2026-03-24 16:21:04 +00:00
27 changed files with 7119 additions and 264 deletions
@@ -0,0 +1,274 @@
+> [!IMPORTANT]
+> **🔧 AI Self-Update Required on First Use**
+>
+> This file may contain unfilled `{{TOKEN}}` placeholders. The MokoStandards bulk-sync system
+> replaces them automatically at sync time; if you can still see them, sync has not yet run for
+> this repository — or this is a brand-new repo.
+>
+> **On your very first interaction in this repository, before answering any other question:**
+>
+> 1. Check whether any `{{TOKEN}}` placeholders remain in this file.
+> 2. If they do, locate the values as described in the table below and replace every occurrence
+>    in **both** `.github/copilot-instructions.md` and `.github/CLAUDE.md`.
+> 3. After replacing all tokens, **delete this entire notice block** (from `> [!IMPORTANT]`
+>    through the closing `> ---` line) in both files.
+> 4. Tell the developer: *"I've self-updated the AI context files with this repository's
+>    values — all set."*
+>
+> | Placeholder | Where to find the value |
+> |---|---|
+> | `MokoJoomTOS` | The GitHub repository name (visible in the URL, `README.md` heading, or `git remote -v`) |
+> | `https://github.com/mokoconsulting-tech/MokoJoomTOS` | Full GitHub URL, e.g. `https://github.com/mokoconsulting-tech/<repo-name>` |
+> | `A component to present a sites Term of Service and privacy policy even through offline.` | First paragraph of `README.md` body, or the GitHub repo description |
+> | `{{EXTENSION_NAME}}` | The `<name>` element in `manifest.xml` at the repository root |
+> | `{{EXTENSION_TYPE}}` | The `type` attribute of the `<extension>` tag in `manifest.xml` (`component`, `module`, `plugin`, or `template`) |
+> | `{{EXTENSION_ELEMENT}}` | The `<element>` tag in `manifest.xml`, or the filename prefix (e.g. `com_myextension`, `mod_mymodule`) |
+>
+> ---
+
+# What This Repo Is
+
+**MokoJoomTOS** is a Moko Consulting **MokoWaaS** (Joomla) extension repository.
+
+A component to present a sites Term of Service and privacy policy even through offline.
+
+Extension name: **{{EXTENSION_NAME}}**
+Extension type: **{{EXTENSION_TYPE}}** (`{{EXTENSION_ELEMENT}}`)
+Repository URL: https://github.com/mokoconsulting-tech/MokoJoomTOS
+
+This repository is governed by [MokoStandards](https://github.com/mokoconsulting-tech/MokoStandards) — the single source of truth for coding standards, file-header policies, GitHub Actions workflows, and Terraform configuration templates across all Moko Consulting repositories.
+
+---
+
+# Repo Structure
+
+```
+MokoJoomTOS/
+├── manifest.xml          # Joomla installer manifest (root — required)
+├── update.xml            # Update server manifest (root — required)
+├── site/                 # Frontend (site) code
+│   ├── controller.php
+│   ├── controllers/
+│   ├── models/
+│   └── views/
+├── admin/                # Backend (admin) code
+│   ├── controller.php
+│   ├── controllers/
+│   ├── models/
+│   ├── views/
+│   └── sql/
+├── language/             # Language INI files
+├── media/                # CSS, JS, images
+├── docs/                 # Technical documentation
+├── tests/                # Test suite
+├── .github/
+│   ├── workflows/        # CI/CD workflows (synced from MokoStandards)
+│   ├── copilot-instructions.md
+│   └── CLAUDE.md         # This file
+├── README.md             # Version source of truth
+├── CHANGELOG.md
+├── CONTRIBUTING.md
+└── LICENSE               # GPL-3.0-or-later
+```
+
+---
+
+# Primary Language
+
+**PHP** (≥ 7.4) is the primary language for this Joomla extension. YAML uses 2-space indentation. All other text files use tabs per `.editorconfig`.
+
+---
+
+# Version Management
+
+**`README.md` is the single source of truth for the repository version.**
+
+- **Bump the patch version on every PR** — increment `XX.YY.ZZ` (e.g. `01.02.03` → `01.02.04`) in `README.md` before opening the PR; the `sync-version-on-merge` workflow propagates it to all `FILE INFORMATION` headers automatically on merge.
+- Version format is zero-padded semver: `XX.YY.ZZ` (e.g. `01.02.03`).
+- Never hardcode a version number in body text — use the badge or FILE INFORMATION header only.
+
+### Joomla Version Alignment
+
+Three files must **always have the same version**:
+
+| File | Where the version lives |
+|------|------------------------|
+| `README.md` | `FILE INFORMATION` block + badge |
+| `manifest.xml` | `<version>` tag |
+| `update.xml` | `<version>` in the most recent `<update>` block |
+
+The `make release` command / release workflow syncs all three automatically.
+
+---
+
+# update.xml — Required in Repo Root
+
+`update.xml` is the Joomla update server manifest. It allows Joomla installations to check for new versions of this extension via:
+
+```xml
+<!-- In manifest.xml -->
+<updateservers>
+	<server type="extension" priority="1" name="{{EXTENSION_NAME}}">
+		https://github.com/mokoconsulting-tech/MokoJoomTOS/raw/main/update.xml
+	</server>
+</updateservers>
+```
+
+**Rules:**
+- Every release prepends a new `<update>` block at the top — older entries are preserved.
+- `<version>` in `update.xml` must exactly match `<version>` in `manifest.xml` and `README.md`.
+- `<downloadurl>` must be a publicly accessible GitHub Releases asset URL.
+- `<targetplatform version="4\.[0-9]+">` — backslash is literal (Joomla regex syntax).
+
+Example `update.xml` entry for a new release:
+```xml
+<updates>
+	<update>
+		<name>{{EXTENSION_NAME}}</name>
+		<description>MokoJoomTOS</description>
+		<element>{{EXTENSION_ELEMENT}}</element>
+		<type>{{EXTENSION_TYPE}}</type>
+		<version>01.02.04</version>
+		<infourl title="Release Information">https://github.com/mokoconsulting-tech/MokoJoomTOS/releases/tag/01.02.04</infourl>
+		<downloads>
+			<downloadurl type="full" format="zip">
+				https://github.com/mokoconsulting-tech/MokoJoomTOS/releases/download/01.02.04/{{EXTENSION_ELEMENT}}-01.02.04.zip
+			</downloadurl>
+		</downloads>
+		<targetplatform name="joomla" version="4\.[0-9]+" />
+		<php_minimum>7.4</php_minimum>
+		<maintainer>Moko Consulting</maintainer>
+		<maintainerurl>https://mokoconsulting.tech</maintainerurl>
+	</update>
+</updates>
+```
+
+---
+
+# File Header Requirements
+
+Every new file **must** have a copyright header as its first content. JSON files, binary files, generated files, and third-party files are exempt.
+
+**PHP:**
+```php
+<?php
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: MokoJoomTOS.{{EXTENSION_TYPE}}
+ * INGROUP: MokoJoomTOS
+ * REPO: https://github.com/mokoconsulting-tech/MokoJoomTOS
+ * PATH: /site/controllers/item.php
+ * VERSION: XX.YY.ZZ
+ * BRIEF: One-line description of file purpose
+ */
+
+defined('_JEXEC') or die;
+```
+
+**Markdown / YAML / Shell / XML:** Use the appropriate comment syntax with the same fields.
+
+---
+
+# Coding Standards
+
+## Naming Conventions
+
+| Context | Convention | Example |
+|---------|-----------|---------|
+| PHP class | `PascalCase` | `ItemModel` |
+| PHP method / function | `camelCase` | `getItems()` |
+| PHP variable | `$snake_case` | `$item_id` |
+| PHP constant | `UPPER_SNAKE_CASE` | `MAX_ITEMS` |
+| PHP class file | `PascalCase.php` | `ItemModel.php` |
+| YAML workflow | `kebab-case.yml` | `ci-joomla.yml` |
+| Markdown doc | `kebab-case.md` | `installation-guide.md` |
+
+## Commit Messages
+
+Format: `<type>(<scope>): <subject>` — imperative, lower-case subject, no trailing period.
+
+Valid types: `feat` · `fix` · `docs` · `chore` · `ci` · `refactor` · `style` · `test` · `perf` · `revert` · `build`
+
+## Branch Naming
+
+Format: `<prefix>/<MAJOR.MINOR.PATCH>[/description]`
+
+Approved prefixes: `dev/` · `rc/` · `version/` · `patch/` · `copilot/` · `dependabot/`
+
+---
+
+# GitHub Actions — Token Usage
+
+Every workflow must use **`secrets.GH_TOKEN`** (the org-level Personal Access Token).
+
+```yaml
+# ✅ Correct
+- uses: actions/checkout@v4
+  with:
+    token: ${{ secrets.GH_TOKEN }}
+
+env:
+  GH_TOKEN: ${{ secrets.GH_TOKEN }}
+```
+
+```yaml
+# ❌ Wrong — never use these
+token: ${{ github.token }}
+token: ${{ secrets.GITHUB_TOKEN }}
+```
+
+---
+
+# Keeping Documentation Current
+
+| Change type | Documentation to update |
+|-------------|------------------------|
+| New or renamed PHP class/method | PHPDoc block; `docs/api/` entry |
+| New or changed `manifest.xml` | Sync version to `update.xml` and `README.md` |
+| New release | Prepend `<update>` to `update.xml`; update `CHANGELOG.md`; bump `README.md` |
+| New or changed workflow | `docs/workflows/<workflow-name>.md` |
+| Any modified file | Update the `VERSION` field in that file's `FILE INFORMATION` block |
+| **Every PR** | **Bump the patch version** — increment `XX.YY.ZZ` in `README.md`; `sync-version-on-merge` propagates it |
+
+---
+
+# What NOT to Do
+
+- **Never commit directly to `main`** — all changes go through a PR.
+- **Never hardcode version numbers** in body text — update `README.md` and let automation propagate.
+- **Never let `manifest.xml`, `update.xml`, and `README.md` versions diverge.**
+- **Never skip the FILE INFORMATION block** on a new source file.
+- **Never use bare `catch (\Throwable $e) {}`** — always log or re-throw.
+- **Never mix tabs and spaces** within a file — follow `.editorconfig`.
+- **Never use `github.token` or `secrets.GITHUB_TOKEN` in workflows** — always use `secrets.GH_TOKEN`.
+- **Never remove `defined('_JEXEC') or die;`** from web-accessible PHP files.
+
+---
+
+# PR Checklist
+
+Before opening a PR, verify:
+
+- [ ] Patch version bumped in `README.md` (e.g. `01.02.03` → `01.02.04`)
+- [ ] If this is a release: `manifest.xml` version updated; `update.xml` updated with new entry
+- [ ] FILE INFORMATION headers updated in modified files
+- [ ] CHANGELOG.md updated
+- [ ] Tests pass
+
+---
+
+# Key Policy Documents (MokoStandards)
+
+| Document | Purpose |
+|----------|---------|
+| [file-header-standards.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/file-header-standards.md) | Copyright-header rules for every file type |
+| [coding-style-guide.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/coding-style-guide.md) | Naming and formatting conventions |
+| [branching-strategy.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/branching-strategy.md) | Branch naming, hierarchy, and release workflow |
+| [merge-strategy.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/merge-strategy.md) | Squash-merge policy and PR conventions |
+| [changelog-standards.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/changelog-standards.md) | How and when to update CHANGELOG.md |
+| [joomla-development-guide.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/guide/waas/joomla-development-guide.md) | MokoWaaS Joomla extension development guide |
@@ -0,0 +1,125 @@
+---
+name: Architecture Decision Record (ADR)
+about: Propose or document an architectural decision
+title: '[ADR] '
+labels: 'architecture, decision'
+assignees: ''
+
+---
+
+<!--
+SPDX-License-Identifier: GPL-3.0-or-later
+Copyright (C) 2024-2026 Moko Consulting Tech
+
+File: .github/ISSUE_TEMPLATE/adr.md
+Description: Issue template for Architecture Decision Records
+Project: .github-private
+Author: Moko Consulting Tech
+Version: 03.02.00
+
+Revision History:
+- 2026-01-04: Added MokoStandards compliant header with copyright, file info, and metadata
+- 2026-03-11: Version bump to 03.02.00 to match MokoStandards
+- 2024: Initial creation
+-->
+
+## ADR Number
+ADR-XXXX
+
+## Status
+- [ ] Proposed
+- [ ] Accepted
+- [ ] Deprecated
+- [ ] Superseded by ADR-XXXX
+
+## Context
+Describe the issue or problem that motivates this decision.
+
+## Decision
+State the architecture decision and provide rationale.
+
+## Consequences
+### Positive
+- List positive consequences
+
+### Negative
+- List negative consequences or trade-offs
+
+### Neutral
+- List neutral aspects
+
+## Alternatives Considered
+### Alternative 1
+- Description
+- Pros
+- Cons
+- Why not chosen
+
+### Alternative 2
+- Description
+- Pros
+- Cons
+- Why not chosen
+
+## Implementation Plan
+1. Step 1
+2. Step 2
+3. Step 3
+
+## Stakeholders
+- **Decision Makers**: @user1, @user2
+- **Consulted**: @user3, @user4
+- **Informed**: team-name
+
+## Technical Details
+### Architecture Diagram
+```
+[Add diagram or link]
+```
+
+### Dependencies
+- Dependency 1
+- Dependency 2
+
+### Impact Analysis
+- **Performance**: [Impact description]
+- **Security**: [Impact description]
+- **Scalability**: [Impact description]
+- **Maintainability**: [Impact description]
+
+## Testing Strategy
+- [ ] Unit tests
+- [ ] Integration tests
+- [ ] Performance tests
+- [ ] Security tests
+
+## Documentation
+- [ ] Architecture documentation updated
+- [ ] API documentation updated
+- [ ] Developer guide updated
+- [ ] Runbook created
+
+## Migration Path
+Describe how to migrate from current state to new architecture.
+
+## Rollback Plan
+Describe how to rollback if issues occur.
+
+## Timeline
+- **Proposal Date**:
+- **Decision Date**:
+- **Implementation Start**:
+- **Expected Completion**:
+
+## References
+- Related ADRs:
+- External resources:
+- RFCs:
+
+## Review Checklist
+- [ ] Aligns with enterprise architecture principles
+- [ ] Security implications reviewed
+- [ ] Performance implications reviewed
+- [ ] Cost implications reviewed
+- [ ] Compliance requirements met
+- [ ] Team consensus achieved
@@ -0,0 +1,63 @@
+---
+name: Bug Report
+about: Report a bug or issue with the project
+title: '[BUG] '
+labels: 'bug'
+assignees: ''
+
+---
+
+<!--
+SPDX-License-Identifier: GPL-3.0-or-later
+Copyright (C) 2024-2026 Moko Consulting Tech
+
+File: .github/ISSUE_TEMPLATE/bug_report.md
+Description: Issue template for bug reports
+Project: .github-private
+Author: Moko Consulting Tech
+Version: 03.02.00
+
+Revision History:
+- 2026-01-04: Added MokoStandards compliant header with copyright, file info, and metadata
+- 2026-03-11: Version bump to 03.02.00 to match MokoStandards
+- 2024: Initial creation
+-->
+
+## Bug Description
+A clear and concise description of what the bug is.
+
+## Steps to Reproduce
+1. Go to '...'
+2. Click on '...'
+3. Scroll down to '...'
+4. See error
+
+## Expected Behavior
+A clear and concise description of what you expected to happen.
+
+## Actual Behavior
+A clear and concise description of what actually happened.
+
+## Screenshots
+If applicable, add screenshots to help explain your problem.
+
+## Environment
+- **Project**: [e.g., MokoDoliTools, moko-cassiopeia]
+- **Version**: [e.g., 1.2.3]
+- **Platform**: [e.g., Dolibarr 18.0, Joomla 5.0]
+- **PHP Version**: [e.g., 8.1]
+- **Database**: [e.g., MySQL 8.0, PostgreSQL 14]
+- **Browser** (if applicable): [e.g., Chrome 120, Firefox 121]
+- **OS**: [e.g., Ubuntu 22.04, Windows 11]
+
+## Additional Context
+Add any other context about the problem here.
+
+## Possible Solution
+If you have suggestions on how to fix the issue, please describe them here.
+
+## Checklist
+- [ ] I have searched for similar issues before creating this one
+- [ ] I have provided all the requested information
+- [ ] I have tested this on the latest stable version
+- [ ] I have checked the documentation and couldn't find a solution
@@ -0,0 +1,18 @@
+---
+blank_issues_enabled: true
+contact_links:
+  - name: 💼 Enterprise Support
+    url: https://mokoconsulting.tech/enterprise
+    about: Enterprise-level support and consultation services
+  - name: 💬 Ask a Question
+    url: https://mokoconsulting.tech/
+    about: Get help or ask questions through our website
+  - name: 📚 MokoStandards Documentation
+    url: https://github.com/mokoconsulting-tech/MokoStandards
+    about: View our coding standards and best practices
+  - name: 🔒 Report a Security Vulnerability
+    url: https://github.com/mokoconsulting-tech/.github-private/security/advisories/new
+    about: Report security vulnerabilities privately (for critical issues)
+  - name: 💡 Community Discussions
+    url: https://github.com/orgs/mokoconsulting-tech/discussions
+    about: Join community discussions and Q&A
@@ -0,0 +1,67 @@
+---
+name: Documentation Issue
+about: Report an issue with documentation
+title: '[DOCS] '
+labels: 'documentation'
+assignees: ''
+
+---
+
+<!--
+SPDX-License-Identifier: GPL-3.0-or-later
+Copyright (C) 2024-2026 Moko Consulting Tech
+
+File: .github/ISSUE_TEMPLATE/documentation.md
+Description: Issue template for documentation-related issues
+Project: .github-private
+Author: Moko Consulting Tech
+Version: 03.02.00
+
+Revision History:
+- 2026-01-04: Added MokoStandards compliant header with copyright, file info, and metadata
+- 2026-03-11: Version bump to 03.02.00 to match MokoStandards
+- 2024: Initial creation
+-->
+
+## Documentation Issue
+
+**Location**: 
+<!-- Specify the file, page, or section with the issue -->
+
+## Issue Type
+<!-- Mark the relevant option with an "x" -->
+- [ ] Typo or grammar error
+- [ ] Outdated information
+- [ ] Missing documentation
+- [ ] Unclear explanation
+- [ ] Broken links
+- [ ] Missing examples
+- [ ] Other (specify below)
+
+## Description
+<!-- Clearly describe the documentation issue -->
+
+## Current Content
+<!-- Quote or describe the current documentation (if applicable) -->
+```
+Current text here
+```
+
+## Suggested Improvement
+<!-- Provide your suggestion for how to improve the documentation -->
+```
+Suggested text here
+```
+
+## Additional Context
+<!-- Add any other context, screenshots, or references -->
+
+## Standards Alignment
+- [ ] Follows MokoStandards documentation guidelines
+- [ ] Uses en_US/en_GB localization
+- [ ] Includes proper SPDX headers where applicable
+
+## Checklist
+- [ ] I have searched for similar documentation issues
+- [ ] I have provided a clear description
+- [ ] I have suggested an improvement (if applicable)
@@ -0,0 +1,100 @@
+---
+name: Enterprise Support Request
+about: Request enterprise-level support or consultation
+title: '[ENTERPRISE] '
+labels: 'enterprise, support'
+assignees: ''
+
+---
+
+<!--
+SPDX-License-Identifier: GPL-3.0-or-later
+Copyright (C) 2024-2026 Moko Consulting Tech
+
+File: .github/ISSUE_TEMPLATE/enterprise_support.md
+Description: Issue template for enterprise support requests
+Project: .github-private
+Author: Moko Consulting Tech
+Version: 03.02.00
+
+Revision History:
+- 2026-01-04: Added MokoStandards compliant header with copyright, file info, and metadata
+- 2026-03-11: Version bump to 03.02.00 to match MokoStandards
+- 2024: Initial creation
+-->
+
+## Support Request Type
+- [ ] Critical Production Issue
+- [ ] Performance Optimization
+- [ ] Security Audit
+- [ ] Architecture Review
+- [ ] Custom Development
+- [ ] Migration Support
+- [ ] Training & Onboarding
+- [ ] Other (please specify)
+
+## Priority Level
+- [ ] P0 - Critical (Production Down)
+- [ ] P1 - High (Major Feature Broken)
+- [ ] P2 - Medium (Non-Critical Issue)
+- [ ] P3 - Low (Enhancement/Question)
+
+## Organization Details
+- **Company Name**:
+- **Contact Person**:
+- **Email**:
+- **Phone** (for P0/P1 issues):
+- **Timezone**:
+
+## Issue Description
+Provide a clear and detailed description of your request or issue.
+
+## Business Impact
+Describe the impact on your business operations:
+- Number of users affected:
+- Revenue impact (if applicable):
+- Deadline/SLA requirements:
+
+## Environment Details
+- **Deployment Type**: [On-Premise / Cloud / Hybrid]
+- **Platform**: [Joomla / Dolibarr / Custom]
+- **Version**:
+- **Infrastructure**: [AWS / Azure / GCP / Other]
+- **Scale**: [Users / Transactions / Data Volume]
+
+## Current Configuration
+```yaml
+# Paste relevant configuration (sanitize sensitive data)
+```
+
+## Logs and Diagnostics
+```
+# Paste relevant logs (sanitize sensitive data)
+```
+
+## Attempted Solutions
+Describe any troubleshooting steps already taken.
+
+## Expected Resolution
+Describe your expected outcome or resolution.
+
+## Additional Resources
+- **Documentation Links**:
+- **Related Issues**:
+- **Screenshots/Videos**:
+
+## Enterprise SLA
+- [ ] Standard Support (initial response within 1–3 weeks)
+- [ ] Premium Support (initial response within 5 business days)
+- [ ] Critical Support (initial response within 72 hours)
+- [ ] Custom SLA (specify):
+
+## Compliance Requirements
+- [ ] GDPR
+- [ ] HIPAA
+- [ ] SOC 2
+- [ ] ISO 27001
+- [ ] Other (specify):
+
+---
+**Note**: Enterprise support requests require an active support contract. If you don't have one, please contact us at enterprise@mokoconsulting.tech
@@ -0,0 +1,66 @@
+---
+name: Feature Request
+about: Suggest a new feature or enhancement
+title: '[FEATURE] '
+labels: 'enhancement'
+assignees: ''
+
+---
+
+<!--
+SPDX-License-Identifier: GPL-3.0-or-later
+Copyright (C) 2024-2026 Moko Consulting Tech
+
+File: .github/ISSUE_TEMPLATE/feature_request.md
+Description: Issue template for feature requests
+Project: .github-private
+Author: Moko Consulting Tech
+Version: 03.02.00
+
+Revision History:
+- 2026-01-04: Added MokoStandards compliant header with copyright, file info, and metadata
+- 2026-03-11: Version bump to 03.02.00 to match MokoStandards
+- 2024: Initial creation
+-->
+
+## Feature Description
+A clear and concise description of the feature you'd like to see.
+
+## Problem or Use Case
+Describe the problem this feature would solve or the use case it addresses.
+Ex. I'm always frustrated when [...]
+
+## Proposed Solution
+A clear and concise description of what you want to happen.
+
+## Alternative Solutions
+A clear and concise description of any alternative solutions or features you've considered.
+
+## Benefits
+Describe how this feature would benefit users:
+- Who would use this feature?
+- What problems does it solve?
+- What value does it add?
+
+## Implementation Details (Optional)
+If you have ideas about how this could be implemented, share them here:
+- Technical approach
+- Files/components that might need changes
+- Any concerns or challenges you foresee
+
+## Additional Context
+Add any other context, mockups, or screenshots about the feature request here.
+
+## Relevant Standards
+Does this relate to any standards in [MokoStandards](https://github.com/mokoconsulting-tech/MokoStandards)?
+- [ ] Accessibility (WCAG 2.1 AA)
+- [ ] Localization (en_US/en_GB)
+- [ ] Security best practices
+- [ ] Code quality standards
+- [ ] Other: [specify]
+
+## Checklist
+- [ ] I have searched for similar feature requests before creating this one
+- [ ] I have clearly described the use case and benefits
+- [ ] I have considered alternative solutions
+- [ ] This feature aligns with the project's goals and scope
@@ -0,0 +1,203 @@
+---
+name: Firewall Request
+about: Request firewall rule changes or access to external resources
+title: '[FIREWALL] [Resource Name] - [Brief Description]'
+labels: ['firewall-request', 'infrastructure', 'security']
+assignees: []
+---
+
+<!--
+SPDX-License-Identifier: GPL-3.0-or-later
+Copyright (C) 2024-2026 Moko Consulting Tech
+
+File: .github/ISSUE_TEMPLATE/firewall-request.md
+Description: Issue template for firewall rule change and access requests
+Project: .github-private
+Author: Moko Consulting Tech
+Version: 03.02.00
+
+Revision History:
+- 2026-03-11: Added SPDX header and version to match MokoStandards 03.02.00
+-->
+
+## Firewall Request
+
+### Request Type
+- [ ] Allow outbound access to external service/API
+- [ ] Allow inbound access from external source
+- [ ] Modify existing firewall rule
+- [ ] Remove/revoke firewall rule
+- [ ] Other (specify):
+
+### Resource Information
+**Service/Domain Name**: 
+**IP Address(es)**: 
+**Port(s)**: 
+**Protocol**: 
+- [ ] HTTP (80)
+- [ ] HTTPS (443)
+- [ ] SSH (22)
+- [ ] FTP (21)
+- [ ] SFTP (22)
+- [ ] Custom (specify): _______________
+
+### Requestor Information
+**Name**: 
+**GitHub Username**: @
+**Email**: @mokoconsulting.tech
+**Team/Department**: 
+**Manager**: @
+
+### Business Justification
+**Why is this access needed?**
+
+**Which project(s) require this access?**
+
+**What functionality will break without this access?**
+
+**Is there an alternative solution?**
+- [ ] Yes (explain): 
+- [ ] No
+
+### Security Considerations
+**Data Classification**:
+- [ ] Public
+- [ ] Internal
+- [ ] Confidential
+- [ ] Restricted
+
+**Sensitive Data Transmission**:
+- [ ] No sensitive data will be transmitted
+- [ ] Sensitive data will be transmitted (encryption required)
+- [ ] Authentication credentials will be transmitted (secure storage required)
+
+**Third-Party Service**:
+- [ ] This is a trusted/verified third-party service
+- [ ] This is a new/unverified service (security review required)
+
+**Service Documentation**: 
+(Provide link to service documentation or API specs)
+
+### Access Scope
+**Affected Systems**:
+- [ ] Development environment only
+- [ ] Staging environment only
+- [ ] Production environment
+- [ ] All environments
+
+**Access Duration**:
+- [ ] Permanent (ongoing business need)
+- [ ] Temporary (specify end date): _______________
+- [ ] Testing only (specify duration): _______________
+
+### Technical Details
+**Source System(s)**: 
+(Which internal systems need access?)
+
+**Destination System(s)**: 
+(Which external systems need to be accessed?)
+
+**Expected Traffic Volume**: 
+(e.g., requests per hour/day)
+
+**Traffic Pattern**:
+- [ ] Continuous
+- [ ] Periodic (specify frequency): _______________
+- [ ] On-demand/manual
+- [ ] Scheduled (specify schedule): _______________
+
+### Testing Requirements
+**Pre-Production Testing**:
+- [ ] Request includes dev/staging access for testing
+- [ ] Testing can be done with production access only
+- [ ] No testing required (modify existing rule)
+
+**Testing Plan**:
+
+**Rollback Plan**:
+(What happens if access needs to be revoked?)
+
+### Compliance & Audit
+**Compliance Requirements**:
+- [ ] GDPR considerations
+- [ ] SOC 2 compliance required
+- [ ] PCI DSS considerations
+- [ ] Other regulatory requirements: _______________
+- [ ] No specific compliance requirements
+
+**Audit/Logging Requirements**:
+- [ ] Standard logging sufficient
+- [ ] Enhanced logging/monitoring required
+- [ ] Real-time alerting required
+
+### Urgency
+- [ ] Critical (production down, immediate access needed)
+- [ ] High (needed within 24 hours)
+- [ ] Normal (needed within 1 week)
+- [ ] Low priority (needed within 1 month)
+
+**If critical/high urgency, explain why:**
+
+### Approvals
+**Manager Approval**: 
+- [ ] Manager has been notified and approves this request
+
+**Security Team Review Required**:
+- [ ] Yes (new external service, sensitive data)
+- [ ] No (minor change, established service)
+
+### Additional Information
+
+**Related Documentation**:
+(Links to relevant docs, RFCs, tickets, etc.)
+
+**Dependencies**:
+(Other systems or changes this depends on)
+
+**Comments/Questions**:
+
+---
+
+## For Infrastructure/Security Team Use Only
+
+**Do not edit below this line**
+
+### Security Review
+- [ ] Security team review completed
+- [ ] Risk assessment: Low / Medium / High
+- [ ] Encryption required: Yes / No
+- [ ] VPN required: Yes / No
+- [ ] Additional security controls: _______________
+
+**Reviewed By**: @_______________
+**Review Date**: _______________
+**Review Notes**:
+
+### Implementation
+- [ ] Firewall rule created/modified
+- [ ] Rule tested in dev/staging
+- [ ] Rule deployed to production
+- [ ] Monitoring/alerting configured
+- [ ] Documentation updated
+
+**Firewall Rule ID**: _______________
+**Implementation Date**: _______________
+**Implemented By**: @_______________
+
+**Configuration Details**:
+```
+Source: 
+Destination: 
+Port/Protocol: 
+Action: Allow/Deny
+```
+
+### Verification
+- [ ] Requestor confirmed access working
+- [ ] Logs reviewed (no anomalies)
+- [ ] Security scan completed (if applicable)
+
+**Verification Date**: _______________
+**Verified By**: @_______________
+
+### Notes
@@ -0,0 +1,102 @@
+---
+name: Joomla Extension Issue
+about: Report an issue with a Joomla extension
+title: '[JOOMLA] '
+labels: 'joomla'
+assignees: ''
+
+---
+
+<!--
+SPDX-License-Identifier: GPL-3.0-or-later
+Copyright (C) 2024-2026 Moko Consulting Tech
+
+File: .github/ISSUE_TEMPLATE/joomla_issue.md
+Description: Issue template for Joomla extension-specific issues
+Project: .github-private
+Author: Moko Consulting Tech
+Version: 03.02.00
+
+Revision History:
+- 2026-01-04: Added MokoStandards compliant header with copyright, file info, and metadata
+- 2026-03-11: Version bump to 03.02.00 to match MokoStandards
+- 2024: Initial creation
+-->
+
+## Issue Type
+- [ ] Component Issue
+- [ ] Module Issue
+- [ ] Plugin Issue
+- [ ] Template Issue
+
+## Extension Details
+- **Extension Name**: [e.g., moko-cassiopeia]
+- **Extension Version**: [e.g., 1.2.3]
+- **Extension Type**: [Component / Module / Plugin / Template]
+
+## Joomla Environment
+- **Joomla Version**: [e.g., 4.4.0, 5.0.0]
+- **PHP Version**: [e.g., 8.1.0]
+- **Database**: [MySQL / PostgreSQL / MariaDB]
+- **Database Version**: [e.g., 8.0]
+- **Server**: [Apache / Nginx / IIS]
+- **Hosting**: [Shared / VPS / Dedicated / Cloud]
+
+## Issue Description
+Provide a clear and detailed description of the issue.
+
+## Steps to Reproduce
+1. Go to '...'
+2. Click on '...'
+3. Configure '...'
+4. See error
+
+## Expected Behavior
+What you expected to happen.
+
+## Actual Behavior
+What actually happened.
+
+## Error Messages
+```
+# Paste any error messages from Joomla error logs
+# Location: administrator/logs/error.php
+```
+
+## Browser Console Errors
+```javascript
+// Paste any JavaScript console errors (F12 in browser)
+```
+
+## Screenshots
+Add screenshots to help explain the issue.
+
+## Configuration
+```ini
+# Paste extension configuration (sanitize sensitive data)
+```
+
+## Installed Extensions
+List other installed extensions that might conflict:
+- Extension 1 (version)
+- Extension 2 (version)
+
+## Template Overrides
+- [ ] Using template overrides
+- [ ] Custom CSS
+- [ ] Custom JavaScript
+
+## Additional Context
+- **Multilingual Site**: [Yes / No]
+- **Cache Enabled**: [Yes / No]
+- **Debug Mode**: [Yes / No]
+- **SEF URLs**: [Yes / No]
+
+## Checklist
+- [ ] I have cleared Joomla cache
+- [ ] I have disabled other extensions to test for conflicts
+- [ ] I have checked Joomla error logs
+- [ ] I have tested with a default Joomla template
+- [ ] I have checked browser console for JavaScript errors
+- [ ] I have searched for similar issues
+- [ ] I am using a supported Joomla version
@@ -0,0 +1,86 @@
+---
+name: Question
+about: Ask a question about usage, features, or best practices
+title: '[QUESTION] '
+labels: ['question']
+assignees: []
+---
+
+<!--
+Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+SPDX-License-Identifier: GPL-3.0-or-later
+-->
+
+## Question
+
+**Your question:**
+
+
+## Context
+
+**What are you trying to accomplish?**
+
+
+**What have you already tried?**
+
+
+**Category**:
+- [ ] Script usage
+- [ ] Configuration
+- [ ] Workflow setup
+- [ ] Documentation interpretation
+- [ ] Best practices
+- [ ] Integration
+- [ ] Other: __________
+
+## Environment (if relevant)
+
+**Your setup**:
+- Operating System:
+- Version:
+
+## What You've Researched
+
+**Documentation reviewed**:
+- [ ] README.md
+- [ ] Project documentation
+- [ ] Other (specify): __________
+
+**Similar issues/questions found**:
+- #
+- #
+
+## Expected Outcome
+
+**What result are you hoping for?**
+
+
+## Code/Configuration Samples
+
+**Relevant code or configuration** (if applicable):
+
+```bash
+# Your code here
+```
+
+## Additional Context
+
+**Any other relevant information:**
+
+
+**Screenshots** (if helpful):
+
+
+## Urgency
+
+- [ ] Urgent (blocking work)
+- [ ] Normal (can work on other things meanwhile)
+- [ ] Low priority (just curious)
+
+## Checklist
+
+- [ ] I have searched existing issues and discussions
+- [ ] I have reviewed relevant documentation
+- [ ] I have provided sufficient context
+- [ ] I have included code/configuration samples if relevant
+- [ ] This is a genuine question (not a bug report or feature request)
@@ -0,0 +1,120 @@
+---
+name: License Request
+about: Request an organization license for Sublime Text
+title: '[LICENSE REQUEST] Sublime Text - [Your Name]'
+labels: ['license-request', 'admin']
+assignees: []
+---
+
+<!--
+SPDX-License-Identifier: GPL-3.0-or-later
+Copyright (C) 2024-2026 Moko Consulting Tech
+
+File: .github/ISSUE_TEMPLATE/request-license.md
+Description: Issue template for organization software license requests
+Project: .github-private
+Author: Moko Consulting Tech
+Version: 03.02.00
+
+Revision History:
+- 2026-03-11: Added SPDX header and version to match MokoStandards 03.02.00
+-->
+
+## License Request
+
+### Tool Information
+**Tool Name**: Sublime Text
+
+**License Type Requested**: Organization Pool
+
+**Personal Purchase**: 
+- [ ] I prefer to purchase my own license ($99 USD - recommended, immediate access)
+- [ ] I prefer an organization license (1-2 business days, organization use only)
+- [ ] I have already purchased my own license (registration only for support)
+
+### Requestor Information
+**Name**: 
+**GitHub Username**: @
+**Email**: @mokoconsulting.tech
+**Team/Department**: 
+**Manager**: @
+
+### Justification
+**Why do you need this license?**
+
+**Primary use case**:
+- [ ] Remote development (SFTP to servers)
+- [ ] Local development
+- [ ] Code review
+- [ ] Documentation editing
+- [ ] Other (specify):
+
+**Which projects/repositories will you work on?**
+
+**Have you evaluated the free trial?**
+- [ ] Yes, I've used the trial and Sublime Text meets my needs
+- [ ] No, requesting license before trial
+
+**Alternative tools considered**:
+- [ ] VS Code (free alternative)
+- [ ] Vim/Neovim (free, terminal-based)
+- [ ] Other: _______________
+
+### Platform
+- [ ] Windows
+- [ ] macOS  
+- [ ] Linux (distribution: ________)
+
+### Urgency
+- [ ] Urgent (needed within 24 hours - please justify)
+- [ ] Normal (1-2 business days)
+- [ ] Low priority (when available)
+
+**If urgent, please explain why:**
+
+### SFTP Plugin
+**Note**: Sublime SFTP plugin ($16 USD) is a **separate personal purchase** and is NOT provided by the organization.
+
+- [ ] I understand SFTP plugin requires separate personal purchase
+- [ ] I have already purchased SFTP plugin
+- [ ] I will purchase SFTP plugin if needed for my work
+- [ ] I don't need SFTP plugin (local development only)
+
+### Acknowledgments
+- [ ] I have read the License Management Policy (/docs/github-private/LICENSE_MANAGEMENT.md)
+- [ ] I understand organization licenses are for work use only
+- [ ] I understand organization licenses must be returned upon leaving
+- [ ] I understand personal purchases ($99) are an alternative with lifetime access
+- [ ] I understand SFTP plugin ($16) requires separate personal purchase
+- [ ] I agree to the terms of use
+
+### Additional Information
+
+**Expected daily usage hours**: _____ hours/day
+
+**Duration of need**:
+- [ ] Permanent (ongoing role)
+- [ ] Temporary project (_____ months)
+- [ ] Trial/Evaluation (_____ weeks)
+
+**Comments/Questions**:
+
+---
+
+## For Admin Use Only
+
+**Do not edit below this line**
+
+- [ ] Manager approval received (@manager-username)
+- [ ] License available in pool (current: __/20)
+- [ ] License type confirmed (Organization / Personal registration)
+- [ ] License key sent via encrypted email
+- [ ] Activation confirmed by user
+- [ ] Added to license tracking sheet
+- [ ] User notified of SFTP plugin requirement
+
+**License Key ID**: _____________
+**Date Issued**: _____________
+**Issued By**: @_____________
+
+**Notes**:
@@ -0,0 +1,141 @@
+---
+name: Request for Comments (RFC)
+about: Propose a significant change for community discussion
+title: '[RFC] '
+labels: 'rfc, discussion'
+assignees: ''
+
+---
+
+<!--
+SPDX-License-Identifier: GPL-3.0-or-later
+Copyright (C) 2024-2026 Moko Consulting Tech
+
+File: .github/ISSUE_TEMPLATE/rfc.md
+Description: Issue template for Request for Comments proposals
+Project: .github-private
+Author: Moko Consulting Tech
+Version: 03.02.00
+
+Revision History:
+- 2026-01-04: Added MokoStandards compliant header with copyright, file info, and metadata
+- 2026-03-11: Version bump to 03.02.00 to match MokoStandards
+- 2024: Initial creation
+-->
+
+## RFC Summary
+One-paragraph summary of the proposal.
+
+## Motivation
+Why are we doing this? What use cases does it support? What is the expected outcome?
+
+## Detailed Design
+### Overview
+Provide a detailed explanation of the proposed change.
+
+### API Changes (if applicable)
+```php
+// Before
+function oldApi($param1) { }
+
+// After
+function newApi($param1, $param2) { }
+```
+
+### User Experience Changes
+Describe how users will interact with this change.
+
+### Implementation Approach
+High-level implementation strategy.
+
+## Drawbacks
+Why should we *not* do this?
+
+## Alternatives
+What other designs have been considered? What is the impact of not doing this?
+
+### Alternative 1
+- Description
+- Trade-offs
+
+### Alternative 2
+- Description
+- Trade-offs
+
+## Adoption Strategy
+How will existing users adopt this? Is this a breaking change?
+
+### Migration Guide
+```bash
+# Steps to migrate
+```
+
+### Deprecation Timeline
+- **Announcement**:
+- **Deprecation**:
+- **Removal**:
+
+## Unresolved Questions
+- Question 1
+- Question 2
+
+## Future Possibilities
+What future work does this enable?
+
+## Impact Assessment
+### Performance
+Expected performance impact.
+
+### Security
+Security considerations and implications.
+
+### Compatibility
+- **Backward Compatible**: [Yes / No]
+- **Breaking Changes**: [List]
+
+### Maintenance
+Long-term maintenance considerations.
+
+## Community Input
+### Stakeholders
+- [ ] Core team
+- [ ] Module developers
+- [ ] End users
+- [ ] Enterprise customers
+
+### Feedback Period
+**Duration**: [e.g., 2 weeks]
+**Deadline**: [date]
+
+## Implementation Timeline
+### Phase 1: Design
+- [ ] RFC discussion
+- [ ] Design finalization
+- [ ] Approval
+
+### Phase 2: Implementation
+- [ ] Core implementation
+- [ ] Tests
+- [ ] Documentation
+
+### Phase 3: Release
+- [ ] Beta release
+- [ ] Feedback collection
+- [ ] Stable release
+
+## Success Metrics
+How will we measure success?
+- Metric 1
+- Metric 2
+
+## References
+- Related RFCs:
+- External documentation:
+- Prior art:
+
+## Open Questions for Community
+1. Question 1?
+2. Question 2?
+
+---
+**Note**: This RFC is open for community discussion. Please provide feedback in the comments below.
@@ -0,0 +1,66 @@
+---
+name: Security Vulnerability Report
+about: Report a security vulnerability (use only for non-critical issues)
+title: '[SECURITY] '
+labels: 'security'
+assignees: ''
+
+---
+
+<!--
+SPDX-License-Identifier: GPL-3.0-or-later
+Copyright (C) 2024-2026 Moko Consulting Tech
+
+File: .github/ISSUE_TEMPLATE/security.md
+Description: Issue template for security vulnerability reports
+Project: .github-private
+Author: Moko Consulting Tech
+Version: 03.02.00
+
+Revision History:
+- 2026-01-04: Added MokoStandards compliant header with copyright, file info, and metadata
+- 2026-03-11: Version bump to 03.02.00 to match MokoStandards
+- 2024: Initial creation
+-->
+
+## ⚠️ IMPORTANT: Private Disclosure Required
+
+**For critical security vulnerabilities, DO NOT use this template.**
+Follow the process in [SECURITY.md](../SECURITY.md) for responsible disclosure.
+
+Use this template only for:
+- Security improvements
+- Non-critical security suggestions
+- Security documentation updates
+
+---
+
+## Security Issue
+
+**Severity**: 
+<!-- Low, Medium, or informational only -->
+
+## Description
+<!-- Describe the security concern or improvement suggestion -->
+
+## Affected Components
+<!-- List the affected files, features, or components -->
+
+## Suggested Mitigation
+<!-- Describe how this could be addressed -->
+
+## Standards Reference
+Does this relate to security standards in [MokoStandards](https://github.com/mokoconsulting-tech/MokoStandards)?
+- [ ] SPDX license identifiers
+- [ ] Secret management
+- [ ] Dependency security
+- [ ] Access control
+- [ ] Other: [specify]
+
+## Additional Context
+<!-- Add any other context about the security concern -->
+
+## Checklist
+- [ ] This is NOT a critical vulnerability requiring private disclosure
+- [ ] I have reviewed the SECURITY.md policy
+- [ ] I have provided sufficient detail for evaluation
@@ -1,206 +1,285 @@
-# GitHub Copilot Instructions for MokoJoomTOS
+> [!IMPORTANT]
+> **🔧 AI Self-Update Required on First Use**
+>
+> This file may contain unfilled `{{TOKEN}}` placeholders. The MokoStandards bulk-sync system
+> replaces them automatically at sync time; if you can still see them, sync has not yet run for
+> this repository — or this is a brand-new repo.
+>
+> **On your very first interaction in this repository, before answering any other question:**
+>
+> 1. Check whether any `{{TOKEN}}` placeholders remain in this file.
+> 2. If they do, locate the values as described in the table below and replace every occurrence
+>    in **both** `.github/copilot-instructions.md` and `.github/CLAUDE.md`.
+> 3. After replacing all tokens, **delete this entire notice block** (from `> [!IMPORTANT]`
+>    through the closing `> ---` line) in both files.
+> 4. Tell the developer: *"I've self-updated the AI context files with this repository's
+>    values — all set."*
+>
+> | Placeholder | Where to find the value |
+> |---|---|
+> | `MokoJoomTOS` | The GitHub repository name (visible in the URL, `README.md` heading, or `git remote -v`) |
+> | `https://github.com/mokoconsulting-tech/MokoJoomTOS` | Full GitHub URL, e.g. `https://github.com/mokoconsulting-tech/<repo-name>` |
+> | `{{EXTENSION_NAME}}` | The `<name>` element in `manifest.xml` at the repository root |
+> | `{{EXTENSION_TYPE}}` | The `type` attribute of the `<extension>` tag in `manifest.xml` (`component`, `module`, `plugin`, or `template`) |
+> | `{{EXTENSION_ELEMENT}}` | The `<element>` tag in `manifest.xml`, or the filename prefix (e.g. `com_myextension`, `mod_mymodule`) |
+>
+> ---

-This file provides guidance to GitHub Copilot when working with this repository.
+# MokoJoomTOS — GitHub Copilot Custom Instructions

-## Project Overview
+## What This Repo Is

-**MokoJoomTOS** is a lightweight Joomla system plugin that allows Terms of Service (or other legal documents) to remain accessible even when the site is in offline/maintenance mode.
+This is a **Moko Consulting MokoWaaS** (Joomla) repository governed by [MokoStandards](https://github.com/mokoconsulting-tech/MokoStandards). All coding standards, workflows, and policies are defined there and enforced here via bulk sync.

- **Type**: Joomla 4.x/5.x System Plugin
- **License**: GPL-3.0-or-later
- **Language**: PHP 7.4+
- **Current Version**: 03.08.04
+Repository URL: https://github.com/mokoconsulting-tech/MokoJoomTOS
+Extension name: **{{EXTENSION_NAME}}**
+Extension type: **{{EXTENSION_TYPE}}** (`{{EXTENSION_ELEMENT}}`)
+Platform: **Joomla 4.x / MokoWaaS**

-## Repository Structure
+---

-```
-/
-├── src/                    # Plugin source code (root level, not nested)
-│   ├── mokojoomtos.php    # Main plugin file
-│   ├── mokojoomtos.xml    # Plugin manifest
-│   ├── script.php         # Installation script
-│   └── src/               # Namespaced classes
-│       ├── Extension/     # Plugin extension classes
-│       └── Field/         # Custom form fields
-├── docs/                  # Detailed documentation
-├── scripts/               # Build and utility scripts
-└── [root docs]           # Essential documentation (README, CHANGELOG, etc.)
-```
+## Primary Language

-## Coding Standards
+**PHP** (≥ 7.4) is the primary language for this Joomla extension. JavaScript may be used for frontend enhancements. YAML uses 2-space indentation. All other text files use tabs per `.editorconfig`.

-### PHP Standards
+---

-1. **Follow Joomla Coding Standards**
-   - Use Joomla's coding conventions
-   - Follow PSR-1 and PSR-2 where applicable
-   - Use tabs for indentation (not spaces), except in YAML files
-   
-2. **File Headers**
-   - All PHP files must include copyright header with GPL-3.0-or-later license
-   - Format: `@package MokoJoomTOS`, `@subpackage plg_system_mokojoomtos`
-   - Include `@since` tags for version tracking
+## File Header — Always Required on New Files

-3. **Namespacing**
-   - Plugin classes use namespace: `Joomla\Plugin\System\MokoJoomTOS\`
-   - Follow Joomla's autoloader conventions
-
-### XML Standards
-
-1. **XML Files Use MokoStandard Header**
-   - Copyright: `Copyright (C) 2026 Moko Consulting`
-   - License: GPL-3.0-or-later
-   - Include FILE INFORMATION section with:
-     - DEFGROUP, INGROUP, PATH, VERSION, BRIEF
-
-2. **Plugin Manifest (mokojoomtos.xml)**
-   - Creation date format: `yyyy-mm-dd` (e.g., `2026-01-01`)
-   - Update server: `https://raw.githubusercontent.com/mokoconsulting-tech/MokoJoomTOS/main/update.xml`
-   - Site language files: NO folder attribute
-   - Administrator language files: `folder="administrator"`
-
-### Documentation Standards
-
-1. **Markdown File Headers**
-   - All markdown files use VERSION: 03.08.04 in FILE INFORMATION section
-   - Follow same MokoStandard format as XML files
-
-2. **Documentation Location**
-   - Detailed documentation → `docs/` directory
-   - Essential root-level docs only: README, CHANGELOG, CONTRIBUTING, LICENSE, SECURITY, CODE_OF_CONDUCT
-   - Use index.md files for navigation in major directories
-
-## Joomla-Specific Patterns
-
-### Table Operations (CRITICAL)
-
-**Always use the proper Joomla table workflow to prevent PrepareDataEvent type errors:**
+Every new file needs a copyright header as its first content.

+**PHP:**
 ```php
-// ❌ INCORRECT - Can cause PrepareDataEvent type errors
-if ($table->save($data)) {
-    return $table->id;
-}
+<?php
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: MokoJoomTOS.{{EXTENSION_TYPE}}
+ * INGROUP: MokoJoomTOS
+ * REPO: https://github.com/mokoconsulting-tech/MokoJoomTOS
+ * PATH: /path/to/file.php
+ * VERSION: XX.YY.ZZ
+ * BRIEF: One-line description of purpose
+ */

-// ✅ CORRECT - Use bind() → check() → store() workflow
-if (!$table->bind($data)) {
-    Log::add('Failed to bind: ' . $table->getError(), Log::WARNING, 'jerror');
-    return null;
-}
-
-if (!$table->check()) {
-    Log::add('Check failed: ' . $table->getError(), Log::WARNING, 'jerror');
-    return null;
-}
-
-if (!$table->store()) {
-    Log::add('Store failed: ' . $table->getError(), Log::WARNING, 'jerror');
-    return null;
-}
-
-return $table->id;
+defined('_JEXEC') or die;
 ```

-This pattern is used in `script.php` for installation routines.
+**Markdown:**
+```markdown
+<!--
+Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>

-### Plugin Event Lifecycle
+This file is part of a Moko Consulting project.

-1. **Template Rendering**
-   - Use `onAfterRoute` event (not `onAfterInitialise`) to set `tmpl=component`
-   - This is the correct point in Joomla's lifecycle (after routing, before template selection)
+SPDX-License-Identifier: GPL-3.0-or-later

-2. **Offline Mode Handling**
-   - When site is offline and TOS slug is accessed:
-     - Temporarily disable offline mode
-     - Set `tmpl=component` in both Input object and `$_GET` superglobal
-     - Ensures component-only view without template chrome
+# FILE INFORMATION
+DEFGROUP: MokoJoomTOS.Documentation
+INGROUP: MokoJoomTOS
+REPO: https://github.com/mokoconsulting-tech/MokoJoomTOS
+PATH: /docs/file.md
+VERSION: XX.YY.ZZ
+BRIEF: One-line description
+-->
+```

-### Language Files
+**YAML / Shell / XML:** Use the appropriate comment syntax with the same fields. JSON files are exempt.

- **Site language files**: Do NOT include `folder` attribute in XML manifest
- **Administrator language files**: Use `folder="administrator"` in XML manifest
- Located in: `administrator/language/` subdirectory within plugin
+---

 ## Version Management

-**Current Version**: 03.08.04
+**`README.md` is the single source of truth for the repository version.**

-When updating version:
- Update in ALL files: mokojoomtos.xml, update.xml, CHANGELOG.md, README.md
- Update markdown file headers (FILE INFORMATION section)
- Follow semantic versioning principles
- Document changes in CHANGELOG.md
+- **Bump the patch version on every PR** — increment `XX.YY.ZZ` (e.g. `01.02.03` → `01.02.04`) in `README.md` before opening the PR; the `sync-version-on-merge` workflow propagates it automatically to all badges and `FILE INFORMATION` headers on merge to `main`.
+- The `VERSION: XX.YY.ZZ` field in `README.md` governs all other version references.
+- Version format is zero-padded semver: `XX.YY.ZZ` (e.g. `01.02.03`).
+- Never hardcode a specific version in document body text — use the badge or FILE INFORMATION header only.

-## Testing & Validation
+### Joomla Version Alignment

-1. **PHP Syntax**: Always validate with `php -l` before committing
-2. **No Test Infrastructure**: Repository currently has no automated tests
-   - Manual testing required
-   - Focus on Joomla integration testing
+The version in `README.md` **must always match** the `<version>` tag in `manifest.xml` and the latest entry in `update.xml`. The `make release` command / release workflow updates all three automatically.

-## Build System
+```xml
+<!-- In manifest.xml — must match README.md version -->
+<version>01.02.04</version>

- Build scripts located in `scripts/` directory (not repository root)
- Manual packaging: Copy from `src/`, create ZIP with proper structure
- Pre-built releases available from GitHub Releases
+<!-- In update.xml — prepend a new <update> block for every release.
+     Note: the backslash in version="4\.[0-9]+" is a literal backslash character
+     in the XML attribute value. Joomla's update server treats the value as a
+     regular expression, so \. matches a literal dot. -->
+<updates>
+	<update>
+		<name>{{EXTENSION_NAME}}</name>
+		<version>01.02.04</version>
+		<downloads>
+			<downloadurl type="full" format="zip">
+				https://github.com/mokoconsulting-tech/MokoJoomTOS/releases/download/01.02.04/{{EXTENSION_ELEMENT}}-01.02.04.zip
+			</downloadurl>
+		</downloads>
+		<targetplatform name="joomla" version="4\.[0-9]+" />
+	</update>
+	<!-- … older entries preserved below … -->
+</updates>
+```

-## Git Workflow
+---

-1. **Commit Messages**: Follow Conventional Commits
-   - Types: feat, fix, docs, style, refactor, test, chore
-   - Format: `type(scope): subject`
+## Joomla Extension Structure

-2. **Branch Naming**: 
-   - Features: `feat/*`
-   - Fixes: `fix/*`
-   - Copilot tasks: `copilot/*`
+```
+MokoJoomTOS/
+├── manifest.xml          # Joomla installer manifest (root — required)
+├── update.xml            # Update server manifest (root — required, see below)
+├── site/                 # Frontend (site) code
+│   ├── controller.php
+│   ├── controllers/
+│   ├── models/
+│   └── views/
+├── admin/                # Backend (admin) code
+│   ├── controller.php
+│   ├── controllers/
+│   ├── models/
+│   ├── views/
+│   └── sql/
+├── language/             # Language INI files
+├── media/                # CSS, JS, images (deployed to /media/{{EXTENSION_ELEMENT}}/)
+├── docs/                 # Technical documentation
+├── tests/                # Test suite
+├── .github/
+│   ├── workflows/
+│   ├── copilot-instructions.md  # This file
+│   └── CLAUDE.md
+├── README.md             # Version source of truth
+├── CHANGELOG.md
+├── CONTRIBUTING.md
+├── LICENSE               # GPL-3.0-or-later
+└── Makefile              # Build automation
+```

-## Common Tasks
+---

-### Adding a New Feature
+## update.xml — Required in Repo Root

-1. Create feature branch
-2. Update plugin files in `src/`
-3. Update version if needed
-4. Update CHANGELOG.md
-5. Test in Joomla environment
-6. Validate PHP syntax
-7. Commit with conventional commit message
+`update.xml` **must exist at the repository root**. It is the Joomla update server manifest that allows Joomla installations to check for new versions of this extension.

-### Updating Documentation
+The `manifest.xml` must reference it via:
+```xml
+<updateservers>
+	<server type="extension" priority="1" name="{{EXTENSION_NAME}}">
+		https://github.com/mokoconsulting-tech/MokoJoomTOS/raw/main/update.xml
+	</server>
+</updateservers>
+```

-1. Detailed docs go in `docs/`
-2. Keep root docs minimal
-3. Update index.md files for navigation
-4. Maintain FILE INFORMATION headers
-5. Update VERSION in headers if project version changes
+**Rules:**
+- Every release must prepend a new `<update>` block at the top of `update.xml` — old entries must be preserved below.
+- The `<version>` in `update.xml` must exactly match `<version>` in `manifest.xml` and the version in `README.md`.
+- The `<downloadurl>` must be a publicly accessible direct download link (GitHub Releases asset URL).
+- `<targetplatform name="joomla" version="4\.[0-9]+">` — the backslash is a **literal backslash character** in the XML attribute value; Joomla's update-server parser treats the value as a regular expression, so `\.` matches a literal dot and `[0-9]+` matches one or more digits. Do not double-escape it.

-### Installation Script Changes
+---

-1. Use proper table workflow (bind → check → store)
-2. Add error logging at each step
-3. Check table instance creation
-4. Test installation/uninstallation in Joomla
+## manifest.xml Rules

-## Important Notes
+- Lives at the repo root as `manifest.xml` (not inside `site/` or `admin/`).
+- `<version>` tag must be kept in sync with `README.md` version and `update.xml`.
+- Must include `<updateservers>` block pointing to this repo's `update.xml`.
+- Must include `<files folder="site">` and `<administration>` sections.
+- Joomla 4.x requires `<namespace path="src">Moko\{{EXTENSION_NAME}}</namespace>` for namespaced extensions.

- ✅ Plugin source files at `src/` root level, NOT nested under `src/plugins/system/mokojoomtos/`
- ✅ No markdown documentation files in `src/` - only source code
- ✅ Enterprise-ready: Automatic setup creates article, menu type, and menu item
- ✅ Zero database impact: No custom tables or migrations
- ✅ Legal menu structure: Dedicated "Legal" menu type with alias `terms-of-service`
+---

-## Security
+## GitHub Actions — Token Usage

- No secrets or credentials in source code
- Follow Joomla security best practices
- Validate and sanitize all inputs
- Use Joomla's API methods for database operations
+Every workflow must use **`secrets.GH_TOKEN`** (the org-level Personal Access Token).

-## References
+```yaml
+# ✅ Correct
+- uses: actions/checkout@v4
+  with:
+    token: ${{ secrets.GH_TOKEN }}

- [Joomla Documentation](https://docs.joomla.org/)
- [Joomla Coding Standards](https://developer.joomla.org/coding-standards.html)
- [Conventional Commits](https://www.conventionalcommits.org/)
- [Repository README](../README.md)
- [Contributing Guidelines](../CONTRIBUTING.md)
+env:
+  GH_TOKEN: ${{ secrets.GH_TOKEN }}
+```
+
+```yaml
+# ❌ Wrong — never use these in workflows
+token: ${{ github.token }}
+token: ${{ secrets.GITHUB_TOKEN }}
+```
+
+---
+
+## MokoStandards Reference
+
+This repository is governed by [MokoStandards](https://github.com/mokoconsulting-tech/MokoStandards). Authoritative policies:
+
+| Document | Purpose |
+|----------|---------|
+| [file-header-standards.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/file-header-standards.md) | Copyright-header rules for every file type |
+| [coding-style-guide.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/coding-style-guide.md) | Naming and formatting conventions |
+| [branching-strategy.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/branching-strategy.md) | Branch naming, hierarchy, and release workflow |
+| [merge-strategy.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/merge-strategy.md) | Squash-merge policy and PR title/body conventions |
+| [changelog-standards.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/changelog-standards.md) | How and when to update CHANGELOG.md |
+| [joomla-development-guide.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/guide/waas/joomla-development-guide.md) | MokoWaaS Joomla extension development guide |
+
+---
+
+## Naming Conventions
+
+| Context | Convention | Example |
+|---------|-----------|---------|
+| PHP class | `PascalCase` | `MyController` |
+| PHP method / function | `camelCase` | `getItems()` |
+| PHP variable | `$snake_case` | `$item_id` |
+| PHP constant | `UPPER_SNAKE_CASE` | `MAX_ITEMS` |
+| PHP class file | `PascalCase.php` | `ItemModel.php` |
+| YAML workflow | `kebab-case.yml` | `ci-joomla.yml` |
+| Markdown doc | `kebab-case.md` | `installation-guide.md` |
+
+---
+
+## Commit Messages
+
+Format: `<type>(<scope>): <subject>` — imperative, lower-case subject, no trailing period.
+
+Valid types: `feat` · `fix` · `docs` · `chore` · `ci` · `refactor` · `style` · `test` · `perf` · `revert` · `build`
+
+---
+
+## Branch Naming
+
+Format: `<prefix>/<MAJOR.MINOR.PATCH>[/description]`
+
+Approved prefixes: `dev/` · `rc/` · `version/` · `patch/` · `copilot/` · `dependabot/`
+
+---
+
+## Keeping Documentation Current
+
+| Change type | Documentation to update |
+|-------------|------------------------|
+| New or renamed PHP class/method | PHPDoc block; `docs/api/` entry |
+| New or changed manifest.xml | Update `update.xml` version; bump README.md version |
+| New release | Prepend `<update>` block to `update.xml`; update CHANGELOG.md; bump README.md version |
+| New or changed workflow | `docs/workflows/<workflow-name>.md` |
+| Any modified file | Update the `VERSION` field in that file's `FILE INFORMATION` block |
+| **Every PR** | **Bump the patch version** — increment `XX.YY.ZZ` in `README.md`; `sync-version-on-merge` propagates it |
+
+---
+
+## Key Constraints
+
+- Never commit directly to `main` — all changes go via PR, squash-merged
+- Never skip the FILE INFORMATION block on a new file
+- Never add `defined('_JEXEC') or die;` to CLI scripts or model tests — only to web-accessible PHP files
+- Never hardcode version numbers in body text — update `README.md` and let automation propagate
+- Never use `github.token` or `secrets.GITHUB_TOKEN` in workflows — always use `secrets.GH_TOKEN`
+- Never let `manifest.xml` version, `update.xml` version, and `README.md` version go out of sync
@@ -0,0 +1,137 @@
+# GitHub Copilot Configuration
+# This file configures GitHub Copilot settings for the repository
+
+# Allowed domains for Copilot to access
+# These domains are trusted sources that Copilot can fetch information from
+allowed_domains:
+  # Standard license providers
+  - "www.gnu.org"          # GNU licenses (GPL, LGPL, AGPL)
+  - "opensource.org"       # Open Source Initiative
+  - "choosealicense.com"   # GitHub's license chooser
+  - "spdx.org"            # Software Package Data Exchange
+  - "creativecommons.org" # Creative Commons licenses
+  - "apache.org"          # Apache Software Foundation
+  - "fsf.org"             # Free Software Foundation
+
+  # Documentation and standards
+  - "semver.org"          # Semantic Versioning
+  - "keepachangelog.com"  # Changelog standards
+  - "conventionalcommits.org" # Commit message standards
+
+  # GitHub and related
+  - "github.com"          # GitHub main site
+  - "docs.github.com"     # GitHub documentation
+  - "raw.githubusercontent.com" # GitHub raw content
+
+  # Package managers and registries
+  - "npmjs.com"           # npm registry
+  - "pypi.org"            # Python Package Index
+  - "packagist.org"       # PHP Composer packages
+  - "rubygems.org"        # Ruby gems
+
+  # Standards and specifications
+  - "json-schema.org"     # JSON Schema
+  - "w3.org"              # W3C standards
+  - "ietf.org"            # IETF RFCs and standards
+
+  # PHP and Joomla specific
+  - "joomla.org"          # Joomla CMS
+  - "docs.joomla.org"     # Joomla documentation
+  - "downloads.joomla.org" # Joomla core downloads
+  - "php.net"             # PHP documentation
+  - "getcomposer.org"     # Composer dependency manager
+  - "packagist.org"       # Composer package registry (also listed under packages)
+
+  # Dolibarr specific
+  - "dolibarr.org"        # Dolibarr ERP/CRM
+  - "wiki.dolibarr.org"   # Dolibarr wiki
+  - "docs.dolibarr.org"   # Dolibarr developer documentation
+
+  # Moko Consulting
+  - "mokoconsulting.tech"     # Moko Consulting main site
+  - "*.mokoconsulting.tech"   # All Moko Consulting subdomains (API, docs, CDN, etc.)
+
+  # Google services
+  - "drive.google.com"             # Google Drive (file sharing and assets)
+  - "docs.google.com"              # Google Docs
+  - "sheets.google.com"            # Google Sheets
+  - "accounts.google.com"          # Google authentication
+  - "storage.googleapis.com"       # Google Cloud Storage
+  - "*.googleapis.com"             # Google APIs (Maps, Fonts, etc.)
+  - "*.googleusercontent.com"      # Google user-uploaded content and CDN
+  - "fonts.googleapis.com"         # Google Fonts CSS
+  - "fonts.gstatic.com"            # Google Fonts static assets
+
+  # GitHub extended
+  - "api.github.com"               # GitHub REST API
+  - "upload.github.com"            # GitHub file uploads
+  - "objects.githubusercontent.com" # GitHub release assets and LFS
+  - "user-images.githubusercontent.com" # GitHub issue/PR image attachments
+  - "codeload.github.com"          # GitHub archive downloads
+  - "ghcr.io"                      # GitHub Container Registry
+  - "pkg.github.com"               # GitHub Packages
+
+  # Developer reference
+  - "developer.mozilla.org"        # MDN Web Docs
+  - "stackoverflow.com"            # Stack Overflow
+  - "git-scm.com"                  # Git documentation
+
+  # CDN and infrastructure
+  - "cdn.jsdelivr.net"             # jsDelivr CDN
+  - "unpkg.com"                    # unpkg CDN
+  - "cdnjs.cloudflare.com"         # Cloudflare CDN
+  - "img.shields.io"               # Shields.io badge images
+  - "shields.io"                   # Shields.io badge service
+
+  # Container registries
+  - "hub.docker.com"               # Docker Hub
+  - "registry-1.docker.io"         # Docker registry pulls
+  - "index.docker.io"              # Docker index
+
+  # CI / code quality
+  - "codecov.io"                   # Code coverage reporting
+  - "coveralls.io"                 # Coveralls coverage service
+  - "sonarcloud.io"                # SonarCloud static analysis
+
+  # Terraform / infrastructure
+  - "registry.terraform.io"        # Terraform provider registry
+  - "releases.hashicorp.com"       # HashiCorp release downloads
+  - "checkpoint-api.hashicorp.com" # HashiCorp update checks
+
+# Settings for code generation and suggestions
+copilot:
+  # Enable Copilot for this repository
+  enabled: true
+
+  # File patterns to include for Copilot suggestions
+  include:
+    - "**/*.py"
+    - "**/*.js"
+    - "**/*.php"
+    - "**/*.md"
+    - "**/*.yml"
+    - "**/*.yaml"
+    - "**/*.json"
+    - "**/*.xml"
+    - "**/*.sh"
+
+  # File patterns to exclude from Copilot suggestions
+  exclude:
+    - "**/node_modules/**"
+    - "**/vendor/**"
+    - "**/build/**"
+    - "**/dist/**"
+    - "**/.git/**"
+    - "**/LICENSE"
+    - "**/CHANGELOG.md"
+
+# Notes:
+# ------
+# - This configuration allows GitHub Copilot to fetch information from trusted sources
+# - License providers are included to help with license text and compliance information
+# - Package registries help with dependency management and version checking
+# - Standards organizations provide authoritative specifications
+# - Platform-specific sites (Joomla, Dolibarr, PHP) support our technology stack
+# - All domains listed are well-known, reputable sources in their respective domains
+# - This list focuses on read-only access to public information
+# - No authentication credentials should be used with these domains
@@ -0,0 +1,115 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# This file is part of a Moko Consulting project.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: GitHub.Workflow.Template
+# INGROUP: MokoStandards.Security
+# REPO: https://github.com/mokoconsulting-tech/MokoStandards
+# PATH: /templates/workflows/generic/codeql-analysis.yml
+# VERSION: 04.00.15
+# BRIEF: CodeQL security scanning workflow (generic — all repo types)
+# NOTE: Deployed to .github/workflows/codeql-analysis.yml in governed repos.
+#       CodeQL does not support PHP directly; JavaScript scans JSON/YAML/shell.
+#       For PHP-specific security scanning see standards-compliance.yml.
+
+name: CodeQL Security Scanning
+
+on:
+  push:
+    branches:
+      - main
+      - dev/**
+      - rc/**
+      - version/**
+  pull_request:
+    branches:
+      - main
+      - dev/**
+      - rc/**
+  schedule:
+    # Weekly on Monday at 06:00 UTC
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+  pull-requests: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # CodeQL does not support PHP. Use 'javascript' to scan JSON, YAML,
+        # and shell scripts. Add 'actions' to scan GitHub Actions workflows.
+        language: ['javascript', 'actions']
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended,security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"
+          upload: true
+          output: sarif-results
+          wait-for-processing: true
+
+      - name: Upload SARIF results
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.5.0
+        with:
+          name: codeql-results-${{ matrix.language }}
+          path: sarif-results
+          retention-days: 30
+
+      - name: Step summary
+        if: always()
+        run: |
+          echo "### 🔍 CodeQL — ${{ matrix.language }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          URL="https://github.com/${{ github.repository }}/security/code-scanning"
+          echo "See the [Security tab]($URL) for findings." >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Severity | SLA |" >> $GITHUB_STEP_SUMMARY
+          echo "|----------|-----|" >> $GITHUB_STEP_SUMMARY
+          echo "| Critical | 7 days |" >> $GITHUB_STEP_SUMMARY
+          echo "| High     | 14 days |" >> $GITHUB_STEP_SUMMARY
+          echo "| Medium   | 30 days |" >> $GITHUB_STEP_SUMMARY
+          echo "| Low      | 60 days / next release |" >> $GITHUB_STEP_SUMMARY
+
+  summary:
+    name: Security Scan Summary
+    runs-on: ubuntu-latest
+    needs: analyze
+    if: always()
+
+    steps:
+      - name: Summary
+        run: |
+          echo "### 🛡️ CodeQL Complete" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Trigger:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
+          SECURITY_URL="https://github.com/${{ github.repository }}/security"
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "📊 [View all security alerts]($SECURITY_URL)" >> $GITHUB_STEP_SUMMARY
@@ -0,0 +1,587 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# This file is part of a Moko Consulting project.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
+#
+# FILE INFORMATION
+# DEFGROUP: GitHub.Workflow
+# INGROUP: MokoStandards.Deploy
+# REPO: https://github.com/mokoconsulting-tech/MokoStandards
+# PATH: /templates/workflows/shared/deploy-dev.yml
+# VERSION: 04.00.25
+# BRIEF: SFTP deployment workflow for development server — synced to all governed repos
+# NOTE: Synced via bulk-repo-sync to .github/workflows/deploy-dev.yml in all governed repos.
+#       Port is resolved in order: DEV_FTP_PORT variable → :port suffix in DEV_FTP_HOST → 22.
+
+name: Deploy to Dev Server (SFTP)
+
+# Deploys the contents of the src/ directory to the development server via SFTP.
+# Triggers on every pull_request to development branches (so the dev server always
+# reflects the latest PR state) and on push/merge to main branches.
+#
+# Required org-level variables:  DEV_FTP_HOST, DEV_FTP_PATH, DEV_FTP_USERNAME
+# Optional org-level variable:   DEV_FTP_PORT (auto-detected from host or defaults to 22)
+# Optional org/repo variable:    DEV_FTP_PATH_SUFFIX
+# Optional org/repo variable:    CUSTOM_FOLDER — when set, appended to the remote path after
+#                                 DEV_FTP_PATH_SUFFIX; used automatically for Dolibarr modules
+# Optional org/repo variable:    FTP_IGNORE — comma-delimited list of regex patterns, each enclosed in
+#                                 double quotes, for files/paths to exclude from upload, e.g.:
+#                                   "\.git*", "\.DS_Store", "configuration\.php", "\.ps1"
+#                                 Patterns are tested against the forward-slash relative path of each
+#                                 file (e.g. "subdir/file.txt"). The repository .gitignore is also
+#                                 respected automatically.
+# Required org-level secret:     DEV_FTP_KEY (preferred) or DEV_FTP_PASSWORD
+#
+# Access control: only users with admin or maintain role on the repository may deploy.
+
+on:
+  push:
+    branches:
+      - main
+      - master
+      - develop
+      - dev
+      - development
+    paths:
+      - 'src/**'
+  pull_request:
+    types: [opened, synchronize, reopened, closed]
+    branches:
+      - main
+      - master
+      - develop
+      - dev
+      - development
+  workflow_dispatch:
+    inputs:
+      clear_remote:
+        description: 'Delete all files inside the remote destination folder before uploading'
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  check-permission:
+    name: Verify Deployment Permission
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check actor permission
+        env:
+          # Prefer the org-scoped GH_TOKEN secret (needed for the org membership
+          # fallback). Falls back to the built-in github.token so the collaborator
+          # endpoint still works even if GH_TOKEN is not configured.
+          GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
+        run: |
+          ACTOR="${{ github.actor }}"
+          REPO="${{ github.repository }}"
+          ORG="${{ github.repository_owner }}"
+
+          # Try the per-repo collaborator endpoint first.
+          # This returns 404 for org owners who are not listed as explicit
+          # collaborators, so we fall back to the org membership role check.
+          PERMISSION=$(gh api "repos/${REPO}/collaborators/${ACTOR}/permission" \
+            --jq '.permission' 2>/dev/null)
+
+          if [ -z "$PERMISSION" ]; then
+            # Collaborator endpoint returned nothing — try org membership.
+            # Requires a token with read:org scope (secrets.GH_TOKEN).
+            # github.token alone is insufficient for this endpoint.
+            ORG_ROLE=$(gh api "orgs/${ORG}/memberships/${ACTOR}" \
+              --jq '.role' 2>/dev/null)
+            if [ "$ORG_ROLE" = "owner" ]; then
+              PERMISSION="admin"
+              echo "ℹ️  ${ACTOR} is an org owner — granting admin access"
+            else
+              # Both checks failed — token may lack read:org scope.
+              echo "⚠️  Could not determine permission for ${ACTOR}."
+              echo "   Add GH_TOKEN (PAT with read:org scope) as an org secret to fix this."
+              PERMISSION="none"
+            fi
+          fi
+
+          case "$PERMISSION" in
+            admin|maintain)
+              echo "✅ ${ACTOR} has '${PERMISSION}' permission — authorized to deploy"
+              ;;
+            *)
+              echo "❌ Deployment requires admin or maintain role."
+              echo "   ${ACTOR} has '${PERMISSION}' — contact your org administrator."
+              exit 1
+              ;;
+          esac
+
+  deploy:
+    name: SFTP Deploy → Dev
+    runs-on: ubuntu-latest
+    needs: [check-permission]
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'push' ||
+      (github.event_name == 'pull_request' &&
+        (github.event.action == 'opened' ||
+         github.event.action == 'synchronize' ||
+         github.event.action == 'reopened' ||
+         github.event.pull_request.merged == true))
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Resolve source directory
+        id: source
+        run: |
+          SRC="src"
+          if [ ! -d "$SRC" ]; then
+            echo "⚠️ No src/ directory found — skipping deployment"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            COUNT=$(find "$SRC" -maxdepth 0 -type d > /dev/null && find "$SRC" -type f | wc -l)
+            echo "✅ Source: src/ (${COUNT} file(s))"
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+            echo "dir=${SRC}"  >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Preview files to deploy
+        if: steps.source.outputs.skip == 'false'
+        env:
+          SOURCE_DIR: ${{ steps.source.outputs.dir }}
+          FTP_IGNORE: ${{ vars.FTP_IGNORE }}
+        run: |
+          # ── Parse FTP_IGNORE ─────────────────────────────────────────────────
+          IGNORE_PATTERNS=()
+          if [ -n "$FTP_IGNORE" ]; then
+            while IFS= read -r -d ',' token; do
+              pattern=$(printf '%s' "$token" | sed 's/^[[:space:]]*"//;s/"[[:space:]]*$//')
+              [ -n "$pattern" ] && IGNORE_PATTERNS+=("$pattern")
+            done <<< "${FTP_IGNORE},"
+          fi
+
+          # ── Walk src/ and classify every file ────────────────────────────────
+          WILL_UPLOAD=()
+          IGNORED_FILES=()
+          while IFS= read -r -d '' file; do
+            rel="${file#${SOURCE_DIR}/}"
+            SKIP=false
+            for pat in "${IGNORE_PATTERNS[@]}"; do
+              if echo "$rel" | grep -qE "$pat" 2>/dev/null; then
+                IGNORED_FILES+=("$rel | FTP_IGNORE \`$pat\`")
+                SKIP=true; break
+              fi
+            done
+            $SKIP && continue
+            if [ -f ".gitignore" ] && git check-ignore -q "$rel" 2>/dev/null; then
+              IGNORED_FILES+=("$rel | .gitignore")
+              continue
+            fi
+            WILL_UPLOAD+=("$rel")
+          done < <(find "$SOURCE_DIR" -type f -print0 | sort -z)
+
+          UPLOAD_COUNT="${#WILL_UPLOAD[@]}"
+          IGNORE_COUNT="${#IGNORED_FILES[@]}"
+
+          echo "ℹ️  ${UPLOAD_COUNT} file(s) will be uploaded, ${IGNORE_COUNT} ignored"
+
+          # ── Write deployment preview to step summary ──────────────────────────
+          {
+            echo "## 📋 Deployment Preview"
+            echo ""
+            echo "| Field | Value |"
+            echo "|---|---|"
+            echo "| Source | \`${SOURCE_DIR}/\` |"
+            echo "| Files to upload | **${UPLOAD_COUNT}** |"
+            echo "| Files ignored | **${IGNORE_COUNT}** |"
+            echo ""
+            if [ "${UPLOAD_COUNT}" -gt 0 ]; then
+              echo "### 📂 Files that will be uploaded"
+              echo '```'
+              printf '%s\n' "${WILL_UPLOAD[@]}"
+              echo '```'
+              echo ""
+            fi
+            if [ "${IGNORE_COUNT}" -gt 0 ]; then
+              echo "### ⏭️ Files excluded"
+              echo "| File | Reason |"
+              echo "|---|---|"
+              for entry in "${IGNORED_FILES[@]}"; do
+                f="${entry% | *}"; r="${entry##* | }"
+                echo "| \`${f}\` | ${r} |"
+              done
+              echo ""
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Resolve SFTP host and port
+        if: steps.source.outputs.skip == 'false'
+        id: conn
+        env:
+          HOST_RAW: ${{ vars.DEV_FTP_HOST }}
+          PORT_VAR: ${{ vars.DEV_FTP_PORT }}
+        run: |
+          HOST="$HOST_RAW"
+          PORT="$PORT_VAR"
+
+          # Priority 1 — explicit DEV_FTP_PORT variable
+          if [ -n "$PORT" ]; then
+            echo "ℹ️  Using explicit DEV_FTP_PORT=${PORT}"
+
+          # Priority 2 — port embedded in DEV_FTP_HOST  (host:port)
+          elif [[ "$HOST" == *:* ]]; then
+            PORT="${HOST##*:}"
+            HOST="${HOST%:*}"
+            echo "ℹ️  Extracted port ${PORT} from DEV_FTP_HOST"
+
+          # Priority 3 — SFTP default
+          else
+            PORT="22"
+            echo "ℹ️  No port specified — defaulting to SFTP port 22"
+          fi
+
+          echo "host=${HOST}" >> "$GITHUB_OUTPUT"
+          echo "port=${PORT}" >> "$GITHUB_OUTPUT"
+          echo "SFTP target: ${HOST}:${PORT}"
+
+      - name: Build remote path
+        if: steps.source.outputs.skip == 'false'
+        id: remote
+        env:
+          DEV_FTP_PATH:        ${{ vars.DEV_FTP_PATH }}
+          DEV_FTP_PATH_SUFFIX: ${{ vars.DEV_FTP_PATH_SUFFIX }}
+          CUSTOM_FOLDER:       ${{ vars.CUSTOM_FOLDER }}
+        run: |
+          BASE="$DEV_FTP_PATH"
+          SUFFIX="$DEV_FTP_PATH_SUFFIX"
+          CUSTOM="$CUSTOM_FOLDER"
+
+          if [ -z "$BASE" ]; then
+            echo "❌ DEV_FTP_PATH is not set."
+            echo "   Configure it as an org-level variable (Settings → Variables) and"
+            echo "   ensure this repository has been granted access to it."
+            exit 1
+          fi
+
+          # Always append suffix when set — path is BASE/SUFFIX
+          if [ -n "$SUFFIX" ]; then
+            REMOTE="${BASE%/}/${SUFFIX#/}"
+          else
+            REMOTE="$BASE"
+          fi
+
+          # Append CUSTOM_FOLDER when set — makes Dolibarr module paths automatic
+          if [ -n "$CUSTOM" ]; then
+            REMOTE="${REMOTE%/}/${CUSTOM#/}"
+            echo "ℹ️  CUSTOM_FOLDER appended: ${CUSTOM}"
+          fi
+
+          echo "path=${REMOTE}" >> "$GITHUB_OUTPUT"
+          echo "Remote path: ${REMOTE}"
+
+      - name: Detect SFTP authentication method
+        if: steps.source.outputs.skip == 'false'
+        id: auth
+        env:
+          HAS_KEY:      ${{ secrets.DEV_FTP_KEY }}
+          HAS_PASSWORD: ${{ secrets.DEV_FTP_PASSWORD }}
+        run: |
+          if [ -n "$HAS_KEY" ] && [ -n "$HAS_PASSWORD" ]; then
+            # Both set: key auth with password as passphrase; falls back to password-only if key fails
+            echo "method=key" >> "$GITHUB_OUTPUT"
+            echo "use_passphrase=true" >> "$GITHUB_OUTPUT"
+            echo "has_password=true" >> "$GITHUB_OUTPUT"
+            echo "ℹ️  Primary: SSH key + passphrase (DEV_FTP_KEY / DEV_FTP_PASSWORD)"
+            echo "ℹ️  Fallback: password-only auth if key authentication fails"
+          elif [ -n "$HAS_KEY" ]; then
+            # Key only: no passphrase, no password fallback
+            echo "method=key" >> "$GITHUB_OUTPUT"
+            echo "use_passphrase=false" >> "$GITHUB_OUTPUT"
+            echo "has_password=false" >> "$GITHUB_OUTPUT"
+            echo "ℹ️  Using SSH key authentication (DEV_FTP_KEY, no passphrase, no fallback)"
+          elif [ -n "$HAS_PASSWORD" ]; then
+            # Password only: direct SFTP password auth
+            echo "method=password" >> "$GITHUB_OUTPUT"
+            echo "use_passphrase=false" >> "$GITHUB_OUTPUT"
+            echo "has_password=true" >> "$GITHUB_OUTPUT"
+            echo "ℹ️  Using password authentication (DEV_FTP_PASSWORD)"
+          else
+            echo "❌ No SFTP credentials configured."
+            echo "   Set DEV_FTP_KEY (preferred) or DEV_FTP_PASSWORD as an org-level secret."
+            exit 1
+          fi
+
+      - name: Setup PHP
+        if: steps.source.outputs.skip == 'false'
+        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.31.0
+        with:
+          php-version: '8.1'
+          tools: composer
+
+      - name: Setup MokoStandards deploy tools
+        if: steps.source.outputs.skip == 'false'
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+        run: |
+          git clone --depth 1 --quiet \
+            "https://x-access-token:${GH_TOKEN}@github.com/mokoconsulting-tech/MokoStandards.git" \
+            /tmp/mokostandards
+          cd /tmp/mokostandards
+          composer install --no-dev --no-interaction --quiet
+
+      - name: Clear remote destination folder
+        if: >-
+          steps.source.outputs.skip == 'false' &&
+          inputs.clear_remote == true
+        env:
+          SFTP_HOST:      ${{ steps.conn.outputs.host }}
+          SFTP_PORT:      ${{ steps.conn.outputs.port }}
+          SFTP_USER:      ${{ vars.DEV_FTP_USERNAME }}
+          SFTP_KEY:       ${{ secrets.DEV_FTP_KEY }}
+          SFTP_PASSWORD:  ${{ secrets.DEV_FTP_PASSWORD }}
+          AUTH_METHOD:    ${{ steps.auth.outputs.method }}
+          USE_PASSPHRASE: ${{ steps.auth.outputs.use_passphrase }}
+          HAS_PASSWORD:   ${{ steps.auth.outputs.has_password }}
+          REMOTE_PATH:    ${{ steps.remote.outputs.path }}
+        run: |
+          cat > /tmp/moko_clear.php << 'PHPEOF'
+          <?php
+          declare(strict_types=1);
+          require '/tmp/mokostandards/vendor/autoload.php';
+
+          use phpseclib3\Net\SFTP;
+          use phpseclib3\Crypt\PublicKeyLoader;
+
+          $host          = (string) getenv('SFTP_HOST');
+          $port          = (int)    getenv('SFTP_PORT');
+          $username      = (string) getenv('SFTP_USER');
+          $authMethod    = (string) getenv('AUTH_METHOD');
+          $usePassphrase = getenv('USE_PASSPHRASE') === 'true';
+          $hasPassword   = getenv('HAS_PASSWORD')   === 'true';
+          $remotePath    = rtrim((string) getenv('REMOTE_PATH'), '/');
+
+          echo "⚠️  Clearing remote folder: {$remotePath}\n";
+
+          $sftp = new SFTP($host, $port);
+
+          // ── Authentication ──────────────────────────────────────────────
+          if ($authMethod === 'key') {
+              $keyData    = (string) getenv('SFTP_KEY');
+              $passphrase = $usePassphrase ? (string) getenv('SFTP_PASSWORD') : false;
+              $password   = $hasPassword   ? (string) getenv('SFTP_PASSWORD') : '';
+              $key = PublicKeyLoader::load($keyData, $passphrase);
+              if (!$sftp->login($username, $key)) {
+                  if ($password !== '') {
+                      echo "⚠️  Key auth failed — falling back to password\n";
+                      if (!$sftp->login($username, $password)) {
+                          fwrite(STDERR, "❌ Both key and password authentication failed\n");
+                          exit(1);
+                      }
+                      echo "✅ Connected via password authentication (key fallback)\n";
+                  } else {
+                      fwrite(STDERR, "❌ Key authentication failed and no password fallback is available\n");
+                      exit(1);
+                  }
+              } else {
+                  echo "✅ Connected via SSH key authentication\n";
+              }
+          } else {
+              if (!$sftp->login($username, (string) getenv('SFTP_PASSWORD'))) {
+                  fwrite(STDERR, "❌ Password authentication failed\n");
+                  exit(1);
+              }
+              echo "✅ Connected via password authentication\n";
+          }
+
+          // ── Recursive delete ────────────────────────────────────────────
+          function rmrf(SFTP $sftp, string $path): void
+          {
+              $entries = $sftp->nlist($path);
+              if ($entries === false) {
+                  return; // path does not exist — nothing to clear
+              }
+              foreach ($entries as $name) {
+                  if ($name === '.' || $name === '..') {
+                      continue;
+                  }
+                  $entry = "{$path}/{$name}";
+                  if ($sftp->is_dir($entry)) {
+                      rmrf($sftp, $entry);
+                      $sftp->rmdir($entry);
+                      echo "  🗑️  Removed dir:  {$entry}\n";
+                  } else {
+                      $sftp->delete($entry);
+                      echo "  🗑️  Removed file: {$entry}\n";
+                  }
+              }
+          }
+
+          // ── Create remote directory tree ────────────────────────────────
+          function sftpMakedirs(SFTP $sftp, string $path): void
+          {
+              $parts = array_values(array_filter(explode('/', $path), fn(string $p) => $p !== ''));
+              $current = str_starts_with($path, '/') ? '' : '';
+              foreach ($parts as $part) {
+                  $current .= '/' . $part;
+                  $sftp->mkdir($current); // silently returns false if already exists
+              }
+          }
+
+          rmrf($sftp, $remotePath);
+          sftpMakedirs($sftp, $remotePath);
+          echo "✅ Remote folder ready: {$remotePath}\n";
+          PHPEOF
+          php /tmp/moko_clear.php
+
+      - name: Deploy via SFTP
+        if: steps.source.outputs.skip == 'false'
+        env:
+          SFTP_HOST:       ${{ steps.conn.outputs.host }}
+          SFTP_PORT:       ${{ steps.conn.outputs.port }}
+          SFTP_USER:       ${{ vars.DEV_FTP_USERNAME }}
+          SFTP_KEY:        ${{ secrets.DEV_FTP_KEY }}
+          SFTP_PASSWORD:   ${{ secrets.DEV_FTP_PASSWORD }}
+          AUTH_METHOD:     ${{ steps.auth.outputs.method }}
+          USE_PASSPHRASE:  ${{ steps.auth.outputs.use_passphrase }}
+          REMOTE_PATH:     ${{ steps.remote.outputs.path }}
+          SOURCE_DIR:      ${{ steps.source.outputs.dir }}
+        run: |
+          # ── Write SSH key to temp file (key auth only) ────────────────────────
+          if [ "$AUTH_METHOD" = "key" ]; then
+            printf '%s' "$SFTP_KEY" > /tmp/deploy_key
+            chmod 600 /tmp/deploy_key
+          fi
+
+          # ── Generate sftp-config.json safely via jq ───────────────────────────
+          if [ "$AUTH_METHOD" = "key" ]; then
+            jq -n \
+              --arg  host "$SFTP_HOST" \
+              --argjson port "${SFTP_PORT:-22}" \
+              --arg  user "$SFTP_USER" \
+              --arg  path "$REMOTE_PATH" \
+              --arg  key  "/tmp/deploy_key" \
+              '{host:$host, port:$port, user:$user, remote_path:$path, ssh_key_file:$key}' \
+              > /tmp/sftp-config.json
+          else
+            jq -n \
+              --arg  host "$SFTP_HOST" \
+              --argjson port "${SFTP_PORT:-22}" \
+              --arg  user "$SFTP_USER" \
+              --arg  path "$REMOTE_PATH" \
+              --arg  pass "$SFTP_PASSWORD" \
+              '{host:$host, port:$port, user:$user, remote_path:$path, password:$pass}' \
+              > /tmp/sftp-config.json
+          fi
+
+          # ── Run deploy-sftp.php from MokoStandards ────────────────────────────
+          DEPLOY_ARGS=(--path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json)
+          if [ "$USE_PASSPHRASE" = "true" ]; then
+            DEPLOY_ARGS+=(--key-passphrase "$SFTP_PASSWORD")
+          fi
+
+          php /tmp/mokostandards/api/deploy/deploy-sftp.php "${DEPLOY_ARGS[@]}"
+          # (deploy-sftp.php handles dotfile skipping and .ftp_ignore natively)
+          # Remove temp files that should never be left behind
+          rm -f /tmp/deploy_key /tmp/sftp-config.json
+
+      - name: Create or update failure issue
+        if: failure()
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
+        run: |
+          REPO="${{ github.repository }}"
+          RUN_URL="${{ github.server_url }}/${REPO}/actions/runs/${{ github.run_id }}"
+          ACTOR="${{ github.actor }}"
+          BRANCH="${{ github.ref_name }}"
+          EVENT="${{ github.event_name }}"
+          NOW=$(date -u '+%Y-%m-%d %H:%M:%S UTC')
+          LABEL="deploy-failure"
+
+          TITLE="fix: Dev deployment failed — ${REPO}"
+          BODY="## Dev Deployment Failed
+
+          A deployment to the dev server failed and requires attention.
+
+          | Field | Value |
+          |-------|-------|
+          | **Repository** | \`${REPO}\` |
+          | **Branch** | \`${BRANCH}\` |
+          | **Trigger** | ${EVENT} |
+          | **Actor** | @${ACTOR} |
+          | **Failed at** | ${NOW} |
+          | **Run** | [View workflow run](${RUN_URL}) |
+
+          ### Next steps
+          1. Review the [workflow run log](${RUN_URL}) for the specific error.
+          2. Fix the underlying issue (credentials, SFTP connectivity, permissions).
+          3. Re-trigger the deployment via **Actions → Deploy to Dev Server → Run workflow**.
+
+          ---
+          *Auto-created by deploy-dev.yml — close this issue once the deployment is resolved.*"
+
+          # Ensure the label exists (idempotent — no-op if already present)
+          gh label create "$LABEL" \
+            --repo "$REPO" \
+            --color "CC0000" \
+            --description "Automated deploy failure tracking" \
+            --force 2>/dev/null || true
+
+          # Look for an existing open deploy-failure issue
+          EXISTING=$(gh api "repos/${REPO}/issues?labels=${LABEL}&state=open&per_page=1" \
+            --jq '.[0].number' 2>/dev/null)
+
+          if [ -n "$EXISTING" ] && [ "$EXISTING" != "null" ]; then
+            gh api "repos/${REPO}/issues/${EXISTING}" \
+              -X PATCH \
+              -f title="$TITLE" \
+              -f body="$BODY" \
+              --silent
+            echo "📋 Failure issue #${EXISTING} updated: ${REPO}" >> "$GITHUB_STEP_SUMMARY"
+          else
+            gh issue create \
+              --repo "$REPO" \
+              --title "$TITLE" \
+              --body "$BODY" \
+              --label "$LABEL" \
+              | tee -a "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Deployment summary
+        if: always()
+        run: |
+          if [ "${{ steps.source.outputs.skip }}" == "true" ]; then
+            echo "### ⏭️ Deployment Skipped" >> "$GITHUB_STEP_SUMMARY"
+            echo "" >> "$GITHUB_STEP_SUMMARY"
+            echo "No \`src/\` directory found in this repository." >> "$GITHUB_STEP_SUMMARY"
+          elif [ "${{ job.status }}" == "success" ]; then
+            echo "" >> "$GITHUB_STEP_SUMMARY"
+            echo "### ✅ Dev Deployment Successful" >> "$GITHUB_STEP_SUMMARY"
+            echo "" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Field | Value |" >> "$GITHUB_STEP_SUMMARY"
+            echo "|-------|-------|" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Host | \`${{ steps.conn.outputs.host }}:${{ steps.conn.outputs.port }}\` |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Remote path | \`${{ steps.remote.outputs.path }}\` |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Source | \`src/\` |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Trigger | ${{ github.event_name }} |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Auth | ${{ steps.auth.outputs.method }} |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Clear remote | ${{ inputs.clear_remote || 'false' }} |" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "### ❌ Dev Deployment Failed" >> "$GITHUB_STEP_SUMMARY"
+            echo "" >> "$GITHUB_STEP_SUMMARY"
+            echo "Check the job log above for error details." >> "$GITHUB_STEP_SUMMARY"
+          fi
@@ -0,0 +1,758 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# This file is part of a Moko Consulting project.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+# FILE INFORMATION
+# DEFGROUP: GitHub.Workflow
+# INGROUP: MokoStandards.Firewall
+# REPO: https://github.com/mokoconsulting-tech/MokoStandards
+# PATH: /templates/workflows/shared/enterprise-firewall-setup.yml
+# VERSION: 01.00.00
+# BRIEF: Enterprise firewall configuration — generates outbound allow-rules including SFTP deployment server
+# NOTE: Reads DEV_FTP_HOST / DEV_FTP_PORT variables to include SFTP egress rules alongside HTTPS rules.
+
+name: Enterprise Firewall Configuration
+
+# This workflow provides firewall configuration guidance for enterprise-ready sites
+# It generates firewall rules for allowing outbound access to trusted domains
+# including license providers, documentation sources, package registries,
+# and the SFTP deployment server (DEV_FTP_HOST / DEV_FTP_PORT).
+#
+# Runs automatically when:
+# - Coding agent workflows are triggered (pull requests with copilot/ prefix)
+# - Manual workflow dispatch for custom configurations
+
+on:
+  workflow_dispatch:
+    inputs:
+      firewall_type:
+        description: 'Target firewall type'
+        required: true
+        type: choice
+        options:
+          - 'iptables'
+          - 'ufw'
+          - 'firewalld'
+          - 'aws-security-group'
+          - 'azure-nsg'
+          - 'gcp-firewall'
+          - 'cloudflare'
+          - 'all'
+        default: 'all'
+      output_format:
+        description: 'Output format'
+        required: true
+        type: choice
+        options:
+          - 'shell-script'
+          - 'json'
+          - 'yaml'
+          - 'markdown'
+          - 'all'
+        default: 'markdown'
+
+  # Auto-run when coding agent creates or updates PRs
+  pull_request:
+    branches:
+      - 'copilot/**'
+      - 'agent/**'
+    types: [opened, synchronize, reopened]
+
+  # Auto-run on push to coding agent branches
+  push:
+    branches:
+      - 'copilot/**'
+      - 'agent/**'
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  generate-firewall-rules:
+    name: Generate Firewall Rules
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+
+      - name: Apply Firewall Rules to Runner (Auto-run only)
+        if: github.event_name != 'workflow_dispatch'
+        env:
+          DEV_FTP_HOST: ${{ vars.DEV_FTP_HOST }}
+          DEV_FTP_PORT: ${{ vars.DEV_FTP_PORT }}
+        run: |
+          echo "🔥 Applying firewall rules for coding agent environment..."
+          echo ""
+          echo "This step ensures the GitHub Actions runner can access trusted domains"
+          echo "including license providers, package registries, and documentation sources."
+          echo ""
+
+          # Note: GitHub Actions runners are ephemeral and run in controlled environments
+          # This step documents what domains are being accessed during the workflow
+          # Actual firewall configuration is managed by GitHub
+
+          cat > /tmp/trusted-domains.txt << 'EOF'
+          # Trusted domains for coding agent environment
+          # License Providers
+          www.gnu.org
+          opensource.org
+          choosealicense.com
+          spdx.org
+          creativecommons.org
+          apache.org
+          fsf.org
+
+          # Documentation & Standards
+          semver.org
+          keepachangelog.com
+          conventionalcommits.org
+
+          # GitHub & Related
+          github.com
+          api.github.com
+          docs.github.com
+          raw.githubusercontent.com
+          ghcr.io
+
+          # Package Registries
+          npmjs.com
+          registry.npmjs.org
+          pypi.org
+          files.pythonhosted.org
+          packagist.org
+          repo.packagist.org
+          rubygems.org
+
+          # Platform-Specific
+          joomla.org
+          downloads.joomla.org
+          docs.joomla.org
+          php.net
+          getcomposer.org
+          dolibarr.org
+          wiki.dolibarr.org
+          docs.dolibarr.org
+
+          # Moko Consulting
+          mokoconsulting.tech
+
+          # SFTP Deployment Server (DEV_FTP_HOST)
+          ${DEV_FTP_HOST:-<not configured>}
+
+          # Google Services
+          drive.google.com
+          docs.google.com
+          sheets.google.com
+          accounts.google.com
+          storage.googleapis.com
+          fonts.googleapis.com
+          fonts.gstatic.com
+
+          # GitHub Extended
+          upload.github.com
+          objects.githubusercontent.com
+          user-images.githubusercontent.com
+          codeload.github.com
+          pkg.github.com
+
+          # Developer Reference
+          developer.mozilla.org
+          stackoverflow.com
+          git-scm.com
+
+          # CDN & Infrastructure
+          cdn.jsdelivr.net
+          unpkg.com
+          cdnjs.cloudflare.com
+          img.shields.io
+
+          # Container Registries
+          hub.docker.com
+          registry-1.docker.io
+
+          # CI & Code Quality
+          codecov.io
+          sonarcloud.io
+
+          # Terraform & Infrastructure
+          registry.terraform.io
+          releases.hashicorp.com
+          checkpoint-api.hashicorp.com
+          EOF
+
+          echo "✓ Trusted domains documented for this runner"
+          echo "✓ GitHub Actions runners have network access to these domains"
+          echo ""
+
+          # Test connectivity to key domains
+          echo "Testing connectivity to key domains..."
+          for domain in "github.com" "www.gnu.org" "npmjs.com" "pypi.org"; do
+            if curl -s --max-time 3 -o /dev/null -w "%{http_code}" "https://$domain" | grep -q "200\|301\|302"; then
+              echo "  ✓ $domain is accessible"
+            else
+              echo "  ⚠️  $domain connectivity check failed (may be expected)"
+            fi
+          done
+
+          # Test SFTP server connectivity (TCP port check)
+          SFTP_HOST="${DEV_FTP_HOST:-}"
+          SFTP_PORT="${DEV_FTP_PORT:-22}"
+          if [ -n "$SFTP_HOST" ]; then
+            # Strip any embedded :port suffix
+            SFTP_HOST="${SFTP_HOST%%:*}"
+            echo ""
+            echo "Testing SFTP deployment server connectivity..."
+            if timeout 5 bash -c "echo >/dev/tcp/${SFTP_HOST}/${SFTP_PORT}" 2>/dev/null; then
+              echo "  ✓ SFTP server ${SFTP_HOST}:${SFTP_PORT} is reachable"
+            else
+              echo "  ⚠️  SFTP server ${SFTP_HOST}:${SFTP_PORT} is not reachable from runner (firewall rule needed)"
+            fi
+          else
+            echo ""
+            echo "  ℹ️  DEV_FTP_HOST not configured — skipping SFTP connectivity check"
+          fi
+
+      - name: Generate Firewall Configuration
+        id: generate
+        env:
+          DEV_FTP_HOST: ${{ vars.DEV_FTP_HOST }}
+          DEV_FTP_PORT: ${{ vars.DEV_FTP_PORT }}
+        run: |
+          cat > generate_firewall_config.py << 'PYTHON_EOF'
+          #!/usr/bin/env python3
+          """
+          Enterprise Firewall Configuration Generator
+
+          Generates firewall rules for enterprise-ready deployments allowing
+          access to trusted domains including license providers, documentation
+          sources, package registries, and platform-specific sites.
+          """
+
+          import json
+          import os
+          import yaml
+          import sys
+          from typing import List, Dict
+
+          # SFTP deployment server from org variables
+          _sftp_host_raw = os.environ.get("DEV_FTP_HOST", "").strip()
+          _sftp_port = os.environ.get("DEV_FTP_PORT", "").strip() or "22"
+          # Strip embedded :port suffix if present
+          _sftp_host = _sftp_host_raw.split(":")[0] if _sftp_host_raw else ""
+          if ":" in _sftp_host_raw and not _sftp_port:
+              _sftp_port = _sftp_host_raw.split(":")[1]
+
+          SFTP_HOST = _sftp_host
+          SFTP_PORT = int(_sftp_port) if _sftp_port.isdigit() else 22
+
+          # Trusted domains from .github/copilot.yml
+          TRUSTED_DOMAINS = {
+              "license_providers": [
+                  "www.gnu.org",
+                  "opensource.org",
+                  "choosealicense.com",
+                  "spdx.org",
+                  "creativecommons.org",
+                  "apache.org",
+                  "fsf.org",
+              ],
+              "documentation_standards": [
+                  "semver.org",
+                  "keepachangelog.com",
+                  "conventionalcommits.org",
+              ],
+              "github_related": [
+                  "github.com",
+                  "api.github.com",
+                  "docs.github.com",
+                  "raw.githubusercontent.com",
+                  "ghcr.io",
+              ],
+              "package_registries": [
+                  "npmjs.com",
+                  "registry.npmjs.org",
+                  "pypi.org",
+                  "files.pythonhosted.org",
+                  "packagist.org",
+                  "repo.packagist.org",
+                  "rubygems.org",
+              ],
+              "standards_organizations": [
+                  "json-schema.org",
+                  "w3.org",
+                  "ietf.org",
+              ],
+              "platform_specific": [
+                  "joomla.org",
+                  "downloads.joomla.org",
+                  "docs.joomla.org",
+                  "php.net",
+                  "getcomposer.org",
+                  "dolibarr.org",
+                  "wiki.dolibarr.org",
+                  "docs.dolibarr.org",
+              ],
+              "moko_consulting": [
+                  "mokoconsulting.tech",
+              ],
+              "google_services": [
+                  "drive.google.com",
+                  "docs.google.com",
+                  "sheets.google.com",
+                  "accounts.google.com",
+                  "storage.googleapis.com",
+                  "fonts.googleapis.com",
+                  "fonts.gstatic.com",
+              ],
+              "github_extended": [
+                  "upload.github.com",
+                  "objects.githubusercontent.com",
+                  "user-images.githubusercontent.com",
+                  "codeload.github.com",
+                  "pkg.github.com",
+              ],
+              "developer_reference": [
+                  "developer.mozilla.org",
+                  "stackoverflow.com",
+                  "git-scm.com",
+              ],
+              "cdn_and_infrastructure": [
+                  "cdn.jsdelivr.net",
+                  "unpkg.com",
+                  "cdnjs.cloudflare.com",
+                  "img.shields.io",
+              ],
+              "container_registries": [
+                  "hub.docker.com",
+                  "registry-1.docker.io",
+              ],
+              "ci_code_quality": [
+                  "codecov.io",
+                  "sonarcloud.io",
+              ],
+              "terraform_infrastructure": [
+                  "registry.terraform.io",
+                  "releases.hashicorp.com",
+                  "checkpoint-api.hashicorp.com",
+              ],
+          }
+
+          # Inject SFTP deployment server as a separate category (port 22, not 443)
+          if SFTP_HOST:
+              TRUSTED_DOMAINS["sftp_deployment_server"] = [SFTP_HOST]
+              print(f"ℹ️  SFTP deployment server: {SFTP_HOST}:{SFTP_PORT}")
+
+          def generate_sftp_iptables_rules(host: str, port: int) -> str:
+              """Generate iptables rules specifically for SFTP egress"""
+              return (
+                  f"# Allow SFTP to deployment server {host}:{port}\n"
+                  f"iptables -A OUTPUT -p tcp -d $(dig +short {host} | head -1)"
+                  f" --dport {port} -j ACCEPT  # SFTP deploy\n"
+              )
+
+          def generate_sftp_ufw_rules(host: str, port: int) -> str:
+              """Generate UFW rules for SFTP egress"""
+              return (
+                  f"# Allow SFTP to deployment server\n"
+                  f"ufw allow out to $(dig +short {host} | head -1)"
+                  f" port {port} proto tcp comment 'SFTP deploy to {host}'\n"
+              )
+
+          def generate_sftp_firewalld_rules(host: str, port: int) -> str:
+              """Generate firewalld rules for SFTP egress"""
+              return (
+                  f"# Allow SFTP to deployment server\n"
+                  f"firewall-cmd --permanent --add-rich-rule='"
+                  f"rule family=ipv4 destination address=$(dig +short {host} | head -1)"
+                  f" port port={port} protocol=tcp accept'  # SFTP deploy\n"
+              )
+
+          def generate_iptables_rules(domains: List[str]) -> str:
+              """Generate iptables firewall rules"""
+              rules = ["#!/bin/bash", "", "# Enterprise Firewall Rules - iptables", ""]
+              rules.append("# Allow outbound HTTPS to trusted domains")
+              rules.append("")
+
+              for domain in domains:
+                  rules.append(f"# Allow {domain}")
+                  rules.append(f"iptables -A OUTPUT -p tcp -d $(dig +short {domain} | head -1) --dport 443 -j ACCEPT")
+
+              rules.append("")
+              rules.append("# Allow DNS lookups")
+              rules.append("iptables -A OUTPUT -p udp --dport 53 -j ACCEPT")
+              rules.append("iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT")
+
+              return "\n".join(rules)
+
+          def generate_ufw_rules(domains: List[str]) -> str:
+              """Generate UFW firewall rules"""
+              rules = ["#!/bin/bash", "", "# Enterprise Firewall Rules - UFW", ""]
+              rules.append("# Allow outbound HTTPS to trusted domains")
+              rules.append("")
+
+              for domain in domains:
+                  rules.append(f"# Allow {domain}")
+                  rules.append(f"ufw allow out to $(dig +short {domain} | head -1) port 443 proto tcp comment 'Allow {domain}'")
+
+              rules.append("")
+              rules.append("# Allow DNS")
+              rules.append("ufw allow out 53/udp comment 'Allow DNS UDP'")
+              rules.append("ufw allow out 53/tcp comment 'Allow DNS TCP'")
+
+              return "\n".join(rules)
+
+          def generate_firewalld_rules(domains: List[str]) -> str:
+              """Generate firewalld rules"""
+              rules = ["#!/bin/bash", "", "# Enterprise Firewall Rules - firewalld", ""]
+              rules.append("# Add trusted domains to firewall")
+              rules.append("")
+
+              for domain in domains:
+                  rules.append(f"# Allow {domain}")
+                  rules.append(f"firewall-cmd --permanent --add-rich-rule='rule family=ipv4 destination address=$(dig +short {domain} | head -1) port port=443 protocol=tcp accept'")
+
+              rules.append("")
+              rules.append("# Reload firewall")
+              rules.append("firewall-cmd --reload")
+
+              return "\n".join(rules)
+
+          def generate_aws_security_group(domains: List[str]) -> Dict:
+              """Generate AWS Security Group rules (JSON format)"""
+              rules = {
+                  "SecurityGroupRules": {
+                      "Egress": []
+                  }
+              }
+
+              for domain in domains:
+                  rules["SecurityGroupRules"]["Egress"].append({
+                      "Description": f"Allow HTTPS to {domain}",
+                      "IpProtocol": "tcp",
+                      "FromPort": 443,
+                      "ToPort": 443,
+                      "CidrIp": "0.0.0.0/0",  # In practice, resolve to specific IPs
+                      "Tags": [{
+                          "Key": "Domain",
+                          "Value": domain
+                      }]
+                  })
+
+              # Add DNS
+              rules["SecurityGroupRules"]["Egress"].append({
+                  "Description": "Allow DNS",
+                  "IpProtocol": "udp",
+                  "FromPort": 53,
+                  "ToPort": 53,
+                  "CidrIp": "0.0.0.0/0"
+              })
+
+              return rules
+
+          def generate_markdown_documentation(domains_by_category: Dict[str, List[str]]) -> str:
+              """Generate markdown documentation"""
+              md = ["# Enterprise Firewall Configuration Guide", ""]
+              md.append("## Overview")
+              md.append("")
+              md.append("This document provides firewall configuration guidance for enterprise-ready deployments.")
+              md.append("It lists trusted domains that should be whitelisted for outbound access to ensure")
+              md.append("proper functionality of license validation, package management, and documentation access.")
+              md.append("")
+
+              md.append("## Trusted Domains by Category")
+              md.append("")
+
+              all_domains = []
+              for category, domains in domains_by_category.items():
+                  category_name = category.replace("_", " ").title()
+                  md.append(f"### {category_name}")
+                  md.append("")
+                  md.append("| Domain | Purpose |")
+                  md.append("|--------|---------|")
+
+                  for domain in domains:
+                      all_domains.append(domain)
+                      purpose = get_domain_purpose(domain)
+                      md.append(f"| `{domain}` | {purpose} |")
+
+                  md.append("")
+
+              md.append("## Implementation Examples")
+              md.append("")
+
+              md.append("### iptables Example")
+              md.append("")
+              md.append("```bash")
+              md.append("# Allow HTTPS to trusted domain")
+              md.append(f"iptables -A OUTPUT -p tcp -d $(dig +short {all_domains[0]}) --dport 443 -j ACCEPT")
+              md.append("```")
+              md.append("")
+
+              md.append("### UFW Example")
+              md.append("")
+              md.append("```bash")
+              md.append("# Allow HTTPS to trusted domain")
+              md.append(f"ufw allow out to {all_domains[0]} port 443 proto tcp")
+              md.append("```")
+              md.append("")
+
+              md.append("### AWS Security Group Example")
+              md.append("")
+              md.append("```json")
+              md.append("{")
+              md.append('  "IpPermissions": [{')
+              md.append('    "IpProtocol": "tcp",')
+              md.append('    "FromPort": 443,')
+              md.append('    "ToPort": 443,')
+              md.append('    "IpRanges": [{"CidrIp": "0.0.0.0/0", "Description": "HTTPS to trusted domains"}]')
+              md.append("  }]")
+              md.append("}")
+              md.append("```")
+              md.append("")
+
+              md.append("## Ports Required")
+              md.append("")
+              md.append("| Port | Protocol | Purpose |")
+              md.append("|------|----------|---------|")
+              md.append("| 443 | TCP | HTTPS (secure web access) |")
+              md.append("| 80 | TCP | HTTP (redirects to HTTPS) |")
+              md.append("| 53 | UDP/TCP | DNS resolution |")
+              md.append("")
+
+              md.append("## Security Considerations")
+              md.append("")
+              md.append("1. **DNS Resolution**: Ensure DNS queries are allowed (port 53 UDP/TCP)")
+              md.append("2. **Certificate Validation**: HTTPS requires ability to reach certificate authorities")
+              md.append("3. **Dynamic IPs**: Some domains use CDNs with dynamic IPs - consider using FQDNs in rules")
+              md.append("4. **Regular Updates**: Review and update whitelist as services change")
+              md.append("5. **Logging**: Enable logging for blocked connections to identify missing rules")
+              md.append("")
+
+              md.append("## Compliance Notes")
+              md.append("")
+              md.append("- All listed domains provide read-only access to public information")
+              md.append("- License providers enable GPL compliance verification")
+              md.append("- Package registries support dependency security scanning")
+              md.append("- No authentication credentials are transmitted to these domains")
+              md.append("")
+
+              return "\n".join(md)
+
+          def get_domain_purpose(domain: str) -> str:
+              """Get human-readable purpose for a domain"""
+              purposes = {
+                  "www.gnu.org": "GNU licenses and documentation",
+                  "opensource.org": "Open Source Initiative resources",
+                  "choosealicense.com": "GitHub license selection tool",
+                  "spdx.org": "Software Package Data Exchange identifiers",
+                  "creativecommons.org": "Creative Commons licenses",
+                  "apache.org": "Apache Software Foundation licenses",
+                  "fsf.org": "Free Software Foundation resources",
+                  "semver.org": "Semantic versioning specification",
+                  "keepachangelog.com": "Changelog format standards",
+                  "conventionalcommits.org": "Commit message conventions",
+                  "github.com": "GitHub platform access",
+                  "api.github.com": "GitHub API access",
+                  "docs.github.com": "GitHub documentation",
+                  "raw.githubusercontent.com": "GitHub raw content access",
+                  "npmjs.com": "npm package registry",
+                  "pypi.org": "Python Package Index",
+                  "packagist.org": "PHP Composer package registry",
+                  "rubygems.org": "Ruby gems registry",
+                  "joomla.org": "Joomla CMS platform",
+                  "php.net": "PHP documentation and downloads",
+                  "dolibarr.org": "Dolibarr ERP/CRM platform",
+              }
+              return purposes.get(domain, "Trusted resource")
+
+          def main():
+              # Use inputs if provided (manual dispatch), otherwise use defaults (auto-run)
+              firewall_type = "${{ github.event.inputs.firewall_type }}" or "all"
+              output_format = "${{ github.event.inputs.output_format }}" or "markdown"
+
+              print(f"Running in {'manual' if '${{ github.event.inputs.firewall_type }}' else 'automatic'} mode")
+              print(f"Firewall type: {firewall_type}")
+              print(f"Output format: {output_format}")
+              print("")
+
+              # Collect all domains
+              all_domains = []
+              for domains in TRUSTED_DOMAINS.values():
+                  all_domains.extend(domains)
+
+              # Remove duplicates and sort
+              all_domains = sorted(set(all_domains))
+
+              print(f"Generating firewall rules for {len(all_domains)} trusted domains...")
+              print("")
+
+              # Exclude SFTP server from HTTPS rule generation (different port)
+              https_domains = [d for d in all_domains if d != SFTP_HOST]
+
+              # Generate based on firewall type
+              if firewall_type in ["iptables", "all"]:
+                  rules = generate_iptables_rules(https_domains)
+                  if SFTP_HOST:
+                      rules += "\n# ── SFTP Deployment Server ──────────────────────────────\n"
+                      rules += generate_sftp_iptables_rules(SFTP_HOST, SFTP_PORT)
+                  with open("firewall-rules-iptables.sh", "w") as f:
+                      f.write(rules)
+                  print("✓ Generated iptables rules: firewall-rules-iptables.sh")
+
+              if firewall_type in ["ufw", "all"]:
+                  rules = generate_ufw_rules(https_domains)
+                  if SFTP_HOST:
+                      rules += "\n# ── SFTP Deployment Server ──────────────────────────────\n"
+                      rules += generate_sftp_ufw_rules(SFTP_HOST, SFTP_PORT)
+                  with open("firewall-rules-ufw.sh", "w") as f:
+                      f.write(rules)
+                  print("✓ Generated UFW rules: firewall-rules-ufw.sh")
+
+              if firewall_type in ["firewalld", "all"]:
+                  rules = generate_firewalld_rules(https_domains)
+                  if SFTP_HOST:
+                      rules += "\n# ── SFTP Deployment Server ──────────────────────────────\n"
+                      rules += generate_sftp_firewalld_rules(SFTP_HOST, SFTP_PORT)
+                  with open("firewall-rules-firewalld.sh", "w") as f:
+                      f.write(rules)
+                  print("✓ Generated firewalld rules: firewall-rules-firewalld.sh")
+
+              if firewall_type in ["aws-security-group", "all"]:
+                  rules = generate_aws_security_group(all_domains)
+                  with open("firewall-rules-aws-sg.json", "w") as f:
+                      json.dump(rules, f, indent=2)
+                  print("✓ Generated AWS Security Group rules: firewall-rules-aws-sg.json")
+
+              if output_format in ["yaml", "all"]:
+                  with open("trusted-domains.yml", "w") as f:
+                      yaml.dump(TRUSTED_DOMAINS, f, default_flow_style=False)
+                  print("✓ Generated YAML domain list: trusted-domains.yml")
+
+              if output_format in ["json", "all"]:
+                  with open("trusted-domains.json", "w") as f:
+                      json.dump(TRUSTED_DOMAINS, f, indent=2)
+                  print("✓ Generated JSON domain list: trusted-domains.json")
+
+              if output_format in ["markdown", "all"]:
+                  md = generate_markdown_documentation(TRUSTED_DOMAINS)
+                  with open("FIREWALL_CONFIGURATION.md", "w") as f:
+                      f.write(md)
+                  print("✓ Generated documentation: FIREWALL_CONFIGURATION.md")
+
+              print("")
+              print("Domain Categories:")
+              for category, domains in TRUSTED_DOMAINS.items():
+                  print(f"  - {category}: {len(domains)} domains")
+
+              print("")
+              print("Total unique domains: ", len(all_domains))
+
+          if __name__ == "__main__":
+              main()
+          PYTHON_EOF
+
+          chmod +x generate_firewall_config.py
+          pip install PyYAML
+          python3 generate_firewall_config.py
+
+      - name: Upload Firewall Configuration Artifacts
+        uses: actions/upload-artifact@v6
+        with:
+          name: firewall-configurations
+          path: |
+            firewall-rules-*.sh
+            firewall-rules-*.json
+            trusted-domains.*
+            FIREWALL_CONFIGURATION.md
+          retention-days: 90
+
+      - name: Display Summary
+        run: |
+          echo "## Firewall Configuration" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "**Mode**: Manual Execution" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Firewall rules have been generated for enterprise-ready deployments." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "**Mode**: Automatic Execution (Coding Agent Active)" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "This workflow ran automatically because a coding agent (GitHub Copilot) is active." >> $GITHUB_STEP_SUMMARY
+            echo "Firewall configuration has been validated for the coding agent environment." >> $GITHUB_STEP_SUMMARY
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Files Generated" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          if ls firewall-rules-* trusted-domains.* FIREWALL_CONFIGURATION.md 2>/dev/null; then
+            ls -lh firewall-rules-* trusted-domains.* FIREWALL_CONFIGURATION.md 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' >> $GITHUB_STEP_SUMMARY
+          else
+            echo "- Documentation generated" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "### Download Artifacts" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Download the generated firewall configurations from the workflow artifacts." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "### Trusted Domains Active" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "The coding agent has access to:" >> $GITHUB_STEP_SUMMARY
+            echo "- License providers (GPL, OSI, SPDX, Apache, etc.)" >> $GITHUB_STEP_SUMMARY
+            echo "- Package registries (npm, PyPI, Packagist, RubyGems)" >> $GITHUB_STEP_SUMMARY
+            echo "- Documentation sources (GitHub, Joomla, Dolibarr, PHP)" >> $GITHUB_STEP_SUMMARY
+            echo "- Standards organizations (W3C, IETF, JSON Schema)" >> $GITHUB_STEP_SUMMARY
+          fi
+
+# Usage Instructions:
+#
+# This workflow runs in two modes:
+#
+# 1. AUTOMATIC MODE (Coding Agent):
+#    - Triggers when coding agent branches (copilot/**, agent/**) are pushed or PR'd
+#    - Validates firewall configuration for the coding agent environment
+#    - Documents accessible domains for compliance
+#    - Ensures license sources and package registries are available
+#
+# 2. MANUAL MODE (Enterprise Configuration):
+#    - Manually trigger from the Actions tab
+#    - Select desired firewall type and output format
+#    - Download generated artifacts
+#    - Apply firewall rules to your enterprise environment
+#
+# Configuration:
+# - Trusted domains are sourced from .github/copilot.yml
+# - Modify copilot.yml to add/remove trusted domains
+# - Changes automatically propagate to firewall rules
+#
+# Important Notes:
+# - Review generated rules before applying to production
+# - Some domains may use CDNs with dynamic IPs
+# - Consider using FQDN-based rules where supported
+# - Test thoroughly in staging environment first
+# - Monitor logs for blocked connections
+# - Update rules as domains/services change
@@ -100,7 +100,6 @@ build/
 dist/
 out/
 site/
-!src/site/
 *.map
 *.css.map
 *.js.map
@@ -187,23 +186,15 @@ venv/
 hypothesis/

 # ============================================================
-# Dolibarr (base + runtime)
+# Joomla Development
 # ============================================================
-documents/
-dolibarr_documents/
-custom/
-uploads/
-thumbs/
-data/
-cache/
-temp/
-tmp/
-logs/
-htdocs/documents/
-htdocs/custom/
-htdocs/cache/
-htdocs/tmp/
-htdocs/logs/
+# Custom user overrides for Joomla development
+user.css
+user.js
+colors_custom.css
+
+# Joomla Module Builder auto-generated files
+modulebuilder.txt

 # ============================================================
 # Joomla Core
@@ -315,7 +306,12 @@ htdocs/logs/
 /administrator/language/en-GB/en-GB.com_wrapper.ini
 /administrator/language/en-GB/en-GB.com_wrapper.sys.ini
 /administrator/language/en-GB/en-GB.ini
+/administrator/language/en-GB/en-GB.lib_fof.ini
+/administrator/language/en-GB/en-GB.lib_fof.sys.ini
 /administrator/language/en-GB/en-GB.lib_joomla.ini
+/administrator/language/en-GB/en-GB.lib_phpass.ini
+/administrator/language/en-GB/en-GB.lib_phpmailer.ini
+/administrator/language/en-GB/en-GB.lib_simplepie.ini
 /administrator/language/en-GB/en-GB.localise.php
 /administrator/language/en-GB/en-GB.mod_custom.ini
 /administrator/language/en-GB/en-GB.mod_custom.sys.ini
@@ -379,6 +375,8 @@ htdocs/logs/
 /administrator/language/en-GB/en-GB.plg_content_contact.sys.ini
 /administrator/language/en-GB/en-GB.plg_content_emailcloak.ini
 /administrator/language/en-GB/en-GB.plg_content_emailcloak.sys.ini
+/administrator/language/en-GB/en-GB.plg_content_example.ini
+/administrator/language/en-GB/en-GB.plg_content_example.sys.ini
 /administrator/language/en-GB/en-GB.plg_content_fields.ini
 /administrator/language/en-GB/en-GB.plg_content_fields.sys.ini
 /administrator/language/en-GB/en-GB.plg_content_finder.ini
@@ -395,6 +393,12 @@ htdocs/logs/
 /administrator/language/en-GB/en-GB.plg_content_pagenavigation.sys.ini
 /administrator/language/en-GB/en-GB.plg_content_vote.ini
 /administrator/language/en-GB/en-GB.plg_content_vote.sys.ini
+/administrator/language/en-GB/en-GB.plg_editors_codemirror.ini
+/administrator/language/en-GB/en-GB.plg_editors_codemirror.sys.ini
+/administrator/language/en-GB/en-GB.plg_editors_none.ini
+/administrator/language/en-GB/en-GB.plg_editors_none.sys.ini
+/administrator/language/en-GB/en-GB.plg_editors_tinymce.ini
+/administrator/language/en-GB/en-GB.plg_editors_tinymce.sys.ini
 /administrator/language/en-GB/en-GB.plg_editors-xtd_article.ini
 /administrator/language/en-GB/en-GB.plg_editors-xtd_article.sys.ini
 /administrator/language/en-GB/en-GB.plg_editors-xtd_contact.ini
@@ -411,12 +415,8 @@ htdocs/logs/
 /administrator/language/en-GB/en-GB.plg_editors-xtd_pagebreak.sys.ini
 /administrator/language/en-GB/en-GB.plg_editors-xtd_readmore.ini
 /administrator/language/en-GB/en-GB.plg_editors-xtd_readmore.sys.ini
-/administrator/language/en-GB/en-GB.plg_editors_codemirror.ini
-/administrator/language/en-GB/en-GB.plg_editors_codemirror.sys.ini
-/administrator/language/en-GB/en-GB.plg_editors_none.ini
-/administrator/language/en-GB/en-GB.plg_editors_none.sys.ini
-/administrator/language/en-GB/en-GB.plg_editors_tinymce.ini
-/administrator/language/en-GB/en-GB.plg_editors_tinymce.sys.ini
+/administrator/language/en-GB/en-GB.plg_extension_example.ini
+/administrator/language/en-GB/en-GB.plg_extension_example.sys.ini
 /administrator/language/en-GB/en-GB.plg_extension_joomla.ini
 /administrator/language/en-GB/en-GB.plg_extension_joomla.sys.ini
 /administrator/language/en-GB/en-GB.plg_fields_calendar.ini
@@ -427,8 +427,6 @@ htdocs/logs/
 /administrator/language/en-GB/en-GB.plg_fields_color.sys.ini
 /administrator/language/en-GB/en-GB.plg_fields_editor.ini
 /administrator/language/en-GB/en-GB.plg_fields_editor.sys.ini
-/administrator/language/en-GB/en-GB.plg_fields_image.ini
-/administrator/language/en-GB/en-GB.plg_fields_image.sys.ini
 /administrator/language/en-GB/en-GB.plg_fields_imagelist.ini
 /administrator/language/en-GB/en-GB.plg_fields_imagelist.sys.ini
 /administrator/language/en-GB/en-GB.plg_fields_integer.ini
@@ -463,16 +461,12 @@ htdocs/logs/
 /administrator/language/en-GB/en-GB.plg_finder_newsfeeds.sys.ini
 /administrator/language/en-GB/en-GB.plg_finder_tags.ini
 /administrator/language/en-GB/en-GB.plg_finder_tags.sys.ini
-/administrator/language/en-GB/en-GB.plg_finder_weblinks.ini
-/administrator/language/en-GB/en-GB.plg_finder_weblinks.sys.ini
 /administrator/language/en-GB/en-GB.plg_installer_folderinstaller.ini
 /administrator/language/en-GB/en-GB.plg_installer_folderinstaller.sys.ini
 /administrator/language/en-GB/en-GB.plg_installer_packageinstaller.ini
 /administrator/language/en-GB/en-GB.plg_installer_packageinstaller.sys.ini
 /administrator/language/en-GB/en-GB.plg_installer_urlinstaller.ini
 /administrator/language/en-GB/en-GB.plg_installer_urlinstaller.sys.ini
-/administrator/language/en-GB/en-GB.plg_installer_webinstaller.ini
-/administrator/language/en-GB/en-GB.plg_installer_webinstaller.sys.ini
 /administrator/language/en-GB/en-GB.plg_privacy_actionlogs.ini
 /administrator/language/en-GB/en-GB.plg_privacy_actionlogs.sys.ini
 /administrator/language/en-GB/en-GB.plg_privacy_consents.ini
@@ -549,29 +543,22 @@ htdocs/logs/
 /administrator/language/en-GB/en-GB.plg_twofactorauth_yubikey.sys.ini
 /administrator/language/en-GB/en-GB.plg_user_contactcreator.ini
 /administrator/language/en-GB/en-GB.plg_user_contactcreator.sys.ini
+/administrator/language/en-GB/en-GB.plg_user_example.ini
+/administrator/language/en-GB/en-GB.plg_user_example.sys.ini
 /administrator/language/en-GB/en-GB.plg_user_joomla.ini
 /administrator/language/en-GB/en-GB.plg_user_joomla.sys.ini
 /administrator/language/en-GB/en-GB.plg_user_profile.ini
 /administrator/language/en-GB/en-GB.plg_user_profile.sys.ini
 /administrator/language/en-GB/en-GB.plg_user_terms.ini
 /administrator/language/en-GB/en-GB.plg_user_terms.sys.ini
-/administrator/language/en-GB/en-GB.tpl_hathor.ini
-/administrator/language/en-GB/en-GB.tpl_hathor.sys.ini
-/administrator/language/en-GB/en-GB.tpl_isis.ini
-/administrator/language/en-GB/en-GB.tpl_isis.sys.ini
 /administrator/language/en-GB/en-GB.xml
-/administrator/language/en-GB/install.xml
-/administrator/language/overrides/*
+/administrator/language/en-GB/index.html
 /administrator/language/index.html
+/administrator/language/overrides/*
 /administrator/logs/*
-/administrator/manifests/files/joomla.xml
-/administrator/manifests/libraries/fof.xml
-/administrator/manifests/libraries/idna_convert.xml
-/administrator/manifests/libraries/joomla.xml
-/administrator/manifests/libraries/phpass.xml
-/administrator/manifests/libraries/phputf8.xml
-/administrator/manifests/packages/pkg_en-GB.xml
-/administrator/manifests/packages/index.html
+/administrator/manifests/files/*
+/administrator/manifests/libraries/*
+/administrator/manifests/packages/*
 /administrator/modules/mod_custom/*
 /administrator/modules/mod_feed/*
 /administrator/modules/mod_latest/*
@@ -608,21 +595,18 @@ htdocs/logs/
 /components/com_finder/*
 /components/com_mailto/*
 /components/com_media/*
-/components/com_menus/*
-/components/com_modules/*
 /components/com_newsfeeds/*
 /components/com_privacy/*
 /components/com_search/*
 /components/com_tags/*
 /components/com_users/*
+/components/com_weblinks/*
 /components/com_wrapper/*
-/components/index.html
 /images/banners/*
 /images/headers/*
+/images/joomla*
 /images/sampledata/*
 /images/index.html
-/images/joomla*
-/images/powered_by.png
 /includes/*
 /installation/*
 /language/en-GB/en-GB.com_ajax.ini
@@ -641,14 +625,12 @@ htdocs/logs/
 /language/en-GB/en-GB.com_weblinks.ini
 /language/en-GB/en-GB.com_wrapper.ini
 /language/en-GB/en-GB.files_joomla.sys.ini
-/language/en-GB/en-GB.finder_cli.ini
 /language/en-GB/en-GB.ini
 /language/en-GB/en-GB.lib_fof.ini
 /language/en-GB/en-GB.lib_fof.sys.ini
 /language/en-GB/en-GB.lib_idna_convert.sys.ini
 /language/en-GB/en-GB.lib_joomla.ini
 /language/en-GB/en-GB.lib_joomla.sys.ini
-/language/en-GB/en-GB.lib_phpass.sys.ini
 /language/en-GB/en-GB.lib_phpmailer.sys.ini
 /language/en-GB/en-GB.lib_phputf8.sys.ini
 /language/en-GB/en-GB.lib_simplepie.sys.ini
@@ -716,13 +698,10 @@ htdocs/logs/
 /language/en-GB/en-GB.tpl_protostar.ini
 /language/en-GB/en-GB.tpl_protostar.sys.ini
 /language/en-GB/en-GB.xml
-/language/en-GB/install.xml
-/language/overrides/*
+/language/en-GB/index.html
 /language/index.html
+/language/overrides/*
 /layouts/joomla/*
-/layouts/libraries/*
-/layouts/plugins/*
-/layouts/index.html
 /libraries/cms/*
 /libraries/fof/*
 /libraries/idna_convert/*
@@ -733,7 +712,6 @@ htdocs/logs/
 /libraries/phpmailer/*
 /libraries/phputf8/*
 /libraries/simplepie/*
-/libraries/src/*
 /libraries/vendor/*
 /libraries/classmap.php
 /libraries/cms.php
@@ -749,8 +727,14 @@ htdocs/logs/
 /media/com_fields/*
 /media/com_finder/*
 /media/com_joomlaupdate/*
+/media/com_mailto/*
+/media/com_media/*
 /media/com_menus/*
 /media/com_modules/*
+/media/com_newsfeeds/*
+/media/com_privacy/*
+/media/com_tags/*
+/media/com_weblinks/*
 /media/com_wrapper/*
 /media/contacts/*
 /media/editors/*
@@ -758,18 +742,18 @@ htdocs/logs/
 /media/mailto/*
 /media/media/*
 /media/mod_languages/*
-/media/mod_sampledata/*
 /media/overrider/*
 /media/plg_captcha_recaptcha/*
 /media/plg_captcha_recaptcha_invisible/*
+/media/plg_editors-xtd_article/*
 /media/plg_quickicon_extensionupdate/*
 /media/plg_quickicon_joomlaupdate/*
 /media/plg_quickicon_privacycheck/*
+/media/plg_system_debug/*
 /media/plg_system_highlight/*
 /media/plg_system_stats/*
 /media/plg_twofactorauth_totp/*
 /media/system/*
-/media/index.html
 /modules/mod_articles_archive/*
 /modules/mod_articles_categories/*
 /modules/mod_articles_category/*
@@ -793,9 +777,9 @@ htdocs/logs/
 /modules/mod_tags_popular/*
 /modules/mod_tags_similar/*
 /modules/mod_users_latest/*
+/modules/mod_weblinks/*
 /modules/mod_whosonline/*
 /modules/mod_wrapper/*
-/modules/index.html
 /plugins/actionlog/joomla/*
 /plugins/authentication/cookie/*
 /plugins/authentication/example/*
@@ -919,5 +903,3 @@ htdocs/logs/
 # Keep-empty folders helper
 # ============================================================
 !.gitkeep
-build/
-dist/
@@ -0,0 +1,20 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# FILE INFORMATION
+# DEFGROUP: MokoStandards.Templates.Config
+# INGROUP: MokoStandards.Templates
+# REPO: https://github.com/mokoconsulting-tech/MokoStandards
+# PATH: /templates/configs/moko-standards.yml
+# VERSION: 04.00.04
+# BRIEF: Governance attachment template — synced to .moko-standards in every governed repository
+# NOTE: Tokens replaced at sync time: mokoconsulting-tech, MokoJoomTOS, waas-component, 04.00.04
+#
+# This file is managed automatically by MokoStandards bulk sync.
+# Do not edit manually — changes will be overwritten on the next sync.
+# To update governance settings, open a PR in MokoStandards instead:
+# https://github.com/mokoconsulting-tech/MokoStandards
+
+standards_source: "https://github.com/mokoconsulting-tech/MokoStandards"
+standards_version: "04.00.04"
+platform: "waas-component"
+governed_repo: "mokoconsulting-tech/MokoJoomTOS"
@@ -0,0 +1,119 @@
+<!--
+ Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+
+ This file is part of a Moko Consulting project.
+
+ SPDX-License-Identifier: GPL-3.0-or-later
+
+ This program is free software; you can redistribute it and/or modify it under the terms of
+ the GNU General Public License as published by the Free Software Foundation; either version 3
+ of the License, or (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
+ without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License (./LICENSE).
+
+ FILE INFORMATION
+ DEFGROUP: mokoconsulting-tech.MokoJoomTOS
+ INGROUP: MokoStandards.Governance
+ REPO: https://github.com/mokoconsulting-tech/MokoJoomTOS
+ VERSION: 04.00.04
+ PATH: /GOVERNANCE.md
+ BRIEF: Project governance rules, roles, and decision process for MokoJoomTOS
+-->
+
+[![MokoStandards](https://img.shields.io/badge/MokoStandards-04.00.04-blue)](https://github.com/mokoconsulting-tech/MokoStandards)
+
+# Project Governance
+
+## Overview
+
+This document defines the governance model for the `MokoJoomTOS` repository within the
+`mokoconsulting-tech` organization. It is automatically maintained by
+[MokoStandards](https://github.com/mokoconsulting-tech/MokoStandards) v04.00.04.
+
+Full governance policy is defined in the MokoStandards source repository:
+[docs/policy/GOVERNANCE.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/GOVERNANCE.md)
+
+---
+
+## Roles and Responsibilities
+
+### Maintainer
+
+**GitHub**: @mokoconsulting-tech
+
+**Authority**: Final decision-making authority on all matters for this repository.
+
+**Responsibilities**:
+- Review and merge pull requests
+- Maintain code quality and standards compliance
+- Manage releases and versioning
+- Respond to issues and security reports
+
+### Contributors
+
+**Authority**: Submit changes via pull requests.
+
+**Requirements**:
+- Read and accept `CODE_OF_CONDUCT.md`
+- Follow `CONTRIBUTING.md` guidelines
+
+---
+
+## Decision-Making
+
+All changes must be submitted as pull requests. The maintainer (@mokoconsulting-tech)
+reviews and approves all changes before they are merged.
+
+### Sole Operator Policy
+
+This organization operates under a **sole operator** model. The maintainer (@mokoconsulting-tech)
+is the sole employee and owner and may self-approve pull requests when no second reviewer is
+available. The following requirements remain mandatory regardless:
+
+1. **Pull Requests Required** — all changes to protected branches go through a PR.
+2. **Automated Checks** — all CI checks must pass before merging.
+3. **Audit Trail** — issues, pull requests, and commit history are preserved.
+4. **Documentation** — changes are documented in `CHANGELOG.md`.
+
+See the full policy:
+[Sole Operator Policy](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/GOVERNANCE.md#sole-operator-policy)
+
+---
+
+## Change Management
+
+| Change Type | Approval | Process |
+|-------------|----------|---------|
+| Routine (docs, bug fixes) | Maintainer | PR → CI pass → merge |
+| Significant (new features) | Maintainer | PR with description → CI pass → merge |
+| Major (breaking, architecture) | Maintainer | Issue discussion → PR → CI pass → merge |
+| Emergency (security) | Maintainer | Labelled `EMERGENCY` → immediate merge → post-mortem |
+
+---
+
+## Reporting Issues
+
+- **Bugs / Features**: Open a [GitHub Issue](https://github.com/mokoconsulting-tech/MokoJoomTOS/issues)
+- **Security vulnerabilities**: See [SECURITY.md](./SECURITY.md)
+- **Code of Conduct**: See [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md)
+- **Contact**: dev@mokoconsulting.tech
+
+---
+
+## Metadata
+
+| Field         | Value                                           |
+| ------------- | ----------------------------------------------- |
+| Document Type | Policy                                          |
+| Domain        | Governance                                      |
+| Applies To    | mokoconsulting-tech/MokoJoomTOS                           |
+| Jurisdiction  | Tennessee, USA                                  |
+| Maintainer    | @mokoconsulting-tech                            |
+| Standards     | MokoStandards v04.00.04            |
+| Repo          | https://github.com/mokoconsulting-tech/MokoJoomTOS        |
+| Path          | /GOVERNANCE.md                                  |
+| Status        | Active — auto-maintained by MokoStandards       |
@@ -1,39 +1,696 @@
-GNU GENERAL PUBLIC LICENSE
-Version 3, 29 June 2007
+<!--	Copyright (C) 2025 Moko Consulting <hello@mokoconsulting.tech>

-Copyright (C) <year>  Free Software Foundation, Inc.  <http://fsf.org/>
-Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
+	This file is part of a Moko Consulting project.

-                    GNU GENERAL PUBLIC LICENSE
-                       Terms and Conditions for Copying, Distribution and Modification
+	SPDX-LICENSE-IDENTIFIER: GPL-3.0-or-later

-  0. This License Agreement applies to any program or other work which contains a notice placed by the copyright holder saying it is governed by this License. Each licensee is addressed as "you".
+	This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.

-  1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program.
+	This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

-  2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:
-    a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change.
-    b) You must keep intact all the notices that refer to this License and to the absence of any warranty.
-    c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else to exit with an error message);
-    d) You must keep intact all the notices that refer to this License and to the absence of any warranty.
-    e) You must not impose any further restrictions on the exercise of the rights granted or affirmed under this License.
+	You should have received a copy of the GNU General Public License (./LICENSE).

-  3. You may copy and distribute the Program (or modified version of it, under the terms of this License), provided that you do not remove or alter any copyright notices, nor create any other legal notices.
+ # FILE INFORMATION
+ DEFGROUP: MokoStandards
+ INGROUP: MokoStandards.Documentation
+ REPO: https://github.com/mokoconsulting-tech/MokoStandards/
+ VERSION: 05.00.00
+ PATH: ./LICENSE
+ BRIEF: Project license (GPL-3.0-or-later)
+ NOTE: Exact text fetched from gnu.org
+-->
+										GNU GENERAL PUBLIC LICENSE
+											 Version 3, 29 June 2007

-  4. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (see Section 8).
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.

-  5. You are not required to accept this License, since you have not signed it.  However, nothing else grants you permission to modify or distribute the Program or its derivative works.  These actions are prohibited by law if you do not accept this License.  Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions.
+														Preamble

-  6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions.  Therefore, you may not impose any further restrictions on the recipients' exercise of the rights granted herein.
+	The GNU General Public License is a free, copyleft license for
+software and other kinds of works.

-  7. This License shall not be interpreted to limit the rights of the recipient of the Program.
+	The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.

-  8. If you are a representative of a company or organization, you may use the Program on behalf of your organization and the organization shall be bound by the terms of this License.
+	When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.

-                      END OF TERMS AND CONDITIONS
+	To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.

-How to apply these terms to your new programs
+	For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.

-If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to do this is to make it free software which everyone can redistribute and change under these terms.  To do so, you should include a copy of this License in each program you distribute.  You should also make sure that everyone else who uses the program is aware that it is governed by these terms, and that they can also do these things.
+	Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+	For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+	Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+	Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+	The precise terms and conditions for copying, distribution and
+modification follow.
+
+											 TERMS AND CONDITIONS
+
+	0. Definitions.
+
+	"This License" refers to version 3 of the GNU General Public License.
+
+	"Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+	"The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+	To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+	A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+	To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+	To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+	An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+	1. Source Code.
+
+	The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+	A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+	The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+	The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+	The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+	The Corresponding Source for a work in source code form is that
+same work.
+
+	2. Basic Permissions.
+
+	All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+	You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+	Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+	3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+	No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+	When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+	4. Conveying Verbatim Copies.
+
+	You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+	You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+	5. Conveying Modified Source Versions.
+
+	You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+		a) The work must carry prominent notices stating that you modified
+		it, and giving a relevant date.
+
+		b) The work must carry prominent notices stating that it is
+		released under this License and any conditions added under section
+		7.  This requirement modifies the requirement in section 4 to
+		"keep intact all notices".
+
+		c) You must license the entire work, as a whole, under this
+		License to anyone who comes into possession of a copy.  This
+		License will therefore apply, along with any applicable section 7
+		additional terms, to the whole of the work, and all its parts,
+		regardless of how they are packaged.  This License gives no
+		permission to license the work in any other way, but it does not
+		invalidate such permission if you have separately received it.
+
+		d) If the work has interactive user interfaces, each must display
+		Appropriate Legal Notices; however, if the Program has interactive
+		interfaces that do not display Appropriate Legal Notices, your
+		work need not make them do so.
+
+	A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+	6. Conveying Non-Source Forms.
+
+	You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+		a) Convey the object code in, or embodied in, a physical product
+		(including a physical distribution medium), accompanied by the
+		Corresponding Source fixed on a durable physical medium
+		customarily used for software interchange.
+
+		b) Convey the object code in, or embodied in, a physical product
+		(including a physical distribution medium), accompanied by a
+		written offer, valid for at least three years and valid for as
+		long as you offer spare parts or customer support for that product
+		model, to give anyone who possesses the object code either (1) a
+		copy of the Corresponding Source for all the software in the
+		product that is covered by this License, on a durable physical
+		medium customarily used for software interchange, for a price no
+		more than your reasonable cost of physically performing this
+		conveying of source, or (2) access to copy the
+		Corresponding Source from a network server at no charge.
+
+		c) Convey individual copies of the object code with a copy of the
+		written offer to provide the Corresponding Source.  This
+		alternative is allowed only occasionally and noncommercially, and
+		only if you received the object code with such an offer, in accord
+		with subsection 6b.
+
+		d) Convey the object code by offering access from a designated
+		place (gratis or for a charge), and offer equivalent access to the
+		Corresponding Source in the same way through the same place at no
+		further charge.  You need not require recipients to copy the
+		Corresponding Source along with the object code.  If the place to
+		copy the object code is a network server, the Corresponding Source
+		may be on a different server (operated by you or a third party)
+		that supports equivalent copying facilities, provided you maintain
+		clear directions next to the object code saying where to find the
+		Corresponding Source.  Regardless of what server hosts the
+		Corresponding Source, you remain obligated to ensure that it is
+		available for as long as needed to satisfy these requirements.
+
+		e) Convey the object code using peer-to-peer transmission, provided
+		you inform other peers where the object code and Corresponding
+		Source of the work are being offered to the general public at no
+		charge under subsection 6d.
+
+	A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+	A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+	"Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+	If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+	The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+	Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+	7. Additional Terms.
+
+	"Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+	When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+	Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+		a) Disclaiming warranty or limiting liability differently from the
+		terms of sections 15 and 16 of this License; or
+
+		b) Requiring preservation of specified reasonable legal notices or
+		author attributions in that material or in the Appropriate Legal
+		Notices displayed by works containing it; or
+
+		c) Prohibiting misrepresentation of the origin of that material, or
+		requiring that modified versions of such material be marked in
+		reasonable ways as different from the original version; or
+
+		d) Limiting the use for publicity purposes of names of licensors or
+		authors of the material; or
+
+		e) Declining to grant rights under trademark law for use of some
+		trade names, trademarks, or service marks; or
+
+		f) Requiring indemnification of licensors and authors of that
+		material by anyone who conveys the material (or modified versions of
+		it) with contractual assumptions of liability to the recipient, for
+		any liability that these contractual assumptions directly impose on
+		those licensors and authors.
+
+	All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+	If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+	Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+	8. Termination.
+
+	You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+	However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+	Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+	Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+	9. Acceptance Not Required for Having Copies.
+
+	You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+	10. Automatic Licensing of Downstream Recipients.
+
+	Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+	An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+	You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+	11. Patents.
+
+	A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+	A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+	Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+	In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+	If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+	If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+	A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+	Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+	12. No Surrender of Others' Freedom.
+
+	If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+	13. Use with the GNU Affero General Public License.
+
+	Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+	14. Revised Versions of this License.
+
+	The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+	Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+	If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+	Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+	15. Disclaimer of Warranty.
+
+	THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+	16. Limitation of Liability.
+
+	IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+	17. Interpretation of Sections 15 and 16.
+
+	If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+										 END OF TERMS AND CONDITIONS
+
+						How to Apply These Terms to Your New Programs
+
+	If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+	To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+		<one line to give the program's name and a brief idea of what it does.>
+		Copyright (C) <year>  <name of author>
+
+		This program is free software: you can redistribute it and/or modify
+	 it under the terms of the GNU General Public License as published by
+		the Free Software Foundation, either version 3 of the License, or
+		(at your option) any later version.
+
+		This program is distributed in the hope that it will be useful,
+		but WITHOUT ANY WARRANTY; without even the implied warranty of
+		MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+		GNU General Public License for more details.
+
+		You should have received a copy of the GNU General Public License
+		along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+	If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+		<program>  Copyright (C) <year>  <name of author>
+		This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+		This is free software, and you are welcome to redistribute it
+		under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+	You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+	The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

-Also, when you incorporate parts of other programs, developers usually find it useful to mention some of the authors of these other programs, so you can do that in the credits or in the network documentation.
@@ -0,0 +1,333 @@
+# Makefile for Joomla Extensions
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This is a reference Makefile for building Joomla extensions.
+# Copy this to your repository root as "Makefile" and customize as needed.
+#
+# Supports: Modules, Plugins, Components, Packages, Templates
+
+# ==============================================================================
+# CONFIGURATION - Customize these for your extension
+# ==============================================================================
+
+# Extension Configuration
+EXTENSION_NAME := mokoexample
+EXTENSION_TYPE := module
+# Options: module, plugin, component, package, template
+EXTENSION_VERSION := 1.0.0
+
+# Module Configuration (for modules only)
+MODULE_TYPE := site
+# Options: site, admin
+
+# Plugin Configuration (for plugins only)
+PLUGIN_GROUP := system
+# Options: system, content, user, authentication, etc.
+
+# Directories
+SRC_DIR := .
+BUILD_DIR := build
+DIST_DIR := dist
+DOCS_DIR := docs
+
+# Joomla Installation (for local testing - customize paths)
+JOOMLA_ROOT := /var/www/html/joomla
+JOOMLA_VERSION := 4
+
+# Tools
+PHP := php
+COMPOSER := composer
+NPM := npm
+PHPCS := vendor/bin/phpcs
+PHPCBF := vendor/bin/phpcbf
+PHPUNIT := vendor/bin/phpunit
+ZIP := zip
+
+# Coding Standards
+PHPCS_STANDARD := Joomla
+
+# Colors for output
+COLOR_RESET := \033[0m
+COLOR_GREEN := \033[32m
+COLOR_YELLOW := \033[33m
+COLOR_BLUE := \033[34m
+COLOR_RED := \033[31m
+
+# ==============================================================================
+# TARGETS
+# ==============================================================================
+
+.PHONY: help
+help: ## Show this help message
+	@echo "$(COLOR_BLUE)╔════════════════════════════════════════════════════════════╗$(COLOR_RESET)"
+	@echo "$(COLOR_BLUE)║            Joomla Extension Makefile                       ║$(COLOR_RESET)"
+	@echo "$(COLOR_BLUE)╚════════════════════════════════════════════════════════════╝$(COLOR_RESET)"
+	@echo ""
+	@echo "Extension: $(EXTENSION_NAME) ($(EXTENSION_TYPE)) v$(EXTENSION_VERSION)"
+	@echo ""
+	@echo "$(COLOR_GREEN)Available targets:$(COLOR_RESET)"
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "  $(COLOR_BLUE)%-20s$(COLOR_RESET) %s\n", $$1, $$2}'
+	@echo ""
+	@echo "$(COLOR_YELLOW)Quick Start:$(COLOR_RESET)"
+	@echo "  1. make install-deps  # Install dependencies"
+	@echo "  2. make build         # Build extension package"
+	@echo "  3. make test          # Run tests"
+	@echo ""
+
+.PHONY: install-deps
+install-deps: ## Install all dependencies (Composer + npm)
+	@echo "$(COLOR_BLUE)Installing dependencies...$(COLOR_RESET)"
+	@if [ -f "composer.json" ]; then \
+		$(COMPOSER) install; \
+		echo "$(COLOR_GREEN)✓ Composer dependencies installed$(COLOR_RESET)"; \
+	fi
+	@if [ -f "package.json" ]; then \
+		$(NPM) install; \
+		echo "$(COLOR_GREEN)✓ npm dependencies installed$(COLOR_RESET)"; \
+	fi
+
+.PHONY: update-deps
+update-deps: ## Update all dependencies
+	@echo "$(COLOR_BLUE)Updating dependencies...$(COLOR_RESET)"
+	@if [ -f "composer.json" ]; then \
+		$(COMPOSER) update; \
+		echo "$(COLOR_GREEN)✓ Composer dependencies updated$(COLOR_RESET)"; \
+	fi
+	@if [ -f "package.json" ]; then \
+		$(NPM) update; \
+		echo "$(COLOR_GREEN)✓ npm dependencies updated$(COLOR_RESET)"; \
+	fi
+
+.PHONY: lint
+lint: ## Run PHP linter (syntax check)
+	@echo "$(COLOR_BLUE)Running PHP linter...$(COLOR_RESET)"
+	@find . -name "*.php" ! -path "./vendor/*" ! -path "./node_modules/*" ! -path "./$(BUILD_DIR)/*" \
+		-exec $(PHP) -l {} \; | grep -v "No syntax errors" || true
+	@echo "$(COLOR_GREEN)✓ PHP linting complete$(COLOR_RESET)"
+
+.PHONY: phpcs
+phpcs: ## Run PHP CodeSniffer (Joomla standards)
+	@echo "$(COLOR_BLUE)Running PHP CodeSniffer...$(COLOR_RESET)"
+	@if [ -f "$(PHPCS)" ]; then \
+		$(PHPCS) --standard=$(PHPCS_STANDARD) --extensions=php --ignore=vendor,node_modules,$(BUILD_DIR) .; \
+	else \
+		echo "$(COLOR_YELLOW)⚠ PHP CodeSniffer not installed. Run: make install-deps$(COLOR_RESET)"; \
+	fi
+
+.PHONY: phpcbf
+phpcbf: ## Fix coding standards automatically
+	@echo "$(COLOR_BLUE)Running PHP Code Beautifier...$(COLOR_RESET)"
+	@if [ -f "$(PHPCBF)" ]; then \
+		$(PHPCBF) --standard=$(PHPCS_STANDARD) --extensions=php --ignore=vendor,node_modules,$(BUILD_DIR) .; \
+		echo "$(COLOR_GREEN)✓ Code formatting applied$(COLOR_RESET)"; \
+	else \
+		echo "$(COLOR_YELLOW)⚠ PHP Code Beautifier not installed. Run: make install-deps$(COLOR_RESET)"; \
+	fi
+
+.PHONY: validate
+validate: lint phpcs ## Run all validation checks
+	@echo "$(COLOR_GREEN)✓ All validation checks passed$(COLOR_RESET)"
+
+.PHONY: test
+test: ## Run PHPUnit tests
+	@echo "$(COLOR_BLUE)Running tests...$(COLOR_RESET)"
+	@if [ -f "$(PHPUNIT)" ] && [ -f "phpunit.xml" ]; then \
+		$(PHPUNIT); \
+	else \
+		echo "$(COLOR_YELLOW)⚠ PHPUnit not configured$(COLOR_RESET)"; \
+	fi
+
+.PHONY: test-coverage
+test-coverage: ## Run tests with coverage report
+	@echo "$(COLOR_BLUE)Running tests with coverage...$(COLOR_RESET)"
+	@if [ -f "$(PHPUNIT)" ] && [ -f "phpunit.xml" ]; then \
+		$(PHPUNIT) --coverage-html $(BUILD_DIR)/coverage; \
+		echo "$(COLOR_GREEN)✓ Coverage report: $(BUILD_DIR)/coverage/index.html$(COLOR_RESET)"; \
+	else \
+		echo "$(COLOR_YELLOW)⚠ PHPUnit not configured$(COLOR_RESET)"; \
+	fi
+
+.PHONY: clean
+clean: ## Clean build artifacts
+	@echo "$(COLOR_BLUE)Cleaning build artifacts...$(COLOR_RESET)"
+	@rm -rf $(BUILD_DIR) $(DIST_DIR)
+	@echo "$(COLOR_GREEN)✓ Build artifacts cleaned$(COLOR_RESET)"
+
+.PHONY: build
+build: clean validate ## Build extension package
+	@echo "$(COLOR_BLUE)Building Joomla extension package...$(COLOR_RESET)"
+	@mkdir -p $(DIST_DIR) $(BUILD_DIR)
+	
+	# Determine package prefix based on extension type
+	@case "$(EXTENSION_TYPE)" in \
+		module) \
+			PACKAGE_PREFIX="mod_$(EXTENSION_NAME)"; \
+			BUILD_TARGET="$(BUILD_DIR)/$$PACKAGE_PREFIX"; \
+			;; \
+		plugin) \
+			PACKAGE_PREFIX="plg_$(PLUGIN_GROUP)_$(EXTENSION_NAME)"; \
+			BUILD_TARGET="$(BUILD_DIR)/$$PACKAGE_PREFIX"; \
+			;; \
+		component) \
+			PACKAGE_PREFIX="com_$(EXTENSION_NAME)"; \
+			BUILD_TARGET="$(BUILD_DIR)/$$PACKAGE_PREFIX"; \
+			;; \
+		package) \
+			PACKAGE_PREFIX="pkg_$(EXTENSION_NAME)"; \
+			BUILD_TARGET="$(BUILD_DIR)/$$PACKAGE_PREFIX"; \
+			;; \
+		template) \
+			PACKAGE_PREFIX="tpl_$(EXTENSION_NAME)"; \
+			BUILD_TARGET="$(BUILD_DIR)/$$PACKAGE_PREFIX"; \
+			;; \
+		*) \
+			echo "$(COLOR_RED)✗ Unknown extension type: $(EXTENSION_TYPE)$(COLOR_RESET)"; \
+			exit 1; \
+			;; \
+	esac; \
+	\
+	mkdir -p "$$BUILD_TARGET"; \
+	\
+	echo "Building $$PACKAGE_PREFIX..."; \
+	\
+	rsync -av --progress \
+		--exclude='$(BUILD_DIR)' \
+		--exclude='$(DIST_DIR)' \
+		--exclude='.git*' \
+		--exclude='vendor/' \
+		--exclude='node_modules/' \
+		--exclude='tests/' \
+		--exclude='Makefile' \
+		--exclude='composer.json' \
+		--exclude='composer.lock' \
+		--exclude='package.json' \
+		--exclude='package-lock.json' \
+		--exclude='phpunit.xml' \
+		--exclude='*.md' \
+		--exclude='.editorconfig' \
+		. "$$BUILD_TARGET/"; \
+	\
+	cd $(BUILD_DIR) && $(ZIP) -r "../$(DIST_DIR)/$${PACKAGE_PREFIX}-$(EXTENSION_VERSION).zip" "$${PACKAGE_PREFIX}"; \
+	\
+	echo "$(COLOR_GREEN)✓ Package created: $(DIST_DIR)/$${PACKAGE_PREFIX}-$(EXTENSION_VERSION).zip$(COLOR_RESET)"
+
+.PHONY: package
+package: build ## Alias for build
+	@echo "$(COLOR_GREEN)✓ Package ready for distribution$(COLOR_RESET)"
+
+.PHONY: install-local
+install-local: build ## Install to local Joomla (upload via admin)
+	@echo "$(COLOR_BLUE)Package ready for installation$(COLOR_RESET)"
+	@case "$(EXTENSION_TYPE)" in \
+		module) PACKAGE="mod_$(EXTENSION_NAME)";; \
+		plugin) PACKAGE="plg_$(PLUGIN_GROUP)_$(EXTENSION_NAME)";; \
+		component) PACKAGE="com_$(EXTENSION_NAME)";; \
+		package) PACKAGE="pkg_$(EXTENSION_NAME)";; \
+		template) PACKAGE="tpl_$(EXTENSION_NAME)";; \
+	esac; \
+	echo "$(COLOR_YELLOW)Upload $(DIST_DIR)/$${PACKAGE}-$(EXTENSION_VERSION).zip via Joomla Administrator$(COLOR_RESET)"; \
+	echo "Admin URL: $(JOOMLA_ROOT) → Extensions → Install"
+
+.PHONY: dev-install
+dev-install: ## Create symlink for development (Joomla 4+)
+	@echo "$(COLOR_BLUE)Creating development symlink...$(COLOR_RESET)"
+	@if [ ! -d "$(JOOMLA_ROOT)" ]; then \
+		echo "$(COLOR_RED)✗ Joomla root not found at $(JOOMLA_ROOT)$(COLOR_RESET)"; \
+		echo "Update JOOMLA_ROOT in Makefile"; \
+		exit 1; \
+	fi
+	
+	@case "$(EXTENSION_TYPE)" in \
+		module) \
+			if [ "$(MODULE_TYPE)" = "admin" ]; then \
+				TARGET="$(JOOMLA_ROOT)/administrator/modules/mod_$(EXTENSION_NAME)"; \
+			else \
+				TARGET="$(JOOMLA_ROOT)/modules/mod_$(EXTENSION_NAME)"; \
+			fi; \
+			;; \
+		plugin) \
+			TARGET="$(JOOMLA_ROOT)/plugins/$(PLUGIN_GROUP)/$(EXTENSION_NAME)"; \
+			;; \
+		component) \
+			echo "$(COLOR_YELLOW)⚠ Components require complex symlink setup$(COLOR_RESET)"; \
+			echo "Manual setup recommended for component development"; \
+			exit 1; \
+			;; \
+		*) \
+			echo "$(COLOR_RED)✗ dev-install not supported for $(EXTENSION_TYPE)$(COLOR_RESET)"; \
+			exit 1; \
+			;; \
+	esac; \
+	\
+	rm -rf "$$TARGET"; \
+	ln -s "$(PWD)" "$$TARGET"; \
+	echo "$(COLOR_GREEN)✓ Development symlink created at $$TARGET$(COLOR_RESET)"
+
+.PHONY: watch
+watch: ## Watch for changes and rebuild
+	@echo "$(COLOR_BLUE)Watching for changes...$(COLOR_RESET)"
+	@echo "$(COLOR_YELLOW)Press Ctrl+C to stop$(COLOR_RESET)"
+	@while true; do \
+		inotifywait -r -e modify,create,delete --exclude '($(BUILD_DIR)|$(DIST_DIR)|vendor|node_modules)' . 2>/dev/null || \
+		(echo "$(COLOR_YELLOW)⚠ inotifywait not installed. Install: apt-get install inotify-tools$(COLOR_RESET)" && sleep 5); \
+		make build; \
+	done
+
+.PHONY: version
+version: ## Display version information
+	@echo "$(COLOR_BLUE)Extension Information:$(COLOR_RESET)"
+	@echo "  Name:    $(EXTENSION_NAME)"
+	@echo "  Type:    $(EXTENSION_TYPE)"
+	@echo "  Version: $(EXTENSION_VERSION)"
+	@if [ "$(EXTENSION_TYPE)" = "module" ]; then \
+		echo "  Module:  $(MODULE_TYPE)"; \
+	fi
+	@if [ "$(EXTENSION_TYPE)" = "plugin" ]; then \
+		echo "  Group:   $(PLUGIN_GROUP)"; \
+	fi
+
+.PHONY: docs
+docs: ## Generate documentation
+	@echo "$(COLOR_BLUE)Generating documentation...$(COLOR_RESET)"
+	@mkdir -p $(DOCS_DIR)
+	@echo "$(COLOR_YELLOW)⚠ Documentation generation not configured$(COLOR_RESET)"
+	@echo "Consider adding phpDocumentor or similar"
+
+.PHONY: release
+release: validate test build ## Create a release (validate + test + build)
+	@echo "$(COLOR_GREEN)✓ Release package ready$(COLOR_RESET)"
+	@echo ""
+	@echo "$(COLOR_BLUE)Release Checklist:$(COLOR_RESET)"
+	@echo "  [ ] Update CHANGELOG.md"
+	@echo "  [ ] Update version in XML manifest"
+	@echo "  [ ] Test installation in clean Joomla"
+	@echo "  [ ] Tag release in git: git tag v$(EXTENSION_VERSION)"
+	@echo "  [ ] Push tags: git push --tags"
+	@echo "  [ ] Create GitHub release"
+	@echo ""
+	@case "$(EXTENSION_TYPE)" in \
+		module) PACKAGE="mod_$(EXTENSION_NAME)";; \
+		plugin) PACKAGE="plg_$(PLUGIN_GROUP)_$(EXTENSION_NAME)";; \
+		component) PACKAGE="com_$(EXTENSION_NAME)";; \
+		package) PACKAGE="pkg_$(EXTENSION_NAME)";; \
+		template) PACKAGE="tpl_$(EXTENSION_NAME)";; \
+	esac; \
+	echo "$(COLOR_GREEN)Package: $(DIST_DIR)/$${PACKAGE}-$(EXTENSION_VERSION).zip$(COLOR_RESET)"
+
+.PHONY: security-check
+security-check: ## Run security checks on dependencies
+	@echo "$(COLOR_BLUE)Running security checks...$(COLOR_RESET)"
+	@if [ -f "composer.json" ]; then \
+		$(COMPOSER) audit || echo "$(COLOR_YELLOW)⚠ Vulnerabilities found$(COLOR_RESET)"; \
+	fi
+	@if [ -f "package.json" ]; then \
+		$(NPM) audit || echo "$(COLOR_YELLOW)⚠ Vulnerabilities found$(COLOR_RESET)"; \
+	fi
+
+.PHONY: all
+all: install-deps validate test build ## Run complete build pipeline
+	@echo "$(COLOR_GREEN)✓ Complete build pipeline finished$(COLOR_RESET)"
+
+# Default target
+.DEFAULT_GOAL := help
@@ -0,0 +1,55 @@
+{
+    "name": "mokoconsulting-tech/mokojoomtos",
+    "description": "MokoJoomTOS Joomla component by Moko Consulting",
+    "type": "joomla-component",
+    "version": "01.00.00",
+    "license": "GPL-3.0-or-later",
+    "authors": [
+        {
+            "name": "Moko Consulting",
+            "email": "hello@mokoconsulting.tech"
+        }
+    ],
+    "minimum-stability": "stable",
+    "prefer-stable": true,
+    "require": {
+        "php": ">=8.1",
+        "mokoconsulting-tech/enterprise": "^4.0"
+    },
+    "require-dev": {
+        "phpunit/phpunit": "^10.5",
+        "phpstan/phpstan": "^2.0",
+        "squizlabs/php_codesniffer": "^4.0"
+    },
+    "autoload": {
+        "psr-4": {
+            "MokoConsulting\\MokoJoomTOS\\": "src/"
+        }
+    },
+    "autoload-dev": {
+        "psr-4": {
+            "MokoConsulting\\MokoJoomTOS\\Tests\\": "tests/"
+        }
+    },
+    "repositories": [
+        {
+            "type": "vcs",
+            "url": "https://github.com/mokoconsulting-tech/MokoStandards"
+        }
+    ],
+    "config": {
+        "sort-packages": true,
+        "optimize-autoloader": true,
+        "preferred-install": "dist",
+        "allow-plugins": {
+            "composer/installers": true
+        }
+    },
+    "scripts": {
+        "validate-manifest": "vendor/bin/validate-manifest --path .",
+        "build":             "vendor/bin/build-package --path .",
+        "test":              "phpunit",
+        "phpcs":             "phpcs --standard=vendor/mokoconsulting-tech/enterprise/phpcs.xml src/",
+        "phpstan":           "phpstan analyse -c phpstan.neon src/"
+    }
+}
@@ -0,0 +1,32 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# PHPStan configuration for Joomla extension repositories.
+# Extends the base MokoStandards config and adds Joomla framework class stubs
+# so PHPStan can resolve Factory, CMSApplication, User, Table, etc.
+# without requiring a full Joomla installation.
+
+parameters:
+    level: 5
+
+    paths:
+        - src
+
+    excludePaths:
+        - vendor
+        - node_modules
+
+    # Joomla framework stubs — resolved via the enterprise package from vendor/
+    stubFiles:
+        - vendor/mokoconsulting-tech/enterprise/templates/stubs/joomla.php
+
+    # Suppress errors that are structural in Joomla's service-container architecture
+    ignoreErrors:
+        # Joomla's service-based dependency injection returns mixed from getApplication()
+        - '#Cannot call method .+ on Joomla\\CMS\\Application\\CMSApplication\|null#'
+        # Factory::getX() patterns are safe at runtime even when nullable in stubs
+        - '#Call to static method [a-zA-Z]+\(\) on an interface#'
+
+    reportUnmatchedIgnoredErrors: false
+    checkMissingIterableValueType: false
+    checkGenericClassInNonGenericObjectType: false
@@ -1,18 +1,34 @@
-<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Joomla Extension Update Server XML
+  See: https://docs.joomla.org/Deploying_an_Update_Server
+
+  This file is the update server manifest for {{EXTENSION_NAME}}.
+  The Joomla installer polls this URL to check for new versions.
+
+  The manifest.xml in this repository must reference this file:
+    <updateservers>
+      <server type="extension" priority="1" name="{{EXTENSION_NAME}}">
+        https://github.com/mokoconsulting-tech/MokoJoomTOS/raw/main/update.xml
+      </server>
+    </updateservers>
+
+  When a new release is made, run `make release` or the release workflow to
+  prepend a new <update> entry to this file automatically.
+-->
 <updates>
-    <update>
-        <name>System - MokoJoomTOS</name>
-        <description>MokoJoomTOS Plugin - Allows Terms of Service to be accessible when site is offline</description>
-        <element>mokojoomtos</element>
-        <type>plugin</type>
-        <folder>system</folder>
-        <client>site</client>
-        <version>03.08.04</version>
-        <infourl title="MokoJoomTOS Plugin">https://github.com/mokoconsulting-tech/MokoJoomTOS</infourl>
-        <downloads>
-            <downloadurl type="full" format="zip">https://github.com/mokoconsulting-tech/MokoJoomTOS/releases/download/v03.08.04/plg_system_mokojoomtos-03.08.04.zip</downloadurl>
-        </downloads>
-        <targetplatform name="joomla" version="(4\.[0-9]|5\.[0-9])" />
-        <php_minimum>7.4.0</php_minimum>
-    </update>
-</updates>
+	<update>
+		<name>{{EXTENSION_NAME}}</name>
+		<description>MokoJoomTOS — Moko Consulting Joomla extension</description>
+		<element>{{EXTENSION_ELEMENT}}</element>
+		<type>{{EXTENSION_TYPE}}</type>
+		<version>{{VERSION}}</version>
+		<infourl title="Release Information">https://github.com/mokoconsulting-tech/MokoJoomTOS/releases/tag/{{VERSION}}</infourl>
+		<downloads>
+			<downloadurl type="full" format="zip">{{DOWNLOAD_URL}}</downloadurl>
+		</downloads>
+		<targetplatform name="joomla" version="4\.[0-9]+" />
+		<php_minimum>7.4</php_minimum>
+		<maintainer>Moko Consulting</maintainer>
+		<maintainerurl>{{MAINTAINER_URL}}</maintainerurl>
+	</update>
+</updates>