OpenApi: Lowercase document name on registration to match AddOpenApi internal behaviour (closes #23210 ) (#23212 )

* Lowercase OpenAPI document name on registration to match AddOpenApi internal behaviour AddOpenApi lowercases the document name when registering its keyed services, so ReplaceOpenApiSchemaService must receive the same lowercased key or the lookup throws. BackOfficeOpenApiDocumentBuilder now computes a normalised registration name and uses it for all DI calls, while keeping DocumentName in its original casing. ShouldInclude matches [MapToApi] case-insensitively to align with how documents are registered, and the UI dropdown label falls back to DocumentName (original casing) rather than the lowercased registration key. AddUmbracoOpenApiDocument applies the same normalisation for its apiName parameter. * Add regression tests for mixed-case OpenAPI document name registration Covers the bug scenario where AddBackOfficeOpenApiDocument with a mixed-case name and WithJsonOptions threw InvalidOperationException at startup, and verifies that ShouldInclude matches [MapToApi] case-insensitively.
Table dates and User dates (#22169 )
2026-06-26 13:59:27 +02:00 · 2026-06-26 09:23:21 +02:00 · 2026-06-26 09:19:08 +02:00 · 2026-06-26 09:09:11 +02:00 · 2026-06-26 09:08:14 +02:00 · 2026-06-25 15:59:33 +02:00
1666 changed files with 59226 additions and 19053 deletions
@@ -0,0 +1,135 @@
+---
+name: umb-release-notes
+description: Improve a set of auto-generated GitHub release notes for an Umbraco CMS release. Cross-checks the notes against every PR carrying the release label, adds any that are missing, re-files every PR under the most appropriate category, and strips purely-internal entries. Use whenever the user asks to tidy up, improve, complete, or recategorize release notes for a given version, or mentions a release-notes text file plus a version number.
+argument-hint: <version> <path-to-generated-notes-file>
+---
+
+# Umbraco CMS - Improve Release Notes
+
+Takes a file of auto-generated GitHub release notes and produces an improved version that:
+
+1. **Is complete** — every merged PR carrying the `release/<version>` label appears.
+2. **Is well-categorized** — every PR sits under the most appropriate heading.
+3. **Is free of noise** — purely-internal entries of no value to a reader are removed.
+
+The result is written to a **new** file alongside the input, so the user can diff the two.
+
+**Run autonomously.** Do NOT use `AskUserQuestion` once the required arguments (version and input file path) are available — only ask if one of them is missing from `$ARGUMENTS` and cannot be inferred (see Arguments). Beyond that, make the categorization calls yourself using the rules below; if a handful are genuinely borderline, place them anyway and note the borderline ones in your closing summary so the user can override.
+
+## Arguments
+
+`$ARGUMENTS` contains two values:
+
+1. **Version** — e.g. `17.5.0`, `18.1.0`. The GitHub label to search is `release/<version>` (so version `17.5.0` → label `release/17.5.0`).
+2. **Input file path** — full path to the text file holding the auto-generated notes (e.g. `C:\Temp\release-17.5.0-rc.md`).
+
+If either is missing, ask the user once for the missing value, then proceed.
+
+## Prerequisites
+
+Run `gh auth status`. If it fails, tell the user to authenticate `gh` (e.g. `gh auth login`) and stop — the skill needs the GitHub CLI to query PRs. The repo is always `umbraco/Umbraco-CMS`.
+
+## Procedure
+
+### 1. Read the input notes
+
+Read the input file. Note its structure — it is GitHub's generated format:
+
+- A leading HTML comment (`<!-- Release notes generated ... -->`).
+- A `## What's Changed` heading followed by `### <emoji> <Category>` sub-headings, each with `* <title> by @<author> in <url>` bullets.
+- A trailing `## New Contributors` section and a `**Full Changelog**: ...` line.
+
+Extract the set of PR numbers already present (parse the `/pull/<number>` from each bullet). Preserve each existing bullet's **exact text** (title, author, URL) when you re-emit it — only its category placement may change.
+
+### 2. Fetch every labelled PR
+
+```bash
+gh pr list --repo umbraco/Umbraco-CMS --label "release/<version>" --state closed --limit 1000 \
+  --json number,title,author,labels,mergedAt \
+  --jq '.[] | select(.mergedAt != null) | "\(.number)\t\(.author.login)\t\([.labels[].name] | join(", "))\t\(.title)"' | sort -n
+```
+
+This is the authoritative list of what the release *should* contain. Each row gives number, author, labels, title.
+
+**Guard against silent truncation.** `gh pr list` caps at `--limit` without warning, so a large release could drop the overflow and the skill would still look "complete". Count the returned rows and compare against the limit:
+
+```bash
+gh pr list --repo umbraco/Umbraco-CMS --label "release/<version>" --state closed --limit 1000 --json number --jq 'length'
+```
+
+If this equals 1000, the limit was hit — raise `--limit` and re-fetch before continuing. Do **not** proceed on a truncated list.
+
+### 3. Reconcile
+
+- **Missing labelled PRs** (labelled but not in the input file): these must be **added**. Build a bullet as `* <title> by @<author> in https://github.com/umbraco/Umbraco-CMS/pull/<number>`.
+  - **Author handle.** `<author>` in the template is the raw `.author.login` value — the bullet supplies the leading `@`, so do not prepend another. `gh`'s `.author.login` already returns bot accounts with the `[bot]` suffix as part of the login — Dependabot comes back as `dependabot[bot]`, not `dependabot` or `app/dependabot` (the `app/` form only appears in git committer metadata and CODEOWNERS, never in `gh`'s JSON). So the login is already in the right shape; use it verbatim (e.g. `.author.login` of `dependabot[bot]` renders as `@dependabot[bot]`, matching what GitHub's generator wrote for the existing bullets). The only thing to guard against is accidentally stripping or altering the `[bot]` suffix.
+- **PRs in the file but not labelled**: keep them. The generated notes span a commit range (see the `Full Changelog` compare link), so they legitimately include backports / earlier-version PRs that lack the current label. For any of these you need to categorize, fetch its labels with:
+
+  ```bash
+  gh pr view <number> --repo umbraco/Umbraco-CMS --json number,title,labels \
+    --jq '"\(.number)\t\([.labels[].name] | join(", "))\t\(.title)"'
+  ```
+
+Do **not** invent or alter the `New Contributors` section — carry it over verbatim. You cannot reliably recompute first-time contributors, so leave it as the generator produced it (mention this in the summary).
+
+### 4. Categorize every PR
+
+Use exactly these headings, in this order. Omit any heading that ends up with no entries.
+
+| Heading | What goes here | Primary signal |
+|---|---|---|
+| `### 🙌 Notable Changes` | **Don't recategorize existing entries.** Label-driven — but still add any missing PR carrying this label here. | label `category/notable` |
+| `### 💥 Breaking Changes` | **Don't recategorize existing entries.** Label-driven — but still add any missing PR carrying this label here. | label `category/breaking` |
+| `### 📦 Dependencies` | Dependency bumps | label `dependencies`; or dependabot author |
+| `### 🚀 New Features` | New user- or developer-facing capability | label `type/feature` / `category/feature`; or title introduces/adds a genuinely new capability |
+| `### 🚤 Performance` | Performance improvements | label `category/performance`; or `Performance:` title prefix |
+| `### 🌈 Accessibility Improvements` | A11y improvements (labels, contrast, keyboard) | label `category/accessibility` / `accessibility`; or clear a11y intent (e.g. "improve contrast", "missing labels") |
+| `### 🐛 Bug Fixes` | Fixes to broken/incorrect behaviour | default for anything describing a fix |
+| `### 🧪 Testing` | Test additions/changes only | label `category/test-automation` / `area/test`; or `E2E`/`QA`/"acceptance tests"/"unit test coverage"/"add tests" titles |
+| `### 🛡️ Code Quality, Documentation and Refactoring` | Refactors, deprecations, API tidy-ups, XML/MD documentation, knowledge-base (`MD`) updates | label `category/refactor`; or titles about refactoring, deprecating, renaming, documenting, constants extraction, MD/CLAUDE.md content |
+| `### 🧑‍💻 Developer Experience` | Things that improve the experience of developers building on or contributing to Umbraco — dev tooling, build/watch ergonomics, test mocks/harnesses, backoffice dev utilities | `Developer Experience` title prefix; dev tooling; mock/harness changes |
+
+**Rules:**
+
+- **Notable and Breaking are off-limits for recategorization** — never move a PR that is *already in the input file* into or out of these sections; they are driven purely by their labels and the generator placed them correctly. This does **not** exempt them from completeness: a PR discovered as missing in step 3 that carries `category/notable` or `category/breaking` must still be **added** under the matching section.
+- Label signals beat title wording, except a `Performance:`/`Developer Experience:` title prefix is decisive for its section.
+- A PR with both `type/feature` and `category/refactor` whose title clearly describes a refactor (e.g. "swap relative imports", "re-export type") belongs under Code Quality, not New Features.
+- "Add ... tests"/"unit test coverage" → Testing, even if it also touches docs. If a PR adds XML documentation *and* tests, lead with where the title's emphasis lies (documentation → Code Quality; test coverage → Testing).
+- When a PR is genuinely 50/50, pick the more reader-useful heading and list it in your closing summary as borderline.
+
+### 5. Remove purely-internal noise
+
+Drop entries that have **no value to anyone reading release notes** — pure repository plumbing with no shipped impact. Examples:
+
+- Branch/merge maintenance ("Fix main branch after merge issue").
+- CI/pipeline fixes that don't change the product.
+- Reverts of changes that never shipped in a release.
+
+**Keep** anything that ships in the product or genuinely helps developers building on Umbraco — that includes documentation/MD updates, dev tooling, and test mocks (those go to Code Quality or Developer Experience, they are *not* noise). When unsure whether something is noise, keep it and flag it in the summary rather than silently dropping it. List every removal in your closing summary.
+
+### 6. Write the output
+
+Write to a new file in the **same folder** as the input, named by appending ` - with updates` before the extension:
+
+- Input `C:\Temp\release-17.5.0-rc.md` → Output `C:\Temp\release-17.5.0-rc - with updates.md`
+
+Preserve the leading HTML comment, the `## What's Changed` heading, the `## New Contributors` section, and the `**Full Changelog**` line exactly. Only the `### <category>` groupings and their bullets change.
+
+### 7. Report
+
+Give a concise summary:
+
+- Count of PRs added (with their numbers), and which categories they landed in.
+- Notable recategorizations (PRs moved out of the catch-all Bug Fixes into Features/Performance/Testing/etc.).
+- Every entry removed, with the one-line reason.
+- Any borderline calls the user may want to override.
+- The output file path.
+
+## Verification
+
+Before reporting done, confirm:
+
+- Every PR number from step 2 is present in the output (except any you deliberately removed in step 5 — and those must be in the removal list).
+- No PR appears under more than one heading.
+- Notable and Breaking sections are byte-for-byte unchanged from the input.
+- The header comment, New Contributors, and Full Changelog lines are intact.
@@ -70,18 +70,6 @@ trim_trailing_whitespace = true
 [*.less]
 trim_trailing_whitespace = false

-##########################################
-# File Header (Uncomment to support file headers)
-# https://docs.microsoft.com/visualstudio/ide/reference/add-file-header
-##########################################
-
-# [*.{cs,csx,cake,vb,vbx}]
-file_header_template = Copyright (c) Umbraco.\nSee LICENSE for more details.
-
-# SA1636: File header copyright text should match
-# Justification: .editorconfig supports file headers. If this is changed to a value other than "none", a stylecop.json file will need to added to the project.
-# dotnet_diagnostic.SA1636.severity = none
-
 ##########################################
 # .NET Language Conventions
 # https://docs.microsoft.com/visualstudio/ide/editorconfig-language-conventions
@@ -136,6 +124,10 @@ dotnet_code_quality_unused_parameters = all:warning
 dotnet_style_operator_placement_when_wrapping = end_of_line
 # https://github.com/dotnet/roslyn/pull/40070
 dotnet_style_prefer_simplified_interpolation = true:warning
+# File header preferences
+file_header_template = Copyright (c) Umbraco.\nSee LICENSE for more details.
+dotnet_diagnostic.SA1633.severity = none # Suppressed until we decide to enforce it
+dotnet_diagnostic.SA1636.severity = none # Suppressed since we are using StyleCop

 # C# Code Style Settings
 # https://docs.microsoft.com/visualstudio/ide/editorconfig-language-conventions#c-code-style-settings
@@ -59,4 +59,5 @@
 # Generated files - hidden by default in GitHub diffs
 src/Umbraco.Web.UI.Client/src/packages/core/backend-api/** linguist-generated
 src/Umbraco.Web.UI.Login/src/api/** linguist-generated
+templates/UmbracoExtension/Client/src/api/** linguist-generated
 src/Umbraco.Cms.Api.Management/OpenApi.json linguist-generated
@@ -7,7 +7,7 @@ body:
  id: "version"
  attributes:
    label: "Which Umbraco version are you using?"
-    description: "Please write the *exact* version, example: `10.1.0`. Use the help icon in the Umbraco backoffice to find the version you're using"
+    description: "Please write the *exact* version, example: `10.1.0`. Click the Umbraco logo in the top left corner of the backoffice to find the version you're using."
  validations:
    required: true
 - type: textarea
@@ -0,0 +1,99 @@
+name: "SonarQube Cloud - Analysis"
+
+# This workflow runs the full SonarCloud analysis with the SONAR_TOKEN secret.
+# It is skipped for fork PRs since secrets are not available in that context.
+
+on:
+  push:
+    branches:
+      - main
+      - "v*/dev"
+      - "v*/main"
+      - "release/*"
+  pull_request:
+    types: [opened, synchronize, reopened]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  SONAR_PROJECT_KEY: umbraco_Umbraco-CMS
+  SONAR_ORGANIZATION: umbraco
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Build and analyze
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork != true
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET from global.json
+        uses: actions/setup-dotnet@v5
+
+      - name: Setup Java 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: "21"
+
+      - name: Cache SonarQube packages
+        uses: actions/cache@v5
+        with:
+          path: ~/.sonar/cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
+
+      - name: Install tools
+        run: |
+          dotnet tool install --global dotnet-sonarscanner
+          dotnet tool install --global dotnet-coverage
+
+      - name: Load sonar params
+        run: echo "SONARQUBE_SCANNER_PARAMS=$(jq -c . .github/workflows/sonarcloud/sonar-params.json)" >> $GITHUB_ENV
+
+      - name: Begin analysis
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          dotnet-sonarscanner begin \
+            /k:"$SONAR_PROJECT_KEY" \
+            /o:"$SONAR_ORGANIZATION" \
+            /d:sonar.token="$SONAR_TOKEN" \
+            /d:sonar.scanner.skipJreProvisioning=true
+
+      - name: Restore
+        run: dotnet restore umbraco.sln
+
+      - name: Build solution
+        run: GITHUB_ENV=/dev/null dotnet build umbraco.sln --no-restore -clp:ErrorsOnly # prevent sonar MSBuild integration from writing malformed values to $GITHUB_ENV
+
+      - name: Run unit tests with coverage
+        id: tests
+        continue-on-error: true
+        run: |
+          dotnet-coverage collect \
+            "dotnet test tests/Umbraco.Tests.UnitTests/Umbraco.Tests.UnitTests.csproj --no-build" \
+            --output TestResults/coverage.xml \
+            --output-format xml
+
+      - name: Warn on test failure
+        if: steps.tests.outcome == 'failure'
+        run: |
+          if [ -f TestResults/coverage.xml ]; then
+            echo "::warning::Unit tests failed - SonarCloud analysis will proceed with the collected coverage data"
+          else
+            echo "::warning::Unit tests failed and no coverage data was collected"
+          fi
+
+      - name: End analysis
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: dotnet-sonarscanner end /d:sonar.token="$SONAR_TOKEN"
@@ -0,0 +1,7 @@
+{
+  "sonar.cs.vscoveragexml.reportsPaths": "TestResults/coverage.xml",
+  "sonar.inclusions": "src/**,templates/**,tools/**,tests/**,.github/**,build/**",
+  "sonar.exclusions": "**/bin/**,**/obj/**,**/node_modules/**,**/lang/*.ts,**/mocks/**,**/wwwroot/**,**/dist-cms/**,**/*.generated.cs,src/Umbraco.Web.UI/umbraco/**,src/Umbraco.Cms.Persistence.EFCore.*/Migrations/**,src/Umbraco.Web.UI.Client/src/packages/core/backend-api/**,**/.nuget/**",
+  "sonar.test.inclusions": "tests/**,**/*.test.ts,**/*.spec.ts",
+  "sonar.typescript.tsconfigPaths": "src/Umbraco.Web.UI.Client/tsconfig.json,src/Umbraco.Web.UI.Client/tsconfig.node.json,src/Umbraco.Web.UI.Login/tsconfig.json"
+}
@@ -120,3 +120,7 @@ trace.zip
 /tests/Umbraco.Tests.Integration/appsettings-schema.*.json
 /tests/Umbraco.Tests.Integration/umbraco-package-schema.json
 /src/Umbraco.Cms/appsettings-schema.json
+.playwright-mcp/
+
+# SonarQube local analysis cache
+.sonarqube/
@@ -48,7 +48,6 @@ dotnet_analyzer_diagnostic.category-StyleCop.CSharp.OrderingRules.severity = sug
 dotnet_analyzer_diagnostic.category-StyleCop.CSharp.MaintainabilityRules.severity = suggestion
 dotnet_analyzer_diagnostic.category-StyleCop.CSharp.LayoutRules.severity = suggestion

-dotnet_diagnostic.SA1636.severity = none # SA1636: File header copyright text should match
 dotnet_diagnostic.SA1101.severity = none # PrefixLocalCallsWithThis - stylecop appears to be ignoring dotnet_style_qualification_for_*
 dotnet_diagnostic.SA1309.severity = none # FieldNamesMustNotBeginWithUnderscore

@@ -448,6 +448,14 @@ When a PR changes Management API controllers or models, the `OpenApi.json` file

 The backoffice is published to npm as `@umbraco-cms/backoffice`. Runtime dependencies are provided via importmap; npm peerDependencies provide types only. For full details on dependency hoisting, version range logic, and plugin development, see `/src/Umbraco.Web.UI.Client/CLAUDE.md` → "npm Package Publishing".

+### SQL Server 2100-parameter limit
+
+Any `WHERE IN (@0, @1, ...)` built from a runtime-sized collection risks hitting SQL Server's 2100-parameter ceiling and throwing `SqlException` 8003 in production.
+
+Batch with `IEnumerable<T>.InGroupsOf(Constants.Sql.MaxParameterCount)` or `Database.FetchByGroups(...)` whenever the collection size is driven by user data — not just when it currently fits. Watch for products of two scaling dimensions (documents × languages, properties × versions) and config-tunable batch sizes whose defaults are safe but ceilings aren't.
+
+Full guidance, safe patterns and decision rule: see `/src/Umbraco.Infrastructure/CLAUDE.md` → "Avoiding the SQL Server 2100-parameter limit".
+
 ### Known Limitations

 1. **Circular Dependencies**: Avoided via `Lazy<T>` or event notifications
@@ -544,6 +552,16 @@ Allowed, but cheap to write and cheaper to leave behind. Keep them short and tra

 ---

+## 9. Testing Practices
+
+### Tests for a bug fix must fail before the fix
+
+Verify any test you add for a bug fix actually catches the bug: either write the failing test first (TDD), or temporarily revert the production change and confirm the test fails before re-applying. A test that passes both ways proves nothing. Watch for coincidental passes — default seed/sort orders can make a buggy path produce the right answer for the test's specific inputs; construct inputs so the broken and fixed behaviours give visibly different results.
+
+For integration tests that exercise caching or cache refreshers, see `tests/Umbraco.Tests.Integration/CLAUDE.md` — the harness disables caching by default, which can produce false greens.
+
+---
+
 ## Quick Reference

 ### Essential Commands
@@ -40,7 +40,7 @@
  <!-- Package Validation -->
  <PropertyGroup>
    <GenerateCompatibilitySuppressionFile>false</GenerateCompatibilitySuppressionFile>
-    <EnablePackageValidation>false</EnablePackageValidation> <!-- TODO (V18): Set to true once this version is released. -->
+    <EnablePackageValidation>true</EnablePackageValidation>
    <PackageValidationBaselineVersion>18.0.0</PackageValidationBaselineVersion>
    <EnableStrictModeForCompatibleFrameworksInPackage>true</EnableStrictModeForCompatibleFrameworksInPackage>
    <EnableStrictModeForCompatibleTfms>true</EnableStrictModeForCompatibleTfms>
@@ -64,4 +64,14 @@
      </_ProjectReferencesWithVersions>
    </ItemGroup>
  </Target>
+
+  <!-- Workaround for https://github.com/umbraco/Umbraco-CMS/issues/23018
+       Due to the amount of XML documentation in this solution, the OpenAPI XML documentation source generator produces
+       too many lines of code causing a StackOverflowException when running on IIS. For that reason we disable the analyzer.
+       See https://learn.microsoft.com/en-us/aspnet/core/fundamentals/openapi/openapi-comments?view=aspnetcore-10.0#disabling-xml-documentation-support -->
+  <Target Name="DisableCompileTimeOpenApiXmlGenerator" BeforeTargets="CoreCompile" Condition="'$(IsPackable)' != 'false' or '$(IsTestProject)' == 'true'">
+    <ItemGroup>
+      <Analyzer Remove="@(Analyzer)" Condition="'%(Filename)' == 'Microsoft.AspNetCore.OpenApi.SourceGenerators'" />
+    </ItemGroup>
+  </Target>
 </Project>
@@ -49,15 +49,15 @@
    <PackageVersion Include="Asp.Versioning.Mvc" Version="10.0.0" />
    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="10.0.0" />
    <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
-    <PackageVersion Include="Examine" Version="3.7.1" />
-    <PackageVersion Include="Examine.Core" Version="3.7.1" />
+    <PackageVersion Include="Examine" Version="3.8.0" />
+    <PackageVersion Include="Examine.Core" Version="3.8.0" />
    <PackageVersion Include="HtmlAgilityPack" Version="1.12.4" />
    <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
    <PackageVersion Include="MailKit" Version="4.16.0" />
    <PackageVersion Include="Markdig" Version="1.1.3" />
    <PackageVersion Include="Markdown" Version="2.2.1" />
-    <PackageVersion Include="MessagePack" Version="3.1.4" />
+    <PackageVersion Include="MessagePack" Version="3.1.7" />
    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
    <PackageVersion Include="MiniProfiler.Shared" Version="4.5.4" />
    <PackageVersion Include="ncrontab" Version="3.4.0" />
@@ -95,4 +95,4 @@
    <!-- TODO: Remove this pinned dependency when Examine updates its Microsoft.AspNetCore.DataProtection reference. -->
    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.7" />
  </ItemGroup>
-</Project>
+</Project>
@@ -45,7 +45,7 @@ parameters:
  - name: integrationNonReleaseTestFilter
    displayName: TestFilter used for non-release type builds
    type: string
-    default: "--filter TestCategory!=LongRunning&TestCategory!=NonCritical"
+    default: "TestCategory!=LongRunning&TestCategory!=NonCritical"
  - name: integrationReleaseTestFilter
    displayName: TestFilter used for release type builds
    type: string
@@ -53,7 +53,7 @@ parameters:
  - name: nonWindowsIntegrationNonReleaseTestFilter
    displayName: TestFilter used for non-release type builds on non Windows agents
    type: string
-    default: "--filter TestCategory!=LongRunning&TestCategory!=NonCritical"
+    default: "TestCategory!=LongRunning&TestCategory!=NonCritical"
  - name: nonWindowsIntegrationReleaseTestFilter
    displayName: TestFilter used for release type builds on non Windows agents
    type: string
@@ -455,13 +455,13 @@ stages:
              projects: "tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj"
              testRunTitle: Integration Tests SQLite - $(Agent.OS)
              ${{ if and(eq(variables['Agent.OS'],'Windows_NT'), or(variables.releaseTestFilter, parameters.forceReleaseTestFilter)) }}:
-                arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build ${{parameters.integrationReleaseTestFilter}}'
+                arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build'
              ${{ elseif eq(variables['Agent.OS'],'Windows_NT') }}:
-                arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build ${{parameters.integrationNonReleaseTestFilter}}'
+                arguments: '--filter "$(testFilter) & ${{parameters.integrationNonReleaseTestFilter}}" --configuration $(buildConfiguration) --no-build'
              ${{ elseif or(variables.releaseTestFilter, parameters.forceReleaseTestFilter) }}:
-                arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build ${{parameters.nonWindowsIntegrationReleaseTestFilter}}'
+                arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build'
              ${{ else }}:
-                arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build ${{parameters.nonWindowsIntegrationNonReleaseTestFilter}}'
+                arguments: '--filter "$(testFilter) & ${{parameters.nonWindowsIntegrationNonReleaseTestFilter}}" --configuration $(buildConfiguration) --no-build'
      # Integration Tests (SQL Server)
      - job:
        timeoutInMinutes: 180
@@ -569,13 +569,13 @@ stages:
              projects: "tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj"
              testRunTitle: Integration Tests SQL Server - $(Agent.OS)
              ${{ if and(eq(variables['Agent.OS'],'Windows_NT'), or(variables.releaseTestFilter, parameters.forceReleaseTestFilter)) }}:
-                arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build ${{parameters.integrationReleaseTestFilter}}'
+                arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build'
              ${{ elseif eq(variables['Agent.OS'],'Windows_NT') }}:
-                arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build ${{parameters.integrationNonReleaseTestFilter}}'
+                arguments: '--filter "$(testFilter) & ${{parameters.integrationNonReleaseTestFilter}}" --configuration $(buildConfiguration) --no-build'
              ${{ elseif or(variables.releaseTestFilter, parameters.forceReleaseTestFilter) }}:
-                arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build ${{parameters.nonWindowsIntegrationReleaseTestFilter}}'
+                arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build'
              ${{ else }}:
-                arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build ${{parameters.nonWindowsIntegrationNonReleaseTestFilter}}'
+                arguments: '--filter "$(testFilter) & ${{parameters.nonWindowsIntegrationNonReleaseTestFilter}}" --configuration $(buildConfiguration) --no-build'

          # Stop SQL Server
          - pwsh: docker stop mssql
@@ -825,74 +825,31 @@ stages:
                publishFeedCredentials: "MyGet - Umbraco Nightly"
              ${{ else }}:
                publishFeedCredentials: "MyGet - Pre-releases"
+      # Pre-release/nightly feeds: keep the `latest` dist-tag default (no `next` split).
      - job:
        displayName: Push to pre-release feed (npm)
        steps:
-          - checkout: none
-          - download: current
-            artifact: npm
-          - bash: |
-              # Check if we are on a nightly build
-              if [ $isNightly = "False" ]; then
-                  echo "##[debug]Prerelease build detected"
-                  registry="https://www.myget.org/F/umbracoprereleases/npm/"
-              else
-                  echo "##[debug]Nightly build detected"
-                  registry="https://www.myget.org/F/umbraconightly/npm/"
-              fi
-              echo "@umbraco-cms:registry=$registry" >> .npmrc
-            env:
-              isNightly: ${{parameters.isNightly}}
-            workingDirectory: $(Pipeline.Workspace)/npm
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm (MyGet)
-            inputs:
-              workingFile: "$(Pipeline.Workspace)/npm/.npmrc"
+          - template: templates/npm-publish.yml
+            parameters:
+              artifactName: npm
              customEndpoint: "MyGet (npm) - Umbracoprereleases, MyGet (npm) - Umbraconightly"
-          - bash: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push to npm (MyGet)
-            workingDirectory: $(Pipeline.Workspace)/npm
+              displayName: Push to npm (MyGet)
+              ${{ if eq(parameters.isNightly, true) }}:
+                registry: https://www.myget.org/F/umbraconightly/npm/
+              ${{ else }}:
+                registry: https://www.myget.org/F/umbracoprereleases/npm/
      - job: PublishTestHelpersNpm
        displayName: Push TestHelpers to pre-release feed (npm)
        steps:
-          - checkout: none
-          - download: current
-            artifact: npm-testhelpers
-          - bash: |
-              # Check if we are on a nightly build
-              if [ $isNightly = "False" ]; then
-                  echo "##[debug]Prerelease build detected"
-                  registry="https://www.myget.org/F/umbracoprereleases/npm/"
-              else
-                  echo "##[debug]Nightly build detected"
-                  registry="https://www.myget.org/F/umbraconightly/npm/"
-              fi
-              echo "@umbraco-cms:registry=$registry" >> .npmrc
-            env:
-              isNightly: ${{parameters.isNightly}}
-            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm (MyGet)
-            inputs:
-              workingFile: "$(Pipeline.Workspace)/npm-testhelpers/.npmrc"
+          - template: templates/npm-publish.yml
+            parameters:
+              artifactName: npm-testhelpers
              customEndpoint: "MyGet (npm) - Umbracoprereleases, MyGet (npm) - Umbraconightly"
-          - bash: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push test helpers to npm (MyGet)
-            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
+              displayName: Push test helpers to npm (MyGet)
+              ${{ if eq(parameters.isNightly, true) }}:
+                registry: https://www.myget.org/F/umbraconightly/npm/
+              ${{ else }}:
+                registry: https://www.myget.org/F/umbracoprereleases/npm/

  - stage: Deploy_NuGet
    displayName: NuGet release
@@ -905,10 +862,10 @@ stages:
      - job: WaitForApproval
        displayName: Wait for manual approval
        pool: server
-        timeoutInMinutes: 4320 # 3 days
        steps:
          - task: ManualValidation@0
            displayName: Manual approval to push to NuGet
+            timeoutInMinutes: 4320 # 3 days
            inputs:
              notifyUsers: ''
              instructions: 'Approve to push the NuGet release.'
@@ -941,53 +898,30 @@ stages:
    condition: and(in(dependencies.Deploy_NuGet.result, 'Succeeded', 'SucceededWithIssues'), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.npmDeploy}}))
    dependsOn:
      - Deploy_NuGet
+    variables:
+      # `latest` for stable releases, `next` for prereleases.
+      npmDistTag: $[ iif(eq(stageDependencies.Build.A.outputs['build.NBGV_PrereleaseVersionNoLeadingHyphen'], ''), 'latest', 'next') ]
    jobs:
      - job: Publish
        displayName: Push to NPM
        steps:
-          - checkout: none
-          - download: current
-            artifact: npm
-          - bash: echo "@umbraco-cms:registry=https://registry.npmjs.org" >> .npmrc
-            workingDirectory: $(Pipeline.Workspace)/npm
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm
-            inputs:
-              workingFile: $(Pipeline.Workspace)/npm/.npmrc
+          - template: templates/npm-publish.yml
+            parameters:
+              artifactName: npm
+              registry: https://registry.npmjs.org/
              customEndpoint: "NPM - Umbraco Backoffice"
-          - script: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push to npm
-            workingDirectory: $(Pipeline.Workspace)/npm
+              displayName: Push to npm
+              npmTag: $(npmDistTag)
      - job: PublishTestHelpers
        displayName: Push Test Helpers to NPM
        steps:
-          - checkout: none
-          - download: current
-            artifact: npm-testhelpers
-          - bash: echo "@umbraco-cms:registry=https://registry.npmjs.org" >> .npmrc
-            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm
-            inputs:
-              workingFile: $(Pipeline.Workspace)/npm-testhelpers/.npmrc
+          - template: templates/npm-publish.yml
+            parameters:
+              artifactName: npm-testhelpers
+              registry: https://registry.npmjs.org/
              customEndpoint: "NPM - Umbraco Backoffice"
-          - script: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push test helpers to npm
-            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
+              displayName: Push test helpers to npm
+              npmTag: $(npmDistTag)

  - stage: Upload_API_Docs
    pool:
@@ -4,11 +4,11 @@ pr: none
 trigger: none

 schedules:
-  - cron: '0 6 * * *'
-    displayName: Daily 6AM build (v18/dev)
+  - cron: '0 0 * * *'
+    displayName: Daily 0AM build (main)
    branches:
      include:
-        - v18/dev
+        - main

 parameters:
  - name: skipIntegrationTests
@@ -0,0 +1,28 @@
+parameters:
+  - name: artifactName # "npm" or "npm-testhelpers"
+    type: string
+  - name: registry # scoped-registry URL to publish to
+    type: string
+  - name: customEndpoint # npmAuthenticate service connection(s)
+    type: string
+  - name: displayName # label for the publish step
+    type: string
+  - name: npmTag # dist-tag to publish under
+    type: string
+    default: latest
+
+steps:
+  - checkout: none
+  - download: current
+    artifact: ${{ parameters.artifactName }}
+  - script: npm config set @umbraco-cms:registry ${{ parameters.registry }} --location=project
+    displayName: Add scoped registry to .npmrc
+    workingDirectory: $(Pipeline.Workspace)/${{ parameters.artifactName }}
+  - task: npmAuthenticate@0
+    displayName: Authenticate with npm
+    inputs:
+      workingFile: $(Pipeline.Workspace)/${{ parameters.artifactName }}/.npmrc
+      customEndpoint: ${{ parameters.customEndpoint }}
+  - script: npm publish *.tgz --tag ${{ parameters.npmTag }}
+    displayName: ${{ parameters.displayName }}
+    workingDirectory: $(Pipeline.Workspace)/${{ parameters.artifactName }}
@@ -1,4 +1,3 @@
-using System.Text.Json.Serialization.Metadata;
 using Asp.Versioning;
 using Microsoft.AspNetCore.Mvc.Abstractions;
 using Microsoft.AspNetCore.Mvc.ApiExplorer;
@@ -69,7 +68,7 @@ internal abstract class ConfigureUmbracoOpenApiOptionsBase : IConfigureNamedOpti
        });

        options.ShouldInclude = ShouldInclude;
-        options.CreateSchemaReferenceId = CreateSchemaReferenceId;
+        options.CreateSchemaReferenceId = UmbracoSchemaIdGenerator.CreateSchemaReferenceId;

        options.AddOperationTransformer<UmbracoOperationIdTransformer>();

@@ -80,33 +79,6 @@ internal abstract class ConfigureUmbracoOpenApiOptionsBase : IConfigureNamedOpti
            .AddDocumentTransformer<SortTagsAndPathsTransformer>();
    }

-    /// <summary>
-    /// Creates a schema reference ID for the given JSON type info.
-    /// Returns null for types that should be inlined, the default schema ID for non-Umbraco types,
-    /// or a generated schema ID for Umbraco types.
-    /// </summary>
-    /// <param name="jsonTypeInfo">The JSON type info to create a schema reference ID for.</param>
-    /// <returns>The schema reference ID, or null if the type should be inlined.</returns>
-    internal static string? CreateSchemaReferenceId(JsonTypeInfo jsonTypeInfo)
-    {
-        // Ensure that only types that would normally be included in the schema generation are given a schema reference ID.
-        // Otherwise, we should return null to inline them.
-        var defaultSchemaReferenceId = OpenApiOptions.CreateDefaultSchemaReferenceId(jsonTypeInfo);
-        if (defaultSchemaReferenceId is null)
-        {
-            return null;
-        }
-
-        Type targetType = Nullable.GetUnderlyingType(jsonTypeInfo.Type) ?? jsonTypeInfo.Type;
-
-        if (targetType.Namespace?.StartsWith("Umbraco.Cms") is not true)
-        {
-            return defaultSchemaReferenceId;
-        }
-
-        return UmbracoSchemaIdGenerator.Generate(targetType);
-    }
-
    /// <summary>
    /// Determines whether the specified API description should be included in this OpenAPI document.
    /// </summary>
@@ -30,6 +30,27 @@ internal static class OpenApiSchemaServiceExtensions
        this IServiceCollection services,
        string documentName,
        string jsonOptionsName)
+        => services.ReplaceOpenApiSchemaService(
+            documentName,
+            sp => sp.GetRequiredService<IOptionsMonitor<JsonOptions>>().Get(jsonOptionsName));
+
+    /// <summary>
+    /// Replaces the internal Microsoft <c>OpenApiSchemaService</c> registration for the specified document so that schema
+    /// generation uses the <see cref="JsonOptions"/> instance produced by the supplied factory. Use this overload when
+    /// the options need to be resolved from the service provider, computed at the last moment, or built in a way that
+    /// doesn't fit the named-options lookup.
+    /// </summary>
+    /// <param name="services">The service collection.</param>
+    /// <param name="documentName">The OpenAPI document key.</param>
+    /// <param name="jsonOptionsFactory">Factory invoked when the schema service is first resolved. Receives the resolving <see cref="IServiceProvider"/> and returns the <see cref="JsonOptions"/> to use.</param>
+    /// <returns>The same <see cref="IServiceCollection"/> for chaining.</returns>
+    /// <remarks>
+    /// Workaround for <see href="https://github.com/dotnet/aspnetcore/issues/66340">dotnet/aspnetcore#66340</see>.
+    /// </remarks>
+    public static IServiceCollection ReplaceOpenApiSchemaService(
+        this IServiceCollection services,
+        string documentName,
+        Func<IServiceProvider, JsonOptions> jsonOptionsFactory)
    {
        ServiceDescriptor descriptor = services.FirstOrDefault(sd =>
            sd.ServiceType.FullName == OpenApiSchemaServiceFullName
@@ -47,7 +68,7 @@ internal static class OpenApiSchemaServiceExtensions
                sp,
                descriptor.ServiceType,
                key,
-                Options.Create(sp.GetRequiredService<IOptionsMonitor<JsonOptions>>().Get(jsonOptionsName))));
+                Options.Create(jsonOptionsFactory(sp))));

        return services;
    }
@@ -23,12 +23,26 @@ public static class OpenApiServiceCollectionExtensions
        this IServiceCollection services,
        string documentName,
        string? documentTitle = null)
+        => services.AddOpenApiDocumentToUi(documentName, () => documentTitle);
+
+    /// <summary>
+    /// Adds an OpenAPI document to the OpenAPI UI document selector dropdown, resolving the title lazily so
+    /// callers (such as builder-pattern helpers) can defer it until SwaggerUI options are resolved.
+    /// </summary>
+    /// <param name="services">The <see cref="IServiceCollection"/> instance.</param>
+    /// <param name="documentName">The name/identifier of the OpenAPI document.</param>
+    /// <param name="documentTitleFactory">Factory invoked when SwaggerUI options are resolved. Returning <c>null</c> falls back to <paramref name="documentName"/>.</param>
+    /// <returns>The <see cref="IServiceCollection"/> instance.</returns>
+    internal static IServiceCollection AddOpenApiDocumentToUi(
+        this IServiceCollection services,
+        string documentName,
+        Func<string?> documentTitleFactory)
    {
        services.AddOptions<SwaggerUIOptions>()
            .Configure<IOptions<UmbracoOpenApiOptions>>((swaggerUiOptions, openApiOptions) =>
            {
                var openApiRoute = openApiOptions.Value.RouteTemplate.Replace("{documentName}", documentName).EnsureStartsWith("/");
-                swaggerUiOptions.SwaggerEndpoint(openApiRoute, documentTitle ?? documentName);
+                swaggerUiOptions.SwaggerEndpoint(openApiRoute, documentTitleFactory() ?? documentName);
                swaggerUiOptions.ConfigObject.Urls = swaggerUiOptions.ConfigObject.Urls.OrderBy(x => x.Name);
            });

@@ -59,6 +59,7 @@ public static class UmbracoBuilderApiExtensions
        string? jsonOptionsName = null)
        where TConfigureOptions : ConfigureUmbracoOpenApiOptionsBase
    {
+        apiName = apiName.ToLowerInvariant();
        builder.Services.AddOpenApi(apiName);
        builder.Services.ConfigureOptions<TConfigureOptions>();
        builder.Services.AddOpenApiDocumentToUi(apiName, apiTitle);
@@ -0,0 +1,177 @@
+using Microsoft.AspNetCore.Http.Json;
+using Microsoft.AspNetCore.OpenApi;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using Umbraco.Cms.Api.Common.Attributes;
+using Umbraco.Cms.Api.Common.DependencyInjection;
+using Umbraco.Cms.Core.DependencyInjection;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+/// <summary>
+/// Fluent builder for configuring a custom OpenAPI document.
+/// </summary>
+public sealed class BackOfficeOpenApiDocumentBuilder
+{
+    private readonly List<Action<OpenApiOptions>> _configurations = [];
+
+    private string? _title;
+    private string? _uiTitle;
+    private bool _includedInUi = true;
+    private Func<IServiceProvider, JsonOptions>? _httpJsonOptionsFactory;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="BackOfficeOpenApiDocumentBuilder"/> class.
+    /// </summary>
+    /// <param name="documentName">The name of the OpenAPI document being configured.</param>
+    internal BackOfficeOpenApiDocumentBuilder(string documentName)
+        => DocumentName = documentName;
+
+    /// <summary>
+    /// Gets the name of the OpenAPI document being configured.
+    /// </summary>
+    public string DocumentName { get; }
+
+    /// <summary>
+    /// Sets the document's <c>Info.Title</c>. Also used as the UI dropdown label unless overridden via
+    /// <see cref="WithUiTitle"/>.
+    /// </summary>
+    /// <param name="title">The title to display.</param>
+    /// <returns>The same builder for chaining.</returns>
+    public BackOfficeOpenApiDocumentBuilder WithTitle(string title)
+    {
+        _title = title;
+        return this;
+    }
+
+    /// <summary>
+    /// Overrides the UI dropdown label for this document.
+    /// </summary>
+    /// <param name="uiTitle">The label to display.</param>
+    /// <returns>The same builder for chaining.</returns>
+    public BackOfficeOpenApiDocumentBuilder WithUiTitle(string uiTitle)
+    {
+        _uiTitle = uiTitle;
+        return this;
+    }
+
+    /// <summary>
+    /// Excludes this document from the UI dropdown.
+    /// </summary>
+    /// <returns>The same builder for chaining.</returns>
+    public BackOfficeOpenApiDocumentBuilder ExcludeFromUi()
+    {
+        _includedInUi = false;
+        return this;
+    }
+
+    /// <summary>
+    /// Adds an <see cref="OpenApiOptions"/> configuration callback. Multiple calls compose.
+    /// </summary>
+    /// <param name="configure">Callback to configure the options.</param>
+    /// <returns>The same builder for chaining.</returns>
+    public BackOfficeOpenApiDocumentBuilder ConfigureOpenApiOptions(Action<OpenApiOptions> configure)
+    {
+        _configurations.Add(configure);
+        return this;
+    }
+
+    /// <summary>
+    /// Sets the named <see cref="JsonOptions">Microsoft.AspNetCore.Http.Json.JsonOptions</see> used when
+    /// generating this document's schema. Use this to match the serialization conventions of the API
+    /// endpoints the document describes.
+    /// </summary>
+    /// <param name="jsonOptionsName">The name of the registered HTTP <see cref="JsonOptions"/> to apply.</param>
+    /// <returns>The same builder for chaining.</returns>
+    public BackOfficeOpenApiDocumentBuilder WithJsonOptions(string jsonOptionsName)
+        => WithJsonOptions(sp => sp.GetRequiredService<IOptionsMonitor<JsonOptions>>().Get(jsonOptionsName));
+
+    /// <summary>
+    /// Sets the <see cref="JsonOptions">Microsoft.AspNetCore.Http.Json.JsonOptions</see> used when
+    /// generating this document's schema. Use this to match the serialization conventions of the API
+    /// endpoints the document describes.
+    /// </summary>
+    /// <param name="jsonOptions">The HTTP JSON options to apply.</param>
+    /// <returns>The same builder for chaining.</returns>
+    public BackOfficeOpenApiDocumentBuilder WithJsonOptions(JsonOptions jsonOptions)
+        => WithJsonOptions(_ => jsonOptions);
+
+    /// <summary>
+    /// Sets a factory that produces the <see cref="JsonOptions">Microsoft.AspNetCore.Http.Json.JsonOptions</see>
+    /// used when generating this document's schema. Use this to match the serialization conventions of the
+    /// API endpoints the document describes.
+    /// </summary>
+    /// <param name="jsonOptionsFactory">Factory invoked when the schema service is first resolved.</param>
+    /// <returns>The same builder for chaining.</returns>
+    public BackOfficeOpenApiDocumentBuilder WithJsonOptions(Func<IServiceProvider, JsonOptions> jsonOptionsFactory)
+    {
+        _httpJsonOptionsFactory = jsonOptionsFactory;
+        return this;
+    }
+
+    /// <summary>
+    /// Applies the accumulated configuration to the supplied <see cref="IUmbracoBuilder"/>'s service
+    /// collection. Called by <c>AddBackOfficeOpenApiDocument</c> once the user-supplied callback returns.
+    /// </summary>
+    /// <param name="builder">The Umbraco builder to register services against.</param>
+    internal void Build(IUmbracoBuilder builder)
+    {
+        // AddOpenApi lowercases the document name when registering its keyed services (https://github.com/dotnet/aspnetcore/blob/v10.0.9/src/OpenApi/src/Extensions/OpenApiServiceCollectionExtensions.cs#L64),
+        // so we must normalise here to keep AddOpenApiDocumentToUi and ReplaceOpenApiSchemaService in sync.
+        string lowercasedDocumentName = DocumentName.ToLowerInvariant();
+
+        builder.Services.AddOpenApi(
+            lowercasedDocumentName,
+            options =>
+            {
+                // ShouldInclude matches [MapToApi] case-insensitively to align with how documents are registered.
+                options.ShouldInclude = apiDescription =>
+                    apiDescription.ActionDescriptor.EndpointMetadata
+                        ?.OfType<MapToApiAttribute>()
+                        .Any(a => a.ApiName.Equals(DocumentName, StringComparison.OrdinalIgnoreCase))
+                    ?? false;
+
+                options.CreateSchemaReferenceId = UmbracoSchemaIdGenerator.CreateSchemaReferenceId;
+
+                if (_title is not null)
+                {
+                    options.AddDocumentTransformer((document, _, _) =>
+                    {
+                        document.Info.Title = _title;
+                        return Task.CompletedTask;
+                    });
+                }
+
+                // Generate operation IDs using Umbraco's naming conventions.
+                options.AddOperationTransformer<UmbracoOperationIdTransformer>();
+
+                // Trim redundant JSON-equivalent MIME types (e.g. text/json, application/*+json, text/plain)
+                // that ASP.NET Core adds alongside application/json.
+                options.AddOperationTransformer<MimeTypesTransformer>();
+
+                // Mark non-nullable properties as required so generated SDKs reflect the C# nullability.
+                options.AddSchemaTransformer<RequireNonNullablePropertiesSchemaTransformer>();
+
+                // Tag actions by group name and cleanup unused tags (caused by the tag changes).
+                options
+                    .AddOperationTransformer<TagActionsByGroupNameTransformer>()
+                    .AddDocumentTransformer<TagActionsByGroupNameTransformer>()
+                    .AddDocumentTransformer<SortTagsAndPathsTransformer>();
+
+                foreach (Action<OpenApiOptions> configure in _configurations)
+                {
+                    configure(options);
+                }
+            });
+
+        if (_includedInUi)
+        {
+            builder.Services.AddOpenApiDocumentToUi(lowercasedDocumentName, _uiTitle ?? _title ?? DocumentName);
+        }
+
+        if (_httpJsonOptionsFactory is not null)
+        {
+            builder.Services.ReplaceOpenApiSchemaService(lowercasedDocumentName, _httpJsonOptionsFactory);
+        }
+    }
+}
@@ -1,5 +1,5 @@
+using System.Net.Mime;
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.AspNetCore.Mvc.Formatters;
 using Microsoft.AspNetCore.OpenApi;
 using Microsoft.OpenApi;
 using Umbraco.Extensions;
@@ -7,11 +7,31 @@ using Umbraco.Extensions;
 namespace Umbraco.Cms.Api.Common.OpenApi;

 /// <summary>
-/// Removes unwanted MIME types from OpenAPI operations, keeping only the content types
-/// declared by <c>[Consumes]</c> for request bodies or <c>application/json</c> as the default.
+/// Trims redundant JSON-equivalent media types from OpenAPI operations.
 /// </summary>
+/// <remarks>
+/// <para>
+/// ASP.NET Core's content negotiation populates operations with several media types that all serialize to JSON
+/// (<c>text/json</c>, <c>application/*+json</c>, and <c>text/plain</c> alongside <c>application/json</c>).
+/// When <c>application/json</c> is present on a response or request body, this transformer strips those
+/// equivalents so OpenAPI consumers and generated SDKs aren't burdened with variants that produce identical
+/// payloads. Non-JSON media types (e.g. <c>application/xml</c>, <c>application/octet-stream</c>) are preserved.
+/// </para>
+/// <para>
+/// Request bodies additionally honour <c>[Consumes]</c>: when the attribute is present, the request content is
+/// replaced entirely with the declared content types, taking precedence over the
+/// JSON-equivalent stripping above.
+/// </para>
+/// </remarks>
 internal class MimeTypesTransformer : IOpenApiOperationTransformer
 {
+    private static readonly string[] _jsonEquivalentMimeTypes =
+    [
+        MediaTypeNames.Text.Plain,
+        "application/*+json",
+        "text/json"
+    ];
+
    /// <inheritdoc/>
    public Task TransformAsync(
        OpenApiOperation operation,
@@ -40,29 +60,29 @@ internal class MimeTypesTransformer : IOpenApiOperationTransformer
            }
            else
            {
-                RemoveNonJsonMimeTypes(requestContent);
+                RemoveJsonEquivalentMimeTypes(requestContent);
            }
        }

-        // For responses, always keep only application/json.
+        // For responses, drop JSON-equivalent media types when application/json is present.
        foreach (IOpenApiResponse response in (operation.Responses ?? []).Values)
        {
            if (response is OpenApiResponse openApiResponse)
            {
-                RemoveNonJsonMimeTypes(openApiResponse.Content);
+                RemoveJsonEquivalentMimeTypes(openApiResponse.Content);
            }
        }

        return Task.CompletedTask;
    }

-    private static void RemoveNonJsonMimeTypes(IDictionary<string, OpenApiMediaType>? content)
+    private static void RemoveJsonEquivalentMimeTypes(IDictionary<string, OpenApiMediaType>? content)
    {
-        if (content?.ContainsKey("application/json") != true)
+        if (content?.ContainsKey(MediaTypeNames.Application.Json) != true)
        {
            return;
        }

-        content.RemoveAll(r => r.Key != "application/json");
+        content.RemoveAll(r => _jsonEquivalentMimeTypes.Contains(r.Key, StringComparer.OrdinalIgnoreCase));
    }
 }
@@ -0,0 +1,81 @@
+using Umbraco.Cms.Core.DependencyInjection;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+/// <summary>
+/// Extension methods for <see cref="IUmbracoBuilder"/> to register custom OpenAPI documents.
+/// </summary>
+public static class UmbracoBuilderOpenApiExtensions
+{
+    /// <summary>
+    /// Registers a custom OpenAPI document with Umbraco's defaults applied.
+    /// </summary>
+    /// <param name="builder">The Umbraco builder.</param>
+    /// <param name="documentName">The document name. Matches the <c>[MapToApi]</c> value on controllers to include.</param>
+    /// <param name="configure">Optional callback to customize the document.</param>
+    /// <returns>The same <see cref="IUmbracoBuilder"/> for chaining.</returns>
+    /// <remarks>
+    /// <para>
+    /// The following defaults are applied to the document and can be customized or overridden via the
+    /// <paramref name="configure"/> callback:
+    /// </para>
+    /// <list type="bullet">
+    ///   <item>
+    ///     <description>
+    ///     Endpoints are filtered by <c>[MapToApi(documentName)]</c>; only matching endpoints appear in the document.
+    ///     </description>
+    ///   </item>
+    ///   <item>
+    ///     <description>
+    ///     Schema reference IDs are generated by <see cref="UmbracoSchemaIdGenerator.CreateSchemaReferenceId"/>, applying
+    ///     Umbraco naming conventions to types under the <c>Umbraco.Cms</c> namespace and falling back to the framework
+    ///     default for everything else. Register your own <c>CreateSchemaReferenceId</c> delegate via
+    ///     <see cref="BackOfficeOpenApiDocumentBuilder.ConfigureOpenApiOptions"/> to override.
+    ///     </description>
+    ///   </item>
+    ///   <item>
+    ///     <description>
+    ///     Operation IDs are generated by <see cref="UmbracoOperationIdTransformer"/>. Register your own
+    ///     <see cref="Microsoft.AspNetCore.OpenApi.IOpenApiOperationTransformer"/> via
+    ///     <see cref="BackOfficeOpenApiDocumentBuilder.ConfigureOpenApiOptions"/> to override.
+    ///     </description>
+    ///   </item>
+    ///   <item>
+    ///     <description>
+    ///     Operations are tagged by their controller's API group name, and the resulting tags and paths are sorted
+    ///     for stable, diffable document output.
+    ///     </description>
+    ///   </item>
+    ///   <item>
+    ///     <description>
+    ///     Redundant JSON-equivalent media types (such as <c>text/json</c>, <c>application/*+json</c>, and
+    ///     <c>text/plain</c>) are stripped from request and response content when <c>application/json</c> is present,
+    ///     so the document doesn't list spurious media types that ASP.NET Core adds by default.
+    ///     </description>
+    ///   </item>
+    ///   <item>
+    ///     <description>
+    ///     Non-nullable properties are marked as <c>required</c> in the schema so generated client SDKs reflect
+    ///     C# nullability. Override via <see cref="BackOfficeOpenApiDocumentBuilder.ConfigureOpenApiOptions"/>
+    ///     if your types don't follow this convention.
+    ///     </description>
+    ///   </item>
+    ///   <item>
+    ///     <description>
+    ///     The document is registered in the OpenAPI UI document selector dropdown. Call
+    ///     <see cref="BackOfficeOpenApiDocumentBuilder.ExcludeFromUi"/> to opt out.
+    ///     </description>
+    ///   </item>
+    /// </list>
+    /// </remarks>
+    public static IUmbracoBuilder AddBackOfficeOpenApiDocument(
+        this IUmbracoBuilder builder,
+        string documentName,
+        Action<BackOfficeOpenApiDocumentBuilder>? configure = null)
+    {
+        var documentBuilder = new BackOfficeOpenApiDocumentBuilder(documentName);
+        configure?.Invoke(documentBuilder);
+        documentBuilder.Build(builder);
+        return builder;
+    }
+}
@@ -29,16 +29,23 @@ public class UmbracoOperationIdTransformer : IOpenApiOperationTransformer
        OpenApiOperationTransformerContext context,
        CancellationToken cancellationToken)
    {
-        operation.OperationId = GenerateOperationId(context);
+        var operationId = GenerateOperationId(context);
+        if (operationId is not null)
+        {
+            operation.OperationId = operationId;
+        }
+
        return Task.CompletedTask;
    }

-    private static string GenerateOperationId(OpenApiOperationTransformerContext context)
+    private static string? GenerateOperationId(OpenApiOperationTransformerContext context)
    {
        ApiDescription apiDescription = context.Description;
        if (apiDescription.ActionDescriptor is not ControllerActionDescriptor controllerActionDescriptor)
        {
-            throw new ArgumentException($"This handler operates only on {nameof(ControllerActionDescriptor)}.");
+            // Minimal APIs and other non-MVC endpoints don't carry a ControllerActionDescriptor; leave their
+            // operation ID untouched so the framework's default applies.
+            return null;
        }

        ApiVersion defaultVersion = context.ApplicationServices.GetRequiredService<IOptions<ApiVersioningOptions>>().Value.DefaultApiVersion;
@@ -1,4 +1,6 @@
+using System.Text.Json.Serialization.Metadata;
 using System.Text.RegularExpressions;
+using Microsoft.AspNetCore.OpenApi;
 using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.OpenApi;
@@ -29,6 +31,32 @@ public static class UmbracoSchemaIdGenerator
        return Regex.Replace(name, @"[^\w]", string.Empty);
    }

+    /// <summary>
+    /// Creates a schema reference ID for the given JSON type info, applying Umbraco's naming conventions to
+    /// types in the <c>Umbraco.Cms</c> namespace and falling back to the framework default for other types.
+    /// </summary>
+    /// <param name="jsonTypeInfo">The JSON type info to create a schema reference ID for.</param>
+    /// <returns>The schema reference ID, or <c>null</c> if the type should be inlined.</returns>
+    internal static string? CreateSchemaReferenceId(JsonTypeInfo jsonTypeInfo)
+    {
+        // Ensure that only types that would normally be included in the schema generation are given a schema reference ID.
+        // Otherwise, we should return null to inline them.
+        var defaultSchemaReferenceId = OpenApiOptions.CreateDefaultSchemaReferenceId(jsonTypeInfo);
+        if (defaultSchemaReferenceId is null)
+        {
+            return null;
+        }
+
+        Type targetType = Nullable.GetUnderlyingType(jsonTypeInfo.Type) ?? jsonTypeInfo.Type;
+
+        if (targetType.Namespace?.StartsWith("Umbraco.Cms") is not true)
+        {
+            return defaultSchemaReferenceId;
+        }
+
+        return Generate(targetType);
+    }
+
    private static string SanitizedTypeName(Type t) => t.Name
        // first grab the "non-generic" part of any generic type name (i.e. "PagedViewModel`1" becomes "PagedViewModel")
        .Split('`').First()
@@ -1,7 +1,9 @@
 using Microsoft.AspNetCore.OpenApi;
+using Microsoft.Extensions.Options;
 using Umbraco.Cms.Api.Common.Configuration;
 using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Cms.Api.Delivery.OpenApi.Transformers;
+using Umbraco.Cms.Core.Configuration.Models;

 namespace Umbraco.Cms.Api.Delivery.Configuration;

@@ -10,6 +12,17 @@ namespace Umbraco.Cms.Api.Delivery.Configuration;
 /// </summary>
 internal class ConfigureUmbracoDeliveryApiOpenApiOptions : ConfigureUmbracoOpenApiOptionsBase
 {
+    private readonly DeliveryApiSettings _deliveryApiSettings;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ConfigureUmbracoDeliveryApiOpenApiOptions"/> class.
+    /// </summary>
+    /// <param name="deliveryApiSettings">The Delivery API settings.</param>
+    public ConfigureUmbracoDeliveryApiOpenApiOptions(IOptions<DeliveryApiSettings> deliveryApiSettings)
+    {
+        _deliveryApiSettings = deliveryApiSettings.Value;
+    }
+
    /// <inheritdoc />
    protected override string ApiName => DeliveryApiConfiguration.ApiName;

@@ -38,5 +51,12 @@ internal class ConfigureUmbracoDeliveryApiOpenApiOptions : ConfigureUmbracoOpenA
        options.AddOperationTransformer<MimeTypesTransformer>();
        options.AddOperationTransformer<ContentApiTransformer>();
        options.AddOperationTransformer<MediaApiTransformer>();
+
+        if (_deliveryApiSettings.OpenApi.GenerateContentTypeSchemas)
+        {
+            options
+                .AddSchemaTransformer<ContentTypeSchemaTransformer>()
+                .AddDocumentTransformer<ContentTypeSchemaTransformer>();
+        }
    }
 }
@@ -5,6 +5,7 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
 using Microsoft.Extensions.Options;
 using Microsoft.Extensions.Primitives;
 using Umbraco.Cms.Api.Common.DependencyInjection;
@@ -171,6 +172,12 @@ public static class UmbracoBuilderExtensions
        builder.Services.AddUnique<IDeliveryApiOutputCacheRequestFilter, DefaultDeliveryApiOutputCacheRequestFilter>();
        builder.Services.AddUnique<IDeliveryApiOutputCacheManager, DeliveryApiOutputCacheManager>();

+        // Signal that Umbraco has enabled output caching so the application builder registers
+        // the output cache middleware. Gated via a marker rather than IOutputCacheStore so that
+        // applications calling services.AddOutputCache(...) for their own purposes are not
+        // affected by Umbraco's automatic middleware registration.
+        builder.Services.TryAddSingleton<IUmbracoManagedOutputCacheMarker, UmbracoManagedOutputCacheMarker>();
+
        return builder;
    }

@@ -0,0 +1,19 @@
+using Microsoft.AspNetCore.OpenApi;
+using Microsoft.OpenApi;
+
+namespace Umbraco.Cms.Api.Delivery.OpenApi.Extensions;
+
+/// <summary>
+/// Provides extension methods for <see cref="OpenApiSchemaTransformerContext"/>.
+/// </summary>
+internal static class OpenApiSchemaTransformerContextExtensions
+{
+    /// <summary>
+    /// Gets the OpenAPI document from the context, throwing if it is null.
+    /// </summary>
+    /// <param name="context">The schema transformer context.</param>
+    /// <returns>The OpenAPI document.</returns>
+    /// <exception cref="InvalidOperationException">Thrown when the document is null.</exception>
+    public static OpenApiDocument GetRequiredDocument(this OpenApiSchemaTransformerContext context)
+        => context.Document ?? throw new InvalidOperationException("OpenAPI document context is required for schema registration.");
+}
@@ -0,0 +1,737 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Text.Json.Schema;
+using System.Text.Json.Serialization.Metadata;
+using Microsoft.AspNetCore.Http.Json;
+using Microsoft.AspNetCore.OpenApi;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Microsoft.OpenApi;
+using Umbraco.Cms.Api.Common.OpenApi;
+using Umbraco.Cms.Api.Delivery.OpenApi.Extensions;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Delivery.OpenApi.Transformers;
+
+/// <summary>
+/// Transforms the OpenAPI document to add schemas for the instance's document types.
+/// </summary>
+/// <remarks>
+/// <para>
+/// This transformer implements both <see cref="IOpenApiSchemaTransformer"/> and <see cref="IOpenApiDocumentTransformer"/>
+/// to handle schema generation in two phases:
+/// </para>
+/// <para>
+/// <b>Phase 1 - Schema Transformation:</b> When the schema transformer encounters types like
+/// <see cref="IApiContentResponse"/> or <see cref="IApiMediaWithCrops"/>, it generates content-type-specific
+/// schemas (e.g., "ArticleContentResponseModel") and registers them as components in the OpenAPI document.
+/// </para>
+/// <para>
+/// <b>Circular Reference Handling:</b> Content type schemas can reference each other (e.g., a "Page"
+/// might have a property of type "Article", which might reference "Page" again). To prevent infinite recursion
+/// during schema generation, we use a placeholder pattern:
+/// <list type="bullet">
+///   <item>When generating a schema, we track its ID in <c>_handledSchemas</c></item>
+///   <item>If we encounter the same schema ID again (circular reference), we return a temporary placeholder
+///   schema with metadata marking it for later replacement</item>
+///   <item>The placeholder contains a <c>x-recursive-ref</c> metadata key with the target schema ID</item>
+/// </list>
+/// </para>
+/// <para>
+/// <b>Phase 2 - Document Transformation:</b> After all schemas are generated, the document transformer
+/// resolves inline schemas into proper <c>$ref</c> references. This handles two cases:
+/// <list type="bullet">
+///   <item>Circular reference placeholders (marked with <c>x-recursive-ref</c>) created during Phase 1</item>
+///   <item>Componentized schemas (marked with <c>x-schema-id</c>) that the framework did not automatically
+///   resolve to <c>$ref</c> — this can happen for schemas reached through properties or composition
+///   rather than as direct API response types</item>
+/// </list>
+/// This is done by <see cref="ResolveSchemaReferences(OpenApiDocument, IOpenApiSchema)"/> which recursively walks
+/// through all schemas and substitutes matching entries with <see cref="OpenApiSchemaReference"/> instances.
+/// </para>
+/// </remarks>
+public sealed class ContentTypeSchemaTransformer : IOpenApiSchemaTransformer, IOpenApiDocumentTransformer
+{
+    // Metadata keys
+    private const string RecursiveRefMetadataKey = "x-recursive-ref";
+    private const string SchemaIdMetadataKey = "x-schema-id";
+
+    // Schema ID suffixes
+    private const string ResponseModelSuffix = "ResponseModel";
+    private const string ModelSuffix = "Model";
+    private const string ContentSuffix = "Content";
+    private const string ElementSuffix = "Element";
+    private const string MediaSuffix = "Media";
+    private const string MediaWithCropsSuffix = "MediaWithCrops";
+    private const string PropertiesModelSuffix = "PropertiesModel";
+
+    private readonly IContentTypeSchemaService _contentTypeSchemaService;
+    private readonly IOptionsMonitor<DeliveryApiSettings> _deliveryApiSettings;
+    private readonly ILogger<ContentTypeSchemaTransformer> _logger;
+    private readonly IJsonTypeInfoResolver _jsonTypeInfoResolver;
+
+    /// <summary>
+    /// Tracks schema IDs that have been or are being generated to detect circular references.
+    /// When a schema ID is encountered a second time, a placeholder is returned instead of recursing infinitely.
+    /// </summary>
+    private readonly HashSet<string> _handledSchemas = [];
+    private readonly JsonSerializerOptions _serializerOptions;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ContentTypeSchemaTransformer"/> class.
+    /// </summary>
+    /// <param name="contentTypeSchemaService">The content type info service.</param>
+    /// <param name="jsonOptionsMonitor">The JSON options monitor.</param>
+    /// <param name="deliveryApiSettings">The Delivery API settings, used to honour the allow/deny content type list.</param>
+    /// <param name="logger">The logger.</param>
+    public ContentTypeSchemaTransformer(
+        IContentTypeSchemaService contentTypeSchemaService,
+        IOptionsMonitor<JsonOptions> jsonOptionsMonitor,
+        IOptionsMonitor<DeliveryApiSettings> deliveryApiSettings,
+        ILogger<ContentTypeSchemaTransformer> logger)
+    {
+        _contentTypeSchemaService = contentTypeSchemaService;
+        _deliveryApiSettings = deliveryApiSettings;
+        _logger = logger;
+        _serializerOptions = jsonOptionsMonitor
+            .Get(Constants.JsonOptionsNames.DeliveryApi)
+            .SerializerOptions;
+        _jsonTypeInfoResolver = _serializerOptions.TypeInfoResolver
+                                ?? throw new InvalidOperationException("The JSON serializer options must have a TypeInfoResolver configured.");
+    }
+
+    private IReadOnlyCollection<ContentTypeSchemaInfo> DocumentTypes
+        => field ??= FilterAllowedDocumentTypes(_contentTypeSchemaService.GetDocumentTypes());
+
+    private IReadOnlyCollection<ContentTypeSchemaInfo> MediaTypes
+        => field ??= _contentTypeSchemaService.GetMediaTypes();
+
+    /// <inheritdoc />
+    public Task TransformAsync(
+        OpenApiDocument document,
+        OpenApiDocumentTransformerContext context,
+        CancellationToken cancellationToken)
+    {
+        if (document.Components?.Schemas is not { Count: > 0 })
+        {
+            return Task.CompletedTask;
+        }
+
+        foreach ((var schemaId, IOpenApiSchema componentsSchema) in document.Components.Schemas)
+        {
+            ResolveSchemaReferences(document, componentsSchema);
+            FixAutoBuiltDiscriminatorMapping(document, schemaId, componentsSchema);
+        }
+
+        return Task.CompletedTask;
+    }
+
+    /// <summary>
+    /// Repairs broken discriminator mapping refs auto-built by the framework for polymorphic types.
+    /// </summary>
+    /// <remarks>
+    /// The framework prefixes each ref with the base schema id, but the derived schemas are
+    /// registered without that prefix. Stripping the prefix recovers the correct ref.
+    /// </remarks>
+    private static void FixAutoBuiltDiscriminatorMapping(OpenApiDocument document, string parentSchemaId, IOpenApiSchema schema)
+    {
+        if (schema is not OpenApiSchema concrete
+            || concrete.Discriminator?.Mapping is not { } mapping
+            || document.Components?.Schemas is not { } schemas)
+        {
+            return;
+        }
+
+        foreach ((var key, OpenApiSchemaReference currentRef) in mapping.ToList())
+        {
+            var targetId = currentRef.Reference.Id;
+            if (string.IsNullOrEmpty(targetId) || schemas.ContainsKey(targetId))
+            {
+                continue;
+            }
+
+            if (targetId.StartsWith(parentSchemaId, StringComparison.Ordinal) is false)
+            {
+                continue;
+            }
+
+            var stripped = targetId[parentSchemaId.Length..];
+            if (schemas.ContainsKey(stripped))
+            {
+                mapping[key] = new OpenApiSchemaReference(stripped, document);
+            }
+        }
+    }
+
+    /// <inheritdoc />
+    public async Task TransformAsync(
+        OpenApiSchema schema,
+        OpenApiSchemaTransformerContext context,
+        CancellationToken cancellationToken)
+    {
+        switch (context.JsonTypeInfo.Type)
+        {
+            case var type when type == typeof(IApiContentResponse):
+                await ApplyPolymorphicContentType(
+                    schema,
+                    context,
+                    PublishedItemType.Content,
+                    DocumentTypes.Where(c => !c.IsElement),
+                    async (contentType, derivedTypeSchemas) =>
+                    {
+                        var schemaIdPrefix = $"{contentType.SchemaId}{ContentSuffix}";
+                        return await CreateContentTypeResponseSchema(
+                            schemaIdPrefix,
+                            derivedTypeSchemas,
+                            context);
+                    },
+                    cancellationToken);
+                await CreateSchema(GetJsonTypeInfo(typeof(IApiContent)), context, cancellationToken);
+                return;
+            case var type when type == typeof(IApiContent):
+                await ApplyPolymorphicContentType(
+                    schema,
+                    context,
+                    PublishedItemType.Content,
+                    DocumentTypes.Where(c => !c.IsElement),
+                    async (contentType, derivedTypeSchemas) =>
+                    {
+                        var schemaId = $"{contentType.SchemaId}{ContentSuffix}{ModelSuffix}";
+                        return await CreateContentTypeSchema(
+                            schemaId,
+                            PublishedItemType.Content,
+                            contentType,
+                            derivedTypeSchemas,
+                            context,
+                            cancellationToken);
+                    },
+                    cancellationToken);
+                await CreateSchema(GetJsonTypeInfo(typeof(IApiElement)), context, cancellationToken);
+                return;
+            case var type when type == typeof(IApiElement):
+                await ApplyPolymorphicContentType(
+                    schema,
+                    context,
+                    PublishedItemType.Content,
+                    DocumentTypes.Where(c => c.IsElement),
+                    async (contentType, derivedTypeSchemas) =>
+                    {
+                        var schemaId = $"{contentType.SchemaId}{ElementSuffix}{ModelSuffix}";
+                        return await CreateContentTypeSchema(
+                            schemaId,
+                            PublishedItemType.Content,
+                            contentType,
+                            derivedTypeSchemas,
+                            context,
+                            cancellationToken);
+                    },
+                    cancellationToken);
+                return;
+            case var type when type == typeof(IApiMediaWithCropsResponse):
+                await ApplyPolymorphicContentType(
+                    schema,
+                    context,
+                    PublishedItemType.Media,
+                    MediaTypes,
+                    async (contentType, derivedTypeSchemas) =>
+                    {
+                        var schemaId = $"{contentType.SchemaId}{MediaWithCropsSuffix}";
+                        return await CreateContentTypeResponseSchema(
+                            schemaId,
+                            derivedTypeSchemas,
+                            context);
+                    },
+                    cancellationToken);
+                await CreateSchema(GetJsonTypeInfo(typeof(IApiMediaWithCrops)), context, cancellationToken);
+                return;
+            case var type when type == typeof(IApiMediaWithCrops):
+                await ApplyPolymorphicContentType(
+                    schema,
+                    context,
+                    PublishedItemType.Media,
+                    MediaTypes,
+                    async (contentType, derivedTypeSchemas) =>
+                    {
+                        var schemaId = $"{contentType.SchemaId}{MediaWithCropsSuffix}{ModelSuffix}";
+                        return await CreateContentTypeSchema(
+                            schemaId,
+                            PublishedItemType.Media,
+                            contentType,
+                            derivedTypeSchemas,
+                            context,
+                            cancellationToken);
+                    },
+                    cancellationToken);
+                return;
+            default:
+                // HACK: Some types with circular references (e.g. ApiBlockGridItem) get left
+                // inlined by the framework, breaking $ref resolution. Register them explicitly.
+                if (GetSchemaId(context.JsonTypeInfo) is not { } schemaId || !_handledSchemas.Add(schemaId))
+                {
+                    return;
+                }
+
+                OpenApiDocument document = context.GetRequiredDocument();
+                document.AddComponent(schemaId, schema);
+                return;
+        }
+    }
+
+    private async Task ApplyPolymorphicContentType(
+        OpenApiSchema schema,
+        OpenApiSchemaTransformerContext context,
+        PublishedItemType itemType,
+        IEnumerable<ContentTypeSchemaInfo> contentTypes,
+        Func<ContentTypeSchemaInfo, List<IOpenApiSchema>, Task<OpenApiSchema>> contentTypeSchemaFactory,
+        CancellationToken cancellationToken)
+    {
+        List<IOpenApiSchema> derivedTypeSchemas = await ResolveDerivedTypeSchemas(
+            schema,
+            context,
+            cancellationToken);
+
+        OpenApiDocument document = context.GetRequiredDocument();
+        var typePropertyName = GetTypePropertyName(itemType);
+        schema.Discriminator = new OpenApiDiscriminator
+        {
+            PropertyName = typePropertyName,
+            Mapping = new Dictionary<string, OpenApiSchemaReference>(),
+        };
+        schema.OneOf ??= new List<IOpenApiSchema>();
+
+        foreach (ContentTypeSchemaInfo contentType in contentTypes)
+        {
+            OpenApiSchema contentTypeSchema = await contentTypeSchemaFactory(contentType, derivedTypeSchemas);
+            var schemaId = (string)contentTypeSchema.Metadata![SchemaIdMetadataKey];
+            schema.Discriminator.Mapping[contentType.Alias] = new OpenApiSchemaReference(schemaId, document);
+            schema.OneOf.Add(contentTypeSchema);
+        }
+
+        // Remove all schema properties that are now handled by the derived types
+        schema.AnyOf = null;
+        schema.Properties = null;
+        schema.Required = new HashSet<string> { typePropertyName };
+    }
+
+    /// <summary>
+    /// Creates and adds a schema to the OpenAPI document if it does not already exist.
+    /// </summary>
+    /// <remarks>A placeholder schema is added first to avoid recursion issues when generating schemas that reference themselves.</remarks>
+    private async Task<IOpenApiSchema> CreateSchema(
+        JsonTypeInfo jsonTypeInfo,
+        OpenApiSchemaTransformerContext context,
+        CancellationToken cancellationToken)
+    {
+        if (jsonTypeInfo.Type.IsArray || jsonTypeInfo.Kind == JsonTypeInfoKind.Enumerable)
+        {
+            Type elementType = jsonTypeInfo.ElementType ?? jsonTypeInfo.Type.GetElementType() ?? typeof(object);
+            JsonTypeInfo elementJsonTypeInfo = GetJsonTypeInfo(elementType);
+            IOpenApiSchema itemSchema = await CreateSchema(elementJsonTypeInfo, context, cancellationToken);
+            return new OpenApiSchema
+            {
+                Type = JsonSchemaType.Array,
+                Items = itemSchema,
+            };
+        }
+
+        var schemaId = GetSchemaId(jsonTypeInfo);
+
+        // Types that produce 'true' in JSON Schema (unconstrained: JsonNode, object, custom-converter types) should be inline {} rather than named components.
+        if (jsonTypeInfo.Kind == JsonTypeInfoKind.None && jsonTypeInfo.GetJsonSchemaAsNode().GetValueKind() == JsonValueKind.True)
+        {
+            return new OpenApiSchema();
+        }
+
+        // If this is one of the types we handle, and we already started generating it, return a placeholder
+        // to avoid circular reference issues.
+        // In the document transformer, these placeholders will be replaced with the actual schemas.
+        if (schemaId is not null && !_handledSchemas.Add(schemaId))
+        {
+            return GetPlaceholderSchema(schemaId);
+        }
+
+        OpenApiSchema schema;
+        try
+        {
+            schema = await context.GetOrCreateSchemaAsync(
+                jsonTypeInfo.Type,
+                cancellationToken: cancellationToken);
+        }
+        catch (Exception ex)
+        {
+            // Log the error but continue with a fallback schema to avoid failing the entire document generation.
+            // The fallback schema includes a description indicating the failure, making it visible to API consumers.
+            _logger.LogError(ex, "Failed to create OpenAPI schema for type {TypeName}", jsonTypeInfo.Type.FullName);
+            schema = new OpenApiSchema
+            {
+                Description = $"[Schema generation failed for type '{jsonTypeInfo.Type.FullName}'. See server logs for details.]",
+            };
+        }
+
+        if (schemaId is null)
+        {
+            return schema;
+        }
+
+        OpenApiDocument document = context.GetRequiredDocument();
+        document.AddComponent(schemaId, schema);
+        return new OpenApiSchemaReference(schemaId, document);
+    }
+
+    /// <summary>
+    /// Allows null at a property reference site without mutating any shared component schema.
+    /// Inline schemas have <c>null</c> OR-ed into their <c>type</c> flags; schema references and
+    /// recursive-ref placeholders are wrapped in a <c>oneOf</c> with an explicit null branch so the
+    /// shared component is left unchanged.
+    /// </summary>
+    private static IOpenApiSchema AsNullable(IOpenApiSchema schema)
+    {
+        if (schema is OpenApiSchema inline
+            && inline.Metadata?.ContainsKey(RecursiveRefMetadataKey) is not true)
+        {
+            inline.Type |= JsonSchemaType.Null;
+            return inline;
+        }
+
+        return new OpenApiSchema
+        {
+            OneOf =
+            [
+                schema,
+                new OpenApiSchema { Type = JsonSchemaType.Null },
+            ],
+        };
+    }
+
+    private static Task<OpenApiSchema> CreateContentTypeResponseSchema(
+        string schemaIdPrefix,
+        List<IOpenApiSchema> derivedTypeSchemas,
+        OpenApiSchemaTransformerContext context)
+    {
+        var schemaId = $"{schemaIdPrefix}{ResponseModelSuffix}";
+        OpenApiDocument document = context.GetRequiredDocument();
+        var schema = new OpenApiSchema
+        {
+            Type = JsonSchemaType.Object,
+            AllOf = [..derivedTypeSchemas, new OpenApiSchemaReference($"{schemaIdPrefix}{ModelSuffix}", document)],
+            Metadata = new Dictionary<string, object> { [SchemaIdMetadataKey] = schemaId },
+        };
+
+        document.AddComponent(schemaId, schema);
+        return Task.FromResult(schema);
+    }
+
+    private async Task<OpenApiSchema> CreateContentTypeSchema(
+        string schemaId,
+        PublishedItemType itemType,
+        ContentTypeSchemaInfo contentType,
+        List<IOpenApiSchema> derivedTypeSchemas,
+        OpenApiSchemaTransformerContext context,
+        CancellationToken cancellationToken)
+    {
+        var typePropertyName = GetTypePropertyName(itemType);
+        var schema = new OpenApiSchema
+        {
+            Type = JsonSchemaType.Object,
+            Properties = new Dictionary<string, IOpenApiSchema>
+            {
+                [typePropertyName] = new OpenApiSchema { Const = contentType.Alias },
+                ["properties"] = await CreatePropertiesSchema(contentType, itemType, context, cancellationToken),
+            },
+            Required = new HashSet<string> { typePropertyName },
+            AllOf = derivedTypeSchemas.Count > 0 ? derivedTypeSchemas : null,
+            Metadata = new Dictionary<string, object> { [SchemaIdMetadataKey] = schemaId, },
+        };
+
+        OpenApiDocument document = context.GetRequiredDocument();
+        document.AddComponent(schemaId, schema);
+        return schema;
+    }
+
+    private async Task<OpenApiSchemaReference> CreatePropertiesSchema(
+        ContentTypeSchemaInfo contentType,
+        PublishedItemType itemType,
+        OpenApiSchemaTransformerContext context,
+        CancellationToken cancellationToken)
+    {
+        var schemaId = GetPropertiesModelSchemaId(contentType, itemType);
+
+        var propertiesSchema = new OpenApiSchema
+        {
+            Type = JsonSchemaType.Object,
+            AllOf =
+            [
+                ..contentType.CompositionSchemaIds.Select(compositionSchemaId
+                    => GetPlaceholderSchema(GetCompositionPropertiesModelSchemaId(compositionSchemaId, itemType)))
+            ],
+            Properties = await CreateContentTypeProperties(contentType, context, cancellationToken),
+            Metadata = new Dictionary<string, object> { [SchemaIdMetadataKey] = schemaId },
+        };
+
+        OpenApiDocument document = context.GetRequiredDocument();
+        document.AddComponent(schemaId, propertiesSchema);
+        return new OpenApiSchemaReference(schemaId, document);
+    }
+
+    private static string GetPropertiesModelSchemaId(ContentTypeSchemaInfo contentType, PublishedItemType itemType) =>
+        $"{contentType.SchemaId}{GetItemTypeSuffix(itemType, contentType.IsElement)}{PropertiesModelSuffix}";
+
+    private string GetCompositionPropertiesModelSchemaId(string compositionSchemaId, PublishedItemType itemType)
+    {
+        // Look up the composition's own IsElement so its reference points at the right
+        // generated schema (element-type compositions live under the Element suffix).
+        IReadOnlyCollection<ContentTypeSchemaInfo> candidates = itemType == PublishedItemType.Media ? MediaTypes : DocumentTypes;
+        ContentTypeSchemaInfo? composition = candidates.FirstOrDefault(c => c.SchemaId == compositionSchemaId);
+        var suffix = GetItemTypeSuffix(itemType, composition?.IsElement ?? false);
+        return $"{compositionSchemaId}{suffix}{PropertiesModelSuffix}";
+    }
+
+    private static string GetItemTypeSuffix(PublishedItemType itemType, bool isElement) =>
+        itemType switch
+        {
+            PublishedItemType.Media => MediaSuffix,
+            PublishedItemType.Content => isElement ? ElementSuffix : ContentSuffix,
+            _ => throw new NotSupportedException($"Unsupported PublishedItemType: {itemType}"),
+        };
+
+    private async Task<Dictionary<string, IOpenApiSchema>> CreateContentTypeProperties(
+        ContentTypeSchemaInfo contentType,
+        OpenApiSchemaTransformerContext context,
+        CancellationToken cancellationToken)
+    {
+        var properties = new Dictionary<string, IOpenApiSchema>();
+        foreach (ContentTypePropertySchemaInfo propertyInfo in contentType.Properties.Where(p => !p.Inherited))
+        {
+            IOpenApiSchema schema = await CreateSchema(
+                GetJsonTypeInfo(propertyInfo.DeliveryApiClrType),
+                context,
+                cancellationToken);
+
+            // Properties may be null (e.g. property added after content was last published).
+            // Nullability is applied at the reference site, never on a shared component schema.
+            properties[propertyInfo.Alias] = AsNullable(schema);
+        }
+
+        return properties;
+    }
+
+    private JsonTypeInfo GetJsonTypeInfo(Type type)
+    {
+        JsonTypeInfo? jsonTypeInfo = _jsonTypeInfoResolver.GetTypeInfo(type, _serializerOptions);
+        return jsonTypeInfo ?? throw new InvalidOperationException("Could not get JsonTypeInfo for type " + type.FullName);
+    }
+
+    private string GetTypePropertyName(PublishedItemType itemType)
+    {
+        var propertyName = itemType switch
+        {
+            PublishedItemType.Content => nameof(IApiElement.ContentType),
+            PublishedItemType.Media => nameof(IApiMedia.MediaType),
+            _ => throw new NotSupportedException($"Unsupported PublishedItemType: {itemType}"),
+        };
+
+        return _serializerOptions.PropertyNamingPolicy?.ConvertName(propertyName) ?? propertyName;
+    }
+
+    private static string? GetSchemaId(JsonTypeInfo type)
+        => UmbracoSchemaIdGenerator.CreateSchemaReferenceId(type);
+
+    /// <summary>
+    /// Creates a temporary placeholder schema to break circular reference chains during schema generation.
+    /// </summary>
+    /// <remarks>
+    /// The placeholder contains metadata with the target schema ID. During the document transformation phase,
+    /// <see cref="ResolveSchemaReferences(OpenApiDocument, IOpenApiSchema)"/> will replace these placeholders with actual schema references.
+    /// </remarks>
+    /// <param name="schemaId">The ID of the schema this placeholder represents.</param>
+    /// <returns>A placeholder schema with metadata indicating the target schema reference.</returns>
+    private static OpenApiSchema GetPlaceholderSchema(string schemaId)
+        => new()
+        {
+            Metadata = new Dictionary<string, object>
+            {
+                [RecursiveRefMetadataKey] = schemaId,
+            },
+        };
+
+    /// <summary>
+    /// Recursively resolves inline schemas into proper <c>$ref</c> references.
+    /// </summary>
+    /// <remarks>
+    /// This method is called during the document transformation phase (after all schemas have been generated).
+    /// It walks through all schema properties, allOf, oneOf, and anyOf collections, resolving two types of
+    /// inline schemas:
+    /// <list type="bullet">
+    ///   <item>Circular reference placeholders created by <see cref="GetPlaceholderSchema"/> (marked with <c>x-recursive-ref</c>)</item>
+    ///   <item>Componentized schemas that should be references (marked with <c>x-schema-id</c>)</item>
+    /// </list>
+    /// Each match is replaced with an <see cref="OpenApiSchemaReference"/> pointing to the actual schema in the document's components.
+    /// </remarks>
+    /// <param name="document">The OpenAPI document containing the registered schema components.</param>
+    /// <param name="schema">The schema to process (will be modified in place).</param>
+    private static void ResolveSchemaReferences(OpenApiDocument document, IOpenApiSchema schema)
+    {
+        // Replace in allOf, oneOf, anyOf
+        ResolveSchemaReferences(document, schema.AllOf);
+        ResolveSchemaReferences(document, schema.OneOf);
+        ResolveSchemaReferences(document, schema.AnyOf);
+
+        // Process array items
+        if (schema is OpenApiSchema { Items: OpenApiSchema itemsSchema } parentSchema)
+        {
+            parentSchema.Items = GetActualSchemaOrReference(document, itemsSchema, out var itemsReplaced);
+            if (!itemsReplaced)
+            {
+                ResolveSchemaReferences(document, itemsSchema);
+            }
+        }
+
+        if (schema.Properties is not { Count: > 0 })
+        {
+            return;
+        }
+
+        // Process properties
+        foreach (var propertyKey in schema.Properties.Keys)
+        {
+            IOpenApiSchema propertySchema = schema.Properties[propertyKey];
+            if (propertySchema is not OpenApiSchema innerSchema)
+            {
+                continue;
+            }
+
+            schema.Properties[propertyKey] = GetActualSchemaOrReference(document, innerSchema, out var replaced);
+            if (replaced)
+            {
+                continue;
+            }
+
+            // Recursive call to handle the property schema
+            ResolveSchemaReferences(document, innerSchema);
+        }
+    }
+
+    private static void ResolveSchemaReferences(OpenApiDocument document, IList<IOpenApiSchema>? schemas)
+    {
+        if (schemas is null || schemas.Count == 0)
+        {
+            return;
+        }
+
+        for (var i = 0; i < schemas.Count; i++)
+        {
+            IOpenApiSchema allOfSchema = schemas[i];
+            schemas[i] = GetActualSchemaOrReference(document, allOfSchema, out var replaced);
+            if (!replaced)
+            {
+                ResolveSchemaReferences(document, schemas[i]);
+            }
+        }
+    }
+
+    [return: NotNullIfNotNull(nameof(schema))]
+    private static IOpenApiSchema? GetActualSchemaOrReference(
+        OpenApiDocument document,
+        IOpenApiSchema? schema,
+        out bool replaced)
+    {
+        if (schema is not OpenApiSchema openApiSchema)
+        {
+            replaced = false;
+            return schema;
+        }
+
+        // Check if this is a placeholder schema (circular reference)
+        if (openApiSchema.Metadata?.TryGetValue(RecursiveRefMetadataKey, out var recursiveRefIdObj) == true
+            && recursiveRefIdObj is string recursiveRefId)
+        {
+            replaced = true;
+            return new OpenApiSchemaReference(recursiveRefId, document);
+        }
+
+        // Check if this is a componentized schema that should be a $ref
+        // Only resolve if the component actually exists — the framework also sets x-schema-id on
+        // schemas that may not end up as components.
+        if (openApiSchema.Metadata?.TryGetValue(SchemaIdMetadataKey, out var schemaIdObj) == true
+            && schemaIdObj is string schemaId
+            && !string.IsNullOrEmpty(schemaId)
+            && document.Components?.Schemas?.ContainsKey(schemaId) == true)
+        {
+            replaced = true;
+            return new OpenApiSchemaReference(schemaId, document);
+        }
+
+        replaced = false;
+        return schema;
+    }
+
+    private IReadOnlyCollection<ContentTypeSchemaInfo> FilterAllowedDocumentTypes(IReadOnlyCollection<ContentTypeSchemaInfo> documentTypes)
+    {
+        DeliveryApiSettings settings = _deliveryApiSettings.CurrentValue;
+        return documentTypes
+            .Where(c => settings.IsAllowedContentType(c.Alias))
+            .ToList();
+    }
+
+    /// <summary>
+    /// Returns the schemas to use as the <c>allOf</c> bases for each typed content type
+    /// schema in a polymorphic union. Prefers concrete derived types declared on the
+    /// interface via <c>[JsonDerivedType]</c>; when none are advertised, falls back to a
+    /// schema built from the interface's own properties.
+    /// </summary>
+    /// <remarks>
+    /// The fallback exists for media interfaces, whose concrete classes are internal in
+    /// Umbraco.Infrastructure and therefore cannot be referenced via <c>[JsonDerivedType]</c>
+    /// from Umbraco.Core.
+    /// </remarks>
+    private async Task<List<IOpenApiSchema>> ResolveDerivedTypeSchemas(
+        OpenApiSchema interfaceSchema,
+        OpenApiSchemaTransformerContext context,
+        CancellationToken cancellationToken)
+    {
+        List<IOpenApiSchema> derivedTypeSchemas = [];
+        foreach (JsonDerivedType derivedType in context.JsonTypeInfo.PolymorphismOptions?.DerivedTypes ?? [])
+        {
+            IOpenApiSchema derivedTypeSchema = await CreateSchema(
+                GetJsonTypeInfo(derivedType.DerivedType),
+                context,
+                cancellationToken);
+            derivedTypeSchemas.Add(derivedTypeSchema);
+        }
+
+        if (derivedTypeSchemas.Count == 0)
+        {
+            derivedTypeSchemas.Add(CreateBaseSchemaFromInterface(interfaceSchema, context));
+        }
+
+        return derivedTypeSchemas;
+    }
+
+    private static IOpenApiSchema CreateBaseSchemaFromInterface(
+        OpenApiSchema interfaceSchema,
+        OpenApiSchemaTransformerContext context)
+    {
+        // Append a "Base" marker so this schema stays distinct from the polymorphic union
+        // schema for the same interface (e.g. IApiMediaWithCropsResponseBaseModel vs.
+        // IApiMediaWithCropsResponseModel).
+        var baseSchemaId = $"{context.JsonTypeInfo.Type.Name}Base{ModelSuffix}";
+        OpenApiDocument document = context.GetRequiredDocument();
+        var baseSchema = new OpenApiSchema
+        {
+            Type = interfaceSchema.Type,
+            Properties = interfaceSchema.Properties,
+            Required = interfaceSchema.Required,
+            Metadata = new Dictionary<string, object> { [SchemaIdMetadataKey] = baseSchemaId },
+        };
+
+        document.AddComponent(baseSchemaId, baseSchema);
+        return new OpenApiSchemaReference(baseSchemaId, document);
+    }
+}
@@ -1,42 +0,0 @@
-using Microsoft.AspNetCore.OpenApi;
-using Umbraco.Cms.Api.Common.Configuration;
-using Umbraco.Cms.Api.Common.OpenApi;
-using Umbraco.Cms.Api.Management.DependencyInjection;
-using Umbraco.Cms.Api.Management.OpenApi;
-using Umbraco.Cms.Api.Management.OpenApi.Transformers;
-
-namespace Umbraco.Cms.Api.Management.Configuration;
-
-/// <summary>
-/// Configures the OpenAPI options for the Umbraco Management API.
-/// </summary>
-internal class ConfigureUmbracoManagementApiOpenApiOptions : ConfigureUmbracoOpenApiOptionsBase
-{
-    /// <inheritdoc />
-    protected override string ApiName => ManagementApiConfiguration.ApiName;
-
-    /// <inheritdoc />
-    protected override string ApiTitle => ManagementApiConfiguration.ApiTitle;
-
-    /// <inheritdoc />
-    protected override string ApiVersion => "Latest";
-
-    /// <inheritdoc />
-    protected override string ApiDescription =>
-        "This shows all APIs available in this version of Umbraco - including all the legacy apis that are available for backward compatibility";
-
-    /// <inheritdoc />
-    protected override void ConfigureOpenApi(OpenApiOptions options)
-    {
-        base.ConfigureOpenApi(options);
-
-        // Sets Security requirement on backoffice apis
-        options.AddBackofficeSecurityRequirements();
-
-        options.AddSchemaTransformer<RequireNonNullablePropertiesSchemaTransformer>();
-        options.AddSchemaTransformer<FixFileReturnTypesTransformer>();
-        options.AddOperationTransformer<MimeTypesTransformer>();
-        options.AddOperationTransformer<ResponseHeaderTransformer>();
-        options.AddOperationTransformer<NotificationHeaderTransformer>();
-    }
-}
@@ -53,11 +53,14 @@ public class SearchDataTypeItemController : DatatypeItemControllerBase
            return Ok(new PagedModel<DataTypeItemResponseModel> { Total = searchResult.Total });
        }

-        IEnumerable<IDataType> dataTypes = await _dataTypeService.GetAllAsync(searchResult.Items.Select(item => item.Key).ToArray());
+        Guid[] keys = searchResult.Items.Select(x => x.Key).ToArray();
+        IEnumerable<IDataType> dataTypes = await _dataTypeService.GetAllAsync(keys);
+        IEnumerable<IDataType> orderedDataTypes = OrderByRequestedIds(dataTypes, keys);
+
        var result = new PagedModel<DataTypeItemResponseModel>
        {
-            Items = _mapper.MapEnumerable<IDataType, DataTypeItemResponseModel>(dataTypes),
-            Total = searchResult.Total
+            Items = _mapper.MapEnumerable<IDataType, DataTypeItemResponseModel>(orderedDataTypes),
+            Total = searchResult.Total,
        };

        return Ok(result);
@@ -0,0 +1,100 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.Security.Authorization;
+using Umbraco.Cms.Api.Management.ViewModels.Sorting;
+using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Document;
+
+/// <summary>
+/// Provides an API endpoint for sorting the root-level documents by a system field.
+/// </summary>
+[ApiVersion("1.0")]
+public class SortChildrenAtRootDocumentController : DocumentControllerBase
+{
+    private readonly IAuthorizationService _authorizationService;
+    private readonly IContentEditingService _contentEditingService;
+    private readonly IEntityService _entityService;
+    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SortChildrenAtRootDocumentController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize user actions.</param>
+    /// <param name="contentEditingService">Service for editing and managing content.</param>
+    /// <param name="entityService">Service used to resolve the children to authorize.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
+    public SortChildrenAtRootDocumentController(
+        IAuthorizationService authorizationService,
+        IContentEditingService contentEditingService,
+        IEntityService entityService,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+    {
+        _authorizationService = authorizationService;
+        _contentEditingService = contentEditingService;
+        _entityService = entityService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+    }
+
+    /// <summary>
+    /// Sorts the root-level documents by a system field.
+    /// </summary>
+    /// <param name="cancellationToken">A <see cref="CancellationToken"/> to observe while waiting for the task to complete.</param>
+    /// <param name="requestModel">The field to sort by and the sort direction.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> indicating the outcome of the operation:
+    /// returns <c>200 OK</c> if sorting succeeds or <c>400 Bad Request</c> if the field is not recognised.
+    /// </returns>
+    [HttpPut("root/sort-children")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [EndpointSummary("Sorts the root-level documents by a field.")]
+    [EndpointDescription("Sorts the root-level documents by a system field in the given direction. When sorting by name, an optional culture selects the variant name; the culture is not validated, so documents that do not vary by it (or an unrecognised culture) fall back to the invariant name.")]
+    public async Task<IActionResult> SortChildren(CancellationToken cancellationToken, SortDocumentChildrenByFieldRequestModel requestModel)
+    {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ContentPermissionResource.WithKeys(ActionSort.ActionLetter, (Guid?)null),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
+        var childrenAuthorized = await AllChildrenAuthorizer.IsAuthorizedForChildrenAsync(
+            _authorizationService,
+            _entityService,
+            User,
+            parentKey: null,
+            UmbracoObjectTypes.Document,
+            childKeys => ContentPermissionResource.WithKeys(ActionSort.ActionLetter, childKeys),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!childrenAuthorized)
+        {
+            return Forbidden();
+        }
+
+        ContentEditingOperationStatus result = await _contentEditingService.SortByFieldAsync(
+            null,
+            requestModel.Field,
+            requestModel.Direction,
+            requestModel.Culture,
+            CurrentUserKey(_backOfficeSecurityAccessor));
+
+        return result == ContentEditingOperationStatus.Success
+            ? Ok()
+            : ContentEditingOperationStatusResult(result);
+    }
+}
@@ -0,0 +1,102 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.Security.Authorization;
+using Umbraco.Cms.Api.Management.ViewModels.Sorting;
+using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Document;
+
+/// <summary>
+/// Provides an API endpoint for sorting the children of a document by a system field.
+/// </summary>
+[ApiVersion("1.0")]
+public class SortChildrenDocumentController : DocumentControllerBase
+{
+    private readonly IAuthorizationService _authorizationService;
+    private readonly IContentEditingService _contentEditingService;
+    private readonly IEntityService _entityService;
+    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SortChildrenDocumentController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize user actions.</param>
+    /// <param name="contentEditingService">Service for editing and managing content.</param>
+    /// <param name="entityService">Service used to resolve the children to authorize.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
+    public SortChildrenDocumentController(
+        IAuthorizationService authorizationService,
+        IContentEditingService contentEditingService,
+        IEntityService entityService,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+    {
+        _authorizationService = authorizationService;
+        _contentEditingService = contentEditingService;
+        _entityService = entityService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+    }
+
+    /// <summary>
+    /// Sorts the child documents of the specified parent document by a system field.
+    /// </summary>
+    /// <param name="cancellationToken">A <see cref="CancellationToken"/> to observe while waiting for the task to complete.</param>
+    /// <param name="id">The unique identifier of the parent document whose children should be sorted.</param>
+    /// <param name="requestModel">The field to sort by and the sort direction.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> indicating the outcome of the operation:
+    /// returns <c>200 OK</c> if sorting succeeds, <c>400 Bad Request</c> if the field is not recognised, or <c>404 Not Found</c> if the parent document does not exist.
+    /// </returns>
+    [HttpPut("{id:guid}/sort-children")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    [EndpointSummary("Sorts the children of a document by a field.")]
+    [EndpointDescription("Sorts the children of the specified parent document by a system field in the given direction. When sorting by name, an optional culture selects the variant name; the culture is not validated, so children that do not vary by it (or an unrecognised culture) fall back to the invariant name.")]
+    public async Task<IActionResult> SortChildren(CancellationToken cancellationToken, Guid id, SortDocumentChildrenByFieldRequestModel requestModel)
+    {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ContentPermissionResource.WithKeys(ActionSort.ActionLetter, id),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
+        var childrenAuthorized = await AllChildrenAuthorizer.IsAuthorizedForChildrenAsync(
+            _authorizationService,
+            _entityService,
+            User,
+            id,
+            UmbracoObjectTypes.Document,
+            childKeys => ContentPermissionResource.WithKeys(ActionSort.ActionLetter, childKeys),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!childrenAuthorized)
+        {
+            return Forbidden();
+        }
+
+        ContentEditingOperationStatus result = await _contentEditingService.SortByFieldAsync(
+            id,
+            requestModel.Field,
+            requestModel.Direction,
+            requestModel.Culture,
+            CurrentUserKey(_backOfficeSecurityAccessor));
+
+        return result == ContentEditingOperationStatus.Success
+            ? Ok()
+            : ContentEditingOperationStatusResult(result);
+    }
+}
@@ -49,8 +49,8 @@ public class ByKeyElementFolderController : ElementFolderControllerBase
    {
        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
            User,
-            ElementPermissionResource.WithKeys(ActionElementBrowse.ActionLetter, id),
-            AuthorizationPolicies.ElementPermissionByResource);
+            ElementContainerPermissionResource.WithKeys(ActionElementContainerBrowse.ActionLetter, id),
+            AuthorizationPolicies.ElementFolderPermissionByResource);

        if (!authorizationResult.Succeeded)
        {
@@ -50,8 +50,8 @@ public class CreateElementFolderController : ElementFolderControllerBase
    {
        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
            User,
-            ElementPermissionResource.WithKeys(ActionElementNew.ActionLetter, createFolderRequestModel.Parent?.Id),
-            AuthorizationPolicies.ElementPermissionByResource);
+            ElementContainerPermissionResource.WithKeys(ActionElementContainerNew.ActionLetter, createFolderRequestModel.Parent?.Id),
+            AuthorizationPolicies.ElementFolderPermissionByResource);

        if (!authorizationResult.Succeeded)
        {
@@ -49,7 +49,18 @@ public class DeleteElementFolderController : ElementFolderControllerBase
    {
        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
            User,
-            ElementPermissionResource.WithKeys(ActionElementDelete.ActionLetter, id),
+            ElementContainerPermissionResource.WithKeys(ActionElementContainerDelete.ActionLetter, id),
+            AuthorizationPolicies.ElementFolderPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
+        // Also authorize deletion of all descendant elements.
+        authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ElementPermissionResource.Branch(ActionElementDelete.ActionLetter, id),
            AuthorizationPolicies.ElementPermissionByResource);

        if (!authorizationResult.Succeeded)
@@ -60,8 +60,8 @@ public class MoveElementFolderController : ElementFolderControllerBase
        // Check Move permission on source folder
        AuthorizationResult sourceAuthorizationResult = await _authorizationService.AuthorizeResourceAsync(
            User,
-            ElementPermissionResource.WithKeys(ActionElementMove.ActionLetter, id),
-            AuthorizationPolicies.ElementPermissionByResource);
+            ElementContainerPermissionResource.WithKeys(ActionElementContainerMove.ActionLetter, id),
+            AuthorizationPolicies.ElementFolderPermissionByResource);

        if (!sourceAuthorizationResult.Succeeded)
        {
@@ -71,8 +71,8 @@ public class MoveElementFolderController : ElementFolderControllerBase
        // Check Create permission on target (where we're moving to)
        AuthorizationResult targetAuthorizationResult = await _authorizationService.AuthorizeResourceAsync(
            User,
-            ElementPermissionResource.WithKeys(ActionElementNew.ActionLetter, moveFolderRequestModel.Target?.Id),
-            AuthorizationPolicies.ElementPermissionByResource);
+            ElementContainerPermissionResource.WithKeys(ActionElementContainerNew.ActionLetter, moveFolderRequestModel.Target?.Id),
+            AuthorizationPolicies.ElementFolderPermissionByResource);

        if (!targetAuthorizationResult.Succeeded)
        {
@@ -57,8 +57,8 @@ public class MoveToRecycleBinElementFolderController : ElementFolderControllerBa
    {
        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
            User,
-            ElementPermissionResource.WithKeys(ActionElementDelete.ActionLetter, id),
-            AuthorizationPolicies.ElementPermissionByResource);
+            ElementContainerPermissionResource.WithKeys(ActionElementContainerDelete.ActionLetter, id),
+            AuthorizationPolicies.ElementFolderPermissionByResource);

        if (!authorizationResult.Succeeded)
        {
@@ -51,8 +51,8 @@ public class UpdateElementFolderController : ElementFolderControllerBase
    {
        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
            User,
-            ElementPermissionResource.WithKeys(ActionElementUpdate.ActionLetter, id),
-            AuthorizationPolicies.ElementPermissionByResource);
+            ElementContainerPermissionResource.WithKeys(ActionElementContainerUpdate.ActionLetter, id),
+            AuthorizationPolicies.ElementFolderPermissionByResource);

        if (!authorizationResult.Succeeded)
        {
@@ -61,8 +61,9 @@ public class SearchElementItemController : ElementItemControllerBase
            .GetAll(UmbracoObjectTypes.Element, keys)
            .OfType<IElementEntitySlim>()
            .ToArray();
+        List<IElementEntitySlim> orderedElements = OrderByRequestedIds(elements, keys);

-        ElementItemResponseModel[] items = await Task.WhenAll(elements.Select(_elementPresentationFactory.CreateItemResponseModelAsync));
+        ElementItemResponseModel[] items = await Task.WhenAll(orderedElements.Select(_elementPresentationFactory.CreateItemResponseModelAsync));

        return Ok(
            new PagedModel<ElementItemResponseModel>
@@ -63,7 +63,18 @@ public class DeleteElementFolderRecycleBinController : ElementRecycleBinControll
    {
        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
            User,
-            ElementPermissionResource.RecycleBin(ActionElementDelete.ActionLetter),
+            ElementContainerPermissionResource.RecycleBin(ActionElementContainerDelete.ActionLetter),
+            AuthorizationPolicies.ElementFolderPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
+        // Also authorize deletion of all descendant elements.
+        authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ElementPermissionResource.Branch(ActionElementDelete.ActionLetter, id),
            AuthorizationPolicies.ElementPermissionByResource);

        if (!authorizationResult.Succeeded)
@@ -59,8 +59,8 @@ public class OriginalParentElementFolderRecycleBinController : ElementRecycleBin
    {
        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
            User,
-            ElementPermissionResource.RecycleBin(ActionElementBrowse.ActionLetter),
-            AuthorizationPolicies.ElementPermissionByResource);
+            ElementContainerPermissionResource.RecycleBin(ActionElementContainerBrowse.ActionLetter),
+            AuthorizationPolicies.ElementFolderPermissionByResource);

        if (!authorizationResult.Succeeded)
        {
@@ -64,8 +64,8 @@ public class RestoreElementFolderRecycleBinController : ElementRecycleBinControl
    {
        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
            User,
-            ElementPermissionResource.RecycleBin(ActionElementMove.ActionLetter),
-            AuthorizationPolicies.ElementPermissionByResource);
+            ElementContainerPermissionResource.RecycleBin(ActionElementContainerMove.ActionLetter),
+            AuthorizationPolicies.ElementFolderPermissionByResource);

        if (!authorizationResult.Succeeded)
        {
@@ -0,0 +1,98 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.Security.Authorization;
+using Umbraco.Cms.Api.Management.ViewModels.Sorting;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Media;
+
+/// <summary>
+/// Provides an API endpoint for sorting the root-level media items by a system field.
+/// </summary>
+[ApiVersion("1.0")]
+public class SortChildrenAtRootMediaController : MediaControllerBase
+{
+    private readonly IAuthorizationService _authorizationService;
+    private readonly IMediaEditingService _mediaEditingService;
+    private readonly IEntityService _entityService;
+    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SortChildrenAtRootMediaController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize user actions.</param>
+    /// <param name="mediaEditingService">Service responsible for editing and sorting media items.</param>
+    /// <param name="entityService">Service used to resolve the children to authorize.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for backoffice security context.</param>
+    public SortChildrenAtRootMediaController(
+        IAuthorizationService authorizationService,
+        IMediaEditingService mediaEditingService,
+        IEntityService entityService,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+    {
+        _authorizationService = authorizationService;
+        _mediaEditingService = mediaEditingService;
+        _entityService = entityService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+    }
+
+    /// <summary>
+    /// Sorts the root-level media items by a system field.
+    /// </summary>
+    /// <param name="cancellationToken">A <see cref="CancellationToken"/> to observe while waiting for the task to complete.</param>
+    /// <param name="requestModel">The field to sort by and the sort direction.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> indicating the outcome of the operation:
+    /// returns <c>200 OK</c> if sorting succeeds or <c>400 Bad Request</c> if the field is not recognised.
+    /// </returns>
+    [HttpPut("root/sort-children")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [EndpointSummary("Sorts the root-level media items by a field.")]
+    [EndpointDescription("Sorts the root-level media items by a system field in the given direction.")]
+    public async Task<IActionResult> SortChildren(CancellationToken cancellationToken, SortMediaChildrenByFieldRequestModel requestModel)
+    {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            MediaPermissionResource.Root(),
+            AuthorizationPolicies.MediaPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
+        var childrenAuthorized = await AllChildrenAuthorizer.IsAuthorizedForChildrenAsync(
+            _authorizationService,
+            _entityService,
+            User,
+            parentKey: null,
+            UmbracoObjectTypes.Media,
+            childKeys => MediaPermissionResource.WithKeys(childKeys),
+            AuthorizationPolicies.MediaPermissionByResource);
+
+        if (!childrenAuthorized)
+        {
+            return Forbidden();
+        }
+
+        ContentEditingOperationStatus result = await _mediaEditingService.SortByFieldAsync(
+            null,
+            requestModel.Field,
+            requestModel.Direction,
+            CurrentUserKey(_backOfficeSecurityAccessor));
+
+        return result == ContentEditingOperationStatus.Success
+            ? Ok()
+            : ContentEditingOperationStatusResult(result);
+    }
+}
@@ -0,0 +1,100 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.Security.Authorization;
+using Umbraco.Cms.Api.Management.ViewModels.Sorting;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Media;
+
+/// <summary>
+/// Provides an API endpoint for sorting the children of a media item by a system field.
+/// </summary>
+[ApiVersion("1.0")]
+public class SortChildrenMediaController : MediaControllerBase
+{
+    private readonly IAuthorizationService _authorizationService;
+    private readonly IMediaEditingService _mediaEditingService;
+    private readonly IEntityService _entityService;
+    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SortChildrenMediaController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize user actions.</param>
+    /// <param name="mediaEditingService">Service responsible for editing and sorting media items.</param>
+    /// <param name="entityService">Service used to resolve the children to authorize.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for backoffice security context.</param>
+    public SortChildrenMediaController(
+        IAuthorizationService authorizationService,
+        IMediaEditingService mediaEditingService,
+        IEntityService entityService,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+    {
+        _authorizationService = authorizationService;
+        _mediaEditingService = mediaEditingService;
+        _entityService = entityService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+    }
+
+    /// <summary>
+    /// Sorts the child media items of the specified parent media item by a system field.
+    /// </summary>
+    /// <param name="cancellationToken">A <see cref="CancellationToken"/> to observe while waiting for the task to complete.</param>
+    /// <param name="id">The unique identifier of the parent media item whose children should be sorted.</param>
+    /// <param name="requestModel">The field to sort by and the sort direction.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> indicating the outcome of the operation:
+    /// returns <c>200 OK</c> if sorting succeeds, <c>400 Bad Request</c> if the field is not recognised, or <c>404 Not Found</c> if the parent media item does not exist.
+    /// </returns>
+    [HttpPut("{id:guid}/sort-children")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    [EndpointSummary("Sorts the children of a media item by a field.")]
+    [EndpointDescription("Sorts the children of the specified parent media item by a system field in the given direction.")]
+    public async Task<IActionResult> SortChildren(CancellationToken cancellationToken, Guid id, SortMediaChildrenByFieldRequestModel requestModel)
+    {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            MediaPermissionResource.WithKeys(id),
+            AuthorizationPolicies.MediaPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
+        var childrenAuthorized = await AllChildrenAuthorizer.IsAuthorizedForChildrenAsync(
+            _authorizationService,
+            _entityService,
+            User,
+            id,
+            UmbracoObjectTypes.Media,
+            childKeys => MediaPermissionResource.WithKeys(childKeys),
+            AuthorizationPolicies.MediaPermissionByResource);
+
+        if (!childrenAuthorized)
+        {
+            return Forbidden();
+        }
+
+        ContentEditingOperationStatus result = await _mediaEditingService.SortByFieldAsync(
+            id,
+            requestModel.Field,
+            requestModel.Direction,
+            CurrentUserKey(_backOfficeSecurityAccessor));
+
+        return result == ContentEditingOperationStatus.Success
+            ? Ok()
+            : ContentEditingOperationStatusResult(result);
+    }
+}
@@ -54,11 +54,14 @@ public class SearchMediaTypeItemController : MediaTypeItemControllerBase
            return Task.FromResult<IActionResult>(Ok(new PagedModel<MediaTypeItemResponseModel> { Total = searchResult.Total }));
        }

-        IEnumerable<IMediaType> mediaTypes = _mediaTypeService.GetMany(searchResult.Items.Select(item => item.Key).ToArray().EmptyNull());
+        Guid[] keys = searchResult.Items.Select(item => item.Key).ToArray();
+        IEnumerable<IMediaType> mediaTypes = _mediaTypeService.GetMany(keys.EmptyNull());
+        IEnumerable<IMediaType> orderedMediaTypes = OrderByRequestedIds(mediaTypes, keys);
+
        var result = new PagedModel<MediaTypeItemResponseModel>
        {
-            Items = _mapper.MapEnumerable<IMediaType, MediaTypeItemResponseModel>(mediaTypes),
-            Total = searchResult.Total
+            Items = _mapper.MapEnumerable<IMediaType, MediaTypeItemResponseModel>(orderedMediaTypes),
+            Total = searchResult.Total,
        };

        return Task.FromResult<IActionResult>(Ok(result));
@@ -32,6 +32,14 @@ public class SearchMemberTypeItemController : MemberTypeItemControllerBase
        _mapper = mapper;
    }

+    /// <summary>
+    /// Searches for member type items matching the specified query, with support for pagination.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="query">The search query used to filter member type items.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for pagination).</param>
+    /// <param name="take">The maximum number of items to return in the result set (used for pagination).</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains an <see cref="IActionResult"/> with a <see cref="PagedModel{MemberTypeItemResponseModel}"/> containing the search results.</returns>
    [HttpGet("search")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedModel<MemberTypeItemResponseModel>), StatusCodes.Status200OK)]
@@ -45,11 +53,14 @@ public class SearchMemberTypeItemController : MemberTypeItemControllerBase
            return Task.FromResult<IActionResult>(Ok(new PagedModel<MemberTypeItemResponseModel> { Total = searchResult.Total }));
        }

-        IEnumerable<IMemberType> memberTypes = _memberTypeService.GetMany(searchResult.Items.Select(item => item.Key).ToArray());
+        Guid[] keys = searchResult.Items.Select(item => item.Key).ToArray();
+        IEnumerable<IMemberType> memberTypes = _memberTypeService.GetMany(keys);
+        IEnumerable<IMemberType> orderedMemberTypes = OrderByRequestedIds(memberTypes, keys);
+
        var result = new PagedModel<MemberTypeItemResponseModel>
        {
-            Items = _mapper.MapEnumerable<IMemberType, MemberTypeItemResponseModel>(memberTypes),
-            Total = searchResult.Total
+            Items = _mapper.MapEnumerable<IMemberType, MemberTypeItemResponseModel>(orderedMemberTypes),
+            Total = searchResult.Total,
        };

        return Task.FromResult<IActionResult>(Ok(result));
@@ -2,6 +2,7 @@ using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;

 namespace Umbraco.Cms.Api.Management.Controllers.RedirectUrlManagement;

@@ -32,11 +33,13 @@ public class DeleteByKeyRedirectUrlManagementController : RedirectUrlManagementC
    [MapToApiVersion("1.0")]
    [HttpDelete("{id:guid}")]
    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
    [EndpointSummary("Deletes a redirect URL.")]
    [EndpointDescription("Deletes a redirect URL identified by the provided Id.")]
    public Task<IActionResult> DeleteByKey(CancellationToken cancellationToken, Guid id)
    {
-        _redirectUrlService.Delete(id);
-        return Task.FromResult<IActionResult>(Ok());
+        RedirectUrlOperationStatus status = _redirectUrlService.DeleteWithStatus(id);
+        return Task.FromResult(RedirectUrlOperationStatusResult(status));
    }
 }
@@ -1,6 +1,8 @@
 using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Core.Services.OperationStatus;
 using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Controllers.RedirectUrlManagement;
@@ -14,4 +16,31 @@ namespace Umbraco.Cms.Api.Management.Controllers.RedirectUrlManagement;
 [Authorize(Policy = AuthorizationPolicies.SectionAccessContent)]
 public class RedirectUrlManagementControllerBase : ManagementApiControllerBase
 {
+    /// <summary>
+    /// Maps a <see cref="RedirectUrlOperationStatus"/> to an appropriate <see cref="IActionResult"/>.
+    /// </summary>
+    /// <param name="status">The operation status to map.</param>
+    /// <returns>An <see cref="IActionResult"/> describing the outcome of the operation.</returns>
+    protected IActionResult RedirectUrlOperationStatusResult(RedirectUrlOperationStatus status) =>
+        OperationStatusResult(status, problemDetailsBuilder => status switch
+        {
+            RedirectUrlOperationStatus.Success => Ok(),
+            RedirectUrlOperationStatus.NotFound => NotFound(problemDetailsBuilder
+                .WithTitle("The redirect URL could not be found")
+                .Build()),
+            RedirectUrlOperationStatus.CancelledByNotification => BadRequest(problemDetailsBuilder
+                .WithTitle("Cancelled by notification")
+                .WithDetail("A notification handler prevented the redirect URL operation.")
+                .Build()),
+            RedirectUrlOperationStatus.Unknown => StatusCode(
+                StatusCodes.Status500InternalServerError,
+                problemDetailsBuilder
+                    .WithTitle("Unknown error. Please see the log for more details.")
+                    .Build()),
+            _ => StatusCode(
+                StatusCodes.Status500InternalServerError,
+                problemDetailsBuilder
+                    .WithTitle("Unknown redirect URL operation status.")
+                    .Build()),
+        });
 }
@@ -8,67 +8,38 @@ using Umbraco.Cms.Core.Security;
 namespace Umbraco.Cms.Api.Management.Controllers.RedirectUrlManagement;

 /// <summary>
-/// Controller for setting the redirect URL tracking status.
+/// Controller for setting the redirect URL tracking status. Retained for backwards compatibility only;
+/// the endpoint no longer modifies any configuration.
 /// </summary>
 [ApiVersion("1.0")]
+[Obsolete("This controller is deprecated and no longer modifies the configuration. Set the Umbraco:CMS:WebRouting:DisableRedirectUrlTracking configuration key instead. Scheduled for removal in Umbraco 19.")]
 public class SetStatusRedirectUrlManagementController : RedirectUrlManagementControllerBase
 {
-    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-    private readonly IConfigManipulator _configManipulator;
-
    /// <summary>
    /// Initializes a new instance of the <see cref="SetStatusRedirectUrlManagementController"/> class.
    /// </summary>
-    /// <param name="backOfficeSecurityAccessor">The back office security accessor.</param>
-    /// <param name="configManipulator">The configuration manipulator.</param>
+    /// <param name="backOfficeSecurityAccessor">Ignored. Retained for binary compatibility.</param>
+    /// <param name="configManipulator">Ignored. Retained for binary compatibility.</param>
    public SetStatusRedirectUrlManagementController(
+#pragma warning disable IDE0060 // Remove unused parameter
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
        IConfigManipulator configManipulator)
+#pragma warning restore IDE0060 // Remove unused parameter
    {
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-        _configManipulator = configManipulator;
    }

-    // TODO: Consider if we should even allow this, or only allow using the appsettings
-    // We generally don't want to edit the appsettings from our code.
-    // But maybe there is a valid use case for doing it on the fly.
    /// <summary>
-    /// Sets the redirect URL tracking status.
+    /// Deprecated. Returns an OK response without modifying any configuration. To toggle redirect URL tracking,
+    /// set the <c>Umbraco:CMS:WebRouting:DisableRedirectUrlTracking</c> configuration key instead.
    /// </summary>
    /// <param name="cancellationToken">The cancellation token for the HTTP request.</param>
-    /// <param name="status">The redirect status to set.</param>
-    /// <returns>An OK result if successful.</returns>
+    /// <param name="status">The redirect status (ignored).</param>
+    /// <returns>An OK result.</returns>
    [HttpPost("status")]
-    [EndpointSummary("Sets the redirect URL tracking status.")]
-    [EndpointDescription("Updates the redirect URL tracking configuration according to the provided status.")]
+    [EndpointSummary("Deprecated. No longer changes the redirect URL tracking status.")]
+    [EndpointDescription("This endpoint is deprecated and no longer modifies the configuration. To toggle redirect URL tracking, set the Umbraco:CMS:WebRouting:DisableRedirectUrlTracking configuration key instead.")]
    [MapToApiVersion("1.0")]
-    public async Task<IActionResult> SetStatus(CancellationToken cancellationToken, [FromQuery] RedirectStatus status)
-    {
-        // TODO: uncomment this when auth is implemented.
-        // var userIsAdmin = _backOfficeSecurityAccessor.BackOfficeSecurity?.CurrentUser?.IsAdmin();
-        // if (userIsAdmin is null or false)
-        // {
-        //     return Unauthorized();
-        // }
-
-        var enable = status switch
-        {
-            RedirectStatus.Enabled => true,
-            RedirectStatus.Disabled => false,
-            _ => throw new ArgumentOutOfRangeException(nameof(status), status, "Unknown redirect status")
-        };
-
-        // For now I'm not gonna change this to limit breaking, but it's weird to have a "disabled" switch,
-        // since you're essentially negating the boolean from the get go,
-        // it's much easier to reason with enabled = false == disabled.
-        await _configManipulator.SaveDisableRedirectUrlTrackingAsync(!enable);
-
-        // Taken from the existing implementation in RedirectUrlManagementController
-        // TODO this is ridiculous, but we need to ensure the configuration is reloaded, before this request is ended.
-        // otherwise we can read the old value in GetEnableState.
-        // The value is equal to JsonConfigurationSource.ReloadDelay
-        Thread.Sleep(250);
-
-        return Ok();
-    }
+    [Obsolete("This endpoint is deprecated and no longer modifies the configuration. Set the Umbraco:CMS:WebRouting:DisableRedirectUrlTracking configuration key instead. Scheduled for removal in Umbraco 19.")]
+    public Task<IActionResult> SetStatus(CancellationToken cancellationToken, [FromQuery] RedirectStatus status)
+        => Task.FromResult<IActionResult>(Ok());
 }
@@ -28,6 +28,7 @@ public class ConfigurationServerController : ServerControllerBase
    private readonly GlobalSettings _globalSettings;
    private readonly IBackOfficeExternalLoginProviders _externalLoginProviders;
    private readonly IHostingEnvironment _hostingEnvironment;
+    private readonly SignalRSettings _signalRSettings;

    /// <summary>
    /// Initializes a new instance of the <see cref="ConfigurationServerController"/> class.
@@ -36,13 +37,38 @@ public class ConfigurationServerController : ServerControllerBase
    /// <param name="globalSettings">The global settings options.</param>
    /// <param name="externalLoginProviders">The external login providers for back office.</param>
    /// <param name="hostingEnvironment">The hosting environment.</param>
+    /// <param name="signalRSettings">The SignalR settings options.</param>
    [ActivatorUtilitiesConstructor]
-    public ConfigurationServerController(IOptions<SecuritySettings> securitySettings, IOptions<GlobalSettings> globalSettings, IBackOfficeExternalLoginProviders externalLoginProviders, IHostingEnvironment hostingEnvironment)
+    public ConfigurationServerController(
+        IOptions<SecuritySettings> securitySettings,
+        IOptions<GlobalSettings> globalSettings,
+        IBackOfficeExternalLoginProviders externalLoginProviders,
+        IHostingEnvironment hostingEnvironment,
+        IOptions<SignalRSettings> signalRSettings)
    {
        _securitySettings = securitySettings.Value;
        _globalSettings = globalSettings.Value;
        _externalLoginProviders = externalLoginProviders;
        _hostingEnvironment = hostingEnvironment;
+        _signalRSettings = signalRSettings.Value;
+    }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Controllers.Server.ConfigurationServerController"/> class.
+    /// </summary>
+    /// <param name="securitySettings">The <see cref="SecuritySettings"/> options.</param>
+    /// <param name="globalSettings">The <see cref="GlobalSettings"/> options.</param>
+    /// <param name="externalLoginProviders">The external login providers used for back office authentication.</param>
+    /// <param name="hostingEnvironment">The hosting environment.</param>
+    [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
+    public ConfigurationServerController(IOptions<SecuritySettings> securitySettings, IOptions<GlobalSettings> globalSettings, IBackOfficeExternalLoginProviders externalLoginProviders, IHostingEnvironment hostingEnvironment)
+        : this(
+            securitySettings,
+            globalSettings,
+            externalLoginProviders,
+            hostingEnvironment,
+            StaticServiceProvider.Instance.GetRequiredService<IOptions<SignalRSettings>>())
+    {
    }

    /// <summary>
@@ -78,6 +104,10 @@ public class ConfigurationServerController : ServerControllerBase
            VersionCheckPeriod = _globalSettings.VersionCheckPeriod,
            AllowLocalLogin = _externalLoginProviders.HasDenyLocalLogin() is false,
            UmbracoCssPath = _hostingEnvironment.ToAbsolute(_globalSettings.UmbracoCssPath),
+            SignalR = new SignalRClientSettingsResponseModel
+            {
+                SkipNegotiation = _signalRSettings.ClientShouldSkipNegotiation,
+            },
        };

        return Task.FromResult<IActionResult>(Ok(responseModel));
@@ -32,6 +32,14 @@ public class SearchTemplateItemController : TemplateItemControllerBase
        _mapper = mapper;
    }

+    /// <summary>
+    /// Searches for template items matching the specified query, with support for pagination.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="query">The search query used to filter template items.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for pagination).</param>
+    /// <param name="take">The maximum number of items to return in the result set (used for pagination).</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains an <see cref="IActionResult"/> with a <see cref="PagedModel{TemplateItemResponseModel}"/> containing the search results.</returns>
    [HttpGet("search")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedModel<TemplateItemResponseModel>), StatusCodes.Status200OK)]
@@ -45,11 +53,14 @@ public class SearchTemplateItemController : TemplateItemControllerBase
            return Ok(new PagedModel<TemplateItemResponseModel> { Total = searchResult.Total });
        }

-        IEnumerable<ITemplate> templates = await _templateService.GetAllAsync(searchResult.Items.Select(item => item.Key).ToArray());
+        Guid[] keys = searchResult.Items.Select(x => x.Key).ToArray();
+        IEnumerable<ITemplate> templates = await _templateService.GetAllAsync(keys);
+        IEnumerable<ITemplate> orderedTemplates = OrderByRequestedIds(templates, keys);
+
        var result = new PagedModel<TemplateItemResponseModel>
        {
-            Items = _mapper.MapEnumerable<ITemplate, TemplateItemResponseModel>(templates),
-            Total = searchResult.Total
+            Items = _mapper.MapEnumerable<ITemplate, TemplateItemResponseModel>(orderedTemplates),
+            Total = searchResult.Total,
        };

        return Ok(result);
@@ -32,6 +32,7 @@ public class CreateTemporaryFileController : TemporaryFileControllerBase

    [HttpPost("")]
    [MapToApiVersion("1.0")]
+    [Consumes("multipart/form-data")]
    [ProducesResponseType(StatusCodes.Status201Created)]
    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
    [EndpointSummary("Creates a temporary file.")]
@@ -26,6 +26,7 @@ internal static class BackOfficeAuthPolicyBuilderExtensions
        builder.Services.AddSingleton<IAuthorizationHandler, DenyLocalLoginHandler>();
        builder.Services.AddSingleton<IAuthorizationHandler, DictionaryPermissionHandler>();
        builder.Services.AddSingleton<IAuthorizationHandler, ElementPermissionHandler>();
+        builder.Services.AddSingleton<IAuthorizationHandler, ElementContainerPermissionHandler>();
        builder.Services.AddSingleton<IAuthorizationHandler, FeatureAuthorizeHandler>();
        builder.Services.AddSingleton<IAuthorizationHandler, MediaPermissionHandler>();
        builder.Services.AddSingleton<IAuthorizationHandler, UserGroupPermissionHandler>();
@@ -150,6 +151,12 @@ internal static class BackOfficeAuthPolicyBuilderExtensions
            policy.Requirements.Add(new ElementPermissionRequirement());
        });

+        options.AddPolicy(AuthorizationPolicies.ElementFolderPermissionByResource, policy =>
+        {
+            policy.AuthenticationSchemes.Add(OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme);
+            policy.Requirements.Add(new ElementContainerPermissionRequirement());
+        });
+
        options.AddPolicy(AuthorizationPolicies.MediaPermissionByResource, policy =>
        {
            policy.AuthenticationSchemes.Add(OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme);
@@ -5,6 +5,7 @@ using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Hosting;
 using Umbraco.Cms.Core.IO;
 using Umbraco.Cms.Web.Common.Hosting;
+using Umbraco.Cms.Web.Common.Middleware;

 namespace Umbraco.Extensions;

@@ -68,6 +69,10 @@ public static partial class UmbracoBuilderExtensions
        builder.Services.AddSingleton<IBackOfficeEnabledMarker, BackOfficeEnabledMarker>();

        builder.Services.AddUnique<IBackOfficePathGenerator, UmbracoBackOfficePathGenerator>();
+        // Registered here rather than in AddWebComponents because the middleware depends on
+        // IBackOfficePathGenerator (registered just above). DI scope validation would otherwise
+        // fail in Delivery-only/Website-only bootstraps that never call AddBackOffice().
+        builder.Services.AddSingleton<UmbracoBackOfficeCacheHeadersMiddleware>();
        builder.Services.AddUnique<IPhysicalFileSystem>(factory =>
        {
            var path = "~/";
@@ -1,9 +1,11 @@
 using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.Configuration;
 using Umbraco.Cms.Api.Common.DependencyInjection;
-using Umbraco.Cms.Api.Management.Configuration;
+using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Cms.Api.Management.DependencyInjection;
 using Umbraco.Cms.Api.Management.Middleware;
+using Umbraco.Cms.Api.Management.OpenApi;
+using Umbraco.Cms.Api.Management.OpenApi.Transformers;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Api.Management.Serialization;
 using Umbraco.Cms.Api.Management.Services;
@@ -100,10 +102,25 @@ public static partial class UmbracoBuilderExtensions
            // Configures the JSON options for the Open API schema generation (based on the back-office MVC JSON options)
            builder.Services.ConfigureOptions<ConfigureUmbracoBackofficeHttpJsonOptions>();

-            builder.AddUmbracoOpenApiDocument<ConfigureUmbracoManagementApiOpenApiOptions>(
+            builder.AddBackOfficeOpenApiDocument(
                ManagementApiConfiguration.ApiName,
-                ManagementApiConfiguration.ApiTitle,
-                Constants.JsonOptionsNames.BackOffice);
+                document => document
+                    .WithTitle(ManagementApiConfiguration.ApiTitle)
+                    .WithBackOfficeAuthentication()
+                    .WithJsonOptions(Constants.JsonOptionsNames.BackOffice)
+                    .ConfigureOpenApiOptions(options =>
+                    {
+                        options.AddDocumentTransformer((doc, _, _) =>
+                        {
+                            doc.Info.Version = "Latest";
+                            doc.Info.Description = "This shows all APIs available in this version of Umbraco - including all the legacy apis that are available for backward compatibility";
+                            doc.Servers?.Clear();
+                            return Task.CompletedTask;
+                        });
+                        options.AddSchemaTransformer<FixFileReturnTypesTransformer>();
+                        options.AddOperationTransformer<ResponseHeaderTransformer>();
+                        options.AddOperationTransformer<NotificationHeaderTransformer>();
+                    }));

            services.Configure<UmbracoPipelineOptions>(options =>
            {
@@ -1,5 +1,8 @@
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 using Umbraco.Cms.Api.Management.ViewModels.DataType;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.PropertyEditors;
 using Umbraco.Cms.Core.Serialization;
@@ -16,6 +19,7 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory
    private readonly IDataValueEditorFactory _dataValueEditorFactory;
    private readonly IConfigurationEditorJsonSerializer _configurationEditorJsonSerializer;
    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<DataTypePresentationFactory> _logger;

    /// <summary>
    /// Initializes a new instance of the <see cref="DataTypePresentationFactory"/> class, which is responsible for creating data type presentation models.
@@ -25,18 +29,46 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory
    /// <param name="dataValueEditorFactory">Factory for creating data value editors.</param>
    /// <param name="configurationEditorJsonSerializer">Serializer for configuration editor JSON data.</param>
    /// <param name="timeProvider">Provides the current time for time-dependent operations.</param>
+    /// <param name="logger">The logger.</param>
    public DataTypePresentationFactory(
        IDataTypeContainerService dataTypeContainerService,
        PropertyEditorCollection propertyEditorCollection,
        IDataValueEditorFactory dataValueEditorFactory,
        IConfigurationEditorJsonSerializer configurationEditorJsonSerializer,
-        TimeProvider timeProvider)
+        TimeProvider timeProvider,
+        ILogger<DataTypePresentationFactory> logger)
    {
        _dataTypeContainerService = dataTypeContainerService;
        _propertyEditorCollection = propertyEditorCollection;
        _dataValueEditorFactory = dataValueEditorFactory;
        _configurationEditorJsonSerializer = configurationEditorJsonSerializer;
        _timeProvider = timeProvider;
+        _logger = logger;
+    }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DataTypePresentationFactory"/> class, which is responsible for creating data type presentation models.
+    /// </summary>
+    /// <param name="dataTypeContainerService">Service used to manage data type containers.</param>
+    /// <param name="propertyEditorCollection">A collection containing all available property editors.</param>
+    /// <param name="dataValueEditorFactory">Factory for creating data value editors.</param>
+    /// <param name="configurationEditorJsonSerializer">Serializer for configuration editor JSON data.</param>
+    /// <param name="timeProvider">Provides the current time for time-dependent operations.</param>
+    [Obsolete("Please use the constructor that takes all parameters. Scheduled for removal in Umbraco 19.")]
+    public DataTypePresentationFactory(
+        IDataTypeContainerService dataTypeContainerService,
+        PropertyEditorCollection propertyEditorCollection,
+        IDataValueEditorFactory dataValueEditorFactory,
+        IConfigurationEditorJsonSerializer configurationEditorJsonSerializer,
+        TimeProvider timeProvider)
+        : this(
+            dataTypeContainerService,
+            propertyEditorCollection,
+            dataValueEditorFactory,
+            configurationEditorJsonSerializer,
+            timeProvider,
+            StaticServiceProvider.Instance.GetRequiredService<ILogger<DataTypePresentationFactory>>())
+    {
    }

    /// <inheritdoc />
@@ -72,7 +104,6 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory
            dataType.Key = requestModel.Id.Value;
        }

-
        return Attempt.SucceedWithStatus<IDataType, DataTypeOperationStatus>(DataTypeOperationStatus.Success, dataType);
    }

@@ -82,7 +113,7 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory
        {
            try
            {
-                var parent = await _dataTypeContainerService.GetAsync(requestModel.Parent.Id);
+                EntityContainer? parent = await _dataTypeContainerService.GetAsync(requestModel.Parent.Id);

                return parent is null
                    ? Attempt.FailWithStatus(DataTypeOperationStatus.ParentNotFound, 0)
@@ -97,6 +128,7 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory
        return Attempt.SucceedWithStatus(DataTypeOperationStatus.Success, Constants.System.Root);
    }

+    /// <inheritdoc/>
    public Task<Attempt<IDataType, DataTypeOperationStatus>> CreateAsync(UpdateDataTypeRequestModel requestModel, IDataType current)
    {
        if (!_propertyEditorCollection.TryGet(requestModel.EditorAlias, out IDataEditor? editor))
@@ -104,7 +136,7 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory
            return Task.FromResult(Attempt.FailWithStatus<IDataType, DataTypeOperationStatus>(DataTypeOperationStatus.PropertyEditorNotFound, new DataType(new VoidEditor(_dataValueEditorFactory), _configurationEditorJsonSerializer) ));
        }

-        IDataType dataType = (IDataType)current.DeepClone();
+        var dataType = (IDataType)current.DeepClone();

        IDictionary<string, object> configurationData = MapConfigurationData(requestModel, editor);
        dataType.Name = requestModel.Name;
@@ -119,12 +151,26 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory

    private ValueStorageType GetEditorValueStorageType(IDataEditor editor, IDictionary<string, object> configurationData)
    {
-        var configurationObject = editor.GetConfigurationEditor()
-            .ToConfigurationObject(configurationData, _configurationEditorJsonSerializer);
-
-        if (configurationObject is IConfigureValueType configureValueType)
+        // Only editors whose configuration object implements IConfigureValueType derive their storage
+        // type from the configuration. Building the typed configuration object can throw for editors
+        // whose stored configuration doesn't cleanly deserialize into their configuration type; that
+        // must not fail the save, so fall back to the value editor's value type in that case.
+        try
        {
-            return ValueTypes.ToStorageType(configureValueType.ValueType);
+            if (editor.GetConfigurationEditor().ToConfigurationObject(configurationData, _configurationEditorJsonSerializer)
+                is IConfigureValueType configureValueType)
+            {
+                return ValueTypes.ToStorageType(configureValueType.ValueType);
+            }
+        }
+        catch (Exception)
+        {
+            // Configuration editors are third-party and can throw anything when the stored configuration
+            // doesn't deserialize into their configuration type. Fall back to the value editor's value type
+            // rather than failing the save, but log so the misconfiguration remains observable.
+            _logger.LogError(
+                "Could not build the configuration object for editor {EditorAlias} to determine its value storage type; falling back to the value editor's value type.",
+                editor.Alias);
        }

        var valueType = editor.GetValueEditor().ValueType;
@@ -5531,6 +5531,129 @@
        ]
      }
    },
+    "/umbraco/management/api/v1/document/{id}/sort-children": {
+      "put": {
+        "tags": [
+          "Document"
+        ],
+        "summary": "Sorts the children of a document by a field.",
+        "description": "Sorts the children of the specified parent document by a system field in the given direction. When sorting by name, an optional culture selects the variant name; the culture is not validated, so children that do not vary by it (or an unrecognised culture) fall back to the invariant name.",
+        "operationId": "PutDocumentByIdSortChildren",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SortDocumentChildrenByFieldRequestModel"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not Found",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The resource is protected and requires an authentication token"
+          },
+          "403": {
+            "description": "The authenticated user does not have access to this resource",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "Backoffice-User": [ ]
+          }
+        ]
+      }
+    },
    "/umbraco/management/api/v1/document/{id}/unpublish": {
      "put": {
        "tags": [
@@ -5751,6 +5874,94 @@
        ]
      }
    },
+    "/umbraco/management/api/v1/document/root/sort-children": {
+      "put": {
+        "tags": [
+          "Document"
+        ],
+        "summary": "Sorts the root-level documents by a field.",
+        "description": "Sorts the root-level documents by a system field in the given direction. When sorting by name, an optional culture selects the variant name; the culture is not validated, so documents that do not vary by it (or an unrecognised culture) fall back to the invariant name.",
+        "operationId": "PutDocumentRootSortChildren",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SortDocumentChildrenByFieldRequestModel"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The resource is protected and requires an authentication token"
+          },
+          "403": {
+            "description": "The authenticated user does not have access to this resource",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "Backoffice-User": [ ]
+          }
+        ]
+      }
+    },
    "/umbraco/management/api/v1/document/sort": {
      "put": {
        "tags": [
@@ -16271,7 +16482,8 @@
              }
            }
          }
-        }
+        },
+        "security": [ ]
      }
    },
    "/umbraco/management/api/v1/install/setup": {
@@ -16334,7 +16546,8 @@
              }
            }
          }
-        }
+        },
+        "security": [ ]
      }
    },
    "/umbraco/management/api/v1/install/validate-database": {
@@ -16397,7 +16610,8 @@
              }
            }
          }
-        }
+        },
+        "security": [ ]
      }
    },
    "/umbraco/management/api/v1/item/language": {
@@ -17658,7 +17872,8 @@
              }
            }
          }
-        }
+        },
+        "security": [ ]
      }
    },
    "/umbraco/management/api/v1/collection/media": {
@@ -18810,6 +19025,129 @@
        ]
      }
    },
+    "/umbraco/management/api/v1/media/{id}/sort-children": {
+      "put": {
+        "tags": [
+          "Media"
+        ],
+        "summary": "Sorts the children of a media item by a field.",
+        "description": "Sorts the children of the specified parent media item by a system field in the given direction.",
+        "operationId": "PutMediaByIdSortChildren",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SortMediaChildrenByFieldRequestModel"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not Found",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The resource is protected and requires an authentication token"
+          },
+          "403": {
+            "description": "The authenticated user does not have access to this resource",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "Backoffice-User": [ ]
+          }
+        ]
+      }
+    },
    "/umbraco/management/api/v1/media/{id}/validate": {
      "put": {
        "tags": [
@@ -19030,6 +19368,94 @@
        ]
      }
    },
+    "/umbraco/management/api/v1/media/root/sort-children": {
+      "put": {
+        "tags": [
+          "Media"
+        ],
+        "summary": "Sorts the root-level media items by a field.",
+        "description": "Sorts the root-level media items by a system field in the given direction.",
+        "operationId": "PutMediaRootSortChildren",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SortMediaChildrenByFieldRequestModel"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The resource is protected and requires an authentication token"
+          },
+          "403": {
+            "description": "The authenticated user does not have access to this resource",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "Backoffice-User": [ ]
+          }
+        ]
+      }
+    },
    "/umbraco/management/api/v1/media/sort": {
      "put": {
        "tags": [
@@ -28426,7 +28852,8 @@
              }
            }
          }
-        }
+        },
+        "security": [ ]
      }
    },
    "/umbraco/management/api/v1/profiling/status": {
@@ -28855,6 +29282,54 @@
              }
            }
          },
+          "400": {
+            "description": "Bad Request",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not Found",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": [
+                    "null",
+                    "array"
+                  ],
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  }
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
          "401": {
            "description": "The resource is protected and requires an authentication token"
          },
@@ -28919,8 +29394,8 @@
        "tags": [
          "Redirect Management"
        ],
-        "summary": "Sets the redirect URL tracking status.",
-        "description": "Updates the redirect URL tracking configuration according to the provided status.",
+        "summary": "Deprecated. No longer changes the redirect URL tracking status.",
+        "description": "This endpoint is deprecated and no longer modifies the configuration. To toggle redirect URL tracking, set the Umbraco:CMS:WebRouting:DisableRedirectUrlTracking configuration key instead.",
        "operationId": "PostRedirectManagementStatus",
        "parameters": [
          {
@@ -30749,7 +31224,8 @@
              }
            }
          }
-        }
+        },
+        "security": [ ]
      }
    },
    "/umbraco/management/api/v1/segment": {
@@ -30831,7 +31307,8 @@
              }
            }
          }
-        }
+        },
+        "security": [ ]
      }
    },
    "/umbraco/management/api/v1/server/information": {
@@ -30893,7 +31370,8 @@
              }
            }
          }
-        }
+        },
+        "security": [ ]
      }
    },
    "/umbraco/management/api/v1/server/troubleshooting": {
@@ -33422,7 +33900,7 @@
        "operationId": "PostTemporaryFile",
        "requestBody": {
          "content": {
-            "application/x-www-form-urlencoded": {
+            "multipart/form-data": {
              "schema": {
                "type": "object",
                "properties": {
@@ -36932,7 +37410,8 @@
              }
            }
          }
-        }
+        },
+        "security": [ ]
      }
    },
    "/umbraco/management/api/v1/user/invite/resend": {
@@ -37138,7 +37617,8 @@
              }
            }
          }
-        }
+        },
+        "security": [ ]
      }
    },
    "/umbraco/management/api/v1/user/set-user-groups": {
@@ -39630,6 +40110,13 @@
          }
        }
      },
+      "ContentSortFieldModel": {
+        "enum": [
+          "Name",
+          "CreateDate",
+          "UpdateDate"
+        ]
+      },
      "CopyDataTypeRequestModel": {
        "type": "object",
        "properties": {
@@ -49659,7 +50146,8 @@
          "allowPasswordReset",
          "versionCheckPeriod",
          "allowLocalLogin",
-          "umbracoCssPath"
+          "umbracoCssPath",
+          "signalR"
        ],
        "type": "object",
        "properties": {
@@ -49675,6 +50163,9 @@
          },
          "umbracoCssPath": {
            "type": "string"
+          },
+          "signalR": {
+            "$ref": "#/components/schemas/SignalRClientSettingsResponseModel"
          }
        }
      },
@@ -49737,6 +50228,38 @@
          }
        }
      },
+      "SignalRClientSettingsResponseModel": {
+        "required": [
+          "skipNegotiation"
+        ],
+        "type": "object",
+        "properties": {
+          "skipNegotiation": {
+            "type": "boolean"
+          }
+        }
+      },
+      "SortDocumentChildrenByFieldRequestModel": {
+        "required": [
+          "field",
+          "direction"
+        ],
+        "type": "object",
+        "properties": {
+          "culture": {
+            "type": [
+              "null",
+              "string"
+            ]
+          },
+          "field": {
+            "$ref": "#/components/schemas/ContentSortFieldModel"
+          },
+          "direction": {
+            "$ref": "#/components/schemas/DirectionModel"
+          }
+        }
+      },
      "SortingRequestModel": {
        "required": [
          "sorting"
@@ -49761,6 +50284,21 @@
          }
        }
      },
+      "SortMediaChildrenByFieldRequestModel": {
+        "required": [
+          "field",
+          "direction"
+        ],
+        "type": "object",
+        "properties": {
+          "field": {
+            "$ref": "#/components/schemas/ContentSortFieldModel"
+          },
+          "direction": {
+            "$ref": "#/components/schemas/DirectionModel"
+          }
+        }
+      },
      "StaticFileItemResponseModel": {
        "required": [
          "isFolder",
@@ -50507,12 +51045,13 @@
          },
          "masterTemplate": {
            "oneOf": [
+              {
+                "type": "null"
+              },
              {
                "$ref": "#/components/schemas/ReferenceByIdModel"
              }
-            ],
-            "nullable": true,
-            "deprecated": true
+            ]
          },
          "name": {
            "type": "string"
@@ -0,0 +1,18 @@
+using Umbraco.Cms.Api.Common.OpenApi;
+
+namespace Umbraco.Cms.Api.Management.OpenApi;
+
+/// <summary>
+/// Management-specific extension methods for <see cref="BackOfficeOpenApiDocumentBuilder"/>.
+/// </summary>
+public static class BackOfficeOpenApiDocumentBuilderExtensions
+{
+    /// <summary>
+    /// Adds backoffice authentication requirements to the document.
+    /// </summary>
+    /// <param name="documentBuilder">The document builder.</param>
+    /// <returns>The same builder for chaining.</returns>
+    public static BackOfficeOpenApiDocumentBuilder WithBackOfficeAuthentication(
+        this BackOfficeOpenApiDocumentBuilder documentBuilder)
+        => documentBuilder.ConfigureOpenApiOptions(options => options.AddBackofficeSecurityRequirements());
+}
@@ -26,11 +26,20 @@ internal class BackOfficeSecurityRequirementsTransformer : IOpenApiOperationTran
        OpenApiOperationTransformerContext context,
        CancellationToken cancellationToken)
    {
-        if (context.Description.ActionDescriptor is not ControllerActionDescriptor description ||
-            description.MethodInfo.GetCustomAttributes(true).Any(x => x is AllowAnonymousAttribute) ||
+        if (context.Description.ActionDescriptor is not ControllerActionDescriptor description)
+        {
+            return Task.CompletedTask;
+        }
+
+        if (description.MethodInfo.GetCustomAttributes(true).Any(x => x is AllowAnonymousAttribute) ||
            description.MethodInfo.DeclaringType?.GetCustomAttributes(true).Any(x => x is AllowAnonymousAttribute) ==
            true)
        {
+            // Explicitly clear security on anonymous operations so they override the document-level
+            // security requirement added below. Without this, OpenAPI consumers (including the
+            // generated backoffice SDK) treat these endpoints as authenticated and attach a Bearer
+            // token, which triggers a /token refresh before the user has logged in.
+            operation.Security = [];
            return Task.CompletedTask;
        }

@@ -1,8 +1,12 @@
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
 using Umbraco.Cms.Api.Management.Controllers.Security;
 using Umbraco.Cms.Api.Management.ServerEvents;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Web.Common.Routing;
 using Umbraco.Extensions;
@@ -12,26 +16,36 @@ namespace Umbraco.Cms.Api.Management.Routing;
 /// <summary>
 /// Creates routes for the back office area.
 /// </summary>
-public sealed class BackOfficeAreaRoutes : IAreaRoutes
+public sealed class BackOfficeAreaRoutes : SignalRRoutesBase, IAreaRoutes
 {
-    private readonly IRuntimeState _runtimeState;
+    /// <summary>
+    /// Initializes a new instance of the <see cref="BackOfficeAreaRoutes" /> class.
+    /// </summary>
+    [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
+    public BackOfficeAreaRoutes(IRuntimeState runtimeState)
+        : this(
+            runtimeState,
+            StaticServiceProvider.Instance.GetRequiredService<IOptions<SignalRSettings>>())
+    {
+    }

    /// <summary>
    /// Initializes a new instance of the <see cref="BackOfficeAreaRoutes" /> class.
    /// </summary>
-    public BackOfficeAreaRoutes(IRuntimeState runtimeState)
-        => _runtimeState = runtimeState;
-
+    public BackOfficeAreaRoutes(IRuntimeState runtimeState, IOptions<SignalRSettings> signalRSettings)
+        : base(runtimeState, signalRSettings)
+    {
+    }

    /// <inheritdoc />
    public void CreateRoutes(IEndpointRouteBuilder endpoints)
    {
-        if (_runtimeState.Level is RuntimeLevel.Install or RuntimeLevel.Upgrade or RuntimeLevel.Upgrading or RuntimeLevel.Run)
+        if (RuntimeState.Level is RuntimeLevel.Install or RuntimeLevel.Upgrade or RuntimeLevel.Upgrading or RuntimeLevel.Run)
        {
            MapMinimalBackOffice(endpoints);

-            endpoints.MapHub<BackofficeHub>(Constants.System.UmbracoPathSegment + Constants.Web.BackofficeSignalRHub);
-            endpoints.MapHub<ServerEventHub>(Constants.System.UmbracoPathSegment + Constants.Web.ServerEventSignalRHub);
+            endpoints.MapHub<BackofficeHub>(Constants.System.UmbracoPathSegment + Constants.Web.BackofficeSignalRHub, ConfigureHubEndpoint);
+            endpoints.MapHub<ServerEventHub>(Constants.System.UmbracoPathSegment + Constants.Web.ServerEventSignalRHub, ConfigureHubEndpoint);
        }
    }

@@ -1,7 +1,11 @@
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
 using Umbraco.Cms.Api.Management.Preview;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Web.Common.Routing;

@@ -10,16 +14,29 @@ namespace Umbraco.Cms.Api.Management.Routing;
 /// <summary>
 ///     Creates routes for the preview hub
 /// </summary>
-public sealed class PreviewRoutes : IAreaRoutes
+public sealed class PreviewRoutes : SignalRRoutesBase, IAreaRoutes
 {
-    private readonly IRuntimeState _runtimeState;
-
    /// <summary>
-    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Routing.PreviewRoutes"/> class, configuring preview routing based on the application's runtime state.
+    /// Initializes a new instance of the <see cref="PreviewRoutes"/> class, configuring preview routing based on the application's runtime state.
    /// </summary>
    /// <param name="runtimeState">An instance representing the current runtime state of the Umbraco application.</param>
+    [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
    public PreviewRoutes(IRuntimeState runtimeState)
-        => _runtimeState = runtimeState;
+        : this(
+            runtimeState,
+            StaticServiceProvider.Instance.GetRequiredService<IOptions<SignalRSettings>>())
+    {
+    }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="PreviewRoutes"/> class, configuring preview routing based on the application's runtime state.
+    /// </summary>
+    /// <param name="runtimeState">An instance representing the current runtime state of the Umbraco application.</param>
+    /// <param name="signalRSettings">The SignalR settings options.</param>
+    public PreviewRoutes(IRuntimeState runtimeState, IOptions<SignalRSettings> signalRSettings)
+        : base(runtimeState, signalRSettings)
+    {
+    }

    /// <summary>
    /// Creates the preview routes on the specified endpoint route builder.
@@ -27,9 +44,9 @@ public sealed class PreviewRoutes : IAreaRoutes
    /// <param name="endpoints">The endpoint route builder to add routes to.</param>
    public void CreateRoutes(IEndpointRouteBuilder endpoints)
    {
-        if (_runtimeState.Level is RuntimeLevel.Install or RuntimeLevel.Upgrade or RuntimeLevel.Upgrading or RuntimeLevel.Run)
+        if (RuntimeState.Level is RuntimeLevel.Install or RuntimeLevel.Upgrade or RuntimeLevel.Upgrading or RuntimeLevel.Run)
        {
-            endpoints.MapHub<PreviewHub>(GetPreviewHubRoute());
+            endpoints.MapHub<PreviewHub>(GetPreviewHubRoute(), ConfigureHubEndpoint);
        }
    }

@@ -41,3 +58,4 @@ public sealed class PreviewRoutes : IAreaRoutes
    /// </returns>
    public string GetPreviewHubRoute() => $"/{Constants.System.UmbracoPathSegment}/{nameof(PreviewHub)}";
 }
+
@@ -0,0 +1,45 @@
+using Microsoft.AspNetCore.Http.Connections;
+using Microsoft.Extensions.Options;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Management.Routing;
+
+/// <summary>
+/// Base class for route definitions that map SignalR hub endpoints,
+/// applying shared transport configuration from <see cref="SignalRSettings"/>.
+/// </summary>
+public abstract class SignalRRoutesBase
+{
+    private readonly SignalRSettings _signalRSettings;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SignalRRoutesBase"/> class.
+    /// </summary>
+    /// <param name="runtimeState">The current runtime state of the Umbraco application.</param>
+    /// <param name="signalRSettings">The SignalR settings options.</param>
+    protected SignalRRoutesBase(IRuntimeState runtimeState, IOptions<SignalRSettings> signalRSettings)
+    {
+        RuntimeState = runtimeState;
+        _signalRSettings = signalRSettings.Value;
+    }
+
+    /// <summary>
+    /// Gets the current runtime state of the Umbraco application.
+    /// </summary>
+    protected IRuntimeState RuntimeState { get; }
+
+    /// <summary>
+    /// Configures the transport options for a SignalR hub endpoint.
+    /// When <see cref="SignalRSettings.ClientShouldSkipNegotiation"/> is enabled,
+    /// restricts the endpoint to WebSocket transport only so clients can skip the negotiate round-trip.
+    /// </summary>
+    /// <param name="options">The hub endpoint dispatcher options to configure.</param>
+    protected void ConfigureHubEndpoint(HttpConnectionDispatcherOptions options)
+    {
+        if (_signalRSettings.ClientShouldSkipNegotiation)
+        {
+            options.Transports = HttpTransportType.WebSockets;
+        }
+    }
+}
@@ -0,0 +1,64 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Authorization;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Security.Authorization;
+
+/// <summary>
+/// Authorizes permissions on all direct children of a node.
+/// </summary>
+internal static class AllChildrenAuthorizer
+{
+    /// <summary>
+    /// Determines whether the user is authorized for every direct child of the given parent (or the root).
+    /// </summary>
+    /// <param name="authorizationService">The authorization service.</param>
+    /// <param name="entityService">The entity service used to resolve the children.</param>
+    /// <param name="user">The current user.</param>
+    /// <param name="parentKey">The parent key, or <c>null</c> to authorize the root-level children.</param>
+    /// <param name="objectType">The object type of the children (and parent).</param>
+    /// <param name="resourceFactory">Builds the permission resource to authorize a batch of child keys against.</param>
+    /// <param name="policy">The authorization policy to apply.</param>
+    /// <returns><c>true</c> if the user is authorized against all children; otherwise <c>false</c>.</returns>
+    public static async Task<bool> IsAuthorizedForChildrenAsync(
+        IAuthorizationService authorizationService,
+        IEntityService entityService,
+        ClaimsPrincipal user,
+        Guid? parentKey,
+        UmbracoObjectTypes objectType,
+        Func<IEnumerable<Guid>, IPermissionResource> resourceFactory,
+        string policy)
+    {
+        const int pageSize = 500;
+        var page = 0;
+        long total;
+        do
+        {
+            Guid[] childKeys = entityService
+                .GetPagedChildren(parentKey, [objectType], objectType, page * pageSize, pageSize, out total)
+                .Select(child => child.Key)
+                .ToArray();
+
+            if (childKeys.Length > 0)
+            {
+                AuthorizationResult authorizationResult = await authorizationService.AuthorizeResourceAsync(
+                    user,
+                    resourceFactory(childKeys),
+                    policy);
+
+                if (authorizationResult.Succeeded is false)
+                {
+                    return false;
+                }
+            }
+
+            page++;
+        }
+        while (page * pageSize < total);
+
+        return true;
+    }
+}
@@ -0,0 +1,52 @@
+using Microsoft.AspNetCore.Authorization;
+using Umbraco.Cms.Core.Models.Membership;
+using Umbraco.Cms.Core.Security.Authorization;
+
+namespace Umbraco.Cms.Api.Management.Security.Authorization.Element;
+
+/// <summary>
+///     Authorizes that the current user has the correct permission access to the element container item(s) specified in the request.
+/// </summary>
+public class ElementContainerPermissionHandler : MustSatisfyRequirementAuthorizationHandler<ElementContainerPermissionRequirement, ElementContainerPermissionResource>
+{
+    private readonly IElementContainerPermissionAuthorizer _elementContainerPermissionAuthorizer;
+    private readonly IAuthorizationHelper _authorizationHelper;
+
+    /// <summary>
+    ///     Initializes a new instance of the <see cref="ElementContainerPermissionHandler" /> class.
+    /// </summary>
+    /// <param name="elementContainerPermissionAuthorizer">Authorizer for element container access.</param>
+    /// <param name="authorizationHelper">The authorization helper.</param>
+    public ElementContainerPermissionHandler(IElementContainerPermissionAuthorizer elementContainerPermissionAuthorizer, IAuthorizationHelper authorizationHelper)
+    {
+        _elementContainerPermissionAuthorizer = elementContainerPermissionAuthorizer;
+        _authorizationHelper = authorizationHelper;
+    }
+
+    /// <inheritdoc />
+    protected override async Task<bool> IsAuthorized(
+        AuthorizationHandlerContext context,
+        ElementContainerPermissionRequirement requirement,
+        ElementContainerPermissionResource resource)
+    {
+        var result = true;
+
+        IUser user = _authorizationHelper.GetUmbracoUser(context.User);
+        if (resource.CheckRoot)
+        {
+            result &= await _elementContainerPermissionAuthorizer.IsDeniedAtRootLevelAsync(user, resource.PermissionsToCheck) is false;
+        }
+
+        if (resource.CheckRecycleBin)
+        {
+            result &= await _elementContainerPermissionAuthorizer.IsDeniedAtRecycleBinLevelAsync(user, resource.PermissionsToCheck) is false;
+        }
+
+        if (resource.ContainerKeys.Any())
+        {
+            result &= await _elementContainerPermissionAuthorizer.IsDeniedAsync(user, resource.ContainerKeys, resource.PermissionsToCheck) is false;
+        }
+
+        return result;
+    }
+}
@@ -0,0 +1,10 @@
+using Microsoft.AspNetCore.Authorization;
+
+namespace Umbraco.Cms.Api.Management.Security.Authorization.Element;
+
+/// <summary>
+///     Authorization requirement for the <see cref="ElementContainerPermissionHandler" />.
+/// </summary>
+public class ElementContainerPermissionRequirement : IAuthorizationRequirement
+{
+}
@@ -1,5 +1,6 @@
 using Umbraco.Cms.Core.Actions;
 using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Models.Membership;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
@@ -25,7 +26,7 @@ internal sealed class DocumentPermissionFilterService : PermissionFilterServiceB
        => _contentPermissionService = contentPermissionService;

    /// <inheritdoc/>
-    protected override string BrowseActionLetter => ActionBrowse.ActionLetter;
+    protected override string BrowseActionLetter(IEntitySlim entity) => ActionBrowse.ActionLetter;

    /// <inheritdoc/>
    protected override Task<IEnumerable<NodePermissions>> GetPermissionsAsync(IUser user, IEnumerable<Guid> entityKeys)
@@ -1,5 +1,7 @@
+using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Actions;
 using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Models.Membership;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
@@ -25,7 +27,10 @@ internal sealed class ElementPermissionFilterService : PermissionFilterServiceBa
        => _elementPermissionService = elementPermissionService;

    /// <inheritdoc/>
-    protected override string BrowseActionLetter => ActionElementBrowse.ActionLetter;
+    protected override string BrowseActionLetter(IEntitySlim entity)
+        => entity.NodeObjectType == Constants.ObjectTypes.Element
+            ? ActionElementBrowse.ActionLetter
+            : ActionElementContainerBrowse.ActionLetter;

    /// <inheritdoc/>
    protected override Task<IEnumerable<NodePermissions>> GetPermissionsAsync(IUser user, IEnumerable<Guid> entityKeys)
@@ -22,7 +22,7 @@ internal abstract class PermissionFilterServiceBase
    /// <summary>
    /// Gets the browse action letter used to check permissions.
    /// </summary>
-    protected abstract string BrowseActionLetter { get; }
+    protected abstract string BrowseActionLetter(IEntitySlim entity);

    /// <summary>
    /// Filters entities based on the current user's browse permissions.
@@ -106,5 +106,5 @@ internal abstract class PermissionFilterServiceBase

    private bool HasBrowsePermission(IEntitySlim entity, Dictionary<Guid, NodePermissions> permissionsByNodeKey)
        => permissionsByNodeKey.TryGetValue(entity.Key, out NodePermissions? nodePermissions)
-           && nodePermissions.Permissions.Contains(BrowseActionLetter);
+           && nodePermissions.Permissions.Contains(BrowseActionLetter(entity));
 }
@@ -21,4 +21,9 @@ public class ServerConfigurationResponseModel
    /// Gets or sets the relative or absolute path to the Umbraco CSS file used by the application.
    /// </summary>
    public string UmbracoCssPath { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the client-side SignalR settings.
+    /// </summary>
+    public SignalRClientSettingsResponseModel SignalR { get; set; } = new();
 }
@@ -0,0 +1,10 @@
+namespace Umbraco.Cms.Api.Management.ViewModels.Server;
+
+/// <summary>
+/// Represents client-side SignalR settings returned by the server configuration endpoint.
+/// </summary>
+public class SignalRClientSettingsResponseModel
+{
+    /// <summary>Gets or sets a value indicating whether the client should skip the SignalR negotiate round-trip.</summary>
+    public bool SkipNegotiation { get; set; }
+}
@@ -0,0 +1,21 @@
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Models.ContentEditing;
+
+namespace Umbraco.Cms.Api.Management.ViewModels.Sorting;
+
+/// <summary>
+/// Base request model for sorting the children of a node by a system field.
+/// </summary>
+public abstract class SortChildrenByFieldRequestModelBase
+{
+    /// <summary>
+    /// Gets or sets the system field to sort the children by.
+    /// The create and update dates are node-level (not culture-specific).
+    /// </summary>
+    public required ContentSortField Field { get; init; }
+
+    /// <summary>
+    /// Gets or sets the direction to sort in.
+    /// </summary>
+    public required Direction Direction { get; init; }
+}
@@ -0,0 +1,16 @@
+using Umbraco.Cms.Core.Models.ContentEditing;
+
+namespace Umbraco.Cms.Api.Management.ViewModels.Sorting;
+
+/// <summary>
+/// Request model for sorting the children of a document by a system field.
+/// </summary>
+public class SortDocumentChildrenByFieldRequestModel : SortChildrenByFieldRequestModelBase
+{
+    /// <summary>
+    /// Gets or sets the culture whose variant name to sort by, or <c>null</c> to sort by the invariant name.
+    /// Only applies when sorting by <see cref="ContentSortField.Name"/>. The culture is not validated: a document that
+    /// does not vary by the given culture - or an unrecognised culture - falls back to the invariant name.
+    /// </summary>
+    public string? Culture { get; init; }
+}
@@ -0,0 +1,9 @@
+namespace Umbraco.Cms.Api.Management.ViewModels.Sorting;
+
+/// <summary>
+/// Request model for sorting the children of a media item by a system field.
+/// Media items do not vary by culture, so no culture is accepted.
+/// </summary>
+public class SortMediaChildrenByFieldRequestModel : SortChildrenByFieldRequestModelBase
+{
+}
@@ -59,7 +59,7 @@ namespace Umbraco.Cms.DevelopmentMode.Backoffice.InMemoryAuto
        private int? _skipver;
        private RoslynCompiler? _roslynCompiler;
        private ModelsBuilderSettings _config;
-        private bool _disposedValue;
+        private volatile bool _disposedValue;

        public InMemoryModelFactory(
            Lazy<UmbracoServices> umbracoServices,
@@ -280,25 +280,34 @@ namespace Umbraco.Cms.DevelopmentMode.Backoffice.InMemoryAuto
                }
            }

-            // don't use an upgradeable lock here because only 1 thread at a time could enter it
-            try
+            // The factory is disposed on application shutdown (via IRegisteredObject.Stop), but in-flight
+            // requests can still reach this point. Bail out with the current models rather than touching
+            // the disposed lock. The catch below covers the small window where disposal happens after this
+            // check but before (or while) the lock is acquired.
+            if (_disposedValue)
            {
-                _locker.EnterReadLock();
-                if (_hasModels)
-                {
-                    return _infos;
-                }
-            }
-            finally
-            {
-                if (_locker.IsReadLockHeld)
-                {
-                    _locker.ExitReadLock();
-                }
+                return _infos;
            }

            try
            {
+                // don't use an upgradeable lock here because only 1 thread at a time could enter it
+                try
+                {
+                    _locker.EnterReadLock();
+                    if (_hasModels)
+                    {
+                        return _infos;
+                    }
+                }
+                finally
+                {
+                    if (_locker.IsReadLockHeld)
+                    {
+                        _locker.ExitReadLock();
+                    }
+                }
+
                _locker.EnterUpgradeableReadLock();

                if (_hasModels)
@@ -359,6 +368,12 @@ namespace Umbraco.Cms.DevelopmentMode.Backoffice.InMemoryAuto

                return _infos;
            }
+            catch (ObjectDisposedException ex)
+            {
+                // Expected when the factory is disposed during shutdown mid-request; log so an unexpected disposal stays traceable.
+                _logger.LogDebug(ex, "EnsureModels interrupted by object disposal (assumed application shutdown); returning current models.");
+                return _infos;
+            }
            finally
            {
                if (_locker.IsWriteLockHeld)
@@ -15,8 +15,9 @@ SQLite-specific EF Core provider for Umbraco CMS. Contains SQLite migrations and
 This is a thin provider project that implements SQLite-specific functionality for the EF Core persistence layer:

 1. **Migration Provider** - Executes SQLite-specific migrations
-2. **Migration Provider Setup** - Configures DbContext to use SQLite
+2. **Migration Provider Setup** - Configures DbContext to use SQLite (incl. transient-error retry)
 3. **Migrations** - SQLite-specific migration files for OpenIddict tables
+4. **Retrying Execution Strategy** - Retries transient SQLite lock errors on EF Core operations

 ### Folder Structure

@@ -30,7 +31,8 @@ Umbraco.Cms.Persistence.EFCore.Sqlite/
 │   └── UmbracoDbContextModelSnapshot.cs         # Current model state
 ├── EFCoreSqliteComposer.cs                       # DI registration
 ├── SqliteMigrationProvider.cs                    # IMigrationProvider impl
-└── SqliteMigrationProviderSetup.cs               # IMigrationProviderSetup impl
+├── SqliteMigrationProviderSetup.cs               # IMigrationProviderSetup impl
+└── SqliteRetryingExecutionStrategy.cs            # IExecutionStrategy for transient lock errors
 ```

 ### Relationship with Parent Project
@@ -65,7 +67,19 @@ Registers `IMigrationProvider` and `IMigrationProviderSetup` for SQLite.

 ### SqliteMigrationProviderSetup (line 11-14)

-Configures `DbContextOptionsBuilder` with `UseSqlite` and migrations assembly.
+Configures `DbContextOptionsBuilder` with `UseSqlite`, the migrations assembly, and the
+`SqliteRetryingExecutionStrategy` (see below). Invoked from
+`UmbracoDbContext.ConfigureOptions` for every `UmbracoDbContext` instance, so all EF Core
+access to the Umbraco database (including OpenIddict's token store) inherits the retry.
+
+### SqliteRetryingExecutionStrategy
+
+Custom `Microsoft.EntityFrameworkCore.Storage.ExecutionStrategy` that retries on transient
+SQLite errors (`SQLITE_BUSY`, `SQLITE_LOCKED`) using `SqliteExceptionExtensions.IsBusyOrLocked`
+from the parent project. Defaults inherit `ExecutionStrategy.DefaultMaxRetryCount` (6) and
+`ExecutionStrategy.DefaultMaxDelay` (30s), giving a ~56-second retry budget — see the class's
+XML doc for the rationale and the unattended-upgrade escape hatch for very long migrations.
+Added to resolve issue #22939 (OpenIddict token reads failing during long migrations).

 ---

@@ -122,7 +136,8 @@ All tables prefixed with `umbraco`:
 | File | Purpose |
 |------|---------|
 | `SqliteMigrationProvider.cs` | Migration execution |
-| `SqliteMigrationProviderSetup.cs` | DbContext configuration |
+| `SqliteMigrationProviderSetup.cs` | DbContext configuration (UseSqlite + retry strategy) |
+| `SqliteRetryingExecutionStrategy.cs` | Retry on transient SQLite BUSY/LOCKED errors |
 | `EFCoreSqliteComposer.cs` | DI registration |
 | `Migrations/*.cs` | Migration files |

@@ -1,5 +1,4 @@
 using Microsoft.EntityFrameworkCore;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Persistence.EFCore.Migrations;

 namespace Umbraco.Cms.Persistence.EFCore.Sqlite;
@@ -15,6 +14,15 @@ public class SqliteMigrationProviderSetup : IMigrationProviderSetup
    /// <inheritdoc />
    public void Setup(DbContextOptionsBuilder builder, string? connectionString)
    {
-        builder.UseSqlite(connectionString, x => x.MigrationsAssembly(GetType().Assembly.FullName));
+        builder.UseSqlite(connectionString, x =>
+        {
+            x.MigrationsAssembly(GetType().Assembly.FullName);
+
+            // Retry transient SQLite errors (BUSY / LOCKED). See SqliteRetryingExecutionStrategy
+            // for the rationale — long-running migrations or schema-modifying operations can
+            // briefly lock the database in a way that surfaces as a hard error to concurrent
+            // EF Core readers (notably OpenIddict token validation). See issue #22939.
+            x.ExecutionStrategy(deps => new SqliteRetryingExecutionStrategy(deps));
+        });
    }
 }
@@ -0,0 +1,71 @@
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore.Storage;
+
+namespace Umbraco.Cms.Persistence.EFCore.Sqlite;
+
+/// <summary>
+/// EF Core execution strategy that retries on transient SQLite errors (BUSY / LOCKED).
+/// </summary>
+/// <remarks>
+/// <para>
+/// SQLite serialises writers at the database level, and schema-modifying statements briefly
+/// block readers — even in WAL mode. Without retries, concurrent EF Core reads (for example
+/// OpenIddict's token validation against <c>umbracoOpenIddictTokens</c>) surface those
+/// transient locks as <see cref="SqliteException"/> and fail the caller's request.
+/// </para>
+/// <para>
+/// Microsoft does not ship a built-in execution strategy for SQLite (only the SQL Server
+/// equivalent), so we provide this one. It piggy-backs on <see cref="ExecutionStrategy"/>'s
+/// default exponential backoff and re-uses its inherited
+/// <see cref="ExecutionStrategy.DefaultMaxRetryCount"/> (6) and
+/// <see cref="ExecutionStrategy.DefaultMaxDelay"/> (30 seconds), which produce a delay
+/// schedule of roughly 0s, 1s, 3s, 7s, 15s, 30s — a ~56-second retry window.
+/// </para>
+/// <para>
+/// On top of those EF Core delays, <c>SQLITE_BUSY</c> (error 5) is also retried internally
+/// by Microsoft.Data.Sqlite for up to the connection's <c>Default Timeout</c> (30 seconds
+/// by default) per attempt. <c>SQLITE_LOCKED</c> (error 6) is not — it returns immediately,
+/// so EF Core's retry budget is the only buffer.
+/// </para>
+/// </remarks>
+public class SqliteRetryingExecutionStrategy : ExecutionStrategy
+{
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SqliteRetryingExecutionStrategy"/> class
+    /// with default retry settings inherited from <see cref="ExecutionStrategy"/>.
+    /// </summary>
+    /// <param name="dependencies">Parameter object containing service dependencies.</param>
+    public SqliteRetryingExecutionStrategy(ExecutionStrategyDependencies dependencies)
+        : this(dependencies, DefaultMaxRetryCount, DefaultMaxDelay)
+    {
+    }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SqliteRetryingExecutionStrategy"/> class.
+    /// </summary>
+    /// <param name="dependencies">Parameter object containing service dependencies.</param>
+    /// <param name="maxRetryCount">The maximum number of retry attempts.</param>
+    /// <param name="maxRetryDelay">The maximum delay between retries.</param>
+    public SqliteRetryingExecutionStrategy(
+        ExecutionStrategyDependencies dependencies,
+        int maxRetryCount,
+        TimeSpan maxRetryDelay)
+        : base(dependencies, maxRetryCount, maxRetryDelay)
+    {
+    }
+
+    /// <inheritdoc />
+    protected override bool ShouldRetryOn(Exception exception)
+    {
+        // EF Core wraps provider exceptions, so walk the inner-exception chain.
+        for (Exception? current = exception; current is not null; current = current.InnerException)
+        {
+            if (current is SqliteException sqlite && sqlite.IsBusyOrLocked())
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
@@ -184,17 +184,11 @@ internal sealed class SqliteEFCoreDistributedLockingMechanism<T> : IDistributedL
                        throw new ArgumentException($"LockObject with id={LockId} does not exist.");
                    }
                }
-                catch (SqliteException ex) when (IsBusyOrLocked(ex))
+                catch (SqliteException ex) when (ex.IsBusyOrLocked())
                {
                    throw new DistributedWriteLockTimeoutException(LockId);
                }
            });
        }
-
-        private static bool IsBusyOrLocked(SqliteException ex) =>
-            ex.SqliteErrorCode
-                is raw.SQLITE_BUSY
-                or raw.SQLITE_LOCKED
-                or raw.SQLITE_LOCKED_SHAREDCACHE;
    }
 }
@@ -0,0 +1,26 @@
+using Microsoft.Data.Sqlite;
+using SQLitePCL;
+
+namespace Umbraco.Cms.Persistence.EFCore;
+
+/// <summary>
+/// SQLite-specific exception helpers for code running on the EF Core persistence stack.
+/// </summary>
+/// <remarks>
+/// A parallel helper exists at <c>Umbraco.Cms.Persistence.Sqlite.Services.SqliteExceptionExtensions</c>
+/// for the NPoco stack. Both stacks are independent (neither references the other) so the small
+/// duplication is intentional — keeps the layering clean.
+/// </remarks>
+public static class SqliteExceptionExtensions
+{
+    /// <summary>
+    /// Determines if the SQLite exception is a BUSY or LOCKED error.
+    /// </summary>
+    /// <param name="ex">The SQLite exception to check.</param>
+    /// <returns><c>true</c> if the error is BUSY, LOCKED, or LOCKED_SHAREDCACHE; otherwise <c>false</c>.</returns>
+    public static bool IsBusyOrLocked(this SqliteException ex) =>
+        ex.SqliteErrorCode
+            is raw.SQLITE_BUSY
+            or raw.SQLITE_LOCKED
+            or raw.SQLITE_LOCKED_SHAREDCACHE;
+}
@@ -119,8 +119,7 @@ BackofficeProjectDirectory = ../Umbraco.Web.UI.Client/
 BackofficeAssetsPath = wwwroot/umbraco/backoffice
 ```

-**Login Build** (lines 94-148):
-
+**Login Build** (lines 102-148):
 ```
 LoginProjectDirectory = ../Umbraco.Web.UI.Login/
 LoginAssetsPath = wwwroot/umbraco/login
@@ -128,13 +127,18 @@ LoginAssetsPath = wwwroot/umbraco/login

 ### Build Targets

-| Target                           | Purpose                                      |
-| -------------------------------- | -------------------------------------------- |
-| `BuildStaticAssetsPreconditions` | Checks if build needed (Visual Studio only)  |
-| `RestoreBackoffice`              | Runs `npm i` if package-lock changed         |
-| `BuildBackoffice`                | Runs `npm run build:for:cms`                 |
-| `DefineBackofficeAssets`         | Registers assets with StaticWebAssets system |
-| `CleanBackoffice`                | Removes built assets on `dotnet clean`       |
+| Target | Purpose |
+|--------|---------|
+| `BuildBackofficeStaticAssetsPreconditions` | Checks if Backoffice build needed (Visual Studio only) |
+| `RestoreBackoffice` | Runs `npm i` if package-lock changed |
+| `BuildBackoffice` | Runs `npm run build:for:cms` |
+| `DefineBackofficeAssets` | Registers Backoffice assets with StaticWebAssets system |
+| `CleanBackoffice` | Removes built Backoffice assets on `dotnet clean` |
+| `BuildLoginStaticAssetsPreconditions` | Checks if Login build needed (Visual Studio only) |
+| `RestoreLogin` | Runs `npm i` if Login's package-lock changed |
+| `BuildLogin` | Runs `npm run build` in Login. Depends on `RestoreBackoffice` because Login's `tsc` walks Client's `src/` via tsconfig path aliases and needs Client's `node_modules` populated for transitive `lit`/`rxjs`/UUI resolution |
+| `DefineLoginAssets` | Registers Login assets with StaticWebAssets system |
+| `CleanLogin` | Removes built Login assets on `dotnet clean` |

 ### Build Conditions

@@ -113,7 +113,7 @@
    <Exec Command="npm i --no-fund --no-audit" WorkingDirectory="$(LoginProjectDirectory)" />
  </Target>

-  <Target Name="BuildLogin" DependsOnTargets="RestoreLogin">
+  <Target Name="BuildLogin" DependsOnTargets="RestoreLogin;RestoreBackoffice">
    <Message Importance="high" Text="Executing Login NPM build script..." />
    <Exec Command="npm run build" WorkingDirectory="$(LoginProjectDirectory)" />
    <ItemGroup>
@@ -21,7 +21,7 @@
    var backOfficeAssetsPath = BackOfficePathGenerator.BackOfficeAssetsPath;
    var loginLogoImageAlternative = Url.RouteUrl(BackOfficeGraphicsController.LoginLogoAlternativeRouteName, new {Version= "1"});
 }<!doctype html>
-<html lang="@GlobalSettings.Value.DefaultUILanguage">
+<html lang="en">

 <head>
    <meta charset="UTF-8" />
@@ -61,7 +61,7 @@
        <p>Here are the <a href="https://www.enable-javascript.com/" target="_blank" rel="noopener" style="text-decoration: underline;">instructions how to enable JavaScript in your web browser</a>.</p>
    </div>
 </noscript>
-<umb-app @(SecuritySettings.Value.KeepUserLoggedIn ? "keep-user-logged-in" : "")></umb-app>
+<umb-app lang="@GlobalSettings.Value.DefaultUILanguage" @(SecuritySettings.Value.KeepUserLoggedIn ? "keep-user-logged-in" : "")></umb-app>

@if (isDebug)
 {
@@ -35,7 +35,7 @@
 }

 <!DOCTYPE html>
-<html lang="@GlobalSettings.Value.DefaultUILanguage">
+<html lang="en">
 <head>
    <meta charset="UTF-8"/>
    <base href="@backOfficePath.EnsureEndsWith('/')" />
@@ -83,6 +83,7 @@
 </noscript>

 <umb-auth
+    lang="@GlobalSettings.Value.DefaultUILanguage"
    return-url="@backOfficePath"
    logo-image="@loginLogoImage"
    logo-image-alternative="@loginLogoImageAlternative"
@@ -16,21 +16,16 @@
  </ItemGroup>

  <!--
-    The Razor editor in VS2026 and the C# extension for VS Code uses the Razor source generator
+    The Razor editor in modern Visual Studio and the C# extension for VS Code use the Razor source generator
    for IDE functionality. We need to add some things to make sure it works correctly, but we
    only do them for design time builds, so that we don't impact regular builds or CI.
-    We also have an escape hatch in case it does cause issues, users can set the appropriate property
+    We also have an escape hatch in case it does cause issues, users can set EnableCohostEditorCompatibility=false
    in their project file to disable this.
+
+    CompilerVisibleProperty is surfaced to generators via AnalyzerConfigOptionsProvider, not as a source-generator input file,
+    so it doesn't enter the hintName-collision codepath that AdditionalFiles does. Keeping it at evaluation time is safe.
  -->
  <ItemGroup Condition="'$(DesignTimeBuild)' == 'true' and '$(EnableCohostEditorCompatibility)' != 'false'">
-    <!-- 
-      We have to make sure the source generator can see the .cshtml files, so make them AdditionalFiles.
-    -->
-    <AdditionalFiles Include="**\*.cshtml" />
-
-    <!--
-      Make sure the source generator knows where the project is, so it can compute target paths.
-    -->
    <CompilerVisibleProperty Include="MSBuildProjectDirectory" />
  </ItemGroup>
 </Project>
@@ -49,4 +49,39 @@
      <ContentWithTargetPath Include="@(_UmbracoFolderFiles)" Exclude="@(ContentWithTargetPath)" TargetPath="%(Identity)" CopyToOutputDirectory="PreserveNewest" CopyToPublishDirectory="PreserveNewest" />
    </ItemGroup>
  </Target>
+
+  <!--
+    The Razor source generator needs .cshtml files in @(AdditionalFiles). The Razor SDK adds them
+    via @(RazorGenerate), but only inside a target that runs during the build — so during cohost
+    design-time builds they may not be present yet, which is what PR #21861 worked around.
+
+    Doing the include at evaluation time (as PR #21861 did) causes duplicates with the SDK during
+    dotnet watch / hot reload design-time builds: the SDK adds the same .cshtml under a different
+    item Identity (slash form / relative vs absolute) and the generator then sees two inputs that
+    derive the same hintName, which crashes it with CS8785 (see issue #22773).
+
+    Run as a target before CoreCompile (hot-reload path) and CompileDesignTime (IDE design-time path)
+    so the SDK's contribution is visible in both cases. Then add only the .cshtml files that are not already
+    present. Both sides are normalized to %(FullPath) so items with different Identity forms still compare equal.
+
+    Set EnableCohostEditorCompatibility=false in a project to opt out entirely.
+  -->
+  <Target Name="_UmbracoEnsureRazorAdditionalFilesForCohostEditor"
+          BeforeTargets="CoreCompile;CompileDesignTime"
+          Condition="'$(DesignTimeBuild)' == 'true' and '$(EnableCohostEditorCompatibility)' != 'false'">
+    <ItemGroup>
+      <_UmbracoCshtmlCandidate Include="**\*.cshtml" />
+      <_UmbracoCshtmlCandidateFull Include="@(_UmbracoCshtmlCandidate->'%(FullPath)')" />
+
+      <_UmbracoExistingAdditionalCshtmlFull
+        Include="@(AdditionalFiles->'%(FullPath)')"
+        Condition="'%(Extension)' == '.cshtml'" />
+
+      <_UmbracoCshtmlMissingFromAdditional
+        Include="@(_UmbracoCshtmlCandidateFull)"
+        Exclude="@(_UmbracoExistingAdditionalCshtmlFull)" />
+
+      <AdditionalFiles Include="@(_UmbracoCshtmlMissingFromAdditional)" />
+    </ItemGroup>
+  </Target>
 </Project>
@@ -0,0 +1,33 @@
+// Copyright (c) Umbraco.
+// See LICENSE for more details.
+
+namespace Umbraco.Cms.Core.Actions;
+
+/// <summary>
+///     This action is used as a security constraint that grants a user the ability to view element containers in a tree
+///     that has permissions applied to it.
+/// </summary>
+/// <remarks>
+///     This action should not be invoked. It is used as the minimum required permission to view element containers in the element tree.
+///     By granting a user this permission, the user is able to see the element container in the tree but not edit it.
+/// </remarks>
+public class ActionElementContainerBrowse : IAction
+{
+    /// <inheritdoc cref="IAction.ActionLetter" />
+    public const string ActionLetter = "Umb.ElementContainer.Read";
+
+    /// <inheritdoc cref="IAction.ActionAlias" />
+    public const string ActionAlias = "elementcontainerbrowse";
+
+    /// <inheritdoc/>
+    public string Letter => ActionLetter;
+
+    /// <inheritdoc/>
+    public string Alias => ActionAlias;
+
+    /// <inheritdoc />
+    public bool ShowInNotifier => false;
+
+    /// <inheritdoc />
+    public bool CanBePermissionAssigned => true;
+}
@@ -0,0 +1,28 @@
+// Copyright (c) Umbraco.
+// See LICENSE for more details.
+
+namespace Umbraco.Cms.Core.Actions;
+
+/// <summary>
+///     This action is used as a security constraint that grants a user the ability to delete element containers.
+/// </summary>
+public class ActionElementContainerDelete : IAction
+{
+    /// <inheritdoc cref="IAction.ActionLetter" />
+    public const string ActionLetter = "Umb.ElementContainer.Delete";
+
+    /// <inheritdoc cref="IAction.ActionAlias" />
+    public const string ActionAlias = "elementcontainerdelete";
+
+    /// <inheritdoc/>
+    public string Letter => ActionLetter;
+
+    /// <inheritdoc/>
+    public string Alias => ActionAlias;
+
+    /// <inheritdoc />
+    public bool ShowInNotifier => false;
+
+    /// <inheritdoc />
+    public bool CanBePermissionAssigned => true;
+}
@@ -0,0 +1,28 @@
+// Copyright (c) Umbraco.
+// See LICENSE for more details.
+
+namespace Umbraco.Cms.Core.Actions;
+
+/// <summary>
+///     This action is used as a security constraint that grants a user the ability to move element containers.
+/// </summary>
+public class ActionElementContainerMove : IAction
+{
+    /// <inheritdoc cref="IAction.ActionLetter" />
+    public const string ActionLetter = "Umb.ElementContainer.Move";
+
+    /// <inheritdoc cref="IAction.ActionAlias" />
+    public const string ActionAlias = "elementcontainermove";
+
+    /// <inheritdoc/>
+    public string Letter => ActionLetter;
+
+    /// <inheritdoc/>
+    public string Alias => ActionAlias;
+
+    /// <inheritdoc />
+    public bool ShowInNotifier => false;
+
+    /// <inheritdoc />
+    public bool CanBePermissionAssigned => true;
+}
@@ -0,0 +1,28 @@
+// Copyright (c) Umbraco.
+// See LICENSE for more details.
+
+namespace Umbraco.Cms.Core.Actions;
+
+/// <summary>
+///     This action is used as a security constraint that grants a user the ability to create new element containers.
+/// </summary>
+public class ActionElementContainerNew : IAction
+{
+    /// <inheritdoc cref="IAction.ActionLetter" />
+    public const string ActionLetter = "Umb.ElementContainer.Create";
+
+    /// <inheritdoc cref="IAction.ActionAlias" />
+    public const string ActionAlias = "elementcontainercreate";
+
+    /// <inheritdoc/>
+    public string Letter => ActionLetter;
+
+    /// <inheritdoc/>
+    public string Alias => ActionAlias;
+
+    /// <inheritdoc />
+    public bool ShowInNotifier => false;
+
+    /// <inheritdoc />
+    public bool CanBePermissionAssigned => true;
+}
@@ -0,0 +1,28 @@
+// Copyright (c) Umbraco.
+// See LICENSE for more details.
+
+namespace Umbraco.Cms.Core.Actions;
+
+/// <summary>
+///     This action is used as a security constraint that grants a user the ability to update element containers.
+/// </summary>
+public class ActionElementContainerUpdate : IAction
+{
+    /// <inheritdoc cref="IAction.ActionLetter" />
+    public const string ActionLetter = "Umb.ElementContainer.Update";
+
+    /// <inheritdoc cref="IAction.ActionAlias" />
+    public const string ActionAlias = "elementcontainerupdate";
+
+    /// <inheritdoc/>
+    public string Letter => ActionLetter;
+
+    /// <inheritdoc/>
+    public string Alias => ActionAlias;
+
+    /// <inheritdoc />
+    public bool ShowInNotifier => false;
+
+    /// <inheritdoc />
+    public bool CanBePermissionAssigned => true;
+}
@@ -21,7 +21,7 @@ public class ActionElementCopy : IAction
    public string Alias => ActionAlias;

    /// <inheritdoc />
-    public bool ShowInNotifier => true;
+    public bool ShowInNotifier => false;

    /// <inheritdoc />
    public bool CanBePermissionAssigned => true;
@@ -21,7 +21,7 @@ public class ActionElementDelete : IAction
    public string Alias => ActionAlias;

    /// <inheritdoc />
-    public bool ShowInNotifier => true;
+    public bool ShowInNotifier => false;

    /// <inheritdoc />
    public bool CanBePermissionAssigned => true;
@@ -21,7 +21,7 @@ public class ActionElementMove : IAction
    public string Alias => ActionAlias;

    /// <inheritdoc />
-    public bool ShowInNotifier => true;
+    public bool ShowInNotifier => false;

    /// <inheritdoc />
    public bool CanBePermissionAssigned => true;
@@ -21,7 +21,7 @@ public class ActionElementNew : IAction
    public string Alias => ActionAlias;

    /// <inheritdoc />
-    public bool ShowInNotifier => true;
+    public bool ShowInNotifier => false;

    /// <inheritdoc />
    public bool CanBePermissionAssigned => true;
@@ -21,7 +21,7 @@ public class ActionElementPublish : IAction
    public string Alias => ActionAlias;

    /// <inheritdoc />
-    public bool ShowInNotifier => true;
+    public bool ShowInNotifier => false;

    /// <inheritdoc />
    public bool CanBePermissionAssigned => true;
@@ -21,7 +21,7 @@ public class ActionElementRollback : IAction
    public string Alias => ActionAlias;

    /// <inheritdoc />
-    public bool ShowInNotifier => true;
+    public bool ShowInNotifier => false;

    /// <inheritdoc />
    public bool CanBePermissionAssigned => true;
@@ -21,7 +21,7 @@ public class ActionElementUpdate : IAction
    public string Alias => ActionAlias;

    /// <inheritdoc />
-    public bool ShowInNotifier => true;
+    public bool ShowInNotifier => false;

    /// <inheritdoc />
    public bool CanBePermissionAssigned => true;
@@ -306,6 +306,8 @@ public class MyEntityCacheRefresher : CacheRefresherBase<MyEntityCacheRefresher>
   - `Attempt.Succeed(value)` / `Attempt.Fail<T>()`
   - `Attempt<Content, ContentEditingOperationStatus>` - typed result with status

+> Writing or reviewing a query with a `WHERE IN` on a runtime-sized collection? See "Avoiding the SQL Server 2100-parameter limit" in `/src/Umbraco.Infrastructure/CLAUDE.md` — that's where the full helper list (`Constants.Sql.MaxParameterCount`, `InGroupsOf`, NPoco's `FetchByGroups`) and the decision rules live.
+
 ### Configuration

 Configuration models in `/Configuration/Models`:
@@ -467,6 +467,20 @@ public static class DistributedCacheExtensions

    #endregion

+    #region ElementContainerCacheRefresher
+
+    /// <summary>
+    ///     Invalidates the id/key map for the specified deleted element containers (folders).
+    /// </summary>
+    /// <param name="dc">The distributed cache.</param>
+    /// <param name="deletedContainers">The element containers that were deleted.</param>
+    public static void RemoveElementContainerCache(this DistributedCache dc, IEnumerable<EntityContainer> deletedContainers)
+        => dc.RefreshByPayload(
+            ElementContainerCacheRefresher.UniqueId,
+            deletedContainers.Select(container => new ElementContainerCacheRefresher.JsonPayload(container.Id, container.Key)));
+
+    #endregion
+
    #region Published Snapshot

    /// <summary>
--- a/Show More
+++ b/Show More