@umbraco-cms/mcp-dev 17.4.0 → 17.4.1

package/dist/{chunk-6NEKTCPS.js → chunk-XVBYRUFE.js}

@@ -3002,28 +3002,28 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const getPartialViewByPath = (path4, options) => {
+  const getPartialViewByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/partial-view/${path4}`,
+        url: `/umbraco/management/api/v1/partial-view/${path3}`,
         method: "GET"
       },
       options
     );
   };
-  const deletePartialViewByPath = (path4, options) => {
+  const deletePartialViewByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/partial-view/${path4}`,
+        url: `/umbraco/management/api/v1/partial-view/${path3}`,
         method: "DELETE"
       },
       options
     );
   };
-  const putPartialViewByPath = (path4, updatePartialViewRequestModel, options) => {
+  const putPartialViewByPath = (path3, updatePartialViewRequestModel, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/partial-view/${path4}`,
+        url: `/umbraco/management/api/v1/partial-view/${path3}`,
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         data: updatePartialViewRequestModel
@@ -3031,10 +3031,10 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const putPartialViewByPathRename = (path4, renamePartialViewRequestModel, options) => {
+  const putPartialViewByPathRename = (path3, renamePartialViewRequestModel, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/partial-view/${path4}/rename`,
+        url: `/umbraco/management/api/v1/partial-view/${path3}/rename`,
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         data: renamePartialViewRequestModel
@@ -3053,19 +3053,19 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const getPartialViewFolderByPath = (path4, options) => {
+  const getPartialViewFolderByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/partial-view/folder/${path4}`,
+        url: `/umbraco/management/api/v1/partial-view/folder/${path3}`,
         method: "GET"
       },
       options
     );
   };
-  const deletePartialViewFolderByPath = (path4, options) => {
+  const deletePartialViewFolderByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/partial-view/folder/${path4}`,
+        url: `/umbraco/management/api/v1/partial-view/folder/${path3}`,
         method: "DELETE"
       },
       options
@@ -3313,28 +3313,28 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const getScriptByPath = (path4, options) => {
+  const getScriptByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/script/${path4}`,
+        url: `/umbraco/management/api/v1/script/${path3}`,
         method: "GET"
       },
       options
     );
   };
-  const deleteScriptByPath = (path4, options) => {
+  const deleteScriptByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/script/${path4}`,
+        url: `/umbraco/management/api/v1/script/${path3}`,
         method: "DELETE"
       },
       options
     );
   };
-  const putScriptByPath = (path4, updateScriptRequestModel, options) => {
+  const putScriptByPath = (path3, updateScriptRequestModel, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/script/${path4}`,
+        url: `/umbraco/management/api/v1/script/${path3}`,
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         data: updateScriptRequestModel
@@ -3342,10 +3342,10 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const putScriptByPathRename = (path4, renameScriptRequestModel, options) => {
+  const putScriptByPathRename = (path3, renameScriptRequestModel, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/script/${path4}/rename`,
+        url: `/umbraco/management/api/v1/script/${path3}/rename`,
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         data: renameScriptRequestModel
@@ -3364,19 +3364,19 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const getScriptFolderByPath = (path4, options) => {
+  const getScriptFolderByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/script/folder/${path4}`,
+        url: `/umbraco/management/api/v1/script/folder/${path3}`,
         method: "GET"
       },
       options
     );
   };
-  const deleteScriptFolderByPath = (path4, options) => {
+  const deleteScriptFolderByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/script/folder/${path4}`,
+        url: `/umbraco/management/api/v1/script/folder/${path3}`,
         method: "DELETE"
       },
       options
@@ -3600,28 +3600,28 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const getStylesheetByPath = (path4, options) => {
+  const getStylesheetByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/stylesheet/${path4}`,
+        url: `/umbraco/management/api/v1/stylesheet/${path3}`,
         method: "GET"
       },
       options
     );
   };
-  const deleteStylesheetByPath = (path4, options) => {
+  const deleteStylesheetByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/stylesheet/${path4}`,
+        url: `/umbraco/management/api/v1/stylesheet/${path3}`,
         method: "DELETE"
       },
       options
     );
   };
-  const putStylesheetByPath = (path4, updateStylesheetRequestModel, options) => {
+  const putStylesheetByPath = (path3, updateStylesheetRequestModel, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/stylesheet/${path4}`,
+        url: `/umbraco/management/api/v1/stylesheet/${path3}`,
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         data: updateStylesheetRequestModel
@@ -3629,10 +3629,10 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const putStylesheetByPathRename = (path4, renameStylesheetRequestModel, options) => {
+  const putStylesheetByPathRename = (path3, renameStylesheetRequestModel, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/stylesheet/${path4}/rename`,
+        url: `/umbraco/management/api/v1/stylesheet/${path3}/rename`,
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         data: renameStylesheetRequestModel
@@ -3651,19 +3651,19 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const getStylesheetFolderByPath = (path4, options) => {
+  const getStylesheetFolderByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/stylesheet/folder/${path4}`,
+        url: `/umbraco/management/api/v1/stylesheet/folder/${path3}`,
         method: "GET"
       },
       options
     );
   };
-  const deleteStylesheetFolderByPath = (path4, options) => {
+  const deleteStylesheetFolderByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/stylesheet/folder/${path4}`,
+        url: `/umbraco/management/api/v1/stylesheet/folder/${path3}`,
         method: "DELETE"
       },
       options
@@ -4546,21 +4546,47 @@ var getUmbracoManagementAPI = () => {
 
 // src/umb-management-api/api/temporary-file/index.ts
 import { UmbracoManagementClient as UmbracoManagementClient2 } from "@umbraco-cms/mcp-server-sdk";
-import FormData from "form-data";
+async function readStreamToBuffer(stream) {
+  const chunks = [];
+  for await (const chunk of stream) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks);
+}
 var getTemporaryFileAPI = () => ({
-  postTemporaryFile: (postTemporaryFileBody2, options) => {
+  postTemporaryFile: async (postTemporaryFileBody2, options) => {
     const formData = new FormData();
     formData.append("Id", postTemporaryFileBody2.Id);
-    formData.append("File", postTemporaryFileBody2.File);
-    const headers = {
-      ...formData.getHeaders(),
-      ...options?.headers
-    };
+    const file = postTemporaryFileBody2.File;
+    console.log("[temp-file] incoming file:", {
+      typeofFile: typeof file,
+      isBuffer: Buffer.isBuffer(file),
+      ctorName: file?.constructor?.name,
+      hasByteLength: typeof file?.byteLength,
+      hasLength: typeof file?.length,
+      keys: file ? Object.keys(file).slice(0, 10) : []
+    });
+    const buffer = Buffer.isBuffer(file) ? file : await readStreamToBuffer(file);
+    console.log("[temp-file] buffer:", { length: buffer.byteLength });
+    const bytes = new Uint8Array(buffer.byteLength);
+    bytes.set(buffer);
+    const blob = new Blob([bytes]);
+    console.log("[temp-file] blob:", { size: blob.size, type: blob.type, fileName: postTemporaryFileBody2.FileName });
+    formData.append("File", blob, postTemporaryFileBody2.FileName);
+    const entries = [];
+    for (const [k, v] of formData.entries()) {
+      entries.push({
+        name: k,
+        valueKind: typeof v === "string" ? "string" : v?.constructor?.name ?? typeof v,
+        valueSize: typeof v === "string" ? v.length : v?.size ?? void 0
+      });
+    }
+    console.log("[temp-file] formData entries:", entries);
     return UmbracoManagementClient2(
       {
         url: `/umbraco/management/api/v1/temporary-file`,
         method: "POST",
-        headers,
+        headers: options?.headers,
         data: formData
       },
       options
@@ -4610,6 +4636,13 @@ var UmbracoManagementClient3 = class {
 
 // src/umb-management-api/runtime-context.ts
 var umbracoVersion = null;
+var allowFilePathUploads = false;
+function setAllowFilePathUploads(allow) {
+  allowFilePathUploads = allow;
+}
+function isFilePathUploadAllowed() {
+  return allowFilePathUploads;
+}
 function setUmbracoVersion(version) {
   umbracoVersion = version ?? null;
 }
@@ -15675,13 +15708,13 @@ function isBlockStructure(value) {
   }
   return Array.isArray(value.contentData) && Array.isArray(value.settingsData);
 }
-function discoverAllBlockArrays(value, path4 = "root") {
+function discoverAllBlockArrays(value, path3 = "root") {
   const results = [];
   if (!value || typeof value !== "object") {
     return results;
   }
   if (isRichTextValue(value)) {
-    const nestedResults = discoverAllBlockArrays(value.blocks, `${path4}.blocks`);
+    const nestedResults = discoverAllBlockArrays(value.blocks, `${path3}.blocks`);
     results.push(...nestedResults);
     return results;
   }
@@ -15689,12 +15722,12 @@ function discoverAllBlockArrays(value, path4 = "root") {
     results.push({
       contentData: value.contentData,
       settingsData: value.settingsData,
-      path: path4
+      path: path3
     });
     value.contentData.forEach((block, index) => {
       if (block.values && Array.isArray(block.values)) {
         block.values.forEach((prop, propIndex) => {
-          const propPath = `${path4}.contentData[${index}].values[${propIndex}](${prop.alias})`;
+          const propPath = `${path3}.contentData[${index}].values[${propIndex}](${prop.alias})`;
           if (isRichTextValue(prop.value)) {
             const nestedResults = discoverAllBlockArrays(prop.value.blocks, `${propPath}.blocks`);
             results.push(...nestedResults);
@@ -15708,7 +15741,7 @@ function discoverAllBlockArrays(value, path4 = "root") {
     value.settingsData.forEach((block, index) => {
       if (block.values && Array.isArray(block.values)) {
         block.values.forEach((prop, propIndex) => {
-          const propPath = `${path4}.settingsData[${index}].values[${propIndex}](${prop.alias})`;
+          const propPath = `${path3}.settingsData[${index}].values[${propIndex}](${prop.alias})`;
           if (isRichTextValue(prop.value)) {
             const nestedResults = discoverAllBlockArrays(prop.value.blocks, `${propPath}.blocks`);
             results.push(...nestedResults);
@@ -18659,16 +18692,14 @@ import { v4 as uuidv46 } from "uuid";
 
 // src/umb-management-api/tools/media/post/helpers/media-upload-helpers.ts
 import * as fs2 from "fs";
-import * as os from "os";
 import * as path2 from "path";
 import mime from "mime-types";
 
 // src/umb-management-api/tools/media/post/helpers/validate-file-path.ts
 import * as path from "path";
 import * as fs from "fs";
-import { getServerConfig } from "@umbraco-cms/mcp-server-sdk";
 async function validateFilePath(filePath, allowedPaths) {
-  const allowedMediaPaths = allowedPaths ?? (await getServerConfig(true)).config.allowedMediaPaths;
+  const allowedMediaPaths = allowedPaths ?? (process.env.UMBRACO_ALLOWED_MEDIA_PATHS ? process.env.UMBRACO_ALLOWED_MEDIA_PATHS.split(",").map((p) => p.trim()).filter(Boolean) : void 0);
   if (!allowedMediaPaths || allowedMediaPaths.length === 0) {
     throw new Error(
       'File path uploads are disabled. To enable, set UMBRACO_ALLOWED_MEDIA_PATHS environment variable with comma-separated allowed directory paths (e.g., UMBRACO_ALLOWED_MEDIA_PATHS="/tmp/uploads,/var/media")'
@@ -18676,8 +18707,13 @@ async function validateFilePath(filePath, allowedPaths) {
   }
   const normalizedPath = path.resolve(filePath);
   const isAllowed = allowedMediaPaths.some((allowedPath) => {
-    const realAllowedPath = fs.realpathSync(allowedPath);
-    return normalizedPath.startsWith(allowedPath) || normalizedPath.startsWith(realAllowedPath);
+    if (normalizedPath.startsWith(allowedPath)) return true;
+    try {
+      const realAllowedPath = fs.realpathSync(allowedPath);
+      return normalizedPath.startsWith(realAllowedPath);
+    } catch {
+      return false;
+    }
   });
   if (!isAllowed) {
     throw new Error(
@@ -18689,8 +18725,13 @@ async function validateFilePath(filePath, allowedPaths) {
     if (stats.isSymbolicLink()) {
       const realPath = fs.realpathSync(normalizedPath);
       const symlinkAllowed = allowedMediaPaths.some((allowedPath) => {
-        const realAllowedPath = fs.realpathSync(allowedPath);
-        return realPath.startsWith(allowedPath) || realPath.startsWith(realAllowedPath);
+        if (realPath.startsWith(allowedPath)) return true;
+        try {
+          const realAllowedPath = fs.realpathSync(allowedPath);
+          return realPath.startsWith(realAllowedPath);
+        } catch {
+          return false;
+        }
       });
       if (!symlinkAllowed) {
         throw new Error(
@@ -18777,18 +18818,25 @@ function buildValueStructure(mediaTypeName, temporaryFileId) {
     value: { temporaryFileId }
   };
 }
-async function createFileStream(sourceType, filePath, fileUrl, fileAsBase64, fileName) {
-  let tempFilePath = null;
-  let readStream;
+async function createFilePayload(sourceType, filePath, fileUrl, fileAsBase64, fileName) {
   switch (sourceType) {
-    case "filePath":
+    case "filePath": {
       if (!filePath) {
         throw new Error("filePath is required when sourceType is 'filePath'");
       }
+      if (typeof fs2.createReadStream !== "function") {
+        throw new Error(
+          "filePath source is not supported in this runtime (no filesystem). Use sourceType 'url' or 'base64' instead."
+        );
+      }
       const validatedPath = await validateFilePath(filePath);
-      readStream = fs2.createReadStream(validatedPath);
-      break;
-    case "url":
+      const filename = fileName.includes(".") ? fileName : path2.basename(validatedPath);
+      return {
+        data: fs2.createReadStream(validatedPath),
+        filename
+      };
+    }
+    case "url": {
       if (!fileUrl) {
         throw new Error("fileUrl is required when sourceType is 'url'");
       }
@@ -18804,123 +18852,110 @@ async function createFileStream(sourceType, filePath, fileUrl, fileAsBase64, fil
         if (response.status >= 400) {
           throw new Error(`Failed to fetch file from URL: HTTP ${response.status} ${response.statusText}`);
         }
-        const arrayBuffer = await response.arrayBuffer();
-        let fileNameWithExtension2 = fileName;
+        const buffer = Buffer.from(await response.arrayBuffer());
+        let filename = fileName;
         if (!fileName.includes(".")) {
           const urlPath = new URL(fileUrl).pathname;
           const urlExtension = path2.extname(urlPath);
           if (urlExtension) {
-            fileNameWithExtension2 = `${fileName}${urlExtension}`;
+            filename = `${fileName}${urlExtension}`;
           } else {
             const contentType = response.headers.get("content-type") ?? void 0;
             const extensionFromMime = getExtensionFromMimeType(contentType);
-            if (extensionFromMime) {
-              fileNameWithExtension2 = `${fileName}${extensionFromMime}`;
-            } else {
-              fileNameWithExtension2 = `${fileName}.bin`;
-            }
+            filename = extensionFromMime ? `${fileName}${extensionFromMime}` : `${fileName}.bin`;
           }
         }
-        tempFilePath = path2.join(os.tmpdir(), fileNameWithExtension2);
-        fs2.writeFileSync(tempFilePath, Buffer.from(arrayBuffer));
-        readStream = fs2.createReadStream(tempFilePath);
+        return { data: buffer, filename };
       } catch (error) {
         if (error.name === "AbortError") {
           throw new Error(`Request timeout after 30s fetching URL: ${fileUrl}`);
         }
         throw new Error(`Failed to fetch URL: ${fileUrl} - ${error.message}`);
       }
-      break;
-    case "base64":
+    }
+    case "base64": {
       if (!fileAsBase64) {
         throw new Error("fileAsBase64 is required when sourceType is 'base64'");
       }
-      const fileContent = Buffer.from(fileAsBase64, "base64");
-      let fileNameWithExtension = fileName;
+      const buffer = Buffer.from(fileAsBase64, "base64");
+      let filename = fileName;
       if (!fileName.includes(".")) {
-        const extension = detectFileExtensionFromBuffer(fileContent);
-        fileNameWithExtension = `${fileName}${extension}`;
+        const extension = detectFileExtensionFromBuffer(buffer);
+        filename = `${fileName}${extension}`;
       }
-      tempFilePath = path2.join(os.tmpdir(), fileNameWithExtension);
-      fs2.writeFileSync(tempFilePath, fileContent);
-      readStream = fs2.createReadStream(tempFilePath);
-      break;
-  }
-  return { readStream, tempFilePath };
-}
-function cleanupTempFile(tempFilePath) {
-  if (tempFilePath && fs2.existsSync(tempFilePath)) {
-    try {
-      fs2.unlinkSync(tempFilePath);
-    } catch (e) {
-      console.error("Failed to cleanup temp file:", e);
+      return { data: buffer, filename };
     }
   }
 }
 async function uploadMediaFile(client, params) {
-  let tempFilePath = null;
+  const validatedMediaTypeName = validateMediaTypeForSvg(
+    params.filePath,
+    params.fileUrl,
+    params.name,
+    params.mediaTypeName
+  );
+  const mediaTypeId = await fetchMediaTypeId(client, validatedMediaTypeName);
+  const { data, filename } = await createFilePayload(
+    params.sourceType,
+    params.filePath,
+    params.fileUrl,
+    params.fileAsBase64,
+    params.name
+  );
   try {
-    const validatedMediaTypeName = validateMediaTypeForSvg(
-      params.filePath,
-      params.fileUrl,
-      params.name,
-      params.mediaTypeName
-    );
-    const mediaTypeId = await fetchMediaTypeId(client, validatedMediaTypeName);
-    const { readStream, tempFilePath: createdTempPath } = await createFileStream(
-      params.sourceType,
-      params.filePath,
-      params.fileUrl,
-      params.fileAsBase64,
-      params.name
-    );
-    tempFilePath = createdTempPath;
-    try {
-      await client.postTemporaryFile({
-        Id: params.temporaryFileId,
-        File: readStream
-      });
-    } catch (error) {
-      const err = error;
-      const errorData = err.response?.data ? typeof err.response.data === "string" ? err.response.data : JSON.stringify(err.response.data) : err.message;
-      throw new Error(`Failed to upload temporary file: ${err.response?.status || "Unknown error"} - ${errorData}`);
-    }
-    const valueStructure = buildValueStructure(validatedMediaTypeName, params.temporaryFileId);
-    let response;
-    try {
-      response = await client.postMedia({
-        mediaType: { id: mediaTypeId },
-        variants: [
-          {
-            culture: null,
-            segment: null,
-            name: params.name
-            // Use original name provided by user
-          }
-        ],
-        values: [valueStructure],
-        parent: params.parentId ? { id: params.parentId } : null
-      }, CAPTURE_RAW_HTTP_RESPONSE146);
-    } catch (error) {
-      const err = error;
-      throw new Error(`Failed to create media item: ${err.response?.status || "Unknown error"} - ${JSON.stringify(err.response?.data) || err.message}`);
-    }
-    if (response.status < 200 || response.status >= 300) {
-      throw new Error(`Request failed with status code ${response.status}`);
-    }
-    const locationHeader = response.headers?.location || response.headers?.Location;
-    if (!locationHeader) {
-      throw new Error("No Location header in response - cannot determine created media ID");
-    }
-    const idMatch = locationHeader.match(/\/([a-f0-9-]{36})$/i);
-    if (!idMatch) {
-      throw new Error(`Could not extract ID from Location header: ${locationHeader}`);
-    }
-    const mediaId = idMatch[1];
-    return { name: params.name, id: mediaId };
-  } finally {
-    cleanupTempFile(tempFilePath);
+    await client.postTemporaryFile({
+      Id: params.temporaryFileId,
+      File: data,
+      FileName: filename
+    });
+  } catch (error) {
+    const err = error;
+    const errorData = err.response?.data ? typeof err.response.data === "string" ? err.response.data : JSON.stringify(err.response.data) : err.message;
+    throw new Error(`Failed to upload temporary file: ${err.response?.status || "Unknown error"} - ${errorData}`);
   }
+  const valueStructure = buildValueStructure(validatedMediaTypeName, params.temporaryFileId);
+  let response;
+  try {
+    response = await client.postMedia({
+      mediaType: { id: mediaTypeId },
+      variants: [
+        {
+          culture: null,
+          segment: null,
+          name: params.name
+          // Use original name provided by user
+        }
+      ],
+      values: [valueStructure],
+      parent: params.parentId ? { id: params.parentId } : null
+    }, CAPTURE_RAW_HTTP_RESPONSE146);
+  } catch (error) {
+    const err = error;
+    throw new Error(`Failed to create media item: ${err.response?.status || "Unknown error"} - ${JSON.stringify(err.response?.data) || err.message}`);
+  }
+  if (response.status < 200 || response.status >= 300) {
+    throw new Error(`Request failed with status code ${response.status}`);
+  }
+  const locationHeader = response.headers?.location || response.headers?.Location;
+  if (!locationHeader) {
+    throw new Error("No Location header in response - cannot determine created media ID");
+  }
+  const idMatch = locationHeader.match(/\/([a-f0-9-]{36})$/i);
+  if (!idMatch) {
+    throw new Error(`Could not extract ID from Location header: ${locationHeader}`);
+  }
+  const mediaId = idMatch[1];
+  return { name: params.name, id: mediaId };
+}
+
+// src/umb-management-api/tools/media/post/helpers/source-type-helpers.ts
+var FILE_PATH_ENTRY = `filePath - Most efficient for local files, works with any size
+     SECURITY: Requires UMBRACO_ALLOWED_MEDIA_PATHS environment variable
+     to be configured with comma-separated allowed directories.
+     Example: UMBRACO_ALLOWED_MEDIA_PATHS="/tmp/uploads,/var/media"`;
+function buildSourceTypeSection(allowFilePath, otherSources) {
+  const sources = allowFilePath ? [FILE_PATH_ENTRY, ...otherSources] : otherSources;
+  return sources.map((s, i) => `  ${i + 1}. ${s}`).join("\n");
 }
 
 // src/umb-management-api/tools/media/post/create-media.ts
@@ -18935,23 +18970,30 @@ import {
   MEDIA_TYPE_VIDEO,
   withStandardDecorators as withStandardDecorators160
 } from "@umbraco-cms/mcp-server-sdk";
-var createMediaSchema = z71.object({
-  sourceType: z71.enum(["filePath", "url", "base64"]).describe("Media source type: 'filePath' for local files (most efficient), 'url' for web files, 'base64' for embedded data (small files only)"),
-  name: z71.string().describe("The name of the media item"),
-  mediaTypeName: z71.string().describe(`Media type: '${MEDIA_TYPE_IMAGE2}', '${MEDIA_TYPE_ARTICLE}', '${MEDIA_TYPE_AUDIO}', '${MEDIA_TYPE_VIDEO}', '${MEDIA_TYPE_VECTOR_GRAPHICS2}', '${MEDIA_TYPE_FILE}', or custom media type name`),
-  filePath: z71.string().optional().describe("Absolute path to the file (required if sourceType is 'filePath')"),
-  fileUrl: z71.string().url().optional().describe("[raw] URL to fetch the file from (required if sourceType is 'url')"),
-  fileAsBase64: z71.string().optional().describe("Base64 encoded file data (required if sourceType is 'base64')"),
-  parentId: z71.string().uuid().optional().describe("Parent folder ID (defaults to root)")
-});
 var createMediaOutputSchema = z71.object({
   message: z71.string(),
   name: z71.string(),
   id: z71.string().guid()
 });
-var CreateMediaTool = {
-  name: "create-media",
-  description: `Upload any media file to Umbraco (images, documents, audio, video, SVG, or custom types).
+function createCreateMediaTool(options) {
+  const sourceTypeValues = options.allowFilePath ? ["filePath", "url", "base64"] : ["url", "base64"];
+  const sourceTypeDescription = options.allowFilePath ? "Media source type: 'filePath' for local files (most efficient), 'url' for web files, 'base64' for embedded data (small files only)" : "Media source type: 'url' for web files, 'base64' for embedded data (small files only)";
+  const schema = z71.object({
+    sourceType: z71.enum(sourceTypeValues).describe(sourceTypeDescription),
+    name: z71.string().describe("The name of the media item"),
+    mediaTypeName: z71.string().describe(`Media type: '${MEDIA_TYPE_IMAGE2}', '${MEDIA_TYPE_ARTICLE}', '${MEDIA_TYPE_AUDIO}', '${MEDIA_TYPE_VIDEO}', '${MEDIA_TYPE_VECTOR_GRAPHICS2}', '${MEDIA_TYPE_FILE}', or custom media type name`),
+    filePath: z71.string().optional().describe("Absolute path to the file (required if sourceType is 'filePath')"),
+    fileUrl: z71.string().url().optional().describe("[raw] URL to fetch the file from (required if sourceType is 'url')"),
+    fileAsBase64: z71.string().optional().describe("Base64 encoded file data (required if sourceType is 'base64')"),
+    parentId: z71.string().uuid().optional().describe("Parent folder ID (defaults to root)")
+  });
+  const filePathSection = buildSourceTypeSection(options.allowFilePath, [
+    "url - Fetch from web URL",
+    "base64 - Only for small files (<10KB) due to token usage"
+  ]);
+  const tool = {
+    name: "create-media",
+    description: `Upload any media file to Umbraco (images, documents, audio, video, SVG, or custom types).
 
   Media Types:
   - ${MEDIA_TYPE_IMAGE2}: jpg, png, gif, webp, etc. (supports cropping)
@@ -18963,48 +19005,45 @@ var CreateMediaTool = {
   - Custom: any custom media type created in Umbraco
 
   Source Types:
-  1. filePath - Most efficient for local files, works with any size
-     SECURITY: Requires UMBRACO_ALLOWED_MEDIA_PATHS environment variable
-     to be configured with comma-separated allowed directories.
-     Example: UMBRACO_ALLOWED_MEDIA_PATHS="/tmp/uploads,/var/media"
-  2. url - Fetch from web URL
-  3. base64 - Only for small files (<10KB) due to token usage
+${filePathSection}
 
   The tool automatically:
   - Creates temporary files
   - Detects and validates media types (auto-corrects SVG vs Image)
   - Configures correct property editors (ImageCropper vs UploadField)
   - Cleans up temporary files`,
-  inputSchema: createMediaSchema.shape,
-  outputSchema: createMediaOutputSchema.shape,
-  slices: ["create"],
-  handler: (async (model) => {
-    try {
-      const client = UmbracoManagementClient3.getClient();
-      const temporaryFileId = uuidv46();
-      const { name: actualName, id } = await uploadMediaFile(client, {
-        sourceType: model.sourceType,
-        name: model.name,
-        mediaTypeName: model.mediaTypeName,
-        filePath: model.filePath,
-        fileUrl: model.fileUrl,
-        fileAsBase64: model.fileAsBase64,
-        parentId: model.parentId,
-        temporaryFileId
-      });
-      return createToolResult20({
-        message: `Media "${actualName}" created successfully`,
-        name: actualName,
-        id
-      });
-    } catch (error) {
-      return createToolResultError10({
-        detail: `Error creating media: ${error.message}`
-      });
-    }
-  })
-};
-var create_media_default = withStandardDecorators160(CreateMediaTool);
+    inputSchema: schema.shape,
+    outputSchema: createMediaOutputSchema.shape,
+    slices: ["create"],
+    handler: (async (model) => {
+      try {
+        const client = UmbracoManagementClient3.getClient();
+        const temporaryFileId = uuidv46();
+        const { name: actualName, id } = await uploadMediaFile(client, {
+          sourceType: model.sourceType,
+          name: model.name,
+          mediaTypeName: model.mediaTypeName,
+          filePath: model.filePath,
+          fileUrl: model.fileUrl,
+          fileAsBase64: model.fileAsBase64,
+          parentId: model.parentId,
+          temporaryFileId
+        });
+        return createToolResult20({
+          message: `Media "${actualName}" created successfully`,
+          name: actualName,
+          id
+        });
+      } catch (error) {
+        return createToolResultError10({
+          detail: `Error creating media: ${error.message}`
+        });
+      }
+    })
+  };
+  return withStandardDecorators160(tool);
+}
+var create_media_default = createCreateMediaTool({ allowFilePath: true });
 
 // src/umb-management-api/tools/media/post/create-media-multiple.ts
 import { z as z72 } from "zod";
@@ -19020,16 +19059,6 @@ import {
   MEDIA_TYPE_VIDEO as MEDIA_TYPE_VIDEO2,
   withStandardDecorators as withStandardDecorators161
 } from "@umbraco-cms/mcp-server-sdk";
-var createMediaMultipleSchema = z72.object({
-  sourceType: z72.enum(["filePath", "url"]).describe("Media source type: 'filePath' for local files (most efficient), 'url' for web files. Base64 not supported for batch uploads due to token usage."),
-  files: z72.array(z72.object({
-    name: z72.string().describe("The name of the media item"),
-    filePath: z72.string().optional().describe("Absolute path to the file (required if sourceType is 'filePath')"),
-    fileUrl: z72.string().url().optional().describe("URL to fetch the file from (required if sourceType is 'url')"),
-    mediaTypeName: z72.string().optional().describe(`Optional override: '${MEDIA_TYPE_IMAGE3}', '${MEDIA_TYPE_ARTICLE2}', '${MEDIA_TYPE_AUDIO2}', '${MEDIA_TYPE_VIDEO2}', '${MEDIA_TYPE_VECTOR_GRAPHICS3}', '${MEDIA_TYPE_FILE2}', or custom media type name. If not specified, defaults to '${MEDIA_TYPE_FILE2}'`)
-  })).describe("Array of files to upload (maximum 20 files per batch)"),
-  parentId: z72.string().uuid().optional().describe("Parent folder ID (defaults to root)")
-});
 var createMediaMultipleOutputSchema = z72.object({
   summary: z72.string(),
   results: z72.array(z72.object({
@@ -19039,70 +19068,84 @@ var createMediaMultipleOutputSchema = z72.object({
     error: z72.string().optional()
   }))
 });
-var CreateMediaMultipleTool = {
-  name: "create-media-multiple",
-  description: `Batch upload multiple media files to Umbraco (maximum 20 files per batch).
+function createCreateMediaMultipleTool(options) {
+  const sourceTypeValues = options.allowFilePath ? ["filePath", "url"] : ["url"];
+  const sourceTypeDescription = options.allowFilePath ? "Media source type: 'filePath' for local files (most efficient), 'url' for web files. Base64 not supported for batch uploads due to token usage." : "Media source type: 'url' for web files. Base64 not supported for batch uploads due to token usage.";
+  const schema = z72.object({
+    sourceType: z72.enum(sourceTypeValues).describe(sourceTypeDescription),
+    files: z72.array(z72.object({
+      name: z72.string().describe("The name of the media item"),
+      filePath: z72.string().optional().describe("Absolute path to the file (required if sourceType is 'filePath')"),
+      fileUrl: z72.string().url().optional().describe("URL to fetch the file from (required if sourceType is 'url')"),
+      mediaTypeName: z72.string().optional().describe(`Optional override: '${MEDIA_TYPE_IMAGE3}', '${MEDIA_TYPE_ARTICLE2}', '${MEDIA_TYPE_AUDIO2}', '${MEDIA_TYPE_VIDEO2}', '${MEDIA_TYPE_VECTOR_GRAPHICS3}', '${MEDIA_TYPE_FILE2}', or custom media type name. If not specified, defaults to '${MEDIA_TYPE_FILE2}'`)
+    })).describe("Array of files to upload (maximum 20 files per batch)"),
+    parentId: z72.string().uuid().optional().describe("Parent folder ID (defaults to root)")
+  });
+  const filePathSection = buildSourceTypeSection(options.allowFilePath, [
+    "url - Fetch from web URL"
+  ]);
+  const tool = {
+    name: "create-media-multiple",
+    description: `Batch upload multiple media files to Umbraco (maximum 20 files per batch).
 
   Supports any file type: images, documents, audio, video, SVG, or custom types.
 
   Source Types:
-  1. filePath - Most efficient for local files, works with any size
-     SECURITY: Requires UMBRACO_ALLOWED_MEDIA_PATHS environment variable
-     to be configured with comma-separated allowed directories.
-     Example: UMBRACO_ALLOWED_MEDIA_PATHS="/tmp/uploads,/var/media"
-  2. url - Fetch from web URL
+${filePathSection}
 
   Note: base64 is not supported for batch uploads due to token usage.
 
   The tool processes files sequentially and returns detailed results for each file.
   If some files fail, others will continue processing (continue-on-error strategy).`,
-  inputSchema: createMediaMultipleSchema.shape,
-  outputSchema: createMediaMultipleOutputSchema.shape,
-  slices: ["create"],
-  handler: (async (model) => {
-    if (model.files.length > 20) {
-      return createToolResultError11({
-        detail: `Batch upload limited to 20 files per call. You provided ${model.files.length} files. Please split into multiple batches.`
-      });
-    }
-    const results = [];
-    const client = UmbracoManagementClient3.getClient();
-    for (const file of model.files) {
-      try {
-        const temporaryFileId = uuidv47();
-        const defaultMediaType = file.mediaTypeName || MEDIA_TYPE_FILE2;
-        const { name: actualName, id: mediaId } = await uploadMediaFile(client, {
-          sourceType: model.sourceType,
-          name: file.name,
-          mediaTypeName: defaultMediaType,
-          filePath: file.filePath,
-          fileUrl: file.fileUrl,
-          fileAsBase64: void 0,
-          parentId: model.parentId,
-          temporaryFileId
-        });
-        results.push({
-          success: true,
-          name: actualName,
-          id: mediaId
-        });
-      } catch (error) {
-        results.push({
-          success: false,
-          name: file.name,
-          error: error.message
+    inputSchema: schema.shape,
+    outputSchema: createMediaMultipleOutputSchema.shape,
+    slices: ["create"],
+    handler: (async (model) => {
+      if (model.files.length > 20) {
+        return createToolResultError11({
+          detail: `Batch upload limited to 20 files per call. You provided ${model.files.length} files. Please split into multiple batches.`
         });
       }
-    }
-    const successCount = results.filter((r) => r.success).length;
-    const failureCount = results.filter((r) => !r.success).length;
-    return createToolResult21({
-      summary: `Processed ${model.files.length} files: ${successCount} succeeded, ${failureCount} failed`,
-      results
-    });
-  })
-};
-var create_media_multiple_default = withStandardDecorators161(CreateMediaMultipleTool);
+      const results = [];
+      const client = UmbracoManagementClient3.getClient();
+      for (const file of model.files) {
+        try {
+          const temporaryFileId = uuidv47();
+          const defaultMediaType = file.mediaTypeName || MEDIA_TYPE_FILE2;
+          const { name: actualName, id: mediaId } = await uploadMediaFile(client, {
+            sourceType: model.sourceType,
+            name: file.name,
+            mediaTypeName: defaultMediaType,
+            filePath: file.filePath,
+            fileUrl: file.fileUrl,
+            fileAsBase64: void 0,
+            parentId: model.parentId,
+            temporaryFileId
+          });
+          results.push({
+            success: true,
+            name: actualName,
+            id: mediaId
+          });
+        } catch (error) {
+          results.push({
+            success: false,
+            name: file.name,
+            error: error.message
+          });
+        }
+      }
+      const successCount = results.filter((r) => r.success).length;
+      const failureCount = results.filter((r) => !r.success).length;
+      return createToolResult21({
+        summary: `Processed ${model.files.length} files: ${successCount} succeeded, ${failureCount} failed`,
+        results
+      });
+    })
+  };
+  return withStandardDecorators161(tool);
+}
+var create_media_multiple_default = createCreateMediaMultipleTool({ allowFilePath: true });
 
 // src/umb-management-api/tools/media/post/create-media-folder.ts
 import { z as z73 } from "zod";
@@ -19921,8 +19964,9 @@ var MediaCollection = {
       tools.push(get_root_default6);
     }
     if (AuthorizationPolicies.SectionAccessMedia(user)) {
-      tools.push(create_media_default);
-      tools.push(create_media_multiple_default);
+      const allowFilePath = isFilePathUploadAllowed();
+      tools.push(createCreateMediaTool({ allowFilePath }));
+      tools.push(createCreateMediaMultipleTool({ allowFilePath }));
       tools.push(create_media_folder_default);
       tools.push(delete_media_default);
       tools.push(update_media_default);
@@ -21941,9 +21985,9 @@ var GetPartialViewByPathTool = {
   outputSchema: getPartialViewByPathResponse.shape,
   annotations: { readOnlyHint: true },
   slices: ["read"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return executeGetApiCall117(
-      (client) => client.getPartialViewByPath(path4, CAPTURE_RAW_HTTP_RESPONSE235)
+      (client) => client.getPartialViewByPath(path3, CAPTURE_RAW_HTTP_RESPONSE235)
     );
   })
 };
@@ -21962,9 +22006,9 @@ var GetPartialViewFolderByPathTool = {
   outputSchema: getPartialViewFolderByPathResponse.shape,
   annotations: { readOnlyHint: true },
   slices: ["read", "folders"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return executeGetApiCall118(
-      (client) => client.getPartialViewFolderByPath(path4, CAPTURE_RAW_HTTP_RESPONSE236)
+      (client) => client.getPartialViewFolderByPath(path3, CAPTURE_RAW_HTTP_RESPONSE236)
     );
   })
 };
@@ -22039,9 +22083,9 @@ var DeletePartialViewTool = {
     destructiveHint: true
   },
   slices: ["delete"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return executeVoidApiCall76(
-      (client) => client.deletePartialViewByPath(path4, CAPTURE_RAW_HTTP_RESPONSE239)
+      (client) => client.deletePartialViewByPath(path3, CAPTURE_RAW_HTTP_RESPONSE239)
     );
   })
 };
@@ -22061,9 +22105,9 @@ var DeletePartialViewFolderTool = {
     destructiveHint: true
   },
   slices: ["delete", "folders"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return executeVoidApiCall77(
-      (client) => client.deletePartialViewFolderByPath(path4, CAPTURE_RAW_HTTP_RESPONSE240)
+      (client) => client.deletePartialViewFolderByPath(path3, CAPTURE_RAW_HTTP_RESPONSE240)
     );
   })
 };
@@ -22549,9 +22593,9 @@ var GetScriptByPathTool = {
   outputSchema: getScriptByPathResponse.shape,
   annotations: { readOnlyHint: true },
   slices: ["read"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return executeGetApiCall130(
-      (client) => client.getScriptByPath(path4, CAPTURE_RAW_HTTP_RESPONSE257)
+      (client) => client.getScriptByPath(path3, CAPTURE_RAW_HTTP_RESPONSE257)
     );
   })
 };
@@ -22570,9 +22614,9 @@ var GetScriptFolderByPathTool = {
   outputSchema: getScriptFolderByPathResponse.shape,
   annotations: { readOnlyHint: true },
   slices: ["read", "folders"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return executeGetApiCall131(
-      (client) => client.getScriptFolderByPath(path4, CAPTURE_RAW_HTTP_RESPONSE258)
+      (client) => client.getScriptFolderByPath(path3, CAPTURE_RAW_HTTP_RESPONSE258)
     );
   })
 };
@@ -22870,9 +22914,9 @@ var DeleteScriptTool = {
     destructiveHint: true
   },
   slices: ["delete"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return executeVoidApiCall82(
-      (client) => client.deleteScriptByPath(path4, CAPTURE_RAW_HTTP_RESPONSE266)
+      (client) => client.deleteScriptByPath(path3, CAPTURE_RAW_HTTP_RESPONSE266)
     );
   })
 };
@@ -22892,9 +22936,9 @@ var DeleteScriptFolderTool = {
     destructiveHint: true
   },
   slices: ["delete", "folders"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return executeVoidApiCall83(
-      (client) => client.deleteScriptFolderByPath(path4, CAPTURE_RAW_HTTP_RESPONSE267)
+      (client) => client.deleteScriptFolderByPath(path3, CAPTURE_RAW_HTTP_RESPONSE267)
     );
   })
 };
@@ -23502,9 +23546,9 @@ var UpdateStylesheetTool = {
   annotations: { idempotentHint: true },
   slices: ["update"],
   handler: (async (model) => {
-    const { path: path4, ...updateModel } = model;
+    const { path: path3, ...updateModel } = model;
     return executeVoidApiCall84(
-      (client) => client.putStylesheetByPath(path4, updateModel, CAPTURE_RAW_HTTP_RESPONSE281)
+      (client) => client.putStylesheetByPath(path3, updateModel, CAPTURE_RAW_HTTP_RESPONSE281)
     );
   })
 };
@@ -23528,8 +23572,8 @@ var RenameStylesheetTool = {
   annotations: { idempotentHint: true },
   slices: ["rename"],
   handler: (async (model) => {
-    const { path: path4, ...renameModel } = model;
-    const normalizedPath = encodeURIComponent(path4);
+    const { path: path3, ...renameModel } = model;
+    const normalizedPath = encodeURIComponent(path3);
     return executeVoidApiCall85(
       (client) => client.putStylesheetByPathRename(normalizedPath, renameModel, CAPTURE_RAW_HTTP_RESPONSE282)
     );
@@ -24140,9 +24184,6 @@ var TemplateCollection = {
 
 // src/umb-management-api/tools/temporary-file/post/create-temporary-file.ts
 import { z as z143 } from "zod";
-import * as fs3 from "fs";
-import * as os2 from "os";
-import * as path3 from "path";
 import {
   createToolResult as createToolResult42,
   createToolResultError as createToolResultError27,
@@ -24171,7 +24212,6 @@ var CreateTemporaryFileTool = {
   outputSchema: createTemporaryFileOutputSchema.shape,
   slices: ["create"],
   handler: (async (model) => {
-    let tempFilePath = null;
     try {
       const fileContent = Buffer.from(model.fileAsBase64, "base64");
       let fileName = model.fileName;
@@ -24179,13 +24219,11 @@ var CreateTemporaryFileTool = {
         const extension = detectFileExtensionFromBuffer2(fileContent);
         fileName = `${fileName}${extension}`;
       }
-      tempFilePath = path3.join(os2.tmpdir(), `umbraco-upload-${model.id}-${fileName}`);
-      fs3.writeFileSync(tempFilePath, fileContent);
-      const readStream = fs3.createReadStream(tempFilePath);
       const client = UmbracoManagementClient3.getClient();
       await client.postTemporaryFile({
         Id: model.id,
-        File: readStream
+        File: fileContent,
+        FileName: fileName
       });
       return createToolResult42({
         message: "Temporary file created successfully",
@@ -24195,14 +24233,6 @@ var CreateTemporaryFileTool = {
       return createToolResultError27({
         detail: `Error creating temporary file: ${error.message}`
       });
-    } finally {
-      if (tempFilePath && fs3.existsSync(tempFilePath)) {
-        try {
-          fs3.unlinkSync(tempFilePath);
-        } catch (e) {
-          console.error("Failed to cleanup temp file:", e);
-        }
-      }
     }
   })
 };
@@ -24213,14 +24243,15 @@ import { ReadStream } from "fs";
 import { z as zod2 } from "zod";
 var postTemporaryFileBody = zod2.object({
   Id: zod2.string().uuid(),
-  File: zod2.instanceof(ReadStream)
+  File: zod2.union([zod2.instanceof(Buffer), zod2.instanceof(ReadStream)]),
+  FileName: zod2.string().min(1)
 });
 var getTemporaryFileByIdParams = zod2.object({
   id: zod2.string().uuid()
 });
 var getTemporaryFileByIdResponse = zod2.object({
   id: zod2.string().guid(),
-  availableUntil: zod2.string().datetime({ local: true }).nullish(),
+  availableUntil: zod2.string().datetime({ local: true, offset: true }).nullish(),
   fileName: zod2.string().min(1)
 });
 var deleteTemporaryFileByIdParams = zod2.object({
@@ -25470,10 +25501,11 @@ export {
   __commonJS,
   __toESM,
   UmbracoManagementClient3 as UmbracoManagementClient,
+  setAllowFilePathUploads,
   setUmbracoVersion,
   availableCollections,
   allModes,
   allModeNames,
   allSliceNames
 };
-//# sourceMappingURL=chunk-6NEKTCPS.js.map
+//# sourceMappingURL=chunk-XVBYRUFE.js.map