@umbraco-cms/mcp-dev 17.4.0 → 17.4.2

package/dist/{chunk-OBOSCZYR.cjs → chunk-Q4LCXM42.cjs}

@@ -1,4 +1,4 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class;var __create = Object.create;
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class;var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -3002,28 +3002,28 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const getPartialViewByPath = (path4, options) => {
+  const getPartialViewByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/partial-view/${path4}`,
+        url: `/umbraco/management/api/v1/partial-view/${path3}`,
         method: "GET"
       },
       options
     );
   };
-  const deletePartialViewByPath = (path4, options) => {
+  const deletePartialViewByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/partial-view/${path4}`,
+        url: `/umbraco/management/api/v1/partial-view/${path3}`,
         method: "DELETE"
       },
       options
     );
   };
-  const putPartialViewByPath = (path4, updatePartialViewRequestModel, options) => {
+  const putPartialViewByPath = (path3, updatePartialViewRequestModel, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/partial-view/${path4}`,
+        url: `/umbraco/management/api/v1/partial-view/${path3}`,
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         data: updatePartialViewRequestModel
@@ -3031,10 +3031,10 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const putPartialViewByPathRename = (path4, renamePartialViewRequestModel, options) => {
+  const putPartialViewByPathRename = (path3, renamePartialViewRequestModel, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/partial-view/${path4}/rename`,
+        url: `/umbraco/management/api/v1/partial-view/${path3}/rename`,
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         data: renamePartialViewRequestModel
@@ -3053,19 +3053,19 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const getPartialViewFolderByPath = (path4, options) => {
+  const getPartialViewFolderByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/partial-view/folder/${path4}`,
+        url: `/umbraco/management/api/v1/partial-view/folder/${path3}`,
         method: "GET"
       },
       options
     );
   };
-  const deletePartialViewFolderByPath = (path4, options) => {
+  const deletePartialViewFolderByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/partial-view/folder/${path4}`,
+        url: `/umbraco/management/api/v1/partial-view/folder/${path3}`,
         method: "DELETE"
       },
       options
@@ -3313,28 +3313,28 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const getScriptByPath = (path4, options) => {
+  const getScriptByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/script/${path4}`,
+        url: `/umbraco/management/api/v1/script/${path3}`,
         method: "GET"
       },
       options
     );
   };
-  const deleteScriptByPath = (path4, options) => {
+  const deleteScriptByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/script/${path4}`,
+        url: `/umbraco/management/api/v1/script/${path3}`,
         method: "DELETE"
       },
       options
     );
   };
-  const putScriptByPath = (path4, updateScriptRequestModel, options) => {
+  const putScriptByPath = (path3, updateScriptRequestModel, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/script/${path4}`,
+        url: `/umbraco/management/api/v1/script/${path3}`,
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         data: updateScriptRequestModel
@@ -3342,10 +3342,10 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const putScriptByPathRename = (path4, renameScriptRequestModel, options) => {
+  const putScriptByPathRename = (path3, renameScriptRequestModel, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/script/${path4}/rename`,
+        url: `/umbraco/management/api/v1/script/${path3}/rename`,
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         data: renameScriptRequestModel
@@ -3364,19 +3364,19 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const getScriptFolderByPath = (path4, options) => {
+  const getScriptFolderByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/script/folder/${path4}`,
+        url: `/umbraco/management/api/v1/script/folder/${path3}`,
         method: "GET"
       },
       options
     );
   };
-  const deleteScriptFolderByPath = (path4, options) => {
+  const deleteScriptFolderByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/script/folder/${path4}`,
+        url: `/umbraco/management/api/v1/script/folder/${path3}`,
         method: "DELETE"
       },
       options
@@ -3600,28 +3600,28 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const getStylesheetByPath = (path4, options) => {
+  const getStylesheetByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/stylesheet/${path4}`,
+        url: `/umbraco/management/api/v1/stylesheet/${path3}`,
         method: "GET"
       },
       options
     );
   };
-  const deleteStylesheetByPath = (path4, options) => {
+  const deleteStylesheetByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/stylesheet/${path4}`,
+        url: `/umbraco/management/api/v1/stylesheet/${path3}`,
         method: "DELETE"
       },
       options
     );
   };
-  const putStylesheetByPath = (path4, updateStylesheetRequestModel, options) => {
+  const putStylesheetByPath = (path3, updateStylesheetRequestModel, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/stylesheet/${path4}`,
+        url: `/umbraco/management/api/v1/stylesheet/${path3}`,
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         data: updateStylesheetRequestModel
@@ -3629,10 +3629,10 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const putStylesheetByPathRename = (path4, renameStylesheetRequestModel, options) => {
+  const putStylesheetByPathRename = (path3, renameStylesheetRequestModel, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/stylesheet/${path4}/rename`,
+        url: `/umbraco/management/api/v1/stylesheet/${path3}/rename`,
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         data: renameStylesheetRequestModel
@@ -3651,19 +3651,19 @@ var getUmbracoManagementAPI = () => {
       options
     );
   };
-  const getStylesheetFolderByPath = (path4, options) => {
+  const getStylesheetFolderByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/stylesheet/folder/${path4}`,
+        url: `/umbraco/management/api/v1/stylesheet/folder/${path3}`,
         method: "GET"
       },
       options
     );
   };
-  const deleteStylesheetFolderByPath = (path4, options) => {
+  const deleteStylesheetFolderByPath = (path3, options) => {
     return UmbracoManagementClient(
       {
-        url: `/umbraco/management/api/v1/stylesheet/folder/${path4}`,
+        url: `/umbraco/management/api/v1/stylesheet/folder/${path3}`,
         method: "DELETE"
       },
       options
@@ -4546,21 +4546,47 @@ var getUmbracoManagementAPI = () => {
 
 // src/umb-management-api/api/temporary-file/index.ts
 
-var _formdata = require('form-data'); var _formdata2 = _interopRequireDefault(_formdata);
+async function readStreamToBuffer(stream) {
+  const chunks = [];
+  for await (const chunk of stream) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks);
+}
 var getTemporaryFileAPI = () => ({
-  postTemporaryFile: (postTemporaryFileBody2, options) => {
-    const formData = new (0, _formdata2.default)();
+  postTemporaryFile: async (postTemporaryFileBody2, options) => {
+    const formData = new FormData();
     formData.append("Id", postTemporaryFileBody2.Id);
-    formData.append("File", postTemporaryFileBody2.File);
-    const headers = {
-      ...formData.getHeaders(),
-      ..._optionalChain([options, 'optionalAccess', _ => _.headers])
-    };
+    const file = postTemporaryFileBody2.File;
+    console.log("[temp-file] incoming file:", {
+      typeofFile: typeof file,
+      isBuffer: Buffer.isBuffer(file),
+      ctorName: _optionalChain([file, 'optionalAccess', _ => _.constructor, 'optionalAccess', _2 => _2.name]),
+      hasByteLength: typeof _optionalChain([file, 'optionalAccess', _3 => _3.byteLength]),
+      hasLength: typeof _optionalChain([file, 'optionalAccess', _4 => _4.length]),
+      keys: file ? Object.keys(file).slice(0, 10) : []
+    });
+    const buffer = Buffer.isBuffer(file) ? file : await readStreamToBuffer(file);
+    console.log("[temp-file] buffer:", { length: buffer.byteLength });
+    const bytes = new Uint8Array(buffer.byteLength);
+    bytes.set(buffer);
+    const blob = new Blob([bytes]);
+    console.log("[temp-file] blob:", { size: blob.size, type: blob.type, fileName: postTemporaryFileBody2.FileName });
+    formData.append("File", blob, postTemporaryFileBody2.FileName);
+    const entries = [];
+    for (const [k, v] of formData.entries()) {
+      entries.push({
+        name: k,
+        valueKind: typeof v === "string" ? "string" : _nullishCoalesce(_optionalChain([v, 'optionalAccess', _5 => _5.constructor, 'optionalAccess', _6 => _6.name]), () => ( typeof v)),
+        valueSize: typeof v === "string" ? v.length : _nullishCoalesce(_optionalChain([v, 'optionalAccess', _7 => _7.size]), () => ( void 0))
+      });
+    }
+    console.log("[temp-file] formData entries:", entries);
     return _mcpserversdk.UmbracoManagementClient.call(void 0, 
       {
         url: `/umbraco/management/api/v1/temporary-file`,
         method: "POST",
-        headers,
+        headers: _optionalChain([options, 'optionalAccess', _8 => _8.headers]),
         data: formData
       },
       options
@@ -4610,6 +4636,13 @@ var UmbracoManagementClient3 = (_class = class {
 
 // src/umb-management-api/runtime-context.ts
 var umbracoVersion = null;
+var allowFilePathUploads = false;
+function setAllowFilePathUploads(allow) {
+  allowFilePathUploads = allow;
+}
+function isFilePathUploadAllowed() {
+  return allowFilePathUploads;
+}
 function setUmbracoVersion(version) {
   umbracoVersion = _nullishCoalesce(version, () => ( null));
 }
@@ -12518,7 +12551,7 @@ async function synthesizeDataTypeSchema(id) {
   const client = UmbracoManagementClient3.getClient();
   const dataType = await client.getDataTypeById(id);
   const template = findTemplateByEditorAlias(dataType.editorAlias);
-  const valueTypeName = _nullishCoalesce(VALUE_TYPE_BY_EDITOR_ALIAS[dataType.editorAlias], () => ( (_optionalChain([template, 'optionalAccess', _2 => _2.value]) !== void 0 ? "JSON" : null)));
+  const valueTypeName = _nullishCoalesce(VALUE_TYPE_BY_EDITOR_ALIAS[dataType.editorAlias], () => ( (_optionalChain([template, 'optionalAccess', _9 => _9.value]) !== void 0 ? "JSON" : null)));
   const jsonSchema = {
     $schema: "https://json-schema.org/draft/2020-12/schema",
     title: dataType.name,
@@ -12526,8 +12559,8 @@ async function synthesizeDataTypeSchema(id) {
     dataTypeId: dataType.id,
     editorAlias: dataType.editorAlias,
     editorUiAlias: dataType.editorUiAlias,
-    example: _optionalChain([template, 'optionalAccess', _3 => _3.value]),
-    notes: _optionalChain([template, 'optionalAccess', _4 => _4._notes])
+    example: _optionalChain([template, 'optionalAccess', _10 => _10.value]),
+    notes: _optionalChain([template, 'optionalAccess', _11 => _11._notes])
   };
   return { valueTypeName, jsonSchema };
 }
@@ -12648,7 +12681,7 @@ var CopyDataTypeTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const location = _optionalChain([response, 'access', _5 => _5.headers, 'optionalAccess', _6 => _6.location]) || "";
+      const location = _optionalChain([response, 'access', _12 => _12.headers, 'optionalAccess', _13 => _13.location]) || "";
       const newId = location.split("/").pop() || "";
       const output = {
         message: "Data type copied successfully",
@@ -13289,7 +13322,7 @@ var CreateDictionaryItemTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _7 => _7.headers, 'optionalAccess', _8 => _8["location"]]) || _optionalChain([response, 'access', _9 => _9.headers, 'optionalAccess', _10 => _10["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _14 => _14.headers, 'optionalAccess', _15 => _15["location"]]) || _optionalChain([response, 'access', _16 => _16.headers, 'optionalAccess', _17 => _17["Location"]]);
       let createdId = model.id || "";
       if (locationHeader) {
         const idMatch = locationHeader.match(/([0-9a-f-]{36})$/i);
@@ -14246,8 +14279,8 @@ function buildPropertyEntry(prop, dataType, template) {
     editorAlias: dataType.editorAlias,
     dataTypeId: dataType.id,
     dataTypeName: dataType.name,
-    example: _optionalChain([template, 'optionalAccess', _11 => _11.value]),
-    notes: _optionalChain([template, 'optionalAccess', _12 => _12._notes])
+    example: _optionalChain([template, 'optionalAccess', _18 => _18.value]),
+    notes: _optionalChain([template, 'optionalAccess', _19 => _19._notes])
   };
 }
 async function synthesizeDocumentTypeSchema(id) {
@@ -14649,7 +14682,7 @@ var CopyDocumentTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const location = _optionalChain([response, 'access', _13 => _13.headers, 'optionalAccess', _14 => _14.location]) || "";
+      const location = _optionalChain([response, 'access', _20 => _20.headers, 'optionalAccess', _21 => _21.location]) || "";
       const newId = location.split("/").pop() || "";
       const output = { id: newId };
       return _mcpserversdk.createToolResult.call(void 0, output);
@@ -14793,7 +14826,7 @@ var CreateDocumentTool = {
       template = { id: model.templateId };
     } else {
       const docType = await client.getDocumentTypeById(model.documentTypeId);
-      template = _optionalChain([docType, 'access', _15 => _15.defaultTemplate, 'optionalAccess', _16 => _16.id]) ? { id: docType.defaultTemplate.id } : null;
+      template = _optionalChain([docType, 'access', _22 => _22.defaultTemplate, 'optionalAccess', _23 => _23.id]) ? { id: docType.defaultTemplate.id } : null;
     }
     const payload = {
       id: documentId,
@@ -15572,7 +15605,7 @@ var UpdateDocumentPropertiesTool = {
         const docTypeProps = await getDocumentTypeProperties();
         const propsToValidate = allPropertiesToValidate.map((p) => {
           const def = docTypeProps.find((d) => d.alias === p.alias);
-          return { alias: p.alias, value: p.value, dataTypeId: _nullishCoalesce(_optionalChain([def, 'optionalAccess', _17 => _17.dataTypeId]), () => ( "")) };
+          return { alias: p.alias, value: p.value, dataTypeId: _nullishCoalesce(_optionalChain([def, 'optionalAccess', _24 => _24.dataTypeId]), () => ( "")) };
         }).filter((p) => p.dataTypeId);
         if (propsToValidate.length > 0) {
           const valueValidation = await validatePropertiesBeforeSave(propsToValidate);
@@ -15675,13 +15708,13 @@ function isBlockStructure(value) {
   }
   return Array.isArray(value.contentData) && Array.isArray(value.settingsData);
 }
-function discoverAllBlockArrays(value, path4 = "root") {
+function discoverAllBlockArrays(value, path3 = "root") {
   const results = [];
   if (!value || typeof value !== "object") {
     return results;
   }
   if (isRichTextValue(value)) {
-    const nestedResults = discoverAllBlockArrays(value.blocks, `${path4}.blocks`);
+    const nestedResults = discoverAllBlockArrays(value.blocks, `${path3}.blocks`);
     results.push(...nestedResults);
     return results;
   }
@@ -15689,12 +15722,12 @@ function discoverAllBlockArrays(value, path4 = "root") {
     results.push({
       contentData: value.contentData,
       settingsData: value.settingsData,
-      path: path4
+      path: path3
     });
     value.contentData.forEach((block, index) => {
       if (block.values && Array.isArray(block.values)) {
         block.values.forEach((prop, propIndex) => {
-          const propPath = `${path4}.contentData[${index}].values[${propIndex}](${prop.alias})`;
+          const propPath = `${path3}.contentData[${index}].values[${propIndex}](${prop.alias})`;
           if (isRichTextValue(prop.value)) {
             const nestedResults = discoverAllBlockArrays(prop.value.blocks, `${propPath}.blocks`);
             results.push(...nestedResults);
@@ -15708,7 +15741,7 @@ function discoverAllBlockArrays(value, path4 = "root") {
     value.settingsData.forEach((block, index) => {
       if (block.values && Array.isArray(block.values)) {
         block.values.forEach((prop, propIndex) => {
-          const propPath = `${path4}.settingsData[${index}].values[${propIndex}](${prop.alias})`;
+          const propPath = `${path3}.settingsData[${index}].values[${propIndex}](${prop.alias})`;
           if (isRichTextValue(prop.value)) {
             const nestedResults = discoverAllBlockArrays(prop.value.blocks, `${propPath}.blocks`);
             results.push(...nestedResults);
@@ -15865,7 +15898,7 @@ var UpdateBlockPropertyTool = {
       if (!isUmbracoAtLeast(17, 4) && elementTypeProperties.length > 0) {
         const propsToValidate = update.properties.map((p) => {
           const def = elementTypeProperties.find((d) => d.alias === p.alias);
-          return { alias: p.alias, value: p.value, dataTypeId: _nullishCoalesce(_optionalChain([def, 'optionalAccess', _18 => _18.dataTypeId]), () => ( "")) };
+          return { alias: p.alias, value: p.value, dataTypeId: _nullishCoalesce(_optionalChain([def, 'optionalAccess', _25 => _25.dataTypeId]), () => ( "")) };
         }).filter((p) => p.dataTypeId);
         if (propsToValidate.length > 0) {
           const valueValidation = await validatePropertiesBeforeSave(propsToValidate);
@@ -16525,7 +16558,7 @@ var CopyDocumentTypeTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const location = _optionalChain([response, 'access', _19 => _19.headers, 'optionalAccess', _20 => _20.location]) || "";
+      const location = _optionalChain([response, 'access', _26 => _26.headers, 'optionalAccess', _27 => _27.location]) || "";
       const newId = location.split("/").pop() || "";
       const output = { id: newId };
       return _mcpserversdk.createToolResult.call(void 0, output);
@@ -18658,17 +18691,15 @@ var ManifestCollection = {
 
 
 // src/umb-management-api/tools/media/post/helpers/media-upload-helpers.ts
-var _fs = require('fs'); var fs2 = _interopRequireWildcard(_fs); var fs = _interopRequireWildcard(_fs); var fs3 = _interopRequireWildcard(_fs);
-var _os = require('os'); var os = _interopRequireWildcard(_os); var os2 = _interopRequireWildcard(_os);
-var _path = require('path'); var path2 = _interopRequireWildcard(_path); var path = _interopRequireWildcard(_path); var path3 = _interopRequireWildcard(_path);
+var _fs = require('fs'); var fs2 = _interopRequireWildcard(_fs); var fs = _interopRequireWildcard(_fs);
+var _path = require('path'); var path2 = _interopRequireWildcard(_path); var path = _interopRequireWildcard(_path);
 var _mimetypes = require('mime-types'); var _mimetypes2 = _interopRequireDefault(_mimetypes);
 
 // src/umb-management-api/tools/media/post/helpers/validate-file-path.ts
 
 
-
 async function validateFilePath(filePath, allowedPaths) {
-  const allowedMediaPaths = await _asyncNullishCoalesce(allowedPaths, async () => ( (await _mcpserversdk.getServerConfig.call(void 0, true)).config.allowedMediaPaths));
+  const allowedMediaPaths = _nullishCoalesce(allowedPaths, () => ( (process.env.UMBRACO_ALLOWED_MEDIA_PATHS ? process.env.UMBRACO_ALLOWED_MEDIA_PATHS.split(",").map((p) => p.trim()).filter(Boolean) : void 0)));
   if (!allowedMediaPaths || allowedMediaPaths.length === 0) {
     throw new Error(
       'File path uploads are disabled. To enable, set UMBRACO_ALLOWED_MEDIA_PATHS environment variable with comma-separated allowed directory paths (e.g., UMBRACO_ALLOWED_MEDIA_PATHS="/tmp/uploads,/var/media")'
@@ -18676,8 +18707,13 @@ async function validateFilePath(filePath, allowedPaths) {
   }
   const normalizedPath = path.resolve(filePath);
   const isAllowed = allowedMediaPaths.some((allowedPath) => {
-    const realAllowedPath = fs.realpathSync(allowedPath);
-    return normalizedPath.startsWith(allowedPath) || normalizedPath.startsWith(realAllowedPath);
+    if (normalizedPath.startsWith(allowedPath)) return true;
+    try {
+      const realAllowedPath = fs.realpathSync(allowedPath);
+      return normalizedPath.startsWith(realAllowedPath);
+    } catch (e2) {
+      return false;
+    }
   });
   if (!isAllowed) {
     throw new Error(
@@ -18689,8 +18725,13 @@ async function validateFilePath(filePath, allowedPaths) {
     if (stats.isSymbolicLink()) {
       const realPath = fs.realpathSync(normalizedPath);
       const symlinkAllowed = allowedMediaPaths.some((allowedPath) => {
-        const realAllowedPath = fs.realpathSync(allowedPath);
-        return realPath.startsWith(allowedPath) || realPath.startsWith(realAllowedPath);
+        if (realPath.startsWith(allowedPath)) return true;
+        try {
+          const realAllowedPath = fs.realpathSync(allowedPath);
+          return realPath.startsWith(realAllowedPath);
+        } catch (e3) {
+          return false;
+        }
       });
       if (!symlinkAllowed) {
         throw new Error(
@@ -18715,6 +18756,7 @@ async function validateFilePath(filePath, allowedPaths) {
 
 
 
+var BASE64_MAX_BYTES = 10 * 1024;
 function getExtensionFromMimeType(mimeType) {
   if (!mimeType) return void 0;
   const baseMimeType = mimeType.split(";")[0].trim();
@@ -18722,7 +18764,7 @@ function getExtensionFromMimeType(mimeType) {
   return extension ? `.${extension}` : void 0;
 }
 function validateMediaTypeForSvg(filePath, fileUrl, fileName, mediaTypeName) {
-  const isSvg = _optionalChain([filePath, 'optionalAccess', _21 => _21.toLowerCase, 'call', _22 => _22(), 'access', _23 => _23.endsWith, 'call', _24 => _24(".svg")]) || _optionalChain([fileUrl, 'optionalAccess', _25 => _25.toLowerCase, 'call', _26 => _26(), 'access', _27 => _27.endsWith, 'call', _28 => _28(".svg")]) || fileName.toLowerCase().endsWith(".svg");
+  const isSvg = _optionalChain([filePath, 'optionalAccess', _28 => _28.toLowerCase, 'call', _29 => _29(), 'access', _30 => _30.endsWith, 'call', _31 => _31(".svg")]) || _optionalChain([fileUrl, 'optionalAccess', _32 => _32.toLowerCase, 'call', _33 => _33(), 'access', _34 => _34.endsWith, 'call', _35 => _35(".svg")]) || fileName.toLowerCase().endsWith(".svg");
   if (isSvg && mediaTypeName === _mcpserversdk.MEDIA_TYPE_IMAGE) {
     console.warn(`SVG detected - using ${_mcpserversdk.MEDIA_TYPE_VECTOR_GRAPHICS} media type instead of ${_mcpserversdk.MEDIA_TYPE_IMAGE}`);
     return _mcpserversdk.MEDIA_TYPE_VECTOR_GRAPHICS;
@@ -18777,18 +18819,25 @@ function buildValueStructure(mediaTypeName, temporaryFileId) {
     value: { temporaryFileId }
   };
 }
-async function createFileStream(sourceType, filePath, fileUrl, fileAsBase64, fileName) {
-  let tempFilePath = null;
-  let readStream;
+async function createFilePayload(sourceType, filePath, fileUrl, fileAsBase64, fileName) {
   switch (sourceType) {
-    case "filePath":
+    case "filePath": {
       if (!filePath) {
         throw new Error("filePath is required when sourceType is 'filePath'");
       }
+      if (typeof fs2.createReadStream !== "function") {
+        throw new Error(
+          "filePath source is not supported in this runtime (no filesystem). Use sourceType 'url' or 'base64' instead."
+        );
+      }
       const validatedPath = await validateFilePath(filePath);
-      readStream = fs2.createReadStream(validatedPath);
-      break;
-    case "url":
+      const filename = fileName.includes(".") ? fileName : path2.basename(validatedPath);
+      return {
+        data: fs2.createReadStream(validatedPath),
+        filename
+      };
+    }
+    case "url": {
       if (!fileUrl) {
         throw new Error("fileUrl is required when sourceType is 'url'");
       }
@@ -18804,122 +18853,284 @@ async function createFileStream(sourceType, filePath, fileUrl, fileAsBase64, fil
         if (response.status >= 400) {
           throw new Error(`Failed to fetch file from URL: HTTP ${response.status} ${response.statusText}`);
         }
-        const arrayBuffer = await response.arrayBuffer();
-        let fileNameWithExtension2 = fileName;
+        const buffer = Buffer.from(await response.arrayBuffer());
+        let filename = fileName;
         if (!fileName.includes(".")) {
           const urlPath = new URL(fileUrl).pathname;
           const urlExtension = path2.extname(urlPath);
           if (urlExtension) {
-            fileNameWithExtension2 = `${fileName}${urlExtension}`;
+            filename = `${fileName}${urlExtension}`;
           } else {
             const contentType = _nullishCoalesce(response.headers.get("content-type"), () => ( void 0));
             const extensionFromMime = getExtensionFromMimeType(contentType);
-            if (extensionFromMime) {
-              fileNameWithExtension2 = `${fileName}${extensionFromMime}`;
-            } else {
-              fileNameWithExtension2 = `${fileName}.bin`;
-            }
+            filename = extensionFromMime ? `${fileName}${extensionFromMime}` : `${fileName}.bin`;
           }
         }
-        tempFilePath = path2.join(os.tmpdir(), fileNameWithExtension2);
-        fs2.writeFileSync(tempFilePath, Buffer.from(arrayBuffer));
-        readStream = fs2.createReadStream(tempFilePath);
+        return { data: buffer, filename };
       } catch (error) {
         if (error.name === "AbortError") {
           throw new Error(`Request timeout after 30s fetching URL: ${fileUrl}`);
         }
         throw new Error(`Failed to fetch URL: ${fileUrl} - ${error.message}`);
       }
-      break;
-    case "base64":
+    }
+    case "base64": {
       if (!fileAsBase64) {
         throw new Error("fileAsBase64 is required when sourceType is 'base64'");
       }
-      const fileContent = Buffer.from(fileAsBase64, "base64");
-      let fileNameWithExtension = fileName;
+      const padding = fileAsBase64.endsWith("==") ? 2 : fileAsBase64.endsWith("=") ? 1 : 0;
+      const estimatedBytes = Math.floor(fileAsBase64.length * 3 / 4) - padding;
+      if (estimatedBytes > BASE64_MAX_BYTES) {
+        throw new Error(
+          `base64 upload rejected: decoded payload is ~${estimatedBytes.toLocaleString()} bytes (limit is ${BASE64_MAX_BYTES.toLocaleString()} bytes). Use sourceType="url" with a public direct-download URL, or sourceType="file" if the file is attached to the chat.`
+        );
+      }
+      const buffer = Buffer.from(fileAsBase64, "base64");
+      let filename = fileName;
       if (!fileName.includes(".")) {
-        const extension = _mcpserversdk.detectFileExtensionFromBuffer.call(void 0, fileContent);
-        fileNameWithExtension = `${fileName}${extension}`;
+        const extension = _mcpserversdk.detectFileExtensionFromBuffer.call(void 0, buffer);
+        filename = `${fileName}${extension}`;
       }
-      tempFilePath = path2.join(os.tmpdir(), fileNameWithExtension);
-      fs2.writeFileSync(tempFilePath, fileContent);
-      readStream = fs2.createReadStream(tempFilePath);
-      break;
+      return { data: buffer, filename };
+    }
   }
-  return { readStream, tempFilePath };
 }
-function cleanupTempFile(tempFilePath) {
-  if (tempFilePath && fs2.existsSync(tempFilePath)) {
-    try {
-      fs2.unlinkSync(tempFilePath);
-    } catch (e) {
-      console.error("Failed to cleanup temp file:", e);
+async function uploadMediaFile(client, params) {
+  const validatedMediaTypeName = validateMediaTypeForSvg(
+    params.filePath,
+    params.fileUrl,
+    params.name,
+    params.mediaTypeName
+  );
+  const mediaTypeId = await fetchMediaTypeId(client, validatedMediaTypeName);
+  const { data, filename } = await createFilePayload(
+    params.sourceType,
+    params.filePath,
+    params.fileUrl,
+    params.fileAsBase64,
+    params.name
+  );
+  try {
+    await client.postTemporaryFile({
+      Id: params.temporaryFileId,
+      File: data,
+      FileName: filename
+    });
+  } catch (error) {
+    const err = error;
+    const errorData = _optionalChain([err, 'access', _36 => _36.response, 'optionalAccess', _37 => _37.data]) ? typeof err.response.data === "string" ? err.response.data : JSON.stringify(err.response.data) : err.message;
+    throw new Error(`Failed to upload temporary file: ${_optionalChain([err, 'access', _38 => _38.response, 'optionalAccess', _39 => _39.status]) || "Unknown error"} - ${errorData}`);
+  }
+  const valueStructure = buildValueStructure(validatedMediaTypeName, params.temporaryFileId);
+  let response;
+  try {
+    response = await client.postMedia({
+      mediaType: { id: mediaTypeId },
+      variants: [
+        {
+          culture: null,
+          segment: null,
+          name: params.name
+          // Use original name provided by user
+        }
+      ],
+      values: [valueStructure],
+      parent: params.parentId ? { id: params.parentId } : null
+    }, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE);
+  } catch (error) {
+    const err = error;
+    throw new Error(`Failed to create media item: ${_optionalChain([err, 'access', _40 => _40.response, 'optionalAccess', _41 => _41.status]) || "Unknown error"} - ${JSON.stringify(_optionalChain([err, 'access', _42 => _42.response, 'optionalAccess', _43 => _43.data])) || err.message}`);
+  }
+  if (response.status < 200 || response.status >= 300) {
+    throw new Error(`Request failed with status code ${response.status}`);
+  }
+  const locationHeader = _optionalChain([response, 'access', _44 => _44.headers, 'optionalAccess', _45 => _45.location]) || _optionalChain([response, 'access', _46 => _46.headers, 'optionalAccess', _47 => _47.Location]);
+  if (!locationHeader) {
+    throw new Error("No Location header in response - cannot determine created media ID");
+  }
+  const idMatch = locationHeader.match(/\/([a-f0-9-]{36})$/i);
+  if (!idMatch) {
+    throw new Error(`Could not extract ID from Location header: ${locationHeader}`);
+  }
+  const mediaId = idMatch[1];
+  return { name: params.name, id: mediaId };
+}
+
+// src/umb-management-api/tools/media/post/helpers/source-type-helpers.ts
+var FILE_PATH_ENTRY = `filePath - Most efficient for local files, works with any size
+     SECURITY: Requires UMBRACO_ALLOWED_MEDIA_PATHS environment variable
+     to be configured with comma-separated allowed directories.
+     Example: UMBRACO_ALLOWED_MEDIA_PATHS="/tmp/uploads,/var/media"`;
+function buildSourceTypeSection(allowFilePath, otherSources) {
+  const sources = allowFilePath ? [FILE_PATH_ENTRY, ...otherSources] : otherSources;
+  return sources.map((s, i) => `  ${i + 1}. ${s}`).join("\n");
+}
+
+// src/umb-management-api/tools/media/post/helpers/streaming-upload.ts
+
+
+var _mcphosted = require('@umbraco-cms/mcp-hosted');
+
+
+
+
+
+
+var authContext = null;
+function isStreamingAuthContextConfigured() {
+  return authContext !== null;
+}
+async function resolveAuth() {
+  if (!authContext) {
+    throw new Error(
+      "Streaming auth context not configured. setStreamingAuthContext() must be called in worker init()."
+    );
+  }
+  const entry = await _mcphosted.getStoredUmbracoToken.call(void 0, authContext.env.OAUTH_KV, authContext.tokenKey);
+  if (!_optionalChain([entry, 'optionalAccess', _48 => _48.tokens, 'optionalAccess', _49 => _49.access_token])) {
+    throw new Error("No Umbraco access token in KV. Reconnect the MCP connector.");
+  }
+  const baseUrl = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([entry, 'access', _50 => _50.site, 'optionalAccess', _51 => _51.serverUrl]), () => ( _optionalChain([entry, 'access', _52 => _52.site, 'optionalAccess', _53 => _53.baseUrl]))), () => ( authContext.env.UMBRACO_SERVER_URL)), () => ( authContext.env.UMBRACO_BASE_URL));
+  if (!baseUrl) {
+    throw new Error("No Umbraco base URL resolvable from site or env.");
+  }
+  return { accessToken: entry.tokens.access_token, baseUrl: _mcpserversdk.normalizeBaseUrl.call(void 0, baseUrl) };
+}
+function ensureExtension(name, contentType, urlPath) {
+  if (name.includes(".")) return name;
+  const fromUrl = _optionalChain([urlPath, 'access', _54 => _54.match, 'call', _55 => _55(/\.([a-z0-9]{1,8})$/i), 'optionalAccess', _56 => _56[0]]);
+  if (fromUrl) return `${name}${fromUrl}`;
+  if (contentType) {
+    const subtype = contentType.split(";")[0].split("/")[1];
+    if (subtype && /^[a-z0-9]{1,8}$/i.test(subtype)) {
+      return `${name}.${subtype === "jpeg" ? "jpg" : subtype}`;
     }
   }
+  return `${name}.bin`;
 }
-async function uploadMediaFile(client, params) {
-  let tempFilePath = null;
+async function streamingUploadFromUrl(params) {
+  const client = UmbracoManagementClient3.getClient();
+  const validatedMediaTypeName = validateMediaTypeForSvg(
+    void 0,
+    params.sourceUrl,
+    params.name,
+    params.mediaTypeName
+  );
+  const [mediaTypeId, auth] = await Promise.all([
+    fetchMediaTypeId(client, validatedMediaTypeName),
+    (async () => {
+      await client.getTemporaryFileConfiguration().catch(() => void 0);
+      return resolveAuth();
+    })()
+  ]);
+  const { accessToken, baseUrl } = auth;
+  const ctl = new AbortController();
+  const overallTimeout = setTimeout(() => ctl.abort(), 6e4);
   try {
-    const validatedMediaTypeName = validateMediaTypeForSvg(
-      params.filePath,
-      params.fileUrl,
-      params.name,
-      params.mediaTypeName
-    );
-    const mediaTypeId = await fetchMediaTypeId(client, validatedMediaTypeName);
-    const { readStream, tempFilePath: createdTempPath } = await createFileStream(
-      params.sourceType,
-      params.filePath,
-      params.fileUrl,
-      params.fileAsBase64,
-      params.name
-    );
-    tempFilePath = createdTempPath;
-    try {
-      await client.postTemporaryFile({
-        Id: params.temporaryFileId,
-        File: readStream
-      });
-    } catch (error) {
-      const err = error;
-      const errorData = _optionalChain([err, 'access', _29 => _29.response, 'optionalAccess', _30 => _30.data]) ? typeof err.response.data === "string" ? err.response.data : JSON.stringify(err.response.data) : err.message;
-      throw new Error(`Failed to upload temporary file: ${_optionalChain([err, 'access', _31 => _31.response, 'optionalAccess', _32 => _32.status]) || "Unknown error"} - ${errorData}`);
+    const sourceResp = await fetch(params.sourceUrl, { signal: ctl.signal });
+    if (!sourceResp.ok || !sourceResp.body) {
+      throw new Error(
+        `Failed to fetch source URL: HTTP ${sourceResp.status} ${sourceResp.statusText}`
+      );
     }
-    const valueStructure = buildValueStructure(validatedMediaTypeName, params.temporaryFileId);
-    let response;
-    try {
-      response = await client.postMedia({
-        mediaType: { id: mediaTypeId },
-        variants: [
-          {
-            culture: null,
-            segment: null,
-            name: params.name
-            // Use original name provided by user
+    const sourceContentType = _nullishCoalesce(sourceResp.headers.get("content-type"), () => ( "application/octet-stream"));
+    const sourceUrl = new URL(params.sourceUrl);
+    const filename = ensureExtension(params.name, sourceContentType, sourceUrl.pathname);
+    const temporaryFileId = crypto.randomUUID();
+    const boundary = `----mcp-stream-${crypto.randomUUID()}`;
+    const encoder = new TextEncoder();
+    const prefix = encoder.encode(
+      `--${boundary}\r
+Content-Disposition: form-data; name="Id"\r
+\r
+${temporaryFileId}\r
+--${boundary}\r
+Content-Disposition: form-data; name="File"; filename="${filename}"\r
+Content-Type: ${sourceContentType}\r
+\r
+`
+    );
+    const suffix = encoder.encode(`\r
+--${boundary}--\r
+`);
+    const sourceBody = sourceResp.body;
+    const multipartBody = new ReadableStream({
+      async start(controller) {
+        const reader = sourceBody.getReader();
+        try {
+          controller.enqueue(prefix);
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            if (value) controller.enqueue(value);
           }
-        ],
+          controller.enqueue(suffix);
+          controller.close();
+        } catch (e) {
+          controller.error(e);
+        } finally {
+          reader.releaseLock();
+        }
+      },
+      cancel(reason) {
+        sourceBody.cancel(reason).catch(() => void 0);
+      }
+    });
+    const tempResp = await fetch(`${baseUrl}/umbraco/management/api/v1/temporary-file`, {
+      method: "POST",
+      body: multipartBody,
+      // @ts-expect-error — `duplex` is required by Workers/undici for streaming bodies
+      duplex: "half",
+      signal: ctl.signal,
+      headers: {
+        "Content-Type": `multipart/form-data; boundary=${boundary}`,
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json"
+      }
+    });
+    if (!tempResp.ok) {
+      const errBody = await tempResp.text().catch(() => "");
+      throw new Error(
+        `Umbraco temporary-file POST failed: HTTP ${tempResp.status} ${tempResp.statusText} - ${errBody}`
+      );
+    }
+    const valueStructure = buildValueStructure(validatedMediaTypeName, temporaryFileId);
+    const response = await client.postMedia(
+      {
+        mediaType: { id: mediaTypeId },
+        variants: [{ culture: null, segment: null, name: params.name }],
         values: [valueStructure],
         parent: params.parentId ? { id: params.parentId } : null
-      }, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE);
-    } catch (error) {
-      const err = error;
-      throw new Error(`Failed to create media item: ${_optionalChain([err, 'access', _33 => _33.response, 'optionalAccess', _34 => _34.status]) || "Unknown error"} - ${JSON.stringify(_optionalChain([err, 'access', _35 => _35.response, 'optionalAccess', _36 => _36.data])) || err.message}`);
-    }
+      },
+      _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE
+    );
     if (response.status < 200 || response.status >= 300) {
-      throw new Error(`Request failed with status code ${response.status}`);
-    }
-    const locationHeader = _optionalChain([response, 'access', _37 => _37.headers, 'optionalAccess', _38 => _38.location]) || _optionalChain([response, 'access', _39 => _39.headers, 'optionalAccess', _40 => _40.Location]);
-    if (!locationHeader) {
-      throw new Error("No Location header in response - cannot determine created media ID");
+      throw new Error(`postMedia failed with status ${response.status}`);
     }
-    const idMatch = locationHeader.match(/\/([a-f0-9-]{36})$/i);
+    const locationHeader = _nullishCoalesce(_optionalChain([response, 'access', _57 => _57.headers, 'optionalAccess', _58 => _58.location]), () => ( _optionalChain([response, 'access', _59 => _59.headers, 'optionalAccess', _60 => _60.Location])));
+    const idMatch = _optionalChain([locationHeader, 'optionalAccess', _61 => _61.match, 'call', _62 => _62(/\/([a-f0-9-]{36})$/i)]);
     if (!idMatch) {
-      throw new Error(`Could not extract ID from Location header: ${locationHeader}`);
+      throw new Error(
+        `Could not extract media id from Location header: ${_nullishCoalesce(locationHeader, () => ( "(missing)"))}`
+      );
     }
-    const mediaId = idMatch[1];
-    return { name: params.name, id: mediaId };
+    return { name: params.name, id: idMatch[1] };
   } finally {
-    cleanupTempFile(tempFilePath);
+    clearTimeout(overallTimeout);
+  }
+}
+async function streamingUploadToToolResult(params) {
+  try {
+    const { name, id } = await streamingUploadFromUrl(params);
+    return _mcpserversdk.createToolResult.call(void 0, {
+      message: `Media "${name}" created successfully`,
+      name,
+      id
+    });
+  } catch (error) {
+    return _mcpserversdk.createToolResultError.call(void 0, {
+      detail: `Error creating media: ${error.message}`
+    });
   }
 }
 
@@ -18935,23 +19146,47 @@ async function uploadMediaFile(client, params) {
 
 
 
-var createMediaSchema = _zod.z.object({
-  sourceType: _zod.z.enum(["filePath", "url", "base64"]).describe("Media source type: 'filePath' for local files (most efficient), 'url' for web files, 'base64' for embedded data (small files only)"),
-  name: _zod.z.string().describe("The name of the media item"),
-  mediaTypeName: _zod.z.string().describe(`Media type: '${_mcpserversdk.MEDIA_TYPE_IMAGE}', '${_mcpserversdk.MEDIA_TYPE_ARTICLE}', '${_mcpserversdk.MEDIA_TYPE_AUDIO}', '${_mcpserversdk.MEDIA_TYPE_VIDEO}', '${_mcpserversdk.MEDIA_TYPE_VECTOR_GRAPHICS}', '${_mcpserversdk.MEDIA_TYPE_FILE}', or custom media type name`),
-  filePath: _zod.z.string().optional().describe("Absolute path to the file (required if sourceType is 'filePath')"),
-  fileUrl: _zod.z.string().url().optional().describe("[raw] URL to fetch the file from (required if sourceType is 'url')"),
-  fileAsBase64: _zod.z.string().optional().describe("Base64 encoded file data (required if sourceType is 'base64')"),
-  parentId: _zod.z.string().uuid().optional().describe("Parent folder ID (defaults to root)")
+var fileObjectSchema = _zod.z.object({
+  download_url: _zod.z.string().describe("Temporary URL the host provides to fetch the file bytes"),
+  file_id: _zod.z.string().describe("Persistent file identifier from the host"),
+  mime_type: _zod.z.string().optional().describe("MIME type if the host knows it"),
+  file_name: _zod.z.string().optional().describe("Original file name if the host knows it")
 });
 var createMediaOutputSchema = _zod.z.object({
   message: _zod.z.string(),
   name: _zod.z.string(),
   id: _zod.z.string().guid()
 });
-var CreateMediaTool = {
-  name: "create-media",
-  description: `Upload any media file to Umbraco (images, documents, audio, video, SVG, or custom types).
+function createCreateMediaTool(options) {
+  const sourceTypeValues = options.allowFilePath ? ["filePath", "url", "file", "base64"] : ["url", "file", "base64"];
+  const base64Kib = BASE64_MAX_BYTES / 1024;
+  const filePathPrefix = options.allowFilePath ? "'filePath' for local files (Node stdio only), " : "";
+  const sourceTypeDescription = `Media source type: ${filePathPrefix}'url' for public direct-download URLs (streamed; preferred for everything not already attached to the chat), 'file' for host-injected attachments \u2014 the connector populates the 'file' object automatically when the user attached a file or you generated one in this chat, 'base64' for TINY inline payloads only \u2014 the server rejects base64 above ${base64Kib} KiB decoded to stop LLM-truncated or thumbnail-preview base64 from persisting as corrupt files`;
+  const schema = _zod.z.object({
+    sourceType: _zod.z.enum(sourceTypeValues).describe(sourceTypeDescription),
+    name: _zod.z.string().describe("The name of the media item"),
+    mediaTypeName: _zod.z.string().describe(`Media type: '${_mcpserversdk.MEDIA_TYPE_IMAGE}', '${_mcpserversdk.MEDIA_TYPE_ARTICLE}', '${_mcpserversdk.MEDIA_TYPE_AUDIO}', '${_mcpserversdk.MEDIA_TYPE_VIDEO}', '${_mcpserversdk.MEDIA_TYPE_VECTOR_GRAPHICS}', '${_mcpserversdk.MEDIA_TYPE_FILE}', or custom media type name`),
+    filePath: _zod.z.string().optional().describe("Absolute path to the file (required if sourceType is 'filePath')"),
+    fileUrl: _zod.z.string().url().optional().describe("[raw] Public, direct-download URL to fetch the file from (required if sourceType is 'url'). Must be reachable without authentication. Share/viewer links (e.g. drive.google.com/file/d/<id>/view, Dropbox ?dl=0, OneDrive view URLs) must be converted to their direct-download equivalent first \u2014 Google Drive: drive.google.com/uc?export=download&id=<id>. Uploads are streamed, so multi-MB files round-trip without timing out."),
+    file: fileObjectSchema.optional().describe(
+      "[raw] Host-injected file object (required if sourceType is 'file'). ChatGPT's connector populates this automatically when the user attached a file or you generated one in this chat \u2014 leave it for the host to fill, do not synthesise it yourself."
+    ),
+    fileAsBase64: _zod.z.string().optional().describe(`Base64-encoded file data (required if sourceType is 'base64'). HARD LIMIT: decoded payload must be \u2264${base64Kib} KiB; the server rejects anything larger because LLMs reliably truncate big base64 strings or substitute thumbnail previews, both producing corrupt files. Use sourceType='url' or 'file' for everything bigger.`),
+    parentId: _zod.z.string().uuid().optional().describe("Parent folder ID (defaults to root)")
+  });
+  const filePathSection = buildSourceTypeSection(options.allowFilePath, [
+    `url - Stream from any public direct-download URL (Drive / Dropbox / etc.). Use this for anything above ${base64Kib} KiB that isn't already attached to the chat.`,
+    `file - Stream a host-attached file. The connector injects { download_url, file_id, mime_type, file_name } on the 'file' field automatically when the user attached a file or you generated one in this chat \u2014 prefer this over url for chat-bound files.`,
+    `base64 - ONLY for tiny inline payloads; server hard-rejects decoded base64 over ${base64Kib} KiB to prevent LLM-truncated corrupt files.`
+  ]);
+  const tool = {
+    name: "create-media",
+    description: `Upload any media file to Umbraco (images, documents, audio, video, SVG, or custom types).
+
+  Pick the sourceType that matches where the file lives:
+  - If the file is attached to this chat or you just generated it \u2192 sourceType="file" (the host fills in the file reference automatically).
+  - If you have a public direct-download URL \u2192 sourceType="url".
+  - For tiny inline payloads (\u2264${base64Kib} KiB decoded) \u2192 sourceType="base64".
 
   Media Types:
   - ${_mcpserversdk.MEDIA_TYPE_IMAGE}: jpg, png, gif, webp, etc. (supports cropping)
@@ -18963,48 +19198,72 @@ var CreateMediaTool = {
   - Custom: any custom media type created in Umbraco
 
   Source Types:
-  1. filePath - Most efficient for local files, works with any size
-     SECURITY: Requires UMBRACO_ALLOWED_MEDIA_PATHS environment variable
-     to be configured with comma-separated allowed directories.
-     Example: UMBRACO_ALLOWED_MEDIA_PATHS="/tmp/uploads,/var/media"
-  2. url - Fetch from web URL
-  3. base64 - Only for small files (<10KB) due to token usage
+${filePathSection}
 
   The tool automatically:
   - Creates temporary files
   - Detects and validates media types (auto-corrects SVG vs Image)
   - Configures correct property editors (ImageCropper vs UploadField)
   - Cleans up temporary files`,
-  inputSchema: createMediaSchema.shape,
-  outputSchema: createMediaOutputSchema.shape,
-  slices: ["create"],
-  handler: (async (model) => {
-    try {
-      const client = UmbracoManagementClient3.getClient();
-      const temporaryFileId = _uuid.v4.call(void 0, );
-      const { name: actualName, id } = await uploadMediaFile(client, {
-        sourceType: model.sourceType,
-        name: model.name,
-        mediaTypeName: model.mediaTypeName,
-        filePath: model.filePath,
-        fileUrl: model.fileUrl,
-        fileAsBase64: model.fileAsBase64,
-        parentId: model.parentId,
-        temporaryFileId
-      });
-      return _mcpserversdk.createToolResult.call(void 0, {
-        message: `Media "${actualName}" created successfully`,
-        name: actualName,
-        id
-      });
-    } catch (error) {
-      return _mcpserversdk.createToolResultError.call(void 0, {
-        detail: `Error creating media: ${error.message}`
-      });
-    }
-  })
-};
-var create_media_default = _mcpserversdk.withStandardDecorators.call(void 0, CreateMediaTool);
+    inputSchema: schema.shape,
+    outputSchema: createMediaOutputSchema.shape,
+    slices: ["create"],
+    _meta: { "openai/fileParams": ["file"] },
+    handler: (async (model) => {
+      let effectiveSourceType;
+      let effectiveFileUrl = model.fileUrl;
+      if (model.sourceType === "file") {
+        if (!_optionalChain([model, 'access', _63 => _63.file, 'optionalAccess', _64 => _64.download_url])) {
+          return _mcpserversdk.createToolResultError.call(void 0, {
+            detail: "Error creating media: sourceType is 'file' but no file object was provided. ChatGPT's connector should inject this automatically when a file is attached \u2014 if it didn't, the user has nothing attached or your client doesn't support openai/fileParams."
+          });
+        }
+        effectiveSourceType = "url";
+        effectiveFileUrl = model.file.download_url;
+      } else {
+        effectiveSourceType = model.sourceType;
+      }
+      if (effectiveSourceType === "url" && isStreamingAuthContextConfigured()) {
+        if (!effectiveFileUrl) {
+          return _mcpserversdk.createToolResultError.call(void 0, {
+            detail: "Error creating media: fileUrl is required when sourceType is 'url'"
+          });
+        }
+        return streamingUploadToToolResult({
+          sourceUrl: effectiveFileUrl,
+          name: model.name,
+          mediaTypeName: model.mediaTypeName,
+          parentId: model.parentId
+        });
+      }
+      try {
+        const client = UmbracoManagementClient3.getClient();
+        const temporaryFileId = _uuid.v4.call(void 0, );
+        const { name: actualName, id } = await uploadMediaFile(client, {
+          sourceType: effectiveSourceType,
+          name: model.name,
+          mediaTypeName: model.mediaTypeName,
+          filePath: model.filePath,
+          fileUrl: effectiveFileUrl,
+          fileAsBase64: model.fileAsBase64,
+          parentId: model.parentId,
+          temporaryFileId
+        });
+        return _mcpserversdk.createToolResult.call(void 0, {
+          message: `Media "${actualName}" created successfully`,
+          name: actualName,
+          id
+        });
+      } catch (error) {
+        return _mcpserversdk.createToolResultError.call(void 0, {
+          detail: `Error creating media: ${error.message}`
+        });
+      }
+    })
+  };
+  return _mcpserversdk.withStandardDecorators.call(void 0, tool);
+}
+var create_media_default = createCreateMediaTool({ allowFilePath: true });
 
 // src/umb-management-api/tools/media/post/create-media-multiple.ts
 
@@ -19020,16 +19279,6 @@ var create_media_default = _mcpserversdk.withStandardDecorators.call(void 0, Cre
 
 
 
-var createMediaMultipleSchema = _zod.z.object({
-  sourceType: _zod.z.enum(["filePath", "url"]).describe("Media source type: 'filePath' for local files (most efficient), 'url' for web files. Base64 not supported for batch uploads due to token usage."),
-  files: _zod.z.array(_zod.z.object({
-    name: _zod.z.string().describe("The name of the media item"),
-    filePath: _zod.z.string().optional().describe("Absolute path to the file (required if sourceType is 'filePath')"),
-    fileUrl: _zod.z.string().url().optional().describe("URL to fetch the file from (required if sourceType is 'url')"),
-    mediaTypeName: _zod.z.string().optional().describe(`Optional override: '${_mcpserversdk.MEDIA_TYPE_IMAGE}', '${_mcpserversdk.MEDIA_TYPE_ARTICLE}', '${_mcpserversdk.MEDIA_TYPE_AUDIO}', '${_mcpserversdk.MEDIA_TYPE_VIDEO}', '${_mcpserversdk.MEDIA_TYPE_VECTOR_GRAPHICS}', '${_mcpserversdk.MEDIA_TYPE_FILE}', or custom media type name. If not specified, defaults to '${_mcpserversdk.MEDIA_TYPE_FILE}'`)
-  })).describe("Array of files to upload (maximum 20 files per batch)"),
-  parentId: _zod.z.string().uuid().optional().describe("Parent folder ID (defaults to root)")
-});
 var createMediaMultipleOutputSchema = _zod.z.object({
   summary: _zod.z.string(),
   results: _zod.z.array(_zod.z.object({
@@ -19039,70 +19288,136 @@ var createMediaMultipleOutputSchema = _zod.z.object({
     error: _zod.z.string().optional()
   }))
 });
-var CreateMediaMultipleTool = {
-  name: "create-media-multiple",
-  description: `Batch upload multiple media files to Umbraco (maximum 20 files per batch).
+var fileObjectSchema2 = _zod.z.object({
+  download_url: _zod.z.string().describe("Temporary URL the host provides to fetch the file bytes"),
+  file_id: _zod.z.string().describe("Persistent file identifier from the host"),
+  mime_type: _zod.z.string().optional().describe("MIME type if the host knows it"),
+  file_name: _zod.z.string().optional().describe("Original file name if the host knows it")
+});
+var UPLOAD_CONCURRENCY = 4;
+var MAX_BATCH_SIZE = 20;
+async function mapWithConcurrency(items, concurrency, producer) {
+  const results = new Array(items.length);
+  let nextIndex = 0;
+  async function worker() {
+    while (true) {
+      const current = nextIndex++;
+      if (current >= items.length) return;
+      results[current] = await producer(items[current], current);
+    }
+  }
+  const workers = Array.from({ length: Math.min(concurrency, items.length) }, () => worker());
+  await Promise.all(workers);
+  return results;
+}
+function createCreateMediaMultipleTool(options) {
+  const sourceTypeValues = options.allowFilePath ? ["filePath", "url", "file"] : ["url", "file"];
+  const filePathPrefix = options.allowFilePath ? "'filePath' for local files (most efficient, Node stdio only), " : "";
+  const sourceTypeDescription = `Media source type: ${filePathPrefix}'url' for public direct-download URLs (streamed), 'file' for host-injected attachments \u2014 the connector populates each entry's 'file' object automatically when the user attached or generated files in this chat. Base64 is not supported for batch uploads due to token usage \u2014 use single-file create-media for tiny inline payloads.`;
+  const schema = _zod.z.object({
+    sourceType: _zod.z.enum(sourceTypeValues).describe(sourceTypeDescription),
+    files: _zod.z.array(_zod.z.object({
+      name: _zod.z.string().describe("The name of the media item"),
+      filePath: _zod.z.string().optional().describe("Absolute path to the file (required if sourceType is 'filePath')"),
+      fileUrl: _zod.z.string().url().optional().describe("[raw] Public direct-download URL (required if sourceType is 'url'). Drive / Dropbox share links must be converted to their direct-download equivalent first \u2014 see the create-media tool description for the format. Streamed, so multi-MB files round-trip without timing out."),
+      file: fileObjectSchema2.optional().describe("[raw] Host-injected file reference (required if sourceType is 'file'). ChatGPT's connector populates this per entry automatically when files are attached."),
+      mediaTypeName: _zod.z.string().optional().describe(`Optional override: '${_mcpserversdk.MEDIA_TYPE_IMAGE}', '${_mcpserversdk.MEDIA_TYPE_ARTICLE}', '${_mcpserversdk.MEDIA_TYPE_AUDIO}', '${_mcpserversdk.MEDIA_TYPE_VIDEO}', '${_mcpserversdk.MEDIA_TYPE_VECTOR_GRAPHICS}', '${_mcpserversdk.MEDIA_TYPE_FILE}', or custom media type name. If not specified, defaults to '${_mcpserversdk.MEDIA_TYPE_FILE}'`)
+    })).max(MAX_BATCH_SIZE).describe(`Array of files to upload (maximum ${MAX_BATCH_SIZE} files per batch)`),
+    parentId: _zod.z.string().uuid().optional().describe("Parent folder ID (defaults to root)")
+  });
+  const filePathSection = buildSourceTypeSection(options.allowFilePath, [
+    "url - Stream from any public direct-download URL (Drive / Dropbox / etc.).",
+    "file - Stream a host-attached file. The connector injects { download_url, file_id, ... } per entry automatically when the user attached or generated files in this chat \u2014 prefer this over 'url' for chat-bound files."
+  ]);
+  const tool = {
+    name: "create-media-multiple",
+    description: `Batch upload multiple media files to Umbraco (maximum ${MAX_BATCH_SIZE} files per batch).
 
-  Supports any file type: images, documents, audio, video, SVG, or custom types.
+  Use this \u2014 not several separate create-media calls \u2014 when the user attached or generated multiple files in this chat (sourceType="file"), or has a list of public URLs to upload (sourceType="url"). ChatGPT's connector populates each entry's 'file' field automatically.
 
   Source Types:
-  1. filePath - Most efficient for local files, works with any size
-     SECURITY: Requires UMBRACO_ALLOWED_MEDIA_PATHS environment variable
-     to be configured with comma-separated allowed directories.
-     Example: UMBRACO_ALLOWED_MEDIA_PATHS="/tmp/uploads,/var/media"
-  2. url - Fetch from web URL
+${filePathSection}
 
   Note: base64 is not supported for batch uploads due to token usage.
 
-  The tool processes files sequentially and returns detailed results for each file.
-  If some files fail, others will continue processing (continue-on-error strategy).`,
-  inputSchema: createMediaMultipleSchema.shape,
-  outputSchema: createMediaMultipleOutputSchema.shape,
-  slices: ["create"],
-  handler: (async (model) => {
-    if (model.files.length > 20) {
-      return _mcpserversdk.createToolResultError.call(void 0, {
-        detail: `Batch upload limited to 20 files per call. You provided ${model.files.length} files. Please split into multiple batches.`
-      });
-    }
-    const results = [];
-    const client = UmbracoManagementClient3.getClient();
-    for (const file of model.files) {
-      try {
-        const temporaryFileId = _uuid.v4.call(void 0, );
-        const defaultMediaType = file.mediaTypeName || _mcpserversdk.MEDIA_TYPE_FILE;
-        const { name: actualName, id: mediaId } = await uploadMediaFile(client, {
-          sourceType: model.sourceType,
-          name: file.name,
-          mediaTypeName: defaultMediaType,
-          filePath: file.filePath,
-          fileUrl: file.fileUrl,
-          fileAsBase64: void 0,
-          parentId: model.parentId,
-          temporaryFileId
-        });
-        results.push({
-          success: true,
-          name: actualName,
-          id: mediaId
-        });
-      } catch (error) {
-        results.push({
-          success: false,
-          name: file.name,
-          error: error.message
+  The tool processes up to ${UPLOAD_CONCURRENCY} uploads in parallel and returns detailed results for each file in input order. If some files fail, others continue processing (continue-on-error strategy).`,
+    inputSchema: schema.shape,
+    outputSchema: createMediaMultipleOutputSchema.shape,
+    slices: ["create"],
+    _meta: { "openai/fileParams": ["files"] },
+    handler: (async (model) => {
+      if (model.files.length > MAX_BATCH_SIZE) {
+        return _mcpserversdk.createToolResultError.call(void 0, {
+          detail: `Batch upload limited to ${MAX_BATCH_SIZE} files per call. You provided ${model.files.length} files. Please split into multiple batches.`
         });
       }
-    }
-    const successCount = results.filter((r) => r.success).length;
-    const failureCount = results.filter((r) => !r.success).length;
-    return _mcpserversdk.createToolResult.call(void 0, {
-      summary: `Processed ${model.files.length} files: ${successCount} succeeded, ${failureCount} failed`,
-      results
-    });
-  })
-};
-var create_media_multiple_default = _mcpserversdk.withStandardDecorators.call(void 0, CreateMediaMultipleTool);
+      const client = UmbracoManagementClient3.getClient();
+      const streamingAvailable = isStreamingAuthContextConfigured();
+      const results = await mapWithConcurrency(
+        model.files,
+        UPLOAD_CONCURRENCY,
+        async (file) => {
+          try {
+            const mediaTypeName = file.mediaTypeName || _mcpserversdk.MEDIA_TYPE_FILE;
+            let effectiveSourceType;
+            let effectiveFileUrl = file.fileUrl;
+            if (model.sourceType === "file") {
+              if (!_optionalChain([file, 'access', _65 => _65.file, 'optionalAccess', _66 => _66.download_url])) {
+                return {
+                  success: false,
+                  name: file.name,
+                  error: "sourceType is 'file' but no file object was provided for this entry. The host connector should inject this automatically when a file is attached."
+                };
+              }
+              effectiveSourceType = "url";
+              effectiveFileUrl = file.file.download_url;
+            } else {
+              effectiveSourceType = model.sourceType;
+            }
+            if (effectiveSourceType === "url" && streamingAvailable) {
+              if (!effectiveFileUrl) {
+                return {
+                  success: false,
+                  name: file.name,
+                  error: "fileUrl is required when sourceType is 'url'."
+                };
+              }
+              const { name: actualName2, id: mediaId2 } = await streamingUploadFromUrl({
+                sourceUrl: effectiveFileUrl,
+                name: file.name,
+                mediaTypeName,
+                parentId: model.parentId
+              });
+              return { success: true, name: actualName2, id: mediaId2 };
+            }
+            const temporaryFileId = _uuid.v4.call(void 0, );
+            const { name: actualName, id: mediaId } = await uploadMediaFile(client, {
+              sourceType: effectiveSourceType,
+              name: file.name,
+              mediaTypeName,
+              filePath: file.filePath,
+              fileUrl: effectiveFileUrl,
+              fileAsBase64: void 0,
+              parentId: model.parentId,
+              temporaryFileId
+            });
+            return { success: true, name: actualName, id: mediaId };
+          } catch (error) {
+            return { success: false, name: file.name, error: error.message };
+          }
+        }
+      );
+      const successCount = results.filter((r) => r.success).length;
+      const failureCount = results.filter((r) => !r.success).length;
+      return _mcpserversdk.createToolResult.call(void 0, {
+        summary: `Processed ${model.files.length} files: ${successCount} succeeded, ${failureCount} failed`,
+        results
+      });
+    })
+  };
+  return _mcpserversdk.withStandardDecorators.call(void 0, tool);
+}
+var create_media_multiple_default = createCreateMediaMultipleTool({ allowFilePath: true });
 
 // src/umb-management-api/tools/media/post/create-media-folder.ts
 
@@ -19146,7 +19461,7 @@ var CreateMediaFolderTool = {
       if (response.status < 200 || response.status >= 300) {
         throw new Error(`Request failed with status code ${response.status}`);
       }
-      const locationHeader = _optionalChain([response, 'access', _41 => _41.headers, 'optionalAccess', _42 => _42.location]) || _optionalChain([response, 'access', _43 => _43.headers, 'optionalAccess', _44 => _44.Location]);
+      const locationHeader = _optionalChain([response, 'access', _67 => _67.headers, 'optionalAccess', _68 => _68.location]) || _optionalChain([response, 'access', _69 => _69.headers, 'optionalAccess', _70 => _70.Location]);
       if (!locationHeader) {
         throw new Error("No Location header in response - cannot determine created folder ID");
       }
@@ -19921,8 +20236,9 @@ var MediaCollection = {
       tools.push(get_root_default6);
     }
     if (AuthorizationPolicies.SectionAccessMedia(user)) {
-      tools.push(create_media_default);
-      tools.push(create_media_multiple_default);
+      const allowFilePath = isFilePathUploadAllowed();
+      tools.push(createCreateMediaTool({ allowFilePath }));
+      tools.push(createCreateMediaMultipleTool({ allowFilePath }));
       tools.push(create_media_folder_default);
       tools.push(delete_media_default);
       tools.push(update_media_default);
@@ -20382,7 +20698,7 @@ var CreateMediaTypeFolderTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _45 => _45.headers, 'optionalAccess', _46 => _46["location"]]) || _optionalChain([response, 'access', _47 => _47.headers, 'optionalAccess', _48 => _48["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _71 => _71.headers, 'optionalAccess', _72 => _72["location"]]) || _optionalChain([response, 'access', _73 => _73.headers, 'optionalAccess', _74 => _74["Location"]]);
       let createdId = model.id || "";
       if (locationHeader) {
         const idMatch = locationHeader.match(/([0-9a-f-]{36})$/i);
@@ -20516,7 +20832,7 @@ var CreateMediaTypeTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _49 => _49.headers, 'optionalAccess', _50 => _50["location"]]) || _optionalChain([response, 'access', _51 => _51.headers, 'optionalAccess', _52 => _52["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _75 => _75.headers, 'optionalAccess', _76 => _76["location"]]) || _optionalChain([response, 'access', _77 => _77.headers, 'optionalAccess', _78 => _78["Location"]]);
       let createdId = model.id || "";
       if (locationHeader) {
         const idMatch = locationHeader.match(/([0-9a-f-]{36})$/i);
@@ -20567,7 +20883,7 @@ var CopyMediaTypeTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _53 => _53.headers, 'optionalAccess', _54 => _54["location"]]) || _optionalChain([response, 'access', _55 => _55.headers, 'optionalAccess', _56 => _56["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _79 => _79.headers, 'optionalAccess', _80 => _80["location"]]) || _optionalChain([response, 'access', _81 => _81.headers, 'optionalAccess', _82 => _82["Location"]]);
       let createdId = "";
       if (locationHeader) {
         const idMatch = locationHeader.match(/([0-9a-f-]{36})$/i);
@@ -20777,7 +21093,7 @@ var CreateMemberTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _57 => _57.headers, 'optionalAccess', _58 => _58["location"]]) || _optionalChain([response, 'access', _59 => _59.headers, 'optionalAccess', _60 => _60["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _83 => _83.headers, 'optionalAccess', _84 => _84["location"]]) || _optionalChain([response, 'access', _85 => _85.headers, 'optionalAccess', _86 => _86["Location"]]);
       let createdId = model.id || "";
       if (locationHeader) {
         const idMatch = locationHeader.match(/([0-9a-f-]{36})$/i);
@@ -21328,7 +21644,7 @@ var CreateMemberTypeTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _61 => _61.headers, 'optionalAccess', _62 => _62["location"]]) || _optionalChain([response, 'access', _63 => _63.headers, 'optionalAccess', _64 => _64["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _87 => _87.headers, 'optionalAccess', _88 => _88["location"]]) || _optionalChain([response, 'access', _89 => _89.headers, 'optionalAccess', _90 => _90["Location"]]);
       let createdId = model.id || "";
       if (locationHeader) {
         const idMatch = locationHeader.match(/([0-9a-f-]{36})$/i);
@@ -21498,7 +21814,7 @@ var CopyMemberTypeTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _65 => _65.headers, 'optionalAccess', _66 => _66["location"]]) || _optionalChain([response, 'access', _67 => _67.headers, 'optionalAccess', _68 => _68["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _91 => _91.headers, 'optionalAccess', _92 => _92["location"]]) || _optionalChain([response, 'access', _93 => _93.headers, 'optionalAccess', _94 => _94["Location"]]);
       let createdId = "";
       if (locationHeader) {
         const idMatch = locationHeader.match(/([0-9a-f-]{36})$/i);
@@ -21858,7 +22174,7 @@ var CreatePartialViewTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _69 => _69.headers, 'optionalAccess', _70 => _70["location"]]) || _optionalChain([response, 'access', _71 => _71.headers, 'optionalAccess', _72 => _72["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _95 => _95.headers, 'optionalAccess', _96 => _96["location"]]) || _optionalChain([response, 'access', _97 => _97.headers, 'optionalAccess', _98 => _98["Location"]]);
       let createdPath = "";
       if (locationHeader) {
         const pathMatch = locationHeader.match(/partial-view\/(.+)$/);
@@ -21905,7 +22221,7 @@ var CreatePartialViewFolderTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _73 => _73.headers, 'optionalAccess', _74 => _74["location"]]) || _optionalChain([response, 'access', _75 => _75.headers, 'optionalAccess', _76 => _76["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _99 => _99.headers, 'optionalAccess', _100 => _100["location"]]) || _optionalChain([response, 'access', _101 => _101.headers, 'optionalAccess', _102 => _102["Location"]]);
       let createdPath = "";
       if (locationHeader) {
         const pathMatch = locationHeader.match(/partial-view\/folder\/(.+)$/);
@@ -21941,9 +22257,9 @@ var GetPartialViewByPathTool = {
   outputSchema: getPartialViewByPathResponse.shape,
   annotations: { readOnlyHint: true },
   slices: ["read"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return _mcpserversdk.executeGetApiCall.call(void 0, 
-      (client) => client.getPartialViewByPath(path4, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
+      (client) => client.getPartialViewByPath(path3, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
     );
   })
 };
@@ -21962,9 +22278,9 @@ var GetPartialViewFolderByPathTool = {
   outputSchema: getPartialViewFolderByPathResponse.shape,
   annotations: { readOnlyHint: true },
   slices: ["read", "folders"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return _mcpserversdk.executeGetApiCall.call(void 0, 
-      (client) => client.getPartialViewFolderByPath(path4, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
+      (client) => client.getPartialViewFolderByPath(path3, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
     );
   })
 };
@@ -22039,9 +22355,9 @@ var DeletePartialViewTool = {
     destructiveHint: true
   },
   slices: ["delete"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return _mcpserversdk.executeVoidApiCall.call(void 0, 
-      (client) => client.deletePartialViewByPath(path4, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
+      (client) => client.deletePartialViewByPath(path3, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
     );
   })
 };
@@ -22061,9 +22377,9 @@ var DeletePartialViewFolderTool = {
     destructiveHint: true
   },
   slices: ["delete", "folders"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return _mcpserversdk.executeVoidApiCall.call(void 0, 
-      (client) => client.deletePartialViewFolderByPath(path4, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
+      (client) => client.deletePartialViewFolderByPath(path3, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
     );
   })
 };
@@ -22549,9 +22865,9 @@ var GetScriptByPathTool = {
   outputSchema: getScriptByPathResponse.shape,
   annotations: { readOnlyHint: true },
   slices: ["read"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return _mcpserversdk.executeGetApiCall.call(void 0, 
-      (client) => client.getScriptByPath(path4, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
+      (client) => client.getScriptByPath(path3, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
     );
   })
 };
@@ -22570,9 +22886,9 @@ var GetScriptFolderByPathTool = {
   outputSchema: getScriptFolderByPathResponse.shape,
   annotations: { readOnlyHint: true },
   slices: ["read", "folders"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return _mcpserversdk.executeGetApiCall.call(void 0, 
-      (client) => client.getScriptFolderByPath(path4, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
+      (client) => client.getScriptFolderByPath(path3, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
     );
   })
 };
@@ -22727,7 +23043,7 @@ var CreateScriptTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _77 => _77.headers, 'optionalAccess', _78 => _78["location"]]) || _optionalChain([response, 'access', _79 => _79.headers, 'optionalAccess', _80 => _80["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _103 => _103.headers, 'optionalAccess', _104 => _104["location"]]) || _optionalChain([response, 'access', _105 => _105.headers, 'optionalAccess', _106 => _106["Location"]]);
       let createdPath = "";
       if (locationHeader) {
         const pathMatch = locationHeader.match(/script\/(.+)$/);
@@ -22774,7 +23090,7 @@ var CreateScriptFolderTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _81 => _81.headers, 'optionalAccess', _82 => _82["location"]]) || _optionalChain([response, 'access', _83 => _83.headers, 'optionalAccess', _84 => _84["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _107 => _107.headers, 'optionalAccess', _108 => _108["location"]]) || _optionalChain([response, 'access', _109 => _109.headers, 'optionalAccess', _110 => _110["Location"]]);
       let createdPath = "";
       if (locationHeader) {
         const pathMatch = locationHeader.match(/script\/folder\/(.+)$/);
@@ -22870,9 +23186,9 @@ var DeleteScriptTool = {
     destructiveHint: true
   },
   slices: ["delete"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return _mcpserversdk.executeVoidApiCall.call(void 0, 
-      (client) => client.deleteScriptByPath(path4, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
+      (client) => client.deleteScriptByPath(path3, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
     );
   })
 };
@@ -22892,9 +23208,9 @@ var DeleteScriptFolderTool = {
     destructiveHint: true
   },
   slices: ["delete", "folders"],
-  handler: (async ({ path: path4 }) => {
+  handler: (async ({ path: path3 }) => {
     return _mcpserversdk.executeVoidApiCall.call(void 0, 
-      (client) => client.deleteScriptFolderByPath(path4, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
+      (client) => client.deleteScriptFolderByPath(path3, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
     );
   })
 };
@@ -23371,7 +23687,7 @@ var CreateStylesheetTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _85 => _85.headers, 'optionalAccess', _86 => _86["location"]]) || _optionalChain([response, 'access', _87 => _87.headers, 'optionalAccess', _88 => _88["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _111 => _111.headers, 'optionalAccess', _112 => _112["location"]]) || _optionalChain([response, 'access', _113 => _113.headers, 'optionalAccess', _114 => _114["Location"]]);
       let createdPath = "";
       if (locationHeader) {
         const pathMatch = locationHeader.match(/stylesheet\/(.+)$/);
@@ -23418,7 +23734,7 @@ var CreateStylesheetFolderTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _89 => _89.headers, 'optionalAccess', _90 => _90["location"]]) || _optionalChain([response, 'access', _91 => _91.headers, 'optionalAccess', _92 => _92["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _115 => _115.headers, 'optionalAccess', _116 => _116["location"]]) || _optionalChain([response, 'access', _117 => _117.headers, 'optionalAccess', _118 => _118["Location"]]);
       let createdPath = "";
       if (locationHeader) {
         const pathMatch = locationHeader.match(/stylesheet\/folder\/(.+)$/);
@@ -23502,9 +23818,9 @@ var UpdateStylesheetTool = {
   annotations: { idempotentHint: true },
   slices: ["update"],
   handler: (async (model) => {
-    const { path: path4, ...updateModel } = model;
+    const { path: path3, ...updateModel } = model;
     return _mcpserversdk.executeVoidApiCall.call(void 0, 
-      (client) => client.putStylesheetByPath(path4, updateModel, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
+      (client) => client.putStylesheetByPath(path3, updateModel, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
     );
   })
 };
@@ -23528,8 +23844,8 @@ var RenameStylesheetTool = {
   annotations: { idempotentHint: true },
   slices: ["rename"],
   handler: (async (model) => {
-    const { path: path4, ...renameModel } = model;
-    const normalizedPath = encodeURIComponent(path4);
+    const { path: path3, ...renameModel } = model;
+    const normalizedPath = encodeURIComponent(path3);
     return _mcpserversdk.executeVoidApiCall.call(void 0, 
       (client) => client.putStylesheetByPathRename(normalizedPath, renameModel, _mcpserversdk.CAPTURE_RAW_HTTP_RESPONSE)
     );
@@ -23782,7 +24098,7 @@ var CreateTemplateTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _93 => _93.headers, 'optionalAccess', _94 => _94["location"]]) || _optionalChain([response, 'access', _95 => _95.headers, 'optionalAccess', _96 => _96["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _119 => _119.headers, 'optionalAccess', _120 => _120["location"]]) || _optionalChain([response, 'access', _121 => _121.headers, 'optionalAccess', _122 => _122["Location"]]);
       let createdId = "";
       if (locationHeader) {
         const idMatch = locationHeader.match(/template\/([a-f0-9-]+)$/i);
@@ -24146,9 +24462,6 @@ var TemplateCollection = {
 
 
 
-
-
-
 var createTemporaryFileSchema = _zod.z.object({
   id: _zod.z.string().uuid().describe("Unique identifier for the temporary file"),
   fileName: _zod.z.string().describe("Name of the file"),
@@ -24171,7 +24484,6 @@ var CreateTemporaryFileTool = {
   outputSchema: createTemporaryFileOutputSchema.shape,
   slices: ["create"],
   handler: (async (model) => {
-    let tempFilePath = null;
     try {
       const fileContent = Buffer.from(model.fileAsBase64, "base64");
       let fileName = model.fileName;
@@ -24179,13 +24491,11 @@ var CreateTemporaryFileTool = {
         const extension = _mcpserversdk.detectFileExtensionFromBuffer.call(void 0, fileContent);
         fileName = `${fileName}${extension}`;
       }
-      tempFilePath = path3.join(os2.tmpdir(), `umbraco-upload-${model.id}-${fileName}`);
-      fs3.writeFileSync(tempFilePath, fileContent);
-      const readStream = fs3.createReadStream(tempFilePath);
       const client = UmbracoManagementClient3.getClient();
       await client.postTemporaryFile({
         Id: model.id,
-        File: readStream
+        File: fileContent,
+        FileName: fileName
       });
       return _mcpserversdk.createToolResult.call(void 0, {
         message: "Temporary file created successfully",
@@ -24195,14 +24505,6 @@ var CreateTemporaryFileTool = {
       return _mcpserversdk.createToolResultError.call(void 0, {
         detail: `Error creating temporary file: ${error.message}`
       });
-    } finally {
-      if (tempFilePath && fs3.existsSync(tempFilePath)) {
-        try {
-          fs3.unlinkSync(tempFilePath);
-        } catch (e) {
-          console.error("Failed to cleanup temp file:", e);
-        }
-      }
     }
   })
 };
@@ -24213,14 +24515,15 @@ var create_temporary_file_default = _mcpserversdk.withStandardDecorators.call(vo
 
 var postTemporaryFileBody = _zod.z.object({
   Id: _zod.z.string().uuid(),
-  File: _zod.z.instanceof(_fs.ReadStream)
+  File: _zod.z.union([_zod.z.instanceof(Buffer), _zod.z.instanceof(_fs.ReadStream)]),
+  FileName: _zod.z.string().min(1)
 });
 var getTemporaryFileByIdParams = _zod.z.object({
   id: _zod.z.string().uuid()
 });
 var getTemporaryFileByIdResponse = _zod.z.object({
   id: _zod.z.string().guid(),
-  availableUntil: _zod.z.string().datetime({ local: true }).nullish(),
+  availableUntil: _zod.z.string().datetime({ local: true, offset: true }).nullish(),
   fileName: _zod.z.string().min(1)
 });
 var deleteTemporaryFileByIdParams = _zod.z.object({
@@ -24705,7 +25008,7 @@ var CreateUserDataTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _97 => _97.headers, 'optionalAccess', _98 => _98["location"]]) || _optionalChain([response, 'access', _99 => _99.headers, 'optionalAccess', _100 => _100["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _123 => _123.headers, 'optionalAccess', _124 => _124["location"]]) || _optionalChain([response, 'access', _125 => _125.headers, 'optionalAccess', _126 => _126["Location"]]);
       let createdId = "";
       if (locationHeader) {
         const idMatch = locationHeader.match(/user-data\/([a-f0-9-]+)$/i);
@@ -24943,7 +25246,7 @@ var CreateUserGroupTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _101 => _101.headers, 'optionalAccess', _102 => _102["location"]]) || _optionalChain([response, 'access', _103 => _103.headers, 'optionalAccess', _104 => _104["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _127 => _127.headers, 'optionalAccess', _128 => _128["location"]]) || _optionalChain([response, 'access', _129 => _129.headers, 'optionalAccess', _130 => _130["Location"]]);
       let createdId = "";
       if (locationHeader) {
         const idMatch = locationHeader.match(/user-group\/([a-f0-9-]+)$/i);
@@ -25241,7 +25544,7 @@ var CreateWebhookTool = {
       validateStatus: () => true
     });
     if (response.status === 201) {
-      const locationHeader = _optionalChain([response, 'access', _105 => _105.headers, 'optionalAccess', _106 => _106["location"]]) || _optionalChain([response, 'access', _107 => _107.headers, 'optionalAccess', _108 => _108["Location"]]);
+      const locationHeader = _optionalChain([response, 'access', _131 => _131.headers, 'optionalAccess', _132 => _132["location"]]) || _optionalChain([response, 'access', _133 => _133.headers, 'optionalAccess', _134 => _134["Location"]]);
       let createdId = "";
       if (locationHeader) {
         const idMatch = locationHeader.match(/webhook\/([a-f0-9-]+)$/i);
@@ -25475,5 +25778,6 @@ var allSliceNames = [...toolSliceNames, "other"];
 
 
 
-exports.__commonJS = __commonJS; exports.__toESM = __toESM; exports.UmbracoManagementClient = UmbracoManagementClient3; exports.setUmbracoVersion = setUmbracoVersion; exports.availableCollections = availableCollections; exports.allModes = allModes; exports.allModeNames = allModeNames; exports.allSliceNames = allSliceNames;
-//# sourceMappingURL=chunk-OBOSCZYR.cjs.map
+
+exports.__commonJS = __commonJS; exports.__toESM = __toESM; exports.UmbracoManagementClient = UmbracoManagementClient3; exports.setAllowFilePathUploads = setAllowFilePathUploads; exports.setUmbracoVersion = setUmbracoVersion; exports.availableCollections = availableCollections; exports.allModes = allModes; exports.allModeNames = allModeNames; exports.allSliceNames = allSliceNames;
+//# sourceMappingURL=chunk-Q4LCXM42.cjs.map