-      - main
-      - v*/dev
-      - v*/main
-  workflow_dispatch:
-
-env:
-  NODE_OPTIONS: --max_old_space_size=16384
-
-jobs:
-  build_and_deploy_job:
-    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed' && contains(github.event.pull_request.labels.*.name, 'preview/storybook') && github.repository == github.event.pull_request.head.repo.full_name)
-    runs-on: ubuntu-latest
-    name: Build and Deploy Job
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build And Deploy
-        id: builddeploy
-        uses: Azure/static-web-apps-deploy@v1
-        with:
-          production_branch: main
-          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_ORANGE_SEA_0C7411A03 }}
-          repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
-          action: "upload"
-          ###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
-          # For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig
-          app_location: "src/Umbraco.Web.UI.Client" # App source code path
-          app_build_command: "npm run storybook:build"
-          output_location: "/storybook-static" # Built app content directory - optional
-          skip_api_build: true # Set to true if you do not have an Azure Functions API in your repo
-          ###### End of Repository/Build Configurations ######
-
-  close_pull_request_job:
-    if: github.event_name == 'pull_request' && github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'preview/storybook') && github.repository == github.event.pull_request.head.repo.full_name
-    runs-on: ubuntu-latest
-    name: Close Pull Request Job
-    steps:
-      - name: Close Pull Request
-        id: closepullrequest
-        uses: Azure/static-web-apps-deploy@v1
-        with:
-          app_location: "src/Umbraco.Web.UI.Client"
-          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_ORANGE_SEA_0C7411A03 }}
-          action: "close"

.github/workflows/codeql-analysis.yml

@@ -4,15 +4,15 @@ on:
   push:
     branches:
       - "*/dev"
-      - "*/main"
-      - "main"
+      - "*/contrib"
+      - "contrib"
       - "release/*"
   pull_request:
     # The branches below must be a subset of the branches above
     branches:
       - "*/dev"
-      - "*/main"
-      - "main"
+      - "*/contrib"
+      - "contrib"
       - "release/*"
   schedule:
     - cron: "33 2 * * 1"

.github/workflows/label-to-release-announcement.yml

@@ -1,164 +0,0 @@
-name: Create a release discussions for each new version label
-
-on:
-  schedule:
-    - cron: "0 * * * *" # every hour
-  workflow_dispatch:    # allow manual runs
-permissions:
-  contents: read
-  discussions: write
-  issues: read
-  pull-requests: read
-
-jobs:
-  reconcile:
-    if: github.repository == 'umbraco/Umbraco-CMS'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Reconcile release/* labels → discussions
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const categoryName = "Releases";
-
-            // 24h cutoff
-            const since = new Date(Date.now() - 24*60*60*1000).toISOString();
-            core.info(`Scanning issues/PRs updated since ${since}`);
-
-            // fetch repo + discussion categories
-            const repoData = await github.graphql(`
-              query($owner:String!, $repo:String!){
-                repository(owner:$owner, name:$repo){
-                  id
-                  discussionCategories(first:100){ nodes { id name } }
-                }
-              }
-            `, { owner, repo });
-            const repoId = repoData.repository.id;
-            const category = repoData.repository.discussionCategories.nodes.find(c => c.name === categoryName);
-            if (!category) {
-              core.setFailed(`Discussion category "${categoryName}" not found`);
-              return;
-            }
-            const categoryId = category.id;
-
-            // paginate issues/PRs updated in last 24h
-            for await (const { data: items } of github.paginate.iterator(
-              github.rest.issues.listForRepo,
-              { owner, repo, state: "all", since, per_page: 100 }
-            )) {
-              for (const item of items) {
-                const releaseLabels = (item.labels || [])
-                  .map(l => (typeof l === "string" ? l : l.name)) // always get the name
-                  .filter(n => typeof n === "string" && n.startsWith("release/") && n !== "release/no-notes");
-                if (releaseLabels.length === 0) continue;
-
-                core.info(`#${item.number}: ${releaseLabels.join(", ")}`);
-
-                for (const labelName of releaseLabels) {
-                  const version = labelName.substring("release/".length);
-                  const titleTarget = `Release: ${version}`;
-
-                  // search discussions
-                  let discussionId = null;
-                  let cursor = null;
-                  while (true) {
-                    const page = await github.graphql(`
-                      query($owner:String!, $repo:String!, $cursor:String){
-                        repository(owner:$owner, name:$repo){
-                          discussions(first:50, after:$cursor){
-                            nodes{
-                              id
-                              title
-                              url
-                              category{ name }
-                              labels(first:50){ nodes{ name } }
-                            }
-                            pageInfo{ hasNextPage endCursor }
-                          }
-                        }
-                      }
-                    `, { owner, repo, cursor });
-                    const nodes = page.repository.discussions.nodes;
-                    const byLabel = nodes.find(d =>
-                      d.category?.name === categoryName &&
-                      d.labels?.nodes?.some(l => l.name === labelName)
-                    );
-                    if (byLabel) { discussionId = byLabel.id; break; }
-                    const byTitle = nodes.find(d =>
-                      d.category?.name === categoryName &&
-                      d.title === titleTarget
-                    );
-                    if (byTitle) { discussionId = byTitle.id; break; }
-                    if (!page.repository.discussions.pageInfo.hasNextPage) break;
-                    cursor = page.repository.discussions.pageInfo.endCursor;
-                  }
-
-                  if (!discussionId) {
-                    core.info(`→ Creating discussion for ${labelName}`);
-                    const body =
-                      `**Release date:** TODO (YYYY-MM-DD)\n\n` +
-                      `### Links\n` +
-                      `- [Issues and pull requests marked for version ${version}](https://github.com/${owner}/${repo}/issues?q=label%3A${encodeURIComponent(labelName)})\n`;
-
-                    const created = await github.graphql(`
-                      mutation($repoId:ID!, $catId:ID!, $title:String!, $body:String!){
-                        createDiscussion(input:{
-                          repositoryId:$repoId,
-                          categoryId:$catId,
-                          title:$title,
-                          body:$body
-                        }){ discussion{ id url } }
-                      }
-                    `, { repoId, catId: categoryId, title: titleTarget, body });
-
-                    discussionId = created.createDiscussion.discussion.id;
-
-                    // lock the discussion to prevent replies
-                    await github.graphql(`
-                      mutation($id:ID!){
-                        lockLockable(input:{ lockableId:$id }) {
-                          clientMutationId
-                        }
-                      }
-                    `, { id: discussionId });
-                    core.info(`🔒 Locked discussion ${discussionId}`);
-                  } else {
-                    core.info(`→ Found existing discussion for ${labelName}`);
-                  }
-
-                  // ensure label exists
-                  let labelId;
-                  try {
-                    await github.rest.issues.getLabel({ owner, repo, name: labelName });
-                  } catch (e) {
-                    if (e.status === 404) {
-                      await github.rest.issues.createLabel({
-                        owner, repo, name: labelName, color: "0E8A16"
-                      });
-                    } else { throw e; }
-                  }
-                  const labelNode = await github.graphql(`
-                    query($owner:String!, $repo:String!, $name:String!){
-                      repository(owner:$owner, name:$repo){ label(name:$name){ id } }
-                    }
-                  `, { owner, repo, name: labelName });
-                  labelId = labelNode.repository.label?.id;
-                  if (!labelId) continue;
-
-                  // add label to discussion
-                  await github.graphql(`
-                    mutation($id:ID!, $labels:[ID!]!){
-                      addLabelsToLabelable(input:{ labelableId:$id, labelIds:$labels }) {
-                        clientMutationId
-                      }
-                    }
-                  `, { id: discussionId, labels: [labelId] });
-
-                  core.info(`✓ ${labelName} attached to discussion`);
-                }
-              }
-            }

.github/workflows/test-backoffice.yml

@@ -3,18 +3,16 @@ name: Test Backoffice
 on:
   push:
     branches:
-      - main
+      - contrib
       - release/*
       - v*/dev
-      - v*/main
     paths:
       - src/Umbraco.Web.UI.Client/**
   pull_request:
     branches:
-      - main
+      - contrib
       - release/*
       - v*/dev
-      - v*/main
     paths:
       - src/Umbraco.Web.UI.Client/**
 

.gitignore

@@ -95,10 +95,6 @@ tools/docfx/
 /tests/Umbraco.Tests.Integration/[Uu]mbraco/[Ll]ogs/
 /tests/Umbraco.Tests.Integration/Views/
 /tests/Umbraco.Tests.UnitTests/[Uu]mbraco/[Dd]ata/TEMP/
-/BenchmarkDotNet.Artifacts/
-playwright-report
-trace.zip
-/tests/Umbraco.Tests.AcceptanceTest/results
 
 # Ignore auto-generated schema
 /src/Umbraco.Cms.Targets/tasks/
@@ -107,8 +103,9 @@ trace.zip
 /src/Umbraco.Web.UI/appsettings-schema.json
 /src/Umbraco.Web.UI/appsettings-schema.*.json
 /src/Umbraco.Web.UI/umbraco-package-schema.json
-/src/Umbraco.Web.UI.Client/umbraco-package-schema.json
 /tests/Umbraco.Tests.Integration/appsettings-schema.json
 /tests/Umbraco.Tests.Integration/appsettings-schema.*.json
 /tests/Umbraco.Tests.Integration/umbraco-package-schema.json
 /src/Umbraco.Cms/appsettings-schema.json
+playwright-report
+trace.zip

.vscode/launch.json

@@ -62,7 +62,6 @@
       "cwd": "${workspaceFolder}/src/Umbraco.Web.UI",
       "stopAtEntry": false,
       "requireExactSource": false,
-      "postDebugTask": "kill-umbraco-web-ui",
       // Enable launching a web browser when ASP.NET Core starts. For more information: https://aka.ms/VSCode-CS-LaunchJson-WebBrowser
       "serverReadyAction": {
         "action": "openExternally",
@@ -97,17 +96,13 @@
       "stopAtEntry": false,
       "requireExactSource": false,
       "checkForDevCert": true,
-      "postDebugTask": "kill-umbraco-web-ui",
       "env": {
         "ASPNETCORE_ENVIRONMENT": "Development",
         "ASPNETCORE_URLS": "https://localhost:44339",
-        "UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL": "https://localhost:44339",
         "UMBRACO__CMS__SECURITY__BACKOFFICEHOST": "http://localhost:5173",
         "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKPATHNAME": "/oauth_complete",
         "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKLOGOUTPATHNAME": "/logout",
-        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKERRORPATHNAME": "/error",
-        "UMBRACO__CMS__SECURITY__KEEPUSERLOGGEDIN": "true",
-        "UMBRACO__CMS__SECURITY__BACKOFFICETOKENCOOKIE__SAMESITE": "None"
+        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKERRORPATHNAME": "/error"
       },
       "sourceFileMap": {
         "/Views": "${workspaceFolder}/Umbraco.Web.UI/Views"

.vscode/settings.json

@@ -1,15 +1,5 @@
 {
-  "cSpell.words": [
-    "backoffice",
-    "pickable",
-    "Pickable",
-    "Umbraco",
-    "unprovide",
-    "Unproviding"
-  ],
-  "eslint.useFlatConfig": true,
-  "eslint.workingDirectories": [
-    "./src/Umbraco.Web.UI.Client/",
-    "./src/Umbraco.Web.UI.Login/"
-  ]
+    "cSpell.words": [
+        "unprovide"
+    ]
 }

.vscode/tasks.json

@@ -1,87 +1,76 @@
 {
-  "version": "2.0.0",
-  "tasks": [
-    {
-      "label": "Build",
-      "detail": "Builds the client and SLN",
-      "promptOnClose": true,
-      "group": "build",
-      "dependsOn": ["Client Build", "Dotnet build"],
-      "problemMatcher": []
-    },
-    {
-      "label": "Client Install",
-      "detail": "install npm for Umbraco.Web.UI.Client",
-      "promptOnClose": true,
-      "type": "npm",
-      "script": "install",
-      "path": "src/Umbraco.Web.UI.Client/",
-      "problemMatcher": []
-    },
-    {
-      "label": "Client Build",
-      "detail": "runs npm run build for Umbraco.Web.UI.Client",
-      "promptOnClose": true,
-      "group": "build",
-      "type": "npm",
-      "script": "build:for:cms",
-      "path": "src/Umbraco.Web.UI.Client/",
-      "problemMatcher": []
-    },
-    {
-      "label": "Client Watch",
-      "detail": "runs npm run dev for Umbraco.Web.UI.Client",
-      "promptOnClose": true,
-      "group": "build",
-      "type": "npm",
-      "script": "dev",
-      "path": "src/Umbraco.Web.UI.Client/",
-      "problemMatcher": []
-    },
-    {
-      "label": "Dotnet build",
-      "detail": "Dotnet build of SLN",
-      "promptOnClose": true,
-      "group": "build",
-      "command": "dotnet",
-      "type": "process",
-      "args": [
-        "build",
-        "${workspaceFolder}/umbraco.sln",
-        "/property:GenerateFullPaths=true",
-        "/consoleloggerparameters:NoSummary"
-      ],
-      "problemMatcher": "$msCompile"
-    },
-    {
-      "label": "Dotnet watch",
-      "detail": "Dotnet run and watch of Web.UI",
-      "promptOnClose": true,
-      "command": "dotnet",
-      "type": "process",
-      "args": [
-        "watch",
-        "run",
-        "--project",
-        "${workspaceFolder}/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj",
-        "/property:GenerateFullPaths=true",
-        "/consoleloggerparameters:NoSummary"
-      ],
-      "problemMatcher": "$msCompile"
-    },
-    {
-      "label": "kill-umbraco-web-ui",
-      "type": "shell",
-      "problemMatcher": [],
-      "osx": {
-        "command": "pkill -f Umbraco.Web.UI"
-      },
-      "linux": {
-        "command": "pkill -f Umbraco.Web.UI"
-      },
-      "windows": {
-        "command": "taskkill /IM Umbraco.Web.UI.exe /F"
-      }
-    }
-  ]
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "Build",
+            "detail": "Builds the client and SLN",
+            "promptOnClose": true,
+            "group": "build",
+            "dependsOn": [
+                "Client Build",
+                "Dotnet build"
+            ],
+            "problemMatcher": []
+        },
+        {
+            "label": "Client Install",
+            "detail": "install npm for Umbraco.Web.UI.Client",
+            "promptOnClose": true,
+            "type": "npm",
+            "script": "install",
+            "path": "src/Umbraco.Web.UI.Client/",
+            "problemMatcher": []
+        },
+        {
+            "label": "Client Build",
+            "detail": "runs npm run build for Umbraco.Web.UI.Client",
+            "promptOnClose": true,
+            "group": "build",
+            "type": "npm",
+            "script": "build:for:cms",
+            "path": "src/Umbraco.Web.UI.Client/",
+            "problemMatcher": []
+        },
+        {
+            "label": "Client Watch",
+            "detail": "runs npm run dev for Umbraco.Web.UI.Client",
+            "promptOnClose": true,
+            "group": "build",
+            "type": "npm",
+            "script": "dev",
+            "path": "src/Umbraco.Web.UI.Client/",
+            "problemMatcher": []
+        },
+        {
+            "label": "Dotnet build",
+            "detail": "Dotnet build of SLN",
+            "promptOnClose": true,
+            "group": "build",
+            "command": "dotnet",
+            "type": "process",
+            "args": [
+                "build",
+                "${workspaceFolder}/umbraco.sln",
+                "/property:GenerateFullPaths=true",
+                "/consoleloggerparameters:NoSummary"
+            ],
+            "problemMatcher": "$msCompile"
+        },
+        {
+            "label": "Dotnet watch",
+            "detail": "Dotnet run and watch of Web.UI",
+            "promptOnClose": true,
+            "command": "dotnet",
+            "type": "process",
+            "args": [
+                "watch",
+                "run",
+                "--project",
+                "${workspaceFolder}/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj",
+                "/property:GenerateFullPaths=true",
+                "/consoleloggerparameters:NoSummary"
+            ],
+            "problemMatcher": "$msCompile"
+        }
+    ]
 }

CLAUDE.md

@@ -1,381 +0,0 @@
-# Umbraco CMS - Multi-Project Repository
-
-Enterprise-grade CMS built on .NET 10.0. This repository contains 21 production projects organized in a layered architecture with clear separation of concerns.
-
-**Repository**: https://github.com/umbraco/Umbraco-CMS
-**License**: MIT
-**Main Branch**: `main`
-
----
-
-## 1. Overview
-
-### What This Repository Contains
-
-**21 Production Projects** organized in 3 main categories:
-
-1. **Core Architecture** (Domain & Infrastructure)
-   - `Umbraco.Core` - Interface contracts, domain models, notifications
-   - `Umbraco.Infrastructure` - Service implementations, data access, caching
-
-2. **Web & APIs** (Presentation Layer)
-   - `Umbraco.Web.UI` - Main ASP.NET Core web application
-   - `Umbraco.Web.Common` - Shared web functionality, controllers, middleware
-   - `Umbraco.Cms.Api.Management` - Backoffice Management API (REST)
-   - `Umbraco.Cms.Api.Delivery` - Content Delivery API (headless)
-   - `Umbraco.Cms.Api.Common` - Shared API infrastructure
-
-3. **Specialized Features** (Pluggable Modules)
-   - Persistence: EF Core (modern), NPoco (legacy) for SQL Server & SQLite
-   - Caching: `PublishedCache.HybridCache` (in-memory + distributed)
-   - Search: `Examine.Lucene` (full-text search)
-   - Imaging: `Imaging.ImageSharp` v1 & v2 (image processing)
-   - Other: Static assets, targets, development tools
-
-**6 Test Projects**:
-- `Umbraco.Tests.Common` - Shared test utilities
-- `Umbraco.Tests.UnitTests` - Unit tests
-- `Umbraco.Tests.Integration` - Integration tests
-- `Umbraco.Tests.Benchmarks` - Performance benchmarks
-- `Umbraco.Tests.AcceptanceTest` - E2E tests
-- `Umbraco.Tests.AcceptanceTest.UmbracoProject` - Test instance
-
-### Key Technologies
-
-- **.NET 10.0** - Target framework for all projects
-- **ASP.NET Core** - Web framework
-- **Entity Framework Core** - Modern ORM
-- **OpenIddict** - OAuth 2.0/OpenID Connect authentication
-- **Swashbuckle** - OpenAPI/Swagger documentation
-- **Lucene.NET** - Full-text search via Examine
-- **ImageSharp** - Image processing
-
----
-
-## 2. Repository Structure
-
-```
-Umbraco-CMS/
-├── src/                                    # 21 production projects
-│   ├── Umbraco.Core/                      # Domain contracts (interfaces only)
-│   │   └── CLAUDE.md                      # ⭐ Core architecture guide
-│   ├── Umbraco.Infrastructure/            # Service implementations
-│   ├── Umbraco.Web.Common/                # Web utilities
-│   ├── Umbraco.Web.UI/                    # Main web application
-│   ├── Umbraco.Cms.Api.Management/        # Management API
-│   ├── Umbraco.Cms.Api.Delivery/          # Delivery API (headless)
-│   ├── Umbraco.Cms.Api.Common/            # Shared API infrastructure
-│   │   └── CLAUDE.md                      # ⭐ API patterns guide
-│   ├── Umbraco.PublishedCache.HybridCache/ # Content caching
-│   ├── Umbraco.Examine.Lucene/            # Search indexing
-│   ├── Umbraco.Cms.Persistence.EFCore/    # EF Core data access
-│   ├── Umbraco.Cms.Persistence.EFCore.Sqlite/
-│   ├── Umbraco.Cms.Persistence.EFCore.SqlServer/
-│   ├── Umbraco.Cms.Persistence.Sqlite/    # Legacy SQLite
-│   ├── Umbraco.Cms.Persistence.SqlServer/ # Legacy SQL Server
-│   ├── Umbraco.Cms.Imaging.ImageSharp/    # Image processing v1
-│   ├── Umbraco.Cms.Imaging.ImageSharp2/   # Image processing v2
-│   ├── Umbraco.Cms.StaticAssets/          # Embedded assets
-│   ├── Umbraco.Cms.DevelopmentMode.Backoffice/
-│   ├── Umbraco.Cms.Targets/               # NuGet targets
-│   └── Umbraco.Cms/                       # Meta-package
-│
-├── tests/                                  # 6 test projects
-│   ├── Umbraco.Tests.Common/
-│   ├── Umbraco.Tests.UnitTests/
-│   ├── Umbraco.Tests.Integration/
-│   ├── Umbraco.Tests.Benchmarks/
-│   ├── Umbraco.Tests.AcceptanceTest/
-│   └── Umbraco.Tests.AcceptanceTest.UmbracoProject/
-│
-├── templates/                              # Project templates
-│   └── Umbraco.Templates/
-│
-├── tools/                                  # Build tools
-│   └── Umbraco.JsonSchema/
-│
-├── umbraco.sln                            # Main solution file
-├── Directory.Build.props                  # Shared build configuration
-├── Directory.Packages.props               # Centralized package versions
-├── .editorconfig                          # Code style
-└── .globalconfig                          # Roslyn analyzers
-```
-
-### Architecture Layers
-
-**Dependency Flow** (unidirectional, always flows inward):
-
-```
-Web.UI → Web.Common → Infrastructure → Core
-                ↓
-          Api.Management → Api.Common → Infrastructure → Core
-                ↓
-          Api.Delivery → Api.Common → Infrastructure → Core
-```
-
-**Key Principle**: Core has NO dependencies (pure contracts). Infrastructure implements Core. Web/APIs depend on Infrastructure.
-
-### Project Dependencies
-
-**Core Layer**:
-- `Umbraco.Core` → No dependencies (only Microsoft.Extensions.*)
-
-**Infrastructure Layer**:
-- `Umbraco.Infrastructure` → `Umbraco.Core`
-- `Umbraco.PublishedCache.*` → `Umbraco.Infrastructure`
-- `Umbraco.Examine.Lucene` → `Umbraco.Infrastructure`
-- `Umbraco.Cms.Persistence.*` → `Umbraco.Infrastructure`
-
-**Web Layer**:
-- `Umbraco.Web.Common` → `Umbraco.Infrastructure` + caching + search
-- `Umbraco.Web.UI` → `Umbraco.Web.Common` + all features
-
-**API Layer**:
-- `Umbraco.Cms.Api.Common` → `Umbraco.Web.Common`
-- `Umbraco.Cms.Api.Management` → `Umbraco.Cms.Api.Common`
-- `Umbraco.Cms.Api.Delivery` → `Umbraco.Cms.Api.Common`
-
----
-
-## 3. Teamwork & Collaboration
-
-### Branching Strategy
-
-- **Main branch**: `main` (protected)
-- **Branch naming convention**: `v<version>/<type>/<description>`
-
-**Format**: `v{major-version}/{type}/{kebab-case-description}`
-
-**Version**: Read from `version.json` in the repository root. Use the major version number (e.g., `v17` for version 17.x.x).
-
-**Types**:
-| Type | Use Case |
-|------|----------|
-| `feature` | New feature being introduced to the product |
-| `bugfix` | Fix to an existing issue with the product |
-| `qa` | Adding or updating unit, integration, or end-to-end tests |
-| `improvement` | Update to something that already exists but isn't broken (UI finessing, refactoring) |
-| `task` | Update that doesn't directly impact product behavior (dependency updates, build pipeline) |
-
-**Description**: A short, kebab-case description (a few words). This should be prefixed with the GitHub issue number if the update is related to resolving a tracked issue.
-
-**Examples**:
-```
-v17/bugfix/12345-correct-display-of-pending-migrations
-v17/feature/add-webhook-support
-v17/improvement/optimize-content-cache
-v17/qa/add-media-service-tests
-v17/task/update-ef-core-dependency
-```
-
-See `.github/CONTRIBUTING.md` for full guidelines.
-
-### Pull Request Process
-
-- **PR Template**: `.github/pull_request_template.md`
-- **Required CI Checks**:
-  - All tests pass
-  - Code formatting (dotnet format)
-  - No build warnings
-- **Merge Strategy**: Squash and merge (via GitHub UI)
-- **Reviews**: Required from code owners
-
-#### PR Naming Convention
-
-Use the format: `Area: Description (closes #IssueID)`
-
-**Examples**:
-| Area | Description | Issue |
-|------|-------------|-------|
-| Relations: | Move persistence of relations from repository into notification handlers | (closes #00000) |
-| Management API: | Correct the population of the parent for sibling items when retrieved under a folder | |
-| Docs: | Updated contributing guidelines to welcome contributions on bugfixes | |
-
-**Area**: The feature or aspect affected (e.g., UFM, TipTap, Docs, Segmentation, Migrations). Helps readers quickly understand what is being changed.
-
-**Description Best Practices**:
-- Include the area of change (Relations, Management API, etc.)
-- Describe the change and its impact
-- Be specific, not vague (describe "a golden retriever" not just "a dog")
-
-**Issue Linking**: Add `(closes #IssueID)` to auto-close linked issues on merge.
-
-### Commit Messages
-
-Follow Conventional Commits format:
-```
-<type>(<scope>): <description>
-
-Types: feat, fix, docs, style, refactor, test, chore
-Scope: project name (core, web, api, etc.)
-
-Examples:
-feat(core): add IContentService.GetByIds method
-fix(api): resolve null reference in schema handler
-docs(web): update routing documentation
-```
-
-### Code Owners
-
-Project ownership is distributed across teams. Check individual project directories for ownership.
-
----
-
-## 4. Architecture Patterns
-
-### Core Architectural Decisions
-
-1. **Layered Architecture with Dependency Inversion**
-   - Core defines contracts (interfaces)
-   - Infrastructure implements contracts
-   - Web/APIs consume implementations via DI
-
-2. **Interface-First Design**
-   - All services defined as interfaces in Core
-   - Enables testing, polymorphism, extensibility
-
-3. **Notification Pattern** (not C# events)
-   - See `/src/Umbraco.Core/CLAUDE.md` → "2. Notification System (Event Handling)"
-
-4. **Composer Pattern** (DI registration)
-   - See `/src/Umbraco.Core/CLAUDE.md` → "3. Composer Pattern (DI Registration)"
-
-5. **Scoping Pattern** (Unit of Work)
-   - See `/src/Umbraco.Core/CLAUDE.md` → "5. Scoping Pattern (Unit of Work)"
-
-6. **Attempt Pattern** (operation results)
-   - `Attempt<TResult, TStatus>` instead of exceptions
-   - Strongly-typed operation status enums
-
-### Key Design Patterns Used
-
-- **Repository Pattern** - Data access abstraction
-- **Unit of Work** - Scoping for transactions
-- **Builder Pattern** - `ProblemDetailsBuilder` for API errors
-- **Strategy Pattern** - OpenAPI handlers (schema ID, operation ID)
-- **Options Pattern** - All configuration via `IOptions<T>`
-- **Factory Pattern** - Content type factories
-- **Mediator Pattern** - Notification aggregator
-
----
-
-## 5. Project-Specific Notes
-
-### Centralized Package Management
-
-**All NuGet package versions** are centralized in `Directory.Packages.props`. Individual projects do NOT specify versions.
-
-```xml
-<!-- Individual projects reference WITHOUT version -->
-<PackageReference Include="Swashbuckle.AspNetCore" />
-
-<!-- Versions defined in Directory.Packages.props -->
-<PackageVersion Include="Swashbuckle.AspNetCore" Version="6.5.0" />
-```
-
-### Build Configuration
-
-- `Directory.Build.props` - Shared properties (target framework, company, copyright)
-- `.editorconfig` - Code style rules
-- `.globalconfig` - Roslyn analyzer rules
-
-### Persistence Layer - NPoco and EF Core
-
-The repository contains BOTH (actively supported):
-- **Current**: NPoco-based persistence (`Umbraco.Cms.Persistence.Sqlite`, `Umbraco.Cms.Persistence.SqlServer`) - widely used and fully supported
-- **Future**: EF Core-based persistence (`Umbraco.Cms.Persistence.EFCore.*`) - migration in progress
-
-**Note**: The codebase is actively migrating to EF Core, but NPoco remains the primary persistence layer and is not deprecated. Both are fully supported.
-
-### Authentication: OpenIddict
-
-All APIs use **OpenIddict** (OAuth 2.0/OpenID Connect):
-- Reference tokens (not JWT) for better security
-- **Secure cookie-based token storage** (v17+) - tokens stored in HTTP-only cookies with `__Host-` prefix
-- Tokens are redacted from client-side responses and passed via secure cookies only
-- ASP.NET Core Data Protection for token encryption
-- Configured in `Umbraco.Cms.Api.Common`
-- API requests must include credentials (`credentials: include` for fetch)
-
-**Load Balancing Requirement**: All servers must share the same Data Protection key ring.
-
-### Content Caching Strategy
-
-**HybridCache** (`Umbraco.PublishedCache.HybridCache`):
-- In-memory cache + distributed cache support
-- Published content only (not draft)
-- Invalidated via notifications and cache refreshers
-
-### API Versioning
-
-APIs use `Asp.Versioning.Mvc`:
-- Management API: `/umbraco/management/api/v{version}/*`
-- Delivery API: `/umbraco/delivery/api/v{version}/*`
-- OpenAPI/Swagger docs per version
-
-### Known Limitations
-
-1. **Circular Dependencies**: Avoided via `Lazy<T>` or event notifications
-2. **Multi-Server**: Requires shared Data Protection key ring and synchronized clocks (NTP)
-3. **Database Support**: SQL Server, SQLite
-
----
-
-## Quick Reference
-
-### Essential Commands
-
-```bash
-# Build solution
-dotnet build
-
-# Run all tests
-dotnet test
-
-# Run specific test category
-dotnet test --filter "Category=Integration"
-
-# Format code
-dotnet format
-
-# Pack all projects
-dotnet pack -c Release
-```
-
-### Key Projects
-
-| Project | Type | Description |
-|---------|------|-------------|
-| **Umbraco.Core** | Library | Interface contracts and domain models |
-| **Umbraco.Infrastructure** | Library | Service implementations and data access |
-| **Umbraco.Web.UI** | Application | Main web application (Razor/MVC) |
-| **Umbraco.Cms.Api.Management** | Library | Management API (backoffice) |
-| **Umbraco.Cms.Api.Delivery** | Library | Delivery API (headless CMS) |
-| **Umbraco.Cms.Api.Common** | Library | Shared API infrastructure |
-| **Umbraco.PublishedCache.HybridCache** | Library | Published content caching |
-| **Umbraco.Examine.Lucene** | Library | Full-text search indexing |
-
-### Important Files
-
-- **Solution**: `umbraco.sln`
-- **Build Config**: `Directory.Build.props`, `Directory.Packages.props`
-- **Code Style**: `.editorconfig`, `.globalconfig`
-- **Documentation**: `/CLAUDE.md`, `/src/Umbraco.Core/CLAUDE.md`, `/src/Umbraco.Cms.Api.Common/CLAUDE.md`
-
-### Project-Specific Documentation
-
-For detailed information about individual projects, see their CLAUDE.md files:
-- **Core Architecture**: `/src/Umbraco.Core/CLAUDE.md` - Service contracts, notification patterns
-- **API Infrastructure**: `/src/Umbraco.Cms.Api.Common/CLAUDE.md` - OpenAPI, authentication, serialization
-
-### Getting Help
-
-- **Official Docs**: https://docs.umbraco.com/
-- **Contributing Guide**: `.github/CONTRIBUTING.md`
-- **Issues**: https://github.com/umbraco/Umbraco-CMS/issues
-- **Community**: https://forum.umbraco.com/
-- **Releases**: https://releases.umbraco.com/
-
----
-
-**This repository follows a layered architecture with strict dependency rules. The Core defines contracts, Infrastructure implements them, and Web/APIs consume them. Each layer can be understood independently, but dependencies always flow inward toward Core.**

Directory.Build.props

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Project>
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Company>Umbraco HQ</Company>
     <Authors>Umbraco</Authors>
     <Copyright>Copyright © Umbraco $([System.DateTime]::Today.ToString('yyyy'))</Copyright>
@@ -20,7 +20,6 @@
     <WarnOnPackingNonPackableProject>false</WarnOnPackingNonPackableProject>
   </PropertyGroup>
 
-
   <PropertyGroup>
     <!--
       TODO: Fix and remove overrides:
@@ -41,7 +40,7 @@
   <PropertyGroup>
     <GenerateCompatibilitySuppressionFile>false</GenerateCompatibilitySuppressionFile>
     <EnablePackageValidation>true</EnablePackageValidation>
-    <PackageValidationBaselineVersion>17.0.0</PackageValidationBaselineVersion>
+    <PackageValidationBaselineVersion>15.0.0</PackageValidationBaselineVersion>
     <EnableStrictModeForCompatibleFrameworksInPackage>true</EnableStrictModeForCompatibleFrameworksInPackage>
     <EnableStrictModeForCompatibleTfms>true</EnableStrictModeForCompatibleTfms>
   </PropertyGroup>

Directory.Packages.props

@@ -2,90 +2,102 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
   <!-- Global packages (private, build-time packages for all projects) -->
   <ItemGroup>
-    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.9.50" />
+    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.6.146" />
     <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
-    <GlobalPackageReference Include="Umbraco.Code" Version="2.4.0" />
+    <GlobalPackageReference Include="Umbraco.Code" Version="2.2.0" />
     <GlobalPackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" />
   </ItemGroup>
   <!-- Microsoft packages -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.14.0" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.2.0" />
-    <PackageVersion Include="System.Linq.Async" Version="7.0.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="9.0.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.10.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.10" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="9.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="9.0.0-preview.9.24556.5" />
   </ItemGroup>
   <!-- Umbraco packages -->
   <ItemGroup>
     <PackageVersion Include="Umbraco.JsonSchema.Extensions" Version="0.3.0" />
+    <PackageVersion Include="Umbraco.CSharpTest.Net.Collections" Version="15.0.0" />
   </ItemGroup>
   <!-- Third-party packages -->
   <ItemGroup>
-    <PackageVersion Include="Asp.Versioning.Mvc" Version="8.1.1" />
-    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="8.1.1" />
+    <PackageVersion Include="Asp.Versioning.Mvc" Version="8.1.0" />
+    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="8.1.0" />
     <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
     <PackageVersion Include="Examine" Version="3.7.1" />
     <PackageVersion Include="Examine.Core" Version="3.7.1" />
-    <PackageVersion Include="HtmlAgilityPack" Version="1.12.4" />
-    <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
+    <PackageVersion Include="HtmlAgilityPack" Version="1.11.74" />
+    <PackageVersion Include="JsonPatch.Net" Version="3.1.1" />
     <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
-    <PackageVersion Include="MailKit" Version="4.14.1" />
-    <PackageVersion Include="Markdig" Version="0.44.0" />
+    <PackageVersion Include="MailKit" Version="4.10.0" />
     <PackageVersion Include="Markdown" Version="2.2.1" />
-    <PackageVersion Include="MessagePack" Version="3.1.4" />
-    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
+    <PackageVersion Include="MessagePack" Version="2.5.192" />
+    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.3.8" />
     <PackageVersion Include="MiniProfiler.Shared" Version="4.5.4" />
-    <PackageVersion Include="ncrontab" Version="3.4.0" />
-    <PackageVersion Include="NPoco" Version="6.1.0" />
-    <PackageVersion Include="NPoco.SqlServer" Version="6.1.0" />
-    <PackageVersion Include="OpenIddict.Abstractions" Version="7.2.0" />
-    <PackageVersion Include="OpenIddict.AspNetCore" Version="7.2.0" />
-    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="7.2.0" />
-    <PackageVersion Include="Serilog" Version="4.3.0" />
-    <PackageVersion Include="Serilog.AspNetCore" Version="9.0.0" />
+    <PackageVersion Include="ncrontab" Version="3.3.3" />
+    <PackageVersion Include="NPoco" Version="5.7.1" />
+    <PackageVersion Include="NPoco.SqlServer" Version="5.7.1" />
+    <PackageVersion Include="OpenIddict.Abstractions" Version="6.1.1" />
+    <PackageVersion Include="OpenIddict.AspNetCore" Version="6.1.1" />
+    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="6.1.1" />
+    <PackageVersion Include="Serilog" Version="4.2.0" />
+    <PackageVersion Include="Serilog.AspNetCore" Version="8.0.3" />
     <PackageVersion Include="Serilog.Enrichers.Process" Version="3.0.0" />
     <PackageVersion Include="Serilog.Enrichers.Thread" Version="4.0.0" />
     <PackageVersion Include="Serilog.Expressions" Version="5.0.0" />
-    <PackageVersion Include="Serilog.Extensions.Hosting" Version="9.0.0" />
+    <PackageVersion Include="Serilog.Extensions.Hosting" Version="8.0.0" />
     <PackageVersion Include="Serilog.Formatting.Compact" Version="3.0.0" />
     <PackageVersion Include="Serilog.Formatting.Compact.Reader" Version="4.0.0" />
-    <PackageVersion Include="Serilog.Settings.Configuration" Version="9.0.0" />
+    <PackageVersion Include="Serilog.Settings.Configuration" Version="8.0.4" />
     <PackageVersion Include="Serilog.Sinks.Async" Version="2.1.0" />
-    <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
+    <PackageVersion Include="Serilog.Sinks.File" Version="6.0.0" />
     <PackageVersion Include="Serilog.Sinks.Map" Version="2.0.0" />
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
-    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.2.0" />
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.1.0" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.7" />
+    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.3" />
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="7.1.0" />
   </ItemGroup>
   <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
   <ItemGroup>
-    <!-- Dazinator.Extensions.FileProviders references vulnerable versions of the following: -->
-    <!-- TODO (V18): Remove these pinned dependencies when the Dazinator.Extensions.FileProviders dependency is removed. -->
+    <!-- Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer brings in a vulnerable version of Azure.Identity -->
+    <!-- Take top-level depedendency on Azure.Identity, because Microsoft.EntityFrameworkCore.SqlServer depends on a vulnerable version -->
+    <PackageVersion Include="Azure.Identity" Version="1.13.1" />
+    <!-- Microsoft.EntityFrameworkCore.SqlServer brings in a vulnerable version of System.Runtime.Caching -->
+    <PackageVersion Include="System.Runtime.Caching" Version="9.0.0" />
+    <!-- Dazinator.Extensions.FileProviders brings in a vulnerable version of System.Net.Http -->
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
-    <PackageVersion Include="System.Private.Uri" Version="4.3.2" />
-    <!-- Markdown references vulnerable version of the following: -->
-    <!-- TODO (V19): Remove these pinned dependencies when the Markdown dependency is removed. -->
+    <!-- Examine brings in a vulnerable version of System.Security.Cryptography.Xml -->
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="9.0.0" />
+    <!-- Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc brings in a vulnerable version of System.Text.RegularExpressions -->
     <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
+    <!-- OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer brings in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
+    <!-- Take top-level depedendency on Microsoft.IdentityModel.JsonWebTokens, because OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer depends on a vulnerable version -->
+    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.2.1" />
+    <!-- Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer and Dazinator.Extensions.FileProviders brings in a legacy version of System.Text.Encodings.Web -->
+    <PackageVersion Include="System.Text.Encodings.Web" Version="9.0.0" />
+    <!-- NPoco.SqlServer brings in a vulnerable version of Microsoft.Data.SqlClient  -->
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.2" />
+    <!-- Examine.Lucene brings in a vulnerable version of Lucene.Net.Replicator -->
+    <PackageVersion Include="Lucene.Net.Replicator" Version="4.8.0-beta00017" />
   </ItemGroup>
 </Project>

NOTICES.txt

@@ -3,9 +3,7 @@ Third-Party Notices
 
 This file contains notices and attributions for third-party software used in the Umbraco CMS project.
 
-Third-party software may contain dependencies that are not explicitly listed here.
-
-This notice is not a license and does not grant any rights to use the third-party software.
+It is not a license and does not grant any rights to use the third-party software.
 
 Umbraco CMS is licensed under the MIT License, which can be found in the LICENSE file.
 
@@ -115,6 +113,14 @@ Copyright: 2023 Shannon Deminick
 
 ---
 
+Glob: A library for matching file paths using glob patterns
+
+URL: https://github.com/isaacs/node-glob
+License: ISC License
+Copyright: 2009-2023 Isaac Z. Schlueter and Contributors
+
+---
+
 Globals: A library for managing global variables in JavaScript
 
 URL: https://github.com/sindresorhus/globals
@@ -196,14 +202,6 @@ Copyright: 2013-2024 .NET Foundation and Contributors
 
 ---
 
-Markdig: A fast, powerful, CommonMark compliant, extensible Markdown processor for .NET
-
-URL: https://github.com/xoofx/markdig
-License: BSD-2-Clause license
-Copyright: 2018+, Alexandre Mutel. All rights reserved.
-
----
-
 Markdown: A library for parsing and compiling Markdown
 
 URL: https://github.com/hey-red/Markdown
@@ -358,6 +356,38 @@ Copyright: Titus Wormer
 
 ---
 
+Rollup: A module bundler for JavaScript
+
+URL: https://rollupjs.org/
+License: MIT License
+Copyright: 2015-present Rollup contributors
+
+---
+
+Rollup Plugins: A collection of Rollup plugins
+
+URL: https://github.com/rollup/plugins
+License: MIT License
+Copyright: 2019-present Rollup Plugins contributors
+
+---
+
+Rollup-plugin-esbuild: A Rollup plugin for using esbuild
+
+URL: https://github.com/egoist/rollup-plugin-esbuild
+License: MIT License
+Copyright: 2020 EGOIST
+
+---
+
+Rollup-plugin-import-css: A Rollup plugin for importing CSS files
+
+URL: https://github.com/jleeson/rollup-plugin-import-css
+License: MIT License
+Copyright: 2020 Jacob Leeson
+
+---
+
 rxjs: Reactive Extensions for JavaScript
 
 URL: https://rxjs.dev/
@@ -422,6 +452,14 @@ Copyright: 2018 Terkel
 
 ---
 
+TinyMCE, version 6.x: A rich text editor for the web
+
+URL: https://www.tiny.cloud/
+License: MIT License
+Copyright: 2022 Ephox Corporation DBA Tiny Technologies, Inc.
+
+---
+
 Tiptap: A renderless rich-text editor for the web
 
 URL: https://tiptap.dev/

build/azure-pipelines.yml

@@ -34,10 +34,6 @@ parameters:
     displayName: Upload API docs
     type: boolean
     default: false
-  - name: uploadDependencyTrack
-    displayName: Upload BOMs to Dependency Track
-    type: boolean
-    default: false
   - name: forceReleaseTestFilter
     displayName: Force to use the release test filters
     type: boolean
@@ -107,15 +103,6 @@ stages:
               command: build
               projects: $(solution)
               arguments: "--configuration $(buildConfiguration) --no-restore --property:ContinuousIntegrationBuild=true --property:GeneratePackageOnBuild=true --property:PackageOutputPath=$(Build.ArtifactStagingDirectory)/nupkg"
-          - powershell: |
-              dotnet tool install --global CycloneDX
-              dotnet-CycloneDX $(solution) --output $(Build.ArtifactStagingDirectory)/bom --filename bom-dotnet.xml
-            displayName: 'Generate Backend BOM'
-          - powershell: |
-              npm install --global @cyclonedx/cyclonedx-npm
-              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)\bom\bom-login.xml --ignore-npm-errors --verbose
-            displayName: Generate Login UI BOM
-            workingDirectory: src/Umbraco.Web.UI.Login
           - task: PublishPipelineArtifact@1
             displayName: Publish nupkg
             inputs:
@@ -126,11 +113,6 @@ stages:
             inputs:
               targetPath: $(Build.SourcesDirectory)
               artifactName: build_output
-          - task: PublishPipelineArtifact@1
-            displayName: Publish Backend BOM
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)/bom
-              artifactName: bom-backend
 
       - job: B
         displayName: Build Bellissima Package
@@ -142,11 +124,6 @@ stages:
             lfs: false,
             fetchDepth: 500
           - template: templates/backoffice-install.yml
-          - powershell: |
-              npm install --global @cyclonedx/cyclonedx-npm
-              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-backoffice.xml --ignore-npm-errors --verbose
-            displayName: Generate Backoffice UI BOM
-            workingDirectory: src/Umbraco.Web.UI.Client
           - script: npm run build:for:npm
             displayName: Run build:for:npm
             workingDirectory: src/Umbraco.Web.UI.Client
@@ -163,35 +140,6 @@ stages:
             inputs:
               targetPath: $(Build.ArtifactStagingDirectory)/npm
               artifactName: npm
-          - publish: $(Build.ArtifactStagingDirectory)/bom
-            artifact: bom-frontend
-            displayName: 'Publish Frontend BOM'
-
-  - stage: E2E_BOM
-    displayName: E2E Tests BOM Generation
-    dependsOn: []
-    jobs:
-    - job:
-      displayName: E2E Generate BOM
-      pool:
-        vmImage: "ubuntu-latest"
-      steps:
-        - checkout: self
-          submodules: false
-          lfs: false,
-          fetchDepth: 500
-        - template: templates/e2e-install.yml
-          parameters:
-            nodeVersion: ${{ variables.nodeVersion }}
-            npm_config_cache: ${{ variables.npm_config_cache }}
-        - powershell: |
-            npm install --global @cyclonedx/cyclonedx-npm
-            cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-e2e.xml --ignore-npm-errors --verbose
-          displayName: Generate E2E Tests BOM
-          workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-        - publish: $(Build.ArtifactStagingDirectory)/bom
-          artifact: bom-e2e
-          displayName: 'Publish E2E BOM'
 
   - stage: Build_Docs
     condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.buildApiDocs}}))
@@ -201,56 +149,53 @@ stages:
       umbracoMajorVersion: $[ stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'] ]
     jobs:
       # C# API Reference
-      # This job is disabled due to failures in correct generation of the docs when running on the pipeline.
-      # API docs are currently manually generated locally and uploaded to blob storage.
-      # TODO: Investigate and resolve this issue such that doc generation and upload can be restored to the pipeline.
-      # - job:
-        # displayName: Build C# API Reference
-        # pool:
-          # vmImage: "windows-latest"
-        # steps:
-          # - task: UseDotNet@2
-            # displayName: Use .NET SDK from global.json
-            # inputs:
-              # useGlobalJson: true
-          # - task: PowerShell@2
-            # displayName: Install DocFX
-            # inputs:
-              # targetType: inline
-              # script: |
-                # choco install docfx --version=2.59.4 -y
-                # if ($lastexitcode -ne 0){
-                    # throw ("Error installing DocFX")
-                # }
-          # - task: PowerShell@2
-            # displayName: Generate metadata
-            # inputs:
-              # targetType: inline
-              # script: |
-                # docfx metadata "$(Build.SourcesDirectory)/build/csharp-docs/docfx.json"
-                # if ($lastexitcode -ne 0){
-                    # throw ("Error generating metadata.")
-                # }
-          # - task: PowerShell@2
-            # displayName: Generate documentation
-            # inputs:
-              # targetType: inline
-              # script: |
-                # docfx build "$(Build.SourcesDirectory)/build/csharp-docs/docfx.json"
-                # if ($lastexitcode -ne 0){
-                      # throw ("Error generating documentation.")
-                # }
-          # - task: ArchiveFiles@2
-            # displayName: Archive C# Docs
-            # inputs:
-              # rootFolderOrFile: $(Build.SourcesDirectory)/build/csharp-docs/_site
-              # includeRootFolder: false
-              # archiveFile: $(Build.ArtifactStagingDirectory)/csharp-docs.zip
-          # - task: PublishPipelineArtifact@1
-            # displayName: Publish C# Docs
-            # inputs:
-              # targetPath: $(Build.ArtifactStagingDirectory)/csharp-docs.zip
-              # artifact: csharp-docs
+      - job:
+        displayName: Build C# API Reference
+        pool:
+          vmImage: "windows-latest"
+        steps:
+          - task: UseDotNet@2
+            displayName: Use .NET SDK from global.json
+            inputs:
+              useGlobalJson: true
+          - task: PowerShell@2
+            displayName: Install DocFX
+            inputs:
+              targetType: inline
+              script: |
+                choco install docfx --version=2.59.4 -y
+                if ($lastexitcode -ne 0){
+                    throw ("Error installing DocFX")
+                }
+          - task: PowerShell@2
+            displayName: Generate metadata
+            inputs:
+              targetType: inline
+              script: |
+                docfx metadata "$(Build.SourcesDirectory)/build/csharp-docs/docfx.json"
+                if ($lastexitcode -ne 0){
+                    throw ("Error generating metadata.")
+                }
+          - task: PowerShell@2
+            displayName: Generate documentation
+            inputs:
+              targetType: inline
+              script: |
+                docfx build "$(Build.SourcesDirectory)/build/csharp-docs/docfx.json"
+                if ($lastexitcode -ne 0){
+                      throw ("Error generating documentation.")
+                }
+          - task: ArchiveFiles@2
+            displayName: Archive C# Docs
+            inputs:
+              rootFolderOrFile: $(Build.SourcesDirectory)/build/csharp-docs/_site
+              includeRootFolder: false
+              archiveFile: $(Build.ArtifactStagingDirectory)/csharp-docs.zip
+          - task: PublishPipelineArtifact@1
+            displayName: Publish C# Docs
+            inputs:
+              targetPath: $(Build.ArtifactStagingDirectory)/csharp-docs.zip
+              artifact: csharp-docs
 
       # js API Reference
       - job:
@@ -368,7 +313,7 @@ stages:
               testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
             LinuxPart3Of3:
               vmImage: "ubuntu-latest"
-              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace
+              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
               testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
             macOSPart1Of3:
               vmImage: "macOS-latest"
@@ -380,7 +325,7 @@ stages:
               testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
             macOSPart3Of3:
               vmImage: "macOS-latest"
-              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure and the ManagementApi namespace
+              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
               testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
         pool:
           vmImage: $(vmImage)
@@ -444,7 +389,7 @@ stages:
               vmImage: "windows-latest"
               Tests__Database__DatabaseType: LocalDb
               Tests__Database__SQLServerMasterConnectionString: N/A
-              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace
+              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
               testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
             LinuxPart1Of3:
               vmImage: "ubuntu-latest"
@@ -465,7 +410,7 @@ stages:
               SA_PASSWORD: UmbracoIntegration123!
               Tests__Database__DatabaseType: SqlServer
               Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
-              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace
+              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
               testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
         pool:
           vmImage: $(vmImage)
@@ -568,9 +513,9 @@ stages:
       UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL: https://localhost:44331/
       ASPNETCORE_URLS: https://localhost:44331
     jobs:
-      # E2E Smoke Tests
+      # E2E Tests
       - job:
-        displayName: E2E Smoke Tests (SQLite)
+        displayName: E2E Tests (SQLite)
         # currently disabled due to DB locks randomly occuring.
         condition: eq(${{parameters.sqliteAcceptanceTests}}, True)
         variables:
@@ -578,7 +523,6 @@ stages:
           CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=Umbraco;Mode=Memory;Cache=Shared;Foreign Keys=True;Pooling=True
           CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.Sqlite
           DatabaseType: SQLite
-          additionalEnvironmentVariables: false
         strategy:
           matrix:
             LinuxPart1Of3:
@@ -635,7 +579,6 @@ stages:
             parameters:
               DatabaseType: ${{ variables.DatabaseType }}
               buildConfiguration: ${{ variables.buildConfiguration }}
-              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}
 
           # Run tests Template
           - template: nightly-E2E-run-tests-template.yml
@@ -645,14 +588,13 @@ stages:
               DatabaseType: ${{ variables.DatabaseType }}
 
       - job:
-        displayName: E2E Smoke Tests (SQL Server)
+        displayName: E2E Tests (SQL Server)
         variables:
           # Connection string
           CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
           CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
           SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
           DatabaseType: SQLServer
-          additionalEnvironmentVariables: false
         strategy:
           matrix:
             ${{ if eq(parameters.sqlServerLinuxAcceptanceTests, True) }}:
@@ -714,7 +656,6 @@ stages:
               SA_PASSWORD: ${{ variables.SA_PASSWORD }}
               buildConfiguration: ${{ variables.buildConfiguration }}
               DatabaseType: ${{ variables.DatabaseType }}
-              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}
 
           # Run tests Template
           - template: nightly-E2E-run-tests-template.yml
@@ -723,34 +664,6 @@ stages:
               ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
               DatabaseType: ${{ variables.DatabaseType }}
 
-  - stage: Dependency_Track
-    displayName: Dependency Track
-    dependsOn:
-      - Build
-      - E2E_BOM
-    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadDependencyTrack}}))
-    variables:
-      # Determine Umbraco version based on whether it's a public release or not. If public release, use major version, else use full NuGet package version.
-      umbracoVersion: $[ iif(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'], stageDependencies.Build.A.outputs['build.NBGV_NuGetPackageVersion']) ]
-    jobs:
-      - template: templates/dependency-track.yml
-        parameters:
-          projectName: "Umbraco-CMS"
-          umbracoVersion: $(umbracoVersion)
-          projects:
-            - name: "Backend"
-              artifact: "bom-backend"
-              bomFilePath: "bom-dotnet.xml"
-            - name: "Login"
-              artifact: "bom-backend"
-              bomFilePath: "bom-login.xml"
-            - name: "Backoffice"
-              artifact: "bom-frontend"
-              bomFilePath: "bom-backoffice.xml"
-            - name: "E2E"
-              artifact: "bom-e2e"
-              bomFilePath: "bom-e2e.xml"
-
   ###############################################
   ## Release
   ###############################################
@@ -885,33 +798,30 @@ stages:
       - Deploy_NuGet
     condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadApiDocs}}))
     jobs:
-      # This job is disabled due to failures in correct generation of the docs when running on the pipeline.
-      # API docs are currently manually generated locally and uploaded to blob storage.
-      # TODO: Investigate and resolve this issue such that doc generation and upload can be restored to the pipeline.
-      # - job:
-        # displayName: Upload C# Docs
-        # steps:
-          # - checkout: none
-          # - task: DownloadPipelineArtifact@2
-            # displayName: Download artifact
-            # inputs:
-              # artifact: csharp-docs
-              # path: $(Build.SourcesDirectory)
-          # - task: ExtractFiles@1
-            # inputs:
-              # archiveFilePatterns: $(Build.SourcesDirectory)/csharp-docs.zip
-              # destinationFolder: $(Build.ArtifactStagingDirectory)/csharp-docs
-              # overwriteExistingFiles: true
-          # - task: AzureFileCopy@4
-            # displayName: "Copy C# Docs to blob storage"
-            # inputs:
-              # SourcePath: "$(Build.ArtifactStagingDirectory)/csharp-docs/*"
-              # azureSubscription: umbraco-storage
-              # Destination: AzureBlob
-              # storage: umbracoapidocs
-              # ContainerName: "$web"
-              # BlobPrefix: v$(umbracoMajorVersion)/csharp
-              # CleanTargetBeforeCopy: true
+      - job:
+        displayName: Upload C# Docs
+        steps:
+          - checkout: none
+          - task: DownloadPipelineArtifact@2
+            displayName: Download artifact
+            inputs:
+              artifact: csharp-docs
+              path: $(Build.SourcesDirectory)
+          - task: ExtractFiles@1
+            inputs:
+              archiveFilePatterns: $(Build.SourcesDirectory)/csharp-docs.zip
+              destinationFolder: $(Build.ArtifactStagingDirectory)/csharp-docs
+              overwriteExistingFiles: true
+          - task: AzureFileCopy@4
+            displayName: "Copy C# Docs to blob storage"
+            inputs:
+              SourcePath: "$(Build.ArtifactStagingDirectory)/csharp-docs/*"
+              azureSubscription: umbraco-storage
+              Destination: AzureBlob
+              storage: umbracoapidocs
+              ContainerName: "$web"
+              BlobPrefix: v$(umbracoMajorVersion)/csharp
+              CleanTargetBeforeCopy: true
       - job:
         displayName: Upload Storybook
         steps:
@@ -960,4 +870,3 @@ stages:
               ContainerName: "$web"
               BlobPrefix: v$(umbracoMajorVersion)/ui-api
               CleanTargetBeforeCopy: true
-

build/nightly-E2E-build-template.yml

@@ -8,8 +8,8 @@
     default: ''
 
   - name: additionalEnvironmentVariables
-    type: string
-    default: 'false'
+    type: boolean
+    default: False
 
 steps:
   - pwsh: |
@@ -66,9 +66,10 @@ steps:
     displayName: Update application to use necessary classes
     workingDirectory: $(Agent.BuildDirectory)/app
 
-  - pwsh: |
-      dotnet build UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-restore
-      dotnet dev-certs https
-    displayName: Build application
-    workingDirectory: $(Agent.BuildDirectory)/app
-    condition: and(succeeded(), eq(variables['additionalEnvironmentVariables'], 'false'))
+  - ${{ if eq(parameters.additionalEnvironmentVariables, False) }}:
+      - pwsh: |
+          dotnet build UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-restore
+          dotnet dev-certs https
+        displayName: Build application
+        workingDirectory: $(Agent.BuildDirectory)/app
+        condition: succeeded()

build/nightly-E2E-run-application-template.yml

@@ -8,8 +8,8 @@
     default: ''
 
   - name: additionalEnvironmentVariables
-    type: string
-    default: 'false'
+    type: boolean
+    default: False
 
   - name: DatabaseType
     type: string
@@ -28,18 +28,20 @@ steps:
         displayName: Start SQL Server LocalDB (Windows)
         condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
 
-  # Run application for Linux
-  - bash: |
-      nohup dotnet run --project UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
-      echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
-    displayName: Run application (Linux)
-    condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'), eq(variables['additionalEnvironmentVariables'], 'false'))
-    workingDirectory: $(Agent.BuildDirectory)/app
+  # If we want to add additional environment variables to the run step, then we will skip these
+  - ${{ if eq(parameters.additionalEnvironmentVariables, False) }}:
+      # Run application for Linux
+      - bash: |
+          nohup dotnet run --project UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
+          echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
+        displayName: Run application (Linux)
+        condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+        workingDirectory: $(Agent.BuildDirectory)/app
 
-  # Run application for Windows
-  - pwsh: |
-      $process = Start-Process dotnet "run --project UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
-      Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
-    displayName: Run application (Windows)
-    condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'), eq(variables['additionalEnvironmentVariables'], 'false'))
-    workingDirectory: $(Agent.BuildDirectory)/app
+      # Run application for Windows
+      - pwsh: |
+          $process = Start-Process dotnet "run --project UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
+          Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
+        displayName: Run application (Windows)
+        condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+        workingDirectory: $(Agent.BuildDirectory)/app

build/nightly-E2E-setup-template.yml

@@ -26,18 +26,37 @@ steps:
       artifact: nupkg
       path: $(Agent.BuildDirectory)/app/nupkg
 
+  - task: NodeTool@0
+    displayName: Use Node.js $(nodeVersion)
+    inputs:
+      versionSpec: $(nodeVersion)
+
   - task: UseDotNet@2
     displayName: Use .NET SDK from global.json
     inputs:
       useGlobalJson: true
 
-  - template: templates/e2e-install.yml
-    parameters:
-      nodeVersion: ${{ parameters.nodeVersion }}
-      npm_config_cache: ${{ parameters.npm_config_cache }}
-      PlaywrightUserEmail: ${{ parameters.PlaywrightUserEmail }}
-      PlaywrightPassword: ${{ parameters.PlaywrightPassword }}
-      ASPNETCORE_URLS: ${{ parameters.ASPNETCORE_URLS }}
+  - pwsh: |
+      "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
+      UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
+      URL=${{ parameters.ASPNETCORE_URLS }}
+      STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json" | Out-File .env
+    displayName: Generate .env
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+
+  # Cache and restore NPM packages
+  - task: Cache@2
+    displayName: Cache NPM packages
+    inputs:
+      key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
+      restoreKeys: |
+        npm_e2e | "$(Agent.OS)"
+        npm_e2e
+      path: ${{ parameters.npm_config_cache }}
+
+  - script: npm ci --no-fund --no-audit --prefer-offline
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+    displayName: Restore NPM packages
 
   # Install Template
   - pwsh: |

build/nightly-E2E-test-pipelines.yml

@@ -3,23 +3,17 @@ name: Nightly_E2E_Test_$(TeamProject)_$(Build.DefinitionName)_$(SourceBranchName
 pr: none
 trigger: none
 
-schedules:
-  - cron: '0 0 * * *'
-    displayName: Daily midnight build
-    branches:
-      include:
-        - v15/dev
-        - v16/dev
-        - main
+# schedules:
+#   - cron: '0 0 * * *'
+#     displayName: Daily midnight build
+#     branches:
+#       include:
+#         - v14/dev
+#         - v15/dev
 
 parameters:
-  - name: skipIntegrationTests
-    displayName: Skip integration tests
-    type: boolean
-    default: false
-
-  - name: skipDifferentAppSettingsAcceptanceTests
-    displayName: Skip acceptance tests with different app settings
+  - name: differentAppSettingsAcceptanceTests
+    displayName: Run acceptance tests with different app settings
     type: boolean
     default: false
 
@@ -28,11 +22,10 @@ parameters:
     type: boolean
     default: false
 
-  # Can we slow our tests down when running on SQLite? That way we might be able to avoid DB locks
-  - name: skipSqliteAcceptanceTests
-    displayName: Skip SQLite acceptance tests
+  - name: skipIntegrationTests
+    displayName: Skip integration tests
     type: boolean
-    default: true
+    default: false
 
 variables:
   nodeVersion: 20
@@ -115,7 +108,6 @@ stages:
             inputs:
               targetPath: $(Build.ArtifactStagingDirectory)/npm
               artifactName: npm
-
   - stage: Integration
     displayName: Integration Tests
     dependsOn: Build
@@ -348,13 +340,12 @@ stages:
       - job:
         displayName: E2E Tests (SQLite)
         timeoutInMinutes: 180
-        condition: ${{ and(eq(parameters.skipDefaultConfigAcceptanceTests, false), eq(parameters.skipSqliteAcceptanceTests, false)) }}
+        condition: ${{ eq(parameters.skipDefaultConfigAcceptanceTests, false) }}
         variables:
           # Connection string
           CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=Umbraco;Mode=Memory;Cache=Shared;Foreign Keys=True;Pooling=True
           CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.Sqlite
           DatabaseType: SQLite
-          additionalEnvironmentVariables: false
         strategy:
           matrix:
             LinuxPart1Of3:
@@ -411,7 +402,6 @@ stages:
             parameters:
               DatabaseType: ${{ variables.DatabaseType }}
               buildConfiguration: ${{ variables.buildConfiguration }}
-              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}
 
           # Run tests Template
           - template: nightly-E2E-run-tests-template.yml
@@ -430,7 +420,6 @@ stages:
           CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
           DatabaseType: SQLServer
           SA_PASSWORD: UmbracoAcceptance123!
-          additionalEnvironmentVariables: false
         strategy:
           matrix:
             LinuxPart1Of3:
@@ -449,15 +438,15 @@ stages:
               vmImage: "ubuntu-latest"
               CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
             WindowsPart1Of3:
-              testCommand: "npm run testWindows -- --shard=1/3"
+              testCommand: "npm run test -- --shard=1/3"
               testFolder: "DefaultConfig"
               vmImage: "windows-latest"
             WindowsPart2Of3:
-              testCommand: "npm run testWindows -- --shard=2/3"
+              testCommand: "npm run test -- --shard=2/3"
               testFolder: "DefaultConfig"
               vmImage: "windows-latest"
             WindowsPart3Of3:
-              testCommand: "npm run testWindows -- --shard=3/3"
+              testCommand: "npm run test -- --shard=3/3"
               testFolder: "DefaultConfig"
               vmImage: "windows-latest"
         pool:
@@ -491,7 +480,6 @@ stages:
               SA_PASSWORD: ${{ variables.SA_PASSWORD }}
               buildConfiguration: ${{ variables.buildConfiguration }}
               DatabaseType: ${{ variables.DatabaseType }}
-              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}
 
           # Run tests Template
           - template: nightly-E2E-run-tests-template.yml
@@ -511,7 +499,7 @@ stages:
     jobs:
       - job:
         displayName: E2E Tests with Different App settings (SQL Server)
-        condition: ${{ eq(parameters.skipDifferentAppSettingsAcceptanceTests, false) }}
+        condition: ${{ eq(parameters.differentAppSettingsAcceptanceTests, true) }}
         timeoutInMinutes: 180
         variables:
           SA_PASSWORD: UmbracoAcceptance123!
@@ -553,66 +541,6 @@ stages:
               CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
               CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
               additionalEnvironmentVariables: true
-            # ExtensionRegistry
-            WindowsExtensionRegistry:
-              vmImage: "windows-latest"
-              testFolder: "ExtensionRegistry"
-              port: ''
-              testCommand: "npx playwright test --project=extensionRegistry"
-              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
-              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-              additionalEnvironmentVariables: false
-            LinuxExtensionRegistry:
-              vmImage: "ubuntu-latest"
-              testFolder: "ExtensionRegistry"
-              port: ''
-              testCommand: "npx playwright test --project=extensionRegistry"
-              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
-              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-              additionalEnvironmentVariables: false
-            # EntityDataPicker
-            WindowsEntityDataPicker:
-              vmImage: "windows-latest"
-              testFolder: "EntityDataPicker"
-              port: ''
-              testCommand: "npx playwright test --project=entityDataPicker"
-              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
-              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-              additionalEnvironmentVariables: false
-            LinuxEntityDataPicker:
-              vmImage: "ubuntu-latest"
-              testFolder: "EntityDataPicker"
-              port: ''
-              testCommand: "npx playwright test --project=entityDataPicker"
-              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
-              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-              additionalEnvironmentVariables: false
-            # ContentSettingConfig
-            WindowsContentSettingsConfig:
-              vmImage: "windows-latest"
-              testFolder: "ContentSettingConfig"
-              port: ''
-              testCommand: "npx playwright test --project=contentSettingConfig"
-              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
-              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-              additionalEnvironmentVariables: false
-            LinuxContentSettingsConfig:
-              vmImage: "ubuntu-latest"
-              testFolder: "ContentSettingConfig"
-              port: ''
-              testCommand: "npx playwright test --project=contentSettingConfig"
-              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
-              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-              additionalEnvironmentVariables: false
-            # SMTP
-            LinuxSMTP:
-              vmImage: "ubuntu-latest"
-              testFolder: "SMTP"
-              port: ''
-              testCommand: "npx playwright test --project=smtp"
-              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
-              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-              additionalEnvironmentVariables: false
         pool:
           vmImage: $(vmImage)
         steps:
@@ -638,7 +566,7 @@ stages:
             parameters:
               testFolder: $(testFolder)
               buildConfiguration: ${{ variables.buildConfiguration }}
-              additionalEnvironmentVariables: $(additionalEnvironmentVariables)
+              additionalEnvironmentVariables: ${{ eq(variables['additionalEnvironmentVariables'], true) }}
 
           # Build application for AzureADB2C
           - pwsh: |
@@ -658,7 +586,7 @@ stages:
           - template: nightly-E2E-run-application-template.yml
             parameters:
               SA_PASSWORD: ${{ variables.SA_PASSWORD }}
-              additionalEnvironmentVariables: $(additionalEnvironmentVariables)
+              additionalEnvironmentVariables: ${{ eq(variables['additionalEnvironmentVariables'], true ) }}
               buildConfiguration: ${{ variables.buildConfiguration }}
               DatabaseType: ${{ variables.DatabaseType }}
 
@@ -690,23 +618,6 @@ stages:
               AZUREADB2CCLIENTID: $(AZUREB2CCLIENTID)
               AZUREADB2CCLIENTSECRET: $(AZUREB2CCLIENTSECRET)
 
-          # Start SMTP4dev via Docker for SMTP tests
-          - bash: |
-              echo "Starting SMTP4dev container..."
-              docker run -d --name smtp4dev -p 5000:80 -p 25:25 rnwood/smtp4dev
-
-              echo "Waiting for SMTP4dev to be ready..."
-              for i in {1..30}; do
-                if curl -s http://localhost:5000/api/messages > /dev/null; then
-                  echo "SMTP4dev is ready"
-                  break
-                fi
-                echo "Attempt $i: Waiting for SMTP4dev..."
-                sleep 2
-              done
-            displayName: Start SMTP4dev Docker container (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'), contains(variables['testFolder'], 'SMTP'))
-
           # Run tests Template
           - template: nightly-E2E-run-tests-template.yml
             parameters:
@@ -716,57 +627,3 @@ stages:
               AZUREB2CTESTUSEREMAIL: $(AZUREB2CTESTUSEREMAIL)
               AZUREB2CTESTUSERPASSWORD: $(AZUREB2CTESTUSERPASSWORD)
               DatabaseType: ${{ variables.DatabaseType }}
-
-          # Stop SMTP4dev container
-          - bash: |
-              echo "Stopping SMTP4dev container..."
-              docker stop smtp4dev
-              docker rm smtp4dev
-            displayName: Stop SMTP4dev Docker container
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'), contains(variables['testFolder'], 'SMTP'))
-
-  - stage: NotifySlackBot
-    displayName: Notify Slack on Failure
-    dependsOn: DefaultConfigE2E
-    # This stage will only run if the E2E tests fail or succeed with issues
-    condition: or(eq(dependencies.DefaultConfigE2E.result, 'failed'), eq(dependencies.DefaultConfigE2E.result, 'succeededWithIssues'))
-    jobs:
-      - job: PostToSlack
-        displayName: Send Slack Notification
-        pool:
-          vmImage: 'ubuntu-latest'
-        steps:
-          # We send a payload to the Slack webhook URL, which will post a message to a specific channel
-          - bash: |
-              PROJECT_NAME_ENCODED=$(echo -n "$SYSTEM_TEAMPROJECT" | jq -s -R -r @uri)
-              PIPELINE_URL="${SYSTEM_TEAMFOUNDATIONCOLLECTIONURI}${PROJECT_NAME_ENCODED}/_build/results?buildId=${BUILD_BUILDID}&view=ms.vss-test-web.build-test-results-tab"
-
-              PAYLOAD="{
-                \"attachments\": [
-                  {
-                    \"color\": \"#ff0000\",
-                    \"pretext\": \"Nightly E2E pipeline *${BUILD_DEFINITIONNAME}* (#${BUILD_BUILDNUMBER}) failed!\",
-                    \"title\": \"View Failed E2E Test Results\",
-                    \"title_link\": \"$PIPELINE_URL\",
-                    \"fields\": [
-                      {
-                        \"title\": \"Pipeline\",
-                        \"value\": \"${BUILD_DEFINITIONNAME}\",
-                        \"short\": true
-                      },
-                      {
-                        \"title\": \"Build ID\",
-                        \"value\": \"${BUILD_BUILDID}\",
-                        \"short\": true
-                      }
-                    ]
-                  }
-                ]
-              }"
-
-              echo "Sending Slack message to: $PIPELINE_URL"
-              curl -X POST -H 'Content-type: application/json' \
-                --data "$PAYLOAD" \
-                "$SLACK_WEBHOOK_URL"
-            env:
-              SLACK_WEBHOOK_URL: $(E2ESLACKWEBHOOKURL)

build/nightly-build-trigger.yml

@@ -8,9 +8,11 @@ schedules:
   displayName: Daily midnight build
   branches:
     include:
+    - v10/dev
     - v13/dev
+    - v14/dev
+    - v15/dev
     - v16/dev
-    - main
 
 steps:
 - checkout: none

build/templates/dependency-track.yml

@@ -1,55 +0,0 @@
-parameters:
-  - name: projectName
-    type: string
-  - name: umbracoVersion
-    type: string
-  - name: projects
-    type: object
-
-jobs:
-- job: Create_DT_Project
-  displayName: Create Dependency Track Project
-  steps:
-    - checkout: none
-
-    - bash: |
-        project_id=$(curl --no-progress-meter -H "X-Api-Key: $(DT_API_KEY)" "$(DT_API_URI)/api/v1/project/lookup?name=${{ parameters.projectName }}&version=${{ parameters.umbracoVersion }}" | jq -r '.uuid')
-        if [ "$project_id" != "null" ] && [ -n "$project_id" ]; then
-          echo "Project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' already exists (ID: $project_id)."
-        else
-          project_id=$(curl --no-progress-meter \
-            -X PUT "$(DT_API_URI)/api/v1/project" \
-            -H "X-Api-Key: $(DT_API_KEY)" \
-            -H "Content-Type: application/json" \
-            -d '{"name": "${{ parameters.projectName }}", "version": "${{ parameters.umbracoVersion }}", "collectionLogic": "AGGREGATE_DIRECT_CHILDREN"}' \
-            | jq -r '.uuid')
-          if [ -z "$project_id" ] || [ "$project_id" == "null" ]; then
-            echo "Failed to create project '${{ parameters.projectName }}' version '${{ parameters.umbracoVersion }}'."
-            exit 1
-          fi
-          echo "Created project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' (ID: $project_id)."
-        fi
-      displayName: Ensure main project exists in Dependency Track
-
-- ${{ each project in parameters.projects }}:
-  - job:
-    displayName: Upload ${{ project.name }} BOM
-    dependsOn: Create_DT_Project
-    steps:
-      - checkout: none
-
-      - download: current
-        artifact: ${{ project.artifact }}
-        displayName: Download ${{ project.artifact }} artifact
-
-      - task: upload-bom-dtrack@1
-        inputs:
-          dtrackURI: $(DT_API_URI)
-          dtrackAPIKey: $(DT_API_KEY)
-          dtrackProjAutoCreate: true
-          dtrackProjName: '${{ parameters.projectName }}-${{ project.name }}'
-          dtrackProjVersion: ${{ parameters.umbracoVersion }}
-          dtrackParentProjName: ${{ parameters.projectName }}
-          dtrackParentProjVersion: ${{ parameters.umbracoVersion }}
-          bomFilePath: '$(Pipeline.Workspace)/${{ project.artifact }}/${{ project.bomFilePath }}'
-        displayName: Upload ${{ project.name }} BOM to Dependency Track

build/templates/e2e-install.yml

@@ -1,49 +0,0 @@
-parameters:
-  - name: nodeVersion
-    type: string
-    default: ''
-
-  - name: npm_config_cache
-    type: string
-    default: ''
-
-  - name: PlaywrightUserEmail
-    type: string
-    default: ''
-
-  - name: PlaywrightPassword
-    type: string
-    default: ''
-
-  - name: ASPNETCORE_URLS
-    type: string
-    default: ''
-
-steps:
-  - task: NodeTool@0
-    displayName: Use Node.js $(nodeVersion)
-    inputs:
-      versionSpec: $(nodeVersion)
-
-  - pwsh: |
-      "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
-      UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
-      URL=${{ parameters.ASPNETCORE_URLS }}
-      STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
-      CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
-    displayName: Generate .env
-    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-  # Cache and restore NPM packages
-  - task: Cache@2
-    displayName: Cache NPM packages
-    inputs:
-      key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-      restoreKeys: |
-        npm_e2e | "$(Agent.OS)"
-        npm_e2e
-      path: ${{ parameters.npm_config_cache }}
-
-  - script: npm ci --no-fund --no-audit --prefer-offline
-    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-    displayName: Restore NPM packages

context7.json

@@ -1,4 +0,0 @@
-{
-  "url": "https://context7.com/umbraco/umbraco-cms",
-  "public_key": "pk_GTIgsrGAQiHNxCirZBDIM"
-}

global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "10.0.100",
+    "version": "9.0.100",
     "rollForward": "latestFeature",
     "allowPrerelease": false
   }

src/Umbraco.Cms.Api.Common/Accessors/RequestContextOutputExpansionStrategyAccessor.cs

@@ -1,19 +0,0 @@
-using Microsoft.AspNetCore.Http;
-using Umbraco.Cms.Core.DeliveryApi;
-
-namespace Umbraco.Cms.Api.Common.Accessors;
-
-/// <summary>
-///     Provides access to the <see cref="IOutputExpansionStrategy"/> for the current HTTP request context.
-/// </summary>
-public sealed class RequestContextOutputExpansionStrategyAccessor : RequestContextServiceAccessorBase<IOutputExpansionStrategy>, IOutputExpansionStrategyAccessor
-{
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="RequestContextOutputExpansionStrategyAccessor"/> class.
-    /// </summary>
-    /// <param name="httpContextAccessor">The HTTP context accessor.</param>
-    public RequestContextOutputExpansionStrategyAccessor(IHttpContextAccessor httpContextAccessor)
-        : base(httpContextAccessor)
-    {
-    }
-}

src/Umbraco.Cms.Api.Common/Accessors/RequestContextServiceAccessorBase.cs

@@ -1,33 +0,0 @@
-using System.Diagnostics.CodeAnalysis;
-using Microsoft.AspNetCore.Http;
-using Microsoft.Extensions.DependencyInjection;
-
-namespace Umbraco.Cms.Api.Common.Accessors;
-
-/// <summary>
-///     Base class for accessing request-scoped services from the current HTTP context.
-/// </summary>
-/// <typeparam name="T">The type of service to access.</typeparam>
-public abstract class RequestContextServiceAccessorBase<T>
-    where T : class
-{
-    private readonly IHttpContextAccessor _httpContextAccessor;
-
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="RequestContextServiceAccessorBase{T}"/> class.
-    /// </summary>
-    /// <param name="httpContextAccessor">The HTTP context accessor.</param>
-    protected RequestContextServiceAccessorBase(IHttpContextAccessor httpContextAccessor)
-        => _httpContextAccessor = httpContextAccessor;
-
-    /// <summary>
-    ///     Attempts to retrieve the service from the current HTTP context's request services.
-    /// </summary>
-    /// <param name="requestStartNodeService">When this method returns, contains the service instance if found; otherwise, <c>null</c>.</param>
-    /// <returns><c>true</c> if the service was found; otherwise, <c>false</c>.</returns>
-    public bool TryGetValue([NotNullWhen(true)] out T? requestStartNodeService)
-    {
-        requestStartNodeService = _httpContextAccessor.HttpContext?.RequestServices.GetService<T>();
-        return requestStartNodeService is not null;
-    }
-}

src/Umbraco.Cms.Api.Common/Attributes/MapToApiAttribute.cs

@@ -1,19 +1,9 @@
 namespace Umbraco.Cms.Api.Common.Attributes;
 
-/// <summary>
-///     Attribute used to map a class to a specific API for OpenAPI documentation generation.
-/// </summary>
 [AttributeUsage(AttributeTargets.Class, AllowMultiple = false)]
 public class MapToApiAttribute : Attribute
 {
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="MapToApiAttribute"/> class.
-    /// </summary>
-    /// <param name="apiName">The name of the API to map to.</param>
     public MapToApiAttribute(string apiName) => ApiName = apiName;
 
-    /// <summary>
-    ///     Gets the name of the API this class is mapped to.
-    /// </summary>
     public string ApiName { get; }
 }

src/Umbraco.Cms.Api.Common/Builders/ProblemDetailsBuilder.cs

@@ -1,12 +1,9 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Common.Builders;
 
-/// <summary>
-///     A fluent builder for creating RFC 7807 <see cref="ProblemDetails"/> responses.
-/// </summary>
 public class ProblemDetailsBuilder
 {
     private string? _title;
@@ -15,45 +12,24 @@ public class ProblemDetailsBuilder
     private string? _operationStatus;
     private IDictionary<string, object>? _extensions;
 
-    /// <summary>
-    ///     Sets the title of the problem details.
-    /// </summary>
-    /// <param name="title">A short, human-readable summary of the problem type.</param>
-    /// <returns>The current builder instance for method chaining.</returns>
     public ProblemDetailsBuilder WithTitle(string title)
     {
         _title = title;
         return this;
     }
 
-    /// <summary>
-    ///     Sets the detail of the problem details.
-    /// </summary>
-    /// <param name="detail">A human-readable explanation specific to this occurrence of the problem.</param>
-    /// <returns>The current builder instance for method chaining.</returns>
     public ProblemDetailsBuilder WithDetail(string detail)
     {
         _detail = detail;
         return this;
     }
 
-    /// <summary>
-    ///     Sets the type of the problem details.
-    /// </summary>
-    /// <param name="type">A URI reference that identifies the problem type.</param>
-    /// <returns>The current builder instance for method chaining.</returns>
     public ProblemDetailsBuilder WithType(string type)
     {
         _type = type;
         return this;
     }
 
-    /// <summary>
-    ///     Sets the operation status from an enum value.
-    /// </summary>
-    /// <typeparam name="TEnum">The enum type representing operation statuses.</typeparam>
-    /// <param name="operationStatus">The operation status enum value.</param>
-    /// <returns>The current builder instance for method chaining.</returns>
     public ProblemDetailsBuilder WithOperationStatus<TEnum>(TEnum operationStatus)
         where TEnum : Enum
     {
@@ -61,20 +37,9 @@ public class ProblemDetailsBuilder
         return this;
     }
 
-    /// <summary>
-    ///     Adds request model validation errors to the problem details.
-    /// </summary>
-    /// <param name="errors">A dictionary of field names to error messages.</param>
-    /// <returns>The current builder instance for method chaining.</returns>
     public ProblemDetailsBuilder WithRequestModelErrors(IDictionary<string, string[]> errors)
         => WithExtension(nameof(HttpValidationProblemDetails.Errors).ToFirstLowerInvariant(), errors);
 
-    /// <summary>
-    ///     Adds a custom extension to the problem details.
-    /// </summary>
-    /// <param name="key">The extension key.</param>
-    /// <param name="value">The extension value.</param>
-    /// <returns>The current builder instance for method chaining.</returns>
     public ProblemDetailsBuilder WithExtension(string key, object value)
     {
         _extensions ??= new Dictionary<string, object>();
@@ -82,10 +47,6 @@ public class ProblemDetailsBuilder
         return this;
     }
 
-    /// <summary>
-    ///     Builds the <see cref="ProblemDetails"/> instance with all configured values.
-    /// </summary>
-    /// <returns>A new <see cref="ProblemDetails"/> instance.</returns>
     public ProblemDetails Build()
     {
         var problemDetails = new ProblemDetails

src/Umbraco.Cms.Api.Common/CLAUDE.md

@@ -1,371 +0,0 @@
-# Umbraco.Cms.Api.Common
-
-Shared infrastructure for Umbraco CMS REST APIs (Management and Delivery).
-
----
-
-## 1. Architecture
-
-**Type**: Class Library (NuGet Package)
-**Target Framework**: .NET 10.0
-**Purpose**: Common API infrastructure - OpenAPI/Swagger, JSON serialization, OpenIddict authentication, problem details
-
-### Key Technologies
-
-- **ASP.NET Core** - Web framework
-- **Swashbuckle** - OpenAPI/Swagger documentation generation
-- **OpenIddict** - OAuth 2.0/OpenID Connect authentication
-- **Asp.Versioning** - API versioning
-- **System.Text.Json** - Polymorphic JSON serialization
-
-### Dependencies
-
-- `Umbraco.Core` - Domain models and service contracts
-- `Umbraco.Web.Common` - Web functionality
-
-### Project Structure (46 files)
-
-```
-Umbraco.Cms.Api.Common/
-├── OpenApi/                    # Schema/Operation ID handlers for Swagger
-│   ├── SchemaIdHandler.cs     # Generates schema IDs (e.g., "PagedUserModel")
-│   ├── OperationIdHandler.cs  # Generates operation IDs
-│   └── SubTypesHandler.cs     # Polymorphism support
-├── Serialization/              # JSON type resolution
-│   └── UmbracoJsonTypeInfoResolver.cs
-├── Configuration/              # Options configuration
-│   ├── ConfigureUmbracoSwaggerGenOptions.cs
-│   └── ConfigureOpenIddict.cs
-├── DependencyInjection/        # Service registration
-│   ├── UmbracoBuilderApiExtensions.cs
-│   └── UmbracoBuilderAuthExtensions.cs
-├── Builders/                   # RFC 7807 problem details
-│   └── ProblemDetailsBuilder.cs
-├── ViewModels/Pagination/      # Common DTOs
-└── Security/                   # Auth paths and handlers
-```
-
-### Design Patterns
-
-1. **Strategy Pattern** - `ISchemaIdHandler`, `IOperationIdHandler` (extensible via inheritance)
-2. **Builder Pattern** - `ProblemDetailsBuilder` for fluent error responses
-3. **Options Pattern** - All configuration via `IConfigureOptions<T>`
-
----
-
-## 2. Commands
-
-See "Quick Reference" section at bottom for common commands.
-
----
-
-## 3. Key Patterns
-
-### Virtual Handlers for Extensibility
-
-Handlers are intentionally virtual to allow consuming APIs to override:
-
-```csharp
-// NOTE: Left unsealed on purpose, so it is extendable.
-public class SchemaIdHandler : ISchemaIdHandler
-{
-    public virtual bool CanHandle(Type type) { }
-    public virtual string Handle(Type type) { }
-}
-```
-
-**Why**: Management and Delivery APIs can customize schema/operation ID generation.
-
-### Schema ID Sanitization (OpenApi/SchemaIdHandler.cs:24-29, 32)
-
-```csharp
-// Add "Model" suffix to avoid TypeScript name clashes (lines 24-29)
-if (name.EndsWith("Model") == false)
-{
-    // because some models names clash with common classes in TypeScript (i.e. Document),
-    // we need to add a "Model" postfix to all models
-    name = $"{name}Model";
-}
-
-// Remove invalid characters to prevent OpenAPI generation errors (line 32)
-return Regex.Replace(name, @"[^\w]", string.Empty);
-```
-
-### Polymorphic Deserialization (Serialization/UmbracoJsonTypeInfoResolver.cs:29-35)
-
-```csharp
-// IMPORTANT: do NOT return an empty enumerable here. it will cause nullability to fail on reference
-// properties, because "$ref" does not mix and match well with "nullable" in OpenAPI.
-if (type.IsInterface is false)
-{
-    return new[] { type };
-}
-```
-
-**Why**: Interfaces must return concrete types to avoid OpenAPI schema conflicts.
-
----
-
-## 4. Testing
-
-**Location**: No direct tests - tested via integration tests in consuming APIs
-
-**How to test changes**:
-```bash
-# Run integration tests that exercise this library
-dotnet test tests/Umbraco.Tests.Integration/
-
-# Verify OpenAPI generation
-# 1. Run Management API
-# 2. Navigate to /umbraco/swagger/
-# 3. Check schema IDs and operation IDs
-```
-
-**Focus areas when testing**:
-- OpenAPI document generation (schema IDs, operation IDs)
-- Polymorphic JSON serialization/deserialization
-- OpenIddict authentication flow
-- Problem details formatting
-
----
-
-## 5. OpenIddict Authentication
-
-### Key Configuration (DependencyInjection/UmbracoBuilderAuthExtensions.cs)
-
-**Reference Tokens over JWT** (line 76-80):
-```csharp
-// Enable reference tokens
-// - see https://documentation.openiddict.com/configuration/token-storage.html
-options
-    .UseReferenceAccessTokens()
-    .UseReferenceRefreshTokens();
-```
-
-**Why**: More secure (revocable), better for load balancing, uses ASP.NET Core Data Protection.
-
-**Token Lifetime** (line 88-91):
-```csharp
-// Make the access token lifetime 25% of the refresh token lifetime
-options.SetAccessTokenLifetime(new TimeSpan(timeOut.Ticks / 4));
-options.SetRefreshTokenLifetime(timeOut);
-```
-
-**PKCE Required** (line 59-63):
-```csharp
-// Enable authorization code flow with PKCE
-options
-    .AllowAuthorizationCodeFlow()
-    .RequireProofKeyForCodeExchange()
-    .AllowRefreshTokenFlow();
-```
-
-**Endpoints**: Backoffice `/umbraco/management/api/v1/security/*`, Member `/umbraco/member/api/v1/security/*`
-
-### Secure Cookie-Based Token Storage (v17+)
-
-**Implementation** (DependencyInjection/HideBackOfficeTokensHandler.cs):
-
-Back-office tokens are hidden from client-side JavaScript via HTTP-only cookies:
-
-```csharp
-private const string AccessTokenCookieKey = "__Host-umbAccessToken";
-private const string RefreshTokenCookieKey = "__Host-umbRefreshToken";
-
-// Tokens are encrypted via Data Protection and stored in cookies
-SetCookie(httpContext, AccessTokenCookieKey, context.Response.AccessToken);
-context.Response.AccessToken = "[redacted]";  // Client sees redacted value
-```
-
-**Key Security Features** (lines 143-165): `HttpOnly`, `IsEssential`, `Path="/"`, `Secure` (HTTPS), `__Host-` prefix
-
-**Configuration**: `BackOfficeTokenCookieSettings.Enabled` (default: true in v17+)
-
-**Implications**: Client-side cannot access tokens; encrypted with Data Protection; load balancing needs shared key ring; API requests need `credentials: include`
-
----
-
-## 6. Common Issues & Edge Cases
-
-### Polymorphic Deserialization Requires `$type`
-
-**Issue**: Deserializing to an interface without `$type` discriminator fails.
-
-**Handled in** (Json/NamedSystemTextJsonInputFormatter.cs:24-29):
-```csharp
-catch (NotSupportedException exception)
-{
-    // This happens when trying to deserialize to an interface, without sending the $type as part of the request
-    context.ModelState.TryAddModelException(string.Empty, new InputFormatterException(exception.Message, exception));
-    return await InputFormatterResult.FailureAsync();
-}
-```
-
-**Solution**: Clients must include `$type` property for interface types, or use concrete types.
-
-### Schema ID Collisions with TypeScript
-
-**Issue**: Type names like `Document` clash with TypeScript built-ins.
-
-**Solution**: Add "Model" suffix (OpenApi/SchemaIdHandler.cs:24-29)
-
-### Generic Type Handling
-
-**Issue**: `PagedViewModel<T>` needs flattened schema name.
-
-**Solution** (OpenApi/SchemaIdHandler.cs:41-50):
-```csharp
-private string HandleGenerics(string name, Type type)
-{
-    if (!type.IsGenericType)
-        return name;
-
-    // use attribute custom name or append the generic type names
-    // turns "PagedViewModel<RelationItemViewModel>" into "PagedRelationItem"
-    return $"{name}{string.Join(string.Empty, type.GenericTypeArguments.Select(SanitizedTypeName))}";
-}
-```
-
----
-
-## 7. Extending This Library
-
-### Adding a Custom OpenAPI Handler
-
-1. **Implement interface**:
-   ```csharp
-   public class MySchemaIdHandler : SchemaIdHandler
-   {
-       public override bool CanHandle(Type type)
-           => type.Namespace?.StartsWith("MyProject") is true;
-
-       public override string Handle(Type type)
-           => $"My{base.Handle(type)}";
-   }
-   ```
-
-2. **Register in consuming API**:
-   ```csharp
-   builder.Services.AddSingleton<ISchemaIdHandler, MySchemaIdHandler>();
-   ```
-
-**Note**: Handlers registered later take precedence in the selector.
-
-### Customizing Problem Details
-
-```csharp
-var problemDetails = new ProblemDetailsBuilder()
-    .WithTitle("Validation Failed")
-    .WithDetail("The request contains errors")
-    .WithType("ValidationError")
-    .WithOperationStatus(MyOperationStatus.ValidationFailed)
-    .WithRequestModelErrors(errors)
-    .Build();
-
-return BadRequest(problemDetails);
-```
-
----
-
-## 8. Project-Specific Notes
-
-### Why Virtual Handlers?
-
-**Decision**: Make `SchemaIdHandler`, `OperationIdHandler`, etc. virtual.
-
-**Why**: Management API and Delivery API have different schema ID requirements. Virtual methods allow override without rewriting the entire handler.
-
-**Example**: Management API might prefix all schemas with "Management", Delivery API with "Delivery".
-
-### Performance: Subtype Caching
-
-**Why**: Cache discovered subtypes (UmbracoJsonTypeInfoResolver.cs:14) to avoid expensive reflection calls
-
-### Known Limitations
-
-1. **Polymorphic Deserialization**:
-   - Requires `$type` discriminator in JSON for interfaces
-   - Only discovers types in Umbraco namespaces
-   - Not all .NET types are discoverable
-
-2. **OpenAPI Schema Generation**:
-   - Generic types are flattened (e.g., `PagedViewModel<T>` → `PagedTModel`)
-   - Type names may need "Model" suffix to avoid clashes
-
-3. **OpenIddict Multi-Server**:
-   - Requires shared Data Protection key ring
-   - All servers must have synchronized clocks (NTP)
-   - Reference tokens require database storage
-
-### External Dependencies
-
-**OpenIddict**:
-- OAuth 2.0 / OpenID Connect provider
-- Version: See `Directory.Packages.props`
-- Uses ASP.NET Core Data Protection for token encryption
-
-**Swashbuckle**:
-- OpenAPI 3.0 document generation
-- Custom filters: `EnumSchemaFilter`, `MimeTypeDocumentFilter`, `RemoveSecuritySchemesDocumentFilter`
-
-**Asp.Versioning**:
-- API versioning via `ApiVersion` attribute
-- API explorer integration for multi-version Swagger docs
-
-### Configuration
-
-**HTTPS**: `DisableTransportSecurityRequirement` for local dev only (ConfigureOpenIddict.cs:14). **Warning**: Never disable in production.
-
-### Usage Pattern
-
-Consuming APIs call `builder.AddUmbracoApiOpenApiUI().AddUmbracoOpenIddict()`
-
----
-
-## Quick Reference
-
-### Essential Commands
-
-```bash
-# Build project
-dotnet build src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj
-
-# Pack for NuGet
-dotnet pack src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj -c Release
-
-# Test via integration tests
-dotnet test tests/Umbraco.Tests.Integration/
-
-# Check packages
-dotnet list src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj package --outdated
-dotnet list src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj package --vulnerable
-```
-
-### Key Classes
-
-| Class | Purpose | File |
-|-------|---------|------|
-| `ProblemDetailsBuilder` | Build RFC 7807 error responses | Builders/ProblemDetailsBuilder.cs |
-| `SchemaIdHandler` | Generate OpenAPI schema IDs | OpenApi/SchemaIdHandler.cs |
-| `UmbracoJsonTypeInfoResolver` | Polymorphic JSON serialization | Serialization/UmbracoJsonTypeInfoResolver.cs |
-| `UmbracoBuilderAuthExtensions` | Configure OpenIddict | DependencyInjection/UmbracoBuilderAuthExtensions.cs |
-| `HideBackOfficeTokensHandler` | Secure cookie-based token storage | DependencyInjection/HideBackOfficeTokensHandler.cs |
-| `PagedViewModel<T>` | Generic pagination model | ViewModels/Pagination/PagedViewModel.cs |
-
-### Important Files
-
-- `Umbraco.Cms.Api.Common.csproj` - Project dependencies
-- `DependencyInjection/UmbracoBuilderApiExtensions.cs` - OpenAPI registration (line 12-31)
-- `DependencyInjection/UmbracoBuilderAuthExtensions.cs` - OpenIddict setup (line 20-183)
-- `Security/Paths.cs` - API endpoint path constants
-
-### Getting Help
-
-- **Root documentation**: `/CLAUDE.md` - Repository overview
-- **Core patterns**: `/src/Umbraco.Core/CLAUDE.md` - Core contracts and patterns
-- **Official docs**: https://docs.umbraco.com/
-- **OpenIddict docs**: https://documentation.openiddict.com/
-
----
-
-**This library is the foundation for all Umbraco CMS REST APIs. Focus on OpenAPI customization, authentication configuration, and polymorphic serialization when working here.**

src/Umbraco.Cms.Api.Common/Configuration/ConfigureApiBehaviorOptions.cs

@@ -1,14 +1,10 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;
 
 namespace Umbraco.Cms.Api.Common.Configuration;
 
-/// <summary>
-///     Configures <see cref="ApiBehaviorOptions"/> for Umbraco APIs.
-/// </summary>
 public class ConfigureApiBehaviorOptions : IConfigureOptions<ApiBehaviorOptions>
 {
-    /// <inheritdoc/>
     public void Configure(ApiBehaviorOptions options) =>
         // disable ProblemDetails as default result type for every non-success response (i.e. 404)
         // - see https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.mvc.apibehavioroptions.suppressmapclienterrors

src/Umbraco.Cms.Api.Common/Configuration/ConfigureMvcJsonOptions.cs

@@ -5,21 +5,12 @@ using Umbraco.Cms.Api.Common.Json;
 
 namespace Umbraco.Cms.Api.Common.Configuration;
 
-/// <summary>
-///     Configures <see cref="MvcOptions"/> with named JSON input and output formatters for Umbraco APIs.
-/// </summary>
 public class ConfigureMvcJsonOptions : IConfigureOptions<MvcOptions>
 {
     private readonly string _jsonOptionsName;
     private readonly IOptionsMonitor<JsonOptions> _jsonOptions;
     private readonly ILoggerFactory _loggerFactory;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="ConfigureMvcJsonOptions"/> class.
-    /// </summary>
-    /// <param name="jsonOptionsName">The name of the JSON options configuration to use.</param>
-    /// <param name="jsonOptions">The JSON options monitor.</param>
-    /// <param name="loggerFactory">The logger factory.</param>
     public ConfigureMvcJsonOptions(
         string jsonOptionsName,
         IOptionsMonitor<JsonOptions> jsonOptions,
@@ -30,7 +21,6 @@ public class ConfigureMvcJsonOptions : IConfigureOptions<MvcOptions>
         _loggerFactory = loggerFactory;
     }
 
-    /// <inheritdoc/>
     public void Configure(MvcOptions options)
     {
         JsonOptions jsonOptions = _jsonOptions.Get(_jsonOptionsName);

src/Umbraco.Cms.Api.Common/Configuration/ConfigureOpenIddict.cs

@@ -4,24 +4,12 @@ using Umbraco.Cms.Core.Configuration.Models;
 
 namespace Umbraco.Cms.Api.Common.Configuration;
 
-/// <summary>
-///     Configures OpenIddict server options for Umbraco authentication.
-/// </summary>
-/// <remarks>
-///     Disables transport security requirement when HTTPS is not configured in global settings.
-///     Warning: This should only be used in development environments.
-/// </remarks>
-internal sealed class ConfigureOpenIddict : IConfigureOptions<OpenIddictServerAspNetCoreOptions>
+internal class ConfigureOpenIddict : IConfigureOptions<OpenIddictServerAspNetCoreOptions>
 {
     private readonly IOptions<GlobalSettings> _globalSettings;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="ConfigureOpenIddict"/> class.
-    /// </summary>
-    /// <param name="globalSettings">The global settings options.</param>
     public ConfigureOpenIddict(IOptions<GlobalSettings> globalSettings) => _globalSettings = globalSettings;
 
-    /// <inheritdoc/>
     public void Configure(OpenIddictServerAspNetCoreOptions options)
         => options.DisableTransportSecurityRequirement = _globalSettings.Value.UseHttps is false;
 }

src/Umbraco.Cms.Api.Common/Configuration/ConfigureUmbracoSwaggerGenOptions.cs

@@ -1,62 +1,40 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Mvc.Abstractions;
 using Microsoft.AspNetCore.Mvc.ApiExplorer;
+using Microsoft.AspNetCore.Mvc.Controllers;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Common.Configuration;
 
-/// <summary>
-///     Configures Swagger/OpenAPI generation options for Umbraco APIs.
-/// </summary>
 public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
 {
     private readonly IOperationIdSelector _operationIdSelector;
     private readonly ISchemaIdSelector _schemaIdSelector;
     private readonly ISubTypesSelector _subTypesSelector;
-    private readonly IDocumentInclusionSelector _documentInclusionSelector;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="ConfigureUmbracoSwaggerGenOptions"/> class.
-    /// </summary>
-    /// <param name="operationIdSelector">The operation ID selector.</param>
-    /// <param name="schemaIdSelector">The schema ID selector.</param>
-    /// <param name="subTypesSelector">The sub-types selector for polymorphism support.</param>
-    /// <param name="documentInclusionSelector">The document inclusion selector.</param>
+    [Obsolete("Use non-obsolete constructor. This will be removed in Umbraco 16.")]
     public ConfigureUmbracoSwaggerGenOptions(
         IOperationIdSelector operationIdSelector,
-        ISchemaIdSelector schemaIdSelector,
-        ISubTypesSelector subTypesSelector,
-        IDocumentInclusionSelector documentInclusionSelector)
-    {
-        _operationIdSelector = operationIdSelector;
-        _schemaIdSelector = schemaIdSelector;
-        _subTypesSelector = subTypesSelector;
-        _documentInclusionSelector = documentInclusionSelector;
-    }
+        ISchemaIdSelector schemaIdSelector)
+        : this(operationIdSelector, schemaIdSelector, StaticServiceProvider.Instance.GetRequiredService<ISubTypesSelector>())
+    { }
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="ConfigureUmbracoSwaggerGenOptions"/> class.
-    /// </summary>
-    /// <param name="operationIdSelector">The operation ID selector.</param>
-    /// <param name="schemaIdSelector">The schema ID selector.</param>
-    /// <param name="subTypesSelector">The sub-types selector for polymorphism support.</param>
-    [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
     public ConfigureUmbracoSwaggerGenOptions(
         IOperationIdSelector operationIdSelector,
         ISchemaIdSelector schemaIdSelector,
         ISubTypesSelector subTypesSelector)
-        : this(
-              operationIdSelector,
-              schemaIdSelector,
-              subTypesSelector,
-              StaticServiceProvider.Instance.GetRequiredService<IDocumentInclusionSelector>())
     {
+        _operationIdSelector = operationIdSelector;
+        _schemaIdSelector = schemaIdSelector;
+        _subTypesSelector = subTypesSelector;
     }
 
-    /// <inheritdoc/>
     public void Configure(SwaggerGenOptions swaggerGenOptions)
     {
         swaggerGenOptions.SwaggerDoc(
@@ -69,11 +47,19 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
             });
 
         swaggerGenOptions.CustomOperationIds(description => _operationIdSelector.OperationId(description));
-        swaggerGenOptions.DocInclusionPredicate(_documentInclusionSelector.Include);
-        swaggerGenOptions.TagActionsBy(api =>
-            api.GroupName is null
-                ? []
-                : new[] { api.GroupName });
+        swaggerGenOptions.DocInclusionPredicate((name, api) =>
+        {
+            if (api.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor
+                && controllerActionDescriptor.MethodInfo.HasMapToApiAttribute(name))
+            {
+                return true;
+            }
+
+            ApiVersionMetadata apiVersionMetadata = api.ActionDescriptor.GetApiVersionMetadata();
+            return apiVersionMetadata.Name == name
+                   || (string.IsNullOrEmpty(apiVersionMetadata.Name) && name == DefaultApiConfiguration.ApiName);
+        });
+        swaggerGenOptions.TagActionsBy(api => new[] { api.GroupName });
         swaggerGenOptions.OrderActionsBy(ActionOrderBy);
         swaggerGenOptions.SchemaFilter<EnumSchemaFilter>();
         swaggerGenOptions.CustomSchemaIds(_schemaIdSelector.SchemaId);
@@ -81,14 +67,7 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
         swaggerGenOptions.SupportNonNullableReferenceTypes();
     }
 
-    /// <summary>
-    ///     Generates a sort key for API actions.
-    /// </summary>
-    /// <param name="apiDesc">The API description.</param>
-    /// <returns>A string used to sort API operations in the documentation.</returns>
-    /// <remarks>
-    ///     See https://github.com/domaindrivendev/Swashbuckle.AspNetCore#change-operation-sort-order-eg-for-ui-sorting.
-    /// </remarks>
+    // see https://github.com/domaindrivendev/Swashbuckle.AspNetCore#change-operation-sort-order-eg-for-ui-sorting
     private static string ActionOrderBy(ApiDescription apiDesc)
         => $"{apiDesc.GroupName}_{apiDesc.ActionDescriptor.AttributeRouteInfo?.Template ?? apiDesc.ActionDescriptor.RouteValues["controller"]}_{(apiDesc.ActionDescriptor.RouteValues.TryGetValue("action", out var action) ? action : null)}_{apiDesc.HttpMethod}";
 }

src/Umbraco.Cms.Api.Common/Configuration/DefaultApiConfiguration.cs

@@ -1,12 +1,6 @@
 namespace Umbraco.Cms.Api.Common.Configuration;
 
-/// <summary>
-///     Contains default configuration values for the API.
-/// </summary>
 internal static class DefaultApiConfiguration
 {
-    /// <summary>
-    ///     The default API name used for endpoints not assigned to a specific API.
-    /// </summary>
     public const string ApiName = "default";
 }

src/Umbraco.Cms.Api.Common/DependencyInjection/HideBackOfficeTokensHandler.cs

@@ -1,262 +0,0 @@
-using System.Diagnostics.CodeAnalysis;
-using Microsoft.AspNetCore.DataProtection;
-using Microsoft.AspNetCore.Http;
-using Microsoft.Extensions.Options;
-using OpenIddict.Server;
-using OpenIddict.Validation;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Core.Events;
-using Umbraco.Cms.Core.Notifications;
-using Umbraco.Cms.Web.Common.Security;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Common.DependencyInjection;
-
-/// <summary>
-///     Handles secure storage of back-office authentication tokens in HTTP-only cookies.
-/// </summary>
-/// <remarks>
-///     This handler intercepts OpenIddict token responses for the back-office client and stores
-///     access tokens, refresh tokens, and PKCE codes in encrypted HTTP-only cookies. The tokens
-///     are redacted from the response to prevent client-side JavaScript access.
-/// </remarks>
-internal sealed class HideBackOfficeTokensHandler
-    : IOpenIddictServerHandler<OpenIddictServerEvents.ApplyTokenResponseContext>,
-        IOpenIddictServerHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>,
-        IOpenIddictServerHandler<OpenIddictServerEvents.ExtractTokenRequestContext>,
-        IOpenIddictValidationHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>,
-        INotificationHandler<UserLogoutSuccessNotification>
-{
-    private const string RedactedTokenValue = "[redacted]";
-
-    // The __Host- prefix enforces secure cookies at browser level (requires Secure, Path=/, no Domain).
-    // For local development over HTTP, we use a simpler prefix to avoid browser rejection.
-    private const string SecureCookiePrefix = "__Host-";
-    private const string AccessTokenCookieName = "umbAccessToken";
-    private const string RefreshTokenCookieName = "umbRefreshToken";
-    private const string PkceCodeCookieName = "umbPkceCode";
-
-    private readonly IHttpContextAccessor _httpContextAccessor;
-    private readonly IDataProtectionProvider _dataProtectionProvider;
-    private readonly BackOfficeTokenCookieSettings _backOfficeTokenCookieSettings;
-    private readonly GlobalSettings _globalSettings;
-
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="HideBackOfficeTokensHandler"/> class.
-    /// </summary>
-    /// <param name="httpContextAccessor">The HTTP context accessor.</param>
-    /// <param name="dataProtectionProvider">The data protection provider for encrypting cookie values.</param>
-    /// <param name="backOfficeTokenCookieSettings">The back-office token cookie settings.</param>
-    /// <param name="globalSettings">The global settings.</param>
-    public HideBackOfficeTokensHandler(
-        IHttpContextAccessor httpContextAccessor,
-        IDataProtectionProvider dataProtectionProvider,
-        IOptions<BackOfficeTokenCookieSettings> backOfficeTokenCookieSettings,
-        IOptions<GlobalSettings> globalSettings)
-    {
-        _httpContextAccessor = httpContextAccessor;
-        _dataProtectionProvider = dataProtectionProvider;
-        _backOfficeTokenCookieSettings = backOfficeTokenCookieSettings.Value;
-        _globalSettings = globalSettings.Value;
-    }
-
-    /// <summary>
-    /// This is invoked when tokens (access and refresh tokens) are issued to a client. For the back-office client,
-    /// we will intercept the response, write the tokens from the response into HTTP-only cookies, and redact the
-    /// tokens from the response, so they are not exposed to the client.
-    /// </summary>
-    public ValueTask HandleAsync(OpenIddictServerEvents.ApplyTokenResponseContext context)
-    {
-        if (context.Request?.ClientId is not Constants.OAuthClientIds.BackOffice)
-        {
-            // Only ever handle the back-office client.
-            return ValueTask.CompletedTask;
-        }
-
-        HttpContext httpContext = GetHttpContext();
-
-        if (context.Response.AccessToken is not null)
-        {
-            SetCookie(httpContext, AccessTokenCookieName, context.Response.AccessToken);
-            context.Response.AccessToken = RedactedTokenValue;
-        }
-
-        if (context.Response.RefreshToken is not null)
-        {
-            SetCookie(httpContext, RefreshTokenCookieName, context.Response.RefreshToken);
-            context.Response.RefreshToken = RedactedTokenValue;
-        }
-
-        return ValueTask.CompletedTask;
-    }
-
-    /// <summary>
-    /// This is invoked when a PKCE code is issued to the client. For the back-office client, we will intercept the
-    /// response, write the PKCE code from the response into a HTTP-only cookie, and redact the code from the response,
-    /// so it's not exposed to the client.
-    /// </summary>
-    public ValueTask HandleAsync(OpenIddictServerEvents.ApplyAuthorizationResponseContext context)
-    {
-        if (context.Request?.ClientId is not Constants.OAuthClientIds.BackOffice)
-        {
-            // Only ever handle the back-office client.
-            return ValueTask.CompletedTask;
-        }
-
-        if (context.Response.Code is not null)
-        {
-            SetCookie(GetHttpContext(), PkceCodeCookieName, context.Response.Code);
-            context.Response.Code = RedactedTokenValue;
-        }
-
-        return ValueTask.CompletedTask;
-    }
-
-    /// <summary>
-    /// This is invoked when requesting new tokens.
-    /// </summary>
-    public ValueTask HandleAsync(OpenIddictServerEvents.ExtractTokenRequestContext context)
-    {
-        if (context.Request?.ClientId != Constants.OAuthClientIds.BackOffice)
-        {
-            // Only ever handle the back-office client.
-            return ValueTask.CompletedTask;
-        }
-
-        HttpContext httpContext = GetHttpContext();
-
-        // Handle when the PKCE code is being exchanged for an access token.
-        if (context.Request.Code == RedactedTokenValue
-            && TryGetCookie(httpContext, PkceCodeCookieName, out var code))
-        {
-            context.Request.Code = code;
-
-            // We won't need the PKCE cookie after this, let's remove it.
-            RemoveCookie(httpContext, PkceCodeCookieName);
-        }
-        else
-        {
-            // PCKE codes should always be redacted. If we got here, someone might be trying to pass another PKCE
-            // code. For security reasons, explicitly discard the code (if any) to be on the safe side.
-            context.Request.Code = null;
-        }
-
-        // Handle when a refresh token is being exchanged for a new access token.
-        if (context.Request.RefreshToken == RedactedTokenValue
-            && TryGetCookie(httpContext, RefreshTokenCookieName, out var refreshToken))
-        {
-            context.Request.RefreshToken = refreshToken;
-        }
-        else
-        {
-            // If we got here, either the refresh token was not redacted, or nothing was found in the refresh token cookie.
-            // If OpenIddict found a refresh token, it could be an old token that is potentially still valid. For security
-            // reasons, we cannot accept that; at this point, we expect the refresh tokens to be explicitly redacted.
-            context.Request.RefreshToken = null;
-        }
-
-        return ValueTask.CompletedTask;
-    }
-
-    /// <summary>
-    /// This is invoked when extracting the auth context for a client request.
-    /// </summary>
-    public ValueTask HandleAsync(OpenIddictValidationEvents.ProcessAuthenticationContext context)
-    {
-        // For the back-office client, this only happens when an access token is sent to the API.
-        if (context.AccessToken != RedactedTokenValue)
-        {
-            return ValueTask.CompletedTask;
-        }
-
-        if (TryGetCookie(GetHttpContext(), AccessTokenCookieName, out var accessToken))
-        {
-            context.AccessToken = accessToken;
-        }
-
-        return ValueTask.CompletedTask;
-    }
-
-    /// <inheritdoc/>
-    public void Handle(UserLogoutSuccessNotification notification)
-    {
-        HttpContext? httpContext = _httpContextAccessor.HttpContext;
-        if (httpContext is null)
-        {
-            // For some reason there is no ambient HTTP context, so we can't clean up the cookies.
-            // This is OK, because the tokens in the cookies have already been revoked at user sign-out,
-            // so the cookie clean-up is mostly cosmetic.
-            return;
-        }
-
-        RemoveCookie(httpContext, AccessTokenCookieName);
-        RemoveCookie(httpContext, RefreshTokenCookieName);
-    }
-
-    private HttpContext GetHttpContext()
-        => _httpContextAccessor.GetRequiredHttpContext();
-
-    private string GetCookieKey(HttpContext httpContext, string cookieName)
-        => _globalSettings.UseHttps || httpContext.Request.IsHttps
-            ? $"{SecureCookiePrefix}{cookieName}"
-            : cookieName;
-
-    private void SetCookie(HttpContext httpContext, string cookieName, string value)
-    {
-        var key = GetCookieKey(httpContext, cookieName);
-        var cookieValue = EncryptionHelper.Encrypt(value, _dataProtectionProvider);
-
-        RemoveCookie(httpContext, cookieName);
-        httpContext.Response.Cookies.Append(key, cookieValue, GetCookieOptions(httpContext));
-    }
-
-    private void RemoveCookie(HttpContext httpContext, string cookieName)
-    {
-        var key = GetCookieKey(httpContext, cookieName);
-        httpContext.Response.Cookies.Delete(key, GetCookieOptions(httpContext));
-    }
-
-    private CookieOptions GetCookieOptions(HttpContext httpContext) =>
-        new()
-        {
-            // Prevent the client-side scripts from accessing the cookie.
-            HttpOnly = true,
-
-            // Mark the cookie as essential to the application, to enforce it despite any
-            // data collection consent options. This aligns with how ASP.NET Core Identity
-            // does when writing cookies for cookie authentication.
-            IsEssential = true,
-
-            // Cookie path must be root for optimal security.
-            Path = "/",
-
-            // For optimal security, the cooke must be secure. However, Umbraco allows for running development
-            // environments over HTTP, so we need to take that into account here.
-            // Thus, we will make the cookie secure if:
-            // - HTTPS is explicitly enabled by config (default for production environments), or
-            // - The current request is over HTTPS (meaning the environment supports it regardless of config).
-            Secure = _globalSettings.UseHttps || httpContext.Request.IsHttps,
-
-            // SameSite is configurable (see BackOfficeTokenCookieSettings for defaults):
-            SameSite = ParseSameSiteMode(_backOfficeTokenCookieSettings.SameSite),
-        };
-
-    private bool TryGetCookie(HttpContext httpContext, string cookieName, [NotNullWhen(true)] out string? value)
-    {
-        var key = GetCookieKey(httpContext, cookieName);
-        if (httpContext.Request.Cookies.TryGetValue(key, out var cookieValue))
-        {
-            value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
-            return true;
-        }
-
-        value = null;
-        return false;
-    }
-
-    private static SameSiteMode ParseSameSiteMode(string sameSiteMode) =>
-        Enum.TryParse(sameSiteMode, ignoreCase: true, out SameSiteMode result)
-            ? result
-            : throw new ArgumentException($"The provided {nameof(sameSiteMode)} value could not be parsed into as SameSiteMode value.", nameof(sameSiteMode));
-}

src/Umbraco.Cms.Api.Common/DependencyInjection/MvcBuilderExtensions.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
@@ -6,18 +6,8 @@ using Umbraco.Cms.Api.Common.Configuration;
 
 namespace Umbraco.Cms.Api.Common.DependencyInjection;
 
-/// <summary>
-///     Extension methods for <see cref="IMvcBuilder"/>.
-/// </summary>
 public static class MvcBuilderExtensions
 {
-    /// <summary>
-    ///     Adds named JSON serialization options to the MVC builder.
-    /// </summary>
-    /// <param name="builder">The MVC builder.</param>
-    /// <param name="settingsName">The name for the JSON options configuration.</param>
-    /// <param name="configure">The action to configure the JSON options.</param>
-    /// <returns>The MVC builder for method chaining.</returns>
     public static IMvcBuilder AddJsonOptions(this IMvcBuilder builder, string settingsName, Action<JsonOptions> configure)
     {
         builder.Services.Configure(settingsName, configure);

src/Umbraco.Cms.Api.Common/DependencyInjection/ProcessRequestContextHandler.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using OpenIddict.Server;
 using OpenIddict.Validation;
 using Umbraco.Cms.Core;
@@ -6,37 +6,21 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Common.DependencyInjection;
 
-/// <summary>
-///     Handles OpenIddict request processing to skip handling for non-authentication requests.
-/// </summary>
-/// <remarks>
-///     This handler prevents OpenIddict from processing every request to the server,
-///     limiting its scope to back-office and well-known OpenID Connect endpoints.
-/// </remarks>
 public class ProcessRequestContextHandler
     : IOpenIddictServerHandler<OpenIddictServerEvents.ProcessRequestContext>, IOpenIddictValidationHandler<OpenIddictValidationEvents.ProcessRequestContext>
 {
     private readonly IHttpContextAccessor _httpContextAccessor;
     private readonly string[] _pathsToHandle;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="ProcessRequestContextHandler"/> class.
-    /// </summary>
-    /// <param name="httpContextAccessor">The HTTP context accessor.</param>
     public ProcessRequestContextHandler(IHttpContextAccessor httpContextAccessor)
     {
         _httpContextAccessor = httpContextAccessor;
         var backOfficePathSegment = Constants.System.DefaultUmbracoPath.TrimStart(Constants.CharArrays.Tilde)
             .EnsureStartsWith('/')
             .EnsureEndsWith('/');
-        _pathsToHandle = [backOfficePathSegment, "/.well-known/openid-configuration", "/.well-known/jwks"];
+        _pathsToHandle = [backOfficePathSegment, "/.well-known/openid-configuration"];
     }
 
-    /// <summary>
-    ///     Handles the server process request context event.
-    /// </summary>
-    /// <param name="context">The process request context.</param>
-    /// <returns>A <see cref="ValueTask"/> representing the asynchronous operation.</returns>
     public ValueTask HandleAsync(OpenIddictServerEvents.ProcessRequestContext context)
     {
         if (SkipOpenIddictHandlingForRequest())
@@ -47,11 +31,6 @@ public class ProcessRequestContextHandler
         return ValueTask.CompletedTask;
     }
 
-    /// <summary>
-    ///     Handles the validation process request context event.
-    /// </summary>
-    /// <param name="context">The process request context.</param>
-    /// <returns>A <see cref="ValueTask"/> representing the asynchronous operation.</returns>
     public ValueTask HandleAsync(OpenIddictValidationEvents.ProcessRequestContext context)
     {
         if (SkipOpenIddictHandlingForRequest())

src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderApiExtensions.cs

@@ -7,16 +7,8 @@ using Umbraco.Cms.Web.Common.ApplicationBuilder;
 
 namespace Umbraco.Cms.Api.Common.DependencyInjection;
 
-/// <summary>
-///     Extension methods for <see cref="IUmbracoBuilder"/> to configure API services.
-/// </summary>
 public static class UmbracoBuilderApiExtensions
 {
-    /// <summary>
-    ///     Adds Umbraco API OpenAPI/Swagger UI services to the builder.
-    /// </summary>
-    /// <param name="builder">The Umbraco builder.</param>
-    /// <returns>The Umbraco builder for method chaining.</returns>
     public static IUmbracoBuilder AddUmbracoApiOpenApiUI(this IUmbracoBuilder builder)
     {
         if (builder.Services.Any(x => !x.IsKeyedService && x.ImplementationType == typeof(OperationIdSelector)))
@@ -33,7 +25,6 @@ public static class UmbracoBuilderApiExtensions
         builder.Services.AddSingleton<ISchemaIdHandler, SchemaIdHandler>();
         builder.Services.AddSingleton<ISubTypesSelector, SubTypesSelector>();
         builder.Services.AddSingleton<ISubTypesHandler, SubTypesHandler>();
-        builder.Services.AddSingleton<IDocumentInclusionSelector, DocumentInclusionSelector>();
         builder.Services.Configure<UmbracoPipelineOptions>(options => options.AddFilter(new SwaggerRouteTemplatePipelineFilter("UmbracoApiCommon")));
 
         return builder;

src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderAuthExtensions.cs

@@ -9,26 +9,13 @@ using Umbraco.Cms.Api.Common.Security;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DependencyInjection;
-using Umbraco.Cms.Core.Notifications;
-using Umbraco.Cms.Infrastructure.BackgroundJobs;
-using Umbraco.Cms.Infrastructure.BackgroundJobs.Jobs.DistributedJobs;
+using Umbraco.Cms.Infrastructure.BackgroundJobs.Jobs;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Common.DependencyInjection;
 
-/// <summary>
-///     Extension methods for <see cref="IUmbracoBuilder"/> to configure authentication services.
-/// </summary>
 public static class UmbracoBuilderAuthExtensions
 {
-    /// <summary>
-    ///     Adds OpenIddict authentication services for Umbraco APIs.
-    /// </summary>
-    /// <param name="builder">The Umbraco builder.</param>
-    /// <returns>The Umbraco builder for method chaining.</returns>
-    /// <remarks>
-    ///     Configures OpenIddict with authorization code flow (with PKCE), client credentials flow,
-    ///     reference tokens, and ASP.NET Core Data Protection for token encryption.
-    /// </remarks>
     public static IUmbracoBuilder AddUmbracoOpenIddict(this IUmbracoBuilder builder)
     {
         if (builder.Services.Any(x => !x.IsKeyedService && x.ImplementationType == typeof(OpenIddictCleanupJob)) is false)
@@ -126,25 +113,6 @@ public static class UmbracoBuilderAuthExtensions
                 {
                     configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
                 });
-
-                options.AddEventHandler<OpenIddictServerEvents.ApplyTokenResponseContext>(configuration =>
-                {
-                    configuration
-                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
-                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ProcessJsonResponse<OpenIddictServerEvents.ApplyTokenResponseContext>.Descriptor.Order - 1);
-                });
-                options.AddEventHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>(configuration =>
-                {
-                    configuration
-                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
-                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.Authentication.ProcessQueryResponse.Descriptor.Order - 1);
-                });
-                options.AddEventHandler<OpenIddictServerEvents.ExtractTokenRequestContext>(configuration =>
-                {
-                    configuration
-                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
-                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ExtractPostRequest<OpenIddictServerEvents.ExtractTokenRequestContext>.Descriptor.Order + 1);
-                });
             })
 
             // Register the OpenIddict validation components.
@@ -169,19 +137,9 @@ public static class UmbracoBuilderAuthExtensions
                 {
                     configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
                 });
-
-                options.AddEventHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>(configuration =>
-                {
-                    configuration
-                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
-                        // IMPORTANT: the handler must be AFTER the built-in query string handler, because the client-side SignalR library sometimes appends access tokens to the query string.
-                        .SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ExtractAccessTokenFromQueryString.Descriptor.Order + 1);
-                });
             });
 
-        builder.Services.AddSingleton<IDistributedBackgroundJob, OpenIddictCleanupJob>();
+        builder.Services.AddRecurringBackgroundJob<OpenIddictCleanupJob>();
         builder.Services.ConfigureOptions<ConfigureOpenIddict>();
-
-        builder.AddNotificationHandler<UserLogoutSuccessNotification, HideBackOfficeTokensHandler>();
     }
 }

src/Umbraco.Cms.Api.Common/Extensions/ActionDescriptorApiCommonExtensions.cs

@@ -1,36 +0,0 @@
-using Microsoft.AspNetCore.Mvc.Abstractions;
-using Umbraco.Cms.Api.Common.Attributes;
-using Umbraco.Cms.Api.Common.Configuration;
-
-namespace Umbraco.Extensions;
-
-/// <summary>
-/// Provides extension methods for <see cref="ActionDescriptor"/> to work with <see cref="MapToApiAttribute"/>.
-/// </summary>
-public static class ActionDescriptorApiCommonExtensions
-{
-    /// <summary>
-    /// Determines whether the <see cref="ActionDescriptor"/> has a <see cref="MapToApiAttribute"/> with the specified API name.
-    /// The check is made in runtime to support attributes added in runtime.
-    /// </summary>
-    /// <param name="actionDescriptor">The action descriptor to inspect.</param>
-    /// <param name="apiName">The API name to check for.</param>
-    /// <returns>
-    /// <c>true</c> if the <see cref="MapToApiAttribute"/> is present and matches the specified API name,
-    /// or if the attribute is not present and the API name matches the default API name; otherwise, <c>false</c>.
-    /// </returns>
-    public static bool HasMapToApiAttribute(this ActionDescriptor actionDescriptor, string apiName)
-    {
-        var value = actionDescriptor.GetMapToApiAttributeValue();
-
-        return value == apiName
-               || (value is null && apiName == DefaultApiConfiguration.ApiName);
-    }
-
-    private static string? GetMapToApiAttributeValue(this ActionDescriptor actionDescriptor)
-    {
-        IEnumerable<MapToApiAttribute> mapToApiAttributes = actionDescriptor?.EndpointMetadata?.OfType<MapToApiAttribute>() ?? [];
-
-        return mapToApiAttributes.SingleOrDefault()?.ApiName;
-    }
-}

src/Umbraco.Cms.Api.Common/Extensions/MethodInfoApiCommonExtensions.cs

@@ -5,28 +5,16 @@ using Umbraco.Cms.Api.Common.Configuration;
 
 namespace Umbraco.Extensions;
 
-/// <summary>
-///     Extension methods for <see cref="MethodInfo"/> to work with API-related attributes.
-/// </summary>
 public static class MethodInfoApiCommonExtensions
 {
-    /// <summary>
-    ///     Gets the API version values from <see cref="MapToApiVersionAttribute"/> applied to the method.
-    /// </summary>
-    /// <param name="methodInfo">The method info to inspect.</param>
-    /// <returns>A pipe-separated string of API version values.</returns>
-    public static string GetMapToApiVersionAttributeValue(this MethodInfo methodInfo)
+
+    public static string? GetMapToApiVersionAttributeValue(this MethodInfo methodInfo)
     {
         MapToApiVersionAttribute[] mapToApis = methodInfo.GetCustomAttributes(typeof(MapToApiVersionAttribute), inherit: true).Cast<MapToApiVersionAttribute>().ToArray();
 
-        return string.Join("|", mapToApis.SelectMany(x => x.Versions));
+        return string.Join("|", mapToApis.SelectMany(x=>x.Versions));
     }
 
-    /// <summary>
-    ///     Gets the API name from <see cref="MapToApiAttribute"/> applied to the method's declaring type.
-    /// </summary>
-    /// <param name="methodInfo">The method info to inspect.</param>
-    /// <returns>The API name if the attribute is present; otherwise, <c>null</c>.</returns>
     public static string? GetMapToApiAttributeValue(this MethodInfo methodInfo)
     {
         MapToApiAttribute[] mapToApis = (methodInfo.DeclaringType?.GetCustomAttributes(typeof(MapToApiAttribute), inherit: true) ?? Array.Empty<object>()).Cast<MapToApiAttribute>().ToArray();
@@ -34,15 +22,6 @@ public static class MethodInfoApiCommonExtensions
         return mapToApis.SingleOrDefault()?.ApiName;
     }
 
-    /// <summary>
-    ///     Determines whether the method's declaring type has a <see cref="MapToApiAttribute"/> with the specified API name.
-    /// </summary>
-    /// <param name="methodInfo">The method info to inspect.</param>
-    /// <param name="apiName">The API name to check for.</param>
-    /// <returns>
-    ///     <c>true</c> if the attribute is present and matches the specified API name,
-    ///     or if the attribute is not present and the API name matches the default API name; otherwise, <c>false</c>.
-    /// </returns>
     public static bool HasMapToApiAttribute(this MethodInfo methodInfo, string apiName)
     {
         var value = methodInfo.GetMapToApiAttributeValue();

src/Umbraco.Cms.Api.Common/Filters/JsonOptionsNameAttribute.cs

@@ -1,19 +1,9 @@
-namespace Umbraco.Cms.Api.Common.Filters;
+namespace Umbraco.Cms.Api.Common.Filters;
 
-/// <summary>
-///     Attribute used to specify the named JSON serialization options for a controller.
-/// </summary>
 [AttributeUsage(AttributeTargets.Class)]
 public class JsonOptionsNameAttribute : Attribute
 {
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="JsonOptionsNameAttribute"/> class.
-    /// </summary>
-    /// <param name="jsonOptionsName">The name of the JSON options configuration to use.</param>
     public JsonOptionsNameAttribute(string jsonOptionsName) => JsonOptionsName = jsonOptionsName;
 
-    /// <summary>
-    ///     Gets the name of the JSON options configuration.
-    /// </summary>
     public string JsonOptionsName { get; }
 }

src/Umbraco.Cms.Api.Common/Json/HttpContextJsonExtensions.cs

@@ -1,18 +1,10 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Umbraco.Cms.Api.Common.Filters;
 
 namespace Umbraco.Cms.Api.Common.Json;
 
-/// <summary>
-///     Extension methods for <see cref="HttpContext"/> related to JSON serialization.
-/// </summary>
 public static class HttpContextJsonExtensions
 {
-    /// <summary>
-    ///     Gets the named JSON options configuration for the current endpoint.
-    /// </summary>
-    /// <param name="context">The HTTP context.</param>
-    /// <returns>The JSON options name if specified via <see cref="JsonOptionsNameAttribute"/>; otherwise, <c>null</c>.</returns>
     public static string? CurrentJsonOptionsName(this HttpContext context)
         => context.GetEndpoint()?.Metadata.GetMetadata<JsonOptionsNameAttribute>()?.JsonOptionsName;
 }

src/Umbraco.Cms.Api.Common/Json/NamedSystemTextJsonInputFormatter.cs

@@ -1,31 +1,20 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Formatters;
 using Microsoft.Extensions.Logging;
 
 namespace Umbraco.Cms.Api.Common.Json;
 
-/// <summary>
-///     A JSON input formatter that only processes requests for endpoints with matching named JSON options.
-/// </summary>
-internal sealed class NamedSystemTextJsonInputFormatter : SystemTextJsonInputFormatter
+internal class NamedSystemTextJsonInputFormatter : SystemTextJsonInputFormatter
 {
     private readonly string _jsonOptionsName;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="NamedSystemTextJsonInputFormatter"/> class.
-    /// </summary>
-    /// <param name="jsonOptionsName">The name of the JSON options configuration this formatter handles.</param>
-    /// <param name="options">The JSON options.</param>
-    /// <param name="logger">The logger.</param>
     public NamedSystemTextJsonInputFormatter(string jsonOptionsName, JsonOptions options, ILogger<NamedSystemTextJsonInputFormatter> logger)
         : base(options, logger) =>
         _jsonOptionsName = jsonOptionsName;
 
-    /// <inheritdoc/>
     public override bool CanRead(InputFormatterContext context)
         => context.HttpContext.CurrentJsonOptionsName() == _jsonOptionsName && base.CanRead(context);
 
-    /// <inheritdoc/>
     public override async Task<InputFormatterResult> ReadAsync(InputFormatterContext context)
     {
         try

src/Umbraco.Cms.Api.Common/Json/NamedSystemTextJsonOutputFormatter.cs

@@ -1,26 +1,18 @@
-using System.Text.Json;
+using System.Text.Json;
 using Microsoft.AspNetCore.Mvc.Formatters;
 
 namespace Umbraco.Cms.Api.Common.Json;
 
-/// <summary>
-///     A JSON output formatter that only processes responses for endpoints with matching named JSON options.
-/// </summary>
-internal sealed class NamedSystemTextJsonOutputFormatter : SystemTextJsonOutputFormatter
+
+internal class NamedSystemTextJsonOutputFormatter : SystemTextJsonOutputFormatter
 {
     private readonly string _jsonOptionsName;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="NamedSystemTextJsonOutputFormatter"/> class.
-    /// </summary>
-    /// <param name="jsonOptionsName">The name of the JSON options configuration this formatter handles.</param>
-    /// <param name="jsonSerializerOptions">The JSON serializer options.</param>
     public NamedSystemTextJsonOutputFormatter(string jsonOptionsName, JsonSerializerOptions jsonSerializerOptions) : base(jsonSerializerOptions)
     {
         _jsonOptionsName = jsonOptionsName;
     }
 
-    /// <inheritdoc/>
     public override bool CanWriteResult(OutputFormatterCanWriteContext context)
         => context.HttpContext.CurrentJsonOptionsName() == _jsonOptionsName && base.CanWriteResult(context);
 }

src/Umbraco.Cms.Api.Common/Mvc/ActionResults/EmptyCreatedAtActionResult.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Routing;
 using Microsoft.Extensions.DependencyInjection;
@@ -16,13 +16,6 @@ public sealed class EmptyCreatedAtActionResult : ActionResult
     private readonly object _routeValues;
     private readonly string _resourceIdentifier;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="EmptyCreatedAtActionResult"/> class.
-    /// </summary>
-    /// <param name="actionName">The name of the action to generate the URL for.</param>
-    /// <param name="controllerName">The name of the controller to generate the URL for.</param>
-    /// <param name="routeValues">The route values to use for URL generation.</param>
-    /// <param name="resourceIdentifier">The identifier of the created resource.</param>
     public EmptyCreatedAtActionResult(string actionName, string controllerName, object routeValues, string resourceIdentifier)
     {
         _actionName = actionName;
@@ -31,7 +24,6 @@ public sealed class EmptyCreatedAtActionResult : ActionResult
         _resourceIdentifier = resourceIdentifier;
     }
 
-    /// <inheritdoc/>
     public override void ExecuteResult(ActionContext context)
     {
         ArgumentNullException.ThrowIfNull(context);

src/Umbraco.Cms.Api.Common/OpenApi/DocumentInclusionSelector.cs

@@ -1,30 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Mvc.Abstractions;
-using Microsoft.AspNetCore.Mvc.ApiExplorer;
-using Microsoft.AspNetCore.Mvc.Controllers;
-using Umbraco.Cms.Api.Common.Configuration;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Common.OpenApi;
-
-/// <summary>
-/// Determines whether an API description should be included in a specific documentation set based on the document name
-/// and API metadata.
-/// </summary>
-public class DocumentInclusionSelector : IDocumentInclusionSelector
-{
-    /// <inheritdoc/>
-    public bool Include(string documentName, ApiDescription apiDescription)
-    {
-        if (apiDescription.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor
-            && controllerActionDescriptor.HasMapToApiAttribute(documentName))
-        {
-            return true;
-        }
-
-        ApiVersionMetadata apiVersionMetadata = apiDescription.ActionDescriptor.GetApiVersionMetadata();
-        return apiVersionMetadata.Name == documentName
-               || (string.IsNullOrEmpty(apiVersionMetadata.Name) && documentName == DefaultApiConfiguration.ApiName);
-    }
-}
-

src/Umbraco.Cms.Api.Common/OpenApi/EnumSchemaFilter.cs

@@ -1,35 +1,25 @@
-using System.Reflection;
+using System.Reflection;
 using System.Runtime.Serialization;
-using System.Text.Json.Nodes;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     A schema filter that converts enum schemas to string type with enum member names.
-/// </summary>
-/// <remarks>
-///     This filter ensures enums are represented as strings in the OpenAPI schema,
-///     using <see cref="EnumMemberAttribute"/> values when available.
-/// </remarks>
 public class EnumSchemaFilter : ISchemaFilter
 {
-    /// <inheritdoc/>
-    public void Apply(IOpenApiSchema model, SchemaFilterContext context)
+    public void Apply(OpenApiSchema model, SchemaFilterContext context)
     {
-        if (model is not OpenApiSchema schema || context.Type.IsEnum is false)
+        if (context.Type.IsEnum)
         {
-            return;
-        }
-
-        schema.Type = JsonSchemaType.String;
-        schema.Format = null;
-        schema.Enum = new List<JsonNode>();
-        foreach (var name in Enum.GetNames(context.Type))
-        {
-            var actualName = context.Type.GetField(name)?.GetCustomAttribute<EnumMemberAttribute>()?.Value ?? name;
-            schema.Enum.Add(actualName);
+            model.Type = "string";
+            model.Format = null;
+            model.Enum.Clear();
+            foreach (var name in Enum.GetNames(context.Type))
+            {
+                var actualName = context.Type.GetField(name)?.GetCustomAttribute<EnumMemberAttribute>()?.Value ?? name;
+                model.Enum.Add(new OpenApiString(actualName));
+            }
         }
     }
 }

src/Umbraco.Cms.Api.Common/OpenApi/IDocumentInclusionSelector.cs

@@ -1,19 +0,0 @@
-using Microsoft.AspNetCore.Mvc.ApiExplorer;
-
-namespace Umbraco.Cms.Api.Common.OpenApi;
-
-/// <summary>
-/// Defines a method that determines whether a given API description should be included in a specific documentation
-/// document.
-/// </summary>
-public interface IDocumentInclusionSelector
-{
-    /// <summary>
-    /// Determines whether the specified API description should be included in the generated documentation for the given
-    /// document name.
-    /// </summary>
-    /// <param name="documentName">The name of the documentation document being generated.</param>
-    /// <param name="apiDescription">The API description to evaluate for inclusion.</param>
-    /// <returns>true if the API description should be included in the documentation; otherwise, false.</returns>
-    bool Include(string documentName, ApiDescription apiDescription);
-}

src/Umbraco.Cms.Api.Common/OpenApi/IOperationIdHandler.cs

@@ -2,22 +2,9 @@ using Microsoft.AspNetCore.Mvc.ApiExplorer;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Defines a handler for generating OpenAPI operation IDs.
-/// </summary>
 public interface IOperationIdHandler
 {
-    /// <summary>
-    ///     Determines whether this handler can generate an operation ID for the specified API description.
-    /// </summary>
-    /// <param name="apiDescription">The API description to check.</param>
-    /// <returns><c>true</c> if this handler can handle the API description; otherwise, <c>false</c>.</returns>
-    bool CanHandle(ApiDescription apiDescription);
+     bool CanHandle(ApiDescription apiDescription);
 
-    /// <summary>
-    ///     Generates an operation ID for the specified API description.
-    /// </summary>
-    /// <param name="apiDescription">The API description to generate an operation ID for.</param>
-    /// <returns>The generated operation ID.</returns>
-    string Handle(ApiDescription apiDescription);
+     string Handle(ApiDescription apiDescription);
 }

src/Umbraco.Cms.Api.Common/OpenApi/IOperationIdSelector.cs

@@ -3,15 +3,10 @@ using Microsoft.AspNetCore.Mvc.ApiExplorer;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Defines a selector for choosing operation IDs from registered handlers.
-/// </summary>
 public interface IOperationIdSelector
 {
-    /// <summary>
-    ///     Selects an operation ID for the specified API description.
-    /// </summary>
-    /// <param name="apiDescription">The API description to generate an operation ID for.</param>
-    /// <returns>The operation ID, or <c>null</c> if none could be determined.</returns>
+    [Obsolete("Use overload that only takes ApiDescription instead. This will be removed in Umbraco 15.")]
+    string? OperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions);
+
     string? OperationId(ApiDescription apiDescription);
 }

src/Umbraco.Cms.Api.Common/OpenApi/ISchemaIdHandler.cs

@@ -1,21 +1,8 @@
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Defines a handler for generating OpenAPI schema IDs.
-/// </summary>
 public interface ISchemaIdHandler
 {
-    /// <summary>
-    ///     Determines whether this handler can generate a schema ID for the specified type.
-    /// </summary>
-    /// <param name="type">The type to check.</param>
-    /// <returns><c>true</c> if this handler can handle the type; otherwise, <c>false</c>.</returns>
     bool CanHandle(Type type);
 
-    /// <summary>
-    ///     Generates a schema ID for the specified type.
-    /// </summary>
-    /// <param name="type">The type to generate a schema ID for.</param>
-    /// <returns>The generated schema ID.</returns>
     string Handle(Type type);
 }

src/Umbraco.Cms.Api.Common/OpenApi/ISchemaIdSelector.cs

@@ -1,14 +1,6 @@
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Defines a selector for choosing schema IDs from registered handlers.
-/// </summary>
 public interface ISchemaIdSelector
 {
-    /// <summary>
-    ///     Selects a schema ID for the specified type.
-    /// </summary>
-    /// <param name="type">The type to generate a schema ID for.</param>
-    /// <returns>The schema ID.</returns>
     string SchemaId(Type type);
 }

src/Umbraco.Cms.Api.Common/OpenApi/ISubTypesHandler.cs

@@ -1,22 +1,8 @@
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Defines a handler for discovering sub-types for polymorphic OpenAPI schemas.
-/// </summary>
 public interface ISubTypesHandler
 {
-    /// <summary>
-    ///     Determines whether this handler can discover sub-types for the specified type and document.
-    /// </summary>
-    /// <param name="type">The type to check.</param>
-    /// <param name="documentName">The OpenAPI document name.</param>
-    /// <returns><c>true</c> if this handler can handle the type; otherwise, <c>false</c>.</returns>
     bool CanHandle(Type type, string documentName);
 
-    /// <summary>
-    ///     Discovers sub-types for the specified type.
-    /// </summary>
-    /// <param name="type">The type to discover sub-types for.</param>
-    /// <returns>An enumerable of discovered sub-types.</returns>
     IEnumerable<Type> Handle(Type type);
 }

src/Umbraco.Cms.Api.Common/OpenApi/ISubTypesSelector.cs

@@ -1,14 +1,6 @@
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Defines a selector for choosing sub-types from registered handlers.
-/// </summary>
 public interface ISubTypesSelector
 {
-    /// <summary>
-    ///     Selects sub-types for the specified type for polymorphic OpenAPI schema generation.
-    /// </summary>
-    /// <param name="type">The type to find sub-types for.</param>
-    /// <returns>An enumerable of sub-types.</returns>
     IEnumerable<Type> SubTypes(Type type);
 }

src/Umbraco.Cms.Api.Common/OpenApi/MimeTypeDocumentFilter.cs

@@ -1,4 +1,4 @@
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Extensions;
 
@@ -11,13 +11,8 @@ public class MimeTypeDocumentFilter : IDocumentFilter
 {
     private readonly string _documentName;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="MimeTypeDocumentFilter"/> class.
-    /// </summary>
-    /// <param name="documentName">The name of the OpenAPI document to filter.</param>
     public MimeTypeDocumentFilter(string documentName) => _documentName = documentName;
 
-    /// <inheritdoc/>
     public void Apply(OpenApiDocument swaggerDoc, DocumentFilterContext context)
     {
         if (context.DocumentName != _documentName)
@@ -26,32 +21,25 @@ public class MimeTypeDocumentFilter : IDocumentFilter
         }
 
         OpenApiOperation[] operations = swaggerDoc.Paths
-            .SelectMany(path => path.Value.Operations?.Values ?? Enumerable.Empty<OpenApiOperation>())
+            .SelectMany(path => path.Value.Operations.Values)
             .ToArray();
 
-        static void RemoveUnwantedMimeTypes(IDictionary<string, OpenApiMediaType>? content)
+        void RemoveUnwantedMimeTypes(IDictionary<string, OpenApiMediaType> content)
         {
-            if (content is null || content.ContainsKey("application/json") is false)
+            if (content.ContainsKey("application/json"))
             {
-                return;
+                content.RemoveAll(r => r.Key != "application/json");
             }
 
-            content.RemoveAll(r => r.Key != "application/json");
         }
 
-        OpenApiRequestBody[] requestBodies = operations
-            .Select(operation => operation.RequestBody)
-            .OfType<OpenApiRequestBody>()
-            .ToArray();
+        OpenApiRequestBody[] requestBodies = operations.Select(operation => operation.RequestBody).WhereNotNull().ToArray();
         foreach (OpenApiRequestBody requestBody in requestBodies)
         {
             RemoveUnwantedMimeTypes(requestBody.Content);
         }
 
-        OpenApiResponse[] responses = operations
-            .SelectMany(operation => operation.Responses?.Values ?? Enumerable.Empty<IOpenApiResponse>())
-            .OfType<OpenApiResponse>()
-            .ToArray();
+        OpenApiResponse[] responses = operations.SelectMany(operation => operation.Responses.Values).WhereNotNull().ToArray();
         foreach (OpenApiResponse response in responses)
         {
             RemoveUnwantedMimeTypes(response.Content);

src/Umbraco.Cms.Api.Common/OpenApi/OperationIdHandler.cs

@@ -6,24 +6,14 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Default handler for generating OpenAPI operation IDs for Umbraco API controllers.
-/// </summary>
-/// <remarks>
-///     Left unsealed on purpose, so it is extendable by consuming APIs.
-/// </remarks>
+// NOTE: Left unsealed on purpose, so it is extendable.
 public class OperationIdHandler : IOperationIdHandler
 {
     private readonly ApiVersioningOptions _apiVersioningOptions;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="OperationIdHandler"/> class.
-    /// </summary>
-    /// <param name="apiVersioningOptions">The API versioning options.</param>
     public OperationIdHandler(IOptions<ApiVersioningOptions> apiVersioningOptions)
         => _apiVersioningOptions = apiVersioningOptions.Value;
 
-    /// <inheritdoc/>
     public bool CanHandle(ApiDescription apiDescription)
     {
         if (apiDescription.ActionDescriptor is not ControllerActionDescriptor controllerActionDescriptor)
@@ -34,16 +24,9 @@ public class OperationIdHandler : IOperationIdHandler
         return CanHandle(apiDescription, controllerActionDescriptor);
     }
 
-    /// <summary>
-    ///     Determines whether this handler can process the API description based on the controller namespace.
-    /// </summary>
-    /// <param name="apiDescription">The API description.</param>
-    /// <param name="controllerActionDescriptor">The controller action descriptor.</param>
-    /// <returns><c>true</c> if the controller is in an Umbraco.Cms.Api namespace; otherwise, <c>false</c>.</returns>
     protected virtual bool CanHandle(ApiDescription apiDescription, ControllerActionDescriptor controllerActionDescriptor)
         => controllerActionDescriptor.ControllerTypeInfo.Namespace?.StartsWith("Umbraco.Cms.Api") is true;
 
-    /// <inheritdoc/>
     public virtual string Handle(ApiDescription apiDescription)
         => UmbracoOperationId(apiDescription);
 

src/Umbraco.Cms.Api.Common/OpenApi/OperationIdRegexes.cs

@@ -1,4 +1,4 @@
-using System.Text.RegularExpressions;
+using System.Text.RegularExpressions;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 

src/Umbraco.Cms.Api.Common/OpenApi/OperationIdSelector.cs

@@ -3,30 +3,22 @@ using Microsoft.AspNetCore.Mvc.ApiExplorer;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Selects an operation ID for an API description using registered handlers.
-/// </summary>
 public class OperationIdSelector : IOperationIdSelector
 {
     private readonly IEnumerable<IOperationIdHandler> _operationIdHandlers;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="OperationIdSelector"/> class.
-    /// </summary>
     [Obsolete("Use non-obsolete constructor. This will be removed in Umbraco 15.")]
     public OperationIdSelector()
         : this(Enumerable.Empty<IOperationIdHandler>())
     {
     }
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="OperationIdSelector"/> class.
-    /// </summary>
-    /// <param name="operationIdHandlers">The registered operation ID handlers.</param>
     public OperationIdSelector(IEnumerable<IOperationIdHandler> operationIdHandlers)
         => _operationIdHandlers = operationIdHandlers;
 
-    /// <inheritdoc/>
+    [Obsolete("Use overload that only takes ApiDescription instead. This will be removed in Umbraco 15.")]
+    public virtual string? OperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions) => OperationId(apiDescription);
+
     public virtual string? OperationId(ApiDescription apiDescription)
     {
         IOperationIdHandler? handler = _operationIdHandlers.FirstOrDefault(h => h.CanHandle(apiDescription));

src/Umbraco.Cms.Api.Common/OpenApi/RemoveSecuritySchemesDocumentFilter.cs

@@ -1,4 +1,4 @@
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
@@ -10,14 +10,9 @@ public class RemoveSecuritySchemesDocumentFilter : IDocumentFilter
 {
     private readonly string _documentName;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="RemoveSecuritySchemesDocumentFilter"/> class.
-    /// </summary>
-    /// <param name="documentName">The name of the OpenAPI document to filter.</param>
     public RemoveSecuritySchemesDocumentFilter(string documentName)
         => _documentName = documentName;
 
-    /// <inheritdoc/>
     public void Apply(OpenApiDocument swaggerDoc, DocumentFilterContext context)
     {
         if (context.DocumentName != _documentName)
@@ -25,6 +20,6 @@ public class RemoveSecuritySchemesDocumentFilter : IDocumentFilter
             return;
         }
 
-        swaggerDoc.Components?.SecuritySchemes?.Clear();
+        swaggerDoc.Components.SecuritySchemes.Clear();
     }
 }

src/Umbraco.Cms.Api.Common/OpenApi/SchemaIdHandler.cs

@@ -3,20 +3,12 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Default handler for generating OpenAPI schema IDs for Umbraco types.
-/// </summary>
-/// <remarks>
-///     Left unsealed on purpose, so it is extendable by consuming APIs.
-///     Adds "Model" suffix to avoid TypeScript name clashes and removes invalid characters.
-/// </remarks>
+// NOTE: Left unsealed on purpose, so it is extendable.
 public class SchemaIdHandler : ISchemaIdHandler
 {
-    /// <inheritdoc/>
     public virtual bool CanHandle(Type type)
         => type.Namespace?.StartsWith("Umbraco.Cms") is true;
 
-    /// <inheritdoc/>
     public virtual string Handle(Type type)
         => UmbracoSchemaId(type);
 

src/Umbraco.Cms.Api.Common/OpenApi/SchemaIdSelector.cs

@@ -1,20 +1,12 @@
-namespace Umbraco.Cms.Api.Common.OpenApi;
+namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Selects a schema ID for a type using registered handlers.
-/// </summary>
 public class SchemaIdSelector : ISchemaIdSelector
 {
     private readonly IEnumerable<ISchemaIdHandler> _schemaIdHandlers;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="SchemaIdSelector"/> class.
-    /// </summary>
-    /// <param name="schemaIdHandlers">The registered schema ID handlers.</param>
     public SchemaIdSelector(IEnumerable<ISchemaIdHandler> schemaIdHandlers)
         => _schemaIdHandlers = schemaIdHandlers;
 
-    /// <inheritdoc/>
     public virtual string SchemaId(Type type)
     {
         ISchemaIdHandler? handler = _schemaIdHandlers.FirstOrDefault(h => h.CanHandle(type));

src/Umbraco.Cms.Api.Common/OpenApi/SubTypesHandler.cs

@@ -2,33 +2,19 @@ using Umbraco.Cms.Api.Common.Serialization;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Default handler for discovering sub-types for polymorphic OpenAPI schemas.
-/// </summary>
 public class SubTypesHandler : ISubTypesHandler
 {
     private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="SubTypesHandler"/> class.
-    /// </summary>
-    /// <param name="umbracoJsonTypeInfoResolver">The JSON type info resolver for finding sub-types.</param>
     public SubTypesHandler(IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
         => _umbracoJsonTypeInfoResolver = umbracoJsonTypeInfoResolver;
 
-    /// <summary>
-    ///     Determines whether this handler can process the specified type based on namespace.
-    /// </summary>
-    /// <param name="type">The type to check.</param>
-    /// <returns><c>true</c> if the type is in an Umbraco.Cms namespace; otherwise, <c>false</c>.</returns>
     protected virtual bool CanHandle(Type type)
         => type.Namespace?.StartsWith("Umbraco.Cms") is true;
 
-    /// <inheritdoc/>
     public virtual bool CanHandle(Type type, string documentName)
         => CanHandle(type);
 
-    /// <inheritdoc/>
     public virtual IEnumerable<Type> Handle(Type type)
         => _umbracoJsonTypeInfoResolver.FindSubTypes(type);
 }

src/Umbraco.Cms.Api.Common/OpenApi/SubTypesSelector.cs

@@ -8,45 +8,38 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Selects sub-types for polymorphic OpenAPI schemas using registered handlers.
-/// </summary>
 public class SubTypesSelector : ISubTypesSelector
 {
+    private readonly IOptions<GlobalSettings> _settings;
     private readonly IHostingEnvironment _hostingEnvironment;
     private readonly IHttpContextAccessor _httpContextAccessor;
     private readonly IEnumerable<ISubTypesHandler> _subTypeHandlers;
     private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="SubTypesSelector"/> class.
-    /// </summary>
-    /// <param name="hostingEnvironment">The hosting environment.</param>
-    /// <param name="httpContextAccessor">The HTTP context accessor.</param>
-    /// <param name="subTypeHandlers">The registered sub-type handlers.</param>
-    /// <param name="umbracoJsonTypeInfoResolver">The JSON type info resolver for finding sub-types.</param>
     public SubTypesSelector(
+        IOptions<GlobalSettings> settings,
         IHostingEnvironment hostingEnvironment,
         IHttpContextAccessor httpContextAccessor,
         IEnumerable<ISubTypesHandler> subTypeHandlers,
         IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
     {
+        _settings = settings;
         _hostingEnvironment = hostingEnvironment;
         _httpContextAccessor = httpContextAccessor;
         _subTypeHandlers = subTypeHandlers;
         _umbracoJsonTypeInfoResolver = umbracoJsonTypeInfoResolver;
     }
 
-    /// <inheritdoc/>
     public IEnumerable<Type> SubTypes(Type type)
     {
-        var backOfficePath = _hostingEnvironment.GetBackOfficePath();
+        var backOfficePath =  _settings.Value.GetBackOfficePath(_hostingEnvironment);
         var swaggerPath = $"{backOfficePath}/swagger";
 
         if (_httpContextAccessor.HttpContext?.Request.Path.StartsWithSegments(swaggerPath) ?? false)
         {
             // Split the path into segments
-            var segments = _httpContextAccessor.HttpContext.Request.Path.Value![swaggerPath.Length..]
+            var segments = _httpContextAccessor.HttpContext.Request.Path.Value!
+                .Substring(swaggerPath.Length)
                 .TrimStart(Constants.CharArrays.ForwardSlash)
                 .Split(Constants.CharArrays.ForwardSlash);
 

src/Umbraco.Cms.Api.Common/OpenApi/SwaggerRouteTemplatePipelineFilter.cs

@@ -3,25 +3,19 @@ using Microsoft.AspNetCore.Hosting;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Swashbuckle.AspNetCore.SwaggerUI;
 using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Hosting;
+using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Web.Common.ApplicationBuilder;
+using Umbraco.Extensions;
 using IHostingEnvironment = Umbraco.Cms.Core.Hosting.IHostingEnvironment;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-/// <summary>
-///     Pipeline filter that configures Swagger/OpenAPI endpoints for Umbraco APIs.
-/// </summary>
 public class SwaggerRouteTemplatePipelineFilter : UmbracoPipelineFilter
 {
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="SwaggerRouteTemplatePipelineFilter"/> class.
-    /// </summary>
-    /// <param name="name">The name of the pipeline filter.</param>
     public SwaggerRouteTemplatePipelineFilter(string name)
         : base(name)
         => PostPipeline = PostPipelineAction;
@@ -36,43 +30,25 @@ public class SwaggerRouteTemplatePipelineFilter : UmbracoPipelineFilter
         IOptions<SwaggerGenOptions> swaggerGenOptions = applicationBuilder.ApplicationServices.GetRequiredService<IOptions<SwaggerGenOptions>>();
 
         applicationBuilder.UseSwagger(swaggerOptions =>
-        {
-            swaggerOptions.RouteTemplate = SwaggerRouteTemplate(applicationBuilder);
-        });
+            {
+                swaggerOptions.RouteTemplate = SwaggerRouteTemplate(applicationBuilder);
+            });
 
         applicationBuilder.UseSwaggerUI(swaggerUiOptions => SwaggerUiConfiguration(swaggerUiOptions, swaggerGenOptions.Value, applicationBuilder));
     }
 
-    /// <summary>
-    ///     Determines whether Swagger is enabled for the application.
-    /// </summary>
-    /// <param name="applicationBuilder">The application builder.</param>
-    /// <returns><c>true</c> if Swagger is enabled; otherwise, <c>false</c>.</returns>
     protected virtual bool SwaggerIsEnabled(IApplicationBuilder applicationBuilder)
-        => applicationBuilder.ApplicationServices.GetRequiredService<IWebHostEnvironment>().IsProduction() is false;
+    {
+        IWebHostEnvironment webHostEnvironment = applicationBuilder.ApplicationServices.GetRequiredService<IWebHostEnvironment>();
+        return webHostEnvironment.IsProduction() is false;
+    }
 
-    /// <summary>
-    ///     Gets the route template for Swagger JSON endpoints.
-    /// </summary>
-    /// <param name="applicationBuilder">The application builder.</param>
-    /// <returns>The Swagger route template.</returns>
     protected virtual string SwaggerRouteTemplate(IApplicationBuilder applicationBuilder)
-        => $"{GetBackOfficePath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger/{{documentName}}/swagger.json";
+        => $"{GetUmbracoPath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger/{{documentName}}/swagger.json";
 
-    /// <summary>
-    ///     Gets the route prefix for the Swagger UI.
-    /// </summary>
-    /// <param name="applicationBuilder">The application builder.</param>
-    /// <returns>The Swagger UI route prefix.</returns>
     protected virtual string SwaggerUiRoutePrefix(IApplicationBuilder applicationBuilder)
-        => $"{GetBackOfficePath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger";
+        => $"{GetUmbracoPath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger";
 
-    /// <summary>
-    ///     Configures the Swagger UI options.
-    /// </summary>
-    /// <param name="swaggerUiOptions">The Swagger UI options to configure.</param>
-    /// <param name="swaggerGenOptions">The Swagger generation options.</param>
-    /// <param name="applicationBuilder">The application builder.</param>
     protected virtual void SwaggerUiConfiguration(
         SwaggerUIOptions swaggerUiOptions,
         SwaggerGenOptions swaggerGenOptions,
@@ -80,7 +56,8 @@ public class SwaggerRouteTemplatePipelineFilter : UmbracoPipelineFilter
     {
         swaggerUiOptions.RoutePrefix = SwaggerUiRoutePrefix(applicationBuilder);
 
-        foreach ((var name, OpenApiInfo? apiInfo) in swaggerGenOptions.SwaggerGeneratorOptions.SwaggerDocs.OrderBy(x => x.Value.Title))
+        foreach ((var name, OpenApiInfo? apiInfo) in swaggerGenOptions.SwaggerGeneratorOptions.SwaggerDocs
+                     .OrderBy(x => x.Value.Title))
         {
             swaggerUiOptions.SwaggerEndpoint($"{name}/swagger.json", $"{apiInfo.Title}");
         }
@@ -93,6 +70,11 @@ public class SwaggerRouteTemplatePipelineFilter : UmbracoPipelineFilter
         swaggerUiOptions.OAuthUsePkce();
     }
 
-    private string GetBackOfficePath(IApplicationBuilder applicationBuilder)
-        => applicationBuilder.ApplicationServices.GetRequiredService<IHostingEnvironment>().GetBackOfficePath();
+    private string GetUmbracoPath(IApplicationBuilder applicationBuilder)
+    {
+        GlobalSettings settings = applicationBuilder.ApplicationServices.GetRequiredService<IOptions<GlobalSettings>>().Value;
+        IHostingEnvironment hostingEnvironment = applicationBuilder.ApplicationServices.GetRequiredService<IHostingEnvironment>();
+
+        return settings.GetBackOfficePath(hostingEnvironment);
+    }
 }

src/Umbraco.Cms.Api.Common/Rendering/ElementOnlyOutputExpansionStrategy.cs

@@ -1,198 +0,0 @@
-using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Common.Rendering;
-
-/// <summary>
-///     Implements output expansion strategy for element-only rendering in the Delivery API.
-/// </summary>
-/// <remarks>
-///     This strategy handles the expansion and filtering of properties when rendering content
-///     through the Delivery API based on expand and fields query parameters.
-/// </remarks>
-public class ElementOnlyOutputExpansionStrategy : IOutputExpansionStrategy
-{
-    /// <summary>
-    ///     The parameter value indicating all properties should be included.
-    /// </summary>
-    protected const string All = "$all";
-
-    /// <summary>
-    ///     The parameter value indicating no properties should be included.
-    /// </summary>
-    protected const string None = "";
-
-    /// <summary>
-    ///     The name of the expand query parameter.
-    /// </summary>
-    protected const string ExpandParameterName = "expand";
-
-    /// <summary>
-    ///     The name of the fields query parameter.
-    /// </summary>
-    protected const string FieldsParameterName = "fields";
-
-    private readonly IApiPropertyRenderer _propertyRenderer;
-
-    /// <summary>
-    ///     Gets the stack of expand property nodes for tracking nested expansions.
-    /// </summary>
-    protected Stack<Node?> ExpandProperties { get; } = new();
-
-    /// <summary>
-    ///     Gets the stack of include property nodes for tracking nested field selections.
-    /// </summary>
-    protected Stack<Node?> IncludeProperties { get; } = new();
-
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="ElementOnlyOutputExpansionStrategy"/> class.
-    /// </summary>
-    /// <param name="propertyRenderer">The property renderer for converting property values.</param>
-    public ElementOnlyOutputExpansionStrategy(
-        IApiPropertyRenderer propertyRenderer)
-    {
-        _propertyRenderer = propertyRenderer;
-    }
-
-    /// <inheritdoc/>
-    public virtual IDictionary<string, object?> MapContentProperties(IPublishedContent content)
-        => content.ItemType == PublishedItemType.Content
-            ? MapProperties(content.Properties)
-            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");
-
-    /// <inheritdoc/>
-    public virtual IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
-    {
-        if (media.ItemType != PublishedItemType.Media)
-        {
-            throw new ArgumentException($"Invalid item type. This method can only be used with item type {PublishedItemType.Media}, got: {media.ItemType}");
-        }
-
-        IPublishedProperty[] properties = media
-            .Properties
-            .Where(p => skipUmbracoProperties is false || p.Alias.StartsWith("umbraco") is false)
-            .ToArray();
-
-        return properties.Any()
-            ? MapProperties(properties)
-            : new Dictionary<string, object?>();
-    }
-
-    /// <inheritdoc/>
-    public virtual IDictionary<string, object?> MapElementProperties(IPublishedElement element)
-        => MapProperties(element.Properties, true);
-
-    private IDictionary<string, object?> MapProperties(IEnumerable<IPublishedProperty> properties, bool forceExpandProperties = false)
-    {
-        Node? currentExpandProperties = ExpandProperties.Count > 0 ? ExpandProperties.Peek() : null;
-        if (ExpandProperties.Count > 1 && currentExpandProperties is null && forceExpandProperties is false)
-        {
-            return new Dictionary<string, object?>();
-        }
-
-        Node? currentIncludeProperties = IncludeProperties.Count > 0 ? IncludeProperties.Peek() : null;
-        var result = new Dictionary<string, object?>();
-        foreach (IPublishedProperty property in properties)
-        {
-            Node? nextIncludeProperties = GetNextProperties(currentIncludeProperties, property.Alias);
-            if (currentIncludeProperties is not null && currentIncludeProperties.Items.Any() && nextIncludeProperties is null)
-            {
-                continue;
-            }
-
-            Node? nextExpandProperties = GetNextProperties(currentExpandProperties, property.Alias);
-
-            IncludeProperties.Push(nextIncludeProperties);
-            ExpandProperties.Push(nextExpandProperties);
-
-            result[property.Alias] = GetPropertyValue(property);
-
-            ExpandProperties.Pop();
-            IncludeProperties.Pop();
-        }
-
-        return result;
-    }
-
-    private Node? GetNextProperties(Node? currentProperties, string propertyAlias)
-        => currentProperties?.Items.FirstOrDefault(i => i.Key == All)
-           ?? currentProperties?.Items.FirstOrDefault(i => i.Key == "properties")?.Items.FirstOrDefault(i => i.Key == All || i.Key == propertyAlias);
-
-    private object? GetPropertyValue(IPublishedProperty property)
-        => _propertyRenderer.GetPropertyValue(property, ExpandProperties.Peek() is not null);
-
-    /// <summary>
-    ///     Represents a node in the parsed expand/fields parameter tree structure.
-    /// </summary>
-    protected sealed class Node
-    {
-        /// <summary>
-        ///     Gets the key of this node.
-        /// </summary>
-        public string Key { get; private set; } = string.Empty;
-
-        /// <summary>
-        ///     Gets the child nodes of this node.
-        /// </summary>
-        public List<Node> Items { get; } = new();
-
-        /// <summary>
-        ///     Parses an expand/fields parameter value into a node tree structure.
-        /// </summary>
-        /// <param name="value">The parameter value to parse.</param>
-        /// <returns>The root node of the parsed tree.</returns>
-        /// <exception cref="ArgumentException">Thrown when the value has invalid syntax.</exception>
-        public static Node Parse(string value)
-        {
-            // verify that there are as many start brackets as there are end brackets
-            if (value.CountOccurrences("[") != value.CountOccurrences("]"))
-            {
-                throw new ArgumentException("Value did not contain an equal number of start and end brackets");
-            }
-
-            // verify that the value does not start with a start bracket
-            if (value.StartsWith("["))
-            {
-                throw new ArgumentException("Value cannot start with a bracket");
-            }
-
-            // verify that there are no empty brackets
-            if (value.Contains("[]"))
-            {
-                throw new ArgumentException("Value cannot contain empty brackets");
-            }
-
-            var stack = new Stack<Node>();
-            var root = new Node { Key = "root" };
-            stack.Push(root);
-
-            var currentNode = new Node();
-            root.Items.Add(currentNode);
-
-            foreach (char c in value)
-            {
-                switch (c)
-                {
-                    case '[': // Start a new node, child of the current node
-                        stack.Push(currentNode);
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ',': // Start a new node, but at the same level of the current node
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ']': // Back to parent of the current node
-                        currentNode = stack.Pop();
-                        break;
-                    default: // Add char to current node key
-                        currentNode.Key += c;
-                        break;
-                }
-            }
-
-            return root;
-        }
-    }
-}

src/Umbraco.Cms.Api.Common/Security/ExposeBackOfficeAuthenticationOpenIddictServerEventsHandler.cs

@@ -1,84 +0,0 @@
-using System.Security.Claims;
-using Microsoft.AspNetCore.Authentication;
-using Microsoft.AspNetCore.Http;
-using Microsoft.Extensions.Options;
-using OpenIddict.Server;
-using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Infrastructure.Security;
-
-/// <summary>
-/// Provides OpenIddict server event handlers to expose the backoffice authentication token via a custom authentication scheme.
-/// </summary>
-public class ExposeBackOfficeAuthenticationOpenIddictServerEventsHandler : IOpenIddictServerHandler<OpenIddictServerEvents.GenerateTokenContext>,
-    IOpenIddictServerHandler<OpenIddictServerEvents.ApplyRevocationResponseContext>
-{
-    private readonly IHttpContextAccessor _httpContextAccessor;
-    private readonly string[] _claimTypes;
-    private readonly TimeSpan _timeOut;
-
-    /// <summary>
-    /// Initializes a new instance of the <see cref="ExposeBackOfficeAuthenticationOpenIddictServerEventsHandler"/> class.
-    /// </summary>
-    public ExposeBackOfficeAuthenticationOpenIddictServerEventsHandler(
-        IHttpContextAccessor httpContextAccessor,
-        IOptions<GlobalSettings> globalSettings,
-        IOptions<BackOfficeIdentityOptions> backOfficeIdentityOptions)
-    {
-        _httpContextAccessor = httpContextAccessor;
-        _timeOut = globalSettings.Value.TimeOut;
-
-        // These are the type identifiers for the claims required by the principal
-        // for the custom authentication scheme.
-        // We make available the ID, user name and allowed applications (sections) claims.
-        _claimTypes =
-        [
-            backOfficeIdentityOptions.Value.ClaimsIdentity.UserIdClaimType,
-            backOfficeIdentityOptions.Value.ClaimsIdentity.UserNameClaimType,
-            Core.Constants.Security.AllowedApplicationsClaimType,
-        ];
-    }
-
-    /// <inheritdoc/>
-    /// <remarks>
-    /// Event handler for when access tokens are generated (created or refreshed).
-    /// </remarks>
-    public async ValueTask HandleAsync(OpenIddictServerEvents.GenerateTokenContext context)
-    {
-        // Only proceed if this is a back-office sign-in.
-        if (context.Principal.Identity?.AuthenticationType != Core.Constants.Security.BackOfficeAuthenticationType)
-        {
-            return;
-        }
-
-        // Create a new principal with the claims from the authenticated principal.
-        var principal = new ClaimsPrincipal(
-            new ClaimsIdentity(
-                context.Principal.Claims.Where(claim => _claimTypes.Contains(claim.Type)),
-                Core.Constants.Security.BackOfficeExposedAuthenticationType));
-
-        // Sign-in the new principal for the custom authentication scheme.
-        await _httpContextAccessor
-            .GetRequiredHttpContext()
-            .SignInAsync(Core.Constants.Security.BackOfficeExposedAuthenticationType, principal, GetAuthenticationProperties());
-    }
-
-    /// <inheritdoc/>
-    /// <remarks>
-    /// Event handler for when access tokens are revoked.
-    /// </remarks>
-    public async ValueTask HandleAsync(OpenIddictServerEvents.ApplyRevocationResponseContext context)
-        => await _httpContextAccessor
-            .GetRequiredHttpContext()
-            .SignOutAsync(Core.Constants.Security.BackOfficeExposedAuthenticationType, GetAuthenticationProperties());
-
-    private AuthenticationProperties GetAuthenticationProperties()
-        => new()
-        {
-            IsPersistent = true,
-            IssuedUtc = DateTimeOffset.UtcNow,
-            ExpiresUtc = DateTimeOffset.UtcNow.Add(_timeOut)
-        };
-}

src/Umbraco.Cms.Api.Common/Security/Paths.cs

@@ -2,77 +2,35 @@ using Umbraco.Cms.Core;
 
 namespace Umbraco.Cms.Api.Common.Security;
 
-/// <summary>
-///     Contains OAuth/OpenID Connect endpoint paths for Umbraco APIs.
-/// </summary>
 public static class Paths
 {
-    /// <summary>
-    ///     Contains endpoint paths for back-office authentication.
-    /// </summary>
     public static class BackOfficeApi
     {
-        /// <summary>
-        ///     The base endpoint template for back-office security endpoints.
-        /// </summary>
         public const string EndpointTemplate = "security/back-office";
 
-        /// <summary>
-        ///     The authorization endpoint path.
-        /// </summary>
         public static readonly string AuthorizationEndpoint = EndpointPath($"{EndpointTemplate}/authorize");
 
-        /// <summary>
-        ///     The token endpoint path.
-        /// </summary>
         public static readonly string TokenEndpoint = EndpointPath($"{EndpointTemplate}/token");
 
-        /// <summary>
-        ///     The logout/sign-out endpoint path.
-        /// </summary>
         public static readonly string LogoutEndpoint = EndpointPath($"{EndpointTemplate}/signout");
 
-        /// <summary>
-        ///     The token revocation endpoint path.
-        /// </summary>
         public static readonly string RevokeEndpoint = EndpointPath($"{EndpointTemplate}/revoke");
 
         private static string EndpointPath(string relativePath) => $"/umbraco{Constants.Web.ManagementApiPath}v1/{relativePath}";
     }
 
-    /// <summary>
-    ///     Contains endpoint paths for member authentication.
-    /// </summary>
     public static class MemberApi
     {
-        /// <summary>
-        ///     The base endpoint template for member security endpoints.
-        /// </summary>
         public const string EndpointTemplate = "security/member";
 
-        /// <summary>
-        ///     The authorization endpoint path.
-        /// </summary>
         public static readonly string AuthorizationEndpoint = EndpointPath($"{EndpointTemplate}/authorize");
 
-        /// <summary>
-        ///     The token endpoint path.
-        /// </summary>
         public static readonly string TokenEndpoint = EndpointPath($"{EndpointTemplate}/token");
 
-        /// <summary>
-        ///     The logout/sign-out endpoint path.
-        /// </summary>
         public static readonly string LogoutEndpoint = EndpointPath($"{EndpointTemplate}/signout");
 
-        /// <summary>
-        ///     The token revocation endpoint path.
-        /// </summary>
         public static readonly string RevokeEndpoint = EndpointPath($"{EndpointTemplate}/revoke");
 
-        /// <summary>
-        ///     The user info endpoint path.
-        /// </summary>
         public static readonly string UserinfoEndpoint = EndpointPath($"{EndpointTemplate}/userinfo");
 
         // NOTE: we're NOT using /api/v1.0/ here because it will clash with the Delivery API docs

src/Umbraco.Cms.Api.Common/Serialization/IUmbracoJsonTypeInfoResolver.cs

@@ -2,22 +2,9 @@ using System.Text.Json.Serialization.Metadata;
 
 namespace Umbraco.Cms.Api.Common.Serialization;
 
-/// <summary>
-///     Extends <see cref="IJsonTypeInfoResolver"/> with Umbraco-specific type resolution for polymorphic JSON serialization.
-/// </summary>
 public interface IUmbracoJsonTypeInfoResolver : IJsonTypeInfoResolver
 {
-    /// <summary>
-    ///     Finds all sub-types of the specified type for polymorphic serialization.
-    /// </summary>
-    /// <param name="type">The base type to find sub-types for.</param>
-    /// <returns>An enumerable of sub-types.</returns>
     IEnumerable<Type> FindSubTypes(Type type);
 
-    /// <summary>
-    ///     Gets the type discriminator value used for polymorphic serialization.
-    /// </summary>
-    /// <param name="type">The type to get the discriminator value for.</param>
-    /// <returns>The discriminator value, or <c>null</c> if not applicable.</returns>
     string? GetTypeDiscriminatorValue(Type type);
 }

src/Umbraco.Cms.Api.Common/Serialization/UmbracoJsonTypeInfoResolver.cs

@@ -8,26 +8,14 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Common.Serialization;
 
-/// <summary>
-///     Implements JSON type info resolution for Umbraco with support for polymorphic serialization.
-/// </summary>
-/// <remarks>
-///     This resolver discovers sub-types of interfaces for polymorphic JSON serialization,
-///     caching results for performance. It also handles type discriminator values for OpenAPI schema generation.
-/// </remarks>
 public sealed class UmbracoJsonTypeInfoResolver : DefaultJsonTypeInfoResolver, IUmbracoJsonTypeInfoResolver
 {
     private readonly ITypeFinder _typeFinder;
     private readonly ConcurrentDictionary<Type, ISet<Type>> _subTypesCache = new ConcurrentDictionary<Type, ISet<Type>>();
 
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="UmbracoJsonTypeInfoResolver"/> class.
-    /// </summary>
-    /// <param name="typeFinder">The type finder for discovering sub-types.</param>
     public UmbracoJsonTypeInfoResolver(ITypeFinder typeFinder)
         => _typeFinder = typeFinder;
 
-    /// <inheritdoc/>
     public IEnumerable<Type> FindSubTypes(Type type)
     {
         JsonDerivedTypeAttribute[] explicitJsonDerivedTypes = type
@@ -56,7 +44,6 @@ public sealed class UmbracoJsonTypeInfoResolver : DefaultJsonTypeInfoResolver, I
         return result;
     }
 
-    /// <inheritdoc/>
     public string? GetTypeDiscriminatorValue(Type type)
     {
         JsonDerivedTypeAttribute? jsonDerivedTypeAttribute = type
@@ -75,7 +62,6 @@ public sealed class UmbracoJsonTypeInfoResolver : DefaultJsonTypeInfoResolver, I
         return typeof(IOpenApiDiscriminator).IsAssignableFrom(type) ? type.Name : null;
     }
 
-    /// <inheritdoc/>
     public override JsonTypeInfo GetTypeInfo(Type type, JsonSerializerOptions options)
     {
         JsonTypeInfo result = base.GetTypeInfo(type, options);

src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj

@@ -4,12 +4,6 @@
     <Description>Contains the bits and pieces that are shared between the Umbraco CMS APIs.</Description>
   </PropertyGroup>
 
-  <ItemGroup>
-    <AssemblyAttribute Include="System.Runtime.CompilerServices.InternalsVisibleTo">
-      <_Parameter1>Umbraco.Tests.UnitTests</_Parameter1>
-    </AssemblyAttribute>
-  </ItemGroup>
-
   <ItemGroup>
     <FrameworkReference Include="Microsoft.AspNetCore.App" />
   </ItemGroup>
@@ -22,6 +16,11 @@
     <PackageReference Include="OpenIddict.AspNetCore" />
   </ItemGroup>
 
+  <ItemGroup>
+    <!-- Take top-level depedendency on OpenIddict.AspNetCore depends on a vulnerable version -->
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
+  </ItemGroup>
+
   <ItemGroup>
     <ProjectReference Include="..\Umbraco.Core\Umbraco.Core.csproj" />
     <ProjectReference Include="..\Umbraco.Web.Common\Umbraco.Web.Common.csproj" />

src/Umbraco.Cms.Api.Common/ViewModels/Pagination/PagedViewModel.cs

@@ -1,28 +1,14 @@
-using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations;
 
 namespace Umbraco.Cms.Api.Common.ViewModels.Pagination;
 
-/// <summary>
-///     Represents a paged collection of items with total count.
-/// </summary>
-/// <typeparam name="T">The type of items in the collection.</typeparam>
 public class PagedViewModel<T>
 {
-    /// <summary>
-    ///     Gets or sets the total number of items available.
-    /// </summary>
     [Required]
     public long Total { get; set; }
 
-    /// <summary>
-    ///     Gets or sets the items in the current page.
-    /// </summary>
     [Required]
     public IEnumerable<T> Items { get; set; } = Enumerable.Empty<T>();
 
-    /// <summary>
-    ///     Creates an empty paged view model.
-    /// </summary>
-    /// <returns>An empty <see cref="PagedViewModel{T}"/> instance.</returns>
     public static PagedViewModel<T> Empty() => new();
 }

src/Umbraco.Cms.Api.Common/ViewModels/Pagination/SubsetViewModel.cs

@@ -1,34 +0,0 @@
-using System.ComponentModel.DataAnnotations;
-
-namespace Umbraco.Cms.Api.Common.ViewModels.Pagination;
-
-/// <summary>
-///     Represents a subset of items with counts of items before and after the subset.
-/// </summary>
-/// <typeparam name="T">The type of items in the collection.</typeparam>
-public class SubsetViewModel<T>
-{
-    /// <summary>
-    ///     Gets or sets the total number of items before this subset.
-    /// </summary>
-    [Required]
-    public long TotalBefore { get; set; }
-
-    /// <summary>
-    ///     Gets or sets the total number of items after this subset.
-    /// </summary>
-    [Required]
-    public long TotalAfter { get; set; }
-
-    /// <summary>
-    ///     Gets or sets the items in the subset.
-    /// </summary>
-    [Required]
-    public IEnumerable<T> Items { get; set; } = Enumerable.Empty<T>();
-
-    /// <summary>
-    ///     Creates an empty subset view model.
-    /// </summary>
-    /// <returns>An empty <see cref="SubsetViewModel{T}"/> instance.</returns>
-    public static SubsetViewModel<T> Empty() => new();
-}

src/Umbraco.Cms.Api.Delivery/CLAUDE.md

@@ -1,382 +0,0 @@
-# Umbraco.Cms.Api.Delivery
-
-Headless content delivery REST API for Umbraco CMS. Enables frontend applications to fetch published content, media, and member-protected resources.
-
----
-
-## 1. Architecture
-
-**Type**: Class Library (NuGet Package)
-**Target Framework**: .NET 10.0
-**Purpose**: Content Delivery API for headless CMS scenarios
-
-### Key Technologies
-
-- **ASP.NET Core** - Web framework
-- **OpenIddict** - Member authentication (OAuth 2.0)
-- **Asp.Versioning** - API versioning (V1, V2)
-- **Output Caching** - Configurable response caching
-- **Examine/Lucene** - Content querying
-
-### Dependencies
-
-- `Umbraco.Cms.Api.Common` - Shared API infrastructure (OpenAPI, auth)
-- `Umbraco.Web.Common` - Web functionality
-
-### Project Structure (86 files)
-
-```
-Umbraco.Cms.Api.Delivery/
-├── Controllers/
-│   ├── Content/               # Content endpoints (by ID, route, query)
-│   ├── Media/                 # Media endpoints (by ID, path, query)
-│   └── Security/              # Member auth (authorize, token, signout)
-├── Querying/
-│   ├── Filters/               # ContentType, Name, CreateDate, UpdateDate
-│   ├── Selectors/             # Ancestors, Children, Descendants
-│   └── Sorts/                 # Name, CreateDate, UpdateDate, Level, SortOrder
-├── Indexing/                  # Lucene index field handlers
-├── Services/                  # Business logic and query building
-├── Caching/                   # Output cache policies
-├── Rendering/                 # Output expansion strategies
-├── Configuration/             # Swagger configuration
-└── Filters/                   # Action filters (access, validation)
-```
-
-### Design Patterns
-
-1. **Strategy Pattern** - Query handlers (`ISelectorHandler`, `IFilterHandler`, `ISortHandler`)
-2. **Factory Pattern** - `ApiContentQueryFactory` builds Examine queries
-3. **Template Method** - `ContentApiControllerBase` for shared controller logic
-4. **Options Pattern** - `DeliveryApiSettings` for all configuration
-
----
-
-## 2. Commands
-
-See "Quick Reference" section at bottom for common commands.
-
----
-
-## 3. Key Patterns
-
-### API Versioning (V1 vs V2)
-
-**V1** (legacy) and **V2** (current) coexist. Key difference is output expansion:
-
-```csharp
-// DependencyInjection/UmbracoBuilderExtensions.cs:49-52
-// V1 uses RequestContextOutputExpansionStrategy
-// V2+ uses RequestContextOutputExpansionStrategyV2
-return apiVersion.MajorVersion == 1
-    ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
-    : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-```
-
-**Why V2**: Improved `expand` and `fields` query parameter parsing (tree-based).
-
-### Query System Architecture
-
-Content querying flows through handlers registered in DI:
-
-1. **Selectors** (`fetch` parameter): `ancestors:id`, `children:id`, `descendants:id`
-2. **Filters** (`filter[]` parameter): `contentType:alias`, `name:value`, `createDate>2024-01-01`
-3. **Sorts** (`sort[]` parameter): `name:asc`, `createDate:desc`, `level:asc`
-
-```csharp
-// Services/ApiContentQueryService.cs:91-96
-ISelectorHandler? selectorHandler = _selectorHandlers.FirstOrDefault(h => h.CanHandle(fetch));
-return selectorHandler?.BuildSelectorOption(fetch);
-```
-
-### Path Decoding Workaround
-
-ASP.NET Core doesn't decode forward slashes in route parameters:
-
-```csharp
-// Controllers/DeliveryApiControllerBase.cs:21-31
-// OpenAPI clients URL-encode paths, but ASP.NET Core doesn't decode "/"
-// See https://github.com/dotnet/aspnetcore/issues/11544
-if (path.Contains("%2F", StringComparison.OrdinalIgnoreCase))
-{
-    path = WebUtility.UrlDecode(path);
-}
-```
-
----
-
-## 4. Testing
-
-**Location**: No direct tests - tested via integration tests in test projects
-
-```bash
-dotnet test tests/Umbraco.Tests.Integration/ --filter "FullyQualifiedName~Delivery"
-```
-
-**Internals exposed to** (csproj lines 28-36):
-- `Umbraco.Tests.UnitTests`
-- `Umbraco.Tests.Integration`
-- `DynamicProxyGenAssembly2` (for mocking)
-
-**Focus areas**:
-- Query parsing (selectors, filters, sorts)
-- Member authentication flows
-- Output caching behavior
-- Protected content access
-
----
-
-## 5. Security & Access Control
-
-### Three Access Modes
-
-```csharp
-// Services/ApiAccessService.cs:21-27
-public bool HasPublicAccess() => _deliveryApiSettings.PublicAccess || HasValidApiKey();
-public bool HasPreviewAccess() => HasValidApiKey();
-public bool HasMediaAccess() => _deliveryApiSettings is { PublicAccess: true, Media.PublicAccess: true } || HasValidApiKey();
-```
-
-**Access levels**:
-1. **Public** - No authentication required (if enabled)
-2. **API Key** - Via `Api-Key` header
-3. **Preview** - Always requires API key
-
-### Member Authentication
-
-OpenIddict-based OAuth 2.0 for member-protected content:
-
-**Flows supported** (Controllers/Security/MemberController.cs):
-- Authorization Code + PKCE (line 53)
-- Client Credentials (line 112)
-- Refresh Token (line 98)
-
-**Endpoints**:
-- `GET /umbraco/delivery/api/v1/security/member/authorize`
-- `POST /umbraco/delivery/api/v1/security/member/token`
-- `GET /umbraco/delivery/api/v1/security/member/signout`
-
-**Scopes**: Only `openid` and `offline_access` allowed for members (line 220-222)
-
-### Protected Content
-
-Member access checked via `ProtectedAccess` model:
-
-```csharp
-// Controllers/Content/QueryContentApiController.cs:56-57
-ProtectedAccess protectedAccess = await _requestMemberAccessService.MemberAccessAsync();
-Attempt<PagedModel<Guid>, ApiContentQueryOperationStatus> queryAttempt =
-    _apiContentQueryService.ExecuteQuery(fetch, filter, sort, protectedAccess, skip, take);
-```
-
----
-
-## 6. Output Caching
-
-### Cache Policy Configuration
-
-```csharp
-// DependencyInjection/UmbracoBuilderExtensions.cs:120-136
-// Content and Media have separate cache durations
-options.AddPolicy(
-    Constants.DeliveryApi.OutputCache.ContentCachePolicy,
-    new DeliveryApiOutputCachePolicy(
-        outputCacheSettings.ContentDuration,
-        new StringValues([AcceptLanguage, AcceptSegment, StartItem])));
-```
-
-**Cache invalidation conditions** (Caching/DeliveryApiOutputCachePolicy.cs:31):
-```csharp
-// Never cache preview or non-public access
-context.EnableOutputCaching = requestPreviewService.IsPreview() is false
-    && apiAccessService.HasPublicAccess();
-```
-
-**Vary by headers**: `Accept-Language`, `Accept-Segment`, `Start-Item`
-
----
-
-## 7. Edge Cases & Known Issues
-
-### Technical Debt (TODOs in codebase)
-
-1. **V1 Removal Pending** (4 locations):
-   - `DependencyInjection/UmbracoBuilderExtensions.cs:98` - FIXME: remove matcher policy
-   - `Routing/DeliveryApiItemsEndpointsMatcherPolicy.cs:11` - FIXME: remove class
-   - `Filters/SwaggerDocumentationFilterBase.cs:79,83` - FIXME: remove V1 swagger docs
-
-2. **Obsolete Reference Warnings** (csproj:9-13):
-   - `ASP0019` - IHeaderDictionary.Append usage
-   - `CS0618/CS0612` - Obsolete member references
-
-### Empty Query Results
-
-Query service returns empty results (not errors) for invalid options:
-
-```csharp
-// Services/ApiContentQueryService.cs:54-78
-// Invalid selector/filter/sort returns fail status with empty result
-return Attempt.FailWithStatus(ApiContentQueryOperationStatus.SelectorOptionNotFound, emptyResult);
-```
-
-### Start Item Fallback
-
-When no `fetch` parameter provided, uses start item or all content:
-
-```csharp
-// Services/ApiContentQueryService.cs:99-112
-if (_requestStartItemProviderAccessor.TryGetValue(out IRequestStartItemProvider? requestStartItemProvider))
-{
-    IPublishedContent? startItem = requestStartItemProvider.GetStartItem();
-    // Use descendants of start item
-}
-return _apiContentQueryProvider.AllContentSelectorOption(); // Fallback to all
-```
-
----
-
-## 8. Project-Specific Notes
-
-### V1 vs V2 Differences
-
-| Feature | V1 | V2 |
-|---------|----|----|
-| Output expansion | Basic | Tree-based parsing |
-| `expand` parameter | Flat list | Nested syntax |
-| `fields` parameter | Limited | Full property selection |
-| Default expansion strategy | `RequestContextOutputExpansionStrategy` | `RequestContextOutputExpansionStrategyV2` |
-
-**Migration note**: V1 is deprecated; plan removal when V17+ drops V1 support.
-
-### JSON Configuration
-
-Delivery API has its own JSON options (distinct from Management API):
-
-```csharp
-// DependencyInjection/UmbracoBuilderExtensions.cs:82-88
-.AddJsonOptions(Constants.JsonOptionsNames.DeliveryApi, options =>
-{
-    options.JsonSerializerOptions.PropertyNamingPolicy = JsonNamingPolicy.CamelCase;
-    options.JsonSerializerOptions.TypeInfoResolver = new DeliveryApiJsonTypeResolver();
-    options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
-});
-```
-
-### Member Token Revocation
-
-Tokens automatically revoked on member changes:
-
-```csharp
-// DependencyInjection/UmbracoBuilderExtensions.cs:93-96
-builder.AddNotificationAsyncHandler<MemberSavedNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
-builder.AddNotificationAsyncHandler<MemberDeletedNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
-builder.AddNotificationAsyncHandler<AssignedMemberRolesNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
-builder.AddNotificationAsyncHandler<RemovedMemberRolesNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
-```
-
-### External Dependencies
-
-**Examine/Lucene** (via Core):
-- Powers content querying
-- Selector/Filter/Sort handlers build Lucene queries
-
-**OpenIddict** (via Api.Common):
-- Member OAuth 2.0 authentication
-- Reference tokens (not JWT)
-
-### Configuration (appsettings.json)
-
-```json
-{
-  "Umbraco": {
-    "CMS": {
-      "DeliveryApi": {
-        "Enabled": true,
-        "PublicAccess": true,
-        "ApiKey": "your-api-key",
-        "Media": {
-          "Enabled": true,
-          "PublicAccess": true
-        },
-        "MemberAuthorization": {
-          "AuthorizationCodeFlow": { "Enabled": true },
-          "ClientCredentialsFlow": { "Enabled": false }
-        },
-        "OutputCache": {
-          "Enabled": true,
-          "ContentDuration": "00:01:00",
-          "MediaDuration": "00:01:00"
-        }
-      }
-    }
-  }
-}
-```
-
-### API Endpoints Summary
-
-**Content** (`/umbraco/delivery/api/v2/content`):
-- `GET /item/{id}` - Single content by GUID
-- `GET /item/{path}` - Single content by route
-- `GET /items` - Multiple by IDs
-- `GET /` - Query with fetch/filter/sort
-
-**Media** (`/umbraco/delivery/api/v2/media`):
-- `GET /item/{id}` - Single media by GUID
-- `GET /item/{path}` - Single media by path
-- `GET /items` - Multiple by IDs
-- `GET /` - Query media
-
-**Security** (`/umbraco/delivery/api/v1/security/member`):
-- `GET /authorize` - Start OAuth flow
-- `POST /token` - Exchange code for token
-- `GET /signout` - Revoke session
-
----
-
-## Quick Reference
-
-### Essential Commands
-
-```bash
-# Build project
-dotnet build src/Umbraco.Cms.Api.Delivery/Umbraco.Cms.Api.Delivery.csproj
-
-# Pack for NuGet
-dotnet pack src/Umbraco.Cms.Api.Delivery/Umbraco.Cms.Api.Delivery.csproj -c Release
-
-# Run integration tests
-dotnet test tests/Umbraco.Tests.Integration/ --filter "FullyQualifiedName~Delivery"
-
-# Check packages
-dotnet list src/Umbraco.Cms.Api.Delivery/Umbraco.Cms.Api.Delivery.csproj package --outdated
-```
-
-### Key Classes
-
-| Class | Purpose | File |
-|-------|---------|------|
-| `DeliveryApiControllerBase` | Base controller with path decoding | Controllers/DeliveryApiControllerBase.cs |
-| `ApiContentQueryService` | Query orchestration | Services/ApiContentQueryService.cs |
-| `ApiAccessService` | Access control logic | Services/ApiAccessService.cs |
-| `DeliveryApiOutputCachePolicy` | Cache policy implementation | Caching/DeliveryApiOutputCachePolicy.cs |
-| `MemberController` | OAuth endpoints | Controllers/Security/MemberController.cs |
-| `RequestContextOutputExpansionStrategyV2` | V2 output expansion | Rendering/RequestContextOutputExpansionStrategyV2.cs |
-
-### Important Files
-
-- `Umbraco.Cms.Api.Delivery.csproj` - Project dependencies
-- `DependencyInjection/UmbracoBuilderExtensions.cs` - DI registration (lines 33-141)
-- `Configuration/DeliveryApiConfiguration.cs` - API constants
-- `Services/ApiContentQueryService.cs` - Query execution
-
-### Getting Help
-
-- **Root documentation**: `/CLAUDE.md` - Repository overview
-- **API Common patterns**: `/src/Umbraco.Cms.Api.Common/CLAUDE.md`
-- **Official docs**: https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api
-- **Media docs**: https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/media-delivery-api
-
----
-
-**This library exposes Umbraco content and media via REST for headless scenarios. Focus on query handlers, access control, and member authentication when working here.**

src/Umbraco.Cms.Api.Delivery/Caching/DeliveryApiOutputCachePolicy.cs

@@ -1,6 +1,5 @@
-using Microsoft.AspNetCore.OutputCaching;
+using Microsoft.AspNetCore.OutputCaching;
 using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Primitives;
 using Umbraco.Cms.Core.DeliveryApi;
 
 namespace Umbraco.Cms.Api.Delivery.Caching;
@@ -8,13 +7,9 @@ namespace Umbraco.Cms.Api.Delivery.Caching;
 internal sealed class DeliveryApiOutputCachePolicy : IOutputCachePolicy
 {
     private readonly TimeSpan _duration;
-    private readonly StringValues _varyByHeaderNames;
 
-    public DeliveryApiOutputCachePolicy(TimeSpan duration, StringValues varyByHeaderNames)
-    {
-        _duration = duration;
-        _varyByHeaderNames = varyByHeaderNames;
-    }
+    public DeliveryApiOutputCachePolicy(TimeSpan duration)
+        => _duration = duration;
 
     ValueTask IOutputCachePolicy.CacheRequestAsync(OutputCacheContext context, CancellationToken cancellationToken)
     {
@@ -30,7 +25,6 @@ internal sealed class DeliveryApiOutputCachePolicy : IOutputCachePolicy
 
         context.EnableOutputCaching = requestPreviewService.IsPreview() is false && apiAccessService.HasPublicAccess();
         context.ResponseExpirationTimeSpan = _duration;
-        context.CacheVaryByRules.HeaderNames = _varyByHeaderNames;
 
         return ValueTask.CompletedTask;
     }

src/Umbraco.Cms.Api.Delivery/Configuration/ConfigureUmbracoDeliveryApiSwaggerGenOptions.cs

@@ -1,6 +1,6 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Cms.Api.Delivery.Filters;

src/Umbraco.Cms.Api.Delivery/Configuration/ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions.cs

@@ -1,6 +1,6 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.Security;
 using Umbraco.Cms.Api.Delivery.Controllers.Content;
@@ -26,7 +26,7 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
         options.OperationFilter<DeliveryApiSecurityFilter>();
     }
 
-    private sealed class DeliveryApiSecurityFilter : SwaggerFilterBase<ContentApiControllerBase>, IOperationFilter, IDocumentFilter
+    private class DeliveryApiSecurityFilter : SwaggerFilterBase<ContentApiControllerBase>, IOperationFilter, IDocumentFilter
     {
         public void Apply(OpenApiOperation operation, OperationFilterContext context)
         {
@@ -35,9 +35,23 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                 return;
             }
 
-            var schemaRef = new OpenApiSecuritySchemeReference(AuthSchemeName, context.Document);
-            operation.Security ??= new List<OpenApiSecurityRequirement>();
-            operation.Security.Add(new OpenApiSecurityRequirement { [schemaRef] = [] });
+            operation.Security = new List<OpenApiSecurityRequirement>
+            {
+                new OpenApiSecurityRequirement
+                {
+                    {
+                        new OpenApiSecurityScheme
+                        {
+                            Reference = new OpenApiReference
+                            {
+                                Type = ReferenceType.SecurityScheme,
+                                Id = AuthSchemeName,
+                            }
+                        },
+                        []
+                    }
+                }
+            };
         }
 
         public void Apply(OpenApiDocument swaggerDoc, DocumentFilterContext context)
@@ -47,7 +61,7 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                 return;
             }
 
-            swaggerDoc.AddComponent(
+            swaggerDoc.Components.SecuritySchemes.Add(
                 AuthSchemeName,
                 new OpenApiSecurityScheme
                 {
@@ -60,9 +74,9 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                         AuthorizationCode = new OpenApiOAuthFlow
                         {
                             AuthorizationUrl = new Uri(Paths.MemberApi.AuthorizationEndpoint, UriKind.Relative),
-                            TokenUrl = new Uri(Paths.MemberApi.TokenEndpoint, UriKind.Relative),
-                        },
-                    },
+                            TokenUrl = new Uri(Paths.MemberApi.TokenEndpoint, UriKind.Relative)
+                        }
+                    }
                 });
         }
     }

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ByIdContentApiController.cs

@@ -1,3 +1,4 @@
+using System.Diagnostics;
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -7,6 +8,7 @@ using Umbraco.Cms.Core.Models.PublishedContent;
 
 namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
 
+[ApiVersion("1.0")]
 [ApiVersion("2.0")]
 public class ByIdContentApiController : ContentApiItemControllerBase
 {
@@ -19,6 +21,16 @@ public class ByIdContentApiController : ContentApiItemControllerBase
         : base(apiPublishedContentCache, apiContentResponseBuilder)
         => _requestMemberAccessService = requestMemberAccessService;
 
+    [HttpGet("item/{id:guid}")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> ById(Guid id)
+        => await HandleRequest(id);
+
     /// <summary>
     ///     Gets a content item by id.
     /// </summary>

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ByIdsContentApiController.cs

@@ -8,6 +8,7 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
 
+[ApiVersion("1.0")]
 [ApiVersion("2.0")]
 public class ByIdsContentApiController : ContentApiItemControllerBase
 {
@@ -20,6 +21,15 @@ public class ByIdsContentApiController : ContentApiItemControllerBase
         : base(apiPublishedContentCache, apiContentResponseBuilder)
         => _requestMemberAccessService = requestMemberAccessService;
 
+    [HttpGet("item")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(IEnumerable<IApiContentResponse>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> Item([FromQuery(Name = "id")] HashSet<Guid> ids)
+        => await HandleRequest(ids);
+
     /// <summary>
     ///     Gets content items by ids.
     /// </summary>
@@ -48,6 +58,6 @@ public class ByIdsContentApiController : ContentApiItemControllerBase
             .WhereNotNull()
             .ToArray();
 
-        return Ok(apiContentItems);
+        return await Task.FromResult(Ok(apiContentItems));
     }
 }