Table dates and User dates (#22169 )

User-collection-table didn´t format and if you have da backoffice the time is still Am/pm Co-authored-by: Lucas Bach Bisgaard <lucas.bisgaard@kraftvaerk.com> Co-authored-by: Niels Lyngsø <nsl@umbraco.dk> Co-authored-by: Mads Rasmussen <madsr@hey.com>
Fix detail data request manager failing when items hit 40, making document unusable (#23164 )
2026-06-26 09:24:35 +02:00 · 2026-06-26 09:09:11 +02:00 · 2026-06-25 15:59:33 +02:00 · 2026-06-24 09:37:53 +00:00 · 2026-06-24 09:29:21 +00:00 · 2026-06-23 14:29:24 +02:00
4907 changed files with 179071 additions and 24710 deletions
@@ -0,0 +1,94 @@
+---
+name: umb-bump-version
+description: Bump the Umbraco CMS version across all required files. Use when the user asks to bump, update, or set the version number — e.g., "bump version to 17.3.4", "set version to 18.0.0-rc", "update version". Accepts the target version as an argument.
+argument-hint: <version> (e.g., 17.3.4, 18.0.0-rc)
+---
+
+# Bump Version - Umbraco CMS
+
+Updates the Umbraco CMS version string across all files that track it.
+
+**Do NOT use AskUserQuestion if a version argument is provided. Only ask if `$ARGUMENTS` is empty or cannot be parsed as a version.**
+
+## Arguments
+
+- `$ARGUMENTS` - Required: the target version string (e.g., `17.3.4`, `18.0.0-rc`)
+
+## Files to Update
+
+The following 5 files must be updated with the new version:
+
+| # | File | Field |
+|---|------|-------|
+| 1 | `version.json` | `"version"` |
+| 2 | `src/Umbraco.Web.UI.Client/package.json` | `"version"` |
+| 3 | `src/Umbraco.Web.UI.Client/package-lock.json` | top-level `"version"` AND `packages[""].version` |
+| 4 | `tests/Umbraco.Tests.AcceptanceTest/package.json` | `"version"` |
+| 5 | `tests/Umbraco.Tests.AcceptanceTest/package-lock.json` | top-level `"version"` AND `packages[""].version` |
+
+**Note**: For major version bumps (e.g., 17.x to 18.x), `src/Umbraco.Web.UI.Login/package.json` has a caret-ranged dependency on `@umbraco-cms/backoffice` (e.g., `^17.2.0`) that will need manual updating. This skill does not handle that — major bumps involve many other changes beyond version strings.
+
+## Instructions
+
+### 1. Parse and Validate the Version
+
+Extract the version from `$ARGUMENTS`. It must be a valid semver-like string (e.g., `17.3.4`, `18.0.0-rc`, `17.4.0-preview.1`). If no version is provided or it cannot be parsed, ask the user for the target version.
+
+### 2. Read the Current Version
+
+Read `version.json` and extract the current `"version"` value. If the current version already equals the target version, report that the version is already set and stop — do not edit, stage, or commit anything.
+
+Otherwise, display both versions:
+
+```
+Bumping version: {current} -> {target}
+```
+
+### 3. Update All Files
+
+Update each of the 5 files listed above, replacing the old version with the new version. For each file:
+
+- **`version.json`**: Replace the `"version"` value.
+- **`package.json` files**: Replace the `"version"` value (near the top of the file).
+- **`package-lock.json` files**: Replace BOTH the top-level `"version"` value AND the `"version"` inside the `"packages": { "": { ... } }` block. These are always in the first ~10 lines of the file.
+
+Use targeted edits — do NOT rewrite entire files. Be precise to avoid changing version strings in dependency entries.
+
+### 4. Verify
+
+After all edits, grep for the target version value across the 5 files to confirm all updates landed correctly:
+
+```bash
+grep -n "\"version\": \"{version}\"" version.json src/Umbraco.Web.UI.Client/package.json src/Umbraco.Web.UI.Client/package-lock.json tests/Umbraco.Tests.AcceptanceTest/package.json tests/Umbraco.Tests.AcceptanceTest/package-lock.json
+```
+
+Expect exactly 7 matches (one per `package.json` and `version.json`, two per `package-lock.json`).
+
+### 5. Stage and Commit
+
+Stage only the 5 changed files:
+
+```bash
+git add version.json src/Umbraco.Web.UI.Client/package.json src/Umbraco.Web.UI.Client/package-lock.json tests/Umbraco.Tests.AcceptanceTest/package.json tests/Umbraco.Tests.AcceptanceTest/package-lock.json
+```
+
+Then commit with the message `Bump version to {version}.` — replacing `{version}` with the target version:
+
+```bash
+git commit -m "Bump version to {version}."
+```
+
+### 6. Report
+
+Output a summary:
+
+```
+Version bumped to {version} in:
+- version.json
+- src/Umbraco.Web.UI.Client/package.json
+- src/Umbraco.Web.UI.Client/package-lock.json
+- tests/Umbraco.Tests.AcceptanceTest/package.json
+- tests/Umbraco.Tests.AcceptanceTest/package-lock.json
+
+Changes staged and committed.
+```
@@ -0,0 +1,135 @@
+---
+name: umb-release-notes
+description: Improve a set of auto-generated GitHub release notes for an Umbraco CMS release. Cross-checks the notes against every PR carrying the release label, adds any that are missing, re-files every PR under the most appropriate category, and strips purely-internal entries. Use whenever the user asks to tidy up, improve, complete, or recategorize release notes for a given version, or mentions a release-notes text file plus a version number.
+argument-hint: <version> <path-to-generated-notes-file>
+---
+
+# Umbraco CMS - Improve Release Notes
+
+Takes a file of auto-generated GitHub release notes and produces an improved version that:
+
+1. **Is complete** — every merged PR carrying the `release/<version>` label appears.
+2. **Is well-categorized** — every PR sits under the most appropriate heading.
+3. **Is free of noise** — purely-internal entries of no value to a reader are removed.
+
+The result is written to a **new** file alongside the input, so the user can diff the two.
+
+**Run autonomously.** Do NOT use `AskUserQuestion` once the required arguments (version and input file path) are available — only ask if one of them is missing from `$ARGUMENTS` and cannot be inferred (see Arguments). Beyond that, make the categorization calls yourself using the rules below; if a handful are genuinely borderline, place them anyway and note the borderline ones in your closing summary so the user can override.
+
+## Arguments
+
+`$ARGUMENTS` contains two values:
+
+1. **Version** — e.g. `17.5.0`, `18.1.0`. The GitHub label to search is `release/<version>` (so version `17.5.0` → label `release/17.5.0`).
+2. **Input file path** — full path to the text file holding the auto-generated notes (e.g. `C:\Temp\release-17.5.0-rc.md`).
+
+If either is missing, ask the user once for the missing value, then proceed.
+
+## Prerequisites
+
+Run `gh auth status`. If it fails, tell the user to authenticate `gh` (e.g. `gh auth login`) and stop — the skill needs the GitHub CLI to query PRs. The repo is always `umbraco/Umbraco-CMS`.
+
+## Procedure
+
+### 1. Read the input notes
+
+Read the input file. Note its structure — it is GitHub's generated format:
+
+- A leading HTML comment (`<!-- Release notes generated ... -->`).
+- A `## What's Changed` heading followed by `### <emoji> <Category>` sub-headings, each with `* <title> by @<author> in <url>` bullets.
+- A trailing `## New Contributors` section and a `**Full Changelog**: ...` line.
+
+Extract the set of PR numbers already present (parse the `/pull/<number>` from each bullet). Preserve each existing bullet's **exact text** (title, author, URL) when you re-emit it — only its category placement may change.
+
+### 2. Fetch every labelled PR
+
+```bash
+gh pr list --repo umbraco/Umbraco-CMS --label "release/<version>" --state closed --limit 1000 \
+  --json number,title,author,labels,mergedAt \
+  --jq '.[] | select(.mergedAt != null) | "\(.number)\t\(.author.login)\t\([.labels[].name] | join(", "))\t\(.title)"' | sort -n
+```
+
+This is the authoritative list of what the release *should* contain. Each row gives number, author, labels, title.
+
+**Guard against silent truncation.** `gh pr list` caps at `--limit` without warning, so a large release could drop the overflow and the skill would still look "complete". Count the returned rows and compare against the limit:
+
+```bash
+gh pr list --repo umbraco/Umbraco-CMS --label "release/<version>" --state closed --limit 1000 --json number --jq 'length'
+```
+
+If this equals 1000, the limit was hit — raise `--limit` and re-fetch before continuing. Do **not** proceed on a truncated list.
+
+### 3. Reconcile
+
+- **Missing labelled PRs** (labelled but not in the input file): these must be **added**. Build a bullet as `* <title> by @<author> in https://github.com/umbraco/Umbraco-CMS/pull/<number>`.
+  - **Author handle.** `<author>` in the template is the raw `.author.login` value — the bullet supplies the leading `@`, so do not prepend another. `gh`'s `.author.login` already returns bot accounts with the `[bot]` suffix as part of the login — Dependabot comes back as `dependabot[bot]`, not `dependabot` or `app/dependabot` (the `app/` form only appears in git committer metadata and CODEOWNERS, never in `gh`'s JSON). So the login is already in the right shape; use it verbatim (e.g. `.author.login` of `dependabot[bot]` renders as `@dependabot[bot]`, matching what GitHub's generator wrote for the existing bullets). The only thing to guard against is accidentally stripping or altering the `[bot]` suffix.
+- **PRs in the file but not labelled**: keep them. The generated notes span a commit range (see the `Full Changelog` compare link), so they legitimately include backports / earlier-version PRs that lack the current label. For any of these you need to categorize, fetch its labels with:
+
+  ```bash
+  gh pr view <number> --repo umbraco/Umbraco-CMS --json number,title,labels \
+    --jq '"\(.number)\t\([.labels[].name] | join(", "))\t\(.title)"'
+  ```
+
+Do **not** invent or alter the `New Contributors` section — carry it over verbatim. You cannot reliably recompute first-time contributors, so leave it as the generator produced it (mention this in the summary).
+
+### 4. Categorize every PR
+
+Use exactly these headings, in this order. Omit any heading that ends up with no entries.
+
+| Heading | What goes here | Primary signal |
+|---|---|---|
+| `### 🙌 Notable Changes` | **Don't recategorize existing entries.** Label-driven — but still add any missing PR carrying this label here. | label `category/notable` |
+| `### 💥 Breaking Changes` | **Don't recategorize existing entries.** Label-driven — but still add any missing PR carrying this label here. | label `category/breaking` |
+| `### 📦 Dependencies` | Dependency bumps | label `dependencies`; or dependabot author |
+| `### 🚀 New Features` | New user- or developer-facing capability | label `type/feature` / `category/feature`; or title introduces/adds a genuinely new capability |
+| `### 🚤 Performance` | Performance improvements | label `category/performance`; or `Performance:` title prefix |
+| `### 🌈 Accessibility Improvements` | A11y improvements (labels, contrast, keyboard) | label `category/accessibility` / `accessibility`; or clear a11y intent (e.g. "improve contrast", "missing labels") |
+| `### 🐛 Bug Fixes` | Fixes to broken/incorrect behaviour | default for anything describing a fix |
+| `### 🧪 Testing` | Test additions/changes only | label `category/test-automation` / `area/test`; or `E2E`/`QA`/"acceptance tests"/"unit test coverage"/"add tests" titles |
+| `### 🛡️ Code Quality, Documentation and Refactoring` | Refactors, deprecations, API tidy-ups, XML/MD documentation, knowledge-base (`MD`) updates | label `category/refactor`; or titles about refactoring, deprecating, renaming, documenting, constants extraction, MD/CLAUDE.md content |
+| `### 🧑‍💻 Developer Experience` | Things that improve the experience of developers building on or contributing to Umbraco — dev tooling, build/watch ergonomics, test mocks/harnesses, backoffice dev utilities | `Developer Experience` title prefix; dev tooling; mock/harness changes |
+
+**Rules:**
+
+- **Notable and Breaking are off-limits for recategorization** — never move a PR that is *already in the input file* into or out of these sections; they are driven purely by their labels and the generator placed them correctly. This does **not** exempt them from completeness: a PR discovered as missing in step 3 that carries `category/notable` or `category/breaking` must still be **added** under the matching section.
+- Label signals beat title wording, except a `Performance:`/`Developer Experience:` title prefix is decisive for its section.
+- A PR with both `type/feature` and `category/refactor` whose title clearly describes a refactor (e.g. "swap relative imports", "re-export type") belongs under Code Quality, not New Features.
+- "Add ... tests"/"unit test coverage" → Testing, even if it also touches docs. If a PR adds XML documentation *and* tests, lead with where the title's emphasis lies (documentation → Code Quality; test coverage → Testing).
+- When a PR is genuinely 50/50, pick the more reader-useful heading and list it in your closing summary as borderline.
+
+### 5. Remove purely-internal noise
+
+Drop entries that have **no value to anyone reading release notes** — pure repository plumbing with no shipped impact. Examples:
+
+- Branch/merge maintenance ("Fix main branch after merge issue").
+- CI/pipeline fixes that don't change the product.
+- Reverts of changes that never shipped in a release.
+
+**Keep** anything that ships in the product or genuinely helps developers building on Umbraco — that includes documentation/MD updates, dev tooling, and test mocks (those go to Code Quality or Developer Experience, they are *not* noise). When unsure whether something is noise, keep it and flag it in the summary rather than silently dropping it. List every removal in your closing summary.
+
+### 6. Write the output
+
+Write to a new file in the **same folder** as the input, named by appending ` - with updates` before the extension:
+
+- Input `C:\Temp\release-17.5.0-rc.md` → Output `C:\Temp\release-17.5.0-rc - with updates.md`
+
+Preserve the leading HTML comment, the `## What's Changed` heading, the `## New Contributors` section, and the `**Full Changelog**` line exactly. Only the `### <category>` groupings and their bullets change.
+
+### 7. Report
+
+Give a concise summary:
+
+- Count of PRs added (with their numbers), and which categories they landed in.
+- Notable recategorizations (PRs moved out of the catch-all Bug Fixes into Features/Performance/Testing/etc.).
+- Every entry removed, with the one-line reason.
+- Any borderline calls the user may want to override.
+- The output file path.
+
+## Verification
+
+Before reporting done, confirm:
+
+- Every PR number from step 2 is present in the output (except any you deliberately removed in step 5 — and those must be in the removal list).
+- No PR appears under more than one heading.
+- Notable and Breaking sections are byte-for-byte unchanged from the input.
+- The header comment, New Contributors, and Full Changelog lines are intact.
@@ -0,0 +1,251 @@
+---
+name: umb-review
+description: Automated PR code review for Umbraco CMS. Analyzes changed files for intent, impact on consumers, breaking changes, architecture compliance, and code quality. Non-interactive — outputs a full structured review. Use this skill whenever the user asks to review a branch, review a PR, check their changes for issues, analyze a diff, or validate breaking change patterns — even if they don't say "review" explicitly. Does NOT apply to writing new code, fixing bugs, refactoring, explaining architecture, writing tests, or reviewing documentation content.
+argument-hint: <target-branch>
+---
+
+# PR Review - Umbraco CMS
+
+Automated, non-interactive PR code review. Analyzes changed files for intent, impact on consumers, breaking changes, architecture compliance, and code quality.
+
+**Do NOT use AskUserQuestion at any point. This skill runs fully autonomously.**
+
+## Arguments
+
+- `$ARGUMENTS` - Optional: target branch to diff against (auto-detected from PR, falls back to `origin/main`)
+
+## Instructions
+
+### 0. Verify GH CLI is Available
+
+Run `gh auth status`. If it fails, read `references/gh-cli-setup.md` and present the setup instructions to the user. Do not proceed with the review.
+
+### 1. Resolve Target Branch
+
+Determine the target branch for comparison using this priority order:
+
+1. **Explicit argument**: If `$ARGUMENTS` is provided and non-empty, use it as the target branch
+2. **PR target branch**: If no argument, run `gh pr view --json baseRefName --jq '.baseRefName'` to detect the target branch of the current branch's open PR. If a PR exists, use `origin/{baseRefName}` as the target branch.
+3. **Fallback**: If no argument and no PR found (command fails or returns empty), default to `origin/main`
+
+Store the resolved target branch for use in subsequent steps. Log which resolution method was used (e.g., "Target branch: `origin/v18/dev` (from PR #1234)").
+
+### 2. Load Review Standards
+
+#### 2a. Load coding preferences
+
+Read the coding preferences and code review scoring criteria from:
+
+- `references/coding-preferences.md` (relative to this skill file)
+
+Parse and internalize all rules, conventions, scoring categories, and severity definitions. These are your review criteria.
+
+#### 2b. Load area-specific documentation
+
+Once the changed file list is known (after step 3a), determine which areas of the codebase are touched and load the relevant documentation. Execute this sub-step between 3a and 3b. This documentation takes precedence over sibling comparison for architectural and pattern validation.
+
+**Resolution order for each changed file:**
+
+1. **Find the nearest `CLAUDE.md`** — walk up from the changed file's directory toward the repository root. The first `CLAUDE.md` found is the area guide for that file. Read it.
+2. **Read referenced docs** — if the `CLAUDE.md` references documentation files (e.g., a `docs/` directory), use the descriptions in the `CLAUDE.md` to determine which docs are relevant to the type of code being changed, and read those. If unsure, read all referenced docs — the cost of reading is low, the cost of missing a convention is high.
+3. **Follow cross-references in loaded docs** — if a loaded doc references another doc as covering a complementary or related concern, and the changed files touch that concern, read the referenced doc too. Repeat until no new relevant cross-references remain.
+4. **Check for applicable skills** — review the available skills list. If a skill exists for the type of code being changed, read the skill file to understand the expected patterns, structure, and conventions it enforces. Do NOT invoke the skill — just use it as a reference for what the correct implementation should look like.
+
+**Store all loaded documentation** for use in step 4. These docs define the authoritative patterns and conventions that the review evaluates against.
+
+### 3. Gather Changed Files
+
+#### 3a. Collect file list, stats, and diff
+
+Run these git commands (where `{target}` is the resolved target branch):
+
+```bash
+git diff {target}...HEAD --name-only --diff-filter=d   # changed files (excluding deleted)
+git diff {target}...HEAD --stat                         # line counts per file
+git log {target}...HEAD --oneline                       # commit history
+git diff {target}...HEAD                                # full diff (primary review source)
+```
+
+**If no changes found**: Output "No changes found between current branch and `{target}`. Nothing to review." and stop.
+
+#### 3b. Filter out noise files
+
+From the changed file list, classify each file as **noise** or **reviewable**.
+
+**Noise files** (skip entirely — do not read, do not review):
+
+| Pattern                                              | Reason                          |
+| ---------------------------------------------------- | ------------------------------- |
+| `*.gen.ts`, `*.gen.cs`                               | Auto-generated API client code  |
+| `*.generated.cs`, `*.Designer.cs` (in `Migrations/`) | Auto-generated models/snapshots |
+| `*/assets/lang/*.ts` (except `en.ts`)                | Non-English translation files   |
+| `*/mocks/data/*.ts`                                  | Test fixture data               |
+| `*/dist-cms/*`, `*/storybook-static/*`               | Build output                    |
+| `*/TEMP/InMemoryAuto/*`                              | Runtime-generated models        |
+| `package-lock.json`                                  | Dependency lock file            |
+| `appsettings-schema.*.json`                          | Generated JSON schema           |
+
+Log the skip list: "Skipped {N} noise files: {comma-separated list of filenames}"
+
+#### 3c. Read reviewable changed files
+
+Read the full file for every reviewable changed file.
+
+#### 3d. Track file counts
+
+Keep track of these numbers for the review output in step 7: total changed files, noise files skipped, and reviewable files read. Also record: distinct production layers touched, distinct project directories, and total lines changed — these feed step 3e.
+
+#### 3e. Assess PR complexity
+
+Follow the procedure in `references/complexity-assessment.md`. Store the triggered dimensions and suggestions for step 7.
+
+#### 3f. Classify PR scope
+
+Classify the PR to determine which review steps are relevant:
+
+| Classification  | Condition                                                                       | Effect                                                                          |
+| --------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
+| **Gen-only**    | All reviewable files are `gen.ts`                                               | Skip steps 5 and 6; step 4 reviews impact on other code only                    |
+| **Docs-only**   | All reviewable files are `.md`                                                  | Skip steps 5 and 6; step 4 reviews intent and readability only                  |
+| **Test-only**   | All reviewable files are in `tests/`                                            | Skip steps 5 and 6; step 4 reviews intent, code quality, and test coverage only |
+| **Config-only** | All reviewable files are `.csproj`, `.props`, `.json` config, or CI/build files | Skip step 5; step 6 checks dependency version changes only                      |
+| **Standard**    | Anything else                                                                   | No skips — run all steps                                                        |
+
+### 4. Raw Code Review
+
+Review each changed file holistically. Think like a senior developer reading a colleague's PR. Note all findings without worrying about format or severity yet.
+
+#### 4a. Read and reason about each file
+
+For each changed file, reason about: What does this code do? Is it correct? What's missing — validation, error handling, notifications, cleanup, edge cases? Could this break anything for consumers?
+
+#### 4b. Validate against documentation and patterns
+
+Use a **docs-first** approach: classify the code by what it does, check it against documented conventions, and only fall back to sibling comparison when docs don't cover the pattern.
+
+**Step 1 — Determine the correct approach from documentation, then check whether the PR matches**
+
+A PR is a proposed solution, not the source of truth. This step has two parts that must happen in order — do not start part B until part A is complete.
+
+**Part A — Before validating/judging the implementation**, determine what the correct approach is for each new class or file based on what it does. Use the documentation loaded in step 2b to identify the expected base classes, patterns, and conventions. Write down the expected approach. Classify based on what the code does, not based on what neighboring files look like.
+
+**Part B — Now compare the PR's implementation** against the expected approach from Part A. If it deviates from the documented approach, flag it. If the documentation specifies reference examples, read those examples to verify the implementation matches.
+
+**Pattern match is the leading finding.** If the documentation defines a pattern that fits what the code does, the first and most important finding is whether the code follows that pattern.
+
+**Step 2 — Fall back to sibling comparison**
+
+If the documentation does not cover the specific pattern, or for cross-cutting concerns not addressed in docs, fall back to sibling comparison:
+
+1. **New method on existing class/interface**: Grep for the most similar existing method on the same class using `-A 80` to capture the full method body (e.g., `UpdateCurrentUserAsync` → grep for `UpdateAsync` in the same file with `-A 80`). Compare line by line for missing cross-cutting concerns: notifications/events, validation, scoping, authorization, error handling, audit logging.
+2. **New TS class**: Grep for siblings by base class (`extends {BaseClass}`) or by interface (`implements {Interface}`) or by name suffix (e.g., `CurrentUserController` → grep for `UserController`). Compare for missing concerns.
+3. **New CS class**: Grep for siblings by base class (`class {ClassName} : {BaseClass}`) or by interface (`class {ClassName} : {Interface}`) or by name suffix (e.g., `ManagementApiComposer` → grep for `ApiComposer`). Compare for missing concerns.
+
+**Important:** Sibling comparison validates cross-cutting concerns, but it must not override documented conventions. If a sibling deviates from documented patterns, that sibling is wrong — do not copy its deviation.
+
+Store your raw findings — they feed into step 7.
+
+### 5. Impact Analysis
+
+**Skip this step if PR scope is docs-only, test-only, or config-only.**
+
+Follow the procedure in `references/impact-analysis.md`.
+
+### 6. Breaking Changes Check
+
+**Skip this step if PR scope is docs-only or test-only. If config-only, only check for dependency version changes that could break consumers.**
+
+Follow the procedure in `references/breaking-changes.md`.
+
+### 7. Consolidate and Output Review
+
+Merge findings from step 4 (raw review), step 5 (impact analysis), and step 6 (breaking changes). For each finding, assign severity (Critical/Important/Suggestion) and verify it relates to changed code — not pre-existing issues. Before outputting, drop any finding about whitespace, blank lines, formatting, or comment wording. Then present the review in this exact format:
+
+```markdown
+## PR Review
+
+**Target:** `{target_branch}` · **Based on commit:** `{head_sha}`
+[If any skipped files, append: · **Skipped:** {skipped} files out of {total} total]
+[If step 3f classification is not "Standard", append: · **Classified as:** {classification}]
+
+[1–2 sentences: what this PR accomplishes , keep it as short as possible, only highlight the primary essence.]
+
+- **Modified public API:** {changed existing interfaces/types/classes/methods}
+  [Omit bullet if none]
+- **Affected implementations (outside this PR):** {interfaces/types/classes/methods using modified public API}
+  [Omit bullet if none]
+- **Breaking changes:** {violations with specifics}
+  [Omit bullet if none]
+- **Other changes:** {changes not listed above that an Umbraco user, plugin developer, or API consumer would notice — e.g., behavior changes, default value changes, error message changes, new configuration options, removed functionality. Exclude internal renames, formatting, and private implementation details.}
+  [Omit bullet if none]
+
+[If step 3e triggered any dimensions, insert this block. Omit entirely if nothing triggered:]
+
+> [!NOTE]
+> **Complexity advisory** — This PR may benefit from splitting.
+>
+> - **{Dimension}:** {Explanation and concrete split suggestion from step 3e}
+>   [one bullet per triggered dimension]
+>
+> _This is an observation, not a blocker. The full review follows below._
+
+---
+
+### Critical
+
+[Must fix before merge — security vulnerabilities, data loss, broken functionality, breaking changes without proper patterns]
+
+- **`{file}:{line}`**: {problem} → {fix}
+
+[Omit section if none]
+
+### Important
+
+[Should fix — performance issues, missing tests, architectural violations, pattern misuse]
+
+- **`{file}:{line}`**: {observation} → {suggestion}
+
+[Omit section if none]
+
+### Suggestions
+
+[Nice to have — readability, minor refactoring, alternative approaches]
+
+- **`{file}:{line}`**: {detail}
+
+[Omit section if none]
+
+---
+
+[One of:]
+
+## Approved
+
+This looks good to be merged as-is, but please do a manual sanity check and testing before merging.
+
+## Approved with Suggestions for improvement
+
+Good to go, but please carefully consider the importance of the suggestions.
+
+## Request Changes
+
+Critical and important issues must be addressed first.
+
+## Needs re-work
+
+This is in such a bad state that the feedback of this review is not sufficient to guide improvements, the PR cannot be approved.
+```
+
+**Guidelines for the review output:**
+
+— When reporting information, be extremely concise and sacrifice grammar for sake of concision.
+
+- Only review code that was changed in the diff — pre-existing issues are out of scope. Focus on what compilers and linters cannot catch: behavioral side-effects (e.g., a changed default alters runtime behavior for consumers), architectural violations (e.g., a new dependency breaks layering), breaking changes for external consumers of the public API, and security implications. Leave type errors, missing imports, and broken references to CI.
+- Be specific — always reference file and line number
+- Explain WHY something is an issue, not just WHAT, but avoid stating the obvious.
+- For complex matters, provide concrete fix suggestions, including code snippets when helpful
+- Keep it constructive — the goal is to help, not gatekeep
+- Don't repeat the same finding for every occurrence — mention it once and note "same pattern in {other files}"
+- Focus on substantive issues only. Do NOT flag purely cosmetic or stylistic concerns. Specifically, never flag: code formatting or whitespace, comment grammar or wording, redundant-but-harmless syntax (e.g., optional chaining after a truthiness check), code duplication that doesn't cause bugs, or HTML template cosmetics. The only exception is when a stylistic issue has a concrete impact on performance or rendering. Note: missing JSDoc/documentation on public or exported APIs is a substantive finding (per coding preferences), not a cosmetic one — flag it as a Suggestion.
+- For breaking changes, reference the specific pattern from the CLAUDE.md that should be applied
+- Do not suggest changes that would themselves introduce breaking changes. If a suggestion would alter public API surface (e.g., changing return types, renaming public members), it is not appropriate for a PR targeting `main` within a major version. Only suggest non-breaking alternatives.
@@ -0,0 +1,97 @@
+{
+  "skill_name": "umb-review",
+  "evals": [
+    {
+      "id": 0,
+      "name": "pr-22214-large-frontend-refactor",
+      "prompt": "Review the changes in PR #22214 (branch origin/pr/22214 targeting main). This is a large frontend refactor migrating create entity actions to use entityCreateOptionAction extensions, with deprecations.",
+      "expected_output": "A structured review that identifies frontend deprecation patterns, flags the large PR complexity, handles 75+ files correctly, checks for breaking changes in exported components, and produces the correct output format.",
+      "pr_number": 22214,
+      "pr_branch": "origin/pr/22214",
+      "base_branch": "origin/main",
+      "files": [],
+      "assertions": [
+        {"id": "deprecation-patterns-noted", "text": "Review identifies deprecation patterns (@deprecated, UmbDeprecation)"},
+        {"id": "frontend-breaking-change-awareness", "text": "Checks frontend-specific breaking changes (exports, custom elements) not just backend"},
+        {"id": "file-references-present", "text": "Findings reference specific files with line numbers"},
+        {"id": "no-false-critical-on-deprecations", "text": "Properly deprecated code is NOT flagged as Critical breaking change"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues (formatting, whitespace, naming conventions, comment grammar, code style preferences) unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."},
+        {"id": "manifest-alias-rename-detected", "text": "Alias renames (CreateOptions → Create) flagged as Critical breaking change"},
+        {"id": "non-exported-deletions-dismissed", "text": "Deleted action classes NOT flagged as breaking (verified against package.json exports)"},
+        {"id": "noise-files-filtered", "text": "Does not review noise files (generated files, lock files, etc.)"},
+        {"id": "complexity-advisory-triggers", "text": "Review includes a complexity/split advisory for the large 75+ file scope"}
+      ]
+    },
+    {
+      "id": 1,
+      "name": "pr-21672-small-frontend-bugfix",
+      "prompt": "Review the changes in PR #21672 (branch origin/pr/21672 targeting main). This is a small 4-file frontend bugfix implementing tab validation badges in the block editor.",
+      "expected_output": "A clean review that correctly identifies this as a small focused bugfix, avoids false positives, and either approves or approves with minor suggestions.",
+      "pr_number": 21672,
+      "pr_branch": "origin/pr/21672",
+      "base_branch": "origin/main",
+      "files": [],
+      "assertions": [
+        {"id": "complexity-advisory-absent", "text": "Review does NOT include a complexity/split advisory"},
+        {"id": "no-false-breaking-changes", "text": "Review does not flag breaking changes"},
+        {"id": "proportionate-verdict", "text": "Verdict is 'Request Changes'"},
+        {"id": "concise-review", "text": "Review output is under 200 lines"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues (formatting, whitespace, naming conventions, comment grammar, code style preferences) unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."}
+      ]
+    },
+    {
+      "id": 2,
+      "name": "pr-22217-small-backend-webhook",
+      "prompt": "Review the changes in PR #22217 (branch origin/pr/22217 targeting v18/dev). This is a tiny 3-file backend change to the default webhook payload type.",
+      "expected_output": "A concise review that correctly resolves v18/dev as target branch, handles the small change proportionately, and considers the behavioral impact of changing a default value.",
+      "pr_number": 22217,
+      "pr_branch": "origin/pr/22217",
+      "base_branch": "origin/v18/dev",
+      "files": [],
+      "assertions": [
+        {"id": "correct-target-branch", "text": "Review references 'v18/dev' as the target branch (not 'main')"},
+        {"id": "default-value-change-noted", "text": "Review discusses the behavioral impact of changing the default payload type"},
+        {"id": "proportionate-review", "text": "Review output is under 150 lines"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues (formatting, whitespace, naming conventions, comment grammar, code style preferences) unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."},
+        {"id": "ignores-preexisting-issues", "text": "Does NOT flag the ~30 builder extension methods with Legacy defaults (pre-existing, not changed in the PR)"},
+        {"id": "side-effect-detection", "text": "Flags stale WebhookSettings.cs docs as a side-effect of the constant value change"},
+        {"id": "consumer-identification", "text": "Identifies affected consumers outside the PR (WebhookSettings, UmbracoBuilder, or WebhookEventCollectionBuilderExtensions)"}
+      ]
+    },
+    {
+      "id": 3,
+      "name": "pr-22268-frontend-feature-workspace-modal",
+      "prompt": "Review the changes in PR #22268 (branch origin/pr/22268 targeting main). This is a 29-file frontend feature adding a current user workspace modal.",
+      "expected_output": "A review of a medium-sized new feature PR. Should assess the new code for architectural compliance, check for breaking changes (new exports, custom elements), and evaluate code quality without flagging pre-existing issues.",
+      "pr_number": 22268,
+      "pr_branch": "origin/pr/22268",
+      "base_branch": "origin/main",
+      "files": [],
+      "assertions": [
+        {"id": "complexity-advisory-triggers", "text": "Review includes a complexity/split advisory (3 layers: Core, API, Frontend across 27+ files)"},
+        {"id": "breaking-changes-on-interface-additions", "text": "Flags new interface methods without default implementations as breaking changes (Pattern 3)"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."},
+        {"id": "diff-scoped", "text": "All findings reference code that was changed in the diff, not pre-existing issues"},
+        {"id": "new-feature-assessed", "text": "Review assesses the new feature's architecture, patterns, or integration approach — not just absence of bugs"},
+        {"id": "no-false-notification-finding", "text": "Review does NOT flag UpdateCurrentUserAsync as missing UserSavingNotification/UserSavedNotification — the sibling UpdateAsync also does not publish these notifications, so flagging their absence would be a false positive"}
+      ]
+    },
+    {
+      "id": 4,
+      "name": "pr-22215-frontend-architecture-violation",
+      "prompt": "Review the changes in PR #22215 (branch origin/pr/22215 targeting main). This is a 2-file frontend feature adding user management to the user group workspace.",
+      "expected_output": "A review that catches the architecture violation: the workspace context directly imports and calls UserService and UserGroupService (generated API clients) instead of going through a repository. In the Umbraco backoffice, workspace contexts access data via repositories, not by calling API services directly. The review should flag this as a significant architecture issue and request changes.",
+      "pr_number": 22215,
+      "pr_branch": "origin/pr/22215",
+      "base_branch": "origin/main",
+      "files": [],
+      "assertions": [
+        {"id": "service-bypass-detected", "text": "Review flags that the workspace context directly imports/calls UserService or UserGroupService instead of using a repository"},
+        {"id": "repository-pattern-recommended", "text": "Review recommends using the repository pattern (going through a repository/data-source layer) rather than calling API services directly from the workspace context"},
+        {"id": "verdict-request-changes", "text": "Verdict is 'Request Changes' (the architecture violation warrants requesting changes, not just approving with suggestions)"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues (formatting, whitespace, naming conventions, comment grammar, code style preferences) unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."},
+        {"id": "no-false-breaking-changes", "text": "Review does not flag breaking changes (this PR only adds new code, no public API is removed or modified)"}
+      ]
+    }
+  ]
+}
@@ -0,0 +1,249 @@
+# Breaking Changes Reference
+
+This document describes how to detect and validate breaking changes during PR review. It covers both backend (.NET) and frontend (TypeScript/Lit) patterns.
+
+---
+
+## Version Detection
+
+**Always read `version.json`** at the repository root to determine the current major version. This drives the obsolete removal target calculation:
+
+- Current major version: read from `version.json` → `version` field (e.g., `"17.4.0-rc"` → major version `17`)
+- Obsolete removal target: `current + 2` (e.g., if current is 17, removal is scheduled for Umbraco 19)
+- Format: `[Obsolete("... Scheduled for removal in Umbraco {current+2}.")]`
+
+---
+
+## Backend (.NET) Breaking Changes
+
+### What Constitutes a Breaking Change
+
+Any of these on a `public` or `protected` member:
+
+- Removing or renaming a class, interface, struct, record, or enum
+- Removing or renaming a method, property, or field
+- Changing a method signature (parameters, return type)
+- Adding required parameters to an existing method
+- Adding methods to a public interface (without default implementation)
+- Changing a constructor signature on a public class
+- Removing or changing enum values
+- Changing type hierarchy (base class, implemented interfaces)
+
+### Pattern 1: Obsolete Constructor + StaticServiceProvider
+
+When a public class needs new dependencies, the existing constructor must be preserved.
+
+**Correct pattern:**
+
+```csharp
+[Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
+public MyService(IDependencyA depA)
+    : this(
+        depA,
+        StaticServiceProvider.Instance.GetRequiredService<IDependencyB>())
+{
+}
+
+public MyService(IDependencyA depA, IDependencyB depB)
+{
+    _depA = depA;
+    _depB = depB;
+}
+```
+
+**Validation checklist:**
+
+- [ ] Old constructor has `[Obsolete]` attribute with correct removal version
+- [ ] Old constructor calls new constructor via `: this(...)`
+- [ ] `StaticServiceProvider.Instance.GetRequiredService<T>()` used for new params only
+- [ ] DI registration uses the NEW constructor (old is for external consumers only)
+- [ ] Removal version is `{current_major + 2}`
+
+**Common mistakes to flag:**
+
+- Removing the old constructor entirely (breaking change!)
+- Old constructor NOT calling new constructor (code duplication)
+- Wrong removal version in `[Obsolete]`
+- Missing `StaticServiceProvider` resolution for new dependencies
+- DI registration still using the old constructor
+
+### Pattern 2: Obsolete Method + New Overload
+
+When a method signature needs to change, add the new overload and obsolete the old.
+
+**Correct pattern:**
+
+```csharp
+[Obsolete("Use the overload taking all parameters. Scheduled for removal in Umbraco 19.")]
+public void DoThing(string name)
+    => DoThing(name, extraParam: null);
+
+public void DoThing(string name, string? extraParam)
+{
+    // Real implementation here
+}
+```
+
+**Validation checklist:**
+
+- [ ] Old method has `[Obsolete]` attribute with correct removal version
+- [ ] Old method calls new method, providing defaults for new parameters
+- [ ] All internal callers updated to use the new method
+- [ ] No internal code references the obsolete method (except the delegation)
+
+### Pattern 3: Default Interface Implementation
+
+When adding methods to a public interface, provide a default implementation.
+
+**Correct pattern:**
+
+```csharp
+public interface IMyService
+{
+    void ExistingMethod();
+
+    // New method with default implementation
+    void NewMethod(string param)
+        => ExistingMethod(); // delegate to existing if possible
+}
+```
+
+**Strategies for defaults (in order of preference):**
+
+1. Use existing interface methods to satisfy the contract
+2. Return a sensible default (empty collection, null, etc.)
+3. Throw `NotImplementedException` if no reasonable default exists
+
+**Validation checklist:**
+
+- [ ] New interface method has a default implementation
+- [ ] TODO comment present: `// TODO (V{next-major}): Remove the default implementation when {obsolete method} is removed.`
+- [ ] Default implementation is functionally correct (even if not optimal)
+- [ ] If `StaticServiceProvider` is used in default impl, noted as temporary
+
+### Obsolete Attribute Validation
+
+For any `[Obsolete]` attribute found in changed code:
+
+1. **Format**: Must contain `"Scheduled for removal in Umbraco {version}."`
+2. **Version**: Must be `current_major + 2` (read from `version.json`)
+3. **Pragma**: Where obsolete members must call each other, `#pragma warning disable CS0618` / `#pragma warning restore CS0618` must be present
+
+### Internal Caller Check
+
+After finding obsolete patterns, verify:
+
+- Search the codebase for usages of the obsolete member
+- **No internal code** (inside `src/`) should reference obsolete members
+- Only the obsolete member's own delegation (calling the new version) is acceptable
+- External consumers (outside the repo) get the deprecation period to migrate
+
+---
+
+## Frontend (TypeScript/Lit) Breaking Changes
+
+The backoffice is published as `@umbraco-cms/backoffice` with 140+ named exports. Plugin developers depend on this public API surface.
+
+**Critical frontend rule (does not apply to backend .NET where `public`/`protected` visibility determines the API surface): only symbols reachable through the `package.json` `exports` field are public API.** Anything not exported — whether classes, functions, constants, types, or entire files — is an internal implementation detail, even if other internal code imports it. Removing or changing unexported frontend symbols is not a breaking change. Before flagging a frontend deletion or rename as breaking, verify the symbol is reachable via `package.json` exports. If it is not, do not flag it.
+
+### Custom Elements (Web Components)
+
+**Breaking changes:**
+
+- Renaming or removing a registered custom element tag (`umb-*`)
+- Removing elements from `HTMLElementTagNameMap`
+- Removing or changing `@property()` decorated fields on exported components
+- Removing event emissions (checked via `this.dispatchEvent`)
+- Removing CSS custom properties (`@cssprop` in JSDoc)
+- Removing CSS parts (`@csspart` in JSDoc)
+
+**How to detect:**
+
+- Check diff for removed `@customElement('umb-...')` decorators
+- Check diff for removed `@property()` fields on exported components
+- Check diff for removed entries in `HTMLElementTagNameMap` declarations
+
+### Exported Types/Interfaces
+
+**Breaking changes:**
+
+- Removing exports from `package.json` `exports` field
+- Changing the shape of exported interfaces (removing properties, changing types)
+- Renaming exported types (consumers import by name)
+- Removing union type members
+- Changing generic type parameter constraints
+
+**How to detect:**
+
+- Check if `package.json` `exports` field is modified
+- Check diff for removed `export` statements
+- Check diff for changed interface/type shapes
+
+### Manifest/Extension System
+
+**Breaking changes:**
+
+- Renaming a manifest `alias` value — plugin developers reference aliases by string in conditions, overwrites, and extension registry lookups. Alias renames are not caught by the compiler since they are string-based. A renamed alias silently breaks any plugin that references the old string.
+- Removing support for a manifest `type` that plugins use
+- Changing manifest `alias` resolution or validation
+- Removing or renaming manifest `kind` types
+- Changing extension bundle structure
+
+**How to detect:**
+
+- **Alias renames**: Compare `alias:` values in manifest files before and after. Changed alias strings are Critical — the old alias should be preserved as a deprecated entry.
+- Search for changes to manifest type definitions
+- Check for removed or renamed manifest kinds
+
+### Context API
+
+**Breaking changes:**
+
+- Removing context tokens from exports
+- Changing the shape of data provided by a context
+- Removing context provider/consumer mechanisms
+
+**How to detect:**
+
+- Check for removed context token exports
+- Check for changes to context provider classes
+
+### Controllers/Lifecycle
+
+**Breaking changes:**
+
+- Changing controller base class inheritance requirements
+- Removing controller lifecycle hooks
+- Breaking cleanup mechanisms in `disconnectedCallback()`
+
+### Observable/State
+
+**Breaking changes:**
+
+- Removing observable properties from the public API
+- Changing observable emission patterns
+
+### npm Publishing
+
+**Breaking changes:**
+
+- Changing version constraints that exclude previously-supported versions
+- Adding incompatible peer dependency constraints
+
+**How to detect:**
+
+- Check if `package.json` `peerDependencies` or `dependencies` changed
+- Verify version ranges are not narrowed
+
+---
+
+## Reporting Breaking Changes
+
+When a breaking change is detected, report:
+
+1. **What**: The specific change and which public symbol is affected
+2. **Pattern**: Which mitigation pattern should be applied (Pattern 1, 2, or 3 for backend)
+3. **Severity**: Critical (no mitigation present) or Important (mitigation present but incorrect)
+4. **Fix**: Concrete code suggestion showing the correct pattern
+
+If no breaking changes are detected, state: "No breaking changes detected."
@@ -0,0 +1,168 @@
+# Coding Preferences & Review Criteria
+
+These are the coding preferences and code review standards used by the review skill. They define what the review evaluates against.
+
+---
+
+## Testing
+
+- **Always create blackbox tests** for new/changed code
+- Choose the appropriate test level:
+  - **Unit tests** for isolated logic
+  - **Integration tests** for application services/use cases
+  - **E2E tests** for API endpoints
+
+### Test Class Naming
+
+- Test classes must be postfixed with `Tests` (e.g., `OrderServiceTests`)
+- One test class per class under test
+
+### Test Method Naming
+
+**C# tests**: Use the `Can_`/`Cannot_` pattern with PascalCase underscore-separated words:
+
+- `Can_Schedule_Publish_Invariant`
+- `Cannot_Delete_Non_Existing`
+- `Can_Schedule_Publish_Single_Culture`
+
+Large test classes are split into partial files by method: `ContentServiceTests.Delete.cs`, `ContentServiceTests.Publish.cs`.
+
+**TypeScript tests**: Use BDD-style `it()` with natural language descriptions:
+
+- `it('should not allow the returned value to be lower than min')`
+- `it('converts string to camelCase')`
+
+### Unit Tests
+
+- Optional, but must be blackbox tests so refactoring does not break tests
+
+### Integration Tests
+
+- Every use case / application service must have integration tests
+- Tests run against real database (containerized or similar)
+- Test the full flow from application layer through infrastructure
+
+### E2E Tests
+
+- Every API endpoint must have E2E tests
+- Test realistic scenarios including error cases
+
+---
+
+## Trade-offs
+
+When making decisions, prioritize:
+
+- **Readability** over cleverness
+- **Flexibility** over rigidity
+- Explain trade-offs when deviating from these defaults
+
+---
+
+## Breaking Changes
+
+- Communicate breaking changes at the **OpenAPI/openapi.json level**
+- Clearly document what changed and the migration path
+
+---
+
+## Documentation
+
+- **Document all public or exported types** (classes, interfaces, types, methods, properties)
+- Keep documentation in sync with code changes
+- Add **JS Docs** on all public frontend APIs (classes, methods, properties)
+- Focus on "why" and usage, not restating the obvious
+
+---
+
+## Dependencies
+
+- Use what's available in the codebase, unless there is no good choice
+- **Flag new dependencies** for review — new packages should be justified
+- Prefer well-maintained, widely-used packages
+
+---
+
+## Error Messages & Logging
+
+- **User-facing errors**: Clear, friendly, actionable
+- **Log messages**: Technical, detailed, with context
+- Include correlation IDs and relevant data in logs
+
+---
+
+## Security
+
+- **Always check for security issues** using OWASP Top 10 as baseline
+- Flag potential vulnerabilities immediately
+- Suggest secure alternatives when spotting risky patterns
+- Apply principle of least privilege
+
+---
+
+## Immutability
+
+- Prefer **immutability** by default
+- Allow internal properties to be mutated, as long as they are not direct references coming from the outside
+
+---
+
+## Nullability
+
+- **TypeScript / JavaScript**
+  - Prefer `undefined` for optional/omitted values (e.g., optional parameters, props, and fields)
+  - Use `null` only when the domain model explicitly encodes "no value" or "not set" (e.g., `string | null` from APIs/DB), and be consistent with existing types
+  - Avoid mixing `null` and `undefined` for the same concept within the same model or API surface
+  
+- **C#**  
+  - use nullable types (e.g., `string?`, `int?`) where absence is valid
+  - Prefer domain modeling (value objects, options/results, empty collections) over `null` where appropriate, but respect existing conventions in the codebase
+
+---
+
+## C# Specific
+
+- use Notification pattern (not C# events), Composer pattern (DI registration), Scoping with `Complete()`, Attempt pattern for operation results.
+
+---
+
+## Architecture
+
+- Follow **Clean Architecture** principles
+- **Fail-fast** principle: detect and report errors as early as possible
+- Within the established layered architecture (Core/Infrastructure/Web/API), organize code by feature inside each layer where practical, while preserving dependency direction
+- One class per file
+- Avoid N+1 queries
+- Profile before optimizing non-critical paths
+
+### Type Hierarchy Consistency
+
+When parallel model types have inconsistent relationships to a shared base type:
+
+**TypeScript**: manipulations via `Omit`, `Pick`, intersection overrides, or workarounds like `as unknown as` / double-casts to bridge type mismatches.
+
+**C#**: hiding base members with `new` to change types, explicit interface implementations to mask mismatches, or downcasting base return types in derived classes.
+
+- **Do NOT suggest** the PR code should deviate from its base type to match a sibling that already deviates. Copying the deviation spreads the problem.
+- **Do flag** the architectural inconsistency: parallel models should share a compatible base contract. The model that manipulates or deviates from the base type is the one that needs attention — not the one that extends it correctly.
+- **Frame the suggestion** as: "These related models have inconsistent type hierarchies. `{deviating type}` manipulates the base contract of `{base type}`, which forces shared consumers like `{shared utility}` to require a shape that conforming subtypes can't satisfy."
+
+---
+
+## Code Style
+
+- Follow standard naming conventions for the language (C# or JS/TS)
+- Keep components small and focused on a single responsibility
+- Prefer early returns
+- Small functions
+- No nested ternaries
+
+---
+
+## Severity Levels
+
+| Severity | Meaning |
+|----------|---------|
+| **Critical** | Must fix before merge — security vulnerabilities, data loss risks, broken functionality |
+| **Important** | Should fix — performance issues, missing tests, architectural violations |
+| **Suggestion** | Nice to have — readability, minor refactoring, alternative approaches |
@@ -0,0 +1,33 @@
+# PR Complexity Assessment
+
+Evaluate whether the PR's scope suggests it should be split. This assessment is **informational only** — it never blocks or shortens the review.
+
+## Always check: Formatting mixed with logic
+
+This check applies to every PR regardless of size or scope.
+
+Run both commands and compare per-file line counts:
+```bash
+git diff {target}...HEAD --stat
+git diff {target}...HEAD --stat --ignore-all-space
+```
+
+For any file where the whitespace-ignored diff is less than **half** the full diff size (and the full diff is over 50 lines), that file has significant formatting changes mixed with logic. Flag it with a split suggestion: "File(s) {list} contain significant formatting changes mixed with logic. Consider a separate formatting-only commit or PR to keep the functional diff reviewable."
+
+## Multi-project scope check
+
+Skip this section entirely if ALL production files reside in a single project directory or if the PR is docs-only, test-only, dependency-bump-only, or rename-only.
+
+Otherwise, flag any dimension that applies:
+
+| Dimension | Condition | Suggestion |
+|---|---|---|
+| **Size** | 30+ files OR 1500+ lines, spanning 2+ projects | "If changes in {projectA} and {projectB} are independently functional, they could be separate PRs." |
+| **Layer spread** | 3+ layers touched (Core/Infrastructure/Web/API/Frontend), 10+ files | "Consider splitting by layer — e.g., Core+Infrastructure first, then API/Frontend consumers." |
+| **Mixed intent** | 2+ intent categories (new feature, bugfix, refactor, dependency update) with 15+ files or 3+ projects | "Consider extracting the {secondary intent} into a separate PR." |
+
+Intent categories — detect from diff characteristics, not commit messages:
+- **New feature**: new files or new `public`/`export` declarations
+- **Bug fix**: small targeted edits, no new files (don't co-flag with new feature)
+- **Refactor**: file renames, symbols moved but logic unchanged
+- **Dependency update**: changes to `.csproj`, `Directory.Packages.props`, `package.json`
@@ -0,0 +1,23 @@
+# GH CLI Setup Instructions
+
+The GitHub CLI (`gh`) is required for this review skill to detect PR target branches.
+
+## Installation
+
+Install via Homebrew:
+
+```
+brew install gh
+```
+
+Or see https://cli.github.com/ for other installation methods.
+
+## Authentication
+
+After installing, authorize by running this in the terminal (use the `!` prefix in Claude Code):
+
+```
+! gh auth login
+```
+
+Follow the prompts to authenticate with your GitHub account.
@@ -0,0 +1,153 @@
+# Impact Analysis Reference
+
+This document describes how to perform impact analysis during PR review. The goal is to look beyond the diff to understand how changes affect consumers in other parts of the codebase.
+
+---
+
+## 1. Extract Changed Public Symbols
+
+Scan the diff output for changes to public API surface:
+
+### Backend (.NET)
+
+Look for added, modified, or removed lines containing:
+
+- `public class`, `public abstract class`, `public sealed class`
+- `public interface`
+- `public record`, `public struct`, `public enum`
+- `public` or `protected` methods, properties, fields
+- `public static` members
+- Constructor signatures on public types
+
+### Frontend (TypeScript/Lit)
+
+Look for changes to:
+
+- `export class`, `export interface`, `export type`, `export enum`
+- `export function`, `export const`
+- `@property()` decorated fields on exported components
+- `@customElement()` registrations
+- Entries in `package.json` `exports` field
+
+Collect a list of all changed public symbol names (type names, method names, property names).
+
+---
+
+## 2. Search for Consumers
+
+For each changed public symbol, search the `src/` directory for usages **outside the changed file itself**.
+
+### Grep Strategy
+
+Use the Grep tool with these settings:
+
+```
+pattern: {symbol name}
+path: src/
+output_mode: files_with_matches
+head_limit: 20
+```
+
+Use `head_limit: 20` to avoid overwhelming results — if there are more than 20 consumers, note "20+ consumers found" and list the first 20.
+
+### What to Search For
+
+For each changed type/method, search for:
+
+- **Type references**: class name, interface name (e.g., `IContentService`)
+- **Method calls**: method name in context (e.g., `\.GetById\(` for a method rename)
+- **Constructor usage**: `new TypeName(`
+- **DI registrations**: `.AddSingleton<IType, Type>`, `.AddScoped<`, `.AddTransient<`
+- **Notification handlers**: if a notification type changed, search for `INotificationHandler<NotificationTypeName>` and `INotificationAsyncHandler<NotificationTypeName>`
+- **Interface implementations**: if an interface changed, search for `: IInterfaceName` or `IInterfaceName,`
+
+### Excluding the Changed File
+
+When reporting consumers, exclude files that are part of the PR's changes (they're already being reviewed). The interesting consumers are those **outside** the PR that may be affected.
+
+---
+
+## 3. Check Dependency Flow Direction
+
+The Umbraco architecture enforces strict unidirectional dependencies:
+
+```
+Api.Management / Api.Delivery (depend on Api.Common)
+  ↓
+Api.Common (depends on Web.Common)
+  ↓
+Web.Common (depends on Infrastructure)
+  ↓
+Infrastructure (depends on Core)
+  ↓
+Core (no dependencies)
+```
+
+### Layer Mapping
+
+Map each changed file to its architectural layer:
+
+| Path prefix | Layer |
+|---|---|
+| `src/Umbraco.Core/` | Core |
+| `src/Umbraco.Infrastructure/` | Infrastructure |
+| `src/Umbraco.PublishedCache.*` | Infrastructure |
+| `src/Umbraco.Examine.Lucene/` | Infrastructure |
+| `src/Umbraco.Cms.Persistence.*` | Infrastructure |
+| `src/Umbraco.Web.Common/` | Web |
+| `src/Umbraco.Web.UI/` | Web (Application) |
+| `src/Umbraco.Web.Website/` | Web |
+| `src/Umbraco.Cms.Api.Common/` | API |
+| `src/Umbraco.Cms.Api.Management/` | API |
+| `src/Umbraco.Cms.Api.Delivery/` | API |
+| `src/Umbraco.Web.UI.Client/` | Frontend |
+| `tests/` | Test |
+
+### Violation Detection
+
+Flag if a change introduces:
+
+- **Core depending on Infrastructure**: Core file importing/referencing Infrastructure types
+- **Core depending on Web/API**: Core file importing/referencing Web or API types
+- **Infrastructure depending on Web/API**: Infrastructure file importing Web or API types
+- **Cross-API dependencies**: Management API depending on Delivery API or vice versa
+
+### How to Check
+
+1. For each changed file, identify its layer
+2. Read the file's `using` statements (C#) or `import` statements (TS)
+3. Check if any imports reference a higher layer
+4. Also check if new parameters or return types come from higher layers
+
+---
+
+## 4. Flag Cross-Project Risks
+
+### High-Risk Patterns
+
+These changes have high ripple potential:
+
+- **Interface changes in Core** — all implementations in Infrastructure must be updated
+- **Notification type changes** — all handlers across the codebase are affected
+- **Base class changes** — all derived classes are affected
+- **Composer changes** — can affect DI container and runtime behavior globally
+- **Shared model/DTO changes** — can affect serialization, API contracts, and consumers
+
+### What to Report
+
+For each cross-project risk found, report:
+
+1. **What changed**: The specific symbol and how it changed
+2. **Who is affected**: List of consuming files/projects found via Grep
+3. **Risk level**: Whether the consumers will break (compile error), behave differently (runtime), or are unaffected
+4. **Recommendation**: Whether the PR should include updates to affected consumers
+
+---
+
+## 5. Performance Notes
+
+- Use `head_limit: 20` on all Grep searches to cap results
+- Only search for symbols that actually changed (not every symbol in the file)
+- For very common type names (e.g., `IScope`, `ILogger`), consider adding more context to the search pattern to reduce false positives
+- Skip impact analysis for test files — they don't have external consumers
+- Skip impact analysis for private/internal members — they can't have external consumers
@@ -23,7 +23,7 @@ jobs:
    runs-on: ubuntu-latest
    name: Build and Deploy Job
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          submodules: true
      - name: Build And Deploy
@@ -26,7 +26,7 @@ jobs:
    runs-on: ubuntu-latest
    name: Build and Deploy Job
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
      - name: Build And Deploy
        id: builddeploy
        uses: Azure/static-web-apps-deploy@v1
@@ -0,0 +1,88 @@
+name: Claude PR Review
+
+on:
+  pull_request:
+    types: [opened, ready_for_review, reopened]
+  # NOTE: `pull_request_target` would let this workflow review fork PRs
+  # (with access to secrets), but the action currently fails during OIDC
+  # token exchange with "401 Unauthorized - Invalid OIDC token" on that
+  # event. PR #579 added `pull_request_target` routing to the action, but
+  # Anthropic's `/github-app-token-exchange` endpoint appears not to
+  # accept the token claims produced by that event. Re-enable once the
+  # upstream issue is resolved.
+  # See: https://github.com/anthropics/claude-code-action/issues/347
+  #      https://github.com/anthropics/claude-code-action/issues/621
+  # pull_request_target:
+  #   types: [opened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+  id-token: write
+  actions: read
+
+jobs:
+  review:
+    # Skip fork PRs: secrets are not exposed on `pull_request` events from
+    # forks, so the action would fail with a red check. Remove this clause
+    # once upstream fork support lands (tracked in
+    # https://github.com/anthropics/claude-code-action/issues/939) and we
+    # can re-enable the `pull_request_target` trigger above.
+    if: >-
+      github.event.pull_request.draft == false
+      && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_03 }}
+
+          # Enable progress tracking
+          track_progress: true
+
+          # Debug (set to true to show full output in logs, false to hide it and only post comments on the PR)
+          show_full_output: false
+
+          additional_permissions: "actions: read"
+          claude_args: "--model claude-sonnet-4-6 --allowedTools 'Bash(gh:*),Bash(git:*)'"
+          prompt: |
+            You are reviewing pull request #${{ github.event.pull_request.number }}
+            in the Umbraco CMS repository.
+
+            Read and execute the review procedure defined in `.claude/skills/umb-review/SKILL.md`.
+
+            For each finding that references a specific file and line:
+            - Post an individual inline PR comment on that line.
+            - Format: **[Severity]** explanation, then suggestion.
+
+            For the overall summary (header, impact, verdict):
+            - Post ONE top-level PR comment.
+
+            Do NOT use sticky/updating comments — post new individual comments.
+
+            After reviewing, apply labels to the PR based on changed files:
+            - `area/frontend` — if files under `src/Umbraco.Web.UI.Client/` are changed
+            - `area/backend` — if .cs files outside the frontend client are changed
+            - `area/test` — if only test files are changed
+            - `category/api` — if Management API or Delivery API files are changed
+            - `category/breaking` — if breaking changes were detected in the review
+            - `category/localization` — if localization/language files are changed
+            - `category/test-automation` — if only test files are changed
+            - `category/refactor` — if the PR is pure refactoring with no new features
+            - `category/performance` — if performance-related changes are detected
+            - `category/ux` — if user-facing changes are detected
+            - `category/ui` — if changes to the UI layer are detected
+
+            Only apply labels you are confident about. Never remove existing labels.
+
+            Be friendly and constructive. This project values community contributions.
+            Frame feedback as suggestions where possible.
+            Reserve firm language for genuine Critical issues only.
+
+            Run fully autonomously. Do NOT ask questions.
+            Only review changed files. Do not flag pre-existing issues.
+            Do not suggest changes that would themselves introduce breaking changes.
@@ -0,0 +1,91 @@
+name: Claude
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned, labeled]
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  id-token: write
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_03 }}
+          assignee_trigger: "claude"
+          label_trigger: "claude"
+          base_branch: "main"
+          additional_permissions: "actions: read"
+          claude_args: "--model claude-sonnet-4-6 --max-turns 50 --allowedTools 'Bash(gh:*),Bash(git:*),Bash(npm:*),Bash(dotnet:*)'"
+          prompt: |
+            You are an AI assistant for the Umbraco CMS repository, an open-source
+            .NET CMS that welcomes community contributions.
+
+            You were triggered on issue/PR #${{ github.event.issue.number || github.event.pull_request.number }}.
+
+            Read the user's message and do what they ask. The trigger phrase
+            `@claude` is stripped before you see the message, so common requests
+            will look like:
+
+            - `review` — Review PR #${{ github.event.issue.number || github.event.pull_request.number }}.
+              Use `gh pr diff ${{ github.event.issue.number || github.event.pull_request.number }}`
+              and `gh pr view ${{ github.event.issue.number || github.event.pull_request.number }}`
+              to read the changes. Do NOT use git diff or the umb-review skill.
+              Focus on bugs, breaking changes, and architectural concerns.
+              Post inline comments for specific issues and a brief summary.
+            - `help` or a general question — Answer based on the codebase.
+              Read CLAUDE.md files for project structure and conventions.
+            - `fix ...` — Implement the requested fix on a new branch.
+            - `label` — Apply appropriate labels to the PR or issue.
+
+            If the message is empty or just whitespace, treat it as `review`
+            when on a PR, or `help` when on an issue.
+
+            If none of these match, read the user's message carefully and respond
+            to what they actually asked for.
+
+            ## Labeling
+
+            When labeling PRs (based on changed files):
+            - `area/frontend`, `area/backend`, `area/test`
+            - `category/api`, `category/breaking`, `category/localization`
+            - `category/refactor`, `category/performance`, `category/ux`, `category/ui`
+            - `category/test-automation`
+
+            When labeling issues (based on content):
+            - `area/frontend`, `area/backend`, `area/test`
+            - `affected/v14` through `affected/v17`, `affected/backoffice`
+            - `category/api`, `category/localization`, `category/performance`
+            - `category/ux`, `category/ui`
+
+            Only apply labels you are confident about. Never remove existing labels.
+
+            ## Tone
+
+            Be friendly and constructive. Frame feedback as suggestions.
+            Reserve firm language for genuine critical issues only.
+
+            ## Constraints
+
+            - Run fully autonomously. Do NOT ask questions.
+            - Do not suggest changes that would introduce breaking changes.
@@ -51,7 +51,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      # We use the setup-dotnet action to set up .NET Core, otherwise the CodeQL CLI will not work with preview versions.
      - name: Setup .NET from global.json
@@ -0,0 +1,84 @@
+name: Issue Deduplication
+
+on:
+  issues:
+    types: [ opened ]
+  workflow_dispatch:
+    inputs:
+      issue_number:
+        description: 'Issue number to analyze for duplicates'
+        required: true
+        type: number
+
+jobs:
+  deduplicate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Check for duplicate issues
+        uses: anthropics/claude-code-action@v1
+        with:
+          prompt: |
+            Analyze this new issue and check if it's a duplicate of existing issues in the repository.
+
+            Issue: #${{ github.event.issue.number || inputs.issue_number }}
+            Repository: ${{ github.repository }}
+
+            Your task:
+            1. Use mcp__github__get_issue to get details of the current issue (#${{ github.event.issue.number || inputs.issue_number }})
+            2. Search for similar existing issues using mcp__github__search_issues with relevant keywords from the issue title and body
+            3. Compare the new issue with existing ones to identify potential duplicates
+
+            Criteria for duplicates:
+            - Same bug or error being reported
+            - Same feature request (even if worded differently)
+            - Same question being asked
+            - Issues describing the same root problem
+
+            If you find duplicates:
+            - Add a comment on the new issue linking to the original issue(s)
+            - Apply the "duplicate" and "state/needs-investigation" labels to the new issue
+            - Be polite and explain why it's a duplicate
+            - Suggest the user follow the original issue for updates
+
+            If it's NOT a duplicate:
+            - Don't add any comments
+            - You may apply appropriate topic labels based on the issue content
+
+            Use these tools:
+            - mcp__github__get_issue: Get issue details
+            - mcp__github__search_issues: Search for similar issues
+            - mcp__github__list_issues: List recent issues if needed
+            - mcp__github__add_issue_comment: Add a comment if duplicate found
+            - mcp__github__update_issue: Add labels
+
+            Be thorough but efficient. Focus on finding true duplicates, not just similar issues.
+
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_03 }}
+
+          # Issues are opened by community members without write access, so the
+          # default OIDC token exchange fails with "User does not have write
+          # access on this repository". Pass `github_token` explicitly and set
+          # `allowed_non_write_users` to bypass that check. Safe here because
+          # `permissions:` and `--allowedTools` below are tightly scoped to
+          # issue operations only.
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          allowed_non_write_users: "*"
+
+          # Surface full SDK output (including tool calls and permission denials)
+          # to diagnose why Claude sometimes only partially completes (e.g. labels
+          # an issue but skips the comment). Safe to leave on — no secrets in output.
+          show_full_output: true
+
+          claude_args: |
+            --model claude-haiku-4-5 --allowedTools "mcp__github__get_issue,mcp__github__search_issues,mcp__github__list_issues,mcp__github__add_issue_comment,mcp__github__update_issue,mcp__github__get_issue_comments"
@@ -34,7 +34,7 @@ jobs:
      run:
        working-directory: src/Umbraco.Web.UI.Client
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
@@ -57,7 +57,7 @@ jobs:
      run:
        working-directory: src/Umbraco.Web.UI.Client
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
@@ -52,7 +52,9 @@ tools/docfx/
 /build/csharp-docs/_site/

 # Local config
-.claude/settings.local.json
+.claude/*
+!.claude/skills/
+!.claude/settings.json
 .env.local

 # Build
@@ -70,7 +72,8 @@ tools/docfx/
 /src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/assets
 /src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/js
 /src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/lib
-/src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/views
+/src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/views/*
+!/src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/views/errors
 /src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/login

 # Environment specific data
@@ -198,7 +198,7 @@ Use the format: `Area: Description (closes #IssueID)`
 - Describe the change and its impact
 - Be specific, not vague (describe "a golden retriever" not just "a dog")

-**Issue Linking**: Add `(closes #IssueID)` to auto-close linked issues on merge.
+**Issue Linking**: Add `(closes #IssueID)` to the title for readability, AND include a closing keyword on its own line in the PR body (e.g., `Fixes #IssueID`) so GitHub actually auto-links and auto-closes the issue on merge. GitHub only parses closing keywords (`closes`, `fixes`, `resolves`) from the PR body or commit messages — the title suffix is cosmetic and does **not** trigger auto-close on its own.

 ### Commit Messages

@@ -227,9 +227,11 @@ Project ownership is distributed across teams. Check individual project director

 1. **Layered Architecture with Dependency Inversion**
   - Core defines contracts (interfaces)
-   - Infrastructure implements contracts
+   - Infrastructure implements contracts that need Infrastructure-owned machinery
   - Web/APIs consume implementations via DI

+   **Where service implementations live**: Services whose dependencies are satisfiable from Core interfaces alone (repositories, scope, config, other Core services) live in `Umbraco.Core/Services/` — this covers the majority of domain services (`MemberService`, `ContentService`, `MediaService`, `ContentTypeService`, `EntityService`, `AuditService`, `ExternalMemberService`, etc.). Service implementations only live in `Umbraco.Infrastructure/Services/Implement/` when they genuinely need Infrastructure concerns — Examine indexes (`ContentSearchService`, `MediaSearchService`, `IndexedEntitySearchService`), log files (`LogViewerRepository`), packaging internals (`PackagingService`), webhook firing (`WebhookFiringService`), distributed-job coordination (`DistributedJobService`). When adding a new service, default to Core and only move to Infrastructure if a concrete dependency forces it.
+
 2. **Interface-First Design**
   - All services defined as interfaces in Core
   - Enables testing, polymorphism, extensibility
@@ -419,64 +421,27 @@ APIs use `Asp.Versioning.Mvc`:
 - Delivery API: `/umbraco/delivery/api/v{version}/*`
 - OpenAPI/Swagger docs per version

-### Backoffice npm Package Structure
+### Updating `OpenApi.json` (Management API)

-The backoffice (`Umbraco.Web.UI.Client`) is published to npm as **`@umbraco-cms/backoffice`** with a plugin architecture:
+When a PR changes Management API controllers or models, the `OpenApi.json` file in the Management API project must be updated:

-#### Architecture Overview
+1. Run the Umbraco instance locally
+2. Open Swagger UI and navigate to the swagger.json link (e.g. `https://localhost:44339/umbraco/swagger/management/swagger.json`)
+3. Copy the full JSON content and paste it into `src/Umbraco.Cms.Api.Management/OpenApi.json`

- **Multi-workspace structure**: Subprojects in `src/libs/*`, `src/packages/*`, `src/external/*`
- **Export model**: All exports defined in root `package.json` → `./exports` field
- **Importmap-driven runtime**: Dependencies provided at runtime via importmap (single source of truth)
- **Build-time types**: TypeScript types come from npm peerDependencies
- **Plugin model**: Developers create plugins that import from `@umbraco-cms/backoffice/*` exports
+**Important**: Commit only the substantive changes — not IDE-applied formatting (whitespace, reordering, etc.). Extraneous formatting diffs make PRs harder to review and merge-ups more error-prone.

-#### Dependency Hoisting Strategy
+### Backoffice npm Package

-When building for npm (`npm pack`), the `cleanse-pkg.js` script hoists subproject dependencies to root `peerDependencies` with intelligent version range conversion:
+The backoffice is published to npm as `@umbraco-cms/backoffice`. Runtime dependencies are provided via importmap; npm peerDependencies provide types only. For full details on dependency hoisting, version range logic, and plugin development, see `/src/Umbraco.Web.UI.Client/CLAUDE.md` → "npm Package Publishing".

-**Version Range Logic** (uses `semver` package):
+### SQL Server 2100-parameter limit

-1. **Pre-release (0.x.y)**: Convert to explicit range
-   - Input: `^0.85.0` or `0.85.0`
-   - Output: `>=0.85.0 <1.0.0`
-   - Rationale: Pre-release caret only allows patch updates, explicit range allows minor upgrades within 0.x.x
-   - Example: Plugin can use `@hey-api/openapi-ts@0.91.1` while backoffice uses `0.85.0`
+Any `WHERE IN (@0, @1, ...)` built from a runtime-sized collection risks hitting SQL Server's 2100-parameter ceiling and throwing `SqlException` 8003 in production.

-2. **Stable with caret (^X.Y.Z where X ≥ 1)**: Keep as-is
-   - Input: `^3.3.1`
-   - Output: `^3.3.1` (unchanged)
-   - Rationale: Caret already implements correct semantics for stable versions
+Batch with `IEnumerable<T>.InGroupsOf(Constants.Sql.MaxParameterCount)` or `Database.FetchByGroups(...)` whenever the collection size is driven by user data — not just when it currently fits. Watch for products of two scaling dimensions (documents × languages, properties × versions) and config-tunable batch sizes whose defaults are safe but ceilings aren't.

-3. **Stable exact versions (X.Y.Z where X ≥ 1)**: Add caret
-   - Input: `3.16.0`
-   - Output: `^3.16.0`
-   - Rationale: Normalizes to conventional semver format
-
-#### Key Dependencies
-
-**Runtime via importmap** (types available from peerDependencies):
- `lit`, `rxjs`, `@umbraco-ui/uui` - Core framework
- `monaco-editor`, `@tiptap/*` - Feature-specific editors
- `@hey-api/openapi-ts` - HTTP client type generation
-
-**Build-time only** (not hoisted):
- `vite`, `typescript`, `eslint` - Dev tooling
-
-#### Plugin Development Implications
-
-Plugin developers should:
- **Declare explicit dependencies** in their own `package.json` (avoid relying on transitive deps)
- **Understand the version ranges**: `>=0.85.0 <1.0.0` means they can use newer pre-release versions
- **Know that types match npm ranges**, but runtime comes from importmap (managed by backoffice)
- **When `@hey-api` hits 1.0.0**: Published constraint will automatically become `^1.0.0`
-
-#### Implementation Details
-
- Script location: `src/Umbraco.Web.UI.Client/devops/publish/cleanse-pkg.js`
- Runs as `prepack` hook before npm pack
- Uses `semver.minVersion()` for robust version range parsing
- Generates single source of truth for importmap versions
+Full guidance, safe patterns and decision rule: see `/src/Umbraco.Infrastructure/CLAUDE.md` → "Avoiding the SQL Server 2100-parameter limit".

 ### Known Limitations

@@ -486,6 +451,104 @@ Plugin developers should:

 ---

+## 7. CI/CD — Claude AI Assistant
+
+Two GitHub Actions workflows powered by `anthropics/claude-code-action@v1`. Advisory only — does not block merging.
+
+### Workflows
+
+| File | Trigger | Purpose |
+|------|---------|---------|
+| `claude-review.yml` | `pull_request: [opened, ready_for_review]` | Auto-review every non-draft PR using the `umb-review` skill |
+| `claude.yml` | `@claude` comments, issue assign/label | Interactive assistant for PRs and issues |
+
+### Auto-Review (`claude-review.yml`)
+
+Runs the full `.claude/skills/umb-review/SKILL.md` procedure on every newly opened or un-drafted PR. Produces inline comments per finding and one summary comment with a verdict. Skips draft PRs. No turn limit.
+
+### Interactive (`claude.yml`)
+
+Responds to `@claude` mentions on PRs and issues. The trigger phrase is stripped before Claude sees the message, so:
+
+- `@claude review` → light review using `gh pr diff` (not the umb-review skill)
+- `@claude fix ...` → implements a fix on a new branch
+- `@claude help` → answers questions about the codebase
+- `@claude label` → applies labels
+- `@claude` (empty) → defaults to `review` on PRs, `help` on issues
+
+Also triggers on issue assignment to `claude` or adding the `claude` label. Gated: only runs when `@claude` appears in the comment/issue body. Max 25 turns.
+
+**Allowed Bash tools**: `gh`, `git`, `npm`, `dotnet` (interactive only; auto-review allows `gh` and `git`).
+
+### Labels
+
+Both workflows apply labels based on content:
+
+**On PRs** (based on changed files):
+
+| Label | Condition |
+|-------|-----------|
+| `area/frontend` | Files under `src/Umbraco.Web.UI.Client/` |
+| `area/backend` | `.cs` files outside the frontend client |
+| `area/test` | Only test files changed |
+| `category/api` | Management or Delivery API files |
+| `category/breaking` | Breaking changes detected |
+| `category/localization` | Localization/language files |
+| `category/test-automation` | Only test files changed |
+| `category/refactor` | Pure refactoring, no new features |
+| `category/performance` | Performance-related changes |
+| `category/ux` | User-facing changes |
+| `category/ui` | UI layer changes |
+
+**On Issues** (based on content): same `area/*` and `category/*` labels, plus `affected/v14` through `affected/v17` and `affected/backoffice`.
+
+Labels are only added, never removed. Claude applies only labels it is confident about.
+
+### Key Implementation Notes
+
+- **Checkout required** — the action internally runs `git fetch origin main` for trusted file restoration. Without `actions/checkout`, it fails with `fatal: not a git repository`.
+- **`id-token: write` permission** — required for OIDC token exchange with the Claude GitHub App.
+- **Trigger phrase stripping** — the action strips `@claude` from comments before passing to Claude. Prompts must reference commands without the prefix (e.g., `review` not `@claude review`).
+- **PR number injection** — the interactive workflow injects the PR/issue number into the prompt via `${{ github.event.issue.number }}` since Claude can't discover it from `gh pr view` when checked out on `main`.
+
+---
+
+## 8. Code Comment Policy
+
+**Default to no comment.** Applies to all code in this repository — C#, TypeScript, Razor, build scripts. Well-named identifiers and small functions are the primary form of self-documentation; comments are a fallback for the rare cases where the code itself cannot carry the meaning.
+
+### When NOT to comment
+
+- **Don't restate what the code does.** A line calling `resetState()` does not need `// Reset state`. A method named `validateInput` does not need `// Validate input`.
+- **Don't narrate a sequence of calls.** If three lines run in order, the order is in the code — don't paraphrase it above.
+- **Don't reference the current task, fix, callers, or PR.** No `// Fix for X`, `// Used by Y`, `// Added for the Z flow`, `// See PR #1234`. That belongs in commit messages and PR descriptions; in source it rots as the codebase evolves.
+
+### When a comment IS justified
+
+Write a comment only when **removing it would leave a future reader confused**. Concretely:
+
+- **A non-obvious WHY.** A hidden constraint, business rule, or ordering requirement that is not visible from the code.
+- **A workaround for a specific bug or platform quirk.** Link the issue (`(#21996)`, `https://...`) so the comment can be deleted once the upstream fix lands.
+- **A subtle invariant** that the type system or method names do not enforce.
+- **An edge case the code intentionally handles** that would surprise a reader (e.g. "must run before X because Y").
+- **API documentation** — XML doc comments on C# members, JSDoc on exported TypeScript symbols. Required for the public contract; still keep them concise.
+
+### TODOs
+
+Allowed, but cheap to write and cheaper to leave behind. Keep them short and trackable: `// TODO (V19): remove once obsolete overload is gone` or `// TODO: pagination [NL]`. A TODO should have an author or a version trigger.
+
+---
+
+## 9. Testing Practices
+
+### Tests for a bug fix must fail before the fix
+
+Verify any test you add for a bug fix actually catches the bug: either write the failing test first (TDD), or temporarily revert the production change and confirm the test fails before re-applying. A test that passes both ways proves nothing. Watch for coincidental passes — default seed/sort orders can make a buggy path produce the right answer for the test's specific inputs; construct inputs so the broken and fixed behaviours give visibly different results.
+
+For integration tests that exercise caching or cache refreshers, see `tests/Umbraco.Tests.Integration/CLAUDE.md` — the harness disables caching by default, which can produce false greens.
+
+---
+
 ## Quick Reference

 ### Essential Commands
@@ -507,6 +570,16 @@ dotnet format
 dotnet pack -c Release
 ```

+### Integration Test Database Configuration
+
+Integration tests are configured in `tests/Umbraco.Tests.Integration/appsettings.Tests.json`.
+
+The `Tests:Database:DatabaseType` setting controls which database is used:
+- `"SQLite"` (default) - No external dependencies
+- `"LocalDb"` - Uses SQL Server LocalDB, required for SQL Server-specific tests (e.g., page-level locking, `sys.dm_tran_locks`)
+
+SQL Server-specific tests use `BaseTestDatabase.IsSqlite()` to skip when running on SQLite.
+
 ### Key Projects

 | Project | Type | Description |
@@ -534,6 +607,8 @@ For detailed information about individual projects, see their CLAUDE.md files:
 - **API Infrastructure**: `/src/Umbraco.Cms.Api.Common/CLAUDE.md` - OpenAPI, authentication, serialization
 - **Backoffice Frontend**: `/src/Umbraco.Web.UI.Client/CLAUDE.md` - Lit web components, extension system, auth client

+**Important**: When working on backoffice client code (anything under `src/Umbraco.Web.UI.Client/`), read `/src/Umbraco.Web.UI.Client/CLAUDE.md` first. It contains action-specific checklists (deprecation, testing, security, etc.) that are not duplicated here.
+
 ### Getting Help

 - **Official Docs**: https://docs.umbraco.com/
@@ -13,55 +13,55 @@
  </ItemGroup>
  <!-- Microsoft packages -->
  <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.6" />
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.14.0" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.4.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.5.0" />
    <PackageVersion Include="System.Linq.Async" Version="7.0.0" />
  </ItemGroup>
  <!-- Umbraco packages -->
  <ItemGroup>
-    <PackageVersion Include="Umbraco.JsonSchema.Extensions" Version="0.3.0" />
+    <PackageVersion Include="Umbraco.JsonSchema.Extensions" Version="0.4.0" />
  </ItemGroup>
  <!-- Third-party packages -->
  <ItemGroup>
    <PackageVersion Include="Asp.Versioning.Mvc" Version="8.1.1" />
    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="8.1.1" />
    <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
-    <PackageVersion Include="Examine" Version="3.7.1" />
-    <PackageVersion Include="Examine.Core" Version="3.7.1" />
+    <PackageVersion Include="Examine" Version="3.8.0" />
+    <PackageVersion Include="Examine.Core" Version="3.8.0" />
    <PackageVersion Include="HtmlAgilityPack" Version="1.12.4" />
    <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
-    <PackageVersion Include="MailKit" Version="4.15.1" />
+    <PackageVersion Include="MailKit" Version="4.16.0" />
    <PackageVersion Include="Markdig" Version="0.45.0" />
    <PackageVersion Include="Markdown" Version="2.2.1" />
-    <PackageVersion Include="MessagePack" Version="3.1.4" />
+    <PackageVersion Include="MessagePack" Version="3.1.7" />
    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
    <PackageVersion Include="MiniProfiler.Shared" Version="4.5.4" />
    <PackageVersion Include="ncrontab" Version="3.4.0" />
    <PackageVersion Include="NPoco" Version="6.2.0" />
    <PackageVersion Include="NPoco.SqlServer" Version="6.2.0" />
-    <PackageVersion Include="OpenIddict.Abstractions" Version="7.2.0" />
-    <PackageVersion Include="OpenIddict.AspNetCore" Version="7.2.0" />
-    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="7.2.0" />
+    <PackageVersion Include="OpenIddict.Abstractions" Version="7.4.0" />
+    <PackageVersion Include="OpenIddict.AspNetCore" Version="7.4.0" />
+    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="7.4.0" />
    <PackageVersion Include="Serilog" Version="4.3.1" />
    <PackageVersion Include="Serilog.AspNetCore" Version="9.0.0" />
    <PackageVersion Include="Serilog.Enrichers.Process" Version="3.0.0" />
@@ -77,7 +77,7 @@
    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.2.0" />
    <!-- When updating this version, also update templates/UmbracoExtension/Umbraco.Extension.csproj -->
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.1.4" />
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.1.7" />
  </ItemGroup>
  <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
  <ItemGroup>
@@ -88,5 +88,8 @@
    <!-- Markdown references vulnerable version of the following: -->
    <!-- TODO (V19): Remove these pinned dependencies when the Markdown dependency is removed. -->
    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
+    <!-- Examine (via Microsoft.AspNetCore.DataProtection 8.0.4) references a vulnerable version of the following: -->
+    <!-- TODO: Remove this pinned dependency when Examine updates its Microsoft.AspNetCore.DataProtection reference. -->
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.6" />
  </ItemGroup>
 </Project>
@@ -188,16 +188,9 @@ stages:
            parameters:
              nodeVersion: ${{ variables.nodeVersion }}
              npm_config_cache: ${{ variables.npm_config_cache }}
-          - bash: |
-              echo "##[command]Install nbgv"
-              dotnet tool install --tool-path . nbgv
-              echo "##[command]Running nbgv get-version"
-              PACKAGE_VERSION=$(nbgv get-version -v NpmPackageVersion)
-              echo "##[command]Running npm version"
-              echo "##[debug]Version: $PACKAGE_VERSION"
-              cd tests/Umbraco.Tests.AcceptanceTest
-              npm version $PACKAGE_VERSION --allow-same-version --no-git-tag-version
-            displayName: Set NPM Version
+          - template: templates/set-npm-version.yml
+            parameters:
+              workingDirectory: tests/Umbraco.Tests.AcceptanceTest
          - bash: |
              echo "##[command]Running npm pack"
              mkdir $(Build.ArtifactStagingDirectory)/npm-testhelpers
@@ -614,7 +607,6 @@ stages:
      UMBRACO__CMS__GLOBAL__VERSIONCHECKPERIOD: 0
      UMBRACO__CMS__GLOBAL__USEHTTPS: true
      UMBRACO__CMS__HEALTHCHECKS__NOTIFICATION__ENABLED: false
-      UMBRACO__CMS__KEEPALIVE__DISABLEKEEPALIVETASK: true
      UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL: https://localhost:44331/
      ASPNETCORE_URLS: https://localhost:44331
    jobs:
@@ -833,84 +825,56 @@ stages:
                publishFeedCredentials: "MyGet - Umbraco Nightly"
              ${{ else }}:
                publishFeedCredentials: "MyGet - Pre-releases"
+      # Pre-release/nightly feeds: keep the `latest` dist-tag default (no `next` split).
      - job:
        displayName: Push to pre-release feed (npm)
        steps:
-          - checkout: none
-          - download: current
-            artifact: npm
-          - bash: |
-              # Check if we are on a nightly build
-              if [ $isNightly = "False" ]; then
-                  echo "##[debug]Prerelease build detected"
-                  registry="https://www.myget.org/F/umbracoprereleases/npm/"
-              else
-                  echo "##[debug]Nightly build detected"
-                  registry="https://www.myget.org/F/umbraconightly/npm/"
-              fi
-              echo "@umbraco-cms:registry=$registry" >> .npmrc
-            env:
-              isNightly: ${{parameters.isNightly}}
-            workingDirectory: $(Pipeline.Workspace)/npm
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm (MyGet)
-            inputs:
-              workingFile: "$(Pipeline.Workspace)/npm/.npmrc"
+          - template: templates/npm-publish.yml
+            parameters:
+              artifactName: npm
              customEndpoint: "MyGet (npm) - Umbracoprereleases, MyGet (npm) - Umbraconightly"
-          - bash: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push to npm (MyGet)
-            workingDirectory: $(Pipeline.Workspace)/npm
+              displayName: Push to npm (MyGet)
+              ${{ if eq(parameters.isNightly, true) }}:
+                registry: https://www.myget.org/F/umbraconightly/npm/
+              ${{ else }}:
+                registry: https://www.myget.org/F/umbracoprereleases/npm/
      - job: PublishTestHelpersNpm
        displayName: Push TestHelpers to pre-release feed (npm)
        steps:
-          - checkout: none
-          - download: current
-            artifact: npm-testhelpers
-          - bash: |
-              # Check if we are on a nightly build
-              if [ $isNightly = "False" ]; then
-                  echo "##[debug]Prerelease build detected"
-                  registry="https://www.myget.org/F/umbracoprereleases/npm/"
-              else
-                  echo "##[debug]Nightly build detected"
-                  registry="https://www.myget.org/F/umbraconightly/npm/"
-              fi
-              echo "@umbraco-cms:registry=$registry" >> .npmrc
-            env:
-              isNightly: ${{parameters.isNightly}}
-            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm (MyGet)
-            inputs:
-              workingFile: "$(Pipeline.Workspace)/npm-testhelpers/.npmrc"
+          - template: templates/npm-publish.yml
+            parameters:
+              artifactName: npm-testhelpers
              customEndpoint: "MyGet (npm) - Umbracoprereleases, MyGet (npm) - Umbraconightly"
-          - bash: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push test helpers to npm (MyGet)
-            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
+              displayName: Push test helpers to npm (MyGet)
+              ${{ if eq(parameters.isNightly, true) }}:
+                registry: https://www.myget.org/F/umbraconightly/npm/
+              ${{ else }}:
+                registry: https://www.myget.org/F/umbracoprereleases/npm/

  - stage: Deploy_NuGet
    displayName: NuGet release
    dependsOn: Deploy_MyGet
-    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.nuGetDeploy}}))
+    # Run only when Deploy_MyGet actually ran (succeeded or failed) — not when it was skipped due to an upstream test failure.
+    # Inspect Deploy_MyGet's direct result rather than succeeded()/failed(), which are transitive across the full ancestor graph.
+    # Approval is required every run via the WaitForApproval job below.
+    condition: and(in(dependencies.Deploy_MyGet.result, 'Succeeded', 'SucceededWithIssues', 'Failed'), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.nuGetDeploy}}))
    jobs:
-      - job:
+      - job: WaitForApproval
+        displayName: Wait for manual approval
+        pool: server
+        timeoutInMinutes: 4320 # 3 days
+        steps:
+          - task: ManualValidation@0
+            displayName: Manual approval to push to NuGet
+            inputs:
+              notifyUsers: ''
+              instructions: 'Approve to push the NuGet release.'
+              onTimeout: 'reject'
+      - job: Push
+        displayName: Push to NuGet
+        dependsOn: WaitForApproval
        pool:
          vmImage: "windows-latest" # NuGetCommand@2 is no longer supported on Ubuntu 24.04 so we'll use windows until an alternative is available.
-        displayName: Push to NuGet
        steps:
          - checkout: none
          - task: DownloadPipelineArtifact@2
@@ -928,56 +892,36 @@ stages:

  - stage: Deploy_Npm
    displayName: Npm release
-    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.npmDeploy}}))
+    # Inspect Deploy_NuGet.result directly so a MyGet failure (which is in the transitive ancestor graph)
+    # doesn't cascade-skip this stage via succeeded(). Deploy_NuGet must itself have succeeded — a NuGet
+    # failure deliberately blocks the npm release.
+    condition: and(in(dependencies.Deploy_NuGet.result, 'Succeeded', 'SucceededWithIssues'), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.npmDeploy}}))
    dependsOn:
      - Deploy_NuGet
+    variables:
+      # `latest` for stable releases, `next` for prereleases.
+      npmDistTag: $[ iif(eq(stageDependencies.Build.A.outputs['build.NBGV_PrereleaseVersionNoLeadingHyphen'], ''), 'latest', 'next') ]
    jobs:
      - job: Publish
        displayName: Push to NPM
        steps:
-          - checkout: none
-          - download: current
-            artifact: npm
-          - bash: echo "@umbraco-cms:registry=https://registry.npmjs.org" >> .npmrc
-            workingDirectory: $(Pipeline.Workspace)/npm
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm
-            inputs:
-              workingFile: $(Pipeline.Workspace)/npm/.npmrc
+          - template: templates/npm-publish.yml
+            parameters:
+              artifactName: npm
+              registry: https://registry.npmjs.org/
              customEndpoint: "NPM - Umbraco Backoffice"
-          - script: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push to npm
-            workingDirectory: $(Pipeline.Workspace)/npm
+              displayName: Push to npm
+              npmTag: $(npmDistTag)
      - job: PublishTestHelpers
        displayName: Push Test Helpers to NPM
        steps:
-          - checkout: none
-          - download: current
-            artifact: npm-testhelpers
-          - bash: echo "@umbraco-cms:registry=https://registry.npmjs.org" >> .npmrc
-            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm
-            inputs:
-              workingFile: $(Pipeline.Workspace)/npm-testhelpers/.npmrc
+          - template: templates/npm-publish.yml
+            parameters:
+              artifactName: npm-testhelpers
+              registry: https://registry.npmjs.org/
              customEndpoint: "NPM - Umbraco Backoffice"
-          - script: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push test helpers to npm
-            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
+              displayName: Push test helpers to npm
+              npmTag: $(npmDistTag)

  - stage: Upload_API_Docs
    pool:
@@ -989,7 +933,10 @@ stages:
      - Build
      - Build_Docs
      - Deploy_NuGet
-    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadApiDocs}}))
+    # Build_Docs must have produced artifacts (we won't upload anything otherwise) and Deploy_NuGet must
+    # have succeeded — a NuGet failure deliberately blocks the docs upload. Direct result checks avoid
+    # transitive succeeded()/failed() which would cascade-skip on a MyGet failure.
+    condition: and(in(dependencies.Build_Docs.result, 'Succeeded', 'SucceededWithIssues'), in(dependencies.Deploy_NuGet.result, 'Succeeded', 'SucceededWithIssues'), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadApiDocs}}))
    jobs:
      - job:
        displayName: Upload C# Docs
@@ -4,13 +4,11 @@ pr: none
 trigger: none

 schedules:
-  - cron: '0 0 * * *'
-    displayName: Daily midnight build
+  - cron: '0 3 * * *'
+    displayName: Daily 3AM build (v17/dev)
    branches:
      include:
-        - v15/dev
-        - v16/dev
-        - main
+        - v17/dev

 parameters:
  - name: skipIntegrationTests
@@ -119,7 +117,7 @@ stages:
  - stage: Integration
    displayName: Integration Tests
    dependsOn: Build
-    condition: ${{ eq(parameters.skipIntegrationTests, false) }}
+    condition: and(succeeded(), ${{ eq(parameters.skipIntegrationTests, false) }})
    jobs:
      # Integration Tests (SQLite)
      - job:
@@ -321,7 +319,8 @@ stages:

  - stage: DefaultConfigE2E
    displayName: Default Config E2E Tests
-    dependsOn: Build
+    dependsOn: [Build, Integration]
+    condition: in(dependencies.Build.result, 'Succeeded', 'SucceededWithIssues')
    variables:
      npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
      # Enable console logging in Release mode
@@ -340,7 +339,6 @@ stages:
      UMBRACO__CMS__GLOBAL__VERSIONCHECKPERIOD: 0
      UMBRACO__CMS__GLOBAL__USEHTTPS: true
      UMBRACO__CMS__HEALTHCHECKS__NOTIFICATION__ENABLED: false
-      UMBRACO__CMS__KEEPALIVE__DISABLEKEEPALIVETASK: true
      UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL: https://localhost:44331/
      ASPNETCORE_URLS: https://localhost:44331
    jobs:
@@ -502,7 +500,8 @@ stages:

  - stage: AdditionalConfigE2E
    displayName: Additional Config E2E Tests
-    dependsOn: Build
+    dependsOn: [Build, DefaultConfigE2E]
+    condition: in(dependencies.Build.result, 'Succeeded', 'SucceededWithIssues')
    variables:
      npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
      ASPNETCORE_URLS: https://localhost:44331
@@ -10,6 +10,7 @@ schedules:
    include:
    - v13/dev
    - v16/dev
+    - v18/dev
    - main

 steps:
@@ -6,16 +6,9 @@ steps:
      versionSource: 'fromFile'
      versionFilePath: src/Umbraco.Web.UI.Client/.nvmrc

-  - bash: |
-      echo "##[command]Install nbgv"
-      dotnet tool install --tool-path . nbgv
-      echo "##[command]Running nbgv get-version"
-      PACKAGE_VERSION=$(nbgv get-version -v NpmPackageVersion)
-      echo "##[command]Running npm version"
-      echo "##[debug]Version: $PACKAGE_VERSION"
-      cd src/Umbraco.Web.UI.Client
-      npm version $PACKAGE_VERSION --allow-same-version --no-git-tag-version
-    displayName: Set NPM Version
+  - template: set-npm-version.yml
+    parameters:
+      workingDirectory: src/Umbraco.Web.UI.Client

  - task: Cache@2
    displayName: Cache node_modules
@@ -0,0 +1,28 @@
+parameters:
+  - name: artifactName # "npm" or "npm-testhelpers"
+    type: string
+  - name: registry # scoped-registry URL to publish to
+    type: string
+  - name: customEndpoint # npmAuthenticate service connection(s)
+    type: string
+  - name: displayName # label for the publish step
+    type: string
+  - name: npmTag # dist-tag to publish under
+    type: string
+    default: latest
+
+steps:
+  - checkout: none
+  - download: current
+    artifact: ${{ parameters.artifactName }}
+  - script: npm config set @umbraco-cms:registry ${{ parameters.registry }} --location=project
+    displayName: Add scoped registry to .npmrc
+    workingDirectory: $(Pipeline.Workspace)/${{ parameters.artifactName }}
+  - task: npmAuthenticate@0
+    displayName: Authenticate with npm
+    inputs:
+      workingFile: $(Pipeline.Workspace)/${{ parameters.artifactName }}/.npmrc
+      customEndpoint: ${{ parameters.customEndpoint }}
+  - script: npm publish *.tgz --tag ${{ parameters.npmTag }}
+    displayName: ${{ parameters.displayName }}
+    workingDirectory: $(Pipeline.Workspace)/${{ parameters.artifactName }}
@@ -0,0 +1,15 @@
+parameters:
+  - name: workingDirectory
+    type: string
+
+steps:
+  - bash: |
+      echo "##[command]Install nbgv"
+      dotnet tool install --tool-path . nbgv
+      echo "##[command]Running nbgv get-version"
+      PACKAGE_VERSION=$(nbgv get-version -v NpmPackageVersion)
+      echo "##[command]Running npm version"
+      echo "##[debug]Version: $PACKAGE_VERSION"
+      cd ${{ parameters.workingDirectory }}
+      npm version $PACKAGE_VERSION --allow-same-version --no-git-tag-version
+    displayName: Set NPM Version
@@ -1,6 +1,8 @@
 using System.Diagnostics.CodeAnalysis;
+using System.Security.Cryptography;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using OpenIddict.Abstractions;
 using OpenIddict.Server;
@@ -41,6 +43,7 @@ internal sealed class HideBackOfficeTokensHandler

    private readonly IHttpContextAccessor _httpContextAccessor;
    private readonly IDataProtectionProvider _dataProtectionProvider;
+    private readonly ILogger<HideBackOfficeTokensHandler> _logger;
 #pragma warning disable CS0618 // Type or member is obsolete
    private readonly BackOfficeTokenCookieSettings _backOfficeTokenCookieSettings;
 #pragma warning restore CS0618 // Type or member is obsolete
@@ -51,11 +54,13 @@ internal sealed class HideBackOfficeTokensHandler
    /// </summary>
    /// <param name="httpContextAccessor">The HTTP context accessor.</param>
    /// <param name="dataProtectionProvider">The data protection provider for encrypting cookie values.</param>
+    /// <param name="logger">The logger.</param>
    /// <param name="backOfficeTokenCookieSettings">The back-office token cookie settings.</param>
    /// <param name="globalSettings">The global settings.</param>
    public HideBackOfficeTokensHandler(
        IHttpContextAccessor httpContextAccessor,
        IDataProtectionProvider dataProtectionProvider,
+        ILogger<HideBackOfficeTokensHandler> logger,
 #pragma warning disable CS0618 // Type or member is obsolete
        IOptions<BackOfficeTokenCookieSettings> backOfficeTokenCookieSettings,
 #pragma warning restore CS0618 // Type or member is obsolete
@@ -63,6 +68,7 @@ internal sealed class HideBackOfficeTokensHandler
    {
        _httpContextAccessor = httpContextAccessor;
        _dataProtectionProvider = dataProtectionProvider;
+        _logger = logger;
        _backOfficeTokenCookieSettings = backOfficeTokenCookieSettings.Value;
        _globalSettings = globalSettings.Value;

@@ -291,8 +297,19 @@ internal sealed class HideBackOfficeTokensHandler
        var key = GetCookieKey(httpContext, cookieName);
        if (httpContext.Request.Cookies.TryGetValue(key, out var cookieValue))
        {
-            value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
-            return true;
+            try
+            {
+                value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
+                return true;
+            }
+            catch (CryptographicException ex)
+            {
+                // Decryption can fail if the data protection key ring has changed
+                // (e.g., after deployment, app pool recycle, or slot swap).
+                // Treat this as a missing cookie — the user will need to re-authenticate.
+                _logger.LogWarning(ex, "Failed to decrypt back-office token cookie '{CookieName}'. The user will need to re-authenticate.", cookieName);
+                RemoveCookie(httpContext, cookieName);
+            }
        }

        value = null;
@@ -0,0 +1,47 @@
+using Microsoft.AspNetCore.Http;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+/// <summary>
+///     Default implementation of <see cref="IDeliveryApiOutputCacheRequestFilter"/> that prevents caching
+///     for preview mode requests and requests without public access.
+/// </summary>
+public class DefaultDeliveryApiOutputCacheRequestFilter : IDeliveryApiOutputCacheRequestFilter
+{
+    private readonly IRequestPreviewService _requestPreviewService;
+    private readonly IApiAccessService _apiAccessService;
+
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="DefaultDeliveryApiOutputCacheRequestFilter"/> class.
+    /// </summary>
+    /// <param name="requestPreviewService">The preview service.</param>
+    /// <param name="apiAccessService">The API access service.</param>
+    public DefaultDeliveryApiOutputCacheRequestFilter(IRequestPreviewService requestPreviewService, IApiAccessService apiAccessService)
+    {
+        _requestPreviewService = requestPreviewService;
+        _apiAccessService = apiAccessService;
+    }
+
+    /// <inheritdoc />
+    public virtual bool IsCacheable(HttpContext context)
+        => IsPreview() is false && HasPublicAccess();
+
+    /// <inheritdoc />
+    public virtual bool IsCacheable(HttpContext context, IPublishedContent content) => true;
+
+    /// <summary>
+    ///     Returns <c>true</c> if the current request is a preview request; <c>false</c> if the request
+    ///     is not a preview and may be cached.
+    /// </summary>
+    protected virtual bool IsPreview()
+        => _requestPreviewService.IsPreview();
+
+    /// <summary>
+    ///     Returns <c>true</c> if the current request has public access; <c>false</c> if the request
+    ///     is not publicly accessible and should not be cached.
+    /// </summary>
+    protected virtual bool HasPublicAccess()
+        => _apiAccessService.HasPublicAccess();
+}
@@ -0,0 +1,17 @@
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.Models.PublishedContent;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+/// <summary>
+///     Tags cached pages for delivery API output caching with their content type alias, enabling eviction by content type.
+/// </summary>
+internal sealed class DeliveryApiContentTypeOutputCacheTagProvider : IDeliveryApiOutputCacheTagProvider
+{
+    /// <inheritdoc />
+    public IEnumerable<string> GetTags(IPublishedContent content)
+    {
+        yield return Constants.DeliveryApi.OutputCache.ContentTypeTagPrefix + content.ContentType.Alias;
+    }
+}
@@ -0,0 +1,135 @@
+using Microsoft.AspNetCore.OutputCaching;
+using Microsoft.Extensions.Logging;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.Events;
+using Umbraco.Cms.Core.Notifications;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.Changes;
+using Umbraco.Cms.Core.Sync;
+using Umbraco.Cms.Web.Common.Caching;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+/// <summary>
+///     Handles <see cref="ContentCacheRefresherNotification"/> to evict Delivery API output cache entries
+///     when content is published, unpublished, moved, or deleted. Also evicts responses for content
+///     that references the changed content via picker properties (umbDocument relations).
+/// </summary>
+internal sealed class DeliveryApiDocumentOutputCacheEvictionHandler
+    : RelationOutputCacheEvictionHandlerBase, INotificationAsyncHandler<ContentCacheRefresherNotification>
+{
+    private readonly IEnumerable<IDeliveryApiOutputCacheEvictionProvider> _evictionProviders;
+    private readonly ILogger<DeliveryApiDocumentOutputCacheEvictionHandler> _logger;
+
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="DeliveryApiDocumentOutputCacheEvictionHandler"/> class.
+    /// </summary>
+    /// <param name="outputCacheStore">The output cache store for evicting cached responses.</param>
+    /// <param name="relationService">The relation service for querying entity references.</param>
+    /// <param name="idKeyMap">The ID/key mapping service for converting between integer IDs and GUIDs.</param>
+    /// <param name="evictionProviders">Custom eviction providers for additional tag-based eviction.</param>
+    /// <param name="logger">The logger.</param>
+    public DeliveryApiDocumentOutputCacheEvictionHandler(
+        IOutputCacheStore outputCacheStore,
+        IRelationService relationService,
+        IIdKeyMap idKeyMap,
+        IEnumerable<IDeliveryApiOutputCacheEvictionProvider> evictionProviders,
+        ILogger<DeliveryApiDocumentOutputCacheEvictionHandler> logger)
+        : base(outputCacheStore, relationService, idKeyMap)
+    {
+        _evictionProviders = evictionProviders;
+        _logger = logger;
+    }
+
+    /// <inheritdoc />
+    public async Task HandleAsync(ContentCacheRefresherNotification notification, CancellationToken cancellationToken)
+    {
+        if (notification.MessageType != MessageType.RefreshByPayload
+            || notification.MessageObject is not ContentCacheRefresher.JsonPayload[] payloads)
+        {
+            return;
+        }
+
+        var changedEntityIds = new List<int>();
+
+        foreach (ContentCacheRefresher.JsonPayload payload in payloads)
+        {
+            if (payload.Blueprint)
+            {
+                continue;
+            }
+
+            await EvictForPayloadAsync(payload, cancellationToken);
+            changedEntityIds.Add(payload.Id);
+        }
+
+        // Evict content that references the changed content via picker properties.
+        await EvictRelatedContentAsync(
+            changedEntityIds,
+            Constants.Conventions.RelationTypes.RelatedDocumentAlias,
+            Constants.DeliveryApi.OutputCache.ContentTagPrefix,
+            _logger,
+            cancellationToken);
+    }
+
+    private async Task EvictForPayloadAsync(ContentCacheRefresher.JsonPayload payload, CancellationToken cancellationToken)
+    {
+        if (payload.ChangeTypes.HasFlag(TreeChangeTypes.RefreshAll))
+        {
+            // Evict all Delivery API responses — media responses may reference content via picker properties.
+            _logger.LogDebug("Content refresh all — evicting all Delivery API output cache entries.");
+            await OutputCacheStore.EvictByTagAsync(Constants.DeliveryApi.OutputCache.AllTag, cancellationToken);
+            return;
+        }
+
+        if (payload.Key.HasValue is false)
+        {
+            return;
+        }
+
+        Guid contentKey = payload.Key.Value;
+
+        if (_logger.IsEnabled(LogLevel.Debug))
+        {
+            _logger.LogDebug("Evicting Delivery API output cache for content {ContentKey}.", contentKey);
+        }
+
+        await OutputCacheStore.EvictByTagAsync(Constants.DeliveryApi.OutputCache.ContentTagPrefix + contentKey, cancellationToken);
+
+        if (payload.ChangeTypes.HasFlag(TreeChangeTypes.RefreshBranch))
+        {
+            if (_logger.IsEnabled(LogLevel.Debug))
+            {
+                _logger.LogDebug("Evicting Delivery API output cache for descendants of {ContentKey}.", contentKey);
+            }
+
+            await OutputCacheStore.EvictByTagAsync(Constants.DeliveryApi.OutputCache.AncestorTagPrefix + contentKey, cancellationToken);
+        }
+
+        await InvokeCustomEvictionProvidersAsync(payload, contentKey, cancellationToken);
+    }
+
+    private async Task InvokeCustomEvictionProvidersAsync(ContentCacheRefresher.JsonPayload payload, Guid contentKey, CancellationToken cancellationToken)
+    {
+        var context = new OutputCacheContentChangedContext(
+            payload.Id,
+            contentKey,
+            payload.PublishedCultures ?? [],
+            payload.UnpublishedCultures ?? []);
+
+        foreach (IDeliveryApiOutputCacheEvictionProvider provider in _evictionProviders)
+        {
+            IEnumerable<string> additionalTags = await provider.GetAdditionalEvictionTagsAsync(context, cancellationToken);
+            foreach (var tag in additionalTags)
+            {
+                if (_logger.IsEnabled(LogLevel.Debug))
+                {
+                    _logger.LogDebug("Evicting Delivery API output cache tag {Tag} via custom provider.", tag);
+                }
+
+                await OutputCacheStore.EvictByTagAsync(tag, cancellationToken);
+            }
+        }
+    }
+}
@@ -0,0 +1,80 @@
+using Microsoft.AspNetCore.OutputCaching;
+using Microsoft.Extensions.Logging;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.Events;
+using Umbraco.Cms.Core.Notifications;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.Changes;
+using Umbraco.Cms.Core.Sync;
+using Umbraco.Cms.Web.Common.Caching;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+/// <summary>
+///     Handles <see cref="MediaCacheRefresherNotification"/> to evict Delivery API output cache entries
+///     when media is created, updated, or deleted. Also evicts content responses that reference
+///     the changed media via picker properties (umbMedia relations).
+/// </summary>
+internal sealed class DeliveryApiMediaOutputCacheEvictionHandler
+    : RelationOutputCacheEvictionHandlerBase, INotificationAsyncHandler<MediaCacheRefresherNotification>
+{
+    private readonly ILogger<DeliveryApiMediaOutputCacheEvictionHandler> _logger;
+
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="DeliveryApiMediaOutputCacheEvictionHandler"/> class.
+    /// </summary>
+    /// <param name="outputCacheStore">The output cache store for evicting cached responses.</param>
+    /// <param name="relationService">The relation service for querying entity references.</param>
+    /// <param name="idKeyMap">The ID/key mapping service for converting between integer IDs and GUIDs.</param>
+    /// <param name="logger">The logger.</param>
+    public DeliveryApiMediaOutputCacheEvictionHandler(
+        IOutputCacheStore outputCacheStore,
+        IRelationService relationService,
+        IIdKeyMap idKeyMap,
+        ILogger<DeliveryApiMediaOutputCacheEvictionHandler> logger)
+        : base(outputCacheStore, relationService, idKeyMap)
+        => _logger = logger;
+
+    /// <inheritdoc />
+    public async Task HandleAsync(MediaCacheRefresherNotification notification, CancellationToken cancellationToken)
+    {
+        if (notification.MessageType != MessageType.RefreshByPayload
+            || notification.MessageObject is not MediaCacheRefresher.JsonPayload[] payloads)
+        {
+            return;
+        }
+
+        foreach (MediaCacheRefresher.JsonPayload payload in payloads)
+        {
+            if (payload.ChangeTypes.HasFlag(TreeChangeTypes.RefreshAll))
+            {
+                // Evict all Delivery API responses — content responses may include referenced media,
+                // so evicting only media entries would leave stale media references in content responses.
+                _logger.LogDebug("Media refresh all — evicting all Delivery API output cache entries.");
+                await OutputCacheStore.EvictByTagAsync(Constants.DeliveryApi.OutputCache.AllTag, cancellationToken);
+                return;
+            }
+
+            if (payload.Key.HasValue is false)
+            {
+                continue;
+            }
+
+            if (_logger.IsEnabled(LogLevel.Debug))
+            {
+                _logger.LogDebug("Evicting Delivery API output cache for media {MediaKey}.", payload.Key.Value);
+            }
+
+            await OutputCacheStore.EvictByTagAsync(Constants.DeliveryApi.OutputCache.MediaTagPrefix + payload.Key.Value, cancellationToken);
+        }
+
+        // Evict content that references the changed media via picker properties.
+        await EvictRelatedContentAsync(
+            payloads.Select(p => p.Id),
+            Constants.Conventions.RelationTypes.RelatedMediaAlias,
+            Constants.DeliveryApi.OutputCache.ContentTagPrefix,
+            _logger,
+            cancellationToken);
+    }
+}
@@ -0,0 +1,54 @@
+using Microsoft.AspNetCore.OutputCaching;
+using Microsoft.Extensions.Logging;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.Events;
+using Umbraco.Cms.Core.Notifications;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Sync;
+using Umbraco.Cms.Web.Common.Caching;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+/// <summary>
+///     Handles <see cref="MemberCacheRefresherNotification"/> to evict Delivery API output cache entries
+///     for content that references the changed member via picker properties (umbMember relations).
+/// </summary>
+internal sealed class DeliveryApiMemberOutputCacheEvictionHandler
+    : RelationOutputCacheEvictionHandlerBase, INotificationAsyncHandler<MemberCacheRefresherNotification>
+{
+    private readonly ILogger<DeliveryApiMemberOutputCacheEvictionHandler> _logger;
+
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="DeliveryApiMemberOutputCacheEvictionHandler"/> class.
+    /// </summary>
+    /// <param name="outputCacheStore">The output cache store for evicting cached responses.</param>
+    /// <param name="relationService">The relation service for querying entity references.</param>
+    /// <param name="idKeyMap">The ID/key mapping service for converting between integer IDs and GUIDs.</param>
+    /// <param name="logger">The logger.</param>
+    public DeliveryApiMemberOutputCacheEvictionHandler(
+        IOutputCacheStore outputCacheStore,
+        IRelationService relationService,
+        IIdKeyMap idKeyMap,
+        ILogger<DeliveryApiMemberOutputCacheEvictionHandler> logger)
+        : base(outputCacheStore, relationService, idKeyMap)
+        => _logger = logger;
+
+    /// <inheritdoc />
+    public async Task HandleAsync(MemberCacheRefresherNotification notification, CancellationToken cancellationToken)
+    {
+        if (notification.MessageType != MessageType.RefreshByPayload
+            || notification.MessageObject is not MemberCacheRefresher.JsonPayload[] payloads)
+        {
+            return;
+        }
+
+        // Evict content that references the changed members via picker properties.
+        await EvictRelatedContentAsync(
+            payloads.Select(p => p.Id),
+            Constants.Conventions.RelationTypes.RelatedMemberAlias,
+            Constants.DeliveryApi.OutputCache.ContentTagPrefix,
+            _logger,
+            cancellationToken);
+    }
+}
@@ -0,0 +1,47 @@
+using Microsoft.AspNetCore.OutputCaching;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Primitives;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Services.Navigation;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+/// <summary>
+///     Output cache policy for Delivery API content endpoints.
+/// </summary>
+internal sealed class DeliveryApiOutputCacheContentPolicy : DeliveryApiOutputCachePolicyBase
+{
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="DeliveryApiOutputCacheContentPolicy"/> class.
+    /// </summary>
+    /// <param name="defaultDuration">The default cache duration from configuration.</param>
+    /// <param name="defaultVaryByHeaders">The default vary-by headers for content requests.</param>
+    public DeliveryApiOutputCacheContentPolicy(TimeSpan defaultDuration, StringValues defaultVaryByHeaders)
+        : base(defaultDuration, defaultVaryByHeaders)
+    {
+    }
+
+    /// <inheritdoc />
+    protected override string ResolvedItemsKey => DeliveryApiOutputCacheKeys.ResolvedContentItemsKey;
+
+    /// <inheritdoc />
+    protected override string ItemTagPrefix => Constants.DeliveryApi.OutputCache.ContentTagPrefix;
+
+    /// <inheritdoc />
+    protected override string AllItemsTag => Constants.DeliveryApi.OutputCache.AllContentTag;
+
+    /// <inheritdoc />
+    protected override void AddItemTags(OutputCacheContext context, IPublishedContent item, IServiceProvider services)
+    {
+        // Tag with ancestor keys for branch eviction.
+        IDocumentNavigationQueryService navigationService = services.GetRequiredService<IDocumentNavigationQueryService>();
+        if (navigationService.TryGetAncestorsKeys(item.Key, out IEnumerable<Guid> ancestorKeys))
+        {
+            foreach (Guid ancestorKey in ancestorKeys)
+            {
+                context.Tags.Add(Constants.DeliveryApi.OutputCache.AncestorTagPrefix + ancestorKey);
+            }
+        }
+    }
+}
@@ -0,0 +1,18 @@
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+/// <summary>
+///     Keys used to pass resolved content and media items from controllers to the output cache policy
+///     via <see cref="Microsoft.AspNetCore.Http.HttpContext.Items"/>.
+/// </summary>
+internal static class DeliveryApiOutputCacheKeys
+{
+    /// <summary>
+    ///     Key for storing resolved content items in <see cref="Microsoft.AspNetCore.Http.HttpContext.Items"/>.
+    /// </summary>
+    public const string ResolvedContentItemsKey = "Umbraco.DeliveryApi.OutputCache.ResolvedContentItems";
+
+    /// <summary>
+    ///     Key for storing resolved media items in <see cref="Microsoft.AspNetCore.Http.HttpContext.Items"/>.
+    /// </summary>
+    public const string ResolvedMediaItemsKey = "Umbraco.DeliveryApi.OutputCache.ResolvedMediaItems";
+}
@@ -0,0 +1,45 @@
+using Microsoft.AspNetCore.OutputCaching;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Cache;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+/// <summary>
+///     Default implementation of <see cref="IDeliveryApiOutputCacheManager"/> that delegates
+///     to the ASP.NET Core <see cref="IOutputCacheStore"/>.
+/// </summary>
+internal sealed class DeliveryApiOutputCacheManager : IDeliveryApiOutputCacheManager
+{
+    private readonly IOutputCacheStore _outputCacheStore;
+
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="DeliveryApiOutputCacheManager"/> class.
+    /// </summary>
+    /// <param name="outputCacheStore">The ASP.NET Core output cache store.</param>
+    public DeliveryApiOutputCacheManager(IOutputCacheStore outputCacheStore)
+        => _outputCacheStore = outputCacheStore;
+
+    /// <inheritdoc />
+    public async Task EvictContentAsync(Guid contentKey, CancellationToken cancellationToken = default)
+        => await _outputCacheStore.EvictByTagAsync(Constants.DeliveryApi.OutputCache.ContentTagPrefix + contentKey, cancellationToken);
+
+    /// <inheritdoc />
+    public async Task EvictMediaAsync(Guid mediaKey, CancellationToken cancellationToken = default)
+        => await _outputCacheStore.EvictByTagAsync(Constants.DeliveryApi.OutputCache.MediaTagPrefix + mediaKey, cancellationToken);
+
+    /// <inheritdoc />
+    public async Task EvictByTagAsync(string tag, CancellationToken cancellationToken = default)
+        => await _outputCacheStore.EvictByTagAsync(tag, cancellationToken);
+
+    /// <inheritdoc />
+    public async Task EvictAllContentAsync(CancellationToken cancellationToken = default)
+        => await _outputCacheStore.EvictByTagAsync(Constants.DeliveryApi.OutputCache.AllContentTag, cancellationToken);
+
+    /// <inheritdoc />
+    public async Task EvictAllMediaAsync(CancellationToken cancellationToken = default)
+        => await _outputCacheStore.EvictByTagAsync(Constants.DeliveryApi.OutputCache.AllMediaTag, cancellationToken);
+
+    /// <inheritdoc />
+    public async Task EvictAllAsync(CancellationToken cancellationToken = default)
+        => await _outputCacheStore.EvictByTagAsync(Constants.DeliveryApi.OutputCache.AllTag, cancellationToken);
+}
@@ -0,0 +1,29 @@
+using Microsoft.Extensions.Primitives;
+using Umbraco.Cms.Core;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+/// <summary>
+///     Output cache policy for Delivery API media endpoints.
+/// </summary>
+internal sealed class DeliveryApiOutputCacheMediaPolicy : DeliveryApiOutputCachePolicyBase
+{
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="DeliveryApiOutputCacheMediaPolicy"/> class.
+    /// </summary>
+    /// <param name="defaultDuration">The default cache duration from configuration.</param>
+    /// <param name="defaultVaryByHeaders">The default vary-by headers for media requests.</param>
+    public DeliveryApiOutputCacheMediaPolicy(TimeSpan defaultDuration, StringValues defaultVaryByHeaders)
+        : base(defaultDuration, defaultVaryByHeaders)
+    {
+    }
+
+    /// <inheritdoc />
+    protected override string ResolvedItemsKey => DeliveryApiOutputCacheKeys.ResolvedMediaItemsKey;
+
+    /// <inheritdoc />
+    protected override string ItemTagPrefix => Constants.DeliveryApi.OutputCache.MediaTagPrefix;
+
+    /// <inheritdoc />
+    protected override string AllItemsTag => Constants.DeliveryApi.OutputCache.AllMediaTag;
+}
@@ -1,43 +0,0 @@
-using Microsoft.AspNetCore.OutputCaching;
-using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Primitives;
-using Umbraco.Cms.Core.DeliveryApi;
-
-namespace Umbraco.Cms.Api.Delivery.Caching;
-
-internal sealed class DeliveryApiOutputCachePolicy : IOutputCachePolicy
-{
-    private readonly TimeSpan _duration;
-    private readonly StringValues _varyByHeaderNames;
-
-    public DeliveryApiOutputCachePolicy(TimeSpan duration, StringValues varyByHeaderNames)
-    {
-        _duration = duration;
-        _varyByHeaderNames = varyByHeaderNames;
-    }
-
-    ValueTask IOutputCachePolicy.CacheRequestAsync(OutputCacheContext context, CancellationToken cancellationToken)
-    {
-        IRequestPreviewService requestPreviewService = context
-            .HttpContext
-            .RequestServices
-            .GetRequiredService<IRequestPreviewService>();
-
-        IApiAccessService apiAccessService = context
-            .HttpContext
-            .RequestServices
-            .GetRequiredService<IApiAccessService>();
-
-        context.EnableOutputCaching = requestPreviewService.IsPreview() is false && apiAccessService.HasPublicAccess();
-        context.ResponseExpirationTimeSpan = _duration;
-        context.CacheVaryByRules.HeaderNames = _varyByHeaderNames;
-
-        return ValueTask.CompletedTask;
-    }
-
-    ValueTask IOutputCachePolicy.ServeFromCacheAsync(OutputCacheContext context, CancellationToken cancellationToken)
-        => ValueTask.CompletedTask;
-
-    ValueTask IOutputCachePolicy.ServeResponseAsync(OutputCacheContext context, CancellationToken cancellationToken)
-        => ValueTask.CompletedTask;
-}
@@ -0,0 +1,154 @@
+using Microsoft.AspNetCore.OutputCaching;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Primitives;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.Models.PublishedContent;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+/// <summary>
+///     Base output cache policy for Delivery API endpoints. Handles request filtering, vary-by rules,
+///     and tagging. Subclasses specify the resolved-items key, tag prefix, and "all" tag that
+///     distinguish content from media.
+/// </summary>
+internal abstract class DeliveryApiOutputCachePolicyBase : IOutputCachePolicy
+{
+    private readonly TimeSpan _defaultDuration;
+    private readonly StringValues _defaultVaryByHeaders;
+
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="DeliveryApiOutputCachePolicyBase"/> class.
+    /// </summary>
+    /// <param name="defaultDuration">The default cache duration from configuration.</param>
+    /// <param name="defaultVaryByHeaders">The default vary-by headers for this endpoint type.</param>
+    protected DeliveryApiOutputCachePolicyBase(TimeSpan defaultDuration, StringValues defaultVaryByHeaders)
+    {
+        _defaultDuration = defaultDuration;
+        _defaultVaryByHeaders = defaultVaryByHeaders;
+    }
+
+    /// <summary>
+    ///     Gets the <see cref="Microsoft.AspNetCore.Http.HttpContext.Items"/> key used to retrieve
+    ///     resolved <see cref="IPublishedContent"/> items stashed by the controller.
+    /// </summary>
+    protected abstract string ResolvedItemsKey { get; }
+
+    /// <summary>
+    ///     Gets the tag prefix for individual item eviction (e.g. <c>umb-dapi-content-</c>).
+    /// </summary>
+    protected abstract string ItemTagPrefix { get; }
+
+    /// <summary>
+    ///     Gets the "all items" tag for bulk eviction (e.g. <c>umb-dapi-content-all</c>).
+    /// </summary>
+    protected abstract string AllItemsTag { get; }
+
+    /// <summary>
+    ///     Adds additional per-item tags to the output cache context. Called once per resolved item
+    ///     during <c>ServeResponseAsync</c>. The default implementation does nothing.
+    /// </summary>
+    /// <param name="context">The output cache context.</param>
+    /// <param name="item">The published content or media item.</param>
+    /// <param name="services">The request service provider.</param>
+    protected virtual void AddItemTags(OutputCacheContext context, IPublishedContent item, IServiceProvider services)
+    {
+    }
+
+    /// <inheritdoc />
+    ValueTask IOutputCachePolicy.CacheRequestAsync(OutputCacheContext context, CancellationToken cancellationToken)
+    {
+        IServiceProvider services = context.HttpContext.RequestServices;
+        ILogger logger = services.GetRequiredService<ILoggerFactory>().CreateLogger(GetType());
+
+        IDeliveryApiOutputCacheRequestFilter requestFilter = services.GetRequiredService<IDeliveryApiOutputCacheRequestFilter>();
+        if (requestFilter.IsCacheable(context.HttpContext) is false)
+        {
+            context.EnableOutputCaching = false;
+            logger.LogDebug("Request filter returned not cacheable — skipping output cache.");
+            return ValueTask.CompletedTask;
+        }
+
+        context.EnableOutputCaching = true;
+        context.AllowCacheLookup = true;
+        context.AllowCacheStorage = true;
+        context.AllowLocking = true;
+        context.ResponseExpirationTimeSpan = _defaultDuration;
+
+        // Set default vary-by headers.
+        context.CacheVaryByRules.HeaderNames = _defaultVaryByHeaders;
+
+        // Invoke custom vary-by providers (additive, runs after defaults).
+        IEnumerable<IDeliveryApiOutputCacheVaryByProvider> varyByProviders = services.GetServices<IDeliveryApiOutputCacheVaryByProvider>();
+        foreach (IDeliveryApiOutputCacheVaryByProvider varyByProvider in varyByProviders)
+        {
+            varyByProvider.ConfigureVaryBy(context.HttpContext, context.CacheVaryByRules);
+        }
+
+        // Add base tags for bulk eviction.
+        context.Tags.Add(AllItemsTag);
+        context.Tags.Add(Constants.DeliveryApi.OutputCache.AllTag);
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <inheritdoc />
+    ValueTask IOutputCachePolicy.ServeFromCacheAsync(OutputCacheContext context, CancellationToken cancellationToken)
+        => ValueTask.CompletedTask;
+
+    /// <inheritdoc />
+    ValueTask IOutputCachePolicy.ServeResponseAsync(OutputCacheContext context, CancellationToken cancellationToken)
+    {
+        if (context.HttpContext.Items[ResolvedItemsKey]
+            is not IPublishedContent[] items || items.Length == 0)
+        {
+            return ValueTask.CompletedTask;
+        }
+
+        IServiceProvider services = context.HttpContext.RequestServices;
+        ILogger logger = services.GetRequiredService<ILoggerFactory>().CreateLogger(GetType());
+        IDeliveryApiOutputCacheRequestFilter requestFilter = services.GetRequiredService<IDeliveryApiOutputCacheRequestFilter>();
+        IEnumerable<IDeliveryApiOutputCacheTagProvider> tagProviders = services.GetServices<IDeliveryApiOutputCacheTagProvider>();
+
+        foreach (IPublishedContent item in items)
+        {
+            // Check content-aware cacheability.
+            if (requestFilter.IsCacheable(context.HttpContext, item) is false)
+            {
+                context.AllowCacheStorage = false;
+                if (logger.IsEnabled(LogLevel.Debug))
+                {
+                    logger.LogDebug("Request filter returned not cacheable for item {ItemKey} — disabling cache storage.", item.Key);
+                }
+
+                return ValueTask.CompletedTask;
+            }
+
+            // Tag with specific item key for targeted eviction.
+            context.Tags.Add(ItemTagPrefix + item.Key);
+
+            // Allow subclasses to add additional per-item tags (e.g. ancestor tags for content).
+            AddItemTags(context, item, services);
+
+            // Invoke custom tag providers.
+            foreach (IDeliveryApiOutputCacheTagProvider tagProvider in tagProviders)
+            {
+                foreach (var tag in tagProvider.GetTags(item))
+                {
+                    context.Tags.Add(tag);
+                }
+            }
+        }
+
+        if (logger.IsEnabled(LogLevel.Debug))
+        {
+            logger.LogDebug(
+                "Caching Delivery API response with {TagCount} tags, duration {Duration}",
+                context.Tags.Count,
+                context.ResponseExpirationTimeSpan);
+        }
+
+        return ValueTask.CompletedTask;
+    }
+}
@@ -0,0 +1,38 @@
+using Microsoft.AspNetCore.Http;
+using Umbraco.Cms.Core.Models.PublishedContent;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+/// <summary>
+///     Determines whether a Delivery API request is eligible for output caching.
+/// </summary>
+/// <remarks>
+///     <para>
+///         This interface provides two levels of cacheability checks:
+///     </para>
+///     <list type="bullet">
+///         <item><see cref="IsCacheable(HttpContext)"/> — called before the controller runs, for
+///         request-level decisions (e.g. preview mode, access control).</item>
+///         <item><see cref="IsCacheable(HttpContext, IPublishedContent)"/> — called after the controller
+///         resolves content, for content-aware decisions (e.g. exclude specific content types).</item>
+///     </list>
+/// </remarks>
+public interface IDeliveryApiOutputCacheRequestFilter
+{
+    /// <summary>
+    ///     Gets a value indicating whether the request is eligible for output caching.
+    ///     Called before the controller runs.
+    /// </summary>
+    /// <param name="context">The HTTP context for the current request.</param>
+    /// <returns><c>true</c> if the response may be cached; <c>false</c> to skip caching.</returns>
+    bool IsCacheable(HttpContext context);
+
+    /// <summary>
+    ///     Gets a value indicating whether the response for the given content or media item is eligible
+    ///     for output caching. Called after the controller resolves content.
+    /// </summary>
+    /// <param name="context">The HTTP context for the current request.</param>
+    /// <param name="content">The resolved published content or media item.</param>
+    /// <returns><c>true</c> if the response may be cached; <c>false</c> to skip caching.</returns>
+    bool IsCacheable(HttpContext context, IPublishedContent content);
+}
@@ -0,0 +1,28 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.OutputCaching;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+/// <summary>
+///     Configures additional vary-by rules for Delivery API output caching.
+/// </summary>
+/// <remarks>
+///     <para>
+///         Multiple implementations can be registered; the output cache policy invokes all of them
+///         to configure vary-by rules at cache-write time, after the default vary-by headers have been set.
+///     </para>
+///     <para>
+///         Providers have direct access to <see cref="CacheVaryByRules"/> and can configure any aspect
+///         including <see cref="CacheVaryByRules.QueryKeys"/>, <see cref="CacheVaryByRules.HeaderNames"/>,
+///         and <see cref="CacheVaryByRules.VaryByValues"/>.
+///     </para>
+/// </remarks>
+public interface IDeliveryApiOutputCacheVaryByProvider
+{
+    /// <summary>
+    ///     Configures vary-by rules for the given request.
+    /// </summary>
+    /// <param name="context">The HTTP context for the current request.</param>
+    /// <param name="rules">The vary-by rules to configure.</param>
+    void ConfigureVaryBy(HttpContext context, CacheVaryByRules rules);
+}
@@ -1,14 +0,0 @@
-using Microsoft.AspNetCore.Builder;
-using Umbraco.Cms.Web.Common.ApplicationBuilder;
-
-namespace Umbraco.Cms.Api.Delivery.Caching;
-
-internal sealed class OutputCachePipelineFilter : UmbracoPipelineFilter
-{
-    public OutputCachePipelineFilter(string name)
-        : base(name)
-        => PostPipeline = PostPipelineAction;
-
-    private void PostPipelineAction(IApplicationBuilder applicationBuilder)
-        => applicationBuilder.UseOutputCache();
-}
@@ -41,17 +41,20 @@ public class ByIdContentApiController : ContentApiItemControllerBase
        {
            return NotFound();
        }
+
        IActionResult? deniedAccessResult = await HandleMemberAccessAsync(contentItem, _requestMemberAccessService).ConfigureAwait(false);
        if (deniedAccessResult is not null)
        {
            return deniedAccessResult;
        }
+
        IApiContentResponse? apiContentResponse = ApiContentResponseBuilder.Build(contentItem);
        if (apiContentResponse is null)
        {
            return NotFound();
        }

+        SetOutputCacheContent(contentItem);
        return Ok(apiContentResponse);
    }
 }
@@ -48,6 +48,7 @@ public class ByIdsContentApiController : ContentApiItemControllerBase
            .WhereNotNull()
            .ToArray();

+        SetOutputCacheContent(contentItems);
        return Ok(apiContentItems);
    }
 }
@@ -64,6 +64,7 @@ public class ByRouteContentApiController : ContentApiItemControllerBase
                return deniedAccessResult;
            }

+            SetOutputCacheContent(contentItem);
            return Ok(ApiContentResponseBuilder.Build(contentItem));
        }

@@ -2,10 +2,12 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.OutputCaching;
 using Umbraco.Cms.Api.Common.Builders;
+using Umbraco.Cms.Api.Delivery.Caching;
 using Umbraco.Cms.Api.Delivery.Filters;
 using Umbraco.Cms.Api.Delivery.Routing;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.Services.OperationStatus;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
@@ -50,6 +52,13 @@ public abstract class ContentApiControllerBase : DeliveryApiControllerBase
                .Build()),
        };

+    /// <summary>
+    ///     Stores the resolved content items in the HTTP context for use by the output cache policy.
+    /// </summary>
+    /// <param name="items">The resolved published content items.</param>
+    protected void SetOutputCacheContent(params IPublishedContent[] items)
+        => HttpContext.Items[DeliveryApiOutputCacheKeys.ResolvedContentItemsKey] = items;
+
    /// <summary>
    ///     Creates a 403 Forbidden result.
    /// </summary>
@@ -62,9 +62,11 @@ public class QueryContentApiController : ContentApiControllerBase
        }

        PagedModel<Guid> pagedResult = queryAttempt.Result;
-        IEnumerable<IPublishedContent> contentItems = ApiPublishedContentCache.GetByIds(pagedResult.Items);
+        IPublishedContent[] contentItems = ApiPublishedContentCache.GetByIds(pagedResult.Items).ToArray();
        IApiContentResponse[] apiContentItems = contentItems.Select(ApiContentResponseBuilder.Build).WhereNotNull().ToArray();

+        SetOutputCacheContent(contentItems);
+
        var model = new PagedViewModel<IApiContentResponse>
        {
            Total = pagedResult.Total,
@@ -39,6 +39,7 @@ public class ByIdMediaApiController : MediaApiControllerBase
            return NotFound();
        }

+        SetOutputCacheMedia(media);
        return Ok(BuildApiMediaWithCrops(media));
    }
 }
@@ -39,6 +39,7 @@ public class ByIdsMediaApiController : MediaApiControllerBase
            .Select(BuildApiMediaWithCrops)
            .ToArray();

+        SetOutputCacheMedia(mediaItems);
        return Ok(apiMediaItems);
    }
 }
@@ -43,6 +43,7 @@ public class ByPathMediaApiController : MediaApiControllerBase
            return NotFound();
        }

+        SetOutputCacheMedia(media);
        return Ok(BuildApiMediaWithCrops(media));
    }
 }
@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.OutputCaching;
 using Umbraco.Cms.Api.Common.Builders;
+using Umbraco.Cms.Api.Delivery.Caching;
 using Umbraco.Cms.Api.Delivery.Filters;
 using Umbraco.Cms.Api.Delivery.Routing;
 using Umbraco.Cms.Core;
@@ -33,6 +34,13 @@ public abstract class MediaApiControllerBase : DeliveryApiControllerBase
    protected IApiMediaWithCropsResponse BuildApiMediaWithCrops(IPublishedContent media)
        => _apiMediaWithCropsResponseBuilder.Build(media);

+    /// <summary>
+    ///     Stores the resolved media items in the HTTP context for use by the output cache policy.
+    /// </summary>
+    /// <param name="items">The resolved published media items.</param>
+    protected void SetOutputCacheMedia(params IPublishedContent[] items)
+        => HttpContext.Items[DeliveryApiOutputCacheKeys.ResolvedMediaItemsKey] = items;
+
    protected IActionResult ApiMediaQueryOperationStatusResult(ApiMediaQueryOperationStatus status) =>
        status switch
        {
@@ -59,6 +59,8 @@ public class QueryMediaApiController : MediaApiControllerBase
        PagedModel<Guid> pagedResult = queryAttempt.Result;
        IPublishedContent[] mediaItems = pagedResult.Items.Select(PublishedMediaCache.GetById).WhereNotNull().ToArray();

+        SetOutputCacheMedia(mediaItems);
+
        var model = new PagedViewModel<IApiMediaWithCropsResponse>
        {
            Total = pagedResult.Total,
@@ -5,6 +5,7 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
 using Microsoft.Extensions.Primitives;
 using Umbraco.Cms.Api.Common.DependencyInjection;
 using Umbraco.Cms.Api.Delivery.Accessors;
@@ -18,6 +19,7 @@ using Umbraco.Cms.Api.Delivery.Security;
 using Umbraco.Cms.Api.Delivery.Services;
 using Umbraco.Cms.Api.Delivery.Services.QueryBuilders;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.DependencyInjection;
@@ -105,6 +107,10 @@ public static class UmbracoBuilderExtensions
        builder.AddNotificationAsyncHandler<MemberDeletedNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
        builder.AddNotificationAsyncHandler<AssignedMemberRolesNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
        builder.AddNotificationAsyncHandler<RemovedMemberRolesNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
+        builder.AddNotificationAsyncHandler<ExternalMemberSavedNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
+        builder.AddNotificationAsyncHandler<ExternalMemberDeletedNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
+        builder.AddNotificationAsyncHandler<AssignedExternalMemberRolesNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
+        builder.AddNotificationAsyncHandler<RemovedExternalMemberRolesNotification, RevokeMemberAuthenticationTokensNotificationHandler>();

        // FIXME: remove this when Delivery API V1 is removed
        builder.Services.AddSingleton<MatcherPolicy, DeliveryApiItemsEndpointsMatcherPolicy>();
@@ -132,7 +138,7 @@ public static class UmbracoBuilderExtensions
            {
                options.AddPolicy(
                    Constants.DeliveryApi.OutputCache.ContentCachePolicy,
-                    new DeliveryApiOutputCachePolicy(
+                    new DeliveryApiOutputCacheContentPolicy(
                        outputCacheSettings.ContentDuration,
                        new StringValues([Constants.DeliveryApi.HeaderNames.AcceptLanguage, Constants.DeliveryApi.HeaderNames.AcceptSegment, Constants.DeliveryApi.HeaderNames.StartItem])));
            }
@@ -141,13 +147,28 @@ public static class UmbracoBuilderExtensions
            {
                options.AddPolicy(
                    Constants.DeliveryApi.OutputCache.MediaCachePolicy,
-                    new DeliveryApiOutputCachePolicy(
+                    new DeliveryApiOutputCacheMediaPolicy(
                        outputCacheSettings.MediaDuration,
                        Constants.DeliveryApi.HeaderNames.StartItem));
            }
        });

-        builder.Services.Configure<UmbracoPipelineOptions>(options => options.AddFilter(new OutputCachePipelineFilter("UmbracoDeliveryApiOutputCache")));
+        // Register eviction handlers.
+        builder.AddNotificationAsyncHandler<ContentCacheRefresherNotification, DeliveryApiDocumentOutputCacheEvictionHandler>();
+        builder.AddNotificationAsyncHandler<MediaCacheRefresherNotification, DeliveryApiMediaOutputCacheEvictionHandler>();
+        builder.AddNotificationAsyncHandler<MemberCacheRefresherNotification, DeliveryApiMemberOutputCacheEvictionHandler>();
+
+        // Register extension point default implementations.
+        builder.Services.AddSingleton<IDeliveryApiOutputCacheTagProvider, DeliveryApiContentTypeOutputCacheTagProvider>();
+        builder.Services.AddUnique<IDeliveryApiOutputCacheRequestFilter, DefaultDeliveryApiOutputCacheRequestFilter>();
+        builder.Services.AddUnique<IDeliveryApiOutputCacheManager, DeliveryApiOutputCacheManager>();
+
+        // Signal that Umbraco has enabled output caching so the application builder registers
+        // the output cache middleware. Gated via a marker rather than IOutputCacheStore so that
+        // applications calling services.AddOutputCache(...) for their own purposes are not
+        // affected by Umbraco's automatic middleware registration.
+        builder.Services.TryAddSingleton<IUmbracoManagedOutputCacheMarker, UmbracoManagedOutputCacheMarker>();
+
        return builder;
    }
 }
@@ -5,6 +5,7 @@ using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.Events;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Notifications;
+using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Delivery.Handlers;
@@ -13,7 +14,11 @@ internal sealed class RevokeMemberAuthenticationTokensNotificationHandler
    : INotificationAsyncHandler<MemberSavedNotification>,
        INotificationAsyncHandler<MemberDeletedNotification>,
        INotificationAsyncHandler<AssignedMemberRolesNotification>,
-        INotificationAsyncHandler<RemovedMemberRolesNotification>
+        INotificationAsyncHandler<RemovedMemberRolesNotification>,
+        INotificationAsyncHandler<ExternalMemberSavedNotification>,
+        INotificationAsyncHandler<ExternalMemberDeletedNotification>,
+        INotificationAsyncHandler<AssignedExternalMemberRolesNotification>,
+        INotificationAsyncHandler<RemovedExternalMemberRolesNotification>
 {
    private readonly IMemberService _memberService;
    private readonly IOpenIddictTokenManager _tokenManager;
@@ -80,6 +85,38 @@ internal sealed class RevokeMemberAuthenticationTokensNotificationHandler
        }
    }

+    public async Task HandleAsync(ExternalMemberSavedNotification notification, CancellationToken cancellationToken)
+    {
+        if (_enabled is false)
+        {
+            return;
+        }
+
+        foreach (ExternalMemberIdentity member in notification.SavedEntities.Where(m => m.IsLockedOut || m.IsApproved is false))
+        {
+            await RevokeTokensByKeyAsync(member.Key);
+        }
+    }
+
+    public async Task HandleAsync(ExternalMemberDeletedNotification notification, CancellationToken cancellationToken)
+    {
+        if (_enabled is false)
+        {
+            return;
+        }
+
+        foreach (ExternalMemberIdentity member in notification.DeletedEntities)
+        {
+            await RevokeTokensByKeyAsync(member.Key);
+        }
+    }
+
+    public async Task HandleAsync(AssignedExternalMemberRolesNotification notification, CancellationToken cancellationToken)
+        => await ExternalMemberRolesChangedAsync(notification);
+
+    public async Task HandleAsync(RemovedExternalMemberRolesNotification notification, CancellationToken cancellationToken)
+        => await ExternalMemberRolesChangedAsync(notification);
+
    private async Task MemberRolesChangedAsync(MemberRolesNotification notification)
    {
        if (_enabled is false)
@@ -99,4 +136,32 @@ internal sealed class RevokeMemberAuthenticationTokensNotificationHandler
            await RevokeTokensAsync(member);
        }
    }
+
+    private async Task ExternalMemberRolesChangedAsync(ExternalMemberRolesNotification notification)
+    {
+        if (_enabled is false)
+        {
+            return;
+        }
+
+        foreach (Guid memberKey in notification.MemberKeys)
+        {
+            await RevokeTokensByKeyAsync(memberKey);
+        }
+    }
+
+    private async Task RevokeTokensByKeyAsync(Guid memberKey)
+    {
+        var tokens = await _tokenManager.FindBySubjectAsync(memberKey.ToString()).ToArrayAsync();
+        if (tokens.Any() is false)
+        {
+            return;
+        }
+
+        _logger.LogInformation("Revoking {count} active tokens for external member with key {key}", tokens.Length, memberKey);
+        foreach (var token in tokens)
+        {
+            await _tokenManager.DeleteAsync(token);
+        }
+    }
 }
@@ -1,12 +1,13 @@
 using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Infrastructure.Examine;

 namespace Umbraco.Cms.Api.Delivery.Indexing.Selectors;

 public sealed class AncestorsSelectorIndexer : IContentIndexHandler
 {
    // NOTE: "id" is a reserved field name
-    internal const string FieldName = "itemId";
+    internal const string FieldName = UmbracoExamineFieldNames.DeliveryApiContentIndex.ItemId;

    public IEnumerable<IndexFieldValue> GetFieldValues(IContent content, string? culture)
        => new[] { new IndexFieldValue { FieldName = FieldName, Values = new object[] { content.Key } } };
@@ -17,7 +17,7 @@ namespace Umbraco.Cms.Api.Delivery.Services;
 /// </summary>
 internal sealed class ApiContentQueryProvider : IApiContentQueryProvider
 {
-    private const string ItemIdFieldName = "itemId";
+    private const string ItemIdFieldName = UmbracoExamineFieldNames.DeliveryApiContentIndex.ItemId;
    private readonly IExamineManager _examineManager;
    private readonly ILogger<ApiContentQueryProvider> _logger;
    private readonly ApiContentQuerySelectorBuilder _selectorBuilder;
@@ -26,7 +26,8 @@ RESTful API for Umbraco backoffice operations. Manages content, media, users, an
 - **Validation**: FluentValidation via base controllers
 - **Serialization**: System.Text.Json with custom converters
 - **Mapping**: Manual presentation factories (no AutoMapper)
- **Patching**: JsonPatch.Net for PATCH operations
+- **Patching**: Custom patch engine for PATCH operations (Umbraco.Cms.Api.Management.Patching)
+  - ⚠️ Legacy JsonPatch.Net support (IJsonPatchService) still available but **obsolete** - scheduled for removal in v19
 - **Real-time**: SignalR hubs (`BackofficeHub`, `ServerEventHub`)
 - **DI**: Microsoft.Extensions.DependencyInjection via `ManagementApiComposer`

@@ -70,7 +71,6 @@ src/Umbraco.Cms.Api.Management/
 - **Umbraco.Cms.Api.Common** - Shared API infrastructure (base controllers, OpenAPI config)
 - **Umbraco.Infrastructure** - Service implementations, data access
 - **Umbraco.PublishedCache.HybridCache** - Published content queries
- **JsonPatch.Net** - JSON Patch (RFC 6902) support
 - **Swashbuckle.AspNetCore** - OpenAPI generation

 ### Design Patterns
@@ -1,4 +1,4 @@
-using Microsoft.Extensions.Options;
+using Microsoft.Extensions.Options;
 using Umbraco.Cms.Api.Management.Security;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Web.Common.Security;
@@ -13,6 +13,11 @@ public class ConfigureBackOfficeSecurityStampValidatorOptions : IConfigureOption
    private readonly SecuritySettings _securitySettings;
    private readonly TimeProvider _timeProvider;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ConfigureBackOfficeSecurityStampValidatorOptions"/> class with the specified security settings and time provider.
+    /// </summary>
+    /// <param name="securitySettings">The <see cref="IOptions{SecuritySettings}"/> used to access security-related configuration options.</param>
+    /// <param name="timeProvider">The <see cref="TimeProvider"/> used for time-based operations.</param>
    public ConfigureBackOfficeSecurityStampValidatorOptions(IOptions<SecuritySettings> securitySettings, TimeProvider timeProvider)
    {
        _timeProvider = timeProvider;
@@ -9,15 +9,30 @@ using Umbraco.Cms.Api.Management.OpenApi;

 namespace Umbraco.Cms.Api.Management.Configuration;

+/// <summary>
+/// Provides configuration for Swagger generation options specific to the Umbraco Management API.
+/// This class is used to customize the Swagger documentation for the API endpoints.
+/// </summary>
 public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
 {
    private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ConfigureUmbracoManagementApiSwaggerGenOptions"/> class.
+    /// </summary>
+    /// <param name="umbracoJsonTypeInfoResolver">An instance of <see cref="IUmbracoJsonTypeInfoResolver"/> used to resolve JSON type information for Umbraco.</param>
    public ConfigureUmbracoManagementApiSwaggerGenOptions(IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
    {
        _umbracoJsonTypeInfoResolver = umbracoJsonTypeInfoResolver;
    }

+    /// <summary>
+    /// Configures the <see cref="SwaggerGenOptions"/> for the Umbraco Management API.
+    /// Sets up the Swagger documentation, including API metadata, security definitions for OAuth2 authentication,
+    /// operation filters for response headers and security requirements, and schema filters for non-nullable properties.
+    /// Also configures polymorphism handling and discriminator properties for OpenAPI schemas.
+    /// </summary>
+    /// <param name="swaggerGenOptions">The <see cref="SwaggerGenOptions"/> instance to configure for the Management API.</param>
    public void Configure(SwaggerGenOptions swaggerGenOptions)
    {
        swaggerGenOptions.SwaggerDoc(
@@ -7,6 +7,9 @@ using Umbraco.Cms.Core.Hosting;

 namespace Umbraco.Cms.Api.Management;

+/// <summary>
+/// Provides endpoints for managing back office user authentication and login operations.
+/// </summary>
 [ApiExplorerSettings(IgnoreApi = true)]
 [Route(LoginPath)]
 public class BackOfficeLoginController : Controller
@@ -15,6 +18,11 @@ public class BackOfficeLoginController : Controller
    private readonly IHostingEnvironment _hostingEnvironment;
    private readonly GlobalSettings _globalSettings;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="BackOfficeLoginController"/> class.
+    /// </summary>
+    /// <param name="globalSettings">A snapshot of the application's global settings options.</param>
+    /// <param name="hostingEnvironment">The current hosting environment for the application.</param>
    public BackOfficeLoginController(
        IOptionsSnapshot<GlobalSettings> globalSettings,
        IHostingEnvironment hostingEnvironment)
@@ -24,8 +32,23 @@ public class BackOfficeLoginController : Controller
    }

    // GET
+    /// <summary>
+    /// Handles the GET request for the back office login page.
+    /// If the user is already authenticated, updates the model accordingly.
+    /// Ensures the return URL is a relative path and sets default values if necessary.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token to cancel the operation.</param>
+    /// <param name="model">The model containing login information and the return URL.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> that renders the login view with the model, or a bad request result if the model state or return URL is invalid.
+    /// </returns>
    public async Task<IActionResult> Index(CancellationToken cancellationToken, BackOfficeLoginModel model)
    {
+        if (ModelState.IsValid is false)
+        {
+            return BadRequest();
+        }
+
        AuthenticateResult cookieAuthResult = await HttpContext.AuthenticateAsync(Constants.Security.BackOfficeAuthenticationType);
        if (cookieAuthResult.Succeeded)
        {
@@ -2,6 +2,9 @@ using Microsoft.AspNetCore.Mvc;

 namespace Umbraco.Cms.Api.Management;

+/// <summary>
+/// Represents a model containing the credentials required for logging into the Umbraco back office.
+/// </summary>
 [BindProperties]
 public class BackOfficeLoginModel
 {
@@ -16,5 +19,8 @@ public class BackOfficeLoginModel
    /// </summary>
    public string? UmbracoUrl { get; set; }

+    /// <summary>
+    /// Indicates whether the user is already logged in to the back office.
+    /// </summary>
    public bool UserIsAlreadyLoggedIn { get; set; }
 }
@@ -14,6 +14,13 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Management.Controllers.Content;

+/// <summary>
+/// Serves as a base controller for managing collections of content items, providing shared functionality for handling content collections and their variants.
+/// </summary>
+/// <typeparam name="TContent">The content entity type.</typeparam>
+/// <typeparam name="TCollectionResponseModel">The response model type for the content collection.</typeparam>
+/// <typeparam name="TValueResponseModelBase">The base type for value response models within the collection.</typeparam>
+/// <typeparam name="TVariantResponseModel">The response model type for content variants.</typeparam>
 public abstract class ContentCollectionControllerBase<TContent, TCollectionResponseModel, TValueResponseModelBase, TVariantResponseModel> : ManagementApiControllerBase
    where TContent : class, IContentBase
    where TCollectionResponseModel : ContentResponseModelBase<TValueResponseModelBase, TVariantResponseModel>
@@ -8,6 +8,9 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Management.Controllers.Content;

+/// <summary>
+/// Serves as the base controller for content management operations in the Umbraco CMS API, providing shared functionality for content-related controllers.
+/// </summary>
 public abstract class ContentControllerBase : ManagementApiControllerBase
 {
    protected IActionResult ContentEditingOperationStatusResult(ContentEditingOperationStatus status)
@@ -53,6 +56,15 @@ public abstract class ContentControllerBase : ManagementApiControllerBase
            ContentEditingOperationStatus.PropertyTypeNotFound => NotFound(problemDetailsBuilder
                .WithTitle("One or more property types could not be found")
                .Build()),
+            ContentEditingOperationStatus.PropertyTypeCultureVarianceMismatch => BadRequest(problemDetailsBuilder
+                .WithTitle("Property type culture variance mismatch")
+                .WithDetail("One or more property values specify a culture for an invariant property, or are missing a culture for a culture-variant property. "
+                    + "This can happen when a property is inherited from a variant composition on an invariant content type, which downgrades it to invariant.")
+                .Build()),
+            ContentEditingOperationStatus.PropertyTypeSegmentVarianceMismatch => BadRequest(problemDetailsBuilder
+                .WithTitle("Property type segment variance mismatch")
+                .WithDetail("One or more property values have a segment that does not match the property type's segment variance.")
+                .Build()),
            ContentEditingOperationStatus.InTrash => BadRequest(problemDetailsBuilder
                .WithTitle("Content is in the recycle bin")
                .WithDetail("Could not perform the operation because the targeted content was in the recycle bin.")
@@ -9,18 +9,33 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.Culture;

+/// <summary>
+/// API controller responsible for retrieving and managing culture information in the system.
+/// </summary>
 [ApiVersion("1.0")]
 public class AllCultureController : CultureControllerBase
 {
    private readonly IUmbracoMapper _umbracoMapper;
    private readonly ICultureService _cultureService;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="AllCultureController"/> class with the specified Umbraco mapper and culture service.
+    /// </summary>
+    /// <param name="umbracoMapper">An instance of <see cref="IUmbracoMapper"/> used for mapping Umbraco objects.</param>
+    /// <param name="cultureService">An instance of <see cref="ICultureService"/> used for managing culture information.</param>
    public AllCultureController(IUmbracoMapper umbracoMapper, ICultureService cultureService)
    {
        _umbracoMapper = umbracoMapper;
        _cultureService = cultureService;
    }

+    /// <summary>
+    /// Retrieves a paginated list of all available cultures, including their English and localized names.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="skip">The number of cultures to skip before starting to collect the result set.</param>
+    /// <param name="take">The maximum number of cultures to return.</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains a <see cref="PagedViewModel{CultureReponseModel}"/> with the paginated cultures.</returns>
    [HttpGet]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<CultureReponseModel>), StatusCodes.Status200OK)]
@@ -1,8 +1,11 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;

 namespace Umbraco.Cms.Api.Management.Controllers.Culture;

+/// <summary>
+/// Serves as the base controller for API endpoints that manage culture-related operations in the Umbraco CMS.
+/// </summary>
 [VersionedApiBackOfficeRoute("culture")]
 [ApiExplorerSettings(GroupName = "Culture")]
 public abstract class CultureControllerBase : ManagementApiControllerBase
@@ -0,0 +1,71 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.ViewModels;
+using Umbraco.Cms.Api.Management.ViewModels.DataType;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+
+namespace Umbraco.Cms.Api.Management.Controllers.DataType;
+
+/// <summary>
+/// Controller for retrieving multiple data type value schemas in a single request.
+/// </summary>
+[ApiVersion("1.0")]
+public class BatchSchemasDataTypeController : DataTypeControllerBase
+{
+    private readonly IPropertyEditorSchemaService _schemaService;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="BatchSchemasDataTypeController"/> class.
+    /// </summary>
+    /// <param name="schemaService">The property editor schema service.</param>
+    public BatchSchemasDataTypeController(IPropertyEditorSchemaService schemaService)
+        => _schemaService = schemaService;
+
+    /// <summary>
+    /// Gets the value schemas for multiple data types.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <param name="ids">The unique identifiers of the data types.</param>
+    /// <returns>The schema information for the requested data types.</returns>
+    /// <remarks>
+    /// Returns schema information for property editors that implement <c>IValueSchemaProvider</c>.
+    /// Each item includes an error field if the schema could not be retrieved (e.g., data type not found or schema not supported).
+    /// </remarks>
+    [HttpGet("schemas/batch")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(FetchResponseModel<DataTypeSchemaItemResponseModel>), StatusCodes.Status200OK)]
+    public async Task<IActionResult> GetSchemas(
+        CancellationToken cancellationToken,
+        [FromQuery(Name = "id")] Guid[] ids)
+    {
+        Guid[] requestedIds = [.. ids.Distinct()];
+
+        if (requestedIds.Length == 0)
+        {
+            return Ok(new FetchResponseModel<DataTypeSchemaItemResponseModel>());
+        }
+
+        var items = new List<DataTypeSchemaItemResponseModel>();
+
+        foreach (Guid id in requestedIds)
+        {
+            Attempt<PropertyValueSchema, PropertyEditorSchemaOperationStatus> attempt = await _schemaService.GetSchemaAsync(id);
+            items.Add(new DataTypeSchemaItemResponseModel
+            {
+                Id = id,
+                ValueTypeName = attempt.Success ? attempt.Result.ValueType?.FullName : null,
+                JsonSchema = attempt.Success ? attempt.Result.JsonSchema : null,
+                Error = attempt.Success ? null : attempt.Status.ToString(),
+            });
+        }
+
+        return Ok(new FetchResponseModel<DataTypeSchemaItemResponseModel>
+        {
+            Total = items.Count,
+            Items = items,
+        });
+    }
+}
@@ -8,18 +8,34 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// Controller for managing data types by their unique key.
+/// </summary>
 [ApiVersion("1.0")]
 public class ByKeyDataTypeController : DataTypeControllerBase
 {
    private readonly IDataTypeService _dataTypeService;
    private readonly IUmbracoMapper _umbracoMapper;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ByKeyDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">Service used for managing and retrieving data types.</param>
+    /// <param name="umbracoMapper">The mapper used to map between Umbraco domain models and API models.</param>
    public ByKeyDataTypeController(IDataTypeService dataTypeService, IUmbracoMapper umbracoMapper)
    {
        _dataTypeService = dataTypeService;
        _umbracoMapper = umbracoMapper;
    }

+    /// <summary>
+    /// Retrieves a data type by its unique identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier (GUID) of the data type to retrieve.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> containing the data type if found; otherwise, a 404 Not Found result.
+    /// </returns>
    [HttpGet("{id:guid}")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(DataTypeResponseModel), StatusCodes.Status200OK)]
@@ -8,13 +8,25 @@ using Umbraco.Cms.Core.Configuration.Models;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// Controller responsible for managing configuration for data types in the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class ConfigurationDataTypeController : DataTypeControllerBase
 {
    private readonly DataTypesSettings _dataTypesSettings;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ConfigurationDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypesSettings">An <see cref="IOptionsSnapshot{T}"/> containing the <see cref="DataTypesSettings"/> configuration options.</param>
    public ConfigurationDataTypeController(IOptionsSnapshot<DataTypesSettings> dataTypesSettings) => _dataTypesSettings = dataTypesSettings.Value;

+    /// <summary>
+    /// Retrieves the configuration settings for data types, including whether data types can be changed and the identifiers for document and media list views.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token that can be used to cancel the operation.</param>
+    /// <returns>An <see cref="IActionResult"/> containing a <see cref="DatatypeConfigurationResponseModel"/> with the data type configuration settings.</returns>
    [HttpGet("configuration")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(DatatypeConfigurationResponseModel), StatusCodes.Status200OK)]
@@ -12,6 +12,9 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// API controller responsible for handling requests to copy data types within the Umbraco CMS management interface.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class CopyDataTypeController : DataTypeControllerBase
@@ -19,12 +22,26 @@ public class CopyDataTypeController : DataTypeControllerBase
    private readonly IDataTypeService _dataTypeService;
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="CopyDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">An instance of <see cref="IDataTypeService"/> used to manage data types.</param>
+    /// <param name="backOfficeSecurityAccessor">An instance of <see cref="IBackOfficeSecurityAccessor"/> used to access back office security information.</param>
    public CopyDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
    {
        _dataTypeService = dataTypeService;
        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
    }

+    /// <summary>
+    /// Creates a copy of the specified data type.
+    /// The new data type will have a unique Id and its name will have " (copy)" appended.
+    /// Optionally, the copy can be placed in a specified container if a target container Id is provided.
+    /// </summary>
+    /// <param name="cancellationToken">Token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the data type to copy.</param>
+    /// <param name="copyDataTypeRequestModel">The request model containing copy options, such as the target container Id.</param>
+    /// <returns>A result indicating the outcome of the copy operation.</returns>
    [HttpPost("{id:guid}/copy")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(StatusCodes.Status201Created)]
@@ -13,6 +13,9 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// API controller responsible for handling requests to create new data types in Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class CreateDataTypeController : DataTypeControllerBase
@@ -21,6 +24,12 @@ public class CreateDataTypeController : DataTypeControllerBase
    private readonly IDataTypePresentationFactory _dataTypePresentationFactory;
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="CreateDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">The <see cref="IDataTypeService"/> used to manage data types.</param>
+    /// <param name="dataTypePresentationFactory">The <see cref="IDataTypePresentationFactory"/> used to create data type presentation models.</param>
+    /// <param name="backOfficeSecurityAccessor">The <see cref="IBackOfficeSecurityAccessor"/> used to access back office security information.</param>
    public CreateDataTypeController(IDataTypeService dataTypeService, IDataTypePresentationFactory dataTypePresentationFactory, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
    {
        _dataTypeService = dataTypeService;
@@ -28,6 +37,14 @@ public class CreateDataTypeController : DataTypeControllerBase
        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
    }

+    /// <summary>
+    /// Creates a new data type using the configuration provided in the request model.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="createDataTypeRequestModel">The model containing the configuration details for the new data type.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> that represents the result of the create operation. Returns <c>201 Created</c> on success, or an appropriate error response on failure.
+    /// </returns>
    [HttpPost]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(StatusCodes.Status201Created)]
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.Builders;
@@ -9,6 +9,10 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// Serves as the base controller for managing data types in the Umbraco CMS API.
+/// This class is intended to be inherited by controllers that handle data type operations.
+/// </summary>
 [VersionedApiBackOfficeRoute(Constants.UdiEntityType.DataType)]
 [ApiExplorerSettings(GroupName = "Data Type")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDocumentsOrMediaOrMembersOrContentTypes)]
@@ -55,6 +59,21 @@ public abstract class DataTypeControllerBase : ManagementApiControllerBase

    protected IActionResult DataTypeNotFound() => OperationStatusResult(DataTypeOperationStatus.NotFound, DataTypeNotFound);

+    protected IActionResult PropertyEditorSchemaOperationStatusResult(PropertyEditorSchemaOperationStatus status) =>
+        OperationStatusResult(status, problemDetailsBuilder => status switch
+        {
+            PropertyEditorSchemaOperationStatus.DataTypeNotFound => NotFound(problemDetailsBuilder
+                .WithTitle("The data type could not be found")
+                .Build()),
+            PropertyEditorSchemaOperationStatus.SchemaNotSupported => NotFound(problemDetailsBuilder
+                .WithTitle("Schema not supported")
+                .WithDetail("The property editor for this data type does not support schema information.")
+                .Build()),
+            _ => StatusCode(StatusCodes.Status500InternalServerError, problemDetailsBuilder
+                .WithTitle("Unknown property editor schema operation status.")
+                .Build()),
+        });
+
    private IActionResult DataTypeNotFound(ProblemDetailsBuilder problemDetailsBuilder)
        => NotFound(problemDetailsBuilder
            .WithTitle("The data type could not be found")
@@ -11,6 +11,9 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// API controller responsible for handling requests to delete data types in the system.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class DeleteDataTypeController : DataTypeControllerBase
@@ -18,12 +21,23 @@ public class DeleteDataTypeController : DataTypeControllerBase
    private readonly IDataTypeService _dataTypeService;
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="DeleteDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">Service used to manage and delete data types.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context and authentication.</param>
    public DeleteDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
    {
        _dataTypeService = dataTypeService;
        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
    }

+    /// <summary>
+    /// Deletes a data type identified by the provided Id.
+    /// </summary>
+    /// <param name="cancellationToken">The cancellation token to cancel the operation.</param>
+    /// <param name="id">The unique identifier of the data type to delete.</param>
+    /// <returns>An <see cref="IActionResult"/> indicating the result of the delete operation.</returns>
    [HttpDelete("{id:guid}")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(StatusCodes.Status200OK)]
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Core;
@@ -6,6 +6,10 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Filter;

+/// <summary>
+/// Serves as the base controller for implementing data type filtering operations in the API.
+/// Provides common functionality for derived controllers handling data type filters.
+/// </summary>
 [ApiExplorerSettings(GroupName = "Data Type")]
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Filter}/{Constants.UdiEntityType.DataType}")]
 // This auth policy might become problematic, as when getting DataTypes on Media types, you don't need access to the document tree.
@@ -11,18 +11,36 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Filter;

+/// <summary>
+/// Controller responsible for handling operations related to filters on data types in the management API.
+/// </summary>
 [ApiVersion("1.0")]
 public class FilterDataTypeFilterController : DataTypeFilterControllerBase
 {
    private readonly IDataTypeService _dataTypeService;
    private readonly IUmbracoMapper _mapper;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Controllers.DataType.Filter.FilterDataTypeFilterController"/> class, responsible for filtering data types.
+    /// </summary>
+    /// <param name="dataTypeService">The <see cref="IDataTypeService"/> used to manage data types.</param>
+    /// <param name="mapper">The <see cref="IUmbracoMapper"/> used for mapping entities.</param>
    public FilterDataTypeFilterController(IDataTypeService dataTypeService, IUmbracoMapper mapper)
    {
        _dataTypeService = dataTypeService;
        _mapper = mapper;
    }

+    /// <summary>
+    /// Retrieves a paginated and filtered list of data types based on the specified criteria.
+    /// </summary>
+    /// <param name="cancellationToken">A token to observe while waiting for the task to complete.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for pagination).</param>
+    /// <param name="take">The maximum number of items to return (used for pagination).</param>
+    /// <param name="name">An optional filter to match data type names.</param>
+    /// <param name="editorUiAlias">An optional filter to match the editor UI alias.</param>
+    /// <param name="editorAlias">An optional filter to match the editor alias.</param>
+    /// <returns>A task that represents the asynchronous operation. The task result contains an <see cref="IActionResult"/> with a paged collection of filtered data types.</returns>
    [HttpGet]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<DataTypeItemResponseModel>), StatusCodes.Status200OK)]
@@ -7,9 +7,17 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;

+/// <summary>
+/// Controller for managing data type folders by their unique key.
+/// </summary>
 [ApiVersion("1.0")]
 public class ByKeyDataTypeFolderController : DataTypeFolderControllerBase
 {
+    /// <summary>
+    /// Constructor for <see cref="Umbraco.Cms.Api.Management.Controllers.DataType.Folder.ByKeyDataTypeFolderController"/>.
+    /// </summary>
+    /// <param name="backOfficeSecurityAccessor">Provides access to back office security features.</param>
+    /// <param name="dataTypeContainerService">Service for managing data type containers.</param>
    public ByKeyDataTypeFolderController(
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
        IDataTypeContainerService dataTypeContainerService)
@@ -17,6 +25,14 @@ public class ByKeyDataTypeFolderController : DataTypeFolderControllerBase
    {
    }

+    /// <summary>
+    /// Retrieves a data type folder by its unique identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier (GUID) of the data type folder to retrieve.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> containing a <see cref="FolderResponseModel"/> with the folder data if found; otherwise, a <see cref="ProblemDetails"/> with status 404 if not found.
+    /// </returns>
    [HttpGet("{id:guid}")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(FolderResponseModel), StatusCodes.Status200OK)]
@@ -7,9 +7,17 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;

+/// <summary>
+/// Provides API endpoints for creating folders used to organize data types in the system.
+/// </summary>
 [ApiVersion("1.0")]
 public class CreateDataTypeFolderController : DataTypeFolderControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="CreateDataTypeFolderController"/> class, responsible for handling requests related to creating data type folders.
+    /// </summary>
+    /// <param name="backOfficeSecurityAccessor">Provides access to back office security features for authorization and authentication.</param>
+    /// <param name="dataTypeContainerService">Service used to manage data type containers (folders) within the system.</param>
    public CreateDataTypeFolderController(
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
        IDataTypeContainerService dataTypeContainerService)
@@ -17,6 +25,12 @@ public class CreateDataTypeFolderController : DataTypeFolderControllerBase
    {
    }

+    /// <summary>
+    /// Creates a new data type folder using the specified details.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="createFolderRequestModel">The request model containing the folder name and parent location.</param>
+    /// <returns>A <see cref="Task{IActionResult}"/> representing the asynchronous operation result.</returns>
    [HttpPost]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(StatusCodes.Status201Created)]
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Core;
@@ -9,6 +9,9 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;

+/// <summary>
+/// Serves as the base controller for operations related to data type folders in the Umbraco CMS Management API.
+/// </summary>
 [VersionedApiBackOfficeRoute($"{Constants.UdiEntityType.DataType}/folder")]
 [ApiExplorerSettings(GroupName = "Data Type")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDocumentTypes)]
@@ -6,9 +6,17 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;

+/// <summary>
+/// Controller responsible for handling requests to delete data type folders in the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class DeleteDataTypeFolderController : DataTypeFolderControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DeleteDataTypeFolderController"/> class.
+    /// </summary>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security operations.</param>
+    /// <param name="dataTypeContainerService">Service for managing data type containers (folders).</param>
    public DeleteDataTypeFolderController(
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
        IDataTypeContainerService dataTypeContainerService)
@@ -16,6 +24,12 @@ public class DeleteDataTypeFolderController : DataTypeFolderControllerBase
    {
    }

+    /// <summary>
+    /// Deletes a data type folder identified by the provided Id.
+    /// </summary>
+    /// <param name="cancellationToken">The cancellation token to cancel the operation.</param>
+    /// <param name="id">The unique identifier of the data type folder to delete.</param>
+    /// <returns>An <see cref="IActionResult"/> representing the result of the delete operation.</returns>
    [HttpDelete("{id:guid}")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(StatusCodes.Status200OK)]
@@ -7,9 +7,17 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;

+/// <summary>
+/// API controller responsible for handling requests to update data type folders in the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class UpdateDataTypeFolderController : DataTypeFolderControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="UpdateDataTypeFolderController"/> class.
+    /// </summary>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context and authentication.</param>
+    /// <param name="dataTypeContainerService">Service used to manage data type folders (containers).</param>
    public UpdateDataTypeFolderController(
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
        IDataTypeContainerService dataTypeContainerService)
@@ -7,6 +7,9 @@ using Umbraco.Cms.Core.Services.OperationStatus;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// Controller for checking whether a data type is currently in use.
+/// </summary>
 [ApiVersion("1.0")]
 public class IsUsedDataTypeController : DataTypeControllerBase
 {
@@ -17,6 +20,14 @@ public class IsUsedDataTypeController : DataTypeControllerBase
        _dataTypeUsageService = dataTypeUsageService;
    }

+    /// <summary>
+    /// Determines whether the data type specified by the given <paramref name="id"/> is currently used in any content, media, or member types.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the data type to check for usage.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> containing a boolean value: <c>true</c> if the data type is used; <c>false</c> otherwise. Returns <see cref="StatusCodes.Status404NotFound"/> if the data type does not exist.
+    /// </returns>
    [HttpGet("{id:guid}/is-used")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(bool), StatusCodes.Status200OK)]
@@ -1,9 +1,12 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Core;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Item;

+/// <summary>
+/// Serves as the base controller for operations related to data type items in the management API.
+/// </summary>
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Item}/{Constants.UdiEntityType.DataType}")]
 [ApiExplorerSettings(GroupName = "Data Type")]
 public class DatatypeItemControllerBase : ManagementApiControllerBase
@@ -8,12 +8,20 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Item;

+/// <summary>
+/// API controller responsible for managing individual data type items within the Umbraco CMS management interface.
+/// </summary>
 [ApiVersion("1.0")]
 public class ItemDatatypeItemController : DatatypeItemControllerBase
 {
    private readonly IDataTypeService _dataTypeService;
    private readonly IUmbracoMapper _mapper;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ItemDatatypeItemController"/> class, which manages item-level operations for data types in the Umbraco CMS Management API.
+    /// </summary>
+    /// <param name="dataTypeService">Service used to manage and retrieve data type information.</param>
+    /// <param name="mapper">The Umbraco mapper used for mapping between domain and API models.</param>
    public ItemDatatypeItemController(IDataTypeService dataTypeService, IUmbracoMapper mapper)
    {
        _dataTypeService = dataTypeService;
@@ -9,6 +9,9 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Item;

+/// <summary>
+/// Controller responsible for handling search operations for data type items in the management API.
+/// </summary>
 [ApiVersion("1.0")]
 public class SearchDataTypeItemController : DatatypeItemControllerBase
 {
@@ -16,6 +19,12 @@ public class SearchDataTypeItemController : DatatypeItemControllerBase
    private readonly IDataTypeService _dataTypeService;
    private readonly IUmbracoMapper _mapper;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="SearchDataTypeItemController"/> class, which handles search operations for data type items.
+    /// </summary>
+    /// <param name="entitySearchService">Service used to perform entity search operations.</param>
+    /// <param name="dataTypeService">Service for managing data types.</param>
+    /// <param name="mapper">The mapper used to convert between domain and API models.</param>
    public SearchDataTypeItemController(IEntitySearchService entitySearchService, IDataTypeService dataTypeService, IUmbracoMapper mapper)
    {
        _entitySearchService = entitySearchService;
@@ -23,6 +32,14 @@ public class SearchDataTypeItemController : DatatypeItemControllerBase
        _mapper = mapper;
    }

+    /// <summary>
+    /// Searches for data type items matching the specified query, with support for pagination.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="query">The search query used to filter data type items.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for pagination).</param>
+    /// <param name="take">The maximum number of items to return in the result set (used for pagination).</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains an <see cref="IActionResult"/> with a <see cref="PagedModel{DataTypeItemResponseModel}"/> containing the search results.</returns>
    [HttpGet("search")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedModel<DataTypeItemResponseModel>), StatusCodes.Status200OK)]
@@ -36,11 +53,14 @@ public class SearchDataTypeItemController : DatatypeItemControllerBase
            return Ok(new PagedModel<DataTypeItemResponseModel> { Total = searchResult.Total });
        }

-        IEnumerable<IDataType> dataTypes = await _dataTypeService.GetAllAsync(searchResult.Items.Select(item => item.Key).ToArray());
+        Guid[] keys = searchResult.Items.Select(x => x.Key).ToArray();
+        IEnumerable<IDataType> dataTypes = await _dataTypeService.GetAllAsync(keys);
+        IEnumerable<IDataType> orderedDataTypes = OrderByRequestedIds(dataTypes, keys);
+
        var result = new PagedModel<DataTypeItemResponseModel>
        {
-            Items = _mapper.MapEnumerable<IDataType, DataTypeItemResponseModel>(dataTypes),
-            Total = searchResult.Total
+            Items = _mapper.MapEnumerable<IDataType, DataTypeItemResponseModel>(orderedDataTypes),
+            Total = searchResult.Total,
        };

        return Ok(result);
@@ -12,6 +12,9 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// Controller responsible for moving data types within the system.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class MoveDataTypeController : DataTypeControllerBase
@@ -19,12 +22,25 @@ public class MoveDataTypeController : DataTypeControllerBase
    private readonly IDataTypeService _dataTypeService;
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="MoveDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">Service used to manage data types.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
    public MoveDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
    {
        _dataTypeService = dataTypeService;
        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
    }

+    /// <summary>
+    /// Moves an existing data type identified by the specified <paramref name="id"/> to a different container.
+    /// The target container Id must be provided in the <paramref name="moveDataTypeRequestModel"/>.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token to cancel the operation.</param>
+    /// <param name="id">The unique identifier of the data type to move.</param>
+    /// <param name="moveDataTypeRequestModel">The request model containing the target container information.</param>
+    /// <returns>An <see cref="IActionResult"/> indicating the result of the move operation.</returns>
    [HttpPut("{id:guid}/move")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(StatusCodes.Status200OK)]
@@ -9,12 +9,20 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.References;

+/// <summary>
+/// Controller responsible for managing and retrieving information about where specific data types are referenced within the system.
+/// </summary>
 [ApiVersion("1.0")]
 public class ReferencedByDataTypeController : DataTypeControllerBase
 {
    private readonly IDataTypeService _dataTypeService;
    private readonly IRelationTypePresentationFactory _relationTypePresentationFactory;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ReferencedByDataTypeController"/> class, which handles API requests related to data types referenced by other entities.
+    /// </summary>
+    /// <param name="dataTypeService">Service used to manage and retrieve data type information.</param>
+    /// <param name="relationTypePresentationFactory">Factory for creating presentation models for relation types.</param>
    public ReferencedByDataTypeController(IDataTypeService dataTypeService, IRelationTypePresentationFactory relationTypePresentationFactory)
    {
        _dataTypeService = dataTypeService;
@@ -22,8 +30,15 @@ public class ReferencedByDataTypeController : DataTypeControllerBase
    }

    /// <summary>
-    ///     Gets a paged list of references for the current data type, so you can see where it is being used.
+    /// Gets a paged list of entities that reference the specified data type, allowing you to see where it is being used.
    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the data type to find references for.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for paging).</param>
+    /// <param name="take">The maximum number of items to return (used for paging).</param>
+    /// <returns>
+    /// A task representing the asynchronous operation. The result contains an <see cref="ActionResult{T}"/> with a <see cref="PagedViewModel{IReferenceResponseModel}"/> listing entities that reference the specified data type.
+    /// </returns>
    [HttpGet("{id:guid}/referenced-by")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
@@ -0,0 +1,54 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.ViewModels.DataType;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+
+namespace Umbraco.Cms.Api.Management.Controllers.DataType;
+
+/// <summary>
+/// Controller for retrieving data type value schemas.
+/// </summary>
+[ApiVersion("1.0")]
+public class SchemaDataTypeController : DataTypeControllerBase
+{
+    private readonly IPropertyEditorSchemaService _schemaService;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SchemaDataTypeController"/> class.
+    /// </summary>
+    /// <param name="schemaService">The property editor schema service.</param>
+    public SchemaDataTypeController(IPropertyEditorSchemaService schemaService)
+        => _schemaService = schemaService;
+
+    /// <summary>
+    /// Gets the value schema for a data type.
+    /// </summary>
+    /// <param name="id">The unique identifier of the data type.</param>
+    /// <returns>The schema information for the data type's values.</returns>
+    /// <remarks>
+    /// Returns schema information for property editors that implement <c>IValueSchemaProvider</c>.
+    /// Returns 404 if the data type is not found or doesn't support schema information.
+    /// </remarks>
+    [HttpGet("{id:guid}/schema")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(DataTypeSchemaResponseModel), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Schema(Guid id)
+    {
+        Attempt<PropertyValueSchema, PropertyEditorSchemaOperationStatus> attempt = await _schemaService.GetSchemaAsync(id);
+        if (attempt.Success is false)
+        {
+            return PropertyEditorSchemaOperationStatusResult(attempt.Status);
+        }
+
+        PropertyValueSchema result = attempt.Result;
+        return Ok(new DataTypeSchemaResponseModel
+        {
+            ValueTypeName = result.ValueType?.FullName,
+            JsonSchema = result.JsonSchema,
+        });
+    }
+}
@@ -8,15 +8,29 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;

+/// <summary>
+/// Controller responsible for handling operations related to the ancestors tree structure of data types.
+/// </summary>
 [ApiVersion("1.0")]
 public class AncestorsDataTypeTreeController : DataTypeTreeControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="AncestorsDataTypeTreeController"/> class, which provides API endpoints for retrieving ancestor data types in the tree structure.
+    /// </summary>
+    /// <param name="entityService">Service used for entity operations within the API.</param>
+    /// <param name="dataTypeService">Service used for data type management and retrieval.</param>
    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public AncestorsDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
        : base(entityService, dataTypeService)
    {
    }

+    /// <summary>
+    /// Initializes a new instance of the <see cref="AncestorsDataTypeTreeController"/> class, which manages operations related to ancestor data type trees in the Umbraco CMS.
+    /// </summary>
+    /// <param name="entityService">Service used for entity-related operations.</param>
+    /// <param name="flagProviders">A collection of providers that supply flags for tree nodes.</param>
+    /// <param name="dataTypeService">Service used for data type management operations.</param>
    [ActivatorUtilitiesConstructor]
    public AncestorsDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
    : base(entityService, flagProviders, dataTypeService)
@@ -9,21 +9,44 @@ using Umbraco.Cms.Api.Management.Services.Flags;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;

+/// <summary>
+/// Controller responsible for handling operations related to the child nodes of the data type tree in the management API.
+/// </summary>
 [ApiVersion("1.0")]
 public class ChildrenDataTypeTreeController : DataTypeTreeControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ChildrenDataTypeTreeController"/> class.
+    /// </summary>
+    /// <param name="entityService">Service used for managing and retrieving entities within the system.</param>
+    /// <param name="dataTypeService">Service used for managing and retrieving data types.</param>
    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public ChildrenDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
        : base(entityService, dataTypeService)
    {
    }

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ChildrenDataTypeTreeController"/> class.
+    /// </summary>
+    /// <param name="entityService">Service used for managing and retrieving entities within the system.</param>
+    /// <param name="flagProviders">A collection of providers that supply additional flags or metadata for entities.</param>
+    /// <param name="dataTypeService">Service responsible for operations related to data types.</param>
    [ActivatorUtilitiesConstructor]
    public ChildrenDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
        : base(entityService, flagProviders, dataTypeService)
    {
    }

+    /// <summary>
+    /// Retrieves a paginated collection of data type tree items that are children of the specified parent ID.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="parentId">The unique identifier of the parent data type tree item whose children are to be retrieved.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for pagination).</param>
+    /// <param name="take">The maximum number of items to return (used for pagination).</param>
+    /// <param name="foldersOnly">If set to <c>true</c>, only folder items will be included in the results.</param>
+    /// <returns>A <see cref="PagedViewModel{T}"/> containing <see cref="DataTypeTreeItemResponseModel"/> instances representing the child items.</returns>
    [HttpGet("children")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -15,6 +15,9 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;

+/// <summary>
+/// Serves as the base controller for handling operations related to data type trees in the Umbraco CMS Management API.
+/// </summary>
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Tree}/{Constants.UdiEntityType.DataType}")]
 [ApiExplorerSettings(GroupName = "Data Type")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
@@ -22,6 +25,11 @@ public class DataTypeTreeControllerBase : FolderTreeControllerBase<DataTypeTreeI
 {
    private readonly IDataTypeService _dataTypeService;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="DataTypeTreeControllerBase"/> class.
+    /// </summary>
+    /// <param name="entityService">Service for managing Umbraco entities.</param>
+    /// <param name="dataTypeService">Service for managing data types within Umbraco.</param>
    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public DataTypeTreeControllerBase(IEntityService entityService, IDataTypeService dataTypeService)
        : this(
@@ -31,6 +39,12 @@ public class DataTypeTreeControllerBase : FolderTreeControllerBase<DataTypeTreeI
    {
    }

+    /// <summary>
+    /// Initializes a new instance of the <see cref="DataTypeTreeControllerBase"/> class with the specified services.
+    /// </summary>
+    /// <param name="entityService">Service used for entity operations within the data type tree.</param>
+    /// <param name="flagProviders">A collection of providers that supply flags for entities.</param>
+    /// <param name="dataTypeService">Service used for managing data types.</param>
    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 19.")]
    public DataTypeTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
        : this(
@@ -9,21 +9,43 @@ using Umbraco.Cms.Api.Management.Services.Flags;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;

+/// <summary>
+/// API controller responsible for handling operations related to the root of the data type tree in Umbraco.
+/// </summary>
 [ApiVersion("1.0")]
 public class RootDataTypeTreeController : DataTypeTreeControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RootDataTypeTreeController"/> class.
+    /// </summary>
+    /// <param name="entityService">Service used for managing and retrieving entities within Umbraco.</param>
+    /// <param name="dataTypeService">Service used for managing data types in Umbraco.</param>
    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public RootDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
        : base(entityService, dataTypeService)
    {
    }

+    /// <summary>
+    /// Initializes a new instance of the <see cref="RootDataTypeTreeController"/> class, which manages the root of the data type tree in the Umbraco management API.
+    /// </summary>
+    /// <param name="entityService">Service used for entity operations within the tree.</param>
+    /// <param name="flagProviders">A collection of providers that supply flags for tree nodes.</param>
+    /// <param name="dataTypeService">Service used for data type management and retrieval.</param>
    [ActivatorUtilitiesConstructor]
    public RootDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
    : base(entityService, flagProviders, dataTypeService)
    {
    }

+    /// <summary>
+    /// Retrieves a paginated list of data type items from the root of the tree, with optional folder-only filtering.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set.</param>
+    /// <param name="take">The maximum number of items to return.</param>
+    /// <param name="foldersOnly">If true, only folders are included in the results.</param>
+    /// <returns>A paged view model containing data type tree item response models.</returns>
    [HttpGet("root")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
@@ -8,20 +8,43 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;

+/// <summary>
+/// Provides API endpoints for managing sibling data types in the Umbraco CMS tree.
+/// </summary>
 public class SiblingsDataTypeTreeController : DataTypeTreeControllerBase
 {
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SiblingsDataTypeTreeController"/> class.
+    /// </summary>
+    /// <param name="entityService">Service used for managing and retrieving entities within Umbraco.</param>
+    /// <param name="dataTypeService">Service used for managing data types in Umbraco.</param>
    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
    public SiblingsDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
        : base(entityService, dataTypeService)
    {
    }

+    /// <summary>
+    /// Initializes a new instance of the <see cref="SiblingsDataTypeTreeController"/> class, which manages operations related to sibling data type trees in the Umbraco CMS.
+    /// </summary>
+    /// <param name="entityService">Service used for entity operations within the CMS.</param>
+    /// <param name="flagProviders">A collection of providers that supply flags for tree nodes.</param>
+    /// <param name="dataTypeService">Service used for managing data types.</param>
    [ActivatorUtilitiesConstructor]
    public SiblingsDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
        : base(entityService, flagProviders, dataTypeService)
    {
    }

+    /// <summary>
+    /// Gets a paged collection of data type tree items that are siblings of the specified data type identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="target">The unique identifier of the data type whose siblings are to be retrieved.</param>
+    /// <param name="before">The number of sibling items to retrieve before the target item.</param>
+    /// <param name="after">The number of sibling items to retrieve after the target item.</param>
+    /// <param name="foldersOnly">If set to <c>true</c>, only folders will be included in the results; otherwise, both folders and data types are returned.</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains an <see cref="ActionResult{T}"/> with a <see cref="SubsetViewModel{T}"/> of <see cref="DataTypeTreeItemResponseModel"/> representing the sibling items.</returns>
    [HttpGet("siblings")]
    [ProducesResponseType(typeof(SubsetViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
    [EndpointSummary("Gets a collection of data type tree sibling items.")]
@@ -13,6 +13,9 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// API controller responsible for handling requests to update data types in the Umbraco CMS management interface.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class UpdateDataTypeController : DataTypeControllerBase
@@ -21,6 +24,12 @@ public class UpdateDataTypeController : DataTypeControllerBase
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
    private IDataTypePresentationFactory _dataTypePresentationFactory;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="UpdateDataTypeController"/> class, responsible for handling data type update operations in the management API.
+    /// </summary>
+    /// <param name="dataTypeService">Service used to manage data types.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
+    /// <param name="dataTypePresentationFactory">Factory for creating data type presentation models.</param>
    public UpdateDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor, IDataTypePresentationFactory dataTypePresentationFactory)
    {
        _dataTypeService = dataTypeService;
@@ -28,6 +37,13 @@ public class UpdateDataTypeController : DataTypeControllerBase
        _dataTypePresentationFactory = dataTypePresentationFactory;
    }

+    /// <summary>
+    /// Updates the data type with the specified ID using the provided request model.
+    /// </summary>
+    /// <param name="cancellationToken">Token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the data type to update.</param>
+    /// <param name="updateDataTypeViewModel">The model containing the updated data type details.</param>
+    /// <returns>An <see cref="IActionResult"/> indicating the result of the update operation.</returns>
    [HttpPut("{id:guid}")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(StatusCodes.Status200OK)]
@@ -10,18 +10,34 @@ using Umbraco.Cms.Core;

 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;

+/// <summary>
+/// API controller responsible for retrieving and managing all dictionary items within the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class AllDictionaryController : DictionaryControllerBase
 {
    private readonly IDictionaryItemService _dictionaryItemService;
    private readonly IUmbracoMapper _umbracoMapper;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="AllDictionaryController"/> class.
+    /// </summary>
+    /// <param name="dictionaryItemService">An instance of <see cref="IDictionaryItemService"/> used to manage dictionary items.</param>
+    /// <param name="umbracoMapper">An instance of <see cref="IUmbracoMapper"/> used for mapping between models.</param>
    public AllDictionaryController(IDictionaryItemService dictionaryItemService, IUmbracoMapper umbracoMapper)
    {
        _dictionaryItemService = dictionaryItemService;
        _umbracoMapper = umbracoMapper;
    }

+    /// <summary>
+    /// Retrieves a paginated list of dictionary items, optionally filtered by name.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="filter">An optional string to filter dictionary items by name.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set.</param>
+    /// <param name="take">The maximum number of items to return.</param>
+    /// <returns>A paginated view model containing dictionary overview response models.</returns>
    [HttpGet]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<DictionaryOverviewResponseModel>), StatusCodes.Status200OK)]
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Factories;
@@ -8,18 +8,36 @@ using Umbraco.Cms.Api.Management.ViewModels.Dictionary;

 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;

+/// <summary>
+/// API controller for managing Umbraco dictionary items by their unique key.
+/// Provides endpoints for retrieving, updating, and deleting dictionary entries identified by key.
+/// </summary>
 [ApiVersion("1.0")]
 public class ByKeyDictionaryController : DictionaryControllerBase
 {
    private readonly IDictionaryItemService _dictionaryItemService;
    private readonly IDictionaryPresentationFactory _dictionaryPresentationFactory;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ByKeyDictionaryController"/> class, which manages dictionary items by key.
+    /// </summary>
+    /// <param name="dictionaryItemService">The <see cref="IDictionaryItemService"/> used to manage dictionary items.</param>
+    /// <param name="dictionaryPresentationFactory">The <see cref="IDictionaryPresentationFactory"/> used to create dictionary item presentations.</param>
    public ByKeyDictionaryController(IDictionaryItemService dictionaryItemService, IDictionaryPresentationFactory dictionaryPresentationFactory)
    {
        _dictionaryItemService = dictionaryItemService;
        _dictionaryPresentationFactory = dictionaryPresentationFactory;
    }

+    /// <summary>
+    /// Retrieves a dictionary item by its unique identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier (GUID) of the dictionary item to retrieve.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> containing the <see cref="DictionaryItemResponseModel"/> if the item is found;
+    /// otherwise, a 404 Not Found response.
+    /// </returns>
    [HttpGet($"{{{nameof(id)}:guid}}")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(DictionaryItemResponseModel), StatusCodes.Status200OK)]
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -15,6 +15,9 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;

+/// <summary>
+/// API controller responsible for handling requests to create new dictionary items in Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class CreateDictionaryController : DictionaryControllerBase
 {
@@ -23,6 +26,14 @@ public class CreateDictionaryController : DictionaryControllerBase
    private readonly IDictionaryPresentationFactory _dictionaryPresentationFactory;
    private readonly IAuthorizationService _authorizationService;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Controllers.Dictionary.CreateDictionaryController"/> class,
+    /// providing dependencies required for managing dictionary items in the Umbraco back office API.
+    /// </summary>
+    /// <param name="dictionaryItemService">Service for managing dictionary items.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
+    /// <param name="dictionaryPresentationFactory">Factory for creating dictionary presentation models.</param>
+    /// <param name="authorizationService">Service for handling authorization checks.</param>
    public CreateDictionaryController(
        IDictionaryItemService dictionaryItemService,
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
@@ -35,6 +46,12 @@ public class CreateDictionaryController : DictionaryControllerBase
        _authorizationService = authorizationService;
    }

+    /// <summary>
+    /// Creates a new dictionary item using the details provided in the request model.
+    /// </summary>
+    /// <param name="cancellationToken">Token to monitor for cancellation requests.</param>
+    /// <param name="createDictionaryItemRequestModel">The model containing the details of the dictionary item to create, including translations.</param>
+    /// <returns>An <see cref="IActionResult"/> indicating the result of the create operation, including possible status codes for success or failure.</returns>
    [HttpPost]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(StatusCodes.Status201Created)]
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Core;
@@ -9,12 +9,20 @@ using Umbraco.Cms.Core.Services.OperationStatus;

 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;

+/// <summary>
+/// Controller responsible for handling requests to delete dictionary items in the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class DeleteDictionaryController : DictionaryControllerBase
 {
    private readonly IDictionaryItemService _dictionaryItemService;
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="DeleteDictionaryController"/> class, used for handling requests to delete dictionary items in the Umbraco CMS.
+    /// </summary>
+    /// <param name="dictionaryItemService">Service for managing dictionary items.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
    public DeleteDictionaryController(IDictionaryItemService dictionaryItemService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
    {
        _dictionaryItemService = dictionaryItemService;
@@ -8,6 +8,9 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;

+/// <summary>
+/// Serves as the base controller for API endpoints that manage dictionary-related operations in the Umbraco CMS.
+/// </summary>
 [VersionedApiBackOfficeRoute("dictionary")]
 [ApiExplorerSettings(GroupName = "Dictionary")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDictionary)]
@@ -1,4 +1,4 @@
-using System.Net.Mime;
+using System.Net.Mime;
 using System.Text;
 using System.Xml.Linq;
 using Asp.Versioning;
@@ -10,18 +10,36 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;

+/// <summary>
+/// API controller responsible for exporting dictionary entries from the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class ExportDictionaryController : DictionaryControllerBase
 {
    private readonly IDictionaryItemService _dictionaryItemService;
    private readonly IEntityXmlSerializer _entityXmlSerializer;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ExportDictionaryController"/> class, providing services for dictionary item management and XML serialization.
+    /// </summary>
+    /// <param name="dictionaryItemService">Service used to manage dictionary items.</param>
+    /// <param name="entityXmlSerializer">Service used to serialize entities to XML.</param>
    public ExportDictionaryController(IDictionaryItemService dictionaryItemService, IEntityXmlSerializer entityXmlSerializer)
    {
        _dictionaryItemService = dictionaryItemService;
        _entityXmlSerializer = entityXmlSerializer;
    }

+    /// <summary>
+    /// Exports the dictionary item identified by the provided <paramref name="id"/> as a downloadable file.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the dictionary item to export.</param>
+    /// <param name="includeChildren">If <c>true</c>, child dictionary items will also be included in the export; otherwise, only the specified item is exported.</param>
+    /// <returns>
+    /// A <see cref="FileContentResult"/> containing the exported dictionary data as a file if the dictionary item is found;
+    /// otherwise, a <see cref="NotFoundResult"/> if the item does not exist.
+    /// </returns>
    [HttpGet("{id:guid}/export")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(FileContentResult), StatusCodes.Status200OK)]
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.Builders;
@@ -11,12 +11,20 @@ using Umbraco.Cms.Core.Security;

 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;

+/// <summary>
+/// Provides API endpoints for importing dictionary items into the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class ImportDictionaryController : DictionaryControllerBase
 {
    private readonly IDictionaryItemImportService _dictionaryItemImportService;
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ImportDictionaryController"/> class, which handles dictionary item import operations in the Umbraco backoffice API.
+    /// </summary>
+    /// <param name="dictionaryItemImportService">Service used to import dictionary items.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
    public ImportDictionaryController(
        IDictionaryItemImportService dictionaryItemImportService,
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
@@ -25,6 +33,15 @@ public class ImportDictionaryController : DictionaryControllerBase
        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
    }

+    /// <summary>
+    /// Imports a dictionary from a provided UDT file upload.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token that can be used to cancel the import operation.</param>
+    /// <param name="importDictionaryRequestModel">The model containing the uploaded UDT file and optional parent dictionary item information.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> indicating the result of the import operation:
+    /// returns <c>201 Created</c> on success, <c>400 Bad Request</c> for invalid file types or content, and <c>404 Not Found</c> if the parent or file is missing.
+    /// </returns>
    [HttpPost("import")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(StatusCodes.Status201Created)]
@@ -1,9 +1,13 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Core;

 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Item;

+/// <summary>
+/// Serves as the base controller for managing dictionary items in the Umbraco CMS Management API.
+/// Provides common functionality and endpoints for derived controllers handling dictionary item operations.
+/// </summary>
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Item}/dictionary")]
 [ApiExplorerSettings(GroupName = "Dictionary")]
 public class DictionaryItemControllerBase : ManagementApiControllerBase
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.ViewModels.Dictionary.Item;
@@ -8,18 +8,32 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Item;

+/// <summary>
+/// Provides API endpoints for managing individual dictionary items within the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class ItemDictionaryItemController : DictionaryItemControllerBase
 {
    private readonly IDictionaryItemService _dictionaryItemService;
    private readonly IUmbracoMapper _mapper;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ItemDictionaryItemController"/> class with the specified services.
+    /// </summary>
+    /// <param name="dictionaryItemService">An instance of <see cref="IDictionaryItemService"/> used to manage dictionary items.</param>
+    /// <param name="mapper">An instance of <see cref="IUmbracoMapper"/> used for mapping objects.</param>
    public ItemDictionaryItemController(IDictionaryItemService dictionaryItemService, IUmbracoMapper mapper)
    {
        _dictionaryItemService = dictionaryItemService;
        _mapper = mapper;
    }

+    /// <summary>
+    /// Retrieves a collection of dictionary items matching the specified IDs.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="ids">A set of dictionary item IDs to retrieve.</param>
+    /// <returns>A task representing the asynchronous operation. The result contains an <see cref="IActionResult"/> with the collection of dictionary items.</returns>
    [HttpGet]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(IEnumerable<DictionaryItemItemResponseModel>), StatusCodes.Status200OK)]
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.ViewModels.Dictionary;
@@ -10,12 +10,20 @@ using Umbraco.Cms.Core.Services.OperationStatus;

 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;

+/// <summary>
+/// Provides API endpoints for moving dictionary items within the Umbraco CMS management interface.
+/// </summary>
 [ApiVersion("1.0")]
 public class MoveDictionaryController : DictionaryControllerBase
 {
    private readonly IDictionaryItemService _dictionaryItemService;
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="MoveDictionaryController"/> class, responsible for handling dictionary item move operations in the management API.
+    /// </summary>
+    /// <param name="dictionaryItemService">Service used to manage dictionary items.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
    public MoveDictionaryController(IDictionaryItemService dictionaryItemService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
    {
        _dictionaryItemService = dictionaryItemService;
--- a/Show More
+++ b/Show More