Add IRecurringBackgroundJobTrigger<TJob> for opt-in job triggering

Tidy RecurringBackgroundJobBase docs and runner error handling
Replace Task.Yield with semaphore timeouts in negative assertions
2026-04-17 10:30:56 +02:00 · 2026-04-17 10:04:35 +02:00 · 2026-04-09 16:19:42 +02:00 · 2026-04-09 16:19:41 +02:00 · 2026-04-09 16:19:40 +02:00 · 2026-04-09 16:19:20 +02:00
6271 changed files with 208064 additions and 28493 deletions
@@ -0,0 +1,251 @@
+---
+name: umb-review
+description: Automated PR code review for Umbraco CMS. Analyzes changed files for intent, impact on consumers, breaking changes, architecture compliance, and code quality. Non-interactive — outputs a full structured review. Use this skill whenever the user asks to review a branch, review a PR, check their changes for issues, analyze a diff, or validate breaking change patterns — even if they don't say "review" explicitly. Does NOT apply to writing new code, fixing bugs, refactoring, explaining architecture, writing tests, or reviewing documentation content.
+argument-hint: <target-branch>
+---
+
+# PR Review - Umbraco CMS
+
+Automated, non-interactive PR code review. Analyzes changed files for intent, impact on consumers, breaking changes, architecture compliance, and code quality.
+
+**Do NOT use AskUserQuestion at any point. This skill runs fully autonomously.**
+
+## Arguments
+
+- `$ARGUMENTS` - Optional: target branch to diff against (auto-detected from PR, falls back to `origin/main`)
+
+## Instructions
+
+### 0. Verify GH CLI is Available
+
+Run `gh auth status`. If it fails, read `references/gh-cli-setup.md` and present the setup instructions to the user. Do not proceed with the review.
+
+### 1. Resolve Target Branch
+
+Determine the target branch for comparison using this priority order:
+
+1. **Explicit argument**: If `$ARGUMENTS` is provided and non-empty, use it as the target branch
+2. **PR target branch**: If no argument, run `gh pr view --json baseRefName --jq '.baseRefName'` to detect the target branch of the current branch's open PR. If a PR exists, use `origin/{baseRefName}` as the target branch.
+3. **Fallback**: If no argument and no PR found (command fails or returns empty), default to `origin/main`
+
+Store the resolved target branch for use in subsequent steps. Log which resolution method was used (e.g., "Target branch: `origin/v18/dev` (from PR #1234)").
+
+### 2. Load Review Standards
+
+#### 2a. Load coding preferences
+
+Read the coding preferences and code review scoring criteria from:
+
+- `references/coding-preferences.md` (relative to this skill file)
+
+Parse and internalize all rules, conventions, scoring categories, and severity definitions. These are your review criteria.
+
+#### 2b. Load area-specific documentation
+
+Once the changed file list is known (after step 3a), determine which areas of the codebase are touched and load the relevant documentation. Execute this sub-step between 3a and 3b. This documentation takes precedence over sibling comparison for architectural and pattern validation.
+
+**Resolution order for each changed file:**
+
+1. **Find the nearest `CLAUDE.md`** — walk up from the changed file's directory toward the repository root. The first `CLAUDE.md` found is the area guide for that file. Read it.
+2. **Read referenced docs** — if the `CLAUDE.md` references documentation files (e.g., a `docs/` directory), use the descriptions in the `CLAUDE.md` to determine which docs are relevant to the type of code being changed, and read those. If unsure, read all referenced docs — the cost of reading is low, the cost of missing a convention is high.
+3. **Follow cross-references in loaded docs** — if a loaded doc references another doc as covering a complementary or related concern, and the changed files touch that concern, read the referenced doc too. Repeat until no new relevant cross-references remain.
+4. **Check for applicable skills** — review the available skills list. If a skill exists for the type of code being changed, read the skill file to understand the expected patterns, structure, and conventions it enforces. Do NOT invoke the skill — just use it as a reference for what the correct implementation should look like.
+
+**Store all loaded documentation** for use in step 4. These docs define the authoritative patterns and conventions that the review evaluates against.
+
+### 3. Gather Changed Files
+
+#### 3a. Collect file list, stats, and diff
+
+Run these git commands (where `{target}` is the resolved target branch):
+
+```bash
+git diff {target}...HEAD --name-only --diff-filter=d   # changed files (excluding deleted)
+git diff {target}...HEAD --stat                         # line counts per file
+git log {target}...HEAD --oneline                       # commit history
+git diff {target}...HEAD                                # full diff (primary review source)
+```
+
+**If no changes found**: Output "No changes found between current branch and `{target}`. Nothing to review." and stop.
+
+#### 3b. Filter out noise files
+
+From the changed file list, classify each file as **noise** or **reviewable**.
+
+**Noise files** (skip entirely — do not read, do not review):
+
+| Pattern                                              | Reason                          |
+| ---------------------------------------------------- | ------------------------------- |
+| `*.gen.ts`, `*.gen.cs`                               | Auto-generated API client code  |
+| `*.generated.cs`, `*.Designer.cs` (in `Migrations/`) | Auto-generated models/snapshots |
+| `*/assets/lang/*.ts` (except `en.ts`)                | Non-English translation files   |
+| `*/mocks/data/*.ts`                                  | Test fixture data               |
+| `*/dist-cms/*`, `*/storybook-static/*`               | Build output                    |
+| `*/TEMP/InMemoryAuto/*`                              | Runtime-generated models        |
+| `package-lock.json`                                  | Dependency lock file            |
+| `appsettings-schema.*.json`                          | Generated JSON schema           |
+
+Log the skip list: "Skipped {N} noise files: {comma-separated list of filenames}"
+
+#### 3c. Read reviewable changed files
+
+Read the full file for every reviewable changed file.
+
+#### 3d. Track file counts
+
+Keep track of these numbers for the review output in step 7: total changed files, noise files skipped, and reviewable files read. Also record: distinct production layers touched, distinct project directories, and total lines changed — these feed step 3e.
+
+#### 3e. Assess PR complexity
+
+Follow the procedure in `references/complexity-assessment.md`. Store the triggered dimensions and suggestions for step 7.
+
+#### 3f. Classify PR scope
+
+Classify the PR to determine which review steps are relevant:
+
+| Classification  | Condition                                                                       | Effect                                                                          |
+| --------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
+| **Gen-only**    | All reviewable files are `gen.ts`                                               | Skip steps 5 and 6; step 4 reviews impact on other code only                    |
+| **Docs-only**   | All reviewable files are `.md`                                                  | Skip steps 5 and 6; step 4 reviews intent and readability only                  |
+| **Test-only**   | All reviewable files are in `tests/`                                            | Skip steps 5 and 6; step 4 reviews intent, code quality, and test coverage only |
+| **Config-only** | All reviewable files are `.csproj`, `.props`, `.json` config, or CI/build files | Skip step 5; step 6 checks dependency version changes only                      |
+| **Standard**    | Anything else                                                                   | No skips — run all steps                                                        |
+
+### 4. Raw Code Review
+
+Review each changed file holistically. Think like a senior developer reading a colleague's PR. Note all findings without worrying about format or severity yet.
+
+#### 4a. Read and reason about each file
+
+For each changed file, reason about: What does this code do? Is it correct? What's missing — validation, error handling, notifications, cleanup, edge cases? Could this break anything for consumers?
+
+#### 4b. Validate against documentation and patterns
+
+Use a **docs-first** approach: classify the code by what it does, check it against documented conventions, and only fall back to sibling comparison when docs don't cover the pattern.
+
+**Step 1 — Determine the correct approach from documentation, then check whether the PR matches**
+
+A PR is a proposed solution, not the source of truth. This step has two parts that must happen in order — do not start part B until part A is complete.
+
+**Part A — Before validating/judging the implementation**, determine what the correct approach is for each new class or file based on what it does. Use the documentation loaded in step 2b to identify the expected base classes, patterns, and conventions. Write down the expected approach. Classify based on what the code does, not based on what neighboring files look like.
+
+**Part B — Now compare the PR's implementation** against the expected approach from Part A. If it deviates from the documented approach, flag it. If the documentation specifies reference examples, read those examples to verify the implementation matches.
+
+**Pattern match is the leading finding.** If the documentation defines a pattern that fits what the code does, the first and most important finding is whether the code follows that pattern.
+
+**Step 2 — Fall back to sibling comparison**
+
+If the documentation does not cover the specific pattern, or for cross-cutting concerns not addressed in docs, fall back to sibling comparison:
+
+1. **New method on existing class/interface**: Grep for the most similar existing method on the same class using `-A 80` to capture the full method body (e.g., `UpdateCurrentUserAsync` → grep for `UpdateAsync` in the same file with `-A 80`). Compare line by line for missing cross-cutting concerns: notifications/events, validation, scoping, authorization, error handling, audit logging.
+2. **New TS class**: Grep for siblings by base class (`extends {BaseClass}`) or by interface (`implements {Interface}`) or by name suffix (e.g., `CurrentUserController` → grep for `UserController`). Compare for missing concerns.
+3. **New CS class**: Grep for siblings by base class (`class {ClassName} : {BaseClass}`) or by interface (`class {ClassName} : {Interface}`) or by name suffix (e.g., `ManagementApiComposer` → grep for `ApiComposer`). Compare for missing concerns.
+
+**Important:** Sibling comparison validates cross-cutting concerns, but it must not override documented conventions. If a sibling deviates from documented patterns, that sibling is wrong — do not copy its deviation.
+
+Store your raw findings — they feed into step 7.
+
+### 5. Impact Analysis
+
+**Skip this step if PR scope is docs-only, test-only, or config-only.**
+
+Follow the procedure in `references/impact-analysis.md`.
+
+### 6. Breaking Changes Check
+
+**Skip this step if PR scope is docs-only or test-only. If config-only, only check for dependency version changes that could break consumers.**
+
+Follow the procedure in `references/breaking-changes.md`.
+
+### 7. Consolidate and Output Review
+
+Merge findings from step 4 (raw review), step 5 (impact analysis), and step 6 (breaking changes). For each finding, assign severity (Critical/Important/Suggestion) and verify it relates to changed code — not pre-existing issues. Before outputting, drop any finding about whitespace, blank lines, formatting, or comment wording. Then present the review in this exact format:
+
+```markdown
+## PR Review
+
+**Target:** `{target_branch}` · **Based on commit:** `{head_sha}`
+[If any skipped files, append: · **Skipped:** {skipped} files out of {total} total]
+[If step 3f classification is not "Standard", append: · **Classified as:** {classification}]
+
+[1–2 sentences: what this PR accomplishes , keep it as short as possible, only highlight the primary essence.]
+
+- **Modified public API:** {changed existing interfaces/types/classes/methods}
+  [Omit bullet if none]
+- **Affected implementations (outside this PR):** {interfaces/types/classes/methods using modified public API}
+  [Omit bullet if none]
+- **Breaking changes:** {violations with specifics}
+  [Omit bullet if none]
+- **Other changes:** {changes not listed above that an Umbraco user, plugin developer, or API consumer would notice — e.g., behavior changes, default value changes, error message changes, new configuration options, removed functionality. Exclude internal renames, formatting, and private implementation details.}
+  [Omit bullet if none]
+
+[If step 3e triggered any dimensions, insert this block. Omit entirely if nothing triggered:]
+
+> [!NOTE]
+> **Complexity advisory** — This PR may benefit from splitting.
+>
+> - **{Dimension}:** {Explanation and concrete split suggestion from step 3e}
+>   [one bullet per triggered dimension]
+>
+> _This is an observation, not a blocker. The full review follows below._
+
+---
+
+### Critical
+
+[Must fix before merge — security vulnerabilities, data loss, broken functionality, breaking changes without proper patterns]
+
+- **`{file}:{line}`**: {problem} → {fix}
+
+[Omit section if none]
+
+### Important
+
+[Should fix — performance issues, missing tests, architectural violations, pattern misuse]
+
+- **`{file}:{line}`**: {observation} → {suggestion}
+
+[Omit section if none]
+
+### Suggestions
+
+[Nice to have — readability, minor refactoring, alternative approaches]
+
+- **`{file}:{line}`**: {detail}
+
+[Omit section if none]
+
+---
+
+[One of:]
+
+## Approved
+
+This looks good to be merged as-is, but please do a manual sanity check and testing before merging.
+
+## Approved with Suggestions for improvement
+
+Good to go, but please carefully consider the importance of the suggestions.
+
+## Request Changes
+
+Critical and important issues must be addressed first.
+
+## Needs re-work
+
+This is in such a bad state that the feedback of this review is not sufficient to guide improvements, the PR cannot be approved.
+```
+
+**Guidelines for the review output:**
+
+— When reporting information, be extremely concise and sacrifice grammar for sake of concision.
+
+- Only review code that was changed in the diff — pre-existing issues are out of scope. Focus on what compilers and linters cannot catch: behavioral side-effects (e.g., a changed default alters runtime behavior for consumers), architectural violations (e.g., a new dependency breaks layering), breaking changes for external consumers of the public API, and security implications. Leave type errors, missing imports, and broken references to CI.
+- Be specific — always reference file and line number
+- Explain WHY something is an issue, not just WHAT, but avoid stating the obvious.
+- For complex matters, provide concrete fix suggestions, including code snippets when helpful
+- Keep it constructive — the goal is to help, not gatekeep
+- Don't repeat the same finding for every occurrence — mention it once and note "same pattern in {other files}"
+- Focus on substantive issues only. Do NOT flag purely cosmetic or stylistic concerns. Specifically, never flag: code formatting or whitespace, comment grammar or wording, redundant-but-harmless syntax (e.g., optional chaining after a truthiness check), code duplication that doesn't cause bugs, or HTML template cosmetics. The only exception is when a stylistic issue has a concrete impact on performance or rendering. Note: missing JSDoc/documentation on public or exported APIs is a substantive finding (per coding preferences), not a cosmetic one — flag it as a Suggestion.
+- For breaking changes, reference the specific pattern from the CLAUDE.md that should be applied
+- Do not suggest changes that would themselves introduce breaking changes. If a suggestion would alter public API surface (e.g., changing return types, renaming public members), it is not appropriate for a PR targeting `main` within a major version. Only suggest non-breaking alternatives.
@@ -0,0 +1,97 @@
+{
+  "skill_name": "umb-review",
+  "evals": [
+    {
+      "id": 0,
+      "name": "pr-22214-large-frontend-refactor",
+      "prompt": "Review the changes in PR #22214 (branch origin/pr/22214 targeting main). This is a large frontend refactor migrating create entity actions to use entityCreateOptionAction extensions, with deprecations.",
+      "expected_output": "A structured review that identifies frontend deprecation patterns, flags the large PR complexity, handles 75+ files correctly, checks for breaking changes in exported components, and produces the correct output format.",
+      "pr_number": 22214,
+      "pr_branch": "origin/pr/22214",
+      "base_branch": "origin/main",
+      "files": [],
+      "assertions": [
+        {"id": "deprecation-patterns-noted", "text": "Review identifies deprecation patterns (@deprecated, UmbDeprecation)"},
+        {"id": "frontend-breaking-change-awareness", "text": "Checks frontend-specific breaking changes (exports, custom elements) not just backend"},
+        {"id": "file-references-present", "text": "Findings reference specific files with line numbers"},
+        {"id": "no-false-critical-on-deprecations", "text": "Properly deprecated code is NOT flagged as Critical breaking change"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues (formatting, whitespace, naming conventions, comment grammar, code style preferences) unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."},
+        {"id": "manifest-alias-rename-detected", "text": "Alias renames (CreateOptions → Create) flagged as Critical breaking change"},
+        {"id": "non-exported-deletions-dismissed", "text": "Deleted action classes NOT flagged as breaking (verified against package.json exports)"},
+        {"id": "noise-files-filtered", "text": "Does not review noise files (generated files, lock files, etc.)"},
+        {"id": "complexity-advisory-triggers", "text": "Review includes a complexity/split advisory for the large 75+ file scope"}
+      ]
+    },
+    {
+      "id": 1,
+      "name": "pr-21672-small-frontend-bugfix",
+      "prompt": "Review the changes in PR #21672 (branch origin/pr/21672 targeting main). This is a small 4-file frontend bugfix implementing tab validation badges in the block editor.",
+      "expected_output": "A clean review that correctly identifies this as a small focused bugfix, avoids false positives, and either approves or approves with minor suggestions.",
+      "pr_number": 21672,
+      "pr_branch": "origin/pr/21672",
+      "base_branch": "origin/main",
+      "files": [],
+      "assertions": [
+        {"id": "complexity-advisory-absent", "text": "Review does NOT include a complexity/split advisory"},
+        {"id": "no-false-breaking-changes", "text": "Review does not flag breaking changes"},
+        {"id": "proportionate-verdict", "text": "Verdict is 'Request Changes'"},
+        {"id": "concise-review", "text": "Review output is under 200 lines"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues (formatting, whitespace, naming conventions, comment grammar, code style preferences) unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."}
+      ]
+    },
+    {
+      "id": 2,
+      "name": "pr-22217-small-backend-webhook",
+      "prompt": "Review the changes in PR #22217 (branch origin/pr/22217 targeting v18/dev). This is a tiny 3-file backend change to the default webhook payload type.",
+      "expected_output": "A concise review that correctly resolves v18/dev as target branch, handles the small change proportionately, and considers the behavioral impact of changing a default value.",
+      "pr_number": 22217,
+      "pr_branch": "origin/pr/22217",
+      "base_branch": "origin/v18/dev",
+      "files": [],
+      "assertions": [
+        {"id": "correct-target-branch", "text": "Review references 'v18/dev' as the target branch (not 'main')"},
+        {"id": "default-value-change-noted", "text": "Review discusses the behavioral impact of changing the default payload type"},
+        {"id": "proportionate-review", "text": "Review output is under 150 lines"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues (formatting, whitespace, naming conventions, comment grammar, code style preferences) unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."},
+        {"id": "ignores-preexisting-issues", "text": "Does NOT flag the ~30 builder extension methods with Legacy defaults (pre-existing, not changed in the PR)"},
+        {"id": "side-effect-detection", "text": "Flags stale WebhookSettings.cs docs as a side-effect of the constant value change"},
+        {"id": "consumer-identification", "text": "Identifies affected consumers outside the PR (WebhookSettings, UmbracoBuilder, or WebhookEventCollectionBuilderExtensions)"}
+      ]
+    },
+    {
+      "id": 3,
+      "name": "pr-22268-frontend-feature-workspace-modal",
+      "prompt": "Review the changes in PR #22268 (branch origin/pr/22268 targeting main). This is a 29-file frontend feature adding a current user workspace modal.",
+      "expected_output": "A review of a medium-sized new feature PR. Should assess the new code for architectural compliance, check for breaking changes (new exports, custom elements), and evaluate code quality without flagging pre-existing issues.",
+      "pr_number": 22268,
+      "pr_branch": "origin/pr/22268",
+      "base_branch": "origin/main",
+      "files": [],
+      "assertions": [
+        {"id": "complexity-advisory-triggers", "text": "Review includes a complexity/split advisory (3 layers: Core, API, Frontend across 27+ files)"},
+        {"id": "breaking-changes-on-interface-additions", "text": "Flags new interface methods without default implementations as breaking changes (Pattern 3)"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."},
+        {"id": "diff-scoped", "text": "All findings reference code that was changed in the diff, not pre-existing issues"},
+        {"id": "new-feature-assessed", "text": "Review assesses the new feature's architecture, patterns, or integration approach — not just absence of bugs"},
+        {"id": "no-false-notification-finding", "text": "Review does NOT flag UpdateCurrentUserAsync as missing UserSavingNotification/UserSavedNotification — the sibling UpdateAsync also does not publish these notifications, so flagging their absence would be a false positive"}
+      ]
+    },
+    {
+      "id": 4,
+      "name": "pr-22215-frontend-architecture-violation",
+      "prompt": "Review the changes in PR #22215 (branch origin/pr/22215 targeting main). This is a 2-file frontend feature adding user management to the user group workspace.",
+      "expected_output": "A review that catches the architecture violation: the workspace context directly imports and calls UserService and UserGroupService (generated API clients) instead of going through a repository. In the Umbraco backoffice, workspace contexts access data via repositories, not by calling API services directly. The review should flag this as a significant architecture issue and request changes.",
+      "pr_number": 22215,
+      "pr_branch": "origin/pr/22215",
+      "base_branch": "origin/main",
+      "files": [],
+      "assertions": [
+        {"id": "service-bypass-detected", "text": "Review flags that the workspace context directly imports/calls UserService or UserGroupService instead of using a repository"},
+        {"id": "repository-pattern-recommended", "text": "Review recommends using the repository pattern (going through a repository/data-source layer) rather than calling API services directly from the workspace context"},
+        {"id": "verdict-request-changes", "text": "Verdict is 'Request Changes' (the architecture violation warrants requesting changes, not just approving with suggestions)"},
+        {"id": "no-stylistic-nitpicks", "text": "Review does not flag purely cosmetic/stylistic issues (formatting, whitespace, naming conventions, comment grammar, code style preferences) unless they affect performance or rendering. Missing JSDoc on new public APIs is NOT a stylistic issue — it is a legitimate finding."},
+        {"id": "no-false-breaking-changes", "text": "Review does not flag breaking changes (this PR only adds new code, no public API is removed or modified)"}
+      ]
+    }
+  ]
+}
@@ -0,0 +1,249 @@
+# Breaking Changes Reference
+
+This document describes how to detect and validate breaking changes during PR review. It covers both backend (.NET) and frontend (TypeScript/Lit) patterns.
+
+---
+
+## Version Detection
+
+**Always read `version.json`** at the repository root to determine the current major version. This drives the obsolete removal target calculation:
+
+- Current major version: read from `version.json` → `version` field (e.g., `"17.4.0-rc"` → major version `17`)
+- Obsolete removal target: `current + 2` (e.g., if current is 17, removal is scheduled for Umbraco 19)
+- Format: `[Obsolete("... Scheduled for removal in Umbraco {current+2}.")]`
+
+---
+
+## Backend (.NET) Breaking Changes
+
+### What Constitutes a Breaking Change
+
+Any of these on a `public` or `protected` member:
+
+- Removing or renaming a class, interface, struct, record, or enum
+- Removing or renaming a method, property, or field
+- Changing a method signature (parameters, return type)
+- Adding required parameters to an existing method
+- Adding methods to a public interface (without default implementation)
+- Changing a constructor signature on a public class
+- Removing or changing enum values
+- Changing type hierarchy (base class, implemented interfaces)
+
+### Pattern 1: Obsolete Constructor + StaticServiceProvider
+
+When a public class needs new dependencies, the existing constructor must be preserved.
+
+**Correct pattern:**
+
+```csharp
+[Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
+public MyService(IDependencyA depA)
+    : this(
+        depA,
+        StaticServiceProvider.Instance.GetRequiredService<IDependencyB>())
+{
+}
+
+public MyService(IDependencyA depA, IDependencyB depB)
+{
+    _depA = depA;
+    _depB = depB;
+}
+```
+
+**Validation checklist:**
+
+- [ ] Old constructor has `[Obsolete]` attribute with correct removal version
+- [ ] Old constructor calls new constructor via `: this(...)`
+- [ ] `StaticServiceProvider.Instance.GetRequiredService<T>()` used for new params only
+- [ ] DI registration uses the NEW constructor (old is for external consumers only)
+- [ ] Removal version is `{current_major + 2}`
+
+**Common mistakes to flag:**
+
+- Removing the old constructor entirely (breaking change!)
+- Old constructor NOT calling new constructor (code duplication)
+- Wrong removal version in `[Obsolete]`
+- Missing `StaticServiceProvider` resolution for new dependencies
+- DI registration still using the old constructor
+
+### Pattern 2: Obsolete Method + New Overload
+
+When a method signature needs to change, add the new overload and obsolete the old.
+
+**Correct pattern:**
+
+```csharp
+[Obsolete("Use the overload taking all parameters. Scheduled for removal in Umbraco 19.")]
+public void DoThing(string name)
+    => DoThing(name, extraParam: null);
+
+public void DoThing(string name, string? extraParam)
+{
+    // Real implementation here
+}
+```
+
+**Validation checklist:**
+
+- [ ] Old method has `[Obsolete]` attribute with correct removal version
+- [ ] Old method calls new method, providing defaults for new parameters
+- [ ] All internal callers updated to use the new method
+- [ ] No internal code references the obsolete method (except the delegation)
+
+### Pattern 3: Default Interface Implementation
+
+When adding methods to a public interface, provide a default implementation.
+
+**Correct pattern:**
+
+```csharp
+public interface IMyService
+{
+    void ExistingMethod();
+
+    // New method with default implementation
+    void NewMethod(string param)
+        => ExistingMethod(); // delegate to existing if possible
+}
+```
+
+**Strategies for defaults (in order of preference):**
+
+1. Use existing interface methods to satisfy the contract
+2. Return a sensible default (empty collection, null, etc.)
+3. Throw `NotImplementedException` if no reasonable default exists
+
+**Validation checklist:**
+
+- [ ] New interface method has a default implementation
+- [ ] TODO comment present: `// TODO (V{next-major}): Remove the default implementation when {obsolete method} is removed.`
+- [ ] Default implementation is functionally correct (even if not optimal)
+- [ ] If `StaticServiceProvider` is used in default impl, noted as temporary
+
+### Obsolete Attribute Validation
+
+For any `[Obsolete]` attribute found in changed code:
+
+1. **Format**: Must contain `"Scheduled for removal in Umbraco {version}."`
+2. **Version**: Must be `current_major + 2` (read from `version.json`)
+3. **Pragma**: Where obsolete members must call each other, `#pragma warning disable CS0618` / `#pragma warning restore CS0618` must be present
+
+### Internal Caller Check
+
+After finding obsolete patterns, verify:
+
+- Search the codebase for usages of the obsolete member
+- **No internal code** (inside `src/`) should reference obsolete members
+- Only the obsolete member's own delegation (calling the new version) is acceptable
+- External consumers (outside the repo) get the deprecation period to migrate
+
+---
+
+## Frontend (TypeScript/Lit) Breaking Changes
+
+The backoffice is published as `@umbraco-cms/backoffice` with 140+ named exports. Plugin developers depend on this public API surface.
+
+**Critical frontend rule (does not apply to backend .NET where `public`/`protected` visibility determines the API surface): only symbols reachable through the `package.json` `exports` field are public API.** Anything not exported — whether classes, functions, constants, types, or entire files — is an internal implementation detail, even if other internal code imports it. Removing or changing unexported frontend symbols is not a breaking change. Before flagging a frontend deletion or rename as breaking, verify the symbol is reachable via `package.json` exports. If it is not, do not flag it.
+
+### Custom Elements (Web Components)
+
+**Breaking changes:**
+
+- Renaming or removing a registered custom element tag (`umb-*`)
+- Removing elements from `HTMLElementTagNameMap`
+- Removing or changing `@property()` decorated fields on exported components
+- Removing event emissions (checked via `this.dispatchEvent`)
+- Removing CSS custom properties (`@cssprop` in JSDoc)
+- Removing CSS parts (`@csspart` in JSDoc)
+
+**How to detect:**
+
+- Check diff for removed `@customElement('umb-...')` decorators
+- Check diff for removed `@property()` fields on exported components
+- Check diff for removed entries in `HTMLElementTagNameMap` declarations
+
+### Exported Types/Interfaces
+
+**Breaking changes:**
+
+- Removing exports from `package.json` `exports` field
+- Changing the shape of exported interfaces (removing properties, changing types)
+- Renaming exported types (consumers import by name)
+- Removing union type members
+- Changing generic type parameter constraints
+
+**How to detect:**
+
+- Check if `package.json` `exports` field is modified
+- Check diff for removed `export` statements
+- Check diff for changed interface/type shapes
+
+### Manifest/Extension System
+
+**Breaking changes:**
+
+- Renaming a manifest `alias` value — plugin developers reference aliases by string in conditions, overwrites, and extension registry lookups. Alias renames are not caught by the compiler since they are string-based. A renamed alias silently breaks any plugin that references the old string.
+- Removing support for a manifest `type` that plugins use
+- Changing manifest `alias` resolution or validation
+- Removing or renaming manifest `kind` types
+- Changing extension bundle structure
+
+**How to detect:**
+
+- **Alias renames**: Compare `alias:` values in manifest files before and after. Changed alias strings are Critical — the old alias should be preserved as a deprecated entry.
+- Search for changes to manifest type definitions
+- Check for removed or renamed manifest kinds
+
+### Context API
+
+**Breaking changes:**
+
+- Removing context tokens from exports
+- Changing the shape of data provided by a context
+- Removing context provider/consumer mechanisms
+
+**How to detect:**
+
+- Check for removed context token exports
+- Check for changes to context provider classes
+
+### Controllers/Lifecycle
+
+**Breaking changes:**
+
+- Changing controller base class inheritance requirements
+- Removing controller lifecycle hooks
+- Breaking cleanup mechanisms in `disconnectedCallback()`
+
+### Observable/State
+
+**Breaking changes:**
+
+- Removing observable properties from the public API
+- Changing observable emission patterns
+
+### npm Publishing
+
+**Breaking changes:**
+
+- Changing version constraints that exclude previously-supported versions
+- Adding incompatible peer dependency constraints
+
+**How to detect:**
+
+- Check if `package.json` `peerDependencies` or `dependencies` changed
+- Verify version ranges are not narrowed
+
+---
+
+## Reporting Breaking Changes
+
+When a breaking change is detected, report:
+
+1. **What**: The specific change and which public symbol is affected
+2. **Pattern**: Which mitigation pattern should be applied (Pattern 1, 2, or 3 for backend)
+3. **Severity**: Critical (no mitigation present) or Important (mitigation present but incorrect)
+4. **Fix**: Concrete code suggestion showing the correct pattern
+
+If no breaking changes are detected, state: "No breaking changes detected."
@@ -0,0 +1,168 @@
+# Coding Preferences & Review Criteria
+
+These are the coding preferences and code review standards used by the review skill. They define what the review evaluates against.
+
+---
+
+## Testing
+
+- **Always create blackbox tests** for new/changed code
+- Choose the appropriate test level:
+  - **Unit tests** for isolated logic
+  - **Integration tests** for application services/use cases
+  - **E2E tests** for API endpoints
+
+### Test Class Naming
+
+- Test classes must be postfixed with `Tests` (e.g., `OrderServiceTests`)
+- One test class per class under test
+
+### Test Method Naming
+
+**C# tests**: Use the `Can_`/`Cannot_` pattern with PascalCase underscore-separated words:
+
+- `Can_Schedule_Publish_Invariant`
+- `Cannot_Delete_Non_Existing`
+- `Can_Schedule_Publish_Single_Culture`
+
+Large test classes are split into partial files by method: `ContentServiceTests.Delete.cs`, `ContentServiceTests.Publish.cs`.
+
+**TypeScript tests**: Use BDD-style `it()` with natural language descriptions:
+
+- `it('should not allow the returned value to be lower than min')`
+- `it('converts string to camelCase')`
+
+### Unit Tests
+
+- Optional, but must be blackbox tests so refactoring does not break tests
+
+### Integration Tests
+
+- Every use case / application service must have integration tests
+- Tests run against real database (containerized or similar)
+- Test the full flow from application layer through infrastructure
+
+### E2E Tests
+
+- Every API endpoint must have E2E tests
+- Test realistic scenarios including error cases
+
+---
+
+## Trade-offs
+
+When making decisions, prioritize:
+
+- **Readability** over cleverness
+- **Flexibility** over rigidity
+- Explain trade-offs when deviating from these defaults
+
+---
+
+## Breaking Changes
+
+- Communicate breaking changes at the **OpenAPI/openapi.json level**
+- Clearly document what changed and the migration path
+
+---
+
+## Documentation
+
+- **Document all public or exported types** (classes, interfaces, types, methods, properties)
+- Keep documentation in sync with code changes
+- Add **JS Docs** on all public frontend APIs (classes, methods, properties)
+- Focus on "why" and usage, not restating the obvious
+
+---
+
+## Dependencies
+
+- Use what's available in the codebase, unless there is no good choice
+- **Flag new dependencies** for review — new packages should be justified
+- Prefer well-maintained, widely-used packages
+
+---
+
+## Error Messages & Logging
+
+- **User-facing errors**: Clear, friendly, actionable
+- **Log messages**: Technical, detailed, with context
+- Include correlation IDs and relevant data in logs
+
+---
+
+## Security
+
+- **Always check for security issues** using OWASP Top 10 as baseline
+- Flag potential vulnerabilities immediately
+- Suggest secure alternatives when spotting risky patterns
+- Apply principle of least privilege
+
+---
+
+## Immutability
+
+- Prefer **immutability** by default
+- Allow internal properties to be mutated, as long as they are not direct references coming from the outside
+
+---
+
+## Nullability
+
+- **TypeScript / JavaScript**
+  - Prefer `undefined` for optional/omitted values (e.g., optional parameters, props, and fields)
+  - Use `null` only when the domain model explicitly encodes "no value" or "not set" (e.g., `string | null` from APIs/DB), and be consistent with existing types
+  - Avoid mixing `null` and `undefined` for the same concept within the same model or API surface
+  
+- **C#**  
+  - use nullable types (e.g., `string?`, `int?`) where absence is valid
+  - Prefer domain modeling (value objects, options/results, empty collections) over `null` where appropriate, but respect existing conventions in the codebase
+
+---
+
+## C# Specific
+
+- use Notification pattern (not C# events), Composer pattern (DI registration), Scoping with `Complete()`, Attempt pattern for operation results.
+
+---
+
+## Architecture
+
+- Follow **Clean Architecture** principles
+- **Fail-fast** principle: detect and report errors as early as possible
+- Within the established layered architecture (Core/Infrastructure/Web/API), organize code by feature inside each layer where practical, while preserving dependency direction
+- One class per file
+- Avoid N+1 queries
+- Profile before optimizing non-critical paths
+
+### Type Hierarchy Consistency
+
+When parallel model types have inconsistent relationships to a shared base type:
+
+**TypeScript**: manipulations via `Omit`, `Pick`, intersection overrides, or workarounds like `as unknown as` / double-casts to bridge type mismatches.
+
+**C#**: hiding base members with `new` to change types, explicit interface implementations to mask mismatches, or downcasting base return types in derived classes.
+
+- **Do NOT suggest** the PR code should deviate from its base type to match a sibling that already deviates. Copying the deviation spreads the problem.
+- **Do flag** the architectural inconsistency: parallel models should share a compatible base contract. The model that manipulates or deviates from the base type is the one that needs attention — not the one that extends it correctly.
+- **Frame the suggestion** as: "These related models have inconsistent type hierarchies. `{deviating type}` manipulates the base contract of `{base type}`, which forces shared consumers like `{shared utility}` to require a shape that conforming subtypes can't satisfy."
+
+---
+
+## Code Style
+
+- Follow standard naming conventions for the language (C# or JS/TS)
+- Keep components small and focused on a single responsibility
+- Prefer early returns
+- Small functions
+- No nested ternaries
+
+---
+
+## Severity Levels
+
+| Severity | Meaning |
+|----------|---------|
+| **Critical** | Must fix before merge — security vulnerabilities, data loss risks, broken functionality |
+| **Important** | Should fix — performance issues, missing tests, architectural violations |
+| **Suggestion** | Nice to have — readability, minor refactoring, alternative approaches |
@@ -0,0 +1,33 @@
+# PR Complexity Assessment
+
+Evaluate whether the PR's scope suggests it should be split. This assessment is **informational only** — it never blocks or shortens the review.
+
+## Always check: Formatting mixed with logic
+
+This check applies to every PR regardless of size or scope.
+
+Run both commands and compare per-file line counts:
+```bash
+git diff {target}...HEAD --stat
+git diff {target}...HEAD --stat --ignore-all-space
+```
+
+For any file where the whitespace-ignored diff is less than **half** the full diff size (and the full diff is over 50 lines), that file has significant formatting changes mixed with logic. Flag it with a split suggestion: "File(s) {list} contain significant formatting changes mixed with logic. Consider a separate formatting-only commit or PR to keep the functional diff reviewable."
+
+## Multi-project scope check
+
+Skip this section entirely if ALL production files reside in a single project directory or if the PR is docs-only, test-only, dependency-bump-only, or rename-only.
+
+Otherwise, flag any dimension that applies:
+
+| Dimension | Condition | Suggestion |
+|---|---|---|
+| **Size** | 30+ files OR 1500+ lines, spanning 2+ projects | "If changes in {projectA} and {projectB} are independently functional, they could be separate PRs." |
+| **Layer spread** | 3+ layers touched (Core/Infrastructure/Web/API/Frontend), 10+ files | "Consider splitting by layer — e.g., Core+Infrastructure first, then API/Frontend consumers." |
+| **Mixed intent** | 2+ intent categories (new feature, bugfix, refactor, dependency update) with 15+ files or 3+ projects | "Consider extracting the {secondary intent} into a separate PR." |
+
+Intent categories — detect from diff characteristics, not commit messages:
+- **New feature**: new files or new `public`/`export` declarations
+- **Bug fix**: small targeted edits, no new files (don't co-flag with new feature)
+- **Refactor**: file renames, symbols moved but logic unchanged
+- **Dependency update**: changes to `.csproj`, `Directory.Packages.props`, `package.json`
@@ -0,0 +1,23 @@
+# GH CLI Setup Instructions
+
+The GitHub CLI (`gh`) is required for this review skill to detect PR target branches.
+
+## Installation
+
+Install via Homebrew:
+
+```
+brew install gh
+```
+
+Or see https://cli.github.com/ for other installation methods.
+
+## Authentication
+
+After installing, authorize by running this in the terminal (use the `!` prefix in Claude Code):
+
+```
+! gh auth login
+```
+
+Follow the prompts to authenticate with your GitHub account.
@@ -0,0 +1,153 @@
+# Impact Analysis Reference
+
+This document describes how to perform impact analysis during PR review. The goal is to look beyond the diff to understand how changes affect consumers in other parts of the codebase.
+
+---
+
+## 1. Extract Changed Public Symbols
+
+Scan the diff output for changes to public API surface:
+
+### Backend (.NET)
+
+Look for added, modified, or removed lines containing:
+
+- `public class`, `public abstract class`, `public sealed class`
+- `public interface`
+- `public record`, `public struct`, `public enum`
+- `public` or `protected` methods, properties, fields
+- `public static` members
+- Constructor signatures on public types
+
+### Frontend (TypeScript/Lit)
+
+Look for changes to:
+
+- `export class`, `export interface`, `export type`, `export enum`
+- `export function`, `export const`
+- `@property()` decorated fields on exported components
+- `@customElement()` registrations
+- Entries in `package.json` `exports` field
+
+Collect a list of all changed public symbol names (type names, method names, property names).
+
+---
+
+## 2. Search for Consumers
+
+For each changed public symbol, search the `src/` directory for usages **outside the changed file itself**.
+
+### Grep Strategy
+
+Use the Grep tool with these settings:
+
+```
+pattern: {symbol name}
+path: src/
+output_mode: files_with_matches
+head_limit: 20
+```
+
+Use `head_limit: 20` to avoid overwhelming results — if there are more than 20 consumers, note "20+ consumers found" and list the first 20.
+
+### What to Search For
+
+For each changed type/method, search for:
+
+- **Type references**: class name, interface name (e.g., `IContentService`)
+- **Method calls**: method name in context (e.g., `\.GetById\(` for a method rename)
+- **Constructor usage**: `new TypeName(`
+- **DI registrations**: `.AddSingleton<IType, Type>`, `.AddScoped<`, `.AddTransient<`
+- **Notification handlers**: if a notification type changed, search for `INotificationHandler<NotificationTypeName>` and `INotificationAsyncHandler<NotificationTypeName>`
+- **Interface implementations**: if an interface changed, search for `: IInterfaceName` or `IInterfaceName,`
+
+### Excluding the Changed File
+
+When reporting consumers, exclude files that are part of the PR's changes (they're already being reviewed). The interesting consumers are those **outside** the PR that may be affected.
+
+---
+
+## 3. Check Dependency Flow Direction
+
+The Umbraco architecture enforces strict unidirectional dependencies:
+
+```
+Api.Management / Api.Delivery (depend on Api.Common)
+  ↓
+Api.Common (depends on Web.Common)
+  ↓
+Web.Common (depends on Infrastructure)
+  ↓
+Infrastructure (depends on Core)
+  ↓
+Core (no dependencies)
+```
+
+### Layer Mapping
+
+Map each changed file to its architectural layer:
+
+| Path prefix | Layer |
+|---|---|
+| `src/Umbraco.Core/` | Core |
+| `src/Umbraco.Infrastructure/` | Infrastructure |
+| `src/Umbraco.PublishedCache.*` | Infrastructure |
+| `src/Umbraco.Examine.Lucene/` | Infrastructure |
+| `src/Umbraco.Cms.Persistence.*` | Infrastructure |
+| `src/Umbraco.Web.Common/` | Web |
+| `src/Umbraco.Web.UI/` | Web (Application) |
+| `src/Umbraco.Web.Website/` | Web |
+| `src/Umbraco.Cms.Api.Common/` | API |
+| `src/Umbraco.Cms.Api.Management/` | API |
+| `src/Umbraco.Cms.Api.Delivery/` | API |
+| `src/Umbraco.Web.UI.Client/` | Frontend |
+| `tests/` | Test |
+
+### Violation Detection
+
+Flag if a change introduces:
+
+- **Core depending on Infrastructure**: Core file importing/referencing Infrastructure types
+- **Core depending on Web/API**: Core file importing/referencing Web or API types
+- **Infrastructure depending on Web/API**: Infrastructure file importing Web or API types
+- **Cross-API dependencies**: Management API depending on Delivery API or vice versa
+
+### How to Check
+
+1. For each changed file, identify its layer
+2. Read the file's `using` statements (C#) or `import` statements (TS)
+3. Check if any imports reference a higher layer
+4. Also check if new parameters or return types come from higher layers
+
+---
+
+## 4. Flag Cross-Project Risks
+
+### High-Risk Patterns
+
+These changes have high ripple potential:
+
+- **Interface changes in Core** — all implementations in Infrastructure must be updated
+- **Notification type changes** — all handlers across the codebase are affected
+- **Base class changes** — all derived classes are affected
+- **Composer changes** — can affect DI container and runtime behavior globally
+- **Shared model/DTO changes** — can affect serialization, API contracts, and consumers
+
+### What to Report
+
+For each cross-project risk found, report:
+
+1. **What changed**: The specific symbol and how it changed
+2. **Who is affected**: List of consuming files/projects found via Grep
+3. **Risk level**: Whether the consumers will break (compile error), behave differently (runtime), or are unaffected
+4. **Recommendation**: Whether the PR should include updates to affected consumers
+
+---
+
+## 5. Performance Notes
+
+- Use `head_limit: 20` on all Grep searches to cap results
+- Only search for symbols that actually changed (not every symbol in the file)
+- For very common type names (e.g., `IScope`, `ILogger`), consider adding more context to the search pattern to reduce false positives
+- Skip impact analysis for test files — they don't have external consumers
+- Skip impact analysis for private/internal members — they can't have external consumers
@@ -0,0 +1,5 @@
+UMBRACO_CLIENT_ID=umbraco-back-office-mcp
+UMBRACO_CLIENT_SECRET=1234567890
+UMBRACO_BASE_URL=https://localhost:44339
+NODE_TLS_REJECT_UNAUTHORIZED=0
+UMBRACO_INCLUDE_TOOL_COLLECTIONS=data-type,document-type,document,media-type,media
@@ -55,3 +55,8 @@
 *.sln text=auto eol=crlf merge=union

 *.gitattributes text=auto
+
+# Generated files - hidden by default in GitHub diffs
+src/Umbraco.Web.UI.Client/src/packages/core/backend-api/** linguist-generated
+src/Umbraco.Web.UI.Login/src/api/** linguist-generated
+src/Umbraco.Cms.Api.Management/OpenApi.json linguist-generated
@@ -1,218 +1 @@
-# Umbraco CMS Development Guide
-
-Always reference these instructions first and fallback to search or bash commands only when you encounter unexpected information that does not match the info here.
-
-## Working Effectively
-
-Bootstrap, build, and test the repository:
-
-   Install .NET SDK (version specified in global.json):
-    -   `curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --version $(jq -r '.sdk.version' global.json)`
-    -   `export PATH="/home/runner/.dotnet:$PATH"`
-   Install Node.js (version specified in src/Umbraco.Web.UI.Client/.nvmrc):
-    -   `curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash`
-    -   `export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"`
-    -   `nvm install $(cat src/Umbraco.Web.UI.Client/.nvmrc) && nvm use $(cat src/Umbraco.Web.UI.Client/.nvmrc)`
-   Fix shallow clone issue (required for GitVersioning):
-    -   `git fetch --unshallow`
-   Restore packages:
-    -   `dotnet restore` -- takes 50 seconds. NEVER CANCEL. Set timeout to 90+ seconds.
-   Build the solution:
-    -   `dotnet build` -- takes 4.5 minutes. NEVER CANCEL. Set timeout to 10+ minutes.
-   Install and build frontend:
-    -   `cd src/Umbraco.Web.UI.Client`
-    -   `npm ci --no-fund --no-audit --prefer-offline` -- takes 11 seconds.
-    -   `npm run build:for:cms` -- takes 1.25 minutes. NEVER CANCEL. Set timeout to 5+ minutes.
-   Install and build Login
-    -   `cd src/Umbraco.Web.UI.Login`
-    -   `npm ci --no-fund --no-audit --prefer-offline`
-    -   `npm run build`
-   Run the application:
-    -   `cd src/Umbraco.Web.UI`
-    -   `dotnet run --no-build` -- Application runs on https://localhost:44339 and http://localhost:11000
-
-Check out [BUILD.md](./BUILD.md) for more detailed instructions.
-
-## Validation
-
-   ALWAYS run through at least one complete end-to-end scenario after making changes.
-   Build and unit tests must pass before committing changes.
-   Frontend build produces output in src/Umbraco.Web.UI.Client/dist-cms/ which gets copied to src/Umbraco.Web.UI/wwwroot/umbraco/backoffice/
-   Always run `dotnet build` and `npm run build:for:cms` before running the application to see your changes.
-   For login-only changes, you can run `npm run build` from src/Umbraco.Web.UI.Login and then `dotnet run --no-build` from src/Umbraco.Web.UI.
-   For frontend-only changes, you can run `npm run dev:server` from src/Umbraco.Web.UI.Client for hot reloading.
-   Frontend changes should be linted using `npm run lint:fix` which uses Eslint.
-
-## Testing
-
-### Unit Tests (.NET)
-
-   Location: tests/Umbraco.Tests.UnitTests/
-   Run: `dotnet test tests/Umbraco.Tests.UnitTests/Umbraco.Tests.UnitTests.csproj --configuration Release --verbosity minimal`
-   Duration: ~1 minute with 3,343 tests
-   NEVER CANCEL: Set timeout to 5+ minutes
-
-### Integration Tests (.NET)
-
-   Location: tests/Umbraco.Tests.Integration/
-   Run: `dotnet test tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj --configuration Release --verbosity minimal`
-   NEVER CANCEL: Set timeout to 10+ minutes
-
-### Frontend Tests
-
-   Location: src/Umbraco.Web.UI.Client/
-   Run: `npm test` (requires `npx playwright install` first)
-   Frontend tests use Web Test Runner with Playwright
-
-### Acceptance Tests (E2E)
-
-   Location: tests/Umbraco.Tests.AcceptanceTest/
-   Requires running Umbraco application and configuration
-   See tests/Umbraco.Tests.AcceptanceTest/README.md for detailed setup (requires `npx playwright install` first)
-
-## Project Structure
-
-The solution contains 30 C# projects organized as follows:
-
-### Main Application Projects
-
-   **Umbraco.Web.UI**: Main web application project (startup project)
-   **Umbraco.Web.UI.Client**: TypeScript frontend (backoffice)
-   **Umbraco.Web.UI.Login**: Separate login screen frontend
-   **Umbraco.Core**: Core domain models and interfaces
-   **Umbraco.Infrastructure**: Data access and infrastructure
-   **Umbraco.Cms**: Main CMS package
-
-### API Projects
-
-   **Umbraco.Cms.Api.Management**: Management API
-   **Umbraco.Cms.Api.Delivery**: Content Delivery API
-   **Umbraco.Cms.Api.Common**: Shared API components
-
-### Persistence Projects
-
-   **Umbraco.Cms.Persistence.SqlServer**: SQL Server support
-   **Umbraco.Cms.Persistence.Sqlite**: SQLite support
-   **Umbraco.Cms.Persistence.EFCore**: Entity Framework Core abstractions
-
-### Test Projects
-
-   **Umbraco.Tests.UnitTests**: Unit tests
-   **Umbraco.Tests.Integration**: Integration tests
-   **Umbraco.Tests.AcceptanceTest**: End-to-end tests with Playwright
-   **Umbraco.Tests.Common**: Shared test utilities
-
-## Common Tasks
-
-### Running Umbraco in Different Modes
-
-**Production Mode (Standard Development)**
-Use this for backend development, testing full builds, or when you don't need hot reloading:
-
-1. Build frontend assets: `cd src/Umbraco.Web.UI.Client && npm run build:for:cms`
-2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
-3. Access backoffice: `https://localhost:44339/umbraco`
-4. Application uses compiled frontend from `wwwroot/umbraco/backoffice/`
-
-**Vite Dev Server Mode (Frontend Development with Hot Reload)**
-Use this for frontend-only development with hot module reloading:
-
-1. Configure backend for frontend development - Add to `src/Umbraco.Web.UI/appsettings.json` under `Umbraco:CMS:Security`:
-    ```json
-    "BackOfficeHost": "http://localhost:5173",
-    "AuthorizeCallbackPathName": "/oauth_complete",
-    "AuthorizeCallbackLogoutPathName": "/logout",
-    "AuthorizeCallbackErrorPathName": "/error",
-    "BackOfficeTokenCookie": {
-      "SameSite": "None"
-    }
-    ```
-2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
-3. Run frontend dev server: `cd src/Umbraco.Web.UI.Client && npm run dev:server`
-4. Access backoffice: `http://localhost:5173/` (no `/umbraco` prefix)
-5. Changes to TypeScript/Lit files hot reload automatically
-
-**Important:** Remove the `BackOfficeHost` configuration before committing or switching back to production mode.
-
-### Backend-Only Development
-
-For backend-only changes, disable frontend builds:
-
-   Comment out the target named "BuildStaticAssetsPreconditions" in src/Umbraco.Cms.StaticAssets.csproj:
-    ```
-    <!--<Target Name="BuildStaticAssetsPreconditions" BeforeTargets="AssignTargetPaths">
-      [...]
-    </Target>-->
-    ```
-   Remember to uncomment before committing
-
-### Building NuGet Packages
-
-To build custom NuGet packages for testing:
-
-```bash
-dotnet pack -c Release -o Build.Out
-dotnet nuget add source [Path to Build.Out folder] -n MyLocalFeed
-```
-
-### Regenerating Frontend API Types
-
-When changing Management API:
-
-```bash
-cd src/Umbraco.Web.UI.Client
-npm run generate:server-api-dev
-```
-
-Also update OpenApi.json from /umbraco/swagger/management/swagger.json
-
-## Database Setup
-
-Default configuration supports SQLite for development. For production-like testing:
-
-   Use SQL Server/LocalDb for better performance
-   Configure connection string in src/Umbraco.Web.UI/appsettings.json
-
-## Clean Up / Reset
-
-To reset development environment:
-
-```bash
-# Remove configuration and database
-rm src/Umbraco.Web.UI/appsettings.json
-rm -rf src/Umbraco.Web.UI/umbraco/Data
-
-# Full clean (removes all untracked files)
-git clean -xdf .
-```
-
-## Version Information
-
-   Target Framework: .NET (version specified in global.json)
-   Current Version: (specified in version.json)
-   Node.js Requirement: (specified in src/Umbraco.Web.UI.Client/.nvmrc)
-   npm Requirement: Latest compatible version
-
-## Known Issues
-
-   Build requires full git history (not shallow clone) due to GitVersioning
-   Some NuGet package security warnings are expected (SixLabors.ImageSharp vulnerabilities)
-   Frontend tests require Playwright browser installation: `npx playwright install`
-   Older Node.js versions may show engine compatibility warnings (check .nvmrc for current requirement)
-
-## Timing Expectations
-
-**NEVER CANCEL** these operations - they are expected to take time:
-
-| Operation               | Expected Time | Timeout Setting |
-| ----------------------- | ------------- | --------------- |
-| `dotnet restore`        | 50 seconds    | 90+ seconds     |
-| `dotnet build`          | 4.5 minutes   | 10+ minutes     |
-| `npm ci`                | 11 seconds    | 30+ seconds     |
-| `npm run build:for:cms` | 1.25 minutes  | 5+ minutes      |
-| `npm test`              | 2 minutes     | 5+ minutes      |
-| `npm run lint`          | 1 minute      | 5+ minutes      |
-| Unit tests              | 1 minute      | 5+ minutes      |
-| Integration tests       | Variable      | 10+ minutes     |
-
-Always wait for commands to complete rather than canceling and retrying.
+The full development guide for this repository lives in [CLAUDE.md](../CLAUDE.md). Please read that file for complete instructions on architecture, build steps, testing, branching conventions, and coding patterns.
@@ -4,9 +4,7 @@ on:
  push:
    branches:
      - main
-      - release/*
      - v*/dev
-      - v*/main
    paths:
      - src/Umbraco.Web.UI.Client/package.json
      - src/Umbraco.Web.UI.Client/package-lock.json
@@ -16,9 +14,7 @@ on:
    types: [opened, synchronize, reopened, closed]
    branches:
      - main
-      - release/*
      - v*/dev
-      - v*/main
  workflow_dispatch:

 jobs:
@@ -5,7 +5,6 @@ on:
    branches:
      - main
      - v*/dev
-      - v*/main
    paths:
      - src/Umbraco.Web.UI.Client/package.json
      - src/Umbraco.Web.UI.Client/package-lock.json
@@ -16,7 +15,6 @@ on:
    branches:
      - main
      - v*/dev
-      - v*/main
  workflow_dispatch:

 env:
@@ -12,6 +12,7 @@ permissions:

 jobs:
  reconcile:
+    if: github.repository == 'umbraco/Umbraco-CMS'
    runs-on: ubuntu-latest
    steps:
      - name: Reconcile release/* labels → discussions
@@ -51,6 +51,10 @@ tools/docfx/
 /build/csharp-docs/api/
 /build/csharp-docs/_site/

+# Local config
+.claude/settings.local.json
+.env.local
+
 # Build
 /build.out/
 /build.tmp/
@@ -99,6 +103,7 @@ tools/docfx/
 playwright-report
 trace.zip
 /tests/Umbraco.Tests.AcceptanceTest/results
+/tests/Umbraco.Tests.AcceptanceTest/dist

 # Ignore auto-generated schema
 /src/Umbraco.Cms.Targets/tasks/
@@ -107,6 +112,7 @@ trace.zip
 /src/Umbraco.Web.UI/appsettings-schema.json
 /src/Umbraco.Web.UI/appsettings-schema.*.json
 /src/Umbraco.Web.UI/umbraco-package-schema.json
+/src/Umbraco.Web.UI.Client/umbraco-package-schema.json
 /tests/Umbraco.Tests.Integration/appsettings-schema.json
 /tests/Umbraco.Tests.Integration/appsettings-schema.*.json
 /tests/Umbraco.Tests.Integration/umbraco-package-schema.json
@@ -0,0 +1,14 @@
+{
+  "mcpServers": {
+    "umbraco-cms": {
+      "command": "npx",
+      "args": ["@umbraco-cms/mcp-dev@17"]
+    },
+    "playwright": {
+      "command": "npx",
+      "args": [
+        "@playwright/mcp@latest"
+      ]
+    }
+  }
+}
@@ -259,7 +259,108 @@ Project ownership is distributed across teams. Check individual project director

 ---

-## 5. Project-Specific Notes
+## 5. Avoiding Breaking Changes
+
+No binary breaking changes are allowed within a major version. Three patterns are used:
+
+### 5.1 Obsolete Constructor + StaticServiceProvider
+
+When a public class needs new dependencies, obsolete the existing constructor and add a new one. The old constructor delegates to the new one, resolving missing deps via `StaticServiceProvider`.
+
+```csharp
+[Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
+public MyService(IDependencyA depA)
+    : this(
+        depA,
+        StaticServiceProvider.Instance.GetRequiredService<IDependencyB>())
+{
+}
+
+public MyService(IDependencyA depA, IDependencyB depB)
+{
+    _depA = depA;
+    _depB = depB;
+}
+```
+
+**Examples**:
+- `ContentCollectionPresentationFactory` - added `FlagProviderCollection`
+- `CacheInstructionService` - added `ILastSyncedManager`, `IRepositoryCacheVersionService`
+- `DocumentPresentationFactory` - added `FlagProviderCollection`
+
+**Rules**:
+- Old constructor marked `[Obsolete("... Scheduled for removal in Umbraco {current-major+2}.")]`
+- Old constructor calls new constructor via `: this(...)`
+- Uses `StaticServiceProvider.Instance.GetRequiredService<T>()` for new params only
+- DI registration must use the NEW constructor (old is for external consumers only)
+
+### 5.2 Obsolete Method + New Overload
+
+When a public method signature needs to change, add the new method/overload and obsolete the old. The obsolete method should call the new one with suitable defaults.
+
+```csharp
+[Obsolete("Use the overload taking all parameters. Scheduled for removal in Umbraco 19.")]
+public void DoThing(string name)
+    => DoThing(name, extraParam: null);
+
+public void DoThing(string name, string? extraParam)
+{
+    // Real implementation here
+}
+```
+
+**Rules**:
+- Old method marked `[Obsolete]` with removal schedule
+- DRY: old method calls new method, providing defaults for new parameters
+- All internal callers must be updated to use the new method
+- No callers should remain on the obsolete method within the codebase
+
+### 5.3 Default Interface Implementation
+
+When adding methods to a public interface, provide a default implementation so existing external implementations don't break.
+
+```csharp
+public interface IMyService
+{
+    // Existing method
+    void ExistingMethod();
+
+    // New method with default implementation
+    void NewMethod(string param)
+        => ExistingMethod(); // delegate to existing if possible
+}
+```
+
+**Strategies for the default** (in order of preference):
+1. **Use existing interface methods** to satisfy the contract (even if not optimal)
+2. **Return a sensible default** like empty collection, null, etc.
+3. **Throw `NotImplementedException`** if no reasonable default exists
+
+**Example**: `IContentService.SaveBlueprint` - new overload with `IContent? createdFromContent` has a default impl that calls the old method (ignoring the new param).
+
+**Example**: `IDocumentPresentationFactory.CreateCulturePublishScheduleModels` - full default implementation with logic, uses `StaticServiceProvider` for dependency resolution within the interface.
+
+**Rules**:
+- Add `// TODO (V{next-major}): Remove the default implementation when {obsolete method} is removed.` comment
+- Default impl should be functionally correct even if not optimal
+- If using `StaticServiceProvider` in a default impl, note this is temporary
+
+### 5.4 General Rules
+
+- **Removal policy**: Obsoleted members must remain for at least one full major version before removal. If obsoleted in version N, the earliest removal is version N+2. For example, something obsoleted in v17 is scheduled for removal in v19 (giving the whole of v18 as a deprecation period).
+- All `[Obsolete]` attributes must include **"Scheduled for removal in Umbraco {current+2}"**
+- Read `version.json` to determine the current major version
+- Suppress `CS0618` warnings where obsolete members must call each other:
+  ```csharp
+  #pragma warning disable CS0618 // Type or member is obsolete
+      => OldMethod(param);
+  #pragma warning restore CS0618 // Type or member is obsolete
+  ```
+- Update ALL internal callers to use the new API - no internal code should use obsolete members
+
+---
+
+## 6. Project-Specific Notes

 ### Centralized Package Management

@@ -292,13 +393,18 @@ The repository contains BOTH (actively supported):
 All APIs use **OpenIddict** (OAuth 2.0/OpenID Connect):
 - Reference tokens (not JWT) for better security
 - **Secure cookie-based token storage** (v17+) - tokens stored in HTTP-only cookies with `__Host-` prefix
- Tokens are redacted from client-side responses and passed via secure cookies only
+- Tokens are redacted from client-side responses and passed via secure cookies only (`[redacted]` placeholder)
 - ASP.NET Core Data Protection for token encryption
 - Configured in `Umbraco.Cms.Api.Common`
 - API requests must include credentials (`credentials: include` for fetch)

 **Load Balancing Requirement**: All servers must share the same Data Protection key ring.

+**Frontend auth pitfalls** — see `src/Umbraco.Web.UI.Client/docs/edge-cases.md` (Auth & Cross-tab section) and `docs/security.md`. Key points:
+- Never call `validateToken()` per API request — it revokes the previous reference token (ID2019 errors)
+- `window.opener` is set for ANY `window.open()` target, not only OAuth popups — scope guards to the pathname too
+- BroadcastChannel does not deliver messages to the sender's own tab
+
 ### Content Caching Strategy

 **HybridCache** (`Umbraco.PublishedCache.HybridCache`):
@@ -313,6 +419,20 @@ APIs use `Asp.Versioning.Mvc`:
 - Delivery API: `/umbraco/delivery/api/v{version}/*`
 - OpenAPI/Swagger docs per version

+### Updating `OpenApi.json` (Management API)
+
+When a PR changes Management API controllers or models, the `OpenApi.json` file in the Management API project must be updated:
+
+1. Run the Umbraco instance locally
+2. Open Swagger UI and navigate to the swagger.json link (e.g. `https://localhost:44339/umbraco/swagger/management/swagger.json`)
+3. Copy the full JSON content and paste it into `src/Umbraco.Cms.Api.Management/OpenApi.json`
+
+**Important**: Commit only the substantive changes — not IDE-applied formatting (whitespace, reordering, etc.). Extraneous formatting diffs make PRs harder to review and merge-ups more error-prone.
+
+### Backoffice npm Package
+
+The backoffice is published to npm as `@umbraco-cms/backoffice`. Runtime dependencies are provided via importmap; npm peerDependencies provide types only. For full details on dependency hoisting, version range logic, and plugin development, see `/src/Umbraco.Web.UI.Client/CLAUDE.md` → "npm Package Publishing".
+
 ### Known Limitations

 1. **Circular Dependencies**: Avoided via `Lazy<T>` or event notifications
@@ -342,6 +462,16 @@ dotnet format
 dotnet pack -c Release
 ```

+### Integration Test Database Configuration
+
+Integration tests are configured in `tests/Umbraco.Tests.Integration/appsettings.Tests.json`.
+
+The `Tests:Database:DatabaseType` setting controls which database is used:
+- `"SQLite"` (default) - No external dependencies
+- `"LocalDb"` - Uses SQL Server LocalDB, required for SQL Server-specific tests (e.g., page-level locking, `sys.dm_tran_locks`)
+
+SQL Server-specific tests use `BaseTestDatabase.IsSqlite()` to skip when running on SQLite.
+
 ### Key Projects

 | Project | Type | Description |
@@ -367,6 +497,7 @@ dotnet pack -c Release
 For detailed information about individual projects, see their CLAUDE.md files:
 - **Core Architecture**: `/src/Umbraco.Core/CLAUDE.md` - Service contracts, notification patterns
 - **API Infrastructure**: `/src/Umbraco.Cms.Api.Common/CLAUDE.md` - OpenAPI, authentication, serialization
+- **Backoffice Frontend**: `/src/Umbraco.Web.UI.Client/CLAUDE.md` - Lit web components, extension system, auth client

 ### Getting Help

@@ -13,27 +13,27 @@
  </ItemGroup>
  <!-- Microsoft packages -->
  <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.1" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.4" />
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.14.0" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.1.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.4.0" />
    <PackageVersion Include="System.Linq.Async" Version="7.0.0" />
  </ItemGroup>
  <!-- Umbraco packages -->
@@ -42,27 +42,27 @@
  </ItemGroup>
  <!-- Third-party packages -->
  <ItemGroup>
-    <PackageVersion Include="Asp.Versioning.Mvc" Version="8.1.0" />
-    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="8.1.0" />
+    <PackageVersion Include="Asp.Versioning.Mvc" Version="8.1.1" />
+    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="8.1.1" />
    <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
    <PackageVersion Include="Examine" Version="3.7.1" />
    <PackageVersion Include="Examine.Core" Version="3.7.1" />
    <PackageVersion Include="HtmlAgilityPack" Version="1.12.4" />
    <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
-    <PackageVersion Include="MailKit" Version="4.14.1" />
-    <PackageVersion Include="Markdig" Version="0.44.0" />
+    <PackageVersion Include="MailKit" Version="4.15.1" />
+    <PackageVersion Include="Markdig" Version="0.45.0" />
    <PackageVersion Include="Markdown" Version="2.2.1" />
    <PackageVersion Include="MessagePack" Version="3.1.4" />
    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
    <PackageVersion Include="MiniProfiler.Shared" Version="4.5.4" />
    <PackageVersion Include="ncrontab" Version="3.4.0" />
-    <PackageVersion Include="NPoco" Version="6.1.0" />
-    <PackageVersion Include="NPoco.SqlServer" Version="6.1.0" />
+    <PackageVersion Include="NPoco" Version="6.2.0" />
+    <PackageVersion Include="NPoco.SqlServer" Version="6.2.0" />
    <PackageVersion Include="OpenIddict.Abstractions" Version="7.2.0" />
    <PackageVersion Include="OpenIddict.AspNetCore" Version="7.2.0" />
    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="7.2.0" />
-    <PackageVersion Include="Serilog" Version="4.3.0" />
+    <PackageVersion Include="Serilog" Version="4.3.1" />
    <PackageVersion Include="Serilog.AspNetCore" Version="9.0.0" />
    <PackageVersion Include="Serilog.Enrichers.Process" Version="3.0.0" />
    <PackageVersion Include="Serilog.Enrichers.Thread" Version="4.0.0" />
@@ -76,7 +76,8 @@
    <PackageVersion Include="Serilog.Sinks.Map" Version="2.0.0" />
    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.2.0" />
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.0.1" />
+    <!-- When updating this version, also update templates/UmbracoExtension/Umbraco.Extension.csproj -->
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.1.4" />
  </ItemGroup>
  <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
  <ItemGroup>
@@ -88,4 +89,4 @@
    <!-- TODO (V19): Remove these pinned dependencies when the Markdown dependency is removed. -->
    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
  </ItemGroup>
-</Project>
+</Project>
@@ -0,0 +1,144 @@
+# MCP (Model Context Protocol) Setup
+
+This repository includes configuration for [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) servers, enabling AI tooling integration for Umbraco CMS development workflows.
+
+## Overview
+
+MCP allows AI assistants (like Claude) to interact with external tools and services. This repository configures two MCP servers:
+
+| Server | Purpose | Package |
+|--------|---------|---------|
+| **umbraco-cms** | Manage Umbraco content types, documents, and media | `@umbraco-cms/mcp-dev@17` |
+| **playwright** | Browser automation for testing and debugging | `@playwright/mcp@latest` |
+
+## Quick Start
+
+### 1. Start Umbraco Locally
+
+Ensure your local Umbraco instance is running at `https://localhost:44339` (or update the URL in your `.env.local`).
+
+### 2. Configure Environment Variables
+
+Copy the example environment file and customize it:
+
+```bash
+cp .env.example .env.local
+```
+
+Edit `.env.local` with your local settings:
+
+```env
+UMBRACO_CLIENT_ID=umbraco-back-office-mcp
+UMBRACO_CLIENT_SECRET=<your-client-secret>
+UMBRACO_BASE_URL=https://localhost:44339
+NODE_TLS_REJECT_UNAUTHORIZED=0
+UMBRACO_INCLUDE_TOOL_COLLECTIONS=data-type,document-type,document,media-type,media
+```
+
+### 3. Configure the OAuth Client in Umbraco
+
+Create an OAuth client in your Umbraco instance with:
+- **Client ID**: `umbraco-back-office-mcp`
+- **Client Secret**: The value you set in `.env.local`
+- **Grant Type**: Client Credentials
+
+## Environment Variables Reference
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `UMBRACO_CLIENT_ID` | OAuth client ID configured in Umbraco | `umbraco-back-office-mcp` |
+| `UMBRACO_CLIENT_SECRET` | OAuth client secret (keep secure!) | `your-secure-secret` |
+| `UMBRACO_BASE_URL` | URL of your local Umbraco instance | `https://localhost:44339` |
+| `NODE_TLS_REJECT_UNAUTHORIZED` | Set to `0` for self-signed certificates (local dev only) | `0` |
+| `UMBRACO_INCLUDE_TOOL_COLLECTIONS` | Comma-separated list of tool collections to enable | `data-type,document-type,document` |
+
+### Tool Collections
+
+The `UMBRACO_INCLUDE_TOOL_COLLECTIONS` variable controls which Umbraco MCP tools are available:
+
+- `data-type` - Manage data types (property editors)
+- `document-type` - Manage document types (content types)
+- `document` - Manage content/documents
+- `media-type` - Manage media types
+- `media` - Manage media items
+
+## Security Considerations
+
+> **Warning**: This configuration is for **local development only**.
+
+### Self-Signed Certificates
+
+`NODE_TLS_REJECT_UNAUTHORIZED=0` disables SSL certificate validation. This is necessary for self-signed certificates in local development but:
+
+- **Never use in production**
+- Affects all HTTPS connections made by Node.js processes
+- Consider trusting your local development certificate instead
+
+### Client Secrets
+
+- Never commit real secrets to source control
+- The `.env.local` file is gitignored for this reason
+- Use strong, unique secrets even in development
+- The example value `1234567890` in `.env.example` is a placeholder only
+
+## File Structure
+
+```
+Umbraco-CMS/
+├── .mcp.json              # MCP server configuration
+├── .env.example           # Example environment variables (committed)
+├── .env.local             # Your local environment variables (gitignored)
+├── .claude/
+│   ├── settings.json      # Shared Claude AI permissions (committed)
+│   └── settings.local.json # Local Claude overrides (gitignored)
+├── .gitignore             # Ignores .env.local and settings.local.json
+└── MCP.md                 # This documentation (you are here)
+```
+
+## Claude AI Permissions
+
+The `.claude/settings.json` file configures which MCP tools Claude can use automatically without prompting. This is shared across the team for consistent developer experience.
+
+### Customizing Permissions Locally
+
+Create `.claude/settings.local.json` to override permissions for your environment:
+
+```json
+{
+  "permissions": {
+    "allow": [
+      "mcp__umbraco__get-all-document-types"
+    ]
+  }
+}
+```
+
+## Troubleshooting
+
+### "Connection refused" errors
+
+- Ensure Umbraco is running at the configured `UMBRACO_BASE_URL`
+- Check that the port matches your local setup
+
+### "Unauthorized" errors
+
+- Verify the OAuth client is configured in Umbraco
+- Check that `UMBRACO_CLIENT_ID` and `UMBRACO_CLIENT_SECRET` match
+- Ensure the client has appropriate permissions
+
+### "Certificate" errors
+
+- For local development, set `NODE_TLS_REJECT_UNAUTHORIZED=0` in `.env.local`
+- Alternatively, trust your local development certificate
+
+### MCP server not starting
+
+- Ensure Node.js is installed (v22+ recommended, matching .nvmrc)
+- Run `npx @umbraco-cms/mcp-dev@17 --help` to verify the package works
+
+## Further Reading
+
+- [Model Context Protocol Documentation](https://modelcontextprotocol.io/)
+- [Umbraco MCP Package](https://www.npmjs.com/package/@umbraco-cms/mcp-dev)
+- [Playwright MCP](https://www.npmjs.com/package/@playwright/mcp)
+- [Claude Code Documentation](https://docs.anthropic.com/claude-code)
@@ -107,9 +107,17 @@ stages:
              command: build
              projects: $(solution)
              arguments: "--configuration $(buildConfiguration) --no-restore --property:ContinuousIntegrationBuild=true --property:GeneratePackageOnBuild=true --property:PackageOutputPath=$(Build.ArtifactStagingDirectory)/nupkg"
+          # Publish compiled DLLs for C# API documentation generation
+          # Separate artifact to avoid increasing build_output size for all builds
+          - task: PublishPipelineArtifact@1
+            displayName: Publish DocFX DLLs
+            condition: and(succeeded(), or(eq(variables['build.NBGV_PublicRelease'], 'True'), eq('${{ parameters.buildApiDocs }}', 'True')))
+            inputs:
+              targetPath: $(Build.SourcesDirectory)/src/Umbraco.Cms/bin/Release
+              artifactName: csharp-docs-dlls
          - powershell: |
              dotnet tool install --global CycloneDX
-              dotnet-CycloneDX $(solution) --output $(Build.ArtifactStagingDirectory)/bom --filename bom-dotnet.xml
+              dotnet-CycloneDX $(solution) --spec-version 1.5 --output $(Build.ArtifactStagingDirectory)/bom --filename bom-dotnet.xml
            displayName: 'Generate Backend BOM'
          - powershell: |
              npm install --global @cyclonedx/cyclonedx-npm
@@ -167,6 +175,41 @@ stages:
            artifact: bom-frontend
            displayName: 'Publish Frontend BOM'

+      - job: C
+        displayName: Build Test Helpers Package
+        pool:
+          vmImage: "ubuntu-latest"
+        steps:
+          - checkout: self
+            submodules: false
+            lfs: false
+            fetchDepth: 500
+          - template: templates/e2e-install.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              npm_config_cache: ${{ variables.npm_config_cache }}
+          - bash: |
+              echo "##[command]Install nbgv"
+              dotnet tool install --tool-path . nbgv
+              echo "##[command]Running nbgv get-version"
+              PACKAGE_VERSION=$(nbgv get-version -v NpmPackageVersion)
+              echo "##[command]Running npm version"
+              echo "##[debug]Version: $PACKAGE_VERSION"
+              cd tests/Umbraco.Tests.AcceptanceTest
+              npm version $PACKAGE_VERSION --allow-same-version --no-git-tag-version
+            displayName: Set NPM Version
+          - bash: |
+              echo "##[command]Running npm pack"
+              mkdir $(Build.ArtifactStagingDirectory)/npm-testhelpers
+              npm pack --pack-destination $(Build.ArtifactStagingDirectory)/npm-testhelpers
+            displayName: Run npm pack
+            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+          - task: PublishPipelineArtifact@1
+            displayName: Publish Test Helpers npm artifact
+            inputs:
+              targetPath: $(Build.ArtifactStagingDirectory)/npm-testhelpers
+              artifactName: npm-testhelpers
+
  - stage: E2E_BOM
    displayName: E2E Tests BOM Generation
    dependsOn: []
@@ -200,12 +243,22 @@ stages:
    variables:
      umbracoMajorVersion: $[ stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'] ]
    jobs:
-      # C# API Reference
+      # C# API Reference - uses pre-compiled DLLs for faster generation (csproj approach caused timeouts)
      - job:
        displayName: Build C# API Reference
        pool:
          vmImage: "windows-latest"
        steps:
+          - checkout: self
+            submodules: false
+            lfs: false
+            fetchDepth: 1
+            fetchFilter: tree:0
+          - task: DownloadPipelineArtifact@2
+            displayName: Download DocFX DLLs
+            inputs:
+              artifact: csharp-docs-dlls
+              path: $(Build.SourcesDirectory)/src/Umbraco.Cms/bin/Release
          - task: UseDotNet@2
            displayName: Use .NET SDK from global.json
            inputs:
@@ -215,7 +268,7 @@ stages:
            inputs:
              targetType: inline
              script: |
-                dotnet tool install -g docfx
+                dotnet tool install -g docfx --version 2.78.4
                if ($lastexitcode -ne 0){
                    throw ("Error installing DocFX")
                }
@@ -561,7 +614,6 @@ stages:
      UMBRACO__CMS__GLOBAL__VERSIONCHECKPERIOD: 0
      UMBRACO__CMS__GLOBAL__USEHTTPS: true
      UMBRACO__CMS__HEALTHCHECKS__NOTIFICATION__ENABLED: false
-      UMBRACO__CMS__KEEPALIVE__DISABLEKEEPALIVETASK: true
      UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL: https://localhost:44331/
      ASPNETCORE_URLS: https://localhost:44331
    jobs:
@@ -814,12 +866,44 @@ stages:
              npm publish "${files[0]}"
            displayName: Push to npm (MyGet)
            workingDirectory: $(Pipeline.Workspace)/npm
+      - job: PublishTestHelpersNpm
+        displayName: Push TestHelpers to pre-release feed (npm)
+        steps:
+          - checkout: none
+          - download: current
+            artifact: npm-testhelpers
+          - bash: |
+              # Check if we are on a nightly build
+              if [ $isNightly = "False" ]; then
+                  echo "##[debug]Prerelease build detected"
+                  registry="https://www.myget.org/F/umbracoprereleases/npm/"
+              else
+                  echo "##[debug]Nightly build detected"
+                  registry="https://www.myget.org/F/umbraconightly/npm/"
+              fi
+              echo "@umbraco-cms:registry=$registry" >> .npmrc
+            env:
+              isNightly: ${{parameters.isNightly}}
+            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
+            displayName: Add scoped registry to .npmrc
+          - task: npmAuthenticate@0
+            displayName: Authenticate with npm (MyGet)
+            inputs:
+              workingFile: "$(Pipeline.Workspace)/npm-testhelpers/.npmrc"
+              customEndpoint: "MyGet (npm) - Umbracoprereleases, MyGet (npm) - Umbraconightly"
+          - bash: |
+              # Setup temp npm project to load in defaults from the local .npmrc
+              npm init -y
+
+              # Find the first .tgz file in the current directory and publish it
+              files=( ./*.tgz )
+              npm publish "${files[0]}"
+            displayName: Push test helpers to npm (MyGet)
+            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers

  - stage: Deploy_NuGet
    displayName: NuGet release
-    dependsOn:
-      - Deploy_MyGet
-      - Build_Docs
+    dependsOn: Deploy_MyGet
    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.nuGetDeploy}}))
    jobs:
      - job:
@@ -870,6 +954,29 @@ stages:
              npm publish "${files[0]}"
            displayName: Push to npm
            workingDirectory: $(Pipeline.Workspace)/npm
+      - job: PublishTestHelpers
+        displayName: Push Test Helpers to NPM
+        steps:
+          - checkout: none
+          - download: current
+            artifact: npm-testhelpers
+          - bash: echo "@umbraco-cms:registry=https://registry.npmjs.org" >> .npmrc
+            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
+            displayName: Add scoped registry to .npmrc
+          - task: npmAuthenticate@0
+            displayName: Authenticate with npm
+            inputs:
+              workingFile: $(Pipeline.Workspace)/npm-testhelpers/.npmrc
+              customEndpoint: "NPM - Umbraco Backoffice"
+          - script: |
+              # Setup temp npm project to load in defaults from the local .npmrc
+              npm init -y
+
+              # Find the first .tgz file in the current directory and publish it
+              files=( ./*.tgz )
+              npm publish "${files[0]}"
+            displayName: Push test helpers to npm
+            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers

  - stage: Upload_API_Docs
    pool:
@@ -879,6 +986,7 @@ stages:
    displayName: Upload API Documentation
    dependsOn:
      - Build
+      - Build_Docs
      - Deploy_NuGet
    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadApiDocs}}))
    jobs:
@@ -3,17 +3,13 @@
    {
      "src": [
        {
-          "src": "../../src",
+          "src": "../../src/Umbraco.Cms/bin/Release",
          "files": [
-            "**/*.csproj"
+            "**/Umbraco.*.dll"
          ],
          "exclude": [
-            "**/obj/**",
-            "**/bin/**",
-            "**/Umbraco.Web.csproj",
-            "**/Umbraco.Web.UI.csproj",
-            "**/Umbraco.Cms.StaticAssets.csproj",
-            "**/JsonSchema.csproj"
+            "**/Umbraco.Cms.StaticAssets.dll",
+            "**/Umbraco.Cms.Targets.dll"
          ]
        }
      ],
@@ -9,7 +9,7 @@
  <meta name="generator" content="docfx {{_docfxVersion}}">
  {{#_description}}<meta name="description" content="{{_description}}">{{/_description}}
  <link rel="icon" type="image/png" href="https://our.umbraco.com/assets/images/app-icons/favicon.png">
-  <link rel="stylesheet" href="{{_rel}}styles/docfx.vendor.css">
+  <link rel="stylesheet" href="{{_rel}}styles/docfx.vendor.min.css">
  <link rel="stylesheet" href="{{_rel}}styles/docfx.css">
  <link rel="stylesheet" href="{{_rel}}styles/main.css">
  <meta property="docfx:navrel" content="{{_navRel}}">
@@ -54,11 +54,17 @@ steps:
  - pwsh: |
      $sourcePath = "$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/tests/${{ parameters.testFolder }}/AdditionalSetup"
      $destinationPath = "UmbracoProject"
-      $csharpFiles = Get-ChildItem -Path $sourcePath -Filter "*.cs"
+      $csharpFiles = Get-ChildItem -Path $sourcePath -Filter "*.cs" -Recurse
      if ($csharpFiles) {
        $csharpFiles | ForEach-Object {
-          Write-Host "Copying: $($_.FullName)"
-          Copy-Item -Path $_.FullName -Destination $destinationPath -Force
+          $relativePath = $_.FullName.Substring($sourcePath.Length + 1)
+          $targetPath = Join-Path -Path $destinationPath -ChildPath $relativePath
+          $targetDir = Split-Path -Path $targetPath -Parent
+          if (-not (Test-Path -Path $targetDir)) {
+            New-Item -ItemType Directory -Path $targetDir -Force | Out-Null
+          }
+          Write-Host "Copying: $($_.FullName) -> $targetPath"
+          Copy-Item -Path $_.FullName -Destination $targetPath -Force
        }
      } else {
        Write-Host "No C# files found."
@@ -44,7 +44,7 @@ steps:
      $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
      dotnet new nugetconfig
      dotnet nuget add source ./nupkg --name Local
-      dotnet new install Umbraco.Templates::$cmsVersion
-      dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
+      dotnet new install Umbraco.Templates@$cmsVersion
+      dotnet new umbraco --name UmbracoProject --exclude-gitignore --no-restore --no-update-check
    displayName: Install Template
    workingDirectory: $(Agent.BuildDirectory)/app
@@ -4,12 +4,10 @@ pr: none
 trigger: none

 schedules:
-  - cron: '0 0 * * *'
-    displayName: Daily midnight build
+  - cron: '0 3 * * *'
+    displayName: Daily 3AM build (main)
    branches:
      include:
-        - v15/dev
-        - v16/dev
        - main

 parameters:
@@ -321,7 +319,8 @@ stages:

  - stage: DefaultConfigE2E
    displayName: Default Config E2E Tests
-    dependsOn: Build
+    dependsOn: Integration
+    condition: always()
    variables:
      npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
      # Enable console logging in Release mode
@@ -340,7 +339,6 @@ stages:
      UMBRACO__CMS__GLOBAL__VERSIONCHECKPERIOD: 0
      UMBRACO__CMS__GLOBAL__USEHTTPS: true
      UMBRACO__CMS__HEALTHCHECKS__NOTIFICATION__ENABLED: false
-      UMBRACO__CMS__KEEPALIVE__DISABLEKEEPALIVETASK: true
      UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL: https://localhost:44331/
      ASPNETCORE_URLS: https://localhost:44331
    jobs:
@@ -502,7 +500,8 @@ stages:

  - stage: AdditionalConfigE2E
    displayName: Additional Config E2E Tests
-    dependsOn: Build
+    dependsOn: DefaultConfigE2E
+    condition: always()
    variables:
      npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
      ASPNETCORE_URLS: https://localhost:44331
@@ -10,6 +10,7 @@ schedules:
    include:
    - v13/dev
    - v16/dev
+    - v18/dev
    - main

 steps:
@@ -29,7 +29,7 @@ steps:
      "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
      UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
      URL=${{ parameters.ASPNETCORE_URLS }}
-      STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
+      STORAGE_STATE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
      CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
    displayName: Generate .env
    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
@@ -47,3 +47,7 @@ steps:
  - script: npm ci --no-fund --no-audit --prefer-offline
    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
    displayName: Restore NPM packages
+
+  - script: npm run build
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+    displayName: Build test helpers
@@ -1,10 +1,17 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Umbraco.Cms.Core.DeliveryApi;

 namespace Umbraco.Cms.Api.Common.Accessors;

+/// <summary>
+///     Provides access to the <see cref="IOutputExpansionStrategy"/> for the current HTTP request context.
+/// </summary>
 public sealed class RequestContextOutputExpansionStrategyAccessor : RequestContextServiceAccessorBase<IOutputExpansionStrategy>, IOutputExpansionStrategyAccessor
 {
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="RequestContextOutputExpansionStrategyAccessor"/> class.
+    /// </summary>
+    /// <param name="httpContextAccessor">The HTTP context accessor.</param>
    public RequestContextOutputExpansionStrategyAccessor(IHttpContextAccessor httpContextAccessor)
        : base(httpContextAccessor)
    {
@@ -1,17 +1,30 @@
-using System.Diagnostics.CodeAnalysis;
+using System.Diagnostics.CodeAnalysis;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection;

 namespace Umbraco.Cms.Api.Common.Accessors;

+/// <summary>
+///     Base class for accessing request-scoped services from the current HTTP context.
+/// </summary>
+/// <typeparam name="T">The type of service to access.</typeparam>
 public abstract class RequestContextServiceAccessorBase<T>
    where T : class
 {
    private readonly IHttpContextAccessor _httpContextAccessor;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="RequestContextServiceAccessorBase{T}"/> class.
+    /// </summary>
+    /// <param name="httpContextAccessor">The HTTP context accessor.</param>
    protected RequestContextServiceAccessorBase(IHttpContextAccessor httpContextAccessor)
        => _httpContextAccessor = httpContextAccessor;

+    /// <summary>
+    ///     Attempts to retrieve the service from the current HTTP context's request services.
+    /// </summary>
+    /// <param name="requestStartNodeService">When this method returns, contains the service instance if found; otherwise, <c>null</c>.</param>
+    /// <returns><c>true</c> if the service was found; otherwise, <c>false</c>.</returns>
    public bool TryGetValue([NotNullWhen(true)] out T? requestStartNodeService)
    {
        requestStartNodeService = _httpContextAccessor.HttpContext?.RequestServices.GetService<T>();
@@ -1,9 +1,19 @@
 namespace Umbraco.Cms.Api.Common.Attributes;

+/// <summary>
+///     Attribute used to map a class to a specific API for OpenAPI documentation generation.
+/// </summary>
 [AttributeUsage(AttributeTargets.Class, AllowMultiple = false)]
 public class MapToApiAttribute : Attribute
 {
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="MapToApiAttribute"/> class.
+    /// </summary>
+    /// <param name="apiName">The name of the API to map to.</param>
    public MapToApiAttribute(string apiName) => ApiName = apiName;

+    /// <summary>
+    ///     Gets the name of the API this class is mapped to.
+    /// </summary>
    public string ApiName { get; }
 }
@@ -1,9 +1,12 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.Builders;

+/// <summary>
+///     A fluent builder for creating RFC 7807 <see cref="ProblemDetails"/> responses.
+/// </summary>
 public class ProblemDetailsBuilder
 {
    private string? _title;
@@ -12,24 +15,45 @@ public class ProblemDetailsBuilder
    private string? _operationStatus;
    private IDictionary<string, object>? _extensions;

+    /// <summary>
+    ///     Sets the title of the problem details.
+    /// </summary>
+    /// <param name="title">A short, human-readable summary of the problem type.</param>
+    /// <returns>The current builder instance for method chaining.</returns>
    public ProblemDetailsBuilder WithTitle(string title)
    {
        _title = title;
        return this;
    }

+    /// <summary>
+    ///     Sets the detail of the problem details.
+    /// </summary>
+    /// <param name="detail">A human-readable explanation specific to this occurrence of the problem.</param>
+    /// <returns>The current builder instance for method chaining.</returns>
    public ProblemDetailsBuilder WithDetail(string detail)
    {
        _detail = detail;
        return this;
    }

+    /// <summary>
+    ///     Sets the type of the problem details.
+    /// </summary>
+    /// <param name="type">A URI reference that identifies the problem type.</param>
+    /// <returns>The current builder instance for method chaining.</returns>
    public ProblemDetailsBuilder WithType(string type)
    {
        _type = type;
        return this;
    }

+    /// <summary>
+    ///     Sets the operation status from an enum value.
+    /// </summary>
+    /// <typeparam name="TEnum">The enum type representing operation statuses.</typeparam>
+    /// <param name="operationStatus">The operation status enum value.</param>
+    /// <returns>The current builder instance for method chaining.</returns>
    public ProblemDetailsBuilder WithOperationStatus<TEnum>(TEnum operationStatus)
        where TEnum : Enum
    {
@@ -37,9 +61,20 @@ public class ProblemDetailsBuilder
        return this;
    }

+    /// <summary>
+    ///     Adds request model validation errors to the problem details.
+    /// </summary>
+    /// <param name="errors">A dictionary of field names to error messages.</param>
+    /// <returns>The current builder instance for method chaining.</returns>
    public ProblemDetailsBuilder WithRequestModelErrors(IDictionary<string, string[]> errors)
        => WithExtension(nameof(HttpValidationProblemDetails.Errors).ToFirstLowerInvariant(), errors);

+    /// <summary>
+    ///     Adds a custom extension to the problem details.
+    /// </summary>
+    /// <param name="key">The extension key.</param>
+    /// <param name="value">The extension value.</param>
+    /// <returns>The current builder instance for method chaining.</returns>
    public ProblemDetailsBuilder WithExtension(string key, object value)
    {
        _extensions ??= new Dictionary<string, object>();
@@ -47,6 +82,10 @@ public class ProblemDetailsBuilder
        return this;
    }

+    /// <summary>
+    ///     Builds the <see cref="ProblemDetails"/> instance with all configured values.
+    /// </summary>
+    /// <returns>A new <see cref="ProblemDetails"/> instance.</returns>
    public ProblemDetails Build()
    {
        var problemDetails = new ProblemDetails
@@ -1,10 +1,14 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;

 namespace Umbraco.Cms.Api.Common.Configuration;

+/// <summary>
+///     Configures <see cref="ApiBehaviorOptions"/> for Umbraco APIs.
+/// </summary>
 public class ConfigureApiBehaviorOptions : IConfigureOptions<ApiBehaviorOptions>
 {
+    /// <inheritdoc/>
    public void Configure(ApiBehaviorOptions options) =>
        // disable ProblemDetails as default result type for every non-success response (i.e. 404)
        // - see https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.mvc.apibehavioroptions.suppressmapclienterrors
@@ -5,12 +5,21 @@ using Umbraco.Cms.Api.Common.Json;

 namespace Umbraco.Cms.Api.Common.Configuration;

+/// <summary>
+///     Configures <see cref="MvcOptions"/> with named JSON input and output formatters for Umbraco APIs.
+/// </summary>
 public class ConfigureMvcJsonOptions : IConfigureOptions<MvcOptions>
 {
    private readonly string _jsonOptionsName;
    private readonly IOptionsMonitor<JsonOptions> _jsonOptions;
    private readonly ILoggerFactory _loggerFactory;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="ConfigureMvcJsonOptions"/> class.
+    /// </summary>
+    /// <param name="jsonOptionsName">The name of the JSON options configuration to use.</param>
+    /// <param name="jsonOptions">The JSON options monitor.</param>
+    /// <param name="loggerFactory">The logger factory.</param>
    public ConfigureMvcJsonOptions(
        string jsonOptionsName,
        IOptionsMonitor<JsonOptions> jsonOptions,
@@ -21,6 +30,7 @@ public class ConfigureMvcJsonOptions : IConfigureOptions<MvcOptions>
        _loggerFactory = loggerFactory;
    }

+    /// <inheritdoc/>
    public void Configure(MvcOptions options)
    {
        JsonOptions jsonOptions = _jsonOptions.Get(_jsonOptionsName);
@@ -4,12 +4,24 @@ using Umbraco.Cms.Core.Configuration.Models;

 namespace Umbraco.Cms.Api.Common.Configuration;

+/// <summary>
+///     Configures OpenIddict server options for Umbraco authentication.
+/// </summary>
+/// <remarks>
+///     Disables transport security requirement when HTTPS is not configured in global settings.
+///     Warning: This should only be used in development environments.
+/// </remarks>
 internal sealed class ConfigureOpenIddict : IConfigureOptions<OpenIddictServerAspNetCoreOptions>
 {
    private readonly IOptions<GlobalSettings> _globalSettings;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="ConfigureOpenIddict"/> class.
+    /// </summary>
+    /// <param name="globalSettings">The global settings options.</param>
    public ConfigureOpenIddict(IOptions<GlobalSettings> globalSettings) => _globalSettings = globalSettings;

+    /// <inheritdoc/>
    public void Configure(OpenIddictServerAspNetCoreOptions options)
        => options.DisableTransportSecurityRequirement = _globalSettings.Value.UseHttps is false;
 }
@@ -8,6 +8,9 @@ using Umbraco.Cms.Core.DependencyInjection;

 namespace Umbraco.Cms.Api.Common.Configuration;

+/// <summary>
+///     Configures Swagger/OpenAPI generation options for Umbraco APIs.
+/// </summary>
 public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
 {
    private readonly IOperationIdSelector _operationIdSelector;
@@ -15,6 +18,13 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
    private readonly ISubTypesSelector _subTypesSelector;
    private readonly IDocumentInclusionSelector _documentInclusionSelector;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="ConfigureUmbracoSwaggerGenOptions"/> class.
+    /// </summary>
+    /// <param name="operationIdSelector">The operation ID selector.</param>
+    /// <param name="schemaIdSelector">The schema ID selector.</param>
+    /// <param name="subTypesSelector">The sub-types selector for polymorphism support.</param>
+    /// <param name="documentInclusionSelector">The document inclusion selector.</param>
    public ConfigureUmbracoSwaggerGenOptions(
        IOperationIdSelector operationIdSelector,
        ISchemaIdSelector schemaIdSelector,
@@ -27,6 +37,12 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
        _documentInclusionSelector = documentInclusionSelector;
    }

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="ConfigureUmbracoSwaggerGenOptions"/> class.
+    /// </summary>
+    /// <param name="operationIdSelector">The operation ID selector.</param>
+    /// <param name="schemaIdSelector">The schema ID selector.</param>
+    /// <param name="subTypesSelector">The sub-types selector for polymorphism support.</param>
    [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
    public ConfigureUmbracoSwaggerGenOptions(
        IOperationIdSelector operationIdSelector,
@@ -40,6 +56,7 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
    {
    }

+    /// <inheritdoc/>
    public void Configure(SwaggerGenOptions swaggerGenOptions)
    {
        swaggerGenOptions.SwaggerDoc(
@@ -64,7 +81,14 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
        swaggerGenOptions.SupportNonNullableReferenceTypes();
    }

-    // see https://github.com/domaindrivendev/Swashbuckle.AspNetCore#change-operation-sort-order-eg-for-ui-sorting
+    /// <summary>
+    ///     Generates a sort key for API actions.
+    /// </summary>
+    /// <param name="apiDesc">The API description.</param>
+    /// <returns>A string used to sort API operations in the documentation.</returns>
+    /// <remarks>
+    ///     See https://github.com/domaindrivendev/Swashbuckle.AspNetCore#change-operation-sort-order-eg-for-ui-sorting.
+    /// </remarks>
    private static string ActionOrderBy(ApiDescription apiDesc)
        => $"{apiDesc.GroupName}_{apiDesc.ActionDescriptor.AttributeRouteInfo?.Template ?? apiDesc.ActionDescriptor.RouteValues["controller"]}_{(apiDesc.ActionDescriptor.RouteValues.TryGetValue("action", out var action) ? action : null)}_{apiDesc.HttpMethod}";
 }
@@ -1,6 +1,12 @@
 namespace Umbraco.Cms.Api.Common.Configuration;

+/// <summary>
+///     Contains default configuration values for the API.
+/// </summary>
 internal static class DefaultApiConfiguration
 {
+    /// <summary>
+    ///     The default API name used for endpoints not assigned to a specific API.
+    /// </summary>
    public const string ApiName = "default";
 }
@@ -1,7 +1,10 @@
 using System.Diagnostics.CodeAnalysis;
+using System.Security.Cryptography;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
+using OpenIddict.Abstractions;
 using OpenIddict.Server;
 using OpenIddict.Validation;
 using Umbraco.Cms.Core;
@@ -13,10 +16,19 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.DependencyInjection;

+/// <summary>
+///     Handles secure storage of back-office authentication tokens in HTTP-only cookies.
+/// </summary>
+/// <remarks>
+///     This handler intercepts OpenIddict token responses for the back-office client and stores
+///     access tokens, refresh tokens, and PKCE codes in encrypted HTTP-only cookies. The tokens
+///     are redacted from the response to prevent client-side JavaScript access.
+/// </remarks>
 internal sealed class HideBackOfficeTokensHandler
    : IOpenIddictServerHandler<OpenIddictServerEvents.ApplyTokenResponseContext>,
        IOpenIddictServerHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>,
        IOpenIddictServerHandler<OpenIddictServerEvents.ExtractTokenRequestContext>,
+        IOpenIddictServerHandler<OpenIddictServerEvents.ExtractRevocationRequestContext>,
        IOpenIddictValidationHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>,
        INotificationHandler<UserLogoutSuccessNotification>
 {
@@ -25,25 +37,44 @@ internal sealed class HideBackOfficeTokensHandler
    // The __Host- prefix enforces secure cookies at browser level (requires Secure, Path=/, no Domain).
    // For local development over HTTP, we use a simpler prefix to avoid browser rejection.
    private const string SecureCookiePrefix = "__Host-";
-    private const string AccessTokenCookieName = "umbAccessToken";
-    private const string RefreshTokenCookieName = "umbRefreshToken";
-    private const string PkceCodeCookieName = "umbPkceCode";
+    private readonly string _accessTokenCookieName = "umbAccessToken";
+    private readonly string _refreshTokenCookieName = "umbRefreshToken";
+    private readonly string _pkceCodeCookieName = "umbPkceCode";

    private readonly IHttpContextAccessor _httpContextAccessor;
    private readonly IDataProtectionProvider _dataProtectionProvider;
+    private readonly ILogger<HideBackOfficeTokensHandler> _logger;
+#pragma warning disable CS0618 // Type or member is obsolete
    private readonly BackOfficeTokenCookieSettings _backOfficeTokenCookieSettings;
+#pragma warning restore CS0618 // Type or member is obsolete
    private readonly GlobalSettings _globalSettings;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="HideBackOfficeTokensHandler"/> class.
+    /// </summary>
+    /// <param name="httpContextAccessor">The HTTP context accessor.</param>
+    /// <param name="dataProtectionProvider">The data protection provider for encrypting cookie values.</param>
+    /// <param name="logger">The logger.</param>
+    /// <param name="backOfficeTokenCookieSettings">The back-office token cookie settings.</param>
+    /// <param name="globalSettings">The global settings.</param>
    public HideBackOfficeTokensHandler(
        IHttpContextAccessor httpContextAccessor,
        IDataProtectionProvider dataProtectionProvider,
+        ILogger<HideBackOfficeTokensHandler> logger,
+#pragma warning disable CS0618 // Type or member is obsolete
        IOptions<BackOfficeTokenCookieSettings> backOfficeTokenCookieSettings,
+#pragma warning restore CS0618 // Type or member is obsolete
        IOptions<GlobalSettings> globalSettings)
    {
        _httpContextAccessor = httpContextAccessor;
        _dataProtectionProvider = dataProtectionProvider;
+        _logger = logger;
        _backOfficeTokenCookieSettings = backOfficeTokenCookieSettings.Value;
        _globalSettings = globalSettings.Value;
+
+        _accessTokenCookieName += _backOfficeTokenCookieSettings.SiteName;
+        _refreshTokenCookieName += _backOfficeTokenCookieSettings.SiteName;
+        _pkceCodeCookieName += _backOfficeTokenCookieSettings.SiteName;
    }

    /// <summary>
@@ -63,13 +94,13 @@ internal sealed class HideBackOfficeTokensHandler

        if (context.Response.AccessToken is not null)
        {
-            SetCookie(httpContext, AccessTokenCookieName, context.Response.AccessToken);
+            SetCookie(httpContext, _accessTokenCookieName, context.Response.AccessToken);
            context.Response.AccessToken = RedactedTokenValue;
        }

        if (context.Response.RefreshToken is not null)
        {
-            SetCookie(httpContext, RefreshTokenCookieName, context.Response.RefreshToken);
+            SetCookie(httpContext, _refreshTokenCookieName, context.Response.RefreshToken);
            context.Response.RefreshToken = RedactedTokenValue;
        }

@@ -91,7 +122,7 @@ internal sealed class HideBackOfficeTokensHandler

        if (context.Response.Code is not null)
        {
-            SetCookie(GetHttpContext(), PkceCodeCookieName, context.Response.Code);
+            SetCookie(GetHttpContext(), _pkceCodeCookieName, context.Response.Code);
            context.Response.Code = RedactedTokenValue;
        }

@@ -113,12 +144,12 @@ internal sealed class HideBackOfficeTokensHandler

        // Handle when the PKCE code is being exchanged for an access token.
        if (context.Request.Code == RedactedTokenValue
-            && TryGetCookie(httpContext, PkceCodeCookieName, out var code))
+            && TryGetCookie(httpContext, _pkceCodeCookieName, out var code))
        {
            context.Request.Code = code;

            // We won't need the PKCE cookie after this, let's remove it.
-            RemoveCookie(httpContext, PkceCodeCookieName);
+            RemoveCookie(httpContext, _pkceCodeCookieName);
        }
        else
        {
@@ -129,7 +160,7 @@ internal sealed class HideBackOfficeTokensHandler

        // Handle when a refresh token is being exchanged for a new access token.
        if (context.Request.RefreshToken == RedactedTokenValue
-            && TryGetCookie(httpContext, RefreshTokenCookieName, out var refreshToken))
+            && TryGetCookie(httpContext, _refreshTokenCookieName, out var refreshToken))
        {
            context.Request.RefreshToken = refreshToken;
        }
@@ -144,6 +175,40 @@ internal sealed class HideBackOfficeTokensHandler
        return ValueTask.CompletedTask;
    }

+    /// <summary>
+    /// This is invoked when a token revocation request is received.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ExtractRevocationRequestContext context)
+    {
+        if (context.Request?.ClientId != Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        HttpContext httpContext = GetHttpContext();
+
+        // Determine which cookie to read based on the token type hint.
+        var cookieName = context.Request.TokenTypeHint == OpenIddictConstants.TokenTypeHints.RefreshToken
+            ? _refreshTokenCookieName
+            : _accessTokenCookieName;
+
+        if (context.Request.Token == RedactedTokenValue
+            && TryGetCookie(httpContext, cookieName, out var token))
+        {
+            context.Request.Token = token;
+        }
+        else
+        {
+            // If we got here, either the token was not redacted, or nothing was found in the expected cookie.
+            // If OpenIddict found a token, it could be an old token that is potentially still valid. For security
+            // reasons, we cannot accept that; at this point, we expect the tokens to be explicitly redacted.
+            context.Request.Token = null;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
    /// <summary>
    /// This is invoked when extracting the auth context for a client request.
    /// </summary>
@@ -155,7 +220,7 @@ internal sealed class HideBackOfficeTokensHandler
            return ValueTask.CompletedTask;
        }

-        if (TryGetCookie(GetHttpContext(), AccessTokenCookieName, out var accessToken))
+        if (TryGetCookie(GetHttpContext(), _accessTokenCookieName, out var accessToken))
        {
            context.AccessToken = accessToken;
        }
@@ -163,6 +228,7 @@ internal sealed class HideBackOfficeTokensHandler
        return ValueTask.CompletedTask;
    }

+    /// <inheritdoc/>
    public void Handle(UserLogoutSuccessNotification notification)
    {
        HttpContext? httpContext = _httpContextAccessor.HttpContext;
@@ -174,8 +240,8 @@ internal sealed class HideBackOfficeTokensHandler
            return;
        }

-        RemoveCookie(httpContext, AccessTokenCookieName);
-        RemoveCookie(httpContext, RefreshTokenCookieName);
+        RemoveCookie(httpContext, _accessTokenCookieName);
+        RemoveCookie(httpContext, _refreshTokenCookieName);
    }

    private HttpContext GetHttpContext()
@@ -231,8 +297,19 @@ internal sealed class HideBackOfficeTokensHandler
        var key = GetCookieKey(httpContext, cookieName);
        if (httpContext.Request.Cookies.TryGetValue(key, out var cookieValue))
        {
-            value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
-            return true;
+            try
+            {
+                value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
+                return true;
+            }
+            catch (CryptographicException ex)
+            {
+                // Decryption can fail if the data protection key ring has changed
+                // (e.g., after deployment, app pool recycle, or slot swap).
+                // Treat this as a missing cookie — the user will need to re-authenticate.
+                _logger.LogWarning(ex, "Failed to decrypt back-office token cookie '{CookieName}'. The user will need to re-authenticate.", cookieName);
+                RemoveCookie(httpContext, cookieName);
+            }
        }

        value = null;
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
@@ -6,8 +6,18 @@ using Umbraco.Cms.Api.Common.Configuration;

 namespace Umbraco.Cms.Api.Common.DependencyInjection;

+/// <summary>
+///     Extension methods for <see cref="IMvcBuilder"/>.
+/// </summary>
 public static class MvcBuilderExtensions
 {
+    /// <summary>
+    ///     Adds named JSON serialization options to the MVC builder.
+    /// </summary>
+    /// <param name="builder">The MVC builder.</param>
+    /// <param name="settingsName">The name for the JSON options configuration.</param>
+    /// <param name="configure">The action to configure the JSON options.</param>
+    /// <returns>The MVC builder for method chaining.</returns>
    public static IMvcBuilder AddJsonOptions(this IMvcBuilder builder, string settingsName, Action<JsonOptions> configure)
    {
        builder.Services.Configure(settingsName, configure);
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using OpenIddict.Server;
 using OpenIddict.Validation;
 using Umbraco.Cms.Core;
@@ -6,12 +6,23 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.DependencyInjection;

+/// <summary>
+///     Handles OpenIddict request processing to skip handling for non-authentication requests.
+/// </summary>
+/// <remarks>
+///     This handler prevents OpenIddict from processing every request to the server,
+///     limiting its scope to back-office and well-known OpenID Connect endpoints.
+/// </remarks>
 public class ProcessRequestContextHandler
    : IOpenIddictServerHandler<OpenIddictServerEvents.ProcessRequestContext>, IOpenIddictValidationHandler<OpenIddictValidationEvents.ProcessRequestContext>
 {
    private readonly IHttpContextAccessor _httpContextAccessor;
    private readonly string[] _pathsToHandle;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="ProcessRequestContextHandler"/> class.
+    /// </summary>
+    /// <param name="httpContextAccessor">The HTTP context accessor.</param>
    public ProcessRequestContextHandler(IHttpContextAccessor httpContextAccessor)
    {
        _httpContextAccessor = httpContextAccessor;
@@ -21,6 +32,11 @@ public class ProcessRequestContextHandler
        _pathsToHandle = [backOfficePathSegment, "/.well-known/openid-configuration", "/.well-known/jwks"];
    }

+    /// <summary>
+    ///     Handles the server process request context event.
+    /// </summary>
+    /// <param name="context">The process request context.</param>
+    /// <returns>A <see cref="ValueTask"/> representing the asynchronous operation.</returns>
    public ValueTask HandleAsync(OpenIddictServerEvents.ProcessRequestContext context)
    {
        if (SkipOpenIddictHandlingForRequest())
@@ -31,6 +47,11 @@ public class ProcessRequestContextHandler
        return ValueTask.CompletedTask;
    }

+    /// <summary>
+    ///     Handles the validation process request context event.
+    /// </summary>
+    /// <param name="context">The process request context.</param>
+    /// <returns>A <see cref="ValueTask"/> representing the asynchronous operation.</returns>
    public ValueTask HandleAsync(OpenIddictValidationEvents.ProcessRequestContext context)
    {
        if (SkipOpenIddictHandlingForRequest())
@@ -7,8 +7,16 @@ using Umbraco.Cms.Web.Common.ApplicationBuilder;

 namespace Umbraco.Cms.Api.Common.DependencyInjection;

+/// <summary>
+///     Extension methods for <see cref="IUmbracoBuilder"/> to configure API services.
+/// </summary>
 public static class UmbracoBuilderApiExtensions
 {
+    /// <summary>
+    ///     Adds Umbraco API OpenAPI/Swagger UI services to the builder.
+    /// </summary>
+    /// <param name="builder">The Umbraco builder.</param>
+    /// <returns>The Umbraco builder for method chaining.</returns>
    public static IUmbracoBuilder AddUmbracoApiOpenApiUI(this IUmbracoBuilder builder)
    {
        if (builder.Services.Any(x => !x.IsKeyedService && x.ImplementationType == typeof(OperationIdSelector)))
@@ -9,14 +9,26 @@ using Umbraco.Cms.Api.Common.Security;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Notifications;
 using Umbraco.Cms.Infrastructure.BackgroundJobs;
 using Umbraco.Cms.Infrastructure.BackgroundJobs.Jobs.DistributedJobs;
-using Umbraco.Cms.Core.Notifications;

 namespace Umbraco.Cms.Api.Common.DependencyInjection;

+/// <summary>
+///     Extension methods for <see cref="IUmbracoBuilder"/> to configure authentication services.
+/// </summary>
 public static class UmbracoBuilderAuthExtensions
 {
+    /// <summary>
+    ///     Adds OpenIddict authentication services for Umbraco APIs.
+    /// </summary>
+    /// <param name="builder">The Umbraco builder.</param>
+    /// <returns>The Umbraco builder for method chaining.</returns>
+    /// <remarks>
+    ///     Configures OpenIddict with authorization code flow (with PKCE), client credentials flow,
+    ///     reference tokens, and ASP.NET Core Data Protection for token encryption.
+    /// </remarks>
    public static IUmbracoBuilder AddUmbracoOpenIddict(this IUmbracoBuilder builder)
    {
        if (builder.Services.Any(x => !x.IsKeyedService && x.ImplementationType == typeof(OpenIddictCleanupJob)) is false)
@@ -133,6 +145,12 @@ public static class UmbracoBuilderAuthExtensions
                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ExtractPostRequest<OpenIddictServerEvents.ExtractTokenRequestContext>.Descriptor.Order + 1);
                });
+                options.AddEventHandler<OpenIddictServerEvents.ExtractRevocationRequestContext>(configuration =>
+                {
+                    configuration
+                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ExtractPostRequest<OpenIddictServerEvents.ExtractRevocationRequestContext>.Descriptor.Order + 1);
+                });
            })

            // Register the OpenIddict validation components.
@@ -33,4 +33,4 @@ public static class ActionDescriptorApiCommonExtensions

        return mapToApiAttributes.SingleOrDefault()?.ApiName;
    }
-}
+}
@@ -5,9 +5,16 @@ using Umbraco.Cms.Api.Common.Configuration;

 namespace Umbraco.Extensions;

+/// <summary>
+///     Extension methods for <see cref="MethodInfo"/> to work with API-related attributes.
+/// </summary>
 public static class MethodInfoApiCommonExtensions
 {
-
+    /// <summary>
+    ///     Gets the API version values from <see cref="MapToApiVersionAttribute"/> applied to the method.
+    /// </summary>
+    /// <param name="methodInfo">The method info to inspect.</param>
+    /// <returns>A pipe-separated string of API version values.</returns>
    public static string GetMapToApiVersionAttributeValue(this MethodInfo methodInfo)
    {
        MapToApiVersionAttribute[] mapToApis = methodInfo.GetCustomAttributes(typeof(MapToApiVersionAttribute), inherit: true).Cast<MapToApiVersionAttribute>().ToArray();
@@ -15,6 +22,11 @@ public static class MethodInfoApiCommonExtensions
        return string.Join("|", mapToApis.SelectMany(x => x.Versions));
    }

+    /// <summary>
+    ///     Gets the API name from <see cref="MapToApiAttribute"/> applied to the method's declaring type.
+    /// </summary>
+    /// <param name="methodInfo">The method info to inspect.</param>
+    /// <returns>The API name if the attribute is present; otherwise, <c>null</c>.</returns>
    public static string? GetMapToApiAttributeValue(this MethodInfo methodInfo)
    {
        MapToApiAttribute[] mapToApis = (methodInfo.DeclaringType?.GetCustomAttributes(typeof(MapToApiAttribute), inherit: true) ?? Array.Empty<object>()).Cast<MapToApiAttribute>().ToArray();
@@ -22,6 +34,15 @@ public static class MethodInfoApiCommonExtensions
        return mapToApis.SingleOrDefault()?.ApiName;
    }

+    /// <summary>
+    ///     Determines whether the method's declaring type has a <see cref="MapToApiAttribute"/> with the specified API name.
+    /// </summary>
+    /// <param name="methodInfo">The method info to inspect.</param>
+    /// <param name="apiName">The API name to check for.</param>
+    /// <returns>
+    ///     <c>true</c> if the attribute is present and matches the specified API name,
+    ///     or if the attribute is not present and the API name matches the default API name; otherwise, <c>false</c>.
+    /// </returns>
    public static bool HasMapToApiAttribute(this MethodInfo methodInfo, string apiName)
    {
        var value = methodInfo.GetMapToApiAttributeValue();
@@ -1,9 +1,19 @@
-namespace Umbraco.Cms.Api.Common.Filters;
+namespace Umbraco.Cms.Api.Common.Filters;

+/// <summary>
+///     Attribute used to specify the named JSON serialization options for a controller.
+/// </summary>
 [AttributeUsage(AttributeTargets.Class)]
 public class JsonOptionsNameAttribute : Attribute
 {
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="JsonOptionsNameAttribute"/> class.
+    /// </summary>
+    /// <param name="jsonOptionsName">The name of the JSON options configuration to use.</param>
    public JsonOptionsNameAttribute(string jsonOptionsName) => JsonOptionsName = jsonOptionsName;

+    /// <summary>
+    ///     Gets the name of the JSON options configuration.
+    /// </summary>
    public string JsonOptionsName { get; }
 }
@@ -1,10 +1,18 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Umbraco.Cms.Api.Common.Filters;

 namespace Umbraco.Cms.Api.Common.Json;

+/// <summary>
+///     Extension methods for <see cref="HttpContext"/> related to JSON serialization.
+/// </summary>
 public static class HttpContextJsonExtensions
 {
+    /// <summary>
+    ///     Gets the named JSON options configuration for the current endpoint.
+    /// </summary>
+    /// <param name="context">The HTTP context.</param>
+    /// <returns>The JSON options name if specified via <see cref="JsonOptionsNameAttribute"/>; otherwise, <c>null</c>.</returns>
    public static string? CurrentJsonOptionsName(this HttpContext context)
        => context.GetEndpoint()?.Metadata.GetMetadata<JsonOptionsNameAttribute>()?.JsonOptionsName;
 }
@@ -1,20 +1,31 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Formatters;
 using Microsoft.Extensions.Logging;

 namespace Umbraco.Cms.Api.Common.Json;

+/// <summary>
+///     A JSON input formatter that only processes requests for endpoints with matching named JSON options.
+/// </summary>
 internal sealed class NamedSystemTextJsonInputFormatter : SystemTextJsonInputFormatter
 {
    private readonly string _jsonOptionsName;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="NamedSystemTextJsonInputFormatter"/> class.
+    /// </summary>
+    /// <param name="jsonOptionsName">The name of the JSON options configuration this formatter handles.</param>
+    /// <param name="options">The JSON options.</param>
+    /// <param name="logger">The logger.</param>
    public NamedSystemTextJsonInputFormatter(string jsonOptionsName, JsonOptions options, ILogger<NamedSystemTextJsonInputFormatter> logger)
        : base(options, logger) =>
        _jsonOptionsName = jsonOptionsName;

+    /// <inheritdoc/>
    public override bool CanRead(InputFormatterContext context)
        => context.HttpContext.CurrentJsonOptionsName() == _jsonOptionsName && base.CanRead(context);

+    /// <inheritdoc/>
    public override async Task<InputFormatterResult> ReadAsync(InputFormatterContext context)
    {
        try
@@ -1,17 +1,26 @@
-using System.Text.Json;
+using System.Text.Json;
 using Microsoft.AspNetCore.Mvc.Formatters;

 namespace Umbraco.Cms.Api.Common.Json;

+/// <summary>
+///     A JSON output formatter that only processes responses for endpoints with matching named JSON options.
+/// </summary>
 internal sealed class NamedSystemTextJsonOutputFormatter : SystemTextJsonOutputFormatter
 {
    private readonly string _jsonOptionsName;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="NamedSystemTextJsonOutputFormatter"/> class.
+    /// </summary>
+    /// <param name="jsonOptionsName">The name of the JSON options configuration this formatter handles.</param>
+    /// <param name="jsonSerializerOptions">The JSON serializer options.</param>
    public NamedSystemTextJsonOutputFormatter(string jsonOptionsName, JsonSerializerOptions jsonSerializerOptions) : base(jsonSerializerOptions)
    {
        _jsonOptionsName = jsonOptionsName;
    }

+    /// <inheritdoc/>
    public override bool CanWriteResult(OutputFormatterCanWriteContext context)
        => context.HttpContext.CurrentJsonOptionsName() == _jsonOptionsName && base.CanWriteResult(context);
 }
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Routing;
 using Microsoft.Extensions.DependencyInjection;
@@ -16,6 +16,13 @@ public sealed class EmptyCreatedAtActionResult : ActionResult
    private readonly object _routeValues;
    private readonly string _resourceIdentifier;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="EmptyCreatedAtActionResult"/> class.
+    /// </summary>
+    /// <param name="actionName">The name of the action to generate the URL for.</param>
+    /// <param name="controllerName">The name of the controller to generate the URL for.</param>
+    /// <param name="routeValues">The route values to use for URL generation.</param>
+    /// <param name="resourceIdentifier">The identifier of the created resource.</param>
    public EmptyCreatedAtActionResult(string actionName, string controllerName, object routeValues, string resourceIdentifier)
    {
        _actionName = actionName;
@@ -24,6 +31,7 @@ public sealed class EmptyCreatedAtActionResult : ActionResult
        _resourceIdentifier = resourceIdentifier;
    }

+    /// <inheritdoc/>
    public override void ExecuteResult(ActionContext context)
    {
        ArgumentNullException.ThrowIfNull(context);
@@ -1,4 +1,4 @@
-using System.Reflection;
+using System.Reflection;
 using System.Runtime.Serialization;
 using System.Text.Json.Nodes;
 using Microsoft.OpenApi;
@@ -6,8 +6,16 @@ using Swashbuckle.AspNetCore.SwaggerGen;

 namespace Umbraco.Cms.Api.Common.OpenApi;

+/// <summary>
+///     A schema filter that converts enum schemas to string type with enum member names.
+/// </summary>
+/// <remarks>
+///     This filter ensures enums are represented as strings in the OpenAPI schema,
+///     using <see cref="EnumMemberAttribute"/> values when available.
+/// </remarks>
 public class EnumSchemaFilter : ISchemaFilter
 {
+    /// <inheritdoc/>
    public void Apply(IOpenApiSchema model, SchemaFilterContext context)
    {
        if (model is not OpenApiSchema schema || context.Type.IsEnum is false)
@@ -2,9 +2,22 @@ using Microsoft.AspNetCore.Mvc.ApiExplorer;

 namespace Umbraco.Cms.Api.Common.OpenApi;

+/// <summary>
+///     Defines a handler for generating OpenAPI operation IDs.
+/// </summary>
 public interface IOperationIdHandler
 {
-     bool CanHandle(ApiDescription apiDescription);
+    /// <summary>
+    ///     Determines whether this handler can generate an operation ID for the specified API description.
+    /// </summary>
+    /// <param name="apiDescription">The API description to check.</param>
+    /// <returns><c>true</c> if this handler can handle the API description; otherwise, <c>false</c>.</returns>
+    bool CanHandle(ApiDescription apiDescription);

-     string Handle(ApiDescription apiDescription);
+    /// <summary>
+    ///     Generates an operation ID for the specified API description.
+    /// </summary>
+    /// <param name="apiDescription">The API description to generate an operation ID for.</param>
+    /// <returns>The generated operation ID.</returns>
+    string Handle(ApiDescription apiDescription);
 }
@@ -3,7 +3,15 @@ using Microsoft.AspNetCore.Mvc.ApiExplorer;

 namespace Umbraco.Cms.Api.Common.OpenApi;

+/// <summary>
+///     Defines a selector for choosing operation IDs from registered handlers.
+/// </summary>
 public interface IOperationIdSelector
 {
+    /// <summary>
+    ///     Selects an operation ID for the specified API description.
+    /// </summary>
+    /// <param name="apiDescription">The API description to generate an operation ID for.</param>
+    /// <returns>The operation ID, or <c>null</c> if none could be determined.</returns>
    string? OperationId(ApiDescription apiDescription);
 }
@@ -1,8 +1,21 @@
 namespace Umbraco.Cms.Api.Common.OpenApi;

+/// <summary>
+///     Defines a handler for generating OpenAPI schema IDs.
+/// </summary>
 public interface ISchemaIdHandler
 {
+    /// <summary>
+    ///     Determines whether this handler can generate a schema ID for the specified type.
+    /// </summary>
+    /// <param name="type">The type to check.</param>
+    /// <returns><c>true</c> if this handler can handle the type; otherwise, <c>false</c>.</returns>
    bool CanHandle(Type type);

+    /// <summary>
+    ///     Generates a schema ID for the specified type.
+    /// </summary>
+    /// <param name="type">The type to generate a schema ID for.</param>
+    /// <returns>The generated schema ID.</returns>
    string Handle(Type type);
 }
@@ -1,6 +1,14 @@
 namespace Umbraco.Cms.Api.Common.OpenApi;

+/// <summary>
+///     Defines a selector for choosing schema IDs from registered handlers.
+/// </summary>
 public interface ISchemaIdSelector
 {
+    /// <summary>
+    ///     Selects a schema ID for the specified type.
+    /// </summary>
+    /// <param name="type">The type to generate a schema ID for.</param>
+    /// <returns>The schema ID.</returns>
    string SchemaId(Type type);
 }
@@ -1,8 +1,22 @@
 namespace Umbraco.Cms.Api.Common.OpenApi;

+/// <summary>
+///     Defines a handler for discovering sub-types for polymorphic OpenAPI schemas.
+/// </summary>
 public interface ISubTypesHandler
 {
+    /// <summary>
+    ///     Determines whether this handler can discover sub-types for the specified type and document.
+    /// </summary>
+    /// <param name="type">The type to check.</param>
+    /// <param name="documentName">The OpenAPI document name.</param>
+    /// <returns><c>true</c> if this handler can handle the type; otherwise, <c>false</c>.</returns>
    bool CanHandle(Type type, string documentName);

+    /// <summary>
+    ///     Discovers sub-types for the specified type.
+    /// </summary>
+    /// <param name="type">The type to discover sub-types for.</param>
+    /// <returns>An enumerable of discovered sub-types.</returns>
    IEnumerable<Type> Handle(Type type);
 }
@@ -1,6 +1,14 @@
 namespace Umbraco.Cms.Api.Common.OpenApi;

+/// <summary>
+///     Defines a selector for choosing sub-types from registered handlers.
+/// </summary>
 public interface ISubTypesSelector
 {
+    /// <summary>
+    ///     Selects sub-types for the specified type for polymorphic OpenAPI schema generation.
+    /// </summary>
+    /// <param name="type">The type to find sub-types for.</param>
+    /// <returns>An enumerable of sub-types.</returns>
    IEnumerable<Type> SubTypes(Type type);
 }
@@ -1,4 +1,4 @@
-using Microsoft.OpenApi;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Extensions;

@@ -11,8 +11,13 @@ public class MimeTypeDocumentFilter : IDocumentFilter
 {
    private readonly string _documentName;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="MimeTypeDocumentFilter"/> class.
+    /// </summary>
+    /// <param name="documentName">The name of the OpenAPI document to filter.</param>
    public MimeTypeDocumentFilter(string documentName) => _documentName = documentName;

+    /// <inheritdoc/>
    public void Apply(OpenApiDocument swaggerDoc, DocumentFilterContext context)
    {
        if (context.DocumentName != _documentName)
@@ -24,7 +29,7 @@ public class MimeTypeDocumentFilter : IDocumentFilter
            .SelectMany(path => path.Value.Operations?.Values ?? Enumerable.Empty<OpenApiOperation>())
            .ToArray();

-        void RemoveUnwantedMimeTypes(IDictionary<string, OpenApiMediaType>? content)
+        static void RemoveUnwantedMimeTypes(IDictionary<string, OpenApiMediaType>? content)
        {
            if (content is null || content.ContainsKey("application/json") is false)
            {
@@ -6,14 +6,24 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.OpenApi;

-// NOTE: Left unsealed on purpose, so it is extendable.
+/// <summary>
+///     Default handler for generating OpenAPI operation IDs for Umbraco API controllers.
+/// </summary>
+/// <remarks>
+///     Left unsealed on purpose, so it is extendable by consuming APIs.
+/// </remarks>
 public class OperationIdHandler : IOperationIdHandler
 {
    private readonly ApiVersioningOptions _apiVersioningOptions;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="OperationIdHandler"/> class.
+    /// </summary>
+    /// <param name="apiVersioningOptions">The API versioning options.</param>
    public OperationIdHandler(IOptions<ApiVersioningOptions> apiVersioningOptions)
        => _apiVersioningOptions = apiVersioningOptions.Value;

+    /// <inheritdoc/>
    public bool CanHandle(ApiDescription apiDescription)
    {
        if (apiDescription.ActionDescriptor is not ControllerActionDescriptor controllerActionDescriptor)
@@ -24,9 +34,16 @@ public class OperationIdHandler : IOperationIdHandler
        return CanHandle(apiDescription, controllerActionDescriptor);
    }

+    /// <summary>
+    ///     Determines whether this handler can process the API description based on the controller namespace.
+    /// </summary>
+    /// <param name="apiDescription">The API description.</param>
+    /// <param name="controllerActionDescriptor">The controller action descriptor.</param>
+    /// <returns><c>true</c> if the controller is in an Umbraco.Cms.Api namespace; otherwise, <c>false</c>.</returns>
    protected virtual bool CanHandle(ApiDescription apiDescription, ControllerActionDescriptor controllerActionDescriptor)
        => controllerActionDescriptor.ControllerTypeInfo.Namespace?.StartsWith("Umbraco.Cms.Api") is true;

+    /// <inheritdoc/>
    public virtual string Handle(ApiDescription apiDescription)
        => UmbracoOperationId(apiDescription);

@@ -1,4 +1,4 @@
-using System.Text.RegularExpressions;
+using System.Text.RegularExpressions;

 namespace Umbraco.Cms.Api.Common.OpenApi;

@@ -3,19 +3,30 @@ using Microsoft.AspNetCore.Mvc.ApiExplorer;

 namespace Umbraco.Cms.Api.Common.OpenApi;

+/// <summary>
+///     Selects an operation ID for an API description using registered handlers.
+/// </summary>
 public class OperationIdSelector : IOperationIdSelector
 {
    private readonly IEnumerable<IOperationIdHandler> _operationIdHandlers;

-    [Obsolete("Use non-obsolete constructor. This will be removed in Umbraco 15.")]
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="OperationIdSelector"/> class.
+    /// </summary>
+    [Obsolete("Use non-obsolete constructor. Scheduled for removal in Umbraco 18.")]
    public OperationIdSelector()
        : this(Enumerable.Empty<IOperationIdHandler>())
    {
    }

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="OperationIdSelector"/> class.
+    /// </summary>
+    /// <param name="operationIdHandlers">The registered operation ID handlers.</param>
    public OperationIdSelector(IEnumerable<IOperationIdHandler> operationIdHandlers)
        => _operationIdHandlers = operationIdHandlers;

+    /// <inheritdoc/>
    public virtual string? OperationId(ApiDescription apiDescription)
    {
        IOperationIdHandler? handler = _operationIdHandlers.FirstOrDefault(h => h.CanHandle(apiDescription));
@@ -1,4 +1,4 @@
-using Microsoft.OpenApi;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;

 namespace Umbraco.Cms.Api.Common.OpenApi;
@@ -10,9 +10,14 @@ public class RemoveSecuritySchemesDocumentFilter : IDocumentFilter
 {
    private readonly string _documentName;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="RemoveSecuritySchemesDocumentFilter"/> class.
+    /// </summary>
+    /// <param name="documentName">The name of the OpenAPI document to filter.</param>
    public RemoveSecuritySchemesDocumentFilter(string documentName)
        => _documentName = documentName;

+    /// <inheritdoc/>
    public void Apply(OpenApiDocument swaggerDoc, DocumentFilterContext context)
    {
        if (context.DocumentName != _documentName)
@@ -3,12 +3,20 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.OpenApi;

-// NOTE: Left unsealed on purpose, so it is extendable.
+/// <summary>
+///     Default handler for generating OpenAPI schema IDs for Umbraco types.
+/// </summary>
+/// <remarks>
+///     Left unsealed on purpose, so it is extendable by consuming APIs.
+///     Adds "Model" suffix to avoid TypeScript name clashes and removes invalid characters.
+/// </remarks>
 public class SchemaIdHandler : ISchemaIdHandler
 {
+    /// <inheritdoc/>
    public virtual bool CanHandle(Type type)
        => type.Namespace?.StartsWith("Umbraco.Cms") is true;

+    /// <inheritdoc/>
    public virtual string Handle(Type type)
        => UmbracoSchemaId(type);

@@ -1,12 +1,20 @@
-namespace Umbraco.Cms.Api.Common.OpenApi;
+namespace Umbraco.Cms.Api.Common.OpenApi;

+/// <summary>
+///     Selects a schema ID for a type using registered handlers.
+/// </summary>
 public class SchemaIdSelector : ISchemaIdSelector
 {
    private readonly IEnumerable<ISchemaIdHandler> _schemaIdHandlers;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="SchemaIdSelector"/> class.
+    /// </summary>
+    /// <param name="schemaIdHandlers">The registered schema ID handlers.</param>
    public SchemaIdSelector(IEnumerable<ISchemaIdHandler> schemaIdHandlers)
        => _schemaIdHandlers = schemaIdHandlers;

+    /// <inheritdoc/>
    public virtual string SchemaId(Type type)
    {
        ISchemaIdHandler? handler = _schemaIdHandlers.FirstOrDefault(h => h.CanHandle(type));
@@ -2,19 +2,33 @@ using Umbraco.Cms.Api.Common.Serialization;

 namespace Umbraco.Cms.Api.Common.OpenApi;

+/// <summary>
+///     Default handler for discovering sub-types for polymorphic OpenAPI schemas.
+/// </summary>
 public class SubTypesHandler : ISubTypesHandler
 {
    private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="SubTypesHandler"/> class.
+    /// </summary>
+    /// <param name="umbracoJsonTypeInfoResolver">The JSON type info resolver for finding sub-types.</param>
    public SubTypesHandler(IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
        => _umbracoJsonTypeInfoResolver = umbracoJsonTypeInfoResolver;

+    /// <summary>
+    ///     Determines whether this handler can process the specified type based on namespace.
+    /// </summary>
+    /// <param name="type">The type to check.</param>
+    /// <returns><c>true</c> if the type is in an Umbraco.Cms namespace; otherwise, <c>false</c>.</returns>
    protected virtual bool CanHandle(Type type)
        => type.Namespace?.StartsWith("Umbraco.Cms") is true;

+    /// <inheritdoc/>
    public virtual bool CanHandle(Type type, string documentName)
        => CanHandle(type);

+    /// <inheritdoc/>
    public virtual IEnumerable<Type> Handle(Type type)
        => _umbracoJsonTypeInfoResolver.FindSubTypes(type);
 }
@@ -8,6 +8,9 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.OpenApi;

+/// <summary>
+///     Selects sub-types for polymorphic OpenAPI schemas using registered handlers.
+/// </summary>
 public class SubTypesSelector : ISubTypesSelector
 {
    private readonly IHostingEnvironment _hostingEnvironment;
@@ -15,6 +18,13 @@ public class SubTypesSelector : ISubTypesSelector
    private readonly IEnumerable<ISubTypesHandler> _subTypeHandlers;
    private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="SubTypesSelector"/> class.
+    /// </summary>
+    /// <param name="hostingEnvironment">The hosting environment.</param>
+    /// <param name="httpContextAccessor">The HTTP context accessor.</param>
+    /// <param name="subTypeHandlers">The registered sub-type handlers.</param>
+    /// <param name="umbracoJsonTypeInfoResolver">The JSON type info resolver for finding sub-types.</param>
    public SubTypesSelector(
        IHostingEnvironment hostingEnvironment,
        IHttpContextAccessor httpContextAccessor,
@@ -27,6 +37,7 @@ public class SubTypesSelector : ISubTypesSelector
        _umbracoJsonTypeInfoResolver = umbracoJsonTypeInfoResolver;
    }

+    /// <inheritdoc/>
    public IEnumerable<Type> SubTypes(Type type)
    {
        var backOfficePath = _hostingEnvironment.GetBackOfficePath();
@@ -35,8 +46,7 @@ public class SubTypesSelector : ISubTypesSelector
        if (_httpContextAccessor.HttpContext?.Request.Path.StartsWithSegments(swaggerPath) ?? false)
        {
            // Split the path into segments
-            var segments = _httpContextAccessor.HttpContext.Request.Path.Value!
-                .Substring(swaggerPath.Length)
+            var segments = _httpContextAccessor.HttpContext.Request.Path.Value![swaggerPath.Length..]
                .TrimStart(Constants.CharArrays.ForwardSlash)
                .Split(Constants.CharArrays.ForwardSlash);

@@ -13,8 +13,15 @@ using IHostingEnvironment = Umbraco.Cms.Core.Hosting.IHostingEnvironment;

 namespace Umbraco.Cms.Api.Common.OpenApi;

+/// <summary>
+///     Pipeline filter that configures Swagger/OpenAPI endpoints for Umbraco APIs.
+/// </summary>
 public class SwaggerRouteTemplatePipelineFilter : UmbracoPipelineFilter
 {
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="SwaggerRouteTemplatePipelineFilter"/> class.
+    /// </summary>
+    /// <param name="name">The name of the pipeline filter.</param>
    public SwaggerRouteTemplatePipelineFilter(string name)
        : base(name)
        => PostPipeline = PostPipelineAction;
@@ -36,15 +43,36 @@ public class SwaggerRouteTemplatePipelineFilter : UmbracoPipelineFilter
        applicationBuilder.UseSwaggerUI(swaggerUiOptions => SwaggerUiConfiguration(swaggerUiOptions, swaggerGenOptions.Value, applicationBuilder));
    }

+    /// <summary>
+    ///     Determines whether Swagger is enabled for the application.
+    /// </summary>
+    /// <param name="applicationBuilder">The application builder.</param>
+    /// <returns><c>true</c> if Swagger is enabled; otherwise, <c>false</c>.</returns>
    protected virtual bool SwaggerIsEnabled(IApplicationBuilder applicationBuilder)
        => applicationBuilder.ApplicationServices.GetRequiredService<IWebHostEnvironment>().IsProduction() is false;

+    /// <summary>
+    ///     Gets the route template for Swagger JSON endpoints.
+    /// </summary>
+    /// <param name="applicationBuilder">The application builder.</param>
+    /// <returns>The Swagger route template.</returns>
    protected virtual string SwaggerRouteTemplate(IApplicationBuilder applicationBuilder)
        => $"{GetBackOfficePath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger/{{documentName}}/swagger.json";

+    /// <summary>
+    ///     Gets the route prefix for the Swagger UI.
+    /// </summary>
+    /// <param name="applicationBuilder">The application builder.</param>
+    /// <returns>The Swagger UI route prefix.</returns>
    protected virtual string SwaggerUiRoutePrefix(IApplicationBuilder applicationBuilder)
        => $"{GetBackOfficePath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger";

+    /// <summary>
+    ///     Configures the Swagger UI options.
+    /// </summary>
+    /// <param name="swaggerUiOptions">The Swagger UI options to configure.</param>
+    /// <param name="swaggerGenOptions">The Swagger generation options.</param>
+    /// <param name="applicationBuilder">The application builder.</param>
    protected virtual void SwaggerUiConfiguration(
        SwaggerUIOptions swaggerUiOptions,
        SwaggerGenOptions swaggerGenOptions,
@@ -4,30 +4,64 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.Rendering;

+/// <summary>
+///     Implements output expansion strategy for element-only rendering in the Delivery API.
+/// </summary>
+/// <remarks>
+///     This strategy handles the expansion and filtering of properties when rendering content
+///     through the Delivery API based on expand and fields query parameters.
+/// </remarks>
 public class ElementOnlyOutputExpansionStrategy : IOutputExpansionStrategy
 {
+    /// <summary>
+    ///     The parameter value indicating all properties should be included.
+    /// </summary>
    protected const string All = "$all";
+
+    /// <summary>
+    ///     The parameter value indicating no properties should be included.
+    /// </summary>
    protected const string None = "";
+
+    /// <summary>
+    ///     The name of the expand query parameter.
+    /// </summary>
    protected const string ExpandParameterName = "expand";
+
+    /// <summary>
+    ///     The name of the fields query parameter.
+    /// </summary>
    protected const string FieldsParameterName = "fields";

    private readonly IApiPropertyRenderer _propertyRenderer;

+    /// <summary>
+    ///     Gets the stack of expand property nodes for tracking nested expansions.
+    /// </summary>
    protected Stack<Node?> ExpandProperties { get; } = new();

+    /// <summary>
+    ///     Gets the stack of include property nodes for tracking nested field selections.
+    /// </summary>
    protected Stack<Node?> IncludeProperties { get; } = new();

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="ElementOnlyOutputExpansionStrategy"/> class.
+    /// </summary>
+    /// <param name="propertyRenderer">The property renderer for converting property values.</param>
    public ElementOnlyOutputExpansionStrategy(
        IApiPropertyRenderer propertyRenderer)
    {
        _propertyRenderer = propertyRenderer;
    }

+    /// <inheritdoc/>
    public virtual IDictionary<string, object?> MapContentProperties(IPublishedContent content)
        => content.ItemType == PublishedItemType.Content
            ? MapProperties(content.Properties)
            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");

+    /// <inheritdoc/>
    public virtual IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
    {
        if (media.ItemType != PublishedItemType.Media)
@@ -45,6 +79,7 @@ public class ElementOnlyOutputExpansionStrategy : IOutputExpansionStrategy
            : new Dictionary<string, object?>();
    }

+    /// <inheritdoc/>
    public virtual IDictionary<string, object?> MapElementProperties(IPublishedElement element)
        => MapProperties(element.Properties, true);

@@ -87,12 +122,27 @@ public class ElementOnlyOutputExpansionStrategy : IOutputExpansionStrategy
    private object? GetPropertyValue(IPublishedProperty property)
        => _propertyRenderer.GetPropertyValue(property, ExpandProperties.Peek() is not null);

+    /// <summary>
+    ///     Represents a node in the parsed expand/fields parameter tree structure.
+    /// </summary>
    protected sealed class Node
    {
+        /// <summary>
+        ///     Gets the key of this node.
+        /// </summary>
        public string Key { get; private set; } = string.Empty;

+        /// <summary>
+        ///     Gets the child nodes of this node.
+        /// </summary>
        public List<Node> Items { get; } = new();

+        /// <summary>
+        ///     Parses an expand/fields parameter value into a node tree structure.
+        /// </summary>
+        /// <param name="value">The parameter value to parse.</param>
+        /// <returns>The root node of the parsed tree.</returns>
+        /// <exception cref="ArgumentException">Thrown when the value has invalid syntax.</exception>
        public static Node Parse(string value)
        {
            // verify that there are as many start brackets as there are end brackets
@@ -2,35 +2,77 @@ using Umbraco.Cms.Core;

 namespace Umbraco.Cms.Api.Common.Security;

+/// <summary>
+///     Contains OAuth/OpenID Connect endpoint paths for Umbraco APIs.
+/// </summary>
 public static class Paths
 {
+    /// <summary>
+    ///     Contains endpoint paths for back-office authentication.
+    /// </summary>
    public static class BackOfficeApi
    {
+        /// <summary>
+        ///     The base endpoint template for back-office security endpoints.
+        /// </summary>
        public const string EndpointTemplate = "security/back-office";

+        /// <summary>
+        ///     The authorization endpoint path.
+        /// </summary>
        public static readonly string AuthorizationEndpoint = EndpointPath($"{EndpointTemplate}/authorize");

+        /// <summary>
+        ///     The token endpoint path.
+        /// </summary>
        public static readonly string TokenEndpoint = EndpointPath($"{EndpointTemplate}/token");

+        /// <summary>
+        ///     The logout/sign-out endpoint path.
+        /// </summary>
        public static readonly string LogoutEndpoint = EndpointPath($"{EndpointTemplate}/signout");

+        /// <summary>
+        ///     The token revocation endpoint path.
+        /// </summary>
        public static readonly string RevokeEndpoint = EndpointPath($"{EndpointTemplate}/revoke");

        private static string EndpointPath(string relativePath) => $"/umbraco{Constants.Web.ManagementApiPath}v1/{relativePath}";
    }

+    /// <summary>
+    ///     Contains endpoint paths for member authentication.
+    /// </summary>
    public static class MemberApi
    {
+        /// <summary>
+        ///     The base endpoint template for member security endpoints.
+        /// </summary>
        public const string EndpointTemplate = "security/member";

+        /// <summary>
+        ///     The authorization endpoint path.
+        /// </summary>
        public static readonly string AuthorizationEndpoint = EndpointPath($"{EndpointTemplate}/authorize");

+        /// <summary>
+        ///     The token endpoint path.
+        /// </summary>
        public static readonly string TokenEndpoint = EndpointPath($"{EndpointTemplate}/token");

+        /// <summary>
+        ///     The logout/sign-out endpoint path.
+        /// </summary>
        public static readonly string LogoutEndpoint = EndpointPath($"{EndpointTemplate}/signout");

+        /// <summary>
+        ///     The token revocation endpoint path.
+        /// </summary>
        public static readonly string RevokeEndpoint = EndpointPath($"{EndpointTemplate}/revoke");

+        /// <summary>
+        ///     The user info endpoint path.
+        /// </summary>
        public static readonly string UserinfoEndpoint = EndpointPath($"{EndpointTemplate}/userinfo");

        // NOTE: we're NOT using /api/v1.0/ here because it will clash with the Delivery API docs
@@ -2,9 +2,22 @@ using System.Text.Json.Serialization.Metadata;

 namespace Umbraco.Cms.Api.Common.Serialization;

+/// <summary>
+///     Extends <see cref="IJsonTypeInfoResolver"/> with Umbraco-specific type resolution for polymorphic JSON serialization.
+/// </summary>
 public interface IUmbracoJsonTypeInfoResolver : IJsonTypeInfoResolver
 {
+    /// <summary>
+    ///     Finds all sub-types of the specified type for polymorphic serialization.
+    /// </summary>
+    /// <param name="type">The base type to find sub-types for.</param>
+    /// <returns>An enumerable of sub-types.</returns>
    IEnumerable<Type> FindSubTypes(Type type);

+    /// <summary>
+    ///     Gets the type discriminator value used for polymorphic serialization.
+    /// </summary>
+    /// <param name="type">The type to get the discriminator value for.</param>
+    /// <returns>The discriminator value, or <c>null</c> if not applicable.</returns>
    string? GetTypeDiscriminatorValue(Type type);
 }
@@ -8,14 +8,26 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.Serialization;

+/// <summary>
+///     Implements JSON type info resolution for Umbraco with support for polymorphic serialization.
+/// </summary>
+/// <remarks>
+///     This resolver discovers sub-types of interfaces for polymorphic JSON serialization,
+///     caching results for performance. It also handles type discriminator values for OpenAPI schema generation.
+/// </remarks>
 public sealed class UmbracoJsonTypeInfoResolver : DefaultJsonTypeInfoResolver, IUmbracoJsonTypeInfoResolver
 {
    private readonly ITypeFinder _typeFinder;
    private readonly ConcurrentDictionary<Type, ISet<Type>> _subTypesCache = new ConcurrentDictionary<Type, ISet<Type>>();

+    /// <summary>
+    ///     Initializes a new instance of the <see cref="UmbracoJsonTypeInfoResolver"/> class.
+    /// </summary>
+    /// <param name="typeFinder">The type finder for discovering sub-types.</param>
    public UmbracoJsonTypeInfoResolver(ITypeFinder typeFinder)
        => _typeFinder = typeFinder;

+    /// <inheritdoc/>
    public IEnumerable<Type> FindSubTypes(Type type)
    {
        JsonDerivedTypeAttribute[] explicitJsonDerivedTypes = type
@@ -44,6 +56,7 @@ public sealed class UmbracoJsonTypeInfoResolver : DefaultJsonTypeInfoResolver, I
        return result;
    }

+    /// <inheritdoc/>
    public string? GetTypeDiscriminatorValue(Type type)
    {
        JsonDerivedTypeAttribute? jsonDerivedTypeAttribute = type
@@ -62,6 +75,7 @@ public sealed class UmbracoJsonTypeInfoResolver : DefaultJsonTypeInfoResolver, I
        return typeof(IOpenApiDiscriminator).IsAssignableFrom(type) ? type.Name : null;
    }

+    /// <inheritdoc/>
    public override JsonTypeInfo GetTypeInfo(Type type, JsonSerializerOptions options)
    {
        JsonTypeInfo result = base.GetTypeInfo(type, options);
@@ -1,14 +1,28 @@
-using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations;

 namespace Umbraco.Cms.Api.Common.ViewModels.Pagination;

+/// <summary>
+///     Represents a paged collection of items with total count.
+/// </summary>
+/// <typeparam name="T">The type of items in the collection.</typeparam>
 public class PagedViewModel<T>
 {
+    /// <summary>
+    ///     Gets or sets the total number of items available.
+    /// </summary>
    [Required]
    public long Total { get; set; }

+    /// <summary>
+    ///     Gets or sets the items in the current page.
+    /// </summary>
    [Required]
    public IEnumerable<T> Items { get; set; } = Enumerable.Empty<T>();

+    /// <summary>
+    ///     Creates an empty paged view model.
+    /// </summary>
+    /// <returns>An empty <see cref="PagedViewModel{T}"/> instance.</returns>
    public static PagedViewModel<T> Empty() => new();
 }
@@ -2,16 +2,33 @@ using System.ComponentModel.DataAnnotations;

 namespace Umbraco.Cms.Api.Common.ViewModels.Pagination;

+/// <summary>
+///     Represents a subset of items with counts of items before and after the subset.
+/// </summary>
+/// <typeparam name="T">The type of items in the collection.</typeparam>
 public class SubsetViewModel<T>
 {
+    /// <summary>
+    ///     Gets or sets the total number of items before this subset.
+    /// </summary>
    [Required]
    public long TotalBefore { get; set; }

+    /// <summary>
+    ///     Gets or sets the total number of items after this subset.
+    /// </summary>
    [Required]
    public long TotalAfter { get; set; }

+    /// <summary>
+    ///     Gets or sets the items in the subset.
+    /// </summary>
    [Required]
    public IEnumerable<T> Items { get; set; } = Enumerable.Empty<T>();

+    /// <summary>
+    ///     Creates an empty subset view model.
+    /// </summary>
+    /// <returns>An empty <see cref="SubsetViewModel{T}"/> instance.</returns>
    public static SubsetViewModel<T> Empty() => new();
 }
@@ -7,6 +7,7 @@ using Umbraco.Cms.Api.Delivery.Configuration;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Features;
 using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Cms.Web.Common.Controllers;

 namespace Umbraco.Cms.Api.Delivery.Controllers;

@@ -14,6 +15,7 @@ namespace Umbraco.Cms.Api.Delivery.Controllers;
 [JsonOptionsName(Constants.JsonOptionsNames.DeliveryApi)]
 [MapToApi(DeliveryApiConfiguration.ApiName)]
 [Authorize(Policy = AuthorizationPolicies.UmbracoFeatureEnabled)]
+[MaintenanceModeActionFilter]
 public abstract class DeliveryApiControllerBase : Controller, IUmbracoFeature
 {
    protected string DecodePath(string path)
@@ -0,0 +1,26 @@
+using Microsoft.AspNetCore.Builder;
+using Umbraco.Cms.Web.Common.ApplicationBuilder;
+
+namespace Umbraco.Extensions;
+
+/// <summary>
+/// <see cref="IApplicationBuilder" /> extensions for the Umbraco Delivery API.
+/// </summary>
+public static class DeliveryApiApplicationBuilderExtensions
+{
+    /// <summary>
+    /// Sets up routes for the Umbraco Delivery API.
+    /// </summary>
+    /// <remarks>
+    /// This method maps attribute-routed controllers including the Delivery API endpoints.
+    /// Call this when using <c>AddDeliveryApi()</c> without <c>AddBackOffice()</c>, as the
+    /// backoffice endpoints normally handle the controller mapping.
+    /// </remarks>
+    /// <param name="builder">The Umbraco endpoint builder context.</param>
+    /// <returns>The <see cref="IUmbracoEndpointBuilderContext" /> for chaining.</returns>
+    public static IUmbracoEndpointBuilderContext UseDeliveryApiEndpoints(this IUmbracoEndpointBuilderContext builder)
+    {
+        builder.EndpointRouteBuilder.MapControllers();
+        return builder;
+    }
+}
@@ -22,7 +22,6 @@ using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Notifications;
-using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Infrastructure.Security;
 using Umbraco.Cms.Web.Common.ApplicationBuilder;

@@ -30,8 +29,20 @@ namespace Umbraco.Extensions;

 public static class UmbracoBuilderExtensions
 {
+    /// <summary>
+    /// Add services for the Umbraco Delivery API (headless content delivery).
+    /// </summary>
+    /// <remarks>
+    /// This method assumes that either <c>AddBackOffice()</c> or <c>AddCore()</c> has already been called.
+    /// It registers Delivery API-specific services such as controllers, output caching, and member authentication.
+    /// </remarks>
+    /// <param name="builder">The Umbraco builder.</param>
+    /// <returns>The Umbraco builder.</returns>
    public static IUmbracoBuilder AddDeliveryApi(this IUmbracoBuilder builder)
    {
+        // Delivery API supports member authentication for protected content
+        builder.AddMembersIdentity();
+
        builder.Services.AddScoped<IRequestStartItemProvider, RequestStartItemProvider>();
        builder.Services.AddScoped<RequestContextOutputExpansionStrategy>();
        builder.Services.AddScoped<RequestContextOutputExpansionStrategyV2>();
@@ -4,7 +4,11 @@ using Umbraco.Cms.Core.DeliveryApi;

 namespace Umbraco.Cms.Api.Delivery.Filters;

-internal sealed class DeliveryApiAccessAttribute : TypeFilterAttribute
+/// <summary>
+/// An action filter attribute that verifies public or preview access to the Delivery API, returning
+/// a <c>401 Unauthorized</c> result if access is denied.
+/// </summary>
+public sealed class DeliveryApiAccessAttribute : TypeFilterAttribute
 {
    public DeliveryApiAccessAttribute()
        : base(typeof(DeliveryApiAccessFilter))
@@ -4,7 +4,11 @@ using Umbraco.Cms.Core.DeliveryApi;

 namespace Umbraco.Cms.Api.Delivery.Filters;

-internal sealed class DeliveryApiMediaAccessAttribute : TypeFilterAttribute
+/// <summary>
+/// An action filter attribute that verifies public access to the media Delivery API, returning
+/// a <c>401 Unauthorized</c> result if access is denied.
+/// </summary>
+public sealed class DeliveryApiMediaAccessAttribute : TypeFilterAttribute
 {
    public DeliveryApiMediaAccessAttribute()
        : base(typeof(DeliveryApiMediaAccessFilter))
@@ -1,12 +1,13 @@
 using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Infrastructure.Examine;

 namespace Umbraco.Cms.Api.Delivery.Indexing.Selectors;

 public sealed class AncestorsSelectorIndexer : IContentIndexHandler
 {
    // NOTE: "id" is a reserved field name
-    internal const string FieldName = "itemId";
+    internal const string FieldName = UmbracoExamineFieldNames.DeliveryApiContentIndex.ItemId;

    public IEnumerable<IndexFieldValue> GetFieldValues(IContent content, string? culture)
        => new[] { new IndexFieldValue { FieldName = FieldName, Values = new object[] { content.Key } } };
@@ -2,7 +2,10 @@ using Umbraco.Cms.Web.Common.Routing;

 namespace Umbraco.Cms.Api.Delivery.Routing;

-internal sealed class VersionedDeliveryApiRouteAttribute : BackOfficeRouteAttribute
+/// <summary>
+/// A routing attribute that ensures consistent Delivery API endpoint paths.
+/// </summary>
+public sealed class VersionedDeliveryApiRouteAttribute : BackOfficeRouteAttribute
 {
    public VersionedDeliveryApiRouteAttribute(string template)
        : base($"delivery/api/v{{version:apiVersion}}/{template.TrimStart('/')}")
@@ -17,7 +17,7 @@ namespace Umbraco.Cms.Api.Delivery.Services;
 /// </summary>
 internal sealed class ApiContentQueryProvider : IApiContentQueryProvider
 {
-    private const string ItemIdFieldName = "itemId";
+    private const string ItemIdFieldName = UmbracoExamineFieldNames.DeliveryApiContentIndex.ItemId;
    private readonly IExamineManager _examineManager;
    private readonly ILogger<ApiContentQueryProvider> _logger;
    private readonly ApiContentQuerySelectorBuilder _selectorBuilder;
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- https://learn.microsoft.com/dotnet/fundamentals/package-validation/diagnostic-ids -->
+<Suppressions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+  <Suppression>
+    <DiagnosticId>CP0002</DiagnosticId>
+    <Target>M:Umbraco.Cms.Api.Management.Controllers.Document.GetPublicAccessDocumentController.GetPublicAccess(System.Threading.CancellationToken,System.Guid)</Target>
+    <Left>lib/net10.0/Umbraco.Cms.Api.Management.dll</Left>
+    <Right>lib/net10.0/Umbraco.Cms.Api.Management.dll</Right>
+    <IsBaselineSuppression>true</IsBaselineSuppression>
+  </Suppression>
+  <Suppression>
+    <DiagnosticId>CP0002</DiagnosticId>
+    <Target>M:Umbraco.Cms.Api.Management.Controllers.UrlSegment.ResizeImagingController.Urls(System.Collections.Generic.HashSet{System.Guid},System.Int32,System.Int32,System.Nullable{Umbraco.Cms.Core.Models.ImageCropMode})</Target>
+    <Left>lib/net10.0/Umbraco.Cms.Api.Management.dll</Left>
+    <Right>lib/net10.0/Umbraco.Cms.Api.Management.dll</Right>
+    <IsBaselineSuppression>true</IsBaselineSuppression>
+  </Suppression>
+</Suppressions>
@@ -140,15 +140,20 @@ public class ConfigureBackOfficeCookieOptions : IConfigureNamedOptions<CookieAut

                await securityStampValidator.ValidateAsync(ctx);

-                // We have to manually specify Issued and Expires,
-                // because the SecurityStampValidator refreshes the principal every 30 minutes,
-                // When the principal is refreshed the Issued is update to time of refresh, however, the Expires remains unchanged
-                // When we then try and renew, the difference of issued and expires effectively becomes the new ExpireTimeSpan
-                // meaning we effectively lose 30 minutes of our ExpireTimeSpan for EVERY principal refresh if we don't
-                // https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/Cookies/src/CookieAuthenticationHandler.cs#L115
-                ctx.Properties.IssuedUtc = _timeProvider.GetUtcNow();
-                ctx.Properties.ExpiresUtc = _timeProvider.GetUtcNow().Add(_globalSettings.TimeOut);
-                ctx.ShouldRenew = true;
+                // Only reset timestamps when a renewal was already triggered (by the SecurityStampValidator
+                // or by EnsureTicketRenewalIfKeepUserLoggedIn above).
+                // When the SecurityStampValidator refreshes the principal, it sets ShouldRenew but updates
+                // IssuedUtc without updating ExpiresUtc, causing the effective cookie lifetime to shrink
+                // with each validation. The manual reset here fixes that drift.
+                // IMPORTANT: Do NOT unconditionally set ShouldRenew or reset IssuedUtc - doing so prevents
+                // the SecurityStampValidator from ever exceeding its ValidationInterval during active use,
+                // which breaks AllowConcurrentLogins enforcement.
+                if (ctx.ShouldRenew)
+                {
+                    DateTimeOffset now = _timeProvider.GetUtcNow();
+                    ctx.Properties.IssuedUtc = now;
+                    ctx.Properties.ExpiresUtc = now.Add(_globalSettings.TimeOut);
+                }
            },
            OnSigningIn = ctx =>
            {
@@ -0,0 +1,45 @@
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Options;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Configuration;
+
+/// <summary>
+///     Used to configure <see cref="CookieAuthenticationOptions" /> for the back office "exposed" authentication type
+/// </summary>
+public class ConfigureBackOfficeExposedCookieOptions : IConfigureNamedOptions<CookieAuthenticationOptions>
+{
+    private readonly SecuritySettings _securitySettings;
+
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="ConfigureBackOfficeExposedCookieOptions" /> class.
+    /// </summary>
+    /// <param name="securitySettings">The <see cref="SecuritySettings" /> options</param>
+    public ConfigureBackOfficeExposedCookieOptions(IOptions<SecuritySettings> securitySettings)
+        => _securitySettings = securitySettings.Value;
+
+    /// <inheritdoc />
+    public void Configure(string? name, CookieAuthenticationOptions options)
+    {
+        if (name != Constants.Security.BackOfficeExposedAuthenticationType)
+        {
+            return;
+        }
+
+        Configure(options);
+    }
+
+    /// <inheritdoc />
+    public void Configure(CookieAuthenticationOptions options)
+    {
+        options.Cookie.Name = _securitySettings.AuthCookieName.IsNullOrWhiteSpace()
+            ? Constants.Security.BackOfficeExposedCookieName
+            : $"{_securitySettings.AuthCookieName}{Constants.Security.BackOfficeExposedCookieNamePostfix}";
+        options.Cookie.HttpOnly = true;
+        options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
+        options.SlidingExpiration = true;
+    }
+}
@@ -1,4 +1,4 @@
-using Microsoft.Extensions.Options;
+using Microsoft.Extensions.Options;
 using Umbraco.Cms.Api.Management.Security;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Web.Common.Security;
@@ -13,6 +13,11 @@ public class ConfigureBackOfficeSecurityStampValidatorOptions : IConfigureOption
    private readonly SecuritySettings _securitySettings;
    private readonly TimeProvider _timeProvider;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ConfigureBackOfficeSecurityStampValidatorOptions"/> class with the specified security settings and time provider.
+    /// </summary>
+    /// <param name="securitySettings">The <see cref="IOptions{SecuritySettings}"/> used to access security-related configuration options.</param>
+    /// <param name="timeProvider">The <see cref="TimeProvider"/> used for time-based operations.</param>
    public ConfigureBackOfficeSecurityStampValidatorOptions(IOptions<SecuritySettings> securitySettings, TimeProvider timeProvider)
    {
        _timeProvider = timeProvider;
@@ -23,6 +28,6 @@ public class ConfigureBackOfficeSecurityStampValidatorOptions : IConfigureOption
    public void Configure(BackOfficeSecurityStampValidatorOptions options)
    {
        options.TimeProvider = _timeProvider;
-        ConfigureSecurityStampOptions.ConfigureOptions(options, _securitySettings);
+        ConfigureSecurityStampOptions.ConfigureOptions(options, _securitySettings.GetUserAllowConcurrentLogins());
    }
 }
@@ -9,15 +9,30 @@ using Umbraco.Cms.Api.Management.OpenApi;

 namespace Umbraco.Cms.Api.Management.Configuration;

+/// <summary>
+/// Provides configuration for Swagger generation options specific to the Umbraco Management API.
+/// This class is used to customize the Swagger documentation for the API endpoints.
+/// </summary>
 public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
 {
    private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ConfigureUmbracoManagementApiSwaggerGenOptions"/> class.
+    /// </summary>
+    /// <param name="umbracoJsonTypeInfoResolver">An instance of <see cref="IUmbracoJsonTypeInfoResolver"/> used to resolve JSON type information for Umbraco.</param>
    public ConfigureUmbracoManagementApiSwaggerGenOptions(IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
    {
        _umbracoJsonTypeInfoResolver = umbracoJsonTypeInfoResolver;
    }

+    /// <summary>
+    /// Configures the <see cref="SwaggerGenOptions"/> for the Umbraco Management API.
+    /// Sets up the Swagger documentation, including API metadata, security definitions for OAuth2 authentication,
+    /// operation filters for response headers and security requirements, and schema filters for non-nullable properties.
+    /// Also configures polymorphism handling and discriminator properties for OpenAPI schemas.
+    /// </summary>
+    /// <param name="swaggerGenOptions">The <see cref="SwaggerGenOptions"/> instance to configure for the Management API.</param>
    public void Configure(SwaggerGenOptions swaggerGenOptions)
    {
        swaggerGenOptions.SwaggerDoc(
@@ -7,23 +7,9 @@ using Umbraco.Cms.Core.Hosting;

 namespace Umbraco.Cms.Api.Management;

-[BindProperties]
-public class BackOfficeLoginModel
-{
-    /// <summary>
-    /// Gets or sets the value of the "ReturnUrl" query parameter or defaults to the configured Umbraco directory.
-    /// </summary>
-    [FromQuery(Name = "ReturnUrl")]
-    public string? ReturnUrl { get; set; }
-
-    /// <summary>
-    /// The configured Umbraco directory.
-    /// </summary>
-    public string? UmbracoUrl { get; set; }
-
-    public bool UserIsAlreadyLoggedIn { get; set; }
-}
-
+/// <summary>
+/// Provides endpoints for managing back office user authentication and login operations.
+/// </summary>
 [ApiExplorerSettings(IgnoreApi = true)]
 [Route(LoginPath)]
 public class BackOfficeLoginController : Controller
@@ -32,6 +18,11 @@ public class BackOfficeLoginController : Controller
    private readonly IHostingEnvironment _hostingEnvironment;
    private readonly GlobalSettings _globalSettings;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="BackOfficeLoginController"/> class.
+    /// </summary>
+    /// <param name="globalSettings">A snapshot of the application's global settings options.</param>
+    /// <param name="hostingEnvironment">The current hosting environment for the application.</param>
    public BackOfficeLoginController(
        IOptionsSnapshot<GlobalSettings> globalSettings,
        IHostingEnvironment hostingEnvironment)
@@ -41,6 +32,16 @@ public class BackOfficeLoginController : Controller
    }

    // GET
+    /// <summary>
+    /// Handles the GET request for the back office login page.
+    /// If the user is already authenticated, updates the model accordingly.
+    /// Ensures the return URL is a relative path and sets default values if necessary.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token to cancel the operation.</param>
+    /// <param name="model">The model containing login information and the return URL.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> that renders the login view with the model, or a bad request result if the return URL is invalid.
+    /// </returns>
    public async Task<IActionResult> Index(CancellationToken cancellationToken, BackOfficeLoginModel model)
    {
        AuthenticateResult cookieAuthResult = await HttpContext.AuthenticateAsync(Constants.Security.BackOfficeAuthenticationType);
@@ -0,0 +1,26 @@
+using Microsoft.AspNetCore.Mvc;
+
+namespace Umbraco.Cms.Api.Management;
+
+/// <summary>
+/// Represents a model containing the credentials required for logging into the Umbraco back office.
+/// </summary>
+[BindProperties]
+public class BackOfficeLoginModel
+{
+    /// <summary>
+    /// Gets or sets the value of the "ReturnUrl" query parameter or defaults to the configured Umbraco directory.
+    /// </summary>
+    [FromQuery(Name = "ReturnUrl")]
+    public string? ReturnUrl { get; set; }
+
+    /// <summary>
+    /// The configured Umbraco directory.
+    /// </summary>
+    public string? UmbracoUrl { get; set; }
+
+    /// <summary>
+    /// Indicates whether the user is already logged in to the back office.
+    /// </summary>
+    public bool UserIsAlreadyLoggedIn { get; set; }
+}
@@ -14,6 +14,13 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Management.Controllers.Content;

+/// <summary>
+/// Serves as a base controller for managing collections of content items, providing shared functionality for handling content collections and their variants.
+/// </summary>
+/// <typeparam name="TContent">The content entity type.</typeparam>
+/// <typeparam name="TCollectionResponseModel">The response model type for the content collection.</typeparam>
+/// <typeparam name="TValueResponseModelBase">The base type for value response models within the collection.</typeparam>
+/// <typeparam name="TVariantResponseModel">The response model type for content variants.</typeparam>
 public abstract class ContentCollectionControllerBase<TContent, TCollectionResponseModel, TValueResponseModelBase, TVariantResponseModel> : ManagementApiControllerBase
    where TContent : class, IContentBase
    where TCollectionResponseModel : ContentResponseModelBase<TValueResponseModelBase, TVariantResponseModel>
@@ -8,6 +8,9 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Management.Controllers.Content;

+/// <summary>
+/// Serves as the base controller for content management operations in the Umbraco CMS API, providing shared functionality for content-related controllers.
+/// </summary>
 public abstract class ContentControllerBase : ManagementApiControllerBase
 {
    protected IActionResult ContentEditingOperationStatusResult(ContentEditingOperationStatus status)
@@ -53,6 +56,15 @@ public abstract class ContentControllerBase : ManagementApiControllerBase
            ContentEditingOperationStatus.PropertyTypeNotFound => NotFound(problemDetailsBuilder
                .WithTitle("One or more property types could not be found")
                .Build()),
+            ContentEditingOperationStatus.PropertyTypeCultureVarianceMismatch => BadRequest(problemDetailsBuilder
+                .WithTitle("Property type culture variance mismatch")
+                .WithDetail("One or more property values specify a culture for an invariant property, or are missing a culture for a culture-variant property. "
+                    + "This can happen when a property is inherited from a variant composition on an invariant content type, which downgrades it to invariant.")
+                .Build()),
+            ContentEditingOperationStatus.PropertyTypeSegmentVarianceMismatch => BadRequest(problemDetailsBuilder
+                .WithTitle("Property type segment variance mismatch")
+                .WithDetail("One or more property values have a segment that does not match the property type's segment variance.")
+                .Build()),
            ContentEditingOperationStatus.InTrash => BadRequest(problemDetailsBuilder
                .WithTitle("Content is in the recycle bin")
                .WithDetail("Could not perform the operation because the targeted content was in the recycle bin.")
@@ -79,11 +91,11 @@ public abstract class ContentControllerBase : ManagementApiControllerBase
                .Build()),
            ContentEditingOperationStatus.CannotDeleteWhenReferenced => BadRequest(problemDetailsBuilder
                .WithTitle("Cannot delete a referenced content item")
-                .WithDetail("Cannot delete a referenced document, while the setting ContentSettings.DisableDeleteWhenReferenced is enabled.")
+                .WithDetail("Cannot delete a referenced content item, while the setting ContentSettings.DisableDeleteWhenReferenced is enabled.")
                .Build()),
            ContentEditingOperationStatus.CannotMoveToRecycleBinWhenReferenced => BadRequest(problemDetailsBuilder
-                .WithTitle("Cannot move a referenced document to the recycle bin")
-                .WithDetail("Cannot move a referenced document to the recycle bin, while the setting ContentSettings.DisableUnpublishWhenReferenced is enabled.")
+                .WithTitle("Cannot move a referenced content item to the recycle bin")
+                .WithDetail("Cannot move a referenced content item to the recycle bin, while the setting ContentSettings.DisableDeleteWhenReferenced is enabled.")
                .Build()),
            ContentEditingOperationStatus.Unknown => StatusCode(
                StatusCodes.Status500InternalServerError,
@@ -9,12 +9,20 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.Culture;

+/// <summary>
+/// API controller responsible for retrieving and managing culture information in the system.
+/// </summary>
 [ApiVersion("1.0")]
 public class AllCultureController : CultureControllerBase
 {
    private readonly IUmbracoMapper _umbracoMapper;
    private readonly ICultureService _cultureService;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="AllCultureController"/> class with the specified Umbraco mapper and culture service.
+    /// </summary>
+    /// <param name="umbracoMapper">An instance of <see cref="IUmbracoMapper"/> used for mapping Umbraco objects.</param>
+    /// <param name="cultureService">An instance of <see cref="ICultureService"/> used for managing culture information.</param>
    public AllCultureController(IUmbracoMapper umbracoMapper, ICultureService cultureService)
    {
        _umbracoMapper = umbracoMapper;
@@ -22,12 +30,17 @@ public class AllCultureController : CultureControllerBase
    }

    /// <summary>
-    ///     Returns all cultures available for creating languages.
+    /// Retrieves a paginated list of all available cultures, including their English and localized names.
    /// </summary>
-    /// <returns></returns>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="skip">The number of cultures to skip before starting to collect the result set.</param>
+    /// <param name="take">The maximum number of cultures to return.</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains a <see cref="PagedViewModel{CultureReponseModel}"/> with the paginated cultures.</returns>
    [HttpGet]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<CultureReponseModel>), StatusCodes.Status200OK)]
+    [EndpointSummary("Gets a paginated collection of cultures available for creating languages.")]
+    [EndpointDescription("Gets a paginated collection containing the English and localized names of all available cultures.")]
    public Task<PagedViewModel<CultureReponseModel>> GetAll(CancellationToken cancellationToken, int skip = 0, int take = 100)
    {
        CultureInfo[] all = _cultureService.GetValidCultureInfos();
@@ -1,8 +1,11 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;

 namespace Umbraco.Cms.Api.Management.Controllers.Culture;

+/// <summary>
+/// Serves as the base controller for API endpoints that manage culture-related operations in the Umbraco CMS.
+/// </summary>
 [VersionedApiBackOfficeRoute("culture")]
 [ApiExplorerSettings(GroupName = "Culture")]
 public abstract class CultureControllerBase : ManagementApiControllerBase
@@ -0,0 +1,60 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.ViewModels;
+using Umbraco.Cms.Api.Management.ViewModels.DataType;
+using Umbraco.Cms.Core.Mapping;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Management.Controllers.DataType;
+
+/// <summary>
+/// Provides an API controller for retrieving the full details for multiple data types by key.
+/// </summary>
+[ApiVersion("1.0")]
+public class BatchDataTypesController : DataTypeControllerBase
+{
+    private readonly IDataTypeService _dataTypeService;
+    private readonly IUmbracoMapper _umbracoMapper;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="BatchDataTypesController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">The data type service.</param>
+    /// <param name="umbracoMapper">The presentation model mapper.</param>
+    public BatchDataTypesController(IDataTypeService dataTypeService, IUmbracoMapper umbracoMapper)
+    {
+        _dataTypeService = dataTypeService;
+        _umbracoMapper = umbracoMapper;
+    }
+
+    [HttpGet("batch")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(BatchResponseModel<DataTypeResponseModel>), StatusCodes.Status200OK)]
+    [EndpointSummary("Gets multiple data types.")]
+    [EndpointDescription("Gets multiple data types identified by the provided Ids.")]
+    public async Task<IActionResult> Batch(
+        CancellationToken cancellationToken,
+        [FromQuery(Name = "id")] HashSet<Guid> ids)
+    {
+        Guid[] requestedIds = [.. ids];
+
+        if (requestedIds.Length == 0)
+        {
+            return Ok(new BatchResponseModel<DataTypeResponseModel>());
+        }
+
+        IEnumerable<IDataType> dataTypes = await _dataTypeService.GetAllAsync(requestedIds);
+
+        List<IDataType> ordered = OrderByRequestedIds(dataTypes, requestedIds);
+
+        var responseModels = ordered.Select(dt => _umbracoMapper.Map<DataTypeResponseModel>(dt)!).ToList();
+
+        return Ok(new BatchResponseModel<DataTypeResponseModel>
+        {
+            Total = responseModels.Count,
+            Items = responseModels,
+        });
+    }
+}
@@ -0,0 +1,71 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.ViewModels;
+using Umbraco.Cms.Api.Management.ViewModels.DataType;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+
+namespace Umbraco.Cms.Api.Management.Controllers.DataType;
+
+/// <summary>
+/// Controller for retrieving multiple data type value schemas in a single request.
+/// </summary>
+[ApiVersion("1.0")]
+public class BatchSchemasDataTypeController : DataTypeControllerBase
+{
+    private readonly IPropertyEditorSchemaService _schemaService;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="BatchSchemasDataTypeController"/> class.
+    /// </summary>
+    /// <param name="schemaService">The property editor schema service.</param>
+    public BatchSchemasDataTypeController(IPropertyEditorSchemaService schemaService)
+        => _schemaService = schemaService;
+
+    /// <summary>
+    /// Gets the value schemas for multiple data types.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <param name="ids">The unique identifiers of the data types.</param>
+    /// <returns>The schema information for the requested data types.</returns>
+    /// <remarks>
+    /// Returns schema information for property editors that implement <c>IValueSchemaProvider</c>.
+    /// Each item includes an error field if the schema could not be retrieved (e.g., data type not found or schema not supported).
+    /// </remarks>
+    [HttpGet("schemas/batch")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(FetchResponseModel<DataTypeSchemaItemResponseModel>), StatusCodes.Status200OK)]
+    public async Task<IActionResult> GetSchemas(
+        CancellationToken cancellationToken,
+        [FromQuery(Name = "id")] Guid[] ids)
+    {
+        Guid[] requestedIds = [.. ids.Distinct()];
+
+        if (requestedIds.Length == 0)
+        {
+            return Ok(new FetchResponseModel<DataTypeSchemaItemResponseModel>());
+        }
+
+        var items = new List<DataTypeSchemaItemResponseModel>();
+
+        foreach (Guid id in requestedIds)
+        {
+            Attempt<PropertyValueSchema, PropertyEditorSchemaOperationStatus> attempt = await _schemaService.GetSchemaAsync(id);
+            items.Add(new DataTypeSchemaItemResponseModel
+            {
+                Id = id,
+                ValueTypeName = attempt.Success ? attempt.Result.ValueType?.FullName : null,
+                JsonSchema = attempt.Success ? attempt.Result.JsonSchema : null,
+                Error = attempt.Success ? null : attempt.Status.ToString(),
+            });
+        }
+
+        return Ok(new FetchResponseModel<DataTypeSchemaItemResponseModel>
+        {
+            Total = items.Count,
+            Items = items,
+        });
+    }
+}
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.ViewModels.DataType;
@@ -8,22 +8,40 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// Controller for managing data types by their unique key.
+/// </summary>
 [ApiVersion("1.0")]
 public class ByKeyDataTypeController : DataTypeControllerBase
 {
    private readonly IDataTypeService _dataTypeService;
    private readonly IUmbracoMapper _umbracoMapper;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ByKeyDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">Service used for managing and retrieving data types.</param>
+    /// <param name="umbracoMapper">The mapper used to map between Umbraco domain models and API models.</param>
    public ByKeyDataTypeController(IDataTypeService dataTypeService, IUmbracoMapper umbracoMapper)
    {
        _dataTypeService = dataTypeService;
        _umbracoMapper = umbracoMapper;
    }

+    /// <summary>
+    /// Retrieves a data type by its unique identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier (GUID) of the data type to retrieve.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> containing the data type if found; otherwise, a 404 Not Found result.
+    /// </returns>
    [HttpGet("{id:guid}")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(DataTypeResponseModel), StatusCodes.Status200OK)]
    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    [EndpointSummary("Gets a data type.")]
+    [EndpointDescription("Gets a data type identified by the provided Id.")]
    public async Task<IActionResult> ByKey(CancellationToken cancellationToken, Guid id)
    {
        IDataType? dataType = await _dataTypeService.GetAsync(id);
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;
@@ -8,16 +8,30 @@ using Umbraco.Cms.Core.Configuration.Models;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// Controller responsible for managing configuration for data types in the Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 public class ConfigurationDataTypeController : DataTypeControllerBase
 {
    private readonly DataTypesSettings _dataTypesSettings;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="ConfigurationDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypesSettings">An <see cref="IOptionsSnapshot{T}"/> containing the <see cref="DataTypesSettings"/> configuration options.</param>
    public ConfigurationDataTypeController(IOptionsSnapshot<DataTypesSettings> dataTypesSettings) => _dataTypesSettings = dataTypesSettings.Value;

+    /// <summary>
+    /// Retrieves the configuration settings for data types, including whether data types can be changed and the identifiers for document and media list views.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token that can be used to cancel the operation.</param>
+    /// <returns>An <see cref="IActionResult"/> containing a <see cref="DatatypeConfigurationResponseModel"/> with the data type configuration settings.</returns>
    [HttpGet("configuration")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(DatatypeConfigurationResponseModel), StatusCodes.Status200OK)]
+    [EndpointSummary("Gets the data type configuration.")]
+    [EndpointDescription("Gets the configuration settings for data types.")]
    public Task<IActionResult> Configuration(CancellationToken cancellationToken)
    {
        var responseModel = new DatatypeConfigurationResponseModel
@@ -12,6 +12,9 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// API controller responsible for handling requests to copy data types within the Umbraco CMS management interface.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class CopyDataTypeController : DataTypeControllerBase
@@ -19,16 +22,32 @@ public class CopyDataTypeController : DataTypeControllerBase
    private readonly IDataTypeService _dataTypeService;
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="CopyDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">An instance of <see cref="IDataTypeService"/> used to manage data types.</param>
+    /// <param name="backOfficeSecurityAccessor">An instance of <see cref="IBackOfficeSecurityAccessor"/> used to access back office security information.</param>
    public CopyDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
    {
        _dataTypeService = dataTypeService;
        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
    }

+    /// <summary>
+    /// Creates a copy of the specified data type.
+    /// The new data type will have a unique Id and its name will have " (copy)" appended.
+    /// Optionally, the copy can be placed in a specified container if a target container Id is provided.
+    /// </summary>
+    /// <param name="cancellationToken">Token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier of the data type to copy.</param>
+    /// <param name="copyDataTypeRequestModel">The request model containing copy options, such as the target container Id.</param>
+    /// <returns>A result indicating the outcome of the copy operation.</returns>
    [HttpPost("{id:guid}/copy")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(StatusCodes.Status201Created)]
    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    [EndpointSummary("Copies a data type.")]
+    [EndpointDescription("Creates a duplicate of an existing data type identified by the provided unique Id. The copied data type will be given a new Id and have ' (copy)' appended to its name. Optionally, the copy can be placed in a specific container by providing a target container Id.")]
    public async Task<IActionResult> Copy(CancellationToken cancellationToken, Guid id, CopyDataTypeRequestModel copyDataTypeRequestModel)
    {
        IDataType? source = await _dataTypeService.GetAsync(id);
@@ -13,6 +13,9 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// API controller responsible for handling requests to create new data types in Umbraco CMS.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class CreateDataTypeController : DataTypeControllerBase
@@ -21,6 +24,12 @@ public class CreateDataTypeController : DataTypeControllerBase
    private readonly IDataTypePresentationFactory _dataTypePresentationFactory;
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="CreateDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">The <see cref="IDataTypeService"/> used to manage data types.</param>
+    /// <param name="dataTypePresentationFactory">The <see cref="IDataTypePresentationFactory"/> used to create data type presentation models.</param>
+    /// <param name="backOfficeSecurityAccessor">The <see cref="IBackOfficeSecurityAccessor"/> used to access back office security information.</param>
    public CreateDataTypeController(IDataTypeService dataTypeService, IDataTypePresentationFactory dataTypePresentationFactory, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
    {
        _dataTypeService = dataTypeService;
@@ -28,11 +37,21 @@ public class CreateDataTypeController : DataTypeControllerBase
        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
    }

+    /// <summary>
+    /// Creates a new data type using the configuration provided in the request model.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="createDataTypeRequestModel">The model containing the configuration details for the new data type.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> that represents the result of the create operation. Returns <c>201 Created</c> on success, or an appropriate error response on failure.
+    /// </returns>
    [HttpPost]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(StatusCodes.Status201Created)]
    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    [EndpointSummary("Creates a new data type.")]
+    [EndpointDescription("Creates a new data type with the configuration specified in the request model.")]
    public async Task<IActionResult> Create(CancellationToken cancellationToken, CreateDataTypeRequestModel createDataTypeRequestModel)
    {
        var attempt = await _dataTypePresentationFactory.CreateAsync(createDataTypeRequestModel);
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.Builders;
@@ -9,6 +9,10 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// Serves as the base controller for managing data types in the Umbraco CMS API.
+/// This class is intended to be inherited by controllers that handle data type operations.
+/// </summary>
 [VersionedApiBackOfficeRoute(Constants.UdiEntityType.DataType)]
 [ApiExplorerSettings(GroupName = "Data Type")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDocumentsOrMediaOrMembersOrContentTypes)]
@@ -55,6 +59,21 @@ public abstract class DataTypeControllerBase : ManagementApiControllerBase

    protected IActionResult DataTypeNotFound() => OperationStatusResult(DataTypeOperationStatus.NotFound, DataTypeNotFound);

+    protected IActionResult PropertyEditorSchemaOperationStatusResult(PropertyEditorSchemaOperationStatus status) =>
+        OperationStatusResult(status, problemDetailsBuilder => status switch
+        {
+            PropertyEditorSchemaOperationStatus.DataTypeNotFound => NotFound(problemDetailsBuilder
+                .WithTitle("The data type could not be found")
+                .Build()),
+            PropertyEditorSchemaOperationStatus.SchemaNotSupported => NotFound(problemDetailsBuilder
+                .WithTitle("Schema not supported")
+                .WithDetail("The property editor for this data type does not support schema information.")
+                .Build()),
+            _ => StatusCode(StatusCodes.Status500InternalServerError, problemDetailsBuilder
+                .WithTitle("Unknown property editor schema operation status.")
+                .Build()),
+        });
+
    private IActionResult DataTypeNotFound(ProblemDetailsBuilder problemDetailsBuilder)
        => NotFound(problemDetailsBuilder
            .WithTitle("The data type could not be found")
@@ -11,6 +11,9 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType;

+/// <summary>
+/// API controller responsible for handling requests to delete data types in the system.
+/// </summary>
 [ApiVersion("1.0")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
 public class DeleteDataTypeController : DataTypeControllerBase
@@ -18,17 +21,30 @@ public class DeleteDataTypeController : DataTypeControllerBase
    private readonly IDataTypeService _dataTypeService;
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="DeleteDataTypeController"/> class.
+    /// </summary>
+    /// <param name="dataTypeService">Service used to manage and delete data types.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context and authentication.</param>
    public DeleteDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
    {
        _dataTypeService = dataTypeService;
        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
    }

+    /// <summary>
+    /// Deletes a data type identified by the provided Id.
+    /// </summary>
+    /// <param name="cancellationToken">The cancellation token to cancel the operation.</param>
+    /// <param name="id">The unique identifier of the data type to delete.</param>
+    /// <returns>An <see cref="IActionResult"/> indicating the result of the delete operation.</returns>
    [HttpDelete("{id:guid}")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(StatusCodes.Status200OK)]
    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    [EndpointSummary("Deletes a data type.")]
+    [EndpointDescription("Deletes a data type identified by the provided Id.")]
    public async Task<IActionResult> Delete(CancellationToken cancellationToken, Guid id)
    {
        Attempt<IDataType?, DataTypeOperationStatus> result = await _dataTypeService.DeleteAsync(id, CurrentUserKey(_backOfficeSecurityAccessor));
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Core;
@@ -6,6 +6,10 @@ using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Filter;

+/// <summary>
+/// Serves as the base controller for implementing data type filtering operations in the API.
+/// Provides common functionality for derived controllers handling data type filters.
+/// </summary>
 [ApiExplorerSettings(GroupName = "Data Type")]
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Filter}/{Constants.UdiEntityType.DataType}")]
 // This auth policy might become problematic, as when getting DataTypes on Media types, you don't need access to the document tree.
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
@@ -11,21 +11,41 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Filter;

+/// <summary>
+/// Controller responsible for handling operations related to filters on data types in the management API.
+/// </summary>
 [ApiVersion("1.0")]
 public class FilterDataTypeFilterController : DataTypeFilterControllerBase
 {
    private readonly IDataTypeService _dataTypeService;
    private readonly IUmbracoMapper _mapper;

+    /// <summary>
+    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Controllers.DataType.Filter.FilterDataTypeFilterController"/> class, responsible for filtering data types.
+    /// </summary>
+    /// <param name="dataTypeService">The <see cref="IDataTypeService"/> used to manage data types.</param>
+    /// <param name="mapper">The <see cref="IUmbracoMapper"/> used for mapping entities.</param>
    public FilterDataTypeFilterController(IDataTypeService dataTypeService, IUmbracoMapper mapper)
    {
        _dataTypeService = dataTypeService;
        _mapper = mapper;
    }

+    /// <summary>
+    /// Retrieves a paginated and filtered list of data types based on the specified criteria.
+    /// </summary>
+    /// <param name="cancellationToken">A token to observe while waiting for the task to complete.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for pagination).</param>
+    /// <param name="take">The maximum number of items to return (used for pagination).</param>
+    /// <param name="name">An optional filter to match data type names.</param>
+    /// <param name="editorUiAlias">An optional filter to match the editor UI alias.</param>
+    /// <param name="editorAlias">An optional filter to match the editor alias.</param>
+    /// <returns>A task that represents the asynchronous operation. The task result contains an <see cref="IActionResult"/> with a paged collection of filtered data types.</returns>
    [HttpGet]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedViewModel<DataTypeItemResponseModel>), StatusCodes.Status200OK)]
+    [EndpointSummary("Gets a filtered collection of data types.")]
+    [EndpointDescription("Filters data types based on the provided criteria with support for pagination.")]
    public async Task<IActionResult> Filter(
        CancellationToken cancellationToken,
        int skip = 0,
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.ViewModels.Folder;
@@ -7,9 +7,17 @@ using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;

+/// <summary>
+/// Controller for managing data type folders by their unique key.
+/// </summary>
 [ApiVersion("1.0")]
 public class ByKeyDataTypeFolderController : DataTypeFolderControllerBase
 {
+    /// <summary>
+    /// Constructor for <see cref="Umbraco.Cms.Api.Management.Controllers.DataType.Folder.ByKeyDataTypeFolderController"/>.
+    /// </summary>
+    /// <param name="backOfficeSecurityAccessor">Provides access to back office security features.</param>
+    /// <param name="dataTypeContainerService">Service for managing data type containers.</param>
    public ByKeyDataTypeFolderController(
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
        IDataTypeContainerService dataTypeContainerService)
@@ -17,9 +25,19 @@ public class ByKeyDataTypeFolderController : DataTypeFolderControllerBase
    {
    }

+    /// <summary>
+    /// Retrieves a data type folder by its unique identifier.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="id">The unique identifier (GUID) of the data type folder to retrieve.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> containing a <see cref="FolderResponseModel"/> with the folder data if found; otherwise, a <see cref="ProblemDetails"/> with status 404 if not found.
+    /// </returns>
    [HttpGet("{id:guid}")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(FolderResponseModel), StatusCodes.Status200OK)]
    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    [EndpointSummary("Gets a data type folder.")]
+    [EndpointDescription("Gets a data type folder identified by the provided Id.")]
    public async Task<IActionResult> ByKey(CancellationToken cancellationToken, Guid id) => await GetFolderAsync(id);
 }
--- a/Show More
+++ b/Show More