@umbraco-cms/backoffice 17.4.0-rc → 17.4.0-rc3

package/dist-cms/packages/block/block-list/components/block-list-entry/block-list-entry.element.js

@@ -158,7 +158,10 @@ let UmbBlockListEntryElement = class UmbBlockListEntryElement extends UmbLitElem
             this._workspaceEditSettingsPath = path;
             this.#updateBlockViewProps({ config: { ...this._blockViewProps.config, editSettingsPath: path } });
         }, null);
-        this.observe(this.#context.readOnlyGuard.permitted, (isReadOnly) => (this._isReadOnly = isReadOnly), 'umbReadOnlyObserver');
+        this.observe(this.#context.readOnlyGuard.permitted, (isReadOnly) => {
+            this._isReadOnly = isReadOnly;
+            this.#updateBlockViewProps({ readonly: isReadOnly });
+        }, 'umbReadOnlyObserver');
     }
     async #observeData() {
         this.observe(await this.#context.contentValues(), (content) => {
@@ -229,6 +232,7 @@ let UmbBlockListEntryElement = class UmbBlockListEntryElement extends UmbLitElem
 				.icon=${this._icon}
 				.index=${this._blockViewProps.index}
 				.unpublished=${!this._exposed}
+				.readOnly=${this._isReadOnly}
 				.config=${this._blockViewProps.config}
 				.content=${this._blockViewProps.content}
 				.settings=${this._blockViewProps.settings}
@@ -242,6 +246,7 @@ let UmbBlockListEntryElement = class UmbBlockListEntryElement extends UmbLitElem
 			.icon=${this._icon}
 			.index=${this._blockViewProps.index}
 			.unpublished=${!this._exposed}
+			.readOnly=${this._isReadOnly}
 			.config=${this._blockViewProps.config}
 			.content=${this._blockViewProps.content}
 			.settings=${this._blockViewProps.settings}
@@ -288,8 +293,6 @@ let UmbBlockListEntryElement = class UmbBlockListEntryElement extends UmbLitElem
 		`;
     }
     #renderEditContentAction() {
-        if (this._isReadOnly)
-            return nothing;
         return this._showContentEdit && this._workspaceEditContentPath
             ? html `<uui-button
 					label="edit"
@@ -312,8 +315,6 @@ let UmbBlockListEntryElement = class UmbBlockListEntryElement extends UmbLitElem
                 : nothing;
     }
     #renderEditSettingsAction() {
-        if (this._isReadOnly)
-            return nothing;
         return html `
 			${this._hasSettings && this._workspaceEditSettingsPath
             ? html `<uui-button
@@ -333,7 +334,11 @@ let UmbBlockListEntryElement = class UmbBlockListEntryElement extends UmbLitElem
     #renderDeleteAction() {
         if (this._isReadOnly)
             return nothing;
-        return html ` <uui-button label="delete" look="secondary" @click=${() => this.#context.requestDelete()} title=${this.localize.term('general_delete')}>
+        return html ` <uui-button
+			label="delete"
+			look="secondary"
+			@click=${() => this.#context.requestDelete()}
+			title=${this.localize.term('general_delete')}>
 			<uui-icon name="icon-remove"></uui-icon>
 		</uui-button>`;
     }

package/dist-cms/packages/block/block-rte/components/block-rte-entry/block-rte-entry.element.js

@@ -140,7 +140,10 @@ let UmbBlockRteEntryElement = class UmbBlockRteEntryElement extends UmbLitElemen
             this._workspaceEditSettingsPath = path;
             this.#updateBlockViewProps({ config: { ...this._blockViewProps.config, editSettingsPath: path } });
         }, null);
-        this.observe(this.#context.readOnlyGuard.permitted, (isReadOnly) => (this._isReadOnly = isReadOnly), 'umbReadOnlyObserver');
+        this.observe(this.#context.readOnlyGuard.permitted, (isReadOnly) => {
+            this._isReadOnly = isReadOnly;
+            this.#updateBlockViewProps({ readonly: isReadOnly });
+        }, 'umbReadOnlyObserver');
     }
     async #observeData() {
         this.observe(await this.#context.contentValues(), (content) => {
@@ -231,8 +234,6 @@ let UmbBlockRteEntryElement = class UmbBlockRteEntryElement extends UmbLitElemen
 			.config=${this._blockViewProps.config}></umb-ref-rte-block>`;
     }
     #renderEditAction() {
-        if (this._isReadOnly)
-            return nothing;
         return this._showContentEdit && this._workspaceEditContentPath
             ? html `<uui-button
 					label="edit"
@@ -254,8 +255,6 @@ let UmbBlockRteEntryElement = class UmbBlockRteEntryElement extends UmbLitElemen
                 : nothing;
     }
     #renderEditSettingsAction() {
-        if (this._isReadOnly)
-            return nothing;
         return html `
 			${this._hasSettings && this._workspaceEditSettingsPath
             ? html `<uui-button

package/dist-cms/packages/block/block-single/components/block-single-entry/block-single-entry.element.js

@@ -160,7 +160,10 @@ let UmbBlockSingleEntryElement = class UmbBlockSingleEntryElement extends UmbLit
             this._workspaceEditSettingsPath = path;
             this.#updateBlockViewProps({ config: { ...this._blockViewProps.config, editSettingsPath: path } });
         }, null);
-        this.observe(this.#context.readOnlyGuard.permitted, (isReadOnly) => (this._isReadOnly = isReadOnly), 'umbReadOnlyObserver');
+        this.observe(this.#context.readOnlyGuard.permitted, (isReadOnly) => {
+            this._isReadOnly = isReadOnly;
+            this.#updateBlockViewProps({ readonly: isReadOnly });
+        }, 'umbReadOnlyObserver');
     }
     async #observeData() {
         this.observe(await this.#context.contentValues(), (content) => {
@@ -280,8 +283,6 @@ let UmbBlockSingleEntryElement = class UmbBlockSingleEntryElement extends UmbLit
             : nothing;
     }
     #renderEditContentAction() {
-        if (this._isReadOnly)
-            return nothing;
         return this._showContentEdit && this._workspaceEditContentPath
             ? html `<uui-button
 					label="edit"
@@ -303,8 +304,6 @@ let UmbBlockSingleEntryElement = class UmbBlockSingleEntryElement extends UmbLit
                 : nothing;
     }
     #renderEditSettingsAction() {
-        if (this._isReadOnly)
-            return nothing;
         return html `
 			${this._hasSettings && this._workspaceEditSettingsPath
             ? html `<uui-button

package/dist-cms/packages/code-editor/umbraco-package.d.ts

@@ -1,3 +1,4 @@
+export declare const name = "Umbraco.CodeEditor";
 export declare const extensions: {
     name: string;
     alias: string;

package/dist-cms/packages/code-editor/umbraco-package.js

@@ -1,3 +1,4 @@
+export const name = 'Umbraco.CodeEditor';
 export const extensions = [
     {
         name: 'Umbraco Code Editor Bundle',

package/dist-cms/packages/content/content/global-components/content-workspace-property.element.js

@@ -29,7 +29,7 @@ let UmbContentWorkspacePropertyElement = class UmbContentWorkspacePropertyElemen
         });
         // The Content Workspace Context is used to retrieve the property type we like to observe.
         // This gives us the configuration from the property type as part of the data type.
-        this.consumeContext(UMB_CONTENT_WORKSPACE_CONTEXT, async (workspaceContext) => {
+        this.consumeContext(UMB_CONTENT_WORKSPACE_CONTEXT, (workspaceContext) => {
             this._workspaceContext = workspaceContext;
             this.#observePropertyType();
         });

package/dist-cms/packages/content/content/rollback/modal/content-rollback-modal.element.js

@@ -5,7 +5,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 import { diffWords } from '../../../../core/utils/index.js';
-import { css, customElement, html, nothing, repeat, state, unsafeHTML } from '../../../../../external/lit/index.js';
+import { css, customElement, html, nothing, repeat, state } from '../../../../../external/lit/index.js';
 import { UmbModalBaseElement } from '../../../../core/modal/index.js';
 import { UmbTextStyles } from '../../../../core/style/index.js';
 import { UmbUserItemRepository } from '../../../../user/user/index.js';
@@ -299,7 +299,7 @@ let UmbContentRollbackModalElement = class UmbContentRollbackModalElement extend
 					label=${this.localize.term('rollback_showDiff')}
 					@change=${this.#onToggleDiff}
 					.checked=${this._showDiff}></uui-toggle>
-				${this._showDiff ? html `<p>${unsafeHTML(this.localize.term('rollback_diffHelp'))}</p>` : nothing}
+				${this._showDiff ? html `<p>${this.localize.htmlString('#rollback_diffHelp')}</p>` : nothing}
 				<uui-table>
 					<uui-table-column style="width: 0"></uui-table-column>
 					<uui-table-column></uui-table-column>

package/dist-cms/packages/content/content-type/repository/structure/content-type-structure-server-data-source-base.d.ts

@@ -35,7 +35,7 @@ export declare abstract class UmbContentTypeStructureServerDataSourceBase<Server
         };
         error?: undefined;
     } | {
-        error: ((Error | import("../../../../core/resources/index.js").UmbApiError | import("../../../../core/resources/index.js").UmbCancelError | import("../../../../core/resources/index.js").UmbError) & (import("../../../../core/resources/index.js").UmbApiError | import("../../../../core/resources/index.js").UmbCancelError)) | undefined;
+        error: ((Error | import("../../../../core/resources/index.js").UmbError | import("../../../../core/resources/index.js").UmbCancelError | import("../../../../core/resources/index.js").UmbApiError) & (import("../../../../core/resources/index.js").UmbCancelError | import("../../../../core/resources/index.js").UmbApiError)) | undefined;
         data?: undefined;
     }>;
 }

package/dist-cms/packages/core/auth/auth.context.d.ts

@@ -5,7 +5,7 @@ import type { UmbControllerHost } from '../../../libs/controller-api/index.js';
 import { UmbContextBase } from '../../../libs/class-api/index.js';
 import type { Observable } from '../../../external/rxjs/index.js';
 import type { UmbBackofficeExtensionRegistry } from '../extension-registry/index.js';
-import type { umbHttpClient } from '../http-client/index.js';
+import type { UmbApiClient } from '../http-client/index.js';
 export interface UmbAuthSession {
     /** When the access token expires (issuedAt + expiresIn). Used to decide when to refresh. */
     accessTokenExpiresAt: number;
@@ -81,7 +81,6 @@ export declare class UmbAuthContext extends UmbContextBase {
      *   const token = await authContext.getLatestToken();
      *   const result = await fetch('https://my-api.com', { headers: { Authorization: `Bearer ${token}` } });
      * ```
-     * @deprecated Use {@link configureClient} for `@hey-api/openapi-ts` clients or {@link getOpenApiConfiguration} for manual fetch calls. With cookie-based auth this always returns `'[redacted]'`. Scheduled for removal in Umbraco 19.
      * @see {@link configureClient} for automatic token handling with `@hey-api/openapi-ts` clients.
      * @see {@link getOpenApiConfiguration} for manual fetch calls with cookie-based auth.
      * @memberof UmbAuthContext
@@ -159,18 +158,28 @@ export declare class UmbAuthContext extends UmbContextBase {
      */
     getOpenApiConfiguration(): UmbOpenApiConfiguration;
     /**
-     * Configures a `@hey-api/openapi-ts` client for authenticated API calls.
-     * Sets baseUrl, credentials, auth header, and binds the default response
-     * interceptors (401 retry, error handling, notifications).
+     * Configures a `@hey-api/openapi-ts` generated client for authenticated API calls.
+     *
+     * Sets `baseUrl`, `credentials`, and the `auth` callback (cookie-based with
+     * automatic token refresh via {@link getLatestToken}), and binds the default
+     * response interceptors (401 retry, problem-details error notifications, etc.)
+     * to the client.
+     *
+     * The same auth context owns a single {@link UmbApiInterceptorController} for
+     * the lifetime of the host (`<umb-app>`), so it's safe to call this method for
+     * multiple clients (the core's {@link umbHttpClient} *and* an extension's own
+     * generated client) without registering duplicate auth-signaler contexts.
+     *
      * @example
      * ```js
      * const authContext = await this.getContext(UMB_AUTH_CONTEXT);
      * authContext.configureClient(myClient);
      * // Now myClient automatically includes auth headers and interceptors
      * ```
-     * @param client A `@hey-api/openapi-ts` client instance.
+     * @param client A `@hey-api/openapi-ts` client instance — either {@link umbHttpClient}
+     * or one regenerated by an extension package against its own OpenAPI document.
      */
-    configureClient(client: typeof umbHttpClient): void;
+    configureClient(client: UmbApiClient): void;
     /**
      * Sets the auth context as initialized, which means that the auth context is ready to be used.
      * @remark This is used to let the app context know that the core module is ready, which means that the core auth providers are available.

package/dist-cms/packages/core/auth/auth.context.js

@@ -40,6 +40,11 @@ export class UmbAuthContext extends UmbContextBase {
     #authorizationSignal;
     // Track clients that have been configured to prevent duplicate interceptor binding
     #configuredClients;
+    // Lazily initialised on the first configureClient() call. Owns the singleton
+    // UmbAuthSignalerContext provided on the host (`<umb-app>`), so we MUST share
+    // one instance across every client we configure — instantiating a new controller
+    // per call would re-provide the signaler and stack listeners.
+    #interceptorController;
     // Endpoint URLs
     #linkEndpoint;
     #linkKeyEndpoint;
@@ -123,20 +128,26 @@ export class UmbAuthContext extends UmbContextBase {
         this.#channel.onmessage = (evt) => {
             switch (evt.data?.type) {
                 case 'authorized': {
-                    // Set session locally — do NOT call #updateSession which would re-broadcast
-                    const accessTokenExpiresAt = evt.data.issuedAt + evt.data.expiresIn;
-                    const expiresAt = evt.data.issuedAt + evt.data.expiresIn * TOKEN_EXPIRY_MULTIPLIER;
-                    this.#session.setValue({ accessTokenExpiresAt, expiresAt });
-                    this.#isAuthorized.setValue(true);
+                    // Apply locally — do NOT call #updateSession which would re-broadcast.
+                    this.#setSessionLocally(evt.data.expiresIn, evt.data.issuedAt);
                     this.#authorizationSignal.next();
                     break;
                 }
                 case 'sessionUpdate':
-                    this.#session.setValue({
-                        accessTokenExpiresAt: evt.data.accessTokenExpiresAt,
-                        expiresAt: evt.data.expiresAt,
-                    });
-                    this.#isAuthorized.setValue(true);
+                    // Peer broadcast already-computed timestamps, so set the session
+                    // directly. We still go through the `#inSessionUpdateCallback` guard
+                    // so observers triggered re-entrantly skip a redundant /token call.
+                    this.#inSessionUpdateCallback = true;
+                    try {
+                        this.#session.setValue({
+                            accessTokenExpiresAt: evt.data.accessTokenExpiresAt,
+                            expiresAt: evt.data.expiresAt,
+                        });
+                        this.#isAuthorized.setValue(true);
+                    }
+                    finally {
+                        this.#inSessionUpdateCallback = false;
+                    }
                     break;
                 case 'sessionCleared':
                     this.#session.setValue(undefined);
@@ -174,6 +185,9 @@ export class UmbAuthContext extends UmbContextBase {
         });
     }
     destroy() {
+        // Tear down any in-flight popup auth flow so its window-level message listener
+        // and the closed-poll interval don't leak past this context's lifetime.
+        this.#popupCleanup?.();
         super.destroy();
         this.#channel.close();
     }
@@ -222,30 +236,32 @@ export class UmbAuthContext extends UmbContextBase {
         };
         window.addEventListener('message', pkceHandler);
         // Wait for the popup to complete via BroadcastChannel.
-        // Resolves when authorized; also resolves (no-op) if the popup is closed/cancelled.
+        // The Promise resolves once cleanup runs — whether triggered by an `authorized`
+        // broadcast, the popup being closed/cancelled, a new auth flow superseding this
+        // one, or the auth context being destroyed. resolve() is parked inside cleanup
+        // so every termination path is observable to the awaiter.
         return new Promise((resolve) => {
             const cleanup = () => {
                 clearInterval(closedPoll);
                 this.#channel.removeEventListener('message', handler);
                 window.removeEventListener('message', pkceHandler);
                 this.#popupCleanup = undefined;
+                resolve();
             };
             this.#popupCleanup = cleanup;
             const handler = (evt) => {
                 if (evt.data?.type === 'authorized') {
-                    cleanup();
                     this.#client.clearPkceState();
                     this.#authWindowProxy?.close();
-                    resolve();
+                    cleanup();
                 }
             };
             this.#channel.addEventListener('message', handler);
             // Poll for popup closed (user cancelled or closed the window)
             const closedPoll = setInterval(() => {
                 if (this.#authWindowProxy?.closed) {
-                    cleanup();
                     this.#client.clearPkceState();
-                    resolve();
+                    cleanup();
                 }
             }, 500);
         });
@@ -262,28 +278,30 @@ export class UmbAuthContext extends UmbContextBase {
         if (!code) {
             return null;
         }
-        // Try to get PKCE state — first from the parent window (popup flow), then from sessionStorage (redirect flow)
+        // Try to get PKCE state. Check sessionStorage first — it's synchronous and covers
+        // the redirect flow (where the same tab navigated to the IDP and back). Only fall
+        // back to asking window.opener if sessionStorage didn't have a matching entry.
+        // The previous order hung for the full opener-postMessage timeout whenever
+        // `oauth_complete` happened to load with a non-OAuth window.opener (which is set
+        // for ANY window.open target, not only OAuth popups).
         let codeVerifier;
-        if (window.opener) {
-            // Popup flow: request code_verifier from parent via postMessage
-            codeVerifier = await this.#requestCodeVerifierFromOpener(state);
-        }
-        if (!codeVerifier) {
-            // Redirect flow: read from sessionStorage
-            const pkceData = sessionStorage.getItem('umb:pkce');
-            if (pkceData) {
-                try {
-                    const parsed = JSON.parse(pkceData);
-                    if (parsed.state === state) {
-                        codeVerifier = parsed.codeVerifier;
-                        sessionStorage.removeItem('umb:pkce');
-                    }
-                }
-                catch {
-                    // Ignore parse errors
+        const pkceData = sessionStorage.getItem('umb:pkce');
+        if (pkceData) {
+            try {
+                const parsed = JSON.parse(pkceData);
+                if (parsed.state === state) {
+                    codeVerifier = parsed.codeVerifier;
                     sessionStorage.removeItem('umb:pkce');
                 }
             }
+            catch {
+                // Ignore parse errors
+                sessionStorage.removeItem('umb:pkce');
+            }
+        }
+        if (!codeVerifier && window.opener) {
+            // Popup flow: request code_verifier from parent via postMessage.
+            codeVerifier = await this.#requestCodeVerifierFromOpener(state);
         }
         if (!codeVerifier) {
             console.error('[UmbAuthContext] No code_verifier available for authorization code exchange');
@@ -355,18 +373,12 @@ export class UmbAuthContext extends UmbContextBase {
      *   const token = await authContext.getLatestToken();
      *   const result = await fetch('https://my-api.com', { headers: { Authorization: `Bearer ${token}` } });
      * ```
-     * @deprecated Use {@link configureClient} for `@hey-api/openapi-ts` clients or {@link getOpenApiConfiguration} for manual fetch calls. With cookie-based auth this always returns `'[redacted]'`. Scheduled for removal in Umbraco 19.
      * @see {@link configureClient} for automatic token handling with `@hey-api/openapi-ts` clients.
      * @see {@link getOpenApiConfiguration} for manual fetch calls with cookie-based auth.
      * @memberof UmbAuthContext
      * @returns The latest token from the Management API
      */
     async getLatestToken() {
-        new UmbDeprecation({
-            deprecated: 'getLatestToken',
-            solution: 'Use configureClient for @hey-api/openapi-ts clients or getOpenApiConfiguration for manual fetch calls. With cookie-based auth this always returns "[redacted]".',
-            removeInVersion: '19.0.0',
-        }).warn();
         await this.#ensureTokenReady();
         return '[redacted]';
     }
@@ -455,14 +467,11 @@ export class UmbAuthContext extends UmbContextBase {
         }
         if (!navigator.locks)
             return;
-        const state = await navigator.locks.query();
-        if (state.held?.some((l) => l.name === 'umb:token-refresh')) {
-            // A refresh is in progress in another tab — queue behind it so we send
-            // requests with the new cookie rather than the soon-to-be-revoked one.
-            await navigator.locks.request('umb:token-refresh', async () => {
-                // No-op: we only need to wait for the ongoing refresh to finish.
-            });
-        }
+        // Always queue behind the refresh lock with a no-op callback. If the lock is
+        // free we acquire it immediately and resolve; if a peer tab holds it we wait
+        // behind that holder. This avoids a race window where querying the lock state
+        // could return "free" microseconds before another tab acquires it.
+        await navigator.locks.request('umb:token-refresh', () => Promise.resolve());
     }
     /**
      * Clears the in-memory session state.
@@ -540,20 +549,30 @@ export class UmbAuthContext extends UmbContextBase {
         return {
             base: this.#serverUrl,
             credentials: 'include',
-            token: () => Promise.resolve('[redacted]'),
+            token: this.getLatestToken.bind(this),
         };
     }
     /**
-     * Configures a `@hey-api/openapi-ts` client for authenticated API calls.
-     * Sets baseUrl, credentials, auth header, and binds the default response
-     * interceptors (401 retry, error handling, notifications).
+     * Configures a `@hey-api/openapi-ts` generated client for authenticated API calls.
+     *
+     * Sets `baseUrl`, `credentials`, and the `auth` callback (cookie-based with
+     * automatic token refresh via {@link getLatestToken}), and binds the default
+     * response interceptors (401 retry, problem-details error notifications, etc.)
+     * to the client.
+     *
+     * The same auth context owns a single {@link UmbApiInterceptorController} for
+     * the lifetime of the host (`<umb-app>`), so it's safe to call this method for
+     * multiple clients (the core's {@link umbHttpClient} *and* an extension's own
+     * generated client) without registering duplicate auth-signaler contexts.
+     *
      * @example
      * ```js
      * const authContext = await this.getContext(UMB_AUTH_CONTEXT);
      * authContext.configureClient(myClient);
      * // Now myClient automatically includes auth headers and interceptors
      * ```
-     * @param client A `@hey-api/openapi-ts` client instance.
+     * @param client A `@hey-api/openapi-ts` client instance — either {@link umbHttpClient}
+     * or one regenerated by an extension package against its own OpenAPI document.
      */
     configureClient(client) {
         if (this.#configuredClients.has(client))
@@ -562,15 +581,16 @@ export class UmbAuthContext extends UmbContextBase {
         client.setConfig({
             baseUrl: this.#serverUrl,
             credentials: 'include',
-            auth: async () => {
-                await this.#ensureTokenReady();
-                return '[redacted]';
-            },
+            auth: this.getLatestToken.bind(this),
         });
-        // Controller self-registers on the host element via UmbControllerBase constructor,
-        // so the anonymous reference is intentional — lifecycle is managed by the host.
-        // Note: _host must be a proper UmbControllerHost (element host) for correct cleanup.
-        new UmbApiInterceptorController(this._host).bindDefaultInterceptors(client);
+        // Lazy single instance — see #interceptorController field comment. Controller
+        // self-registers on the host element via UmbControllerBase, so its lifecycle is
+        // managed by the host. `_host` must be a proper UmbControllerHost.
+        this.#interceptorController ??= new UmbApiInterceptorController(this._host);
+        // Each generated client is structurally identical but TypeScript treats them as
+        // distinct generic instantiations. Cast at the boundary; the controller's own
+        // signature stays strictly typed against `umbHttpClient`.
+        this.#interceptorController.bindDefaultInterceptors(client);
     }
     /**
      * Sets the auth context as initialized, which means that the auth context is ready to be used.
@@ -631,13 +651,16 @@ export class UmbAuthContext extends UmbContextBase {
         const request = new Request(this.#unlinkEndpoint, {
             method: 'POST',
             credentials: 'include',
-            headers: { 'Content-Type': 'application/json', Authorization: 'Bearer [redacted]' },
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${await this.getLatestToken()}` },
             body: JSON.stringify({ loginProvider, providerKey }),
         });
         const result = await fetch(request);
         if (!result.ok) {
-            const error = await result.json();
-            throw error;
+            // Wrap the parsed body in a real Error so consumers using `instanceof Error`
+            // or expecting a stack trace get sane behaviour. The original problem-details
+            // payload is exposed on `.cause` for callers that want the structured fields.
+            const detail = await result.json().catch(() => undefined);
+            throw new Error(`Failed to unlink login (${result.status} ${result.statusText})`, { cause: detail });
         }
         await this.signOut();
         return true;
@@ -708,10 +731,13 @@ export class UmbAuthContext extends UmbContextBase {
                 resolve(undefined);
                 return;
             }
+            // Short timeout: a real OAuth popup parent responds within milliseconds. Any
+            // longer is just a hang for the unrelated-opener case (e.g. an arbitrary
+            // `window.open(...)` target that incidentally landed on `oauth_complete`).
             const timeout = setTimeout(() => {
                 window.removeEventListener('message', handler);
                 resolve(undefined);
-            }, 5000);
+            }, 1500);
             const handler = (evt) => {
                 if (evt.origin !== window.location.origin)
                     return;
@@ -730,7 +756,7 @@ export class UmbAuthContext extends UmbContextBase {
         const request = await fetch(`${this.#linkKeyEndpoint}?provider=${provider}`, {
             credentials: 'include',
             headers: {
-                Authorization: 'Bearer [redacted]',
+                Authorization: `Bearer ${await this.getLatestToken()}`,
                 'Content-Type': 'application/json',
             },
         });

package/dist-cms/packages/core/components/body-layout/body-layout.element.js

@@ -68,7 +68,9 @@ let UmbBodyLayoutElement = class UmbBodyLayoutElement extends LitElement {
             this._navigationSlotHasChildren
             ? ''
             : 'none'}">
-				${this.headline ? html `<h3 id="headline" title=${this.headline}>${this.headline}</h3>` : nothing}
+				${this.headline
+            ? html `<h3 id="headline" title=${this.headline} data-mark="layout-headline">${this.headline}</h3>`
+            : nothing}
 
 				<slot
 					id="header-slot"

package/dist-cms/packages/core/components/input-number-range/input-number-range.element.d.ts

@@ -1,6 +1,6 @@
 import { UmbLitElement } from '../../lit-element/index.js';
 import type { UmbNumberRangeValueType } from '../../models/index.js';
-declare const UmbInputNumberRangeElement_base: import("../../../../libs/extension-api/index.js").HTMLElementConstructor<import("../../validation/index.js").UmbFormControlMixinElement<FormDataEntryValue | FormData | undefined>> & typeof UmbLitElement;
+declare const UmbInputNumberRangeElement_base: import("../../../../libs/extension-api/index.js").HTMLElementConstructor<import("../../validation/index.js").UmbFormControlMixinElement<FormData | FormDataEntryValue | undefined>> & typeof UmbLitElement;
 export declare class UmbInputNumberRangeElement extends UmbInputNumberRangeElement_base {
     #private;
     minLabel: string;

package/dist-cms/packages/core/components/input-toggle/input-toggle.element.d.ts

@@ -1,5 +1,5 @@
 import { UmbLitElement } from '../../lit-element/index.js';
-declare const UmbInputToggleElement_base: import("../../../../libs/extension-api/index.js").HTMLElementConstructor<import("../../validation/index.js").UmbFormControlMixinElement<FormDataEntryValue | FormData>> & typeof UmbLitElement;
+declare const UmbInputToggleElement_base: import("../../../../libs/extension-api/index.js").HTMLElementConstructor<import("../../validation/index.js").UmbFormControlMixinElement<FormData | FormDataEntryValue>> & typeof UmbLitElement;
 export declare class UmbInputToggleElement extends UmbInputToggleElement_base {
     #private;
     /**

package/dist-cms/packages/core/components/multiple-color-picker-input/multiple-color-picker-input.element.d.ts

@@ -1,6 +1,6 @@
 import { UmbLitElement } from '../../lit-element/index.js';
 import type { UmbSwatchDetails } from '../../models/index.js';
-declare const UmbMultipleColorPickerInputElement_base: (new (...args: any[]) => import("@umbraco-ui/uui-base").UUIFormControlMixinElement<FormDataEntryValue | FormData>) & typeof UmbLitElement;
+declare const UmbMultipleColorPickerInputElement_base: (new (...args: any[]) => import("@umbraco-ui/uui-base").UUIFormControlMixinElement<FormData | FormDataEntryValue>) & typeof UmbLitElement;
 /**
  * @element umb-multiple-color-picker-input
  */

package/dist-cms/packages/core/components/multiple-color-picker-input/multiple-color-picker-item-input.element.d.ts

@@ -1,6 +1,6 @@
 import { UmbLitElement } from '../../lit-element/index.js';
 import type { UUIColorPickerElement, UUIInputElement } from '../../../../external/uui/index.js';
-declare const UmbMultipleColorPickerItemInputElement_base: (new (...args: any[]) => import("@umbraco-ui/uui-base").UUIFormControlMixinElement<FormDataEntryValue | FormData>) & typeof UmbLitElement;
+declare const UmbMultipleColorPickerItemInputElement_base: (new (...args: any[]) => import("@umbraco-ui/uui-base").UUIFormControlMixinElement<FormData | FormDataEntryValue>) & typeof UmbLitElement;
 /**
  * @element umb-multiple-color-picker-item-input
  */

package/dist-cms/packages/core/components/multiple-text-string-input/input-multiple-text-string-item.element.d.ts

@@ -1,6 +1,6 @@
 import { UmbLitElement } from '../../lit-element/index.js';
 import type { UUIInputElement } from '../../../../external/uui/index.js';
-declare const UmbInputMultipleTextStringItemElement_base: (new (...args: any[]) => import("@umbraco-ui/uui-base").UUIFormControlMixinElement<FormDataEntryValue | FormData>) & typeof UmbLitElement;
+declare const UmbInputMultipleTextStringItemElement_base: (new (...args: any[]) => import("@umbraco-ui/uui-base").UUIFormControlMixinElement<FormData | FormDataEntryValue>) & typeof UmbLitElement;
 /**
  * @element umb-input-multiple-text-string-item
  */

package/dist-cms/packages/core/culture/components/input-culture-select/input-culture-select.element.d.ts

@@ -1,5 +1,5 @@
 import { UmbLitElement } from '../../../lit-element/index.js';
-declare const UmbInputCultureSelectElement_base: (new (...args: any[]) => import("@umbraco-ui/uui-base").UUIFormControlMixinElement<FormDataEntryValue | FormData>) & typeof UmbLitElement;
+declare const UmbInputCultureSelectElement_base: (new (...args: any[]) => import("@umbraco-ui/uui-base").UUIFormControlMixinElement<FormData | FormDataEntryValue>) & typeof UmbLitElement;
 export declare class UmbInputCultureSelectElement extends UmbInputCultureSelectElement_base {
     #private;
     /**